anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Agent keeps executing git commands even though its set as "ask for permission" #7090

New Issue
Closed
opened 2026-02-16 18:06:09 -05:00 by yindo · 7 comments
yindo commented 2026-02-16 18:06:09 -05:00
Owner
Copy Link
Copy Source

Originally created by @trixnfx on GitHub (Jan 21, 2026).

Originally assigned to: @rekram1-node on GitHub.

Description

I'm encountering an issue with gemini variants where they are REALLY keen on using git commands. git add/commit/push even though I've explicitly forbit it in AGENTS.md.

~/.config/opencode/opencode.json

...
  "agent": {
    "build": {
      "permission": {
        "git": "deny"
      }
    },
    "creative-planning": {
      "prompt": "You are a creative planner. Validate ideas with me and do NOT do any changes to the repo you are working on.",
      "temperature": 0.9,
      "tools": {
        "write": false,
        "edit": false,
        "bash": false
      }
    }
  },
...
Image

Plugins

No response

OpenCode version

1.1.28

Steps to reproduce

Its random but super annoying... I just ask it to implement something and it sometimes pushes to the remote branch.

Screenshot and/or share link

No response

Operating System

MacOS Tahoe

Terminal

Alacritty

Originally created by @trixnfx on GitHub (Jan 21, 2026). Originally assigned to: @rekram1-node on GitHub. ### Description I'm encountering an issue with gemini variants where they are REALLY keen on using git commands. git add/commit/push even though I've explicitly forbit it in AGENTS.md. ~/.config/opencode/opencode.json ``` ... "agent": { "build": { "permission": { "git": "deny" } }, "creative-planning": { "prompt": "You are a creative planner. Validate ideas with me and do NOT do any changes to the repo you are working on.", "temperature": 0.9, "tools": { "write": false, "edit": false, "bash": false } } }, ... ``` <img width="296" height="180" alt="Image" src="https://github.com/user-attachments/assets/89e13f20-02d1-4cae-91f9-d7c9000794c3" /> ### Plugins _No response_ ### OpenCode version 1.1.28 ### Steps to reproduce Its random but super annoying... I just ask it to implement something and it sometimes pushes to the remote branch. ### Screenshot and/or share link _No response_ ### Operating System MacOS Tahoe ### Terminal Alacritty
yindo added the bug label 2026-02-16 18:06:09 -05:00
yindo closed this issue 2026-02-16 18:06:09 -05:00
yindo commented 2026-02-16 18:06:10 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 21, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #6873: auto upgrade to 1.1.1, surprise! commands no longer require approval - similar permission bypass issue with git commands
  • #4642: Permission system broken - comprehensive report of agent ignoring bash/git permission denies and finding workarounds
  • #6396: [BUG] Custom agent 'deny' permissions in opencode.json are ignored when invoked via SDK - permissions being ignored across different contexts
  • #7554: Permission control does not seem to be working - agent ignoring explicit deny permissions
  • #3948: Custom Agent Writes/Edits Files Despite Configuration Restrictions - agents ignoring tool restriction configurations

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 21, 2026): This issue might be a duplicate of existing issues. Please check: - #6873: auto upgrade to 1.1.1, surprise! commands no longer require approval - similar permission bypass issue with git commands - #4642: Permission system broken - comprehensive report of agent ignoring bash/git permission denies and finding workarounds - #6396: [BUG] Custom agent 'deny' permissions in opencode.json are ignored when invoked via SDK - permissions being ignored across different contexts - #7554: Permission control does not seem to be working - agent ignoring explicit deny permissions - #3948: Custom Agent Writes/Edits Files Despite Configuration Restrictions - agents ignoring tool restriction configurations Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 18:06:10 -05:00
Author
Owner
Copy Link
Copy Source

@SMInsmed commented on GitHub (Jan 21, 2026):

I'm having a similar issue with Gemini 3 models. It will run arbitrary Python code in Plan mode with python -c "<code generated by Gemini>" which is at odds with what the README says about asking permission before running bash commands. It never asked for permission, it just went ahead and did it.

@SMInsmed commented on GitHub (Jan 21, 2026): I'm having a similar issue with Gemini 3 models. It will run arbitrary Python code in Plan mode with `python -c "<code generated by Gemini>"` which is at odds with what the README says about asking permission before running bash commands. It never asked for permission, it just went ahead and did it.
yindo commented 2026-02-16 18:06:10 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 21, 2026):

@trixnfx try "git *": "deny"

@rekram1-node commented on GitHub (Jan 21, 2026): @trixnfx try `"git *": "deny"`
yindo commented 2026-02-16 18:06:10 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 21, 2026):

Our permissions system needs wildcards otherwise it does exact match and git add !== git

@rekram1-node commented on GitHub (Jan 21, 2026): Our permissions system needs wildcards otherwise it does exact match and `git add` !== `git`
yindo commented 2026-02-16 18:06:10 -05:00
Author
Owner
Copy Link
Copy Source

@trixnfx commented on GitHub (Jan 21, 2026):

I'll give it a go, thank you!

@trixnfx commented on GitHub (Jan 21, 2026): I'll give it a go, thank you!
yindo commented 2026-02-16 18:06:10 -05:00
Author
Owner
Copy Link
Copy Source

@trixnfx commented on GitHub (Jan 22, 2026):

sadly it happened even with that setting...

Image 
  "agent": {
    "build": {
      "permission": {
        "git *": "deny"
      }
    },
    "explore": {
      "model": "zai-coding-plan/glm-4.7"
    },
    "creative-planning": {
      "prompt": "You are a creative planner. Validate ideas with me and do NOT do any changes to the repo you are working on.",
      "temperature": 0.9,
      "tools": {
        "write": false,
        "edit": false,
        "bash": false
      }
    }
  },
@trixnfx commented on GitHub (Jan 22, 2026): sadly it happened even with that setting... <img width="567" height="65" alt="Image" src="https://github.com/user-attachments/assets/a30f1dbc-fd40-4fd8-91ed-1ce45e07f359" /> ``` "agent": { "build": { "permission": { "git *": "deny" } }, "explore": { "model": "zai-coding-plan/glm-4.7" }, "creative-planning": { "prompt": "You are a creative planner. Validate ideas with me and do NOT do any changes to the repo you are working on.", "temperature": 0.9, "tools": { "write": false, "edit": false, "bash": false } } }, ```
yindo commented 2026-02-16 18:06:10 -05:00
Author
Owner
Copy Link
Copy Source

@jcgordon10 commented on GitHub (Jan 23, 2026):

your screenshot doesn't show the command being used, or what agent is using it. I think you have permission there to deny git, but shouldn't git be a subset of bash because it's a bash tool that's matching to a string "git *"? Like:

"permission": {
"read": "allow",
"bash": {
"*": "ask",
}
},

And I think that the "tools" under your custom agent was done away with in favor of the "permissions" style.

@jcgordon10 commented on GitHub (Jan 23, 2026): your screenshot doesn't show the command being used, or what agent is using it. I think you have permission there to deny git, but shouldn't git be a subset of bash because it's a bash tool that's matching to a string "git *"? Like: "permission": { "read": "allow", "bash": { "*": "ask", } }, And I think that the "tools" under your custom agent was done away with in favor of the "permissions" style.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#7090
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?