server: permission evaluations and asks are no longer logged in v2 #56247

Activity

1. opencode-agent commented on Oct 16, 2026

   

   opencode-agentBot

   on Oct 16, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the detailed report. I reproduced this on 2.0.31, and it still happens on the latest dev (180fd9d).

   Steps:

   • Set up a project with a single rule: { "action": "shell", "resource": "*", "effect": "ask" }.
   • Had a (simulated) model run touch made-by-shell.txt.
   • Answered the Permission required prompt with "Allow once".
   • Grepped that run's opencode.log for permission-related lines.

   Result: the log had about 150 lines, 51 of them role=server, and none about permissions. There was no line for the rule evaluation, the ask, or the reply. The recording and the script below show the run.

   The permission service in v2 currently has no logging calls, while the troubleshooting docs say role=server includes permission activity. I've passed this on to the maintainers.

   recording.mp4

   

   Reproduction script (drive.ts)

   // Reproduce anomalyco/opencode#56247: v2 writes no permission evaluation/ask lines to opencode.log.
   // Triggers a shell `ask` rule and an external_directory read, answers both prompts,
   // then prints every log line mentioning permissions from the isolated opencode.log.
   import { Effect } from "effect"
   import { readFileSync, mkdirSync, writeFileSync, readdirSync } from "node:fs"
   import { join } from "node:path"
   import { Llm, OpenCodeDriver } from "opencode-drive"
   
   mkdirSync("/tmp/outside", { recursive: true })
   writeFileSync("/tmp/outside/note.txt", "outside\n")
   
   export default OpenCodeDriver.use(
     {
       ...(process.env.OC_DEV ? { opencode: { dev: process.env.OC_DEV } } : {}),
       tui: { recording: true },
       config: { permissions: [{ action: "shell", resource: "*", effect: "ask" }] } as any,
       project: { git: true, files: { "README.md": "hi\n" } },
     },
     ({ ui, llm, artifacts }) =>
       Effect.gen(function* () {
         yield* llm.queue(
           Llm.toolCall({ index: 0, id: "call_sh", name: "shell", input: { command: "touch made-by-shell.txt", description: "touch file" } }),
           Llm.finish("tool-calls"),
         )
         yield* llm.queue(
           Llm.toolCall({ index: 0, id: "call_rd", name: "read", input: { path: "/tmp/outside/note.txt" } }),
           Llm.finish("tool-calls"),
         )
         yield* llm.queue(Llm.text("All done."))
         yield* ui.submit("Touch a file, then read /tmp/outside/note.txt")
         // shell ask prompt
         yield* Effect.sleep("3 seconds")
         yield* ui.screenshot("shell-prompt")
         yield* ui.enter()
         // external_directory prompt
         yield* Effect.sleep("3 seconds")
         yield* ui.screenshot("external-prompt")
         yield* ui.enter()
         yield* ui.waitFor("All done.")
         yield* ui.screenshot("after")
         const files = (readdirSync(artifacts, { recursive: true }) as string[]).filter((f) => /opencode[^/]*\.log$/.test(f))
         console.log("log files:", files)
         const log = files.flatMap((f) => readFileSync(join(artifacts, f), "utf8").split("\n"))
         const server = log.filter((l) => l.includes("role=server"))
         const perm = log.filter((l) => /permission|evaluated|asking|per_/i.test(l))
         console.log(`opencode.log: ${log.length} lines, ${server.length} role=server lines`)
         console.log(`permission-related lines: ${perm.length}`)
         for (const l of perm) console.log("  " + l)
       }),
   )

   Run it with opencode-drive: opencode-drive run ./drive.ts. It drives opencode from your PATH; set OC_DEV to the path of an OpenCode checkout to run that from source instead.
2. opencode-agent

   added

   reproduced

   on Oct 16, 2026
3. opencode-agent commented on Oct 16, 2026

   

   opencode-agentBot

   on Oct 16, 2026 – with OpenCode Agent

   Contributor

   More actions

   User opencode-agent[bot] does not have write permissions

   github run
4. ZXLyyds100 commented on Oct 16, 2026

   

   ZXLyyds100

   on Oct 16, 2026

   More actions

   I'd like to work on this. Current dev has no permission-service logging, and I found no linked or matching V2 fix PR.

   I'll reproduce it through the real permission service, restore evaluation and ask/reply diagnostics, and cover configured denials, saved approvals, and pending-request cleanup. I'll keep permission decisions unchanged and avoid dumping full rulesets, command/path resources, metadata, or rejection feedback into the new logs. The evidence will use isolated local fixtures without a paid model or an existing user session.
5. MudadlaPranay12

   added 4 commits that reference this issue on Nov 12, 2026

   core, protocol, plugin: implement structured permission decision diag…

   ...

   This issue will close once commit a46303f is merged into the 'dev' branch.

   a46303f

   core, protocol, plugin: implement structured permission decision diag…

   ...

   This issue will close once commit b18ab95 is merged into the 'dev' branch.

   b18ab95

   core, protocol, plugin, server: implement structured permission decis…

   ...

   This issue will close once commit 08031c9 is merged into the 'dev' branch.

   08031c9

   core, protocol, plugin, server: implement structured permission decis…

   ...

   This issue will close once commit 8dfd9a7 is merged into the 'dev' branch.

   8dfd9a7