[FEATURE]:Warn users when Plan mode permissions are silently overridden by global config #39715

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Problem Description

When using Plan mode, I expected the AI to be strictly read-only (as documented). However, the AI was able to edit source files directly via the edit tool. After debugging with debug logs, I found that my opencode.json had a global permission rule:

{
  "permission": {
    "bash": {
      "*": "allow"
    },
    "edit": "allow"
  }
}

This global allow silently overrides Plan mode's default deny for the edit tool, causing Plan mode to behave like Build mode without any warning.

Log Evidence

The following log lines confirm the override:

timestamp=2026-07-30T15:57:05.218Z level=INFO evaluated permission=edit pattern="JAVA\\src\\com\\xxxx\\ImageDownloader.java" action.permission=edit action.action=allow action.pattern=*
timestamp=2026-07-30T15:57:05.219Z level=INFO formatting file="D:\\Develop\\xxxx\\JAVA\\src\\com\\xxxx\\ImageDownloader.java"

Key observation: action.pattern=* indicates the global wildcard matched, not the Plan-specific deny rule.

(For more information, screenshot about chat is attached in the end. FOCUS the last ai-thinking block).

Root Cause

The current permission resolution priority is:

1. Agent-specific permissions (e.g., agents.plan.permissions)
2. Default agent permissions (agents.default.permissions)
3. Global permissions (permissions.*)

However, if the user sets "*": "allow" at the global level, it overrides all agent-specific deny rules silently. There is no validation or warning when this happens, making it extremely hard to diagnose.

Suggested Improvements

1. Startup Configuration Validation

Add a check during startup: if Plan mode's edit permission is effectively allow (due to any level of configuration), emit a warning in the terminal and/or TUI:

⚠️ Warning: Plan mode has edit permission enabled.
   This may cause unintended file modifications.
   To restore Plan mode's read-only behavior, remove global "edit: allow" or add explicit deny in agents.plan.permissions.

2. Documentation Enhancement

In the Plan mode documentation, add a permission priority table:

Also include a clear note: "Setting "*": "allow" at the global level will completely disable Plan mode's read-only protection."

3. Quick Recovery Option

Provide a configuration flag to reset Plan mode to its safe defaults:

{
  "agents": {
    "plan": {
      "useSafeDefaults": true
    }
  }
}

This would automatically set edit: deny (except .opencode/plans/*.md) and bash: ask, ignoring any global overrides for Plan mode.

Environment

• OpenCode version: 1.18.10
• OS: Windows 11
• Model: deepseek-v4-flash (via Volcano Engine Coding Plan provider)
• Config: global "edit": "allow" present in opencode.json

Related Commits

• #23214 (65368f6) – Introduced layered permission array for precedence ordering
• #24222 (66f9303) – Changed permission evaluation to insertion-order (last-match-wins)
• #27258 (2820472) – Temporarily reverted layered array approach
• #30287 (9b815bc) – Introduced location-based permission service (v2 refactor)

Related Issues

• Plugin agent manifest tools: question: true does not override inherited default question: deny permission #39022 (Plugin agent manifest tools: question: true does not override inherited default question: deny permission) – same root cause: inherited defaults silently override explicit permissions
• Subagent parent deny inheritance over-constrains delegated agents with explicit permissions #26700 (Subagent parent deny inheritance over-constrains delegated agents with explicit permissions) – same class of permission inheritance/override issue
• plan agent bypass #24615 (Plan agent bypass) – default plan agent permissions lost due to global config override
• Plan Agent does modifications to files. #2709 (bash bypass) – mentions global allow as a contributing factor, but no feature request for warnings
• plan mode: unwilling to write to .opencode/plans/ #11078 (prompt vs permission conflict) – different root cause, but touches plan mode permission boundaries

None of these issues specifically propose adding validation or warnings for silent permission override, which is what this feature request addresses.

chat screenshot

The last ai-thinking block answers why agent did so, and the above are what angent change in Plan mode.