[Bug]: disabled_agents not enforced in call_omo_agent tool — disabled agents can still be spawned

[marcoxyz123]

Prerequisites

• I will write this issue in English (see our Language Policy)
• I have searched existing issues to avoid duplicates
• I am using the latest version of oh-my-opencode
• I have read the documentation or asked an AI coding agent with this project's GitHub URL loaded and couldn't find the answer

Bug Description

Hello All

I use OMO on a daily base for my work since 3 weeks now. For all code searches I enforce the usage of the MCP Serena for all Agents to prevent dump grep searches etc. Since the Explorer Agent has hardcoded grep/find. and ignores a AGENT.md I was trying to disable Explore because it is unnecessary in my workflow. But is is not working because of:

disabled_agents: ["explore"] in oh-my-opencode.json does not prevent the explore agent from being spawned via the call_omo_agent tool.

fixing disabled_agents enforcement is the critical bug.

Steps to Reproduce

1. Set "disabled_agents": ["explore"] in ~/.config/opencode/oh-my-opencode.json
2. Send a message containing a search keyword (e.g., "find the auth implementation")

Expected Behavior

Disabled Agents are not spawned anymore.

Actual Behavior

The disabled_agents config is correctly enforced during agent registration in createBuiltinAgents() (line ~62809 in bundled index.js), which filters agents out of the available agent list. However, call_omo_agent has a hardcoded ALLOWED_AGENTS array that includes "explore" and never checks disabled_agents:
// src/tools/call-omo-agent/constants.ts
var ALLOWED_AGENTS = [
"explore",
"librarian",
"oracle",
"hephaestus",
"metis",
"momus",
"multimodal-looker"
];
The execute() function only validates against this static list — it never cross-references the user's disabled_agents config.
The task() tool path (resolveSubagentExecution) does work correctly because it resolves against the live registered agent list, where disabled agents are already filtered out. So task(subagent_type="explore") correctly returns "Unknown agent", but call_omo_agent(subagent_type="explore") happily spawns it.
Reproduction

1. Set "disabled_agents": ["explore"] in ~/.config/opencode/oh-my-opencode.json
2. Enable keyword-detector hook (remove from disabled_hooks)
3. Send a message containing a search keyword (e.g., "find the auth implementation")
4. keyword-detector injects [search-mode] which instructs the agent to spawn explore agents
5. Explore agent is spawned via call_omo_agent despite being in disabled_agents
   Impact
   This forces users who want to disable explore to also disable the entire keyword-detector hook, which takes ultrawork mode activation down with it (since ultrawork detection lives inside keyword-detector). There's no way to get /ulw-loop working properly while keeping explore disabled.
   Suggested Fix
   Pass the disabled_agents config into createCallOmoAgent and check it before execution:
   async execute(args, toolContext) {
   // ...existing validation...
   const normalizedAgent = args.subagent_type.toLowerCase();
   if (disabledAgents.some(name => name.toLowerCase() === normalizedAgent)) {
   return Error: Agent "${args.subagent_type}" is disabled via disabled_agents config.;
   }
   // ...rest of execute...
   }
   This is ~5 lines of change in src/tools/call-omo-agent/tools.ts.
   Optional Enhancement
   Separately, it would be useful to support granular control over keyword-detector sub-detectors, so users can enable ultrawork detection without search/analyze mode:
   hook_options: {
   keyword-detector: {
   disabled_detectors: [search, analyze]
   }
   }

Doctor Output

oMoMoMoMo... Doctor 
Installation
────────────────────────────────────────
  ✓ OpenCode Installation → 1.1.53
  ✓ Plugin Registration → Registered (pinned: 3.4.0)
Configuration
────────────────────────────────────────
  ✓ Configuration Validity → Valid JSON config
  ✓ Model Resolution → 10 agents, 8 categories (16 overrides), 2512 available
Authentication
────────────────────────────────────────
  ✓ Anthropic (Claude) Auth → Auth plugin available
  ○ OpenAI (ChatGPT) Auth → Auth plugin not installed
  ○ Google (Gemini) Auth → Auth plugin not installed
Dependencies
────────────────────────────────────────
  ⚠ AST-Grep CLI → Not installed (optional)
  ⚠ AST-Grep NAPI → Not installed (optional)
  ⚠ Comment Checker → Not installed (optional)
Tools & Servers
────────────────────────────────────────
  ✓ GitHub CLI → 2.85.0 - authenticated as marcoxyz123
  ✓ LSP Servers → 2/4 servers available
  ✓ Built-in MCP Servers → 2 built-in servers enabled
  ○ User MCP Configuration → No user MCP configuration found
  ○ MCP OAuth Tokens → No OAuth tokens configured
Updates
────────────────────────────────────────
  ✓ Version Status → Pinned to version 3.4.0
Summary
────────────────────────────────────────
  9 passed, 0 failed, 3 warnings, 4 skipped
  Total: 16 checks in 2969ms

Error Logs

Configuration

Additional Context

No response

Operating System

macOS

OpenCode Version

1.1.53