v1 apply_patch: permission list returns HTTP 400 for non-move changes #45275

Description

In OpenCode v1, apply_patch includes movePath: undefined in permission metadata for add, update, and delete operations. The request is accepted in memory, but GET /permission fails while encoding it:

BadRequest: Expected JSON value

This is easy to miss because permission.asked SSE serialization omits the undefined property, so the normal interactive flow can still work. It becomes a hang when a client misses the SSE event and relies on the permission-list endpoint for recovery.

Reproduced with v1.17.4 for add and update operations. The implementation remains unchanged in v1.18.23 and the current dev branch at 830aaf2059e87eab3105dda4c19556206d60c443.

Permission metadata accepts arbitrary values rather than requiring JSON-safe data:

At minimum, v1 should omit movePath when it is undefined so pending apply-patch permissions remain listable.

Plugins

None required. The failure occurs through the server API directly.

OpenCode version

Reproduced with v1.17.4. Source inspection indicates v1.4.4 through v1.18.23 and current dev are affected.

Steps to reproduce

1. Start OpenCode v1 with edit permission configured to ask.
2. Use a model that selects apply_patch.
3. Ask it to add or update a file.
4. While the permission request is pending, call GET /permission.
5. Observe HTTP 400 with BadRequest: Expected JSON value.

The failure also follows from the same metadata construction for deletes and mixed patches. A move-only patch may avoid this exact error because its movePath is a string.

Screenshot and/or share link

Not applicable. Reproduced through the HTTP permission API.

Operating System

Linux 7.0.0-29-generic x86_64

Terminal

Not terminal-specific; reproduced at the server API boundary.