anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Permission edit patterns #9479

New Issue
Open
opened 2026-02-16 18:12:32 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:12:32 -05:00
Owner
Copy Link
Copy Source

Originally created by @mindplay-dk on GitHub (Feb 16, 2026).

Question

The docs for this are really unhelpful - this example isn't really explained:

    "edit": {
      "*": "deny",
      "packages/web/src/content/docs/*.mdx": "allow"
    }

What does the packages/web/src/content/docs/*.mdx pattern mean?

To my understanding of glob patterns, this means *.mdx files in that folder but not in subfolders?

For subfolders, you would need path/**/*.ext correct?

But I had this pattern and it doesn't work:

  "$schema": "https://opencode.ai/config.json",
  "permission": {
    "edit": {
      "*": "deny",
      "src/**/*": "allow",
      "spec/**/*": "allow",
    }
  },

With this, it was unable to edit anything in src or spec folders.

Assuming this works, and assuming these are reasonably standard glob patterns, that should work, right?

I've pored over the docs, I've tried again and again, I've asked on the discord and no one really seems to know, and I can't get this feature to work. No matter what I put under "edit" it fails to write anything. Only by omitting this section entirely have I been able to get opencode to write anything.

Could we have some useful examples in the docs maybe?

Just a few basic pattern examples with explanations:

  • specific files
  • specific files in a specific folder
  • specific files in a specific folder and all subfolders

This should be enough for most people to intuit the essentials, I think?

(also, side note, but is "yolo" mode really the default? I have opencode on 3 different systems, and on one of them, it asked for permissions in the session - on two other systems, with a totally clean install and no real configuration, it just does whatever it wants. does merely adding the permission section to the project's opencode.jsonc wipe out all the defaults and just permit everything, or how it this supposed to work?)

Originally created by @mindplay-dk on GitHub (Feb 16, 2026). ### Question The [docs](https://opencode.ai/docs/permissions/#granular-rules-object-syntax) for this are really unhelpful - this example isn't really explained: ``` "edit": { "*": "deny", "packages/web/src/content/docs/*.mdx": "allow" } ``` What does the `packages/web/src/content/docs/*.mdx` pattern mean? To my understanding of glob patterns, this means `*.mdx` files in that folder but not in subfolders? For subfolders, you would need `path/**/*.ext` correct? But I had this pattern and it doesn't work: ``` "$schema": "https://opencode.ai/config.json", "permission": { "edit": { "*": "deny", "src/**/*": "allow", "spec/**/*": "allow", } }, ``` With this, it was unable to edit anything in `src` or `spec` folders. Assuming this works, and assuming these are reasonably standard glob patterns, that should work, right? I've pored over the docs, I've tried again and again, I've asked on the discord and no one really seems to know, and I can't get this feature to work. No matter what I put under "edit" it fails to write anything. Only by omitting this section entirely have I been able to get opencode to write anything. Could we have some useful examples in the docs maybe? Just a few basic pattern examples with explanations: - specific files - specific files in a specific folder - specific files in a specific folder and all subfolders This should be enough for most people to intuit the essentials, I think? (also, side note, but is "yolo" mode really the default? I have opencode on 3 different systems, and on one of them, it asked for permissions in the session - on two other systems, with a totally clean install and no real configuration, it just does whatever it wants. does merely adding the `permission` section to the project's `opencode.jsonc` wipe out all the defaults and just permit everything, or how it this supposed to work?)
yindo commented 2026-02-16 18:12:32 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Feb 16, 2026):

This issue might be a duplicate or related to existing issues about permission patterns not working as documented. Please check:

  • #13646: Path-based read permissions not enforced; catch-all rules always take precedence - This appears to be a bug where permission patterns don't work as expected
  • #4287: edit/write permission with deny,allow,ask using glob - Feature request for glob pattern support in permissions
  • #6892: MCP tool permissions not working after migration from tools to permissions - Documentation and permissions functionality issues

The behavior you're describing (permissions failing to work regardless of pattern) matches the reported bug in #13646. You may want to follow that issue for updates, or check if there's additional context there about workarounds.

@github-actions[bot] commented on GitHub (Feb 16, 2026): This issue might be a duplicate or related to existing issues about permission patterns not working as documented. Please check: - #13646: Path-based read permissions not enforced; catch-all rules always take precedence - This appears to be a bug where permission patterns don't work as expected - #4287: edit/write permission with deny,allow,ask using glob - Feature request for glob pattern support in permissions - #6892: MCP tool permissions not working after migration from tools to permissions - Documentation and permissions functionality issues The behavior you're describing (permissions failing to work regardless of pattern) matches the reported bug in #13646. You may want to follow that issue for updates, or check if there's additional context there about workarounds.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#9479
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?