anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

agent always using cd [cwd] && .... even when cd isn't needed #3251

New Issue
Open
opened 2026-02-16 17:39:20 -05:00 by yindo · 9 comments
yindo commented 2026-02-16 17:39:20 -05:00
Owner
Copy Link
Copy Source

Originally created by @benceferdinandy-signifyd on GitHub (Dec 2, 2025).

Originally assigned to: @rekram1-node on GitHub.

Description

The bash tool has this prompt

"Try to maintain your current working directory throughout the session by using absolute paths and avoiding usage of cd. You may use cd if the User explicitly requests it."

On the other hand I basically almost always see Anthropic models (I don't use anything else tbh), to run bash with cd [cwd] && actual tool. Since e.g. subagents do not get cd permissions, things stop. I think this prohibition needs to be worded more strongly or worked around some other way.

OpenCode version

1.0.122

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

MacOS

Terminal

Ghostty

Originally created by @benceferdinandy-signifyd on GitHub (Dec 2, 2025). Originally assigned to: @rekram1-node on GitHub. ### Description The bash tool has this prompt > "Try to maintain your current working directory throughout the session by using absolute paths and avoiding usage of cd. You may use cd if the User explicitly requests it." On the other hand I basically almost always see Anthropic models (I don't use anything else tbh), to run bash with `cd [cwd] && actual tool`. Since e.g. subagents do not get `cd` permissions, things stop. I think this prohibition needs to be worded more strongly or worked around some other way. ### OpenCode version 1.0.122 ### Steps to reproduce _No response_ ### Screenshot and/or share link _No response_ ### Operating System MacOS ### Terminal Ghostty
yindo added the bug label 2026-02-16 17:39:20 -05:00
yindo commented 2026-02-16 17:39:20 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Dec 2, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #4066: Subagent doesn't ask permission when executing bash commands - directly related to the permission issue with subagents running bash
  • #4642: Permission system broken - discusses how agents use bash as a workaround to bypass permission restrictions
  • #4267: [bug] Restrict which subagents a custom agent can spawn - related concern about subagent permission restrictions
  • #3808: Task should inherit current agent permissions/tools for MCP - related to permission inheritance in delegated tasks

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Dec 2, 2025): This issue might be a duplicate of existing issues. Please check: - #4066: Subagent doesn't ask permission when executing bash commands - directly related to the permission issue with subagents running bash - #4642: Permission system broken - discusses how agents use bash as a workaround to bypass permission restrictions - #4267: [bug] Restrict which subagents a custom agent can spawn - related concern about subagent permission restrictions - #3808: Task should inherit current agent permissions/tools for MCP - related to permission inheritance in delegated tasks Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:39:20 -05:00
Author
Owner
Copy Link
Copy Source

@ariane-emory commented on GitHub (Dec 2, 2025):

Try using some RFC2119 language like SHOULD and MUST NOT, Claude responds well to that.

@ariane-emory commented on GitHub (Dec 2, 2025): Try using some RFC2119 language like `SHOULD` and `MUST NOT`, Claude responds well to that.
yindo commented 2026-02-16 17:39:20 -05:00
Author
Owner
Copy Link
Copy Source

@benceferdinandy-signifyd commented on GitHub (Dec 2, 2025):

Try using some RFC2119 language like SHOULD and MUST NOT, Claude responds well to that.

I mean this is what is in the codebase currently. You think upgrading the prompt with these would be enough? I have a vague feeling that the issue is that the LLM sees something like ~/project and thinks it needs to cd to /Users/myuser/project.

@benceferdinandy-signifyd commented on GitHub (Dec 2, 2025): > Try using some RFC2119 language like `SHOULD` and `MUST NOT`, Claude responds well to that. I mean this is what is in the codebase currently. You think upgrading the prompt with these would be enough? I have a vague feeling that the issue is that the LLM sees something like `~/project` and thinks it needs to cd to `/Users/myuser/project`.
yindo commented 2026-02-16 17:39:21 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 2, 2025):

Just so i understand, what makes permissions useless exactly? And is this with subagents you wrote that have bash tool enabled but cd is blocked? Or what

@rekram1-node commented on GitHub (Dec 2, 2025): Just so i understand, what makes permissions useless exactly? And is this with subagents you wrote that have bash tool enabled but cd is blocked? Or what
yindo commented 2026-02-16 17:39:21 -05:00
Author
Owner
Copy Link
Copy Source

@benceferdinandy-signifyd commented on GitHub (Dec 2, 2025):

Just so i understand, what makes permissions useless exactly? And is this with subagents you wrote that have bash tool enabled but cd is blocked? Or what

Yeah, I generally do not give cd permissions to subagents (I mean it's easy to work around that, but still, on principle I only give permission that I think is required). And since cd now needs me to allow it basically can't run anything alone.

But as far as I see, the current built-in prompt is actually trying to discourage the AI to prepend cd, it just doesn't seem to work at all. The main agent also always does that.

(it also always makes commands harder to read)

@benceferdinandy-signifyd commented on GitHub (Dec 2, 2025): > Just so i understand, what makes permissions useless exactly? And is this with subagents you wrote that have bash tool enabled but cd is blocked? Or what Yeah, I generally do not give `cd` permissions to subagents (I mean it's easy to work around that, but still, on principle I only give permission that I think is required). And since `cd` now needs me to allow it basically can't run anything alone. But as far as I see, the current built-in prompt is actually trying to discourage the AI to prepend `cd`, it just doesn't seem to work at all. The main agent also always does that. (it also always makes commands harder to read)
yindo commented 2026-02-16 17:39:21 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 2, 2025):

Okay I see, now I will note that if the agent tries to cd into a dir outside cwd, we prompt you for permission anyways, so I dont know if you need to blacklist cd

But I agree, the agent doesnt seem aware enough of cwd and thats something ive noticed as well

@rekram1-node commented on GitHub (Dec 2, 2025): Okay I see, now I will note that if the agent tries to cd into a dir outside cwd, we prompt you for permission anyways, so I dont know if you need to blacklist cd But I agree, the agent doesnt seem aware enough of cwd and thats something ive noticed as well
yindo commented 2026-02-16 17:39:21 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 2, 2025):

we have an external_directory permission so that when an agent tries to access files outside cwd via cd or other tools, we ask user for permission before proceeding

@rekram1-node commented on GitHub (Dec 2, 2025): we have an external_directory permission so that when an agent tries to access files outside cwd via cd or other tools, we ask user for permission before proceeding
yindo commented 2026-02-16 17:39:21 -05:00
Author
Owner
Copy Link
Copy Source

@benceferdinandy-signifyd commented on GitHub (Dec 2, 2025):

we have an external_directory permission so that when an agent tries to access files outside cwd via cd or other tools, we ask user for permission before proceeding

that makes sense absolutely, my problem is with cd that is seemingly completely unnecessary

@benceferdinandy-signifyd commented on GitHub (Dec 2, 2025): > we have an external_directory permission so that when an agent tries to access files outside cwd via cd or other tools, we ask user for permission before proceeding that makes sense absolutely, my problem is with cd that is seemingly completely unnecessary
yindo commented 2026-02-16 17:39:21 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 2, 2025):

Yeah we are on same page there, it's so annoying that it always does that. I literally have a note on my desk:

Make agent more aware of cwd.

So I'll do some stuff to address that very soon :)

@rekram1-node commented on GitHub (Dec 2, 2025): Yeah we are on same page there, it's so annoying that it always does that. I literally have a note on my desk: Make agent more aware of cwd. So I'll do some stuff to address that very soon :)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#3251
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?