agents: config-defined shell deny on free-model agent fails session with misleading free-tier error #51193

Activity

1. malcevsergeyq

   added a commit that references this issue on Sep 24, 2026

   fix(agents): оставить в shell одну pwd — обход бага free tier Zen

   ...

   1a4cfca
2. scachemaille commented on Sep 30, 2026

   

   scachemaille

   on Sep 30, 2026

   Last edited by scachemaille

   More actions

   Corroborating this trigger on a primary agent (same class as #50627). Same error, 100% reproducible, and a bisect isolates it to the config-defined deny rule — the model is not involved.

   Environment

   • opencode version: v2.0.18
   • OS: Linux 6.18.54-1-MANJARO (linux x64)
   • Terminal: TERM=xterm-256color, COLORTERM=truecolor (TERM_PROGRAM unset)
   • Shell: /bin/zsh
   • Install/channel: latest
   • Active plugins: superpowers@git+https://github.com/obra/superpowers.git, opencode-cmd-provider

   Failing agent

   ~/.config/opencode/agents/ask.md:

   ---
   description: Web-only agent for knowledge and conversation.
   mode: primary
   model: opencode/mimo-v2.6-flash-free
   request:
     body:
       temperature: 0.1
   permissions:
     - action: "*"
       resource: "*"
       effect: deny
     - action: webfetch
       resource: "*"
       effect: ask
     - action: websearch
       resource: "*"
       effect: ask
   ---
   
   You are a helpful assistant limited to web research. ...

   Reproduction

   1. Select the ask agent (primary) with opencode/mimo-v2.6-flash-free.
   2. Send any message.
   3. Every time:

   Error from provider (Console): OpenCode's free tier can only be used from within OpenCode
   

   Bisect

   Removing only this block from the agent frontmatter fixes it:

     - action: "*"
       resource: "*"
       effect: deny

   mode: primary and request.body.temperature: 0.1 were left unchanged, so the trigger is the config-defined action: "*" deny rule (which includes shell). The same free model works on a config-defined agent with no permissions block, and on builtin agents.

   Notes

   • Trips on action: "*" deny, not only an explicit shell: deny — possibly broader than the repro here.
   • Primary agent, so this is the same class as policy: deny shell * on custom agent breaks free tier with "can only be used from within OpenCode" #50627.

   Related

   • policy: deny shell * on custom agent breaks free tier with "can only be used from within OpenCode" #50627 — deny shell * on a custom primary agent
   • tools.read = false in opencode.json makes all zen free-tier models fail with "free tier can only be used from within OpenCode" #51315 — same error via tools.read = false

   the comment has been written by AI but all the tests has been done by me a human
3. ggbdpq commented on Oct 2, 2026

   

   ggbdpq

   on Oct 2, 2026

   More actions

   Ran the code path down for anyone picking this up — two facts from dev source, plus a clearly-labeled guess:

   Fact 1: a config-defined rule like {action: "*", effect: deny} makes Permission.disabled() (packages/opencode/src/permission/index.ts) strip every tool from the agent's visible toolset, since Wildcard.match(anyTool, "*") always matches a deny rule whose pattern is *.

   Fact 2: the outgoing request body is built from that visible toolset (session/llm/request.ts), so the free-model request would go out with an empty (or near-empty) tools field. Builtin agents with *: deny are unaffected because their ruleset doesn't flow through the same config-agent permission merge — which matches the reports here.

   Guess (unverified): the Zen gateway rejecting with "can only be used from within OpenCode" appears to key off request shape rather than the identity headers (x-opencode-client is always sent, defaulting to cli), and an empty tools array is the obvious candidate signature. Confirming or killing that needs the gateway side, which isn't in this repo — so I'm leaving it here rather than guessing at a fix.
4. neriousy commented on Oct 20, 2026

   

   neriousy

   on Oct 20, 2026

   Member

   More actions

   Thanks for narrowing this down with the custom-agent permission comparisons. This is the same problem as #51241, where denying shell or read access incorrectly triggers the free-tier error, and we're tracking it there. Please subscribe or add a 👍 there; your agent definition and deny-versus-ask results are worth adding too.
5. neriousy

   closed this as a duplicateof [BUG] Free models fail when shell or read permissions are denied #51241 on Oct 20, 2026