anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Path-based read permissions not enforced; catch-all rules always take precedence #9356

New Issue
Open
opened 2026-02-16 18:12:15 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:12:15 -05:00
Owner
Copy Link
Copy Source

Originally created by @krasnikau-andrei on GitHub (Feb 14, 2026).

Originally assigned to: @thdxr on GitHub.

Description

Path-scoped read permissions don't work.

Configurations Attempted

~.config/opencode/agents/s-manager.md

---
description: Lightweight workflow orchestrator - executes skills and subagents
  with read/write access to docs folder only
mode: primary
temperature: 0.3
permission:
  skill: allow
  task: allow
  todowrite: allow
  todoread: allow
  <read configuration here>
---

...

Bellow yaml part of md file for agen configuration

❌ Configuration 1 (Initial - Read tool disappeared)

permission:
  skill: allow
  task: allow
  todowrite: allow
  todoread: allow
  read:
    "docs/**": allow
    "game_docs/**": allow
    "*": deny

Expected: Agent can read only docs/** and game_docs/**

Actual:

Model tried to call unavailable tool 'read'. Available tools: invalid, bash, glob, grep, edit, write, task, webfetch, todowrite, skill, memory_list, memory_set, memory_replace, distill, prune.

❌ Configuration 2 (Added top-level allow - Back to unsecured)

permission:
  skill: allow
  task: allow
  todowrite: allow
  todoread: allow
  read: allow              # ← Added this
  read:
    "docs/**": allow
    "game_docs/**": allow
    "*": deny

Expected: Nested read: rules should restrict access

Actual:

  • Read tool reappears and is fully accessible
  • Top-level read: allow overwrites nested path configuration
  • Agent can read ANY file in working folder
  • Path restrictions completely ignored

❌ Configuration 3 (Removed top-level allow, rule order first)

permission:
  skill: allow
  task: allow
  todowrite: allow
  todoread: allow
  read:
    "*": deny                # ← Catch-all deny first
    "docs/**": allow         # ← Specific allows after
    "game_docs/**": allow

Expected: Last matching rule wins (per OpenCode docs) - specific allows after deny should work

Actual:

Error: The user has specified a rule which prevents you from using this specific tool call. 
Here are the relevant rules: 
[
  {"permission":"*","pattern":"*","action":"allow"},
  {"permission":"read","pattern":"*","action":"allow"},
  {"permission":"read","pattern":"*.env","action":"ask"},
  {"permission":"read","pattern":"*.env.*","action":"ask"},
  {"permission":"read","pattern":"*.env.example","action":"allow"},
  {"permission":"*","pattern":"*","action":"deny"},
  {"permission":"read","pattern":"docs/**","action":"allow"},
  {"permission":"read","pattern":"game_docs/**","action":"allow"}
]
  • Permission error shows "*" deny rule at position 6, allows at positions 7-8
  • Catch-all deny blocks before specific allows are reached

Impact

Security issue - agents cannot be reliably restricted to specific file directories. Path-based permissions do not work as documented.

Plugins

No response

OpenCode version

1.1.60

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

macOs

Terminal

Ghosty

Originally created by @krasnikau-andrei on GitHub (Feb 14, 2026). Originally assigned to: @thdxr on GitHub. ### Description Path-scoped read permissions don't work. ## Configurations Attempted `~.config/opencode/agents/s-manager.md` ```md --- description: Lightweight workflow orchestrator - executes skills and subagents with read/write access to docs folder only mode: primary temperature: 0.3 permission: skill: allow task: allow todowrite: allow todoread: allow <read configuration here> --- ... ``` Bellow yaml part of md file for agen configuration ### ❌ Configuration 1 (Initial - Read tool disappeared) ```yaml permission: skill: allow task: allow todowrite: allow todoread: allow read: "docs/**": allow "game_docs/**": allow "*": deny ``` **Expected:** Agent can read only `docs/**` and `game_docs/**` **Actual:** ``` Model tried to call unavailable tool 'read'. Available tools: invalid, bash, glob, grep, edit, write, task, webfetch, todowrite, skill, memory_list, memory_set, memory_replace, distill, prune. ``` ### ❌ Configuration 2 (Added top-level allow - Back to unsecured) ```yaml permission: skill: allow task: allow todowrite: allow todoread: allow read: allow # ← Added this read: "docs/**": allow "game_docs/**": allow "*": deny ``` **Expected:** Nested `read:` rules should restrict access **Actual:** - Read tool reappears and is fully accessible - Top-level `read: allow` overwrites nested path configuration - Agent can read ANY file in working folder - Path restrictions completely ignored ### ❌ Configuration 3 (Removed top-level allow, rule order first) ```yaml permission: skill: allow task: allow todowrite: allow todoread: allow read: "*": deny # ← Catch-all deny first "docs/**": allow # ← Specific allows after "game_docs/**": allow ``` **Expected:** Last matching rule wins (per OpenCode docs) - specific allows after deny should work **Actual:** ``` Error: The user has specified a rule which prevents you from using this specific tool call. Here are the relevant rules: [ {"permission":"*","pattern":"*","action":"allow"}, {"permission":"read","pattern":"*","action":"allow"}, {"permission":"read","pattern":"*.env","action":"ask"}, {"permission":"read","pattern":"*.env.*","action":"ask"}, {"permission":"read","pattern":"*.env.example","action":"allow"}, {"permission":"*","pattern":"*","action":"deny"}, {"permission":"read","pattern":"docs/**","action":"allow"}, {"permission":"read","pattern":"game_docs/**","action":"allow"} ] ``` - Permission error shows `"*"` deny rule at position 6, allows at positions 7-8 - Catch-all deny blocks before specific allows are reached ## Impact Security issue - agents cannot be reliably restricted to specific file directories. Path-based permissions do not work as documented. ### Plugins _No response_ ### OpenCode version 1.1.60 ### Steps to reproduce _No response_ ### Screenshot and/or share link _No response_ ### Operating System macOs ### Terminal Ghosty
yindo added the bug label 2026-02-16 18:12:15 -05:00
yindo commented 2026-02-16 18:12:15 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Feb 14, 2026):

This issue might be a duplicate of or related to existing issues addressing permission enforcement:

  • #11272: Path-based folder permission control not working (similar catch-all override behavior)
  • #5529: Feature request for per-agent filesystem boundaries (the functionality you're trying to use)
  • #11324: Task tool ignores per-target deny rules
  • #12566: Subagents don't respect permission rules

Consider checking these issues for updates or workarounds, and consolidating discussion there if your specific bug is the same root cause.

@github-actions[bot] commented on GitHub (Feb 14, 2026): This issue might be a duplicate of or related to existing issues addressing permission enforcement: - #11272: Path-based folder permission control not working (similar catch-all override behavior) - #5529: Feature request for per-agent filesystem boundaries (the functionality you're trying to use) - #11324: Task tool ignores per-target deny rules - #12566: Subagents don't respect permission rules Consider checking these issues for updates or workarounds, and consolidating discussion there if your specific bug is the same root cause.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#9356
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?