plan agent bypass

Description

opencode can edit files in the default plan agent

if i explicitly configure permissions for the plan agent they're respected, but the default plan agent permissions are somehow lost

diff --git a/.config/opencode/opencode.json b/.config/opencode/opencode.json
index 99a05b9..c5cf0ce 100644
--- a/.config/opencode/opencode.json
+++ b/.config/opencode/opencode.json
@@ -60,7 +60,7 @@
       "gh pr diff *": "allow",
       "tail *": "allow"
     },
-    "task": "allow",
+    "task": "ask",
     "skill": "allow",
     "lsp": "allow",
     "question": "allow",
@@ -74,6 +74,57 @@
     "context7*": "allow",
     "synthetic-web-search": "allow"
   },
+  "agent": {
+    "plan": {
+      "permission": {
+        "*": "ask",
+        "read": {
+          "*": "allow",
+          "*.env": "deny",
+          "*.env.*": "deny",
+          "*.env.example": "allow"
+        },
+        "edit": "deny",
+        "glob": "allow",
+        "grep": "allow",
+        "list": "allow",
+        "bash": {
+          "*": "ask",
+          "date": "allow",
+          "git status": "allow",
+          "git status *": "allow",
+          "git diff": "allow",
+          "git diff *": "allow",
+          "git log": "allow",
+          "git log *": "allow",
+          "ls": "allow",
+          "ls -la": "allow",
+          "head *": "allow",
+          "pwd": "allow",
+          "cat *": "allow",
+          "echo": "allow",
+          "gh pr view": "allow",
+          "gh pr view *": "allow",
+          "gh pr diff": "allow",
+          "gh pr diff *": "allow",
+          "tail *": "allow"
+        },
+        "task": "ask",
+        "skill": "allow",
+        "lsp": "allow",
+        "question": "allow",
+        "webfetch": "allow",
+        "websearch": "allow",
+        "codesearch": "allow",
+        "todowrite": "allow",
+        "external_directory": "ask",
+        "doom_loop": "ask",
+        "tavily*": "allow",
+        "context7*": "allow",
+        "synthetic-web-search": "allow"
+      }
+    }
+  },
   "mcp": {
     "tavily": {
       "type": "remote",

Plugins

_

OpenCode version

v1.14.28

Steps to reproduce

start opencode
select pig pickle model
select plan agent
ask it to modify any file in the folder
it will do it

Screenshot and/or share link

https://opncd.ai/share/uHgCOLcQ

Operating System

Windows 11

Terminal

Windows Terminal

This issue might be a duplicate of existing issues. Please check:

[CRITICAL Security Issue/Bug] Plan mode restrictions bypassed when spawning sub-agents #6527: Plan mode restrictions bypassed when spawning sub-agents (very similar — default plan agent permissions not enforced)
Plan mode: agent executes file-creation commands via bash tool directly (no sub-agent bypass) #19094: Plan mode agent executes file-creation commands via bash tool directly (same symptom without sub-agent bypass)
'Plan' agent does not adhere to the plan rule. #11441: Plan agent does not adhere to the plan rule
Plan mode is editing my files (gemini 3 pro) #7292: Plan mode is editing files
Changing files in plan mode #10741: Changing files in plan mode
Permissions ignored #16331: Permissions ignored

If none of these cover your specific case (default plan agent permissions being silently dropped when not explicitly configured), please clarify how it differs.

This issue might be a duplicate of existing issues. Please check:

[CRITICAL Security Issue/Bug] Plan mode restrictions bypassed when spawning sub-agents #6527: Plan mode restrictions bypassed when spawning sub-agents (very similar — default plan agent permissions not enforced)

Plan mode: agent executes file-creation commands via bash tool directly (no sub-agent bypass) #19094: Plan mode agent executes file-creation commands via bash tool directly (same symptom without sub-agent bypass)

'Plan' agent does not adhere to the plan rule. #11441: Plan agent does not adhere to the plan rule

Plan mode is editing my files (gemini 3 pro) #7292: Plan mode is editing files

Changing files in plan mode #10741: Changing files in plan mode

Permissions ignored #16331: Permissions ignored

If none of these cover your specific case (default plan agent permissions being silently dropped when not explicitly configured), please clarify how it differs.

#7292 and #11441 look like the same issue

this code does not seem to be respected:
https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/agent/agent.ts#L136

#24110 addresses the same permission precedence bug for session permissions and bash commands, but #24615 may also need native plan edit restrictions reapplied after user/global config merge.

upd.: I think this behavior is expected, finally figured out. Maybe documentation should be updated, but it's basically behaves like this:

{
  "$schema": "https://opencode.ai/config.json",
  // set readonly global permissions, it will override default permissions for all agents, including the built-in agents (build, general, explore...)
  "permission": {
    "edit": "ask",
    "task": {
      // do not allow running subagents with edit permissions by default without user confirmation
      "*": "ask",
      "explore": "allow",
    },
  },
  "agent": {
    // allow edit permissions for specific agents
    "build": {
      "permission": {
        "edit": {
          "*": "allow",
        },
        "task": {
          // allow agents with edit permission to run subagents with edit permissions by default without user confirmation
          "general": "allow",
        },
      },
    },
    "general": {
      "permission": {
        "edit": {
          "*": "allow",
        },
        "task": {
          "general": "allow",
        },
      },
    },
  },
}

the bug was introduced in commit 351ddee

It clearly disagrees with both the documentation at https://opencode.ai/docs/agents/ and with expectations.

I, for one, was very surprised when the agent was doing a git commit + push despite plan mode.

Plan mode must have set "bash" to "ask", otherwise it can do things like "git commit", "git push" and worse.

@neuhaus

@neuhaus then try explicitly setting permissions for the plan agent, should work, explicit permissions are respected

@neuhaus then try explicitly setting permissions for the plan agent, should work, explicit permissions are respected

OK. But the documentation states that "bash" is set to "ask" which it isn't, but it should be (perhaps with a good whitelist that's set to "allow").

To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.

reopen this issue!

Navigation Menu

Repository navigation

plan agent bypass #24615

Description

Plugins

OpenCode version

Steps to reproduce

Screenshot and/or share link

Operating System

Terminal

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

plan agent bypass #24615

Description

Description

Plugins

OpenCode version

Steps to reproduce

Screenshot and/or share link

Operating System

Terminal

Activity

github-actions commented on Apr 27, 2026

nikitakot commented on Apr 27, 2026

kzekiue commented on Apr 27, 2026

nikitakot commented on Apr 29, 2026

neuhaus commented on May 1, 2026

nikitakot commented on May 1, 2026

neuhaus commented on May 2, 2026

github-actions commented on Jul 7, 2026

neuhaus commented on Aug 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions