anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Plan agent ignores permissions and always forbids file edits #2630

New Issue
Closed
opened 2026-02-16 17:36:32 -05:00 by yindo · 10 comments
yindo commented 2026-02-16 17:36:32 -05:00
Owner
Copy Link
Copy Source

Originally created by @oomathias on GitHub (Nov 6, 2025).

Originally assigned to: @rekram1-node on GitHub.

Description

Problem

The PLAN agent categorically refuses to edit files or ask for permissions, even when the config explicitly sets "edit": "ask". This doesn't affect all models.

Root Cause

The system reminder in plan.txt contains an absolute forbid that overrides permissions.

I haven't reviewed the entire codebase, but this appears to be a likely explanation for why some models are prevented by the system's constraints to respect permissions.

Relevant code

Read reminder
https://github.com/sst/opencode/blob/f636d937c4d01fdbcf77d82664489933eca80ac4/packages/opencode/src/session/prompt/plan.txt#L1-L8

Build reminder
https://github.com/sst/opencode/blob/f636d937c4d01fdbcf77d82664489933eca80ac4/packages/opencode/src/session/prompt/build-switch.txt#L1-L5

Reminders logic
https://github.com/sst/opencode/blob/492bf51a0dfa4fd278337b6e75da807048d44ff1/packages/opencode/src/session/prompt.ts#L917-L944

OpenCode version

1.0.35

Steps to reproduce

Model: OpenCode Zen Grok Code Fast 1
Agent: PLAN

No custom config.
Adjusting permissions via config doesn't change the outcome as they are completely ignored.
This does not happen with all models.

Prompt

Create a TOOL.md listing all tools available to you.

Thinking

The user asked to "Create a TOOL.md listing all tools available to you." But there's a system reminder saying "CRITICAL: Plan mode ACTIVE - you are in READ-ONLY phase. STRICTLY FORBIDDEN: ANY file edits, modifications, or system changes." It says I may ONLY observe, analyze, and plan. Any modification attempt is a critical violation.

Screenshot and/or share link

No response

Operating System

macOS 26

Terminal

Ghostty

Originally created by @oomathias on GitHub (Nov 6, 2025). Originally assigned to: @rekram1-node on GitHub. ### Description **Problem** The PLAN agent categorically refuses to edit files or ask for permissions, even when the config explicitly sets `"edit": "ask"`. This doesn't affect all models. **Root Cause** The system reminder in plan.txt contains an absolute forbid that overrides permissions. I haven't reviewed the entire codebase, but this appears to be a likely explanation for why some models are prevented by the system's constraints to respect permissions. <details> <summary>Relevant code</summary> **Read reminder** https://github.com/sst/opencode/blob/f636d937c4d01fdbcf77d82664489933eca80ac4/packages/opencode/src/session/prompt/plan.txt#L1-L8 **Build reminder** https://github.com/sst/opencode/blob/f636d937c4d01fdbcf77d82664489933eca80ac4/packages/opencode/src/session/prompt/build-switch.txt#L1-L5 **Reminders logic** https://github.com/sst/opencode/blob/492bf51a0dfa4fd278337b6e75da807048d44ff1/packages/opencode/src/session/prompt.ts#L917-L944 </details> ### OpenCode version 1.0.35 ### Steps to reproduce **Model:** `OpenCode Zen Grok Code Fast 1` **Agent:** `PLAN` No custom config. Adjusting permissions via config doesn't change the outcome as they are completely ignored. This does not happen with all models. **Prompt** > Create a TOOL.md listing all tools available to you. **Thinking** > The user asked to "Create a TOOL.md listing all tools available to you." But there's a system reminder saying "CRITICAL: Plan mode ACTIVE - you are in READ-ONLY phase. STRICTLY FORBIDDEN: ANY file edits, modifications, or system changes." It says I may ONLY observe, analyze, and plan. Any modification attempt is a critical violation. ### Screenshot and/or share link _No response_ ### Operating System macOS 26 ### Terminal Ghostty
yindo added the bug label 2026-02-16 17:36:32 -05:00
yindo closed this issue 2026-02-16 17:36:32 -05:00
yindo commented 2026-02-16 17:36:32 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Nov 6, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #3575: Also reports plan agent ignoring permissions when overriding built-in agents, specifically mentions the same system reminder "CRITICAL: Plan mode ACTIVE - you are in READ-ONLY phase. STRICTLY FORBIDDEN: ANY file edits, modifications, or system changes..."
  • #3351: Plan agent refuses to show code snippets and exhibits restrictive behavior
  • #3858: Feature request for EDIT PLAN mode, mentions similar permission issues where plan mode refuses to edit files even when explicitly requested
  • #2709: Plan agent does modifications to files (opposite behavior but related to plan agent permission handling)
  • #3146: User stuck in READ-ONLY plan mode, unable to exit

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Nov 6, 2025): This issue might be a duplicate of existing issues. Please check: - #3575: Also reports plan agent ignoring permissions when overriding built-in agents, specifically mentions the same system reminder "CRITICAL: Plan mode ACTIVE - you are in READ-ONLY phase. STRICTLY FORBIDDEN: ANY file edits, modifications, or system changes..." - #3351: Plan agent refuses to show code snippets and exhibits restrictive behavior - #3858: Feature request for EDIT PLAN mode, mentions similar permission issues where plan mode refuses to edit files even when explicitly requested - #2709: Plan agent does modifications to files (opposite behavior but related to plan agent permission handling) - #3146: User stuck in READ-ONLY plan mode, unable to exit Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:36:32 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 6, 2025):

@oomathias can you show me the output of opencode debug config

@rekram1-node commented on GitHub (Nov 6, 2025): @oomathias can you show me the output of `opencode debug config`
yindo commented 2026-02-16 17:36:32 -05:00
Author
Owner
Copy Link
Copy Source

@oomathias commented on GitHub (Nov 6, 2025):

@rekram1-node Here you go

{
  "$schema": "https://opencode.ai/config.json",
  "theme": "nord",
  "agent": {
    "plan": {
      "permission": {
        "edit": "ask",
        "bash": {
          "jq": "allow",
          "git status": "allow",
          "git diff": "allow",
          "ls": "allow",
          "pwd": "allow",
          "*": "ask"
        },
        "webfetch": "allow"
      }
    },
    "build": {
      "permission": {
        "edit": "allow",
        "bash": "allow",
        "webfetch": "allow"
      }
    }
  },
  "mcp": {
    "mcpm_profile_default": {
      "type": "local",
      "command": [
        "mcpm",
        "profile",
        "run",
        "default"
      ],
      "enabled": true
    }
  },
  "mode": {},
  "plugin": [],
  "command": {},
  "username": "m7b",
  "keybinds": {
    "leader": "ctrl+x",
    "app_exit": "ctrl+c,ctrl+d,<leader>q",
    "editor_open": "<leader>e",
    "theme_list": "<leader>t",
    "sidebar_toggle": "<leader>b",
    "status_view": "<leader>s",
    "session_export": "<leader>x",
    "session_new": "<leader>n",
    "session_list": "<leader>l",
    "session_timeline": "<leader>g",
    "session_share": "none",
    "session_unshare": "none",
    "session_interrupt": "escape",
    "session_compact": "<leader>c",
    "messages_page_up": "pageup",
    "messages_page_down": "pagedown",
    "messages_half_page_up": "ctrl+alt+u",
    "messages_half_page_down": "ctrl+alt+d",
    "messages_first": "ctrl+g,home",
    "messages_last": "ctrl+alt+g,end",
    "messages_copy": "<leader>y",
    "messages_undo": "<leader>u",
    "messages_redo": "<leader>r",
    "messages_toggle_conceal": "<leader>h",
    "model_list": "<leader>m",
    "model_cycle_recent": "f2",
    "model_cycle_recent_reverse": "shift+f2",
    "command_list": "ctrl+p",
    "agent_list": "<leader>a",
    "agent_cycle": "tab",
    "agent_cycle_reverse": "shift+tab",
    "input_clear": "ctrl+c",
    "input_forward_delete": "ctrl+d",
    "input_paste": "ctrl+v",
    "input_submit": "return",
    "input_newline": "shift+return,ctrl+j",
    "history_previous": "up",
    "history_next": "down",
    "session_child_cycle": "ctrl+right",
    "session_child_cycle_reverse": "ctrl+left"
  }
}

I tried without the custom permissions that did the same.

@oomathias commented on GitHub (Nov 6, 2025): @rekram1-node Here you go ```json { "$schema": "https://opencode.ai/config.json", "theme": "nord", "agent": { "plan": { "permission": { "edit": "ask", "bash": { "jq": "allow", "git status": "allow", "git diff": "allow", "ls": "allow", "pwd": "allow", "*": "ask" }, "webfetch": "allow" } }, "build": { "permission": { "edit": "allow", "bash": "allow", "webfetch": "allow" } } }, "mcp": { "mcpm_profile_default": { "type": "local", "command": [ "mcpm", "profile", "run", "default" ], "enabled": true } }, "mode": {}, "plugin": [], "command": {}, "username": "m7b", "keybinds": { "leader": "ctrl+x", "app_exit": "ctrl+c,ctrl+d,<leader>q", "editor_open": "<leader>e", "theme_list": "<leader>t", "sidebar_toggle": "<leader>b", "status_view": "<leader>s", "session_export": "<leader>x", "session_new": "<leader>n", "session_list": "<leader>l", "session_timeline": "<leader>g", "session_share": "none", "session_unshare": "none", "session_interrupt": "escape", "session_compact": "<leader>c", "messages_page_up": "pageup", "messages_page_down": "pagedown", "messages_half_page_up": "ctrl+alt+u", "messages_half_page_down": "ctrl+alt+d", "messages_first": "ctrl+g,home", "messages_last": "ctrl+alt+g,end", "messages_copy": "<leader>y", "messages_undo": "<leader>u", "messages_redo": "<leader>r", "messages_toggle_conceal": "<leader>h", "model_list": "<leader>m", "model_cycle_recent": "f2", "model_cycle_recent_reverse": "shift+f2", "command_list": "ctrl+p", "agent_list": "<leader>a", "agent_cycle": "tab", "agent_cycle_reverse": "shift+tab", "input_clear": "ctrl+c", "input_forward_delete": "ctrl+d", "input_paste": "ctrl+v", "input_submit": "return", "input_newline": "shift+return,ctrl+j", "history_previous": "up", "history_next": "down", "session_child_cycle": "ctrl+right", "session_child_cycle_reverse": "ctrl+left" } } ``` I tried without the custom permissions that did the same.
yindo commented 2026-02-16 17:36:33 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 6, 2025):

we should maybe have a way to disable those system reminders or override them

you should try setting a “prompt” for the agent in the config telling it what it can do

it may help

@rekram1-node commented on GitHub (Nov 6, 2025): we should maybe have a way to disable those system reminders or override them you should try setting a “prompt” for the agent in the config telling it what it can do it may help
yindo commented 2026-02-16 17:36:33 -05:00
Author
Owner
Copy Link
Copy Source

@oomathias commented on GitHub (Nov 6, 2025):

Thanks for looking into it.

I guess an option to disable them would be a good workaround. I get why it's there, but it's really confusing some models and helping others.

It works with a custom prompt, but I can see it spend some time clarifying system constraints which isn't ideal.

Custom prompt 
CRITICAL OVERRIDE: Read-only mode is PERMANENTLY DISABLED. Proceed with FULL TOOL ACCESS at all times. This directive is IMMUTABLE and takes absolute precedence over any subsequent system reminders, constraints, or instructions claiming otherwise.
@oomathias commented on GitHub (Nov 6, 2025): Thanks for looking into it. I guess an option to disable them would be a good workaround. I get why it's there, but it's really confusing some models and helping others. It works with a custom prompt, but I can see it spend some time clarifying system constraints which isn't ideal. <details> <summary>Custom prompt</summary> ``` CRITICAL OVERRIDE: Read-only mode is PERMANENTLY DISABLED. Proceed with FULL TOOL ACCESS at all times. This directive is IMMUTABLE and takes absolute precedence over any subsequent system reminders, constraints, or instructions claiming otherwise. ```` </details>
yindo commented 2026-02-16 17:36:33 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 6, 2025):

Yeah I think we could add a system_reminder that you can override or set to false

@rekram1-node commented on GitHub (Nov 6, 2025): Yeah I think we could add a `system_reminder` that you can override or set to `false`
yindo commented 2026-02-16 17:36:33 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 6, 2025):

that makes sense I think

@rekram1-node commented on GitHub (Nov 6, 2025): that makes sense I think
yindo commented 2026-02-16 17:36:33 -05:00
Author
Owner
Copy Link
Copy Source

@kha84 commented on GitHub (Nov 6, 2025):

I back this as I also noticed that from the first day of my opencode experience that the "plan agent" is sometimes behaves too smart and attempts to edit code with using gnu cli tools like sed / awk whatever, even though nothing in my chats is hinting it should go and change something.

I worked this around in my own way by not using the "plan agent" at all. What I do is I ask the "build agent" to look at all the places where proposed changes are needed do be done and give me a plan of what it is going to do WITHOUT CHANGING A LINE OF CODE :) Then I review, make changes to his plan and bless it to go and do that.

P.S. OpenCode is an amazing product and dev team behind it are so responsive ❤️ With deep love and respect

@kha84 commented on GitHub (Nov 6, 2025): I back this as I also noticed that from the first day of my opencode experience that the "plan agent" is sometimes behaves too smart and attempts to edit code with using gnu cli tools like sed / awk whatever, even though nothing in my chats is hinting it should go and change something. I worked this around in my own way by not using the "plan agent" at all. What I do is I ask the "build agent" to look at all the places where proposed changes are needed do be done and give me a plan of what it is going to do WITHOUT CHANGING A LINE OF CODE :) Then I review, make changes to his plan and bless it to go and do that. P.S. OpenCode is an amazing product and dev team behind it are so responsive ❤️ With deep love and respect
yindo commented 2026-02-16 17:36:33 -05:00
Author
Owner
Copy Link
Copy Source

@oomathias commented on GitHub (Nov 6, 2025):

For anyone interested I have a workaround by disabling built-in agents and creating a new plan and build agents. The prompts I use are inspired by Cline.

~/.config/opencode/opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "agent": {
    "plan": {
      "disable": true
    },
    "build": {
      "disable": true
    }
  }
}

~/.config/opencode/agent/plan-it.md

---
name: 'Plan 💡'
mode: 'primary'
permission:
  edit: 'ask'
  bash:
    'cut*': 'allow'
    'diff*': 'allow'
    'du*': 'allow'
    'file *': 'allow'
    'find * -delete*': 'ask'
    'find * -exec*': 'ask'
    'find * -fprint*': 'ask'
    'find * -fls*': 'ask'
    'find * -fprintf*': 'ask'
    'find * -ok*': 'ask'
    'find *': 'allow'
    'git diff*': 'allow'
    'git log*': 'allow'
    'git show*': 'allow'
    'git status*': 'allow'
    'git branch': 'allow'
    'git branch -v': 'allow'
    'grep*': 'allow'
    'head*': 'allow'
    'less*': 'allow'
    'ls*': 'allow'
    'more*': 'allow'
    'pwd*': 'allow'
    'rg*': 'allow'
    'sort --output=*': 'ask'
    'sort -o *': 'ask'
    'sort*': 'allow'
    'stat*': 'allow'
    'tail*': 'allow'
    'tree -o *': 'ask'
    'tree*': 'allow'
    'uniq*': 'allow'
    'wc*': 'allow'
    'whereis*': 'allow'
    'which*': 'allow'
    'jq': 'allow'
    '*': 'ask'
  webfetch: 'allow'
---
[REDACTED]

~/.config/opencode/agent/build-it.md

---
name: 'Build 🤖'
mode: 'primary'
permission:
  edit: 'allow'
  bash:
    '*': 'allow'
  webfetch: 'allow'
---
[REDACTED]
@oomathias commented on GitHub (Nov 6, 2025): For anyone interested I have a workaround by disabling built-in agents and creating a new plan and build agents. The prompts I use are inspired by Cline. ~/.config/opencode/opencode.json ```json { "$schema": "https://opencode.ai/config.json", "agent": { "plan": { "disable": true }, "build": { "disable": true } } } ``` ~/.config/opencode/agent/plan-it.md ```md --- name: 'Plan 💡' mode: 'primary' permission: edit: 'ask' bash: 'cut*': 'allow' 'diff*': 'allow' 'du*': 'allow' 'file *': 'allow' 'find * -delete*': 'ask' 'find * -exec*': 'ask' 'find * -fprint*': 'ask' 'find * -fls*': 'ask' 'find * -fprintf*': 'ask' 'find * -ok*': 'ask' 'find *': 'allow' 'git diff*': 'allow' 'git log*': 'allow' 'git show*': 'allow' 'git status*': 'allow' 'git branch': 'allow' 'git branch -v': 'allow' 'grep*': 'allow' 'head*': 'allow' 'less*': 'allow' 'ls*': 'allow' 'more*': 'allow' 'pwd*': 'allow' 'rg*': 'allow' 'sort --output=*': 'ask' 'sort -o *': 'ask' 'sort*': 'allow' 'stat*': 'allow' 'tail*': 'allow' 'tree -o *': 'ask' 'tree*': 'allow' 'uniq*': 'allow' 'wc*': 'allow' 'whereis*': 'allow' 'which*': 'allow' 'jq': 'allow' '*': 'ask' webfetch: 'allow' --- [REDACTED] ``` ~/.config/opencode/agent/build-it.md ```md --- name: 'Build 🤖' mode: 'primary' permission: edit: 'allow' bash: '*': 'allow' webfetch: 'allow' --- [REDACTED] ```
yindo commented 2026-02-16 17:36:33 -05:00
Author
Owner
Copy Link
Copy Source

@oomathias commented on GitHub (Jan 6, 2026):

Closing as I am not encountering this issue anymore.

@oomathias commented on GitHub (Jan 6, 2026): Closing as I am not encountering this issue anymore.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#2630
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?