Skills advertised despite session deny #38337

Description

Description

Skills denied by session permissions can still appear in system-prompt skill advertisement. Selecting one then returns a permission denial.

Environment

• OpenCode version: 1.18.4
• OS: Linux

Expected

Denied skills are excluded from advertised available skills, or marked unavailable.

Actual

skill.available(agent) checks only agent permission, so denied skills remain advertised. Loading invokes context permission checks and returns deny.

customize-opencode is registered before disk scan in packages/opencode/src/skill/index.ts:276-284. Advertisement uses skill.available(agent) at packages/opencode/src/skill/index.ts:310-315 and system prompt lists skills at packages/opencode/src/session/system.ts:98-110,1257-1269. Session overrides merge in packages/opencode/src/session/tools.ts:81-89; deny is returned by packages/opencode/src/permission/index.ts:72-80.

Proposed behavior

Filter advertised skills using effective session permissions before adding them to system prompt to reduce context rot and wasteful skill tool calls.

Plugins

No response

OpenCode version

1.18.4

Steps to reproduce

1. Start session with a skill denied through session permission overrides.
2. Inspect system prompt or available skill list.
3. Attempt to load denied skill.

Screenshot and/or share link

No response

Operating System

Linux

Terminal

Tested on opencode build-in web server