Description

batch resolves executable tools independently from the active turn filter, so batched execution can disagree with the tool set the model actually saw.

Observed failure modes:

• batch can miss model-gated tools such as apply_patch when the active model would expose them
• batch can attempt subcalls that were not exposed in the current turn

This is related to, but distinct from, #16028. That issue is about permission aliasing for apply_patch; this one is about batch drifting from the active turn's model-specific and per-turn-filtered tool set.

Plugins

None

OpenCode version

Current dev branch behavior prior to PR #21366

Steps to reproduce

1. Start a turn where SessionPrompt exposes a filtered tool set to the model
2. Use a GPT-5-style patch flow where apply_patch is available for the active turn
3. Call batch with an apply_patch subcall
4. Observe that batch resolves tools independently from the turn context instead of using the active { providerID, modelID } and turn allowlist

Screenshot and/or share link

N/A

Operating System

Linux

Terminal

bash