Repository navigation
[bug] No pre-flight validation before tool execution despite tool.execute.before hooks #33076
Description
Description
opencode's tool.execute.before hook infrastructure exists (packages/opencode/src/session/tools.ts L54-L69) but has no built-in pre-flight safety validation. The hook is only wired for plugin triggering, not for safety checks.
This means:
- Edit tool silently deletes referenced symbol definitions (see [bug] Edit tool silently deletes symbol definitions without cross-reference validation #33062)
- Bash tool executes destructive commands (
git reset --hard,rm -rf) without warning - Write tool can write empty content over existing files
- No tool verifies that AGENTS.md rules are being followed
Expected behavior
Add a built-in pre-flight validation layer to the tool.execute.before hook that checks all tool invocations for destructive or unsafe operations before execution.
Code location
https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/session/tools.ts#L54-L69
Environment
OpenCode Desktop 1.17.8, Windows 11
About the duplicate flag: This issue covers ALL tools and proposes a centralized safety architecture in the tool.execute.before hook. #33062 (edit silently deletes symbols) is a narrower bug report about one specific missing validation in the edit tool. This issue is the meta-level design for where safety checks should live and how they should be routed. If #33062 is fixed, this issue (and the rest of the missing validations) remain.
Activity
github-actions commentedon Jun 20, 2026
This issue might be a duplicate of existing issues. Please check:
If you believe this is a distinct issue covering the broader pre-flight validation architecture rather than any single tool, please clarify how it differs from #33062 and consider narrowing the scope to a single reproducible problem.
Necmttn commentedon Jun 21, 2026
Pre-flight safety should be a verdict-producing layer, not only plugin callbacks. A built-in guard can evaluate normalized tool intents and return
allow|warn|blockwith rule id, reason, affected paths/commands, and whether the user can override.Start with narrow invariants: empty Write over existing file, destructive Bash patterns, write without prior read for governed files, and workspace escape. Persist the verdict receipt so later audits can tell whether a dangerous action was blocked, warned, or never inspected.
Generated with ax.
rekram1-node commentedon Jun 22, 2026
STOP SPAMMING ISSUES.