Repository navigation
Config permissions/agents overrides cannot override built-in agent policies (external_directory always asks) #43669
Description
Summary
Config-based YOLO / auto-approve does not work in opencode2 beta: setting permissions (V2 array) and agents.<id>.permissions to allow does not override built-in agent policies, so external_directory access still requires approval (ask) even with an allow-all rule.
Environment
- opencode version: 0.0.0-beta-17728
- OS: Linux 7.0.0-29-generic (Ubuntu) x86_64
- Terminal: TERM_PROGRAM=Orca TERM=xterm-256color COLORTERM=truecolor
- Shell: /bin/bash
- Install/channel: beta
- Server: background service http://0.0.0.0:49374
- Config: ~/.config/opencode/opencode.json
Reproduction
- Add the following to the global config:
{
"$schema": "https://opencode.ai/config.json",
"permissions": [{ "action": "*", "resource": "*", "effect": "allow" }],
"agents": {
"build": {
"permissions": [{ "action": "external_directory", "resource": "*", "effect": "allow" }]
}
}
}- Restart the server:
opencode2 service restart - Run:
opencode2 run -m <model> "read /etc/hostname" - Result: permission is still requested
! permission requested: external_directory (/etc/*); auto-rejecting
Read /etc/hostname failed
The user declined this tool call
Expected Behavior
An allow-all rule (global or per-agent) should allow all tool actions including external directory access, so no permission prompt appears.
Actual Behavior
External directory access still asks. The built-in external_directory: ask policy wins over the user's allow rules.
Root Cause Analysis
- The
permissionsarray IS parsed:opencode2 debug agentsshows{action: "*", resource: "*", effect: "allow"}at the start of every agent's effective permission array. - V2 permission evaluation uses "last matching rule wins" (
findLast). The built-in agent policy rule{external_directory, *, ask}appears AFTER the user's allow-all, so it wins and the request is rejected/asked. agents.<id>.permissionsconfig overrides are NOT appended: debug agents output shows they are missing from the end of the built-in agents' permission arrays.- Source: the agent builder reads
cfg.agent(singular) but the config schema field isagents(plural), with no conversion — so JSON-configured agent overrides are ignored in this beta.
Suggested Fix
- Convert the V2
agentsfield into theagentobject used by the agent builder (packages/opencode/src/agent/agent.ts), or make the builder read the plural field - Or ensure user-specified agent rules are appended after built-in policies so they can override them
Workarounds
- CLI:
opencode2 run --auto/--yolo(client sends "once" for permission requests) — works - Web UI: click "Always allow" per project (manual)
Related known issues
- Desktop/Web: Missing Revert and Fork actions for messages #9661/[Web] Session Fork/Revert UI actions still missing in v1.3.15 despite issue #9661 being closed #21119 Web Revert/Fork actions missing/broken over the versions (web client session/state issues)
Activity
github-actions commentedon Aug 20, 2026
This issue might be a duplicate of, or closely related to, existing issues. Please check:
findLast()semantics cause broad rules to override specific ones; the V2 permission evaluator's last-match-wins logic makes user allow rules lose to built-in agent policies appended after them.Your additional finding that
agents(plural) config is silently ignored in favor ofagent(singular) appears to be a distinct bug not covered by the above.exorrtech commentedon Aug 24, 2026
Fresh data point from a fully-autonomous primary agent use case (v1.18.21, Linux x64, agent defined in
~/.config/opencode/agent/yolo.md).Repro summary
Agent frontmatter set every tool-level category to
allowbut initially omittedexternal_directory(it is easy to miss — the key only appears in the config schema, and the default isask):external_directoryask-events vs 3,513 allow-events/tmp/*writes and/sys/bus/usb/devices/.../*reads via bashevaluated permission=external_directory pattern=/tmp/* action.permission=external_directory action.pattern=* action.action=askAdding
external_directory: allowexplicitly to the agent frontmatter stopped the asks in that scope, but the underlying expectation mismatch remains: users writing partial permission blocks for autonomous agents reasonably assume tool-level allows cover command side-effects on external paths.Two friction points worth addressing
external_directoryis easy to omit because it is not obvious that bash commands touching /tmp or /sys count as "external directory" access. A prominent note in the agents/permissions docs would help.external_directory: allow, users expect the documented "agent rules take precedence" behavior to hold without also needing a global-config rule.I have opened #44657 documenting the complete all-keys block + this trap in the permissions docs. Happy to test any patch against the reproduction setup.
Co-authored-by: ox-alpha [email protected]
nico2525nn commentedon Aug 28, 2026
Follow-up: as of build 0.0.0-beta-18414 the Web UI "auto-accept permissions" toggle is enabled and usable again (verified). This provides a UI-side path for auto-approval (per-session/directory) as a workaround, separate from the config
agentsoverride issue this issue is about — which remains open (JSONagents.*overrides are still not applied to built-in agents).neriousy commentedon Oct 20, 2026
Thanks for reporting this! Starting in 2.0.25, accessing files outside the project no longer asks for approval by default, and configured agent permissions apply after the built-in rules. Update with
opencode upgradeornpm i -g @opencode/cli@latest(desktop: update the app). Please reopen or comment if your configuration still prompts unexpectedly on that version or newer.