Skip to content

Permissions are no longer working after 6 to 8 weeks as is #15754

Closed as not planned

Description

@morcth

Description

I have been using:

  "permission": {
    "bash": {
      "git push": "ask",
      "git commit *": "ask",
      "rm *": "ask"
    },
    "external_directory": "ask"
  },

for all work related projects and it has been working flawless for a while.

I noticed today that the agent was reviewing files in other projects and able to commit with no asking.

Plugins and MCP show up fine under status.

I use web instances

Plugins

Context7, Superpowers

OpenCode version

v1.2.15

Steps to reproduce

Add Bash and external directory "ask" permissions to your opencode.json:
"permission": {
"bash": {
"git commit *": "ask"
},
"external_directory": "ask"
},

Check if it works. For me it has stopped.

Screenshot and/or share link

No response

Operating System

Mint 22.2

Terminal

xterm-256color

Activity

  1. added
    coreAnything pertaining to core functionality of the application (opencode server stuff)
    on Mar 2, 2026
  2. github-actions commented on Mar 2, 2026

    @github-actions
    Contributor

    This issue might be a duplicate of existing issues. Please check:

    If your issue is distinct (e.g., a regression specific to a recent version or only affecting web instances), please let us know what makes it different.

  3. morcth commented on Mar 2, 2026

    @morcth
    Author

    I did just try putting the permissions under agent -> build as seen in the related tickets with no luck.

     "agent: {   
        "build": {
          "permission": {
            "bash": {
              "git push": "ask",
              "git commit *": "ask",
              "rm *": "ask"
            },
            "external_directory": "ask"
          },
        }
    }
    
  4. 621625 commented on Mar 17, 2026

    @621625

    I second this. Important security flaw must be fixed immediately.

  5. assigned and unassigned on Apr 26, 2026
  6. removed
    bugSomething isn't working
    coreAnything pertaining to core functionality of the application (opencode server stuff)
    on May 3, 2026
  7. github-actions commented on Jul 3, 2026

    @github-actions
    Contributor

    To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions