anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-23 02:36:57 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[FEATURE]: Add "soft deny" permission action for self-correcting AI behavior #6965

New Issue
Closed
opened 2026-02-16 18:05:44 -05:00 by yindo · 6 comments
yindo commented 2026-02-16 18:05:44 -05:00
Owner
Copy Link
Copy Source

Originally created by @awikman on GitHub (Jan 20, 2026).

Originally assigned to: @thdxr on GitHub.

Feature hasn't been suggested before.

  • I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Currently, the permission system has three actions: allow, ask, and deny. When a command is denied, execution halts with an error. This is problematic when the AI could simply try an alternative approach.

Example config:

{
  "permission": {
    "bash": {
      "find *": "soft deny",
      "python tests/*": "soft deny"
    }
  }
}

Generic use case: Configure find * with "soft deny" so that when the AI tries bash command find, it receives a message like "That bash command is not allowed. Try using another tool, instead of bash" and hopefully will naturally self-correct.

My use case: The AI tries constantly to run tests using bash commands python tests/..., which fails because it does not have permission to run python. I'd like opencode to tell the AI to use my custom mcp server that can run tests, if it tries to run bash python test*. Some models just wont listen to instructions on this...

Originally created by @awikman on GitHub (Jan 20, 2026). Originally assigned to: @thdxr on GitHub. ### Feature hasn't been suggested before. - [x] I have verified this feature I'm about to request hasn't been suggested before. ### Describe the enhancement you want to request Currently, the permission system has three actions: allow, ask, and deny. When a command is denied, execution halts with an error. This is problematic when the AI could simply try an alternative approach. **Example config**: ``` { "permission": { "bash": { "find *": "soft deny", "python tests/*": "soft deny" } } } ``` **Generic use case**: Configure `find *` with "soft deny" so that when the AI tries bash command `find`, it receives a message like "That bash command is not allowed. Try using another tool, instead of bash" and hopefully will naturally self-correct. **My use case**: The AI tries constantly to run tests using bash commands `python tests/...`, which fails because it does not have permission to run python. I'd like opencode to tell the AI to use my custom mcp server that can run tests, if it tries to run bash `python test*`. Some models just wont listen to instructions on this...
yindo added the discussion label 2026-02-16 18:05:44 -05:00
yindo closed this issue 2026-02-16 18:05:44 -05:00
yindo commented 2026-02-16 18:05:44 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 20, 2026):

This issue has several related feature requests that share similar goals of improving the permission system and tool guidance:

  • #9516: Extract inner commands from xargs/parallel/find -exec for permission matching
  • #9552: Tool Search (MCP On Demand) - would help AI discover alternative MCP tools
  • #9548: @ mention syntax for MCP server activation
  • #9461: Claude-style Tool Search Tool Implementation
  • #9614: Permission UX friction with 'ask' action (related permission system improvements)

While not exact duplicates, these issues complement your feature request. In particular, #9552, #9548, and #9461 would help make 'soft deny' more effective by making alternative MCP tools discoverable to the AI when bash is denied.

@github-actions[bot] commented on GitHub (Jan 20, 2026): This issue has several related feature requests that share similar goals of improving the permission system and tool guidance: - #9516: Extract inner commands from xargs/parallel/find -exec for permission matching - #9552: Tool Search (MCP On Demand) - would help AI discover alternative MCP tools - #9548: @ mention syntax for MCP server activation - #9461: Claude-style Tool Search Tool Implementation - #9614: Permission UX friction with 'ask' action (related permission system improvements) While not exact duplicates, these issues complement your feature request. In particular, #9552, #9548, and #9461 would help make 'soft deny' more effective by making alternative MCP tools discoverable to the AI when bash is denied.
yindo commented 2026-02-16 18:05:44 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 20, 2026):

You can use continue_loop_on_deny in the experimental section of ur cfg btw

@rekram1-node commented on GitHub (Jan 20, 2026): You can use `continue_loop_on_deny` in the experimental section of ur cfg btw
yindo commented 2026-02-16 18:05:44 -05:00
Author
Owner
Copy Link
Copy Source

@awikman commented on GitHub (Jan 20, 2026):

Hmm... When I was testing this before, the model just stopped, without output. So I assumed opencode stopped it. But on further digging, it seems like it only stopped because of the deny message caused it to to stop:

packages/opencode/src/permission/next.ts

`The user has specified a rule which prevents you from using this specific tool call. Here are some of the relevant rules ${JSON.stringify(ruleset)}`,

Some models just give up because of that response from using the tool.
So what I really need is it to be more soft with the response, and suggesting to the AI to do something else. Having a custom message for specific permission would be optimal.
Something like:

    "permission": {                                                                                                                                                                                                                                           
        "bash": {                                                                                                                                                                                                                                             
            "python test/*": {"deny": "This tool call is not allowed. use test_tool_run_test instead"}

For now, I think I'll try to convince the model not to give up on that response in AGENTS.md

@awikman commented on GitHub (Jan 20, 2026): Hmm... When I was testing this before, the model just stopped, without output. So I assumed opencode stopped it. But on further digging, it seems like it only stopped because of the deny message caused it to to stop: `packages/opencode/src/permission/next.ts` ``` `The user has specified a rule which prevents you from using this specific tool call. Here are some of the relevant rules ${JSON.stringify(ruleset)}`, ``` Some models just give up because of that response from using the tool. So what I really need is it to be more soft with the response, and suggesting to the AI to do something else. Having a custom message for specific permission would be optimal. Something like: ``` "permission": { "bash": { "python test/*": {"deny": "This tool call is not allowed. use test_tool_run_test instead"} ``` For now, I think I'll try to convince the model not to give up on that response in AGENTS.md
yindo commented 2026-02-16 18:05:44 -05:00
Author
Owner
Copy Link
Copy Source

@awikman commented on GitHub (Jan 30, 2026):

Going to close this, because better instruction in AGENTS.md was good enough.

@awikman commented on GitHub (Jan 30, 2026): Going to close this, because better instruction in AGENTS.md was good enough.
yindo commented 2026-02-16 18:05:44 -05:00
Author
Owner
Copy Link
Copy Source

@disbolog commented on GitHub (Feb 13, 2026):

I'd like to see this reopened, because AGENTS.md in such a case is a snake oil non-solution.

@disbolog commented on GitHub (Feb 13, 2026): I'd like to see this reopened, because AGENTS.md in such a case is a snake oil non-solution.
yindo commented 2026-02-16 18:05:44 -05:00
Author
Owner
Copy Link
Copy Source

@mathe00 commented on GitHub (Feb 13, 2026):

I'd like to see this reopened, because AGENTS.md in such a case is a snake oil non-solution.

up. I agree.

@mathe00 commented on GitHub (Feb 13, 2026): > I'd like to see this reopened, because [AGENTS.md](http://AGENTS.md) in such a case is a snake oil non-solution. up. I agree.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label discussion
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6965
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?