From 23ea4a21e09aa02065c7e979b350b355e68d0819 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Thu, 22 Jan 2026 06:03:15 +0000
Subject: [PATCH] fix: skip elevated defaults when not allowed

---
 src/agents/bash-tools.exec.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/agents/bash-tools.exec.ts b/src/agents/bash-tools.exec.ts
index d7aaa218f..1ddcbc913 100644
--- a/src/agents/bash-tools.exec.ts
+++ b/src/agents/bash-tools.exec.ts
@@ -706,6 +706,7 @@ export function createExecTool(
           : clampNumber(params.yieldMs ?? defaultBackgroundMs, defaultBackgroundMs, 10, 120_000)
         : null;
       const elevatedDefaults = defaults?.elevated;
+      const elevatedAllowed = Boolean(elevatedDefaults?.enabled && elevatedDefaults.allowed);
       const elevatedDefaultMode =
         elevatedDefaults?.defaultLevel === "full"
           ? "full"
@@ -714,6 +715,7 @@ export function createExecTool(
             : elevatedDefaults?.defaultLevel === "on"
               ? "ask"
               : "off";
+      const effectiveDefaultMode = elevatedAllowed ? elevatedDefaultMode : "off";
       const elevatedMode =
         typeof params.elevated === "boolean"
           ? params.elevated
@@ -721,7 +723,7 @@ export function createExecTool(
               ? "full"
               : "ask"
             : "off"
-          : elevatedDefaultMode;
+          : effectiveDefaultMode;
       const elevatedRequested = elevatedMode !== "off";
       if (elevatedRequested) {
         if (!elevatedDefaults?.enabled || !elevatedDefaults.allowed) {