anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-23 02:36:57 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Permission wildcard syntax #1908

New Issue
Closed
opened 2026-02-16 17:33:11 -05:00 by yindo · 10 comments
yindo commented 2026-02-16 17:33:11 -05:00
Owner
Copy Link
Copy Source

Originally created by @paymog on GitHub (Oct 1, 2025).

Originally assigned to: @rekram1-node on GitHub.

What is the exact syntax of the permission wildcard? Is it simple globbing? Is it something else? I see that * is used which looks like a glob but it's not clear exactly how it works.

Originally created by @paymog on GitHub (Oct 1, 2025). Originally assigned to: @rekram1-node on GitHub. What is the exact syntax of the permission wildcard? Is it simple globbing? Is it something else? I see that `*` is used which looks like a glob but it's not clear exactly how it works.
yindo closed this issue 2026-02-16 17:33:11 -05:00
yindo commented 2026-02-16 17:33:11 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Oct 1, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #2208: Support {file:...} references for agent permissions - discusses permission syntax and configuration
  • #2521: Feature Request: Add Prefix Requirements for Permission Prompts - extensive discussion about permission system mechanics and wildcards

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Oct 1, 2025): This issue might be a duplicate of existing issues. Please check: - #2208: Support {file:...} references for agent permissions - discusses permission syntax and configuration - #2521: Feature Request: Add Prefix Requirements for Permission Prompts - extensive discussion about permission system mechanics and wildcards Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:33:11 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Oct 1, 2025):

@paymog it is simple regex globbing: https://github.com/sst/opencode/blob/dev/packages/opencode/src/util/wildcard.ts

• * matches zero or more of any character (including none)
• ? matches exactly one character
• All other characters match literally

For most things you will want to include the "*" examples:

{
  "$schema": "https://opencode.ai/config.json",
  "permission": {
    "bash": {
      "echo *": "ask",
      "?cho *": "ask"
    }
  }
}
@rekram1-node commented on GitHub (Oct 1, 2025): @paymog it is simple regex globbing: https://github.com/sst/opencode/blob/dev/packages/opencode/src/util/wildcard.ts ``` • * matches zero or more of any character (including none) • ? matches exactly one character • All other characters match literally ``` For most things you will want to include the "*" examples: ``` { "$schema": "https://opencode.ai/config.json", "permission": { "bash": { "echo *": "ask", "?cho *": "ask" } } } ```
yindo commented 2026-02-16 17:33:11 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Oct 1, 2025):

obviously that ?cho is dumb but I just wanted to give u an example of something you could do

@rekram1-node commented on GitHub (Oct 1, 2025): obviously that ?cho is dumb but I just wanted to give u an example of something you could do
yindo commented 2026-02-16 17:33:11 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Oct 1, 2025):

also these are my global permissions they are the only ones I use rn:

{
"permission": {
    "bash": {
      "rm *": "ask",
      "sst *": "ask",
      "bun* sst *": "ask",
    },
  },
}
@rekram1-node commented on GitHub (Oct 1, 2025): also these are my global permissions they are the only ones I use rn: ``` { "permission": { "bash": { "rm *": "ask", "sst *": "ask", "bun* sst *": "ask", }, }, } ```
yindo commented 2026-02-16 17:33:11 -05:00
Author
Owner
Copy Link
Copy Source

@paymog commented on GitHub (Oct 1, 2025):

ah super helpful, thank you! I think the docs would benefit from a bit more explanation/examples around this 🙂

@paymog commented on GitHub (Oct 1, 2025): ah super helpful, thank you! I think the docs would benefit from a bit more explanation/examples around this 🙂
yindo commented 2026-02-16 17:33:11 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Oct 1, 2025):

good idea

@rekram1-node commented on GitHub (Oct 1, 2025): good idea
yindo commented 2026-02-16 17:33:11 -05:00
Author
Owner
Copy Link
Copy Source

@paymog commented on GitHub (Oct 1, 2025):

and one more question, if two permissions match the same command, which takes precedence?

Here's my settings

{
  "$schema": "https://opencode.ai/config.json",
  "theme": "opencode",
  "model": "anthropic/claude-sonnet-4-20250514",
  "autoupdate": true,
  "permission": {
    "webfetch": "allow",
    "edit": "allow",
    "bash": {
      "aws * list*": "allow",
      "aws *describe*": "allow",
      "aws *get*": "allow",
      "*": "ask"
    }
  }
}

And opencode is prompting me for approval here, which is unintuitive to me

  ┃                                                                                                                                                                                                                                                                                                                                                                                                                                 ┃
  ┃  Shell Retrieve VPC flow log details including IDs and destinations for production account                                                                                                                                                                                                                                                                                                                                      ┃
  ┃                                                                                                                                                                                                                                                                                                                                                                                                                                 ┃
  ┃  $ aws ec2 describe-flow-logs --profile=prod                                                                                                                                                                                                                                                                                                                                                                                    ┃
  ┃                                                                                                                                                                                                                                                                                                                                                                                                                                 ┃
  ┃                                                                                                                                                                                                                                                                                                                                                                                                                                 ┃
  ┃  Permission required to run this tool:                                                                                                                                                                                                                                                                                                                                                                                          ┃
  ┃                                                                                                                                                                                                                                                                                                                                                                                                                                 ┃
  ┃  enter accept   a accept always   esc reject                                                                                                                                                                                                                                                                                                                                                                                    ┃
@paymog commented on GitHub (Oct 1, 2025): and one more question, if two permissions match the same command, which takes precedence? Here's my settings ``` { "$schema": "https://opencode.ai/config.json", "theme": "opencode", "model": "anthropic/claude-sonnet-4-20250514", "autoupdate": true, "permission": { "webfetch": "allow", "edit": "allow", "bash": { "aws * list*": "allow", "aws *describe*": "allow", "aws *get*": "allow", "*": "ask" } } } ``` And opencode is prompting me for approval here, which is unintuitive to me ``` ┃ ┃ ┃ Shell Retrieve VPC flow log details including IDs and destinations for production account ┃ ┃ ┃ ┃ $ aws ec2 describe-flow-logs --profile=prod ┃ ┃ ┃ ┃ ┃ ┃ Permission required to run this tool: ┃ ┃ ┃ ┃ enter accept a accept always esc reject ┃ ```
yindo commented 2026-02-16 17:33:11 -05:00
Author
Owner
Copy Link
Copy Source

@paymog commented on GitHub (Oct 1, 2025):

oh duh the code is right there. the last match takes precedence so I should move my "*": "ask" rule to the top.

Might be interesting to break out of the loop here on the first match

@paymog commented on GitHub (Oct 1, 2025): oh duh the code is right there. the last match takes precedence so I should move my `"*": "ask"` rule to the top. Might be interesting to break out of the loop [here](https://github.com/sst/opencode/blob/dev/packages/opencode/src/util/wildcard.ts#L23) on the first match
yindo commented 2026-02-16 17:33:12 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Oct 1, 2025):

ah not a bad idea

@rekram1-node commented on GitHub (Oct 1, 2025): ah not a bad idea
yindo commented 2026-02-16 17:33:12 -05:00
Author
Owner
Copy Link
Copy Source

@paymog commented on GitHub (Oct 3, 2025):

ah just realized that the sorting and overall structure of how permissions are declared could make reasoning about rule application ordering kind of hard for users. Looks like it sorts by length of the key. I wonder if it would make more sense to swtich to claude permission structure which is

allow: [x,y,z],
ask: [a,b,c],
deny: [d,e,f]

Then the order of permissions is defined by the user and i guess the intuitive default would be first searching through deny then ask then allow.

@paymog commented on GitHub (Oct 3, 2025): ah just realized that the sorting and overall structure of how permissions are declared could make reasoning about rule application ordering kind of hard for users. Looks like it sorts by length of the key. I wonder if it would make more sense to swtich to claude permission structure which is ``` allow: [x,y,z], ask: [a,b,c], deny: [d,e,f] ``` Then the order of permissions is defined by the user and i guess the intuitive default would be first searching through deny then ask then allow.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#1908
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?