anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Tool use cannot be prevented early in a session #4180

New Issue
Open
opened 2026-02-16 17:42:55 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 17:42:55 -05:00
Owner
Copy Link
Copy Source

Originally created by @thewildandy on GitHub (Jan 4, 2026).

Originally assigned to: @thdxr on GitHub.

Description

Following this example from the docs on preventing .env var read access, I created a simple plugin. Surprisingly, it did not work. I simplified the code to investigate.

It seems that when the first message in a session (or immediately following /new) is a request to read a file, the tool.execute.before hook does not fire. For subsequent messages, it works fine.

Plugins

A single line debug plugin as detailed below

OpenCode version

1.0.220

Steps to reproduce

  1. Create a plugin as follows in any of the allowed locations (I tested {project}/.opencode/plugin and {home}/.config/opencode/plugin
export const DebugPlugin = async ({ project, client, $, directory, worktree }) => {
  return {
    "tool.execute.before": async (input, output) => {
      throw new Error("about to use a tool")
    },
  }
}
  1. Start opencode, ask it to read a file. For example, I used the prompt "What's in @example.local.txt".

Expected:

Opencode will run the tool.execute.before hook prior to reading any files, and throw the error.

Actual:

Models will respond with the contents of the file. On subsequent requests they'll typically block it. In the attached screenshot you can see Grok correctly identify that it was blocked from reading, and then return the contents anyway (presumably from the initial interaction).

Screenshot and/or share link

Image

Operating System

macOS 26.1

Terminal

Alacritty

Originally created by @thewildandy on GitHub (Jan 4, 2026). Originally assigned to: @thdxr on GitHub. ### Description Following [this example from the docs](https://opencode.ai/docs/plugins/#env-protection) on preventing .env var read access, I created a simple plugin. Surprisingly, it did not work. I simplified the code to investigate. It seems that when the first message in a session (or immediately following `/new`) is a request to read a file, the `tool.execute.before` hook does not fire. For subsequent messages, it works fine. ### Plugins A single line debug plugin as detailed below ### OpenCode version 1.0.220 ### Steps to reproduce 1. Create a plugin as follows in any of the allowed locations (I tested {project}/.opencode/plugin and {home}/.config/opencode/plugin ```js export const DebugPlugin = async ({ project, client, $, directory, worktree }) => { return { "tool.execute.before": async (input, output) => { throw new Error("about to use a tool") }, } } ``` 2. Start opencode, ask it to read a file. For example, I used the prompt "What's in @example.local.txt". ### Expected: Opencode will run the tool.execute.before hook _prior to_ reading any files, and throw the error. ### Actual: Models will respond with the contents of the file. On subsequent requests they'll typically block it. In the attached screenshot you can see Grok correctly identify that it was blocked from reading, and then return the contents anyway (presumably from the initial interaction). ### Screenshot and/or share link <img width="887" height="1094" alt="Image" src="https://github.com/user-attachments/assets/d34c2141-18ca-4bb4-b2ed-7dc2555d4523" /> ### Operating System macOS 26.1 ### Terminal Alacritty
yindo added the bug label 2026-02-16 17:42:55 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#4180
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?