fix(core): expect universal default permissions in agent tests

Agent.Info.empty() seeds every agent with baseline { *: allow } and { external_directory: ask } permissions (matching v1, where defaults are merged into every native and custom agent). Update ConfigAgentPlugin tests to expect those defaults, remove a stray debug log left in the config agent plugin, and regenerate the client SDK for the agent.updated event.

packages/client/src/generated/types.ts

@@ -2711,6 +2711,14 @@ export type EventSubscribeOutput =
       readonly location?: { readonly directory: string; readonly workspaceID?: string }
       readonly data: {}
     }
+  | {
+      readonly id: string
+      readonly metadata?: { readonly [x: string]: unknown }
+      readonly type: "agent.updated"
+      readonly durable?: { readonly aggregateID: string; readonly seq: number; readonly version: number }
+      readonly location?: { readonly directory: string; readonly workspaceID?: string }
+      readonly data: {}
+    }
   | {
       readonly id: string
       readonly metadata?: { readonly [x: string]: unknown }

packages/core/src/config/plugin/agent.ts

@@ -60,7 +60,6 @@ export const Plugin = define({
         const configuredDefault = Config.latest(documents, "default_agent")
         if (configuredDefault !== undefined) draft.default(AgentV2.ID.make(configuredDefault))
         for (const current of draft.list()) {
-          yield* Effect.log({ msg: "applying permissions", id: current.id, permissions: global })
           draft.update(current.id, (agent) => agent.permissions.push(...global))
         }
 

packages/core/test/config/agent.test.ts

@@ -77,6 +77,8 @@ describe("ConfigAgentPlugin.Plugin", () => {
       const buildAgent = yield* agents.get(build)
       if (!buildAgent) throw new Error("expected configured build agent")
       expect(buildAgent.permissions).toEqual([
+        { action: "*", resource: "*", effect: "allow" },
+        { action: "external_directory", resource: "*", effect: "ask" },
         { action: "bash", resource: "*", effect: "allow" },
         { action: "bash", resource: "*", effect: "ask" },
         { action: "read", resource: "*", effect: "allow" },
@@ -94,6 +96,8 @@ describe("ConfigAgentPlugin.Plugin", () => {
         model: { providerID: "openrouter", id: "openai/gpt-5", variant: "high" },
       })
       expect(reviewer.permissions).toEqual([
+        { action: "*", resource: "*", effect: "allow" },
+        { action: "external_directory", resource: "*", effect: "ask" },
         { action: "bash", resource: "*", effect: "ask" },
         { action: "read", resource: "*", effect: "allow" },
         { action: "edit", resource: "*", effect: "deny" },
@@ -101,6 +105,8 @@ describe("ConfigAgentPlugin.Plugin", () => {
       ])
       expect(PermissionV2.evaluate("read", "README.md", reviewer.permissions).effect).toBe("deny")
       expect((yield* agents.get(AgentV2.ID.make("late")))?.permissions).toEqual([
+        { action: "*", resource: "*", effect: "allow" },
+        { action: "external_directory", resource: "*", effect: "ask" },
         { action: "bash", resource: "*", effect: "ask" },
         { action: "read", resource: "*", effect: "allow" },
         { action: "edit", resource: "*", effect: "allow" },
@@ -258,13 +264,21 @@ Use native v2 fields.`,
             system: "Review carefully.",
             description: "Markdown description",
             request: { body: { temperature: 0.5 } },
-            permissions: [{ action: "edit", resource: "*", effect: "deny" }],
+            permissions: [
+              { action: "*", resource: "*", effect: "allow" },
+              { action: "external_directory", resource: "*", effect: "ask" },
+              { action: "edit", resource: "*", effect: "deny" },
+            ],
           })
           expect(yield* agents.get(AgentV2.ID.make("team/helper"))).toMatchObject({ system: "Help the team." })
           expect(yield* agents.get(AgentV2.ID.make("native"))).toMatchObject({
             system: "Use native v2 fields.",
             request: { headers: { "x-agent": "native" }, body: { effort: "high" } },
-            permissions: [{ action: "edit", resource: "*", effect: "deny" }],
+            permissions: [
+              { action: "*", resource: "*", effect: "allow" },
+              { action: "external_directory", resource: "*", effect: "ask" },
+              { action: "edit", resource: "*", effect: "deny" },
+            ],
           })
           expect(yield* agents.get(AgentV2.ID.make("disabled"))).toBeUndefined()
           expect(yield* agents.get(AgentV2.ID.make("plan"))).toMatchObject({ system: "Make a plan.", mode: "primary" })