fix(cancel_task): ownership check compares wrong session ID — always unauthorized

[randomm]

Bug

cancel_task always returns unauthorized, even when the same PM session that spawned the task attempts to cancel it. This makes cancel_task completely non-functional in practice.

Root Cause

File: packages/opencode/src/session/async-tasks.ts:582

tryCancel() checks metadata.session_id (the child/subagent session ID) against ctx.sessionID (the caller/PM session ID). These are always different by design — so the check always fails.

// BROKEN — compares child session against parent caller
if (metadata && metadata.session_id !== sessionID)
  return { status: "unauthorized", ... }

At task creation (task.ts:376), both IDs are stored:

• session_id → the spawned child/subagent session
• parent_session_id → the PM/caller session (= ctx.sessionID)

The ownership check should use parent_session_id, not session_id. list_tasks.ts:51 already does this correctly — the inconsistency between the two tools confirms this is the bug.

Fix

One-line change in async-tasks.ts:582:

// BEFORE (wrong):
if (metadata && metadata.session_id !== sessionID)

// AFTER (correct):
if (metadata && metadata.parent_session_id !== sessionID)

Is this a regression from permission-bubbling (#187)?

No — pre-existing bug unrelated to permission-bubbling. The permission-bubbling feature controls which agents can spawn tasks; it does not affect task ownership/cancellation logic.

Tasks

• Fix async-tasks.ts:582: change session_id → parent_session_id in tryCancel()
• Verify cancel_task.test.ts covers the PM-cancels-own-task scenario; add test if missing
• bun run typecheck passes (0 errors)
• bun test passes (0 failures)
• Local verification complete before push

References

• packages/opencode/src/session/async-tasks.ts:582 — broken ownership check
• packages/opencode/src/tool/task.ts:376 — where session_id and parent_session_id are stored
• packages/opencode/src/tool/cancel_task.ts:30 — passes ctx.sessionID to tryCancel()
• packages/opencode/src/tool/list_tasks.ts:51 — correctly uses parent_session_id (reference impl)

[randomm]

Resolved by PR #227.