anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[BUG] “Always allow” TUI approvals override restrictions for all agents #6892

New Issue
Open
opened 2026-02-16 18:05:31 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:05:31 -05:00
Owner
Copy Link
Copy Source

Originally created by @rashidalnaemi on GitHub (Jan 20, 2026).

Originally assigned to: @rekram1-node on GitHub.

Description

When a user chooses “Always allow” in a permission prompt, the approval is stored in a process‑wide in‑memory ruleset keyed only by permission + pattern. During evaluation, the approved rules are appended after the agent/session rules and win due to findLast, causing the approval to apply across all agents and sessions in the same OpenCode process. This overrides agent‑specific permission configurations, which is unexpected and unsafe. I believe the expected behavior is just for the specified agent to be granted that permission.

Strong suggestion
Scope “always allow” to both agent and session (not just agent). Store approvals with {agent, sessionID, permission, pattern} and only match approvals where both agent and session ID match the current request, or at least allow it as an option (Always Allow/Always Allow for this Session)

Plugins

None

OpenCode version

1.1.19

Steps to reproduce

  1. Configure Plan Agent with restrictive permissions (e.g., deny write), Build with ask permissions.
  2. Start a session with Build Agent and trigger a permission prompt for write.
  3. Choose “Always allow”.
  4. Start a session with Plan and trigger a writett.
  5. Observe that the permission is auto‑approved despite Plan Agent’s restrictions.

Screenshot and/or share link

No response

Operating System

Fedora and Arch

Terminal

Ghostty and Wezterm

Originally created by @rashidalnaemi on GitHub (Jan 20, 2026). Originally assigned to: @rekram1-node on GitHub. ### Description When a user chooses “Always allow” in a permission prompt, the approval is stored in a process‑wide in‑memory ruleset keyed only by permission + pattern. During evaluation, the approved rules are appended after the agent/session rules and win due to findLast, causing the approval to apply across all agents and sessions in the same OpenCode process. This overrides agent‑specific permission configurations, which is unexpected and unsafe. I believe the expected behavior is just for the specified agent to be granted that permission. **Strong suggestion** Scope “always allow” to both agent and session (not just agent). Store approvals with {agent, sessionID, permission, pattern} and only match approvals where both agent and session ID match the current request, or at least allow it as an option (Always Allow/Always Allow for this Session) ### Plugins None ### OpenCode version 1.1.19 ### Steps to reproduce 1. Configure Plan Agent with restrictive permissions (e.g., deny write), Build with ask permissions. 2. Start a session with Build Agent and trigger a permission prompt for write. 3. Choose “Always allow”. 4. Start a session with Plan and trigger a writett. 5. Observe that the permission is auto‑approved despite Plan Agent’s restrictions. ### Screenshot and/or share link _No response_ ### Operating System Fedora and Arch ### Terminal Ghostty and Wezterm
yindo added the opentuibug labels 2026-02-16 18:05:31 -05:00
yindo commented 2026-02-16 18:05:32 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 20, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #7474: Subagent permissions not enforced - configured restrictions ignored (addresses similar permission override issues with subagents)
  • #6527: Plan mode restrictions bypassed when spawning sub-agents (security issue about restrictions being overridden through delegation)
  • #7006: permission.ask plugin hook is defined but not triggered (relates to permission system bypasses)

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 20, 2026): This issue might be a duplicate of existing issues. Please check: - #7474: Subagent permissions not enforced - configured restrictions ignored (addresses similar permission override issues with subagents) - #6527: Plan mode restrictions bypassed when spawning sub-agents (security issue about restrictions being overridden through delegation) - #7006: permission.ask plugin hook is defined but not triggered (relates to permission system bypasses) Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug opentui
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6892
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?