Headless opencode run: any permission resolving to "ask" hangs forever, no timeout (three repro paths) #36762

Description

In non-interactive opencode run (no TTY), any permission check that resolves to ask blocks forever: no prompt can render, there is no timeout, and the process looks busy while spending nothing. The only external signature is a message=asking log line (with --print-logs) and flat spend.

We hit this through three independent paths (all verified on 1.17.18):

1. Uncovered permission class: config has a permission.bash pattern map + skill: deny but no external_directory entry. A subagent reads a path outside the project → external_directory defaults to ask → hang.
2. Pipeline arbitration: top-level bash pattern map ending "*": "deny" with "npx *": "allow". A piped command like npx tsc | head -40 evaluates segments separately; mixed verdicts escalate to ask → hang.
3. Agent-level permission.bash maps not honored (agent-level edit IS honored) — falls back to ask → hang. Possibly its own bug; included here as an ask-path.

Expected: when stdin is not a TTY, ask should fail fast — auto-resolve to deny with a non-zero exit and a clear error, or be controllable via a flag (e.g. --non-interactive=deny). A documented list of every permission class that can reach ask would let operators close them all in config.

Related: #14473 described the external_directory case in server mode and was auto-closed by the staleness bot (which suggested opening a new issue); #7876 was cited there as the same root cause; #35073 covers the sync-subagent variant. This issue is the general headless opencode run case with the three repro paths above.

Side effect worth noting: with Anthropic-family models a >5-min hang expires the prompt cache, so even a recovered session pays a full-context cache re-write.

Plugins

None

OpenCode version

1.17.18

Steps to reproduce

1. Config: {"permission": {"bash": {"npm *": "allow", "*": "deny"}, "skill": "deny"}} (no external_directory entry).
2. From a non-TTY shell: opencode run --print-logs --log-level INFO "read ~/somefile-outside-the-project and summarize it" > log 2>&1
3. Log shows message=asking, then nothing, indefinitely. (Paths 2 and 3 above reproduce the same hang via different ask routes.)

Operating System

macOS (darwin 25.5.0), node v22.13.1

Terminal

Non-TTY (headless invocation)