Repository navigation
V2 plan mode doesn't stop Kiro (ACP provider) models from editing files #53530
Description
Description
In plan mode with a kiro/* model, I asked for a file to be created — it was created, no prompt, no denial, nothing in session history but text. Asked how, the model said nothing told it plan mode was on and that it edited via kiro-cli's own Write tool and shell, bypassing opencode's edit tools.
I A/B tested this on the same machine (same kiro-cli 2.11.1, provider 3.3.0, model list, plugin settings), swapping only the core: 1.18.34 refuses the same request citing plan mode; 2.0.24 performs it silently. The V1 binary carries an explicit plan system reminder that evidently reaches the model; V2 injects the reminder as synthetic session messages — present in my session_message rows, but the provider never delivers them to kiro-cli, whose native tools then bypass the permission layer entirely (my plan sessions record zero tool parts).
Secondly, the V2 plan policy has no shell rule, so even bridged shell calls fall through to allow — worth a look independent of this bug.
Happy to test fixes against the same setup; staying on 1.18.34 meanwhile.
Activity
github-actions commentedon Oct 6, 2026
Thanks for updating the issue with the required Bug Report description, reproduction context, and system details!
schnipcstg commentedon Oct 14, 2026
I also have hit this issue, looks like somehow my default kiro agent got used instead of the opencode one with
tools: []opencodejr commentedon Oct 27, 2026
Thanks for the detailed A/B test, @Real-Gecko! I couldn't reproduce this myself: seeing a Kiro model edit files needs a real
kiro-clilogin and a Kiro account, and I don't have one here.Reading the code does show why plan mode doesn't reach the model:
dev), OpenCode adds the plan-mode reminder to the prompt as its own user message, placed just before your latest message (packages/core/src/plugin/plan.ts).[email protected]builds what it sends tokiro-cliinextractPrompt(). That function keeps the system messages and only the last user message, so the reminder is dropped. This matches what you saw: the reminder is stored in your session but never reaches the model.kiro-cli's own Write and shell tools don't go through OpenCode's permission system, so the reminder is the only thing that could stop the model.Whether this is better handled in how OpenCode sends the reminder or in the Kiro provider is for the maintainers to decide. Someone with a Kiro account will need to confirm it.
Related:
shellrule, so shell commands are allowed (your second point); fix in PR fix(core): ask before shell commands in plan mode #54165Real-Gecko commentedon Oct 28, 2026
How can I test? Do I need a specific build of opencode?