Default permissions allow editing files and executing any commands

In my opinion very strange that Opencode allows any actions by default. I did not know any other AI tool with the same behaviour. It would be cool to have default permissions set – always ask for editing, and also always ask for critical commands, etc.

This issue might be a duplicate of existing issues. Please check:

Feature Request: Add Prefix Requirements for Permission Prompts #2521: Comprehensive feature request for adding prefix requirements for permission prompts to prevent accidental approvals of sensitive operations
Feature Request: Yolo and non-Yolo mode (auto-accept) #1813: Feature request for easily switching between 'ask' permissions and 'allow all' (yolo) mode, similar to Claude Code's permission modes
[FEATURE] add exec tool as more secure alternative to bash tool #2206: Proposal for more secure alternatives to bash tool and general security improvements for command execution
[SECURITY] allow ignoring files to prevent secrets being leaked from .env to LLM #539: Security-focused issue about preventing secrets from being leaked to LLM through file access controls

Feel free to ignore if none of these address your specific case.

This was done very intentionally by the team they felt like this was a better UX and better default when they made the decision

This was done very intentionally by the team they felt like this was a better UX and better default when they made the decision

Maybe "BUILD WITHOUT ASK" predefined agent could be an option. I spent much time to research how to setup permissions and define tools I use. I think almost all users managed permissions and I am not alone)

most people initially think they want permissions and then actually prefer not having them so that's why our defaults work this way

majority of people never turn them on so we won't flip the defaults. let us know if the docs around permissions or the feature itself is lacking in a new issue

I can't imagine how can work in a real project without permissions. There is one option - Opencode is used only for playing around and forgetting)

I use it everyday in real projects at work, so do my coworkers, none of us use permissions

I think it is just a preference thing, if the llm makes a mistake I just do /undo and start over or try a fresh session

I use git worktrees so sometimes I just have a branch I am using it on and I do more focused work on separate ones

@rekram1-node

@rekram1-node you can't undo creating MR with wrong target branch/description or undoing any bash command also impossible. In Claude Code / Windsurf / Warp I can refine result. It much faster and safe

True, i just don't have my agents do anything destructive I generally dont prompt about git commands other than git diff and git log and I've never had it go off the rails for me. Granted I know that is a possibility but I have protecctions in place to ensure that force pushes to main can't happen, etc

@rekram1-node

@rekram1-node as an option please provide possibility to generate opencode.json with normal permission handling in /init command. Ask what user needs (and add statistics tracking optionally). Allow anything by default is an stopper for several users because it's dangerous. I recommended Opencode for friends and they are surprised by this behaviour.

why not wrap it in a sandbox/container?

why not wrap it in a sandbox/container?

wrap remote services?)) I want to allow access to them, but with explicit consent. In addition in many cases you should disallow edit and prompt to do it in right way

I want to allow access to them, but with explicit consent

I mean you can, but why force everybody else to add boilerplate to their configs? if you are going to give your AI access to a prod db, you're probably motivated enough to rtfm and figure out the permissions

in many cases you should disallow edit and prompt to do it in right way

in my experience it's better/faster/easier to either let the agent iterate or undo and re-prompt (or just do it yourself)

@thdxr

most people initially think they want permissions and then actually prefer not having them so that's why our defaults work this waymajority of people never turn them on so we won't flip the defaults. let us know if the docs around permissions or the feature itself is lacking in a new issue

Hello my friend, I wanted to set edit+bash perms but the doc is not clear on where exactly this opencode.json permission file goes. The doc page literally only says "You can configure this using the permission option." and shows the .json example. I do feel like I might be acting a little blind here but I don't really know where to set it haha @thdxr

Edit: I did realize it goes in the local folder I ran the opencode tool now. I just asked because I thought opencode did not see the file or maybe I needed to restart the tool. Thanks.

@gkp1

@gkp1 global one goes:

~/.config/opencode/opencode.json

@gkp1

@gkp1 global one goes:

~/.config/opencode/opencode.json

Great thanks! Should def add it in the doc, I'll see if I can submit a pr adding these 2 options there if the doc is in this repo

It is documented in the config section, but if you have recommendations to make things more clear feel free to add a pr

Just installed opencode, which looks great. However, I was very surprised by this decision. If developers want this then great. But it's really essential that there should be a warning on the first run of Open Code that it is set like this. I was working on an important project and noticed the model running away doing all sorts of things and had to press escape. The model made various git hub commits without asking me first. Thankfully the project wasn't ruined in any way but it was a bit weird to be honest. Thanks.

You should never run opencode without very restrictive permissions in place. Even simple bash commands like find can be very destructive if combined with the -exec parameter. I experienced this myself while being in plan mode. The whole security concept for opencode is flawed. So much can go wrong.
The llm shouldn't use these commands to do basic work. Instead, there should be tools shipped with the cli to perform these operations in a safe manner.

Furthermore, I don't want content of my homedir to be read by agents, except some specific dirs, like reading memory from calude code.

Perhaps somebody have sane opencode.jsonc file with permissions so I can use it?

@Mart-Bogdan

@Mart-Bogdan you can setup but OpenCode can ignore your rules randomly.

Well, I'm telling not about RULES.md but about restrictions on tool calling. I know that it can use bash to read any files.

I've set up some rules in opencode.jsonc. Desktop mode of open code ignored them, lol.

fwiw this thread gives me such bad vibes. Not trying to throw shade, but just being honest about how much i feel like I'm taking crazy pills while reading things here that are presumably the views of the maintainers. Feels very irresponsible as defaults, and not respecting agency or thoughtful ways to enter into agentic coding (ie. watching it first and building trust)

fwiw this thread gives me such bad vibes. Not trying to throw shade, but just being honest about how much i feel like I'm taking crazy pills while reading things here that are presumably the views of the maintainers. Feels very irresponsible as defaults, and not respecting agency or thoughtful ways to enter into agentic coding (ie. watching it first and building trust)

yep, project looks promising but I switched to Claude Code / Codex where I can control everything and UX more predictable. Maintainers should find real problems and improve product, instead it they are improving TUI interface, search of files, another optional staff

Navigation Menu

Repository navigation

Default permissions allow editing files and executing any commands #2632

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Default permissions allow editing files and executing any commands #2632

Description

Activity

github-actions commented on Sep 16, 2025

rekram1-node commented on Sep 16, 2025

NaikSoftware commented on Sep 16, 2025

thdxr commented on Sep 17, 2025

NaikSoftware commented on Sep 17, 2025

rekram1-node commented on Sep 17, 2025

NaikSoftware commented on Sep 17, 2025

rekram1-node commented on Sep 17, 2025

NaikSoftware commented on Sep 17, 2025

anuramat commented on Sep 23, 2025

NaikSoftware commented on Sep 23, 2025

anuramat commented on Sep 24, 2025

gkp1 commented on Dec 8, 2025

rekram1-node commented on Dec 8, 2025

gkp1 commented on Dec 8, 2025

rekram1-node commented on Dec 8, 2025

Michael-Z-Freeman commented on Mar 27, 2026

T3rm1 commented on Apr 8, 2026

Mart-Bogdan commented on Apr 13, 2026

NaikSoftware commented on Apr 13, 2026

Mart-Bogdan commented on Apr 15, 2026

patcon commented on Jul 11, 2026

NaikSoftware commented on Aug 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions