anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

unexpected system prompt parts despite disabling default agent(s) #3270

New Issue
Closed
opened 2026-02-16 17:39:25 -05:00 by yindo · 11 comments
yindo commented 2026-02-16 17:39:25 -05:00
Owner
Copy Link
Copy Source

Originally created by @taqtiqa-mark on GitHub (Dec 2, 2025).

Originally assigned to: @rekram1-node on GitHub.

Description

Environment

  • OpenCode version: v1.0.128
  • Operating System: Linux (Debian Testing)
  • Installation: Containerized setup via curl script
  • Mode: TUI (no serve-attach)
  • Configuration: Relevant agent settings as follows (with Plan, Build, and General agents disabled):
  "agent": {
    // Example agent:
    "driven": {
      "disable": false
    },
    "research": {
      "disable": false
    },
    "knowledge-synthesizer": {
      "disable": false
    },
     "plan": {
      "disable": true
    },
    "build": {
      "disable": true
    },
     "general": {
      "disable": true
    }
  },
  • Note: The "driven" agent is a custom implementation that does not identify itself as "opencode."

Steps to Reproduce

  1. Configure OpenCode with the above agent settings, ensuring Plan, Build, and General agents are disabled.
  2. Start OpenCode in TUI mode.
  3. Initiate interaction with the LLM by entering a simple prompt, such as "Hello? Grok?" (or any initial query without specifying a custom prompt).

Expected Behavior

With the Plan, Build, and General agents disabled, the LLM should respond without any injected system prompts or self-identification as "opencode." Instead, it should provide the default response from the underlying LLM provider, free from any developer-imposed modifications or injections.

Actual Behavior

Upon initial interaction (e.g., "Hello? Grok?"), the LLM responds with:

Hello! I'm opencode, and AI coding assistant. How can I help with your software project? Type `/help` for usage info.

This indicates an unintended background prompt injection that overrides the configuration, forcing the LLM to identify as "opencode" despite the disabled agents intended to prevent such defaults.

Impact

This behavior undermines user control over the LLM's prompting, introducing unexpected modifications that could alter responses in unintended ways. It represents a potential security flaw, as users cannot reliably prevent developer-injected prompts from influencing their workflow, which may lead to privacy concerns, inconsistent outputs, or exposure to unconfigurable biases. In environments requiring strict prompt hygiene (e.g., custom agent integrations), this erodes trust in the tool's configurability.

Suggested Resolution

Ensure that disabling the Plan, Build, and General agents fully eliminates default prompt injections, allowing the LLM to revert to its provider's raw behavior. Consider adding explicit configuration options for system prompt overrides or a "raw mode" to give users granular control. This would enhance security and align with principles of user autonomy in AI tools.

OpenCode version

v1.0.128

Steps to reproduce

See above.

Screenshot and/or share link

NA

Operating System

Linux (Debian Testing)

Terminal

Alacritty+Zellij

Originally created by @taqtiqa-mark on GitHub (Dec 2, 2025). Originally assigned to: @rekram1-node on GitHub. ## Description ### Environment - OpenCode version: v1.0.128 - Operating System: Linux (Debian Testing) - Installation: Containerized setup via curl script - Mode: TUI (no serve-attach) - Configuration: Relevant agent settings as follows (with Plan, Build, and General agents disabled): ```jsonc "agent": { // Example agent: "driven": { "disable": false }, "research": { "disable": false }, "knowledge-synthesizer": { "disable": false }, "plan": { "disable": true }, "build": { "disable": true }, "general": { "disable": true } }, ``` - Note: The "driven" agent is a custom implementation that does not identify itself as "opencode." ### Steps to Reproduce 1. Configure OpenCode with the above agent settings, ensuring Plan, Build, and General agents are disabled. 2. Start OpenCode in TUI mode. 3. Initiate interaction with the LLM by entering a simple prompt, such as "Hello? Grok?" (or any initial query without specifying a custom prompt). ### Expected Behavior With the Plan, Build, and General agents disabled, the LLM should respond without any injected system prompts or self-identification as "opencode." Instead, it should provide the default response from the underlying LLM provider, free from any developer-imposed modifications or injections. #### Actual Behavior Upon initial interaction (e.g., "Hello? Grok?"), the LLM responds with: ``` Hello! I'm opencode, and AI coding assistant. How can I help with your software project? Type `/help` for usage info. ``` This indicates an unintended background prompt injection that overrides the configuration, forcing the LLM to identify as "opencode" despite the disabled agents intended to prevent such defaults. ### Impact This behavior undermines user control over the LLM's prompting, introducing unexpected modifications that could alter responses in unintended ways. It represents a potential security flaw, as users cannot reliably prevent developer-injected prompts from influencing their workflow, which may lead to privacy concerns, inconsistent outputs, or exposure to unconfigurable biases. In environments requiring strict prompt hygiene (e.g., custom agent integrations), this erodes trust in the tool's configurability. ### Suggested Resolution Ensure that disabling the Plan, Build, and General agents fully eliminates default prompt injections, allowing the LLM to revert to its provider's raw behavior. Consider adding explicit configuration options for system prompt overrides or a "raw mode" to give users granular control. This would enhance security and align with principles of user autonomy in AI tools. ### OpenCode version v1.0.128 ### Steps to reproduce See above. ### Screenshot and/or share link NA ### Operating System Linux (Debian Testing) ### Terminal Alacritty+Zellij
yindo added the bug label 2026-02-16 17:39:25 -05:00
yindo closed this issue 2026-02-16 17:39:26 -05:00
yindo commented 2026-02-16 17:39:26 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Dec 2, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #3895: Built-in agent overrides don't fully apply
  • #4578: OpenCode GitHub Actions can't work with disabled default agents
  • #3575: BUG: Overriding built-in agents, doesn't allow overriding permissions
  • #3991: Plan agent ignores permissions and always forbids file edits
  • #1894: add optional system prompt environment injection

These issues all relate to the core problem: system prompts and agent identification are being injected despite configuration attempting to disable or override them. The root cause appears to be that the system prompt injection mechanism doesn't fully respect agent disable configurations.

Feel free to ignore if your specific case differs, but checking these would help determine if this is a known limitation or a related but distinct issue.

@github-actions[bot] commented on GitHub (Dec 2, 2025): This issue might be a duplicate of existing issues. Please check: - #3895: Built-in agent overrides don't fully apply - #4578: OpenCode GitHub Actions can't work with disabled default agents - #3575: BUG: Overriding built-in agents, doesn't allow overriding permissions - #3991: Plan agent ignores permissions and always forbids file edits - #1894: add optional system prompt environment injection These issues all relate to the core problem: system prompts and agent identification are being injected despite configuration attempting to disable or override them. The root cause appears to be that the system prompt injection mechanism doesn't fully respect agent disable configurations. Feel free to ignore if your specific case differs, but checking these would help determine if this is a known limitation or a related but distinct issue.
yindo commented 2026-02-16 17:39:26 -05:00
Author
Owner
Copy Link
Copy Source

@taqtiqa-mark commented on GitHub (Dec 3, 2025):

@rekram1-node , can you clarify what would be a security issue?
In many contexts, prompt injection is a security breach. Example, a org (say bank) has it's own strict prompts that prohibit PII data being accessed, simulated or hypothesized.

Over riding those is a critical incident, generally you'd be expected to report the incident to the relevant authority/regulator...

@taqtiqa-mark commented on GitHub (Dec 3, 2025): @rekram1-node , can you clarify what would be a security issue? In many contexts, prompt injection is a security breach. Example, a org (say bank) has it's own strict prompts that prohibit PII data being accessed, simulated or hypothesized. Over riding those is a critical incident, generally you'd be expected to report the incident to the relevant authority/regulator...
yindo commented 2026-02-16 17:39:26 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 3, 2025):

I wouldn't classify this as a security issue because we intentionally include system prompts about opencode itself in many cases, this seems like it is either a bug or something isn't clear to the end user.

I don't think it's a security vulnerability that opencode includes a prompt informing an agent that it is opencode, now if there is some bug in terms of agent resolution maybe it could be classified under that but from what i read that didn't seem to be the case.

Can you share your agent definition? So we can get to the bottom of it?

@rekram1-node commented on GitHub (Dec 3, 2025): I wouldn't classify this as a security issue because we intentionally include system prompts about opencode itself in many cases, this seems like it is either a bug or something isn't clear to the end user. I don't think it's a security vulnerability that opencode includes a prompt informing an agent that it is opencode, now if there is some bug in terms of agent resolution maybe it could be classified under that but from what i read that didn't seem to be the case. Can you share your agent definition? So we can get to the bottom of it?
yindo commented 2026-02-16 17:39:26 -05:00
Author
Owner
Copy Link
Copy Source

@taqtiqa-mark commented on GitHub (Dec 3, 2025):

we intentionally include system prompts about opencode itself in many cases

Understood. My understanding is that OC intends to give users full control over their prompt context. Of course you can make a different choice, no argument there.

With that understanding,

I don't think it's a security vulnerability that opencode includes a prompt informing an agent that it is opencode

Agreed, if that is what happened in a default configuration... it would not be a bug/incident.

However, the bug, which is the security incident, is that default prompts were disabled. Yet still a OC developer prompt was injected into my workflow.

Can you share your agent definition? So we can get to the bottom of it?

Sure. I've really struggled to work out the OC prompt heirachy. Can you tell me what log entries constitute the sequence of prompts that make up an "agent definition", and I can filter out that sequence of messages. Or what files make up that definition. For example there are AGENTS.md, at different levels, which can't be violated, etc. etc.

Perhaps this can be documented?

@taqtiqa-mark commented on GitHub (Dec 3, 2025): > we intentionally include system prompts about opencode itself in many cases Understood. My understanding is that OC intends to give users full control over their prompt context. Of course you can make a different choice, no argument there. With that understanding, > I don't think it's a security vulnerability that opencode includes a prompt informing an agent that it is opencode Agreed, if that is what happened in a default configuration... it would not be a bug/incident. However, the bug, which is the security incident, is that default prompts were disabled. Yet still a OC developer prompt was injected into my workflow. > Can you share your agent definition? So we can get to the bottom of it? Sure. I've really struggled to work out the OC prompt heirachy. Can you tell me what log entries constitute the sequence of prompts that make up an "agent definition", and I can filter out that sequence of messages. Or what files make up that definition. For example there are AGENTS.md, at different levels, which can't be violated, etc. etc. Perhaps this can be documented?
yindo commented 2026-02-16 17:39:26 -05:00
Author
Owner
Copy Link
Copy Source

@taqtiqa-mark commented on GitHub (Dec 3, 2025):

However, the bug, which is the security incident, is that default prompts were disabled. Yet still a OC developer prompt was injected into my workflow.

Of course, if OC does NOT intend to give users full control over their workflow/prompt/context, then this is a non-issue and could be closed.

@taqtiqa-mark commented on GitHub (Dec 3, 2025): > However, the bug, which is the security incident, is that default prompts were disabled. Yet still a OC developer prompt was injected into my workflow. Of course, if OC does NOT intend to give users full control over their workflow/prompt/context, then this is a non-issue and could be closed.
yindo commented 2026-02-16 17:39:26 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 3, 2025):

Yes we DO want to give full control for sure, I think the issue is currently there are things we inject regardless of your setup. Also note that AGENTS.md will always be included in prompts currently

And I totally agree we need better docs too

@rekram1-node commented on GitHub (Dec 3, 2025): Yes we DO want to give full control for sure, I think the issue is currently there are things we inject regardless of your setup. Also note that AGENTS.md will always be included in prompts currently And I totally agree we need better docs too
yindo commented 2026-02-16 17:39:26 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 3, 2025):

You are covering some of this ground before most so as you run into things such as this, we will fix them up, ideally anything basically should be entirely in your control. Rn that isn't the case but we wanna get there

@rekram1-node commented on GitHub (Dec 3, 2025): You are covering some of this ground before most so as you run into things such as this, we will fix them up, ideally anything basically should be entirely in your control. Rn that isn't the case but we wanna get there
yindo commented 2026-02-16 17:39:26 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Dec 3, 2025):

Not docs but just to shed some light on how stuff works we have this system.ts file that resolves system prompts:
https://github.com/sst/opencode/blob/dev/packages/opencode/src/session/system.ts

And then this is where we build the finalized prompt:
https://github.com/sst/opencode/blob/32b5db754e948e010db8b010ba26d3331a747d77/packages/opencode/src/session/prompt.ts#L639

So if you have a custom agent prompt the only additional things being injected (unless you are using Anthropic) are:
system.push(...(await SystemPrompt.environment()))
system.push(...(await SystemPrompt.custom()))

custom is AGENTS.md files (and "instructions": [...] defined in your config if any)

environment is file tree, git dir, some other metadata about cwd

@rekram1-node commented on GitHub (Dec 3, 2025): Not docs but just to shed some light on how stuff works we have this system.ts file that resolves system prompts: https://github.com/sst/opencode/blob/dev/packages/opencode/src/session/system.ts And then this is where we build the finalized prompt: https://github.com/sst/opencode/blob/32b5db754e948e010db8b010ba26d3331a747d77/packages/opencode/src/session/prompt.ts#L639 So if you have a custom agent prompt the only additional things being injected (unless you are using Anthropic) are: system.push(...(await SystemPrompt.environment())) system.push(...(await SystemPrompt.custom())) custom is AGENTS.md files (and "instructions": [...] defined in your config if any) environment is file tree, git dir, some other metadata about cwd
yindo commented 2026-02-16 17:39:26 -05:00
Author
Owner
Copy Link
Copy Source

@taqtiqa-mark commented on GitHub (Dec 3, 2025):

currently there are things we inject regardless of your setup.

Understood, but for a v1 release this is less cool. Give that v1 status, I'd argue again for this being a security issue and going to the top of the pile. But reasonable minds can disagree.

Would this be an accurate statement? If so, it can serve as i starting point for the documentation:

# Prompt Composition in OpenCode

## Overview

In OpenCode, prompts are constructed dynamically to support AI agent interactions. This process integrates environmental context, custom instructions, and agent-specific details. Developers of varying skill levels can use this understanding to customize agents or integrate OpenCode effectively. The hierarchy ensures a logical sequence, prioritizing foundational elements before additions.

## Key Components of Prompt Composition

The prompt is built by combining the following elements:

1. **Environment Information**:
   - Includes details about the current working directory, such as the file tree structure, Git directory information, and other metadata.
   - Purpose: Equips the AI agent with awareness of the project's environment to deliver contextually accurate responses.

2. **Custom Instructions**:
   - Derived from AGENTS.md files and any instructions defined in the configuration.
   - AGENTS.md files include a system-level file at `~/.config/opencode/AGENTS.md`, which provides global default instructions applicable across all projects, and project-level files (e.g., in the project root), which offer project-specific overrides.
   - Any `instructions` array in the configuration file adds further directives.
   - Purpose: Enables developers to incorporate specific directives, enhancing or overriding default behaviors. The system-level prompt fits within this component as the baseline for custom instructions.

When a custom agent prompt is used, only these environment and custom elements are added, with exceptions for certain providers where no additions occur.

## Prompt Hierarchy and Sequence

The prompt follows a defined order to maintain consistency:

1. **Base System Prompt (Optional)**:
   - Begins with any user-provided foundational prompt for custom agents.

2. **Environment Addition**:
   - Appends environmental details next, grounding the prompt in the project's context.

3. **Custom Addition**:
   - Appends custom instructions last, allowing them to reference prior elements. Within custom instructions, the sequence aggregates the system-level AGENTS.md first (as global defaults), followed by project-level AGENTS.md (for overrides), and then any configuration instructions.

This sequence results in a cohesive prompt array for AI processing.

## Graphical Illustration

The following Mermaid diagram represents the prompt hierarchy as a sequential flow:

~~~mermaid
flowchart TD
    A["Start: Optional Base System Prompt"] --> B["Append Environment\n(File Tree, Git Dir, CWD Metadata)"]
    B --> C[Append Custom]
    subgraph Custom [Custom Instructions]
        C1["System-Level\n(~/.config/opencode/AGENTS.md)"]
        C1 --> C2["Project-Level\n(e.g., project-root/AGENTS.md)"]
        C2 --> C3["Config Instructions\n(e.g., config.json #quot;instructions#quot; array)"]
    end
    C --> D["Final Prompt Array"]
~~~

## Example Structure

For clarity, consider an example illustrating relevant files. The system-level AGENTS.md resides in the user's home configuration directory, providing global defaults. Project-level files and configurations are within the project root. The file tree might appear as follows:

~~~
~ (Home Directory)/
└── .config/
    └── opencode/
        └── AGENTS.md  # System-level AGENTS.md with global default agent instructions

project-root/
├── AGENTS.md      # Project-level AGENTS.md with overrides for this specific project
└── config.json    # Configuration file containing an "instructions" array
                   # Example content: { "instructions": ["Prioritize efficiency", "Use TypeScript"] }
~~~

In this structure:
- The system-level AGENTS.md (`~/.config/opencode/AGENTS.md`) provides baseline instructions applicable universally.
- The project-level AGENTS.md overrides or extends the system-level for the current project.
- Configuration instructions add final customizations.
- The user prompt, if provided, serves as the base and initiates the composition process.

This example demonstrates how elements integrate unambiguously into the hierarchy for effective prompt building. Developers should ensure files are correctly placed and formatted to avoid inconsistencies.
@taqtiqa-mark commented on GitHub (Dec 3, 2025): > currently there are things we inject regardless of your setup. Understood, but for a v1 release this is less cool. Give that v1 status, I'd argue again for this being a security issue and going to the top of the pile. But reasonable minds can disagree. Would this be an accurate statement? If so, it can serve as i starting point for the documentation: ```markdown # Prompt Composition in OpenCode ## Overview In OpenCode, prompts are constructed dynamically to support AI agent interactions. This process integrates environmental context, custom instructions, and agent-specific details. Developers of varying skill levels can use this understanding to customize agents or integrate OpenCode effectively. The hierarchy ensures a logical sequence, prioritizing foundational elements before additions. ## Key Components of Prompt Composition The prompt is built by combining the following elements: 1. **Environment Information**: - Includes details about the current working directory, such as the file tree structure, Git directory information, and other metadata. - Purpose: Equips the AI agent with awareness of the project's environment to deliver contextually accurate responses. 2. **Custom Instructions**: - Derived from AGENTS.md files and any instructions defined in the configuration. - AGENTS.md files include a system-level file at `~/.config/opencode/AGENTS.md`, which provides global default instructions applicable across all projects, and project-level files (e.g., in the project root), which offer project-specific overrides. - Any `instructions` array in the configuration file adds further directives. - Purpose: Enables developers to incorporate specific directives, enhancing or overriding default behaviors. The system-level prompt fits within this component as the baseline for custom instructions. When a custom agent prompt is used, only these environment and custom elements are added, with exceptions for certain providers where no additions occur. ## Prompt Hierarchy and Sequence The prompt follows a defined order to maintain consistency: 1. **Base System Prompt (Optional)**: - Begins with any user-provided foundational prompt for custom agents. 2. **Environment Addition**: - Appends environmental details next, grounding the prompt in the project's context. 3. **Custom Addition**: - Appends custom instructions last, allowing them to reference prior elements. Within custom instructions, the sequence aggregates the system-level AGENTS.md first (as global defaults), followed by project-level AGENTS.md (for overrides), and then any configuration instructions. This sequence results in a cohesive prompt array for AI processing. ## Graphical Illustration The following Mermaid diagram represents the prompt hierarchy as a sequential flow: ~~~mermaid flowchart TD A["Start: Optional Base System Prompt"] --> B["Append Environment\n(File Tree, Git Dir, CWD Metadata)"] B --> C[Append Custom] subgraph Custom [Custom Instructions] C1["System-Level\n(~/.config/opencode/AGENTS.md)"] C1 --> C2["Project-Level\n(e.g., project-root/AGENTS.md)"] C2 --> C3["Config Instructions\n(e.g., config.json #quot;instructions#quot; array)"] end C --> D["Final Prompt Array"] ~~~ ## Example Structure For clarity, consider an example illustrating relevant files. The system-level AGENTS.md resides in the user's home configuration directory, providing global defaults. Project-level files and configurations are within the project root. The file tree might appear as follows: ~~~ ~ (Home Directory)/ └── .config/ └── opencode/ └── AGENTS.md # System-level AGENTS.md with global default agent instructions project-root/ ├── AGENTS.md # Project-level AGENTS.md with overrides for this specific project └── config.json # Configuration file containing an "instructions" array # Example content: { "instructions": ["Prioritize efficiency", "Use TypeScript"] } ~~~ In this structure: - The system-level AGENTS.md (`~/.config/opencode/AGENTS.md`) provides baseline instructions applicable universally. - The project-level AGENTS.md overrides or extends the system-level for the current project. - Configuration instructions add final customizations. - The user prompt, if provided, serves as the base and initiates the composition process. This example demonstrates how elements integrate unambiguously into the hierarchy for effective prompt building. Developers should ensure files are correctly placed and formatted to avoid inconsistencies. ```
yindo commented 2026-02-16 17:39:26 -05:00
Author
Owner
Copy Link
Copy Source

@brendensoares commented on GitHub (Feb 12, 2026):

We need docs like this for the built-in agents, too and instructions on how to remove/replace them.

@brendensoares commented on GitHub (Feb 12, 2026): We need docs like this for the built-in agents, too and instructions on how to remove/replace them.
yindo commented 2026-02-16 17:39:26 -05:00
Author
Owner
Copy Link
Copy Source

@taqtiqa-mark commented on GitHub (Feb 12, 2026):

In the spirit of calling out excellent engineering and design....

I've found that the Pi Coding Agent is more robust and, for me has none of the issues that I've encountered in OC, or has an elegant way to resolve them.... I'm dropping out of OC issues:

@taqtiqa-mark commented on GitHub (Feb 12, 2026): In the spirit of calling out excellent engineering and design.... I've found that the Pi Coding Agent is more robust and, for me has none of the issues that I've encountered in OC, or has an elegant way to resolve them.... I'm dropping out of OC issues: - [Pi Coding Agent](https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent) - [Overview](https://mariozechner.at/posts/2025-11-30-pi-coding-agent/) - [Example development session](https://www.youtube.com/watch?v=ANQ1IYsFM2s)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#3270
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?