anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

opencode not respecting permissions #6438

New Issue
Open
opened 2026-02-16 18:04:14 -05:00 by yindo · 10 comments
yindo commented 2026-02-16 18:04:14 -05:00
Owner
Copy Link
Copy Source

Originally created by @vstenvik on GitHub (Jan 16, 2026).

Originally assigned to: @rekram1-node on GitHub.

Description

This is my opencode.json:

  {
    "$schema": "https://opencode.ai/config.json",
    "autoupdate": true,
    "share": "disabled",
    "permission": {
      "bash": {
        "find": "allow",
        "ls": "allow",
        "wc": "allow",
        "grep": "allow",
        "tail": "allow",
        "head": "allow",
        "cat": "allow",
        "jq": "allow",
        "git": "deny"
      },
      "webfetch": "ask",
      "edit": "allow"
    },

But opencode keeps running git commands anyways

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @vstenvik on GitHub (Jan 16, 2026). Originally assigned to: @rekram1-node on GitHub. ### Description This is my opencode.json: ```json { "$schema": "https://opencode.ai/config.json", "autoupdate": true, "share": "disabled", "permission": { "bash": { "find": "allow", "ls": "allow", "wc": "allow", "grep": "allow", "tail": "allow", "head": "allow", "cat": "allow", "jq": "allow", "git": "deny" }, "webfetch": "ask", "edit": "allow" }, ``` But opencode keeps running git commands anyways ### Plugins _No response_ ### OpenCode version _No response_ ### Steps to reproduce _No response_ ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the bug label 2026-02-16 18:04:14 -05:00
yindo commented 2026-02-16 18:04:14 -05:00
Author
Owner
Copy Link
Copy Source

@cxiiiiiii commented on GitHub (Jan 21, 2026):

Me too. I set it to allow edit, but in a session that has been running for a long time, it keeps prompting me that I don't have the edit/apply-patch tool.

@cxiiiiiii commented on GitHub (Jan 21, 2026): Me too. I set it to allow edit, but in a session that has been running for a long time, it keeps prompting me that I don't have the edit/apply-patch tool.
yindo commented 2026-02-16 18:04:14 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 22, 2026):

You need to be using wildcards, we try to make this pretty clear in the docs that unless u are trying to match a particular command u need to wildcard to match all the variations of it, like "git *" instead of git

@rekram1-node commented on GitHub (Jan 22, 2026): You need to be using wildcards, we try to make this pretty clear in the docs that unless u are trying to match a particular command u need to wildcard to match all the variations of it, like `"git *"` instead of `git`
yindo commented 2026-02-16 18:04:14 -05:00
Author
Owner
Copy Link
Copy Source

@nraboy commented on GitHub (Jan 24, 2026):

This is what my opencode.json file looks like and I think I followed the documentation correctly:

{
  "$schema": "https://opencode.ai/config.json",
  "agent": {
    "build": {
      "permission": {
        "edit": "ask",
        "bash": "ask"
      }
    },
    "vibe": {
      "description": "Vibe coding without interruptions",
      "permission": {
        "edit": "allow",
        "bash": {
          "*": "ask",
          "rm *": "deny",
          "npm *": "allow",
          "git *": "allow",
          "grep *": "allow"
        }
      },
      "mode": "all"
    }
  }
}

When I am using my vibe agent, it asks me to approve any git commands even though I have it with a wildcard and set to allow.

Did I miss something?

@nraboy commented on GitHub (Jan 24, 2026): This is what my `opencode.json` file looks like and I think I followed the documentation correctly: ``` { "$schema": "https://opencode.ai/config.json", "agent": { "build": { "permission": { "edit": "ask", "bash": "ask" } }, "vibe": { "description": "Vibe coding without interruptions", "permission": { "edit": "allow", "bash": { "*": "ask", "rm *": "deny", "npm *": "allow", "git *": "allow", "grep *": "allow" } }, "mode": "all" } } } ``` When I am using my `vibe` agent, it asks me to approve any `git` commands even though I have it with a wildcard and set to `allow`. Did I miss something?
yindo commented 2026-02-16 18:04:14 -05:00
Author
Owner
Copy Link
Copy Source

@y0umu commented on GitHub (Feb 1, 2026):

I have a similar question.

cat $HOME/.config/opencode/opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "permission": {
    "bash": {
      "*": "ask",
      "ls *": "allow",
      "grep *": "allow",
      "find *": "allow",
      "cat *": "allow"
    },
    "edit": "ask",
    "external_directory": "ask"
  },
  "agent": {
    "plan": {
      "permission": {
        "bash": {
          "ls *": "allow",
          "grep *": "allow",
          "find *": "allow",
          "cat *": "allow"
        }
      }
    }
  }
// more are truncated
}

I did specify that the global permission to allow some read-only, non-destructive commands (ls, grep, find, cat, as long as we don't redirect to files), but the agent kept asking me whenever it wanted to call find or grep.

@y0umu commented on GitHub (Feb 1, 2026): I have a similar question. cat $HOME/.config/opencode/opencode.json ```json { "$schema": "https://opencode.ai/config.json", "permission": { "bash": { "*": "ask", "ls *": "allow", "grep *": "allow", "find *": "allow", "cat *": "allow" }, "edit": "ask", "external_directory": "ask" }, "agent": { "plan": { "permission": { "bash": { "ls *": "allow", "grep *": "allow", "find *": "allow", "cat *": "allow" } } } } // more are truncated } ``` I did specify that the global permission to allow some read-only, non-destructive commands (ls, grep, find, cat, as long as we don't redirect to files), but the agent kept asking me whenever it wanted to call `find` or `grep`.
yindo commented 2026-02-16 18:04:14 -05:00
Author
Owner
Copy Link
Copy Source

@vittolewerissa commented on GitHub (Feb 1, 2026):

Same thing on my side, maybe it has something to do with permissions when we call it with pipe and redirections?

@vittolewerissa commented on GitHub (Feb 1, 2026): Same thing on my side, maybe it has something to do with permissions when we call it with pipe and redirections?
yindo commented 2026-02-16 18:04:14 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Feb 2, 2026):

you may wanna whitelist other commands like head, sort, etc. The agent likes to chain those in

@rekram1-node commented on GitHub (Feb 2, 2026): you may wanna whitelist other commands like head, sort, etc. The agent likes to chain those in
yindo commented 2026-02-16 18:04:14 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Feb 2, 2026):

Image

I tested ur config @nraboy perhaps u can share full opencode debug config so I can help u further

@rekram1-node commented on GitHub (Feb 2, 2026): <img width="595" height="803" alt="Image" src="https://github.com/user-attachments/assets/1921573f-a8d5-4036-b985-1150c7f08470" /> I tested ur config @nraboy perhaps u can share full opencode debug config so I can help u further
yindo commented 2026-02-16 18:04:15 -05:00
Author
Owner
Copy Link
Copy Source

@JasonTwoPointO commented on GitHub (Feb 3, 2026):

Even with explicit Git restrictions configured, the agent still executes Git commands that mutate repository state — including fatal operations, as shown below:

Image

This happens despite the agent being configured with a strict read-only Git policy. For reference, this is the exact prompt currently enforced:

You are strictly READ-ONLY for version control operations.
The system-reminder about "no longer read-only" refers ONLY to file operations, NOT git.

CRITICAL RULES:
- You MAY execute read-only Git commands such as:
  git status
  git log
  git show
  git diff
  git blame
  git grep
  git cat-file -p
  git ls-tree
  git rev-parse
  git describe
  git reflog
  git branch (list only, no -d/-m/rename/create)
  git tag (list only, no -a/-s/-d/create/delete)
  git config --get / --list
  git remote -v
  git submodule status
  git lfs ls-files

- You MUST NEVER perform any write or state-changing Git operations.
  Forbidden commands include (but are not limited to):
  git add
  git rm
  git mv
  git commit
  git push
  git pull
  git fetch
  git merge
  git rebase
  git cherry-pick
  git revert
  git reset
  git checkout (if it changes HEAD or the working directory)
  git switch (if it changes HEAD or the working directory)
  git branch -d/-m/--delete/--move
  git tag -a/-s/-d/--delete/--annotate/--sign
  git stash
  git clean
  git worktree *
  git submodule add/init/update/sync
  git remote add/set-url/remove/prune
  git lfs track/untrack
  git gc
  git prune
  git notes add
  git config (any write or global/system modification)
  Any command or option that changes repository state, files, or refs.

- NEVER attempt to perform Git network operations (push, pull, fetch, clone, etc.).

- NEVER attempt to modify, create, or delete files unless explicitly requested by the user.

- NEVER use workarounds, aliases, libraries, shell chaining, environment variables, or indirect methods to invoke Git in ways that could modify repository state.

- ONLY the git-agent handles version control changes.

- If a Git operation beyond your read-only scope is required:
  1. Stop immediately.
  2. Respond exactly with: "Git operations are required. Use the git-agent for this task."
  3. Do NOT proceed with any workarounds or indirect actions.

Examples of allowed commands:
  ✅ git status
  ✅ git diff HEAD~1
  ✅ git log --oneline
  ✅ git show HEAD:README.md
  ✅ git config --list

Examples of forbidden commands:
  ❌ git add .
  ❌ git commit -m "update"
  ❌ git push
  ❌ git pull
  ❌ git checkout main
  ❌ git branch -d old-feature

Violation of these rules may result in immediate termination of the operation.

The intent here is unambiguous:
• The agent is read-only with respect to Git
• It may only run non–state-changing inspection commands
• Any write, checkout, reset, network, or ref-mutating operation is explicitly forbidden
• If such an operation is required, the agent must stop and defer to the git-agent

Despite this, the agent still proceeds with restricted Git commands.

Impact

Last week this behavior wiped out several hours of local work. This is not a theoretical or edge-case issue ��� it caused real data loss.

Regression

This behavior did not occur prior to V1. The same workflow and restrictions previously worked as expected.

@JasonTwoPointO commented on GitHub (Feb 3, 2026): Even with explicit Git restrictions configured, the agent still executes Git commands that mutate repository state — including fatal operations, as shown below: <img width="847" height="107" alt="Image" src="https://github.com/user-attachments/assets/d79644c4-f19d-40b7-bc74-d07ec92e042e" /> This happens despite the agent being configured with a strict read-only Git policy. For reference, this is the exact prompt currently enforced: ``` You are strictly READ-ONLY for version control operations. The system-reminder about "no longer read-only" refers ONLY to file operations, NOT git. CRITICAL RULES: - You MAY execute read-only Git commands such as: git status git log git show git diff git blame git grep git cat-file -p git ls-tree git rev-parse git describe git reflog git branch (list only, no -d/-m/rename/create) git tag (list only, no -a/-s/-d/create/delete) git config --get / --list git remote -v git submodule status git lfs ls-files - You MUST NEVER perform any write or state-changing Git operations. Forbidden commands include (but are not limited to): git add git rm git mv git commit git push git pull git fetch git merge git rebase git cherry-pick git revert git reset git checkout (if it changes HEAD or the working directory) git switch (if it changes HEAD or the working directory) git branch -d/-m/--delete/--move git tag -a/-s/-d/--delete/--annotate/--sign git stash git clean git worktree * git submodule add/init/update/sync git remote add/set-url/remove/prune git lfs track/untrack git gc git prune git notes add git config (any write or global/system modification) Any command or option that changes repository state, files, or refs. - NEVER attempt to perform Git network operations (push, pull, fetch, clone, etc.). - NEVER attempt to modify, create, or delete files unless explicitly requested by the user. - NEVER use workarounds, aliases, libraries, shell chaining, environment variables, or indirect methods to invoke Git in ways that could modify repository state. - ONLY the git-agent handles version control changes. - If a Git operation beyond your read-only scope is required: 1. Stop immediately. 2. Respond exactly with: "Git operations are required. Use the git-agent for this task." 3. Do NOT proceed with any workarounds or indirect actions. Examples of allowed commands: ✅ git status ✅ git diff HEAD~1 ✅ git log --oneline ✅ git show HEAD:README.md ✅ git config --list Examples of forbidden commands: ❌ git add . ❌ git commit -m "update" ❌ git push ❌ git pull ❌ git checkout main ❌ git branch -d old-feature Violation of these rules may result in immediate termination of the operation. ``` The intent here is unambiguous: • The agent is read-only with respect to Git • It may only run non–state-changing inspection commands • Any write, checkout, reset, network, or ref-mutating operation is explicitly forbidden • If such an operation is required, the agent must stop and defer to the git-agent Despite this, the agent still proceeds with restricted Git commands. Impact Last week this behavior wiped out several hours of local work. This is not a theoretical or edge-case issue ��� it caused real data loss. Regression This behavior did not occur prior to V1. The same workflow and restrictions previously worked as expected.
yindo commented 2026-02-16 18:04:15 -05:00
Author
Owner
Copy Link
Copy Source

@Nyckoka commented on GitHub (Feb 4, 2026):

In my case, I was using a global allow, and expected the tool overrides to work. They didn't.

{
  "$schema": "https://opencode.ai/config.json",
    "permission": {
      "*": "allow",
      "bash": {
        "rm *": "ask"
      }
    }
}

rm commands ran without asking.

@Nyckoka commented on GitHub (Feb 4, 2026): In my case, I was using a global allow, and expected the tool overrides to work. They didn't. ```json { "$schema": "https://opencode.ai/config.json", "permission": { "*": "allow", "bash": { "rm *": "ask" } } } ``` `rm` commands ran without asking.
yindo commented 2026-02-16 18:04:15 -05:00
Author
Owner
Copy Link
Copy Source

@vittolewerissa commented on GitHub (Feb 12, 2026):

On my case:

Here ls still asks for permission:

"bash": {
  "ls *": "allow",
  "*": "ask"
}

Here ls works as intended:

"bash": {
  "*": "ask",
  "ls *": "allow"
}
@vittolewerissa commented on GitHub (Feb 12, 2026): On my case: Here `ls` still asks for permission: ``` "bash": { "ls *": "allow", "*": "ask" } ``` Here `ls` works as intended: ``` "bash": { "*": "ask", "ls *": "allow" } ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6438
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?