anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Agent Permission not work as expected #7132

New Issue
Open
opened 2026-02-16 18:06:16 -05:00 by yindo · 3 comments
yindo commented 2026-02-16 18:06:16 -05:00
Owner
Copy Link
Copy Source

Originally created by @beatwade on GitHub (Jan 21, 2026).

Originally assigned to: @thdxr on GitHub.

Description

  1. [init] create custom agent md format write constraint permissions
permission:
  skill:
    "req-create*": deny
  1. [behavior]
    the skill req-create still work
Image
  1. [debug] log
    INFO 2026-01-22T02:30:11 +0ms service=permission permission=skill pattern=req-create ruleset=[{"permission":"","action":"allow","pattern":""},{"permission":"doom_loop","action":"ask","pattern":""},{"permission":"external_directory","pattern":"","action":"ask"},{"permission":"external_directory","pattern":"/Users/mac/.local/share/opencode/tool-output","action":"allow"},{"permission":"external_directory","pattern":"/Users/mac/.local/share/opencode/tool-output/","action":"allow"},{"permission":"question","action":"deny","pattern":""},{"permission":"plan_enter","action":"deny","pattern":""},{"permission":"plan_exit","action":"deny","pattern":""},{"permission":"read","pattern":"","action":"allow"},{"permission":"read","pattern":".env","action":"ask"},{"permission":"read","pattern":".env.","action":"ask"},{"permission":"read","pattern":".env.example","action":"allow"},{"permission":"webfetch","action":"allow","pattern":""},{"permission":"external_directory","action":"allow","pattern":""},{"permission":"write","action":"deny","pattern":""},{"permission":"edit","action":"deny","pattern":""},{"permission":"bash","pattern":"","action":"ask"},{"permission":"bash","pattern":"git diff","action":"allow"},{"permission":"bash","pattern":"git log*","action":"allow"},{"permission":"bash","pattern":"grep ","action":"allow"},{"permission":"read","action":"deny","pattern":""},{"permission":"webfetch","action":"deny","pattern":""},**{"permission":"skill","pattern":"req-create","action":"deny"},**{"permission":"external_directory","pattern":"/Users/mac/.local/share/opencode/tool-output","action":"allow"},{"permission":"external_directory","pattern":"/Users/mac/.local/share/opencode/tool-output/*","action":"allow"}] evaluate

you can see these lines:
first : "permission":"","action":"allow","pattern":""}
then: override {"permission":"skill","pattern":"req-create*","action":"deny"}

Plugins

No response

OpenCode version

1.1.31

Steps to reproduce

just create a custom agent

---
name: phase-router
description: test
mode: primary
permission:
  skill:
    "req-create*": deny 
---

the skill will trigger as normal without any restriction

Screenshot and/or share link

No response

Operating System

macos

Terminal

iterm2

Originally created by @beatwade on GitHub (Jan 21, 2026). Originally assigned to: @thdxr on GitHub. ### Description 1. [init] create custom agent md format write constraint permissions ``` permission: skill: "req-create*": deny ``` 2. [behavior] the skill req-create still work <img width="3156" height="1116" alt="Image" src="https://github.com/user-attachments/assets/3f10e1ca-c4c1-464f-b5fb-aab58eee6914" /> 3. [debug] log INFO 2026-01-22T02:30:11 +0ms service=permission permission=skill pattern=req-create ruleset=[{"permission":"*","action":"allow","pattern":"*"},{"permission":"doom_loop","action":"ask","pattern":"*"},{"permission":"external_directory","pattern":"*","action":"ask"},{"permission":"external_directory","pattern":"/Users/mac/.local/share/opencode/tool-output","action":"allow"},{"permission":"external_directory","pattern":"/Users/mac/.local/share/opencode/tool-output/*","action":"allow"},{"permission":"question","action":"deny","pattern":"*"},{"permission":"plan_enter","action":"deny","pattern":"*"},{"permission":"plan_exit","action":"deny","pattern":"*"},{"permission":"read","pattern":"*","action":"allow"},{"permission":"read","pattern":"*.env","action":"ask"},{"permission":"read","pattern":"*.env.*","action":"ask"},{"permission":"read","pattern":"*.env.example","action":"allow"},{"permission":"webfetch","action":"allow","pattern":"*"},{"permission":"external_directory","action":"allow","pattern":"*"},{"permission":"write","action":"deny","pattern":"*"},{"permission":"edit","action":"deny","pattern":"*"},{"permission":"bash","pattern":"*","action":"ask"},{"permission":"bash","pattern":"git diff","action":"allow"},{"permission":"bash","pattern":"git log*","action":"allow"},{"permission":"bash","pattern":"grep *","action":"allow"},{"permission":"read","action":"deny","pattern":"*"},{"permission":"webfetch","action":"deny","pattern":"*"},**{"permission":"skill","pattern":"req-create*","action":"deny"},**{"permission":"external_directory","pattern":"/Users/mac/.local/share/opencode/tool-output","action":"allow"},{"permission":"external_directory","pattern":"/Users/mac/.local/share/opencode/tool-output/*","action":"allow"}] evaluate you can see these lines: first : "permission":"*","action":"allow","pattern":"*"} then: override {"permission":"skill","pattern":"req-create*","action":"deny"} ### Plugins _No response_ ### OpenCode version 1.1.31 ### Steps to reproduce just create a custom agent ``` --- name: phase-router description: test mode: primary permission: skill: "req-create*": deny --- ``` the skill will trigger as normal without any restriction ### Screenshot and/or share link _No response_ ### Operating System macos ### Terminal iterm2
yindo added the bug label 2026-02-16 18:06:16 -05:00
yindo commented 2026-02-16 18:06:16 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 21, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #7474: [Security Bug] Subagent permissions not enforced - configured restrictions ignored
  • #7063: Permission denied, yet command is executed regardless
  • #9554: [BUG] "Always allow" TUI approvals override restrictions for all agents

These issues describe similar permission enforcement problems where configured restrictions (especially with wildcard/specific patterns) are not being properly applied.

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 21, 2026): This issue might be a duplicate of existing issues. Please check: - #7474: [Security Bug] Subagent permissions not enforced - configured restrictions ignored - #7063: Permission denied, yet command is executed regardless - #9554: [BUG] "Always allow" TUI approvals override restrictions for all agents These issues describe similar permission enforcement problems where configured restrictions (especially with wildcard/specific patterns) are not being properly applied. Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 18:06:16 -05:00
Author
Owner
Copy Link
Copy Source

@khimaros commented on GitHub (Feb 7, 2026):

is this the same cause as edit permission misbehaving?

for example:

permission:
    edit:
        "*": deny
        "foo/*": allow
        "foo/bar.md": ask
@khimaros commented on GitHub (Feb 7, 2026): is this the same cause as edit permission misbehaving? for example: ``` permission: edit: "*": deny "foo/*": allow "foo/bar.md": ask ```
yindo commented 2026-02-16 18:06:16 -05:00
Author
Owner
Copy Link
Copy Source

@johanlundberg commented on GitHub (Feb 9, 2026):

I'm seeing the same issue with bash permission rules from config not being enforced.

Config (~/.config/opencode/opencode.json):
bash: {
*: ask,
pytest *: allow,
tail *: allow
}

Command that triggers the permission prompt:
PYTHONPATH=src pytest -vvv src/webapp/tests/test_app.py 2>&1 | tail -20

OpenCode correctly decomposes this into pytest * and tail * — the "Always allow" dialog says:

This will allow the following patterns until OpenCode is restarted

  • pytest *
  • tail *

So the pattern matching/decomposition logic works. But two things are broken:

  1. Config rules not applied — The exact same "pytest *": "allow" and "tail *": "allow" patterns already in my config don't prevent the prompt.
  2. "Always allow" doesn't persist within the session — After choosing "Always allow", the same command still prompts for permission again in the same session.

This suggests the session-based "always allow" uses different (working) decomposition logic than the config-based rule evaluation, and even the session-based rules aren't actually being stored/consulted on subsequent calls.

@johanlundberg commented on GitHub (Feb 9, 2026): I'm seeing the same issue with bash permission rules from config not being enforced. Config (~/.config/opencode/opencode.json): bash: { *: ask, pytest *: allow, tail *: allow } Command that triggers the permission prompt: `PYTHONPATH=src pytest -vvv src/webapp/tests/test_app.py 2>&1 | tail -20` OpenCode correctly decomposes this into pytest * and tail * — the "Always allow" dialog says: > This will allow the following patterns until OpenCode is restarted > - pytest * > - tail * So the pattern matching/decomposition logic works. But two things are broken: 1. Config rules not applied — The exact same "pytest *": "allow" and "tail *": "allow" patterns already in my config don't prevent the prompt. 2. "Always allow" doesn't persist within the session — After choosing "Always allow", the same command still prompts for permission again in the same session. This suggests the session-based "always allow" uses different (working) decomposition logic than the config-based rule evaluation, and even the session-based rules aren't actually being stored/consulted on subsequent calls.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#7132
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?