Repository navigation
Closed as not planned
Description
Description
There are similar issues but they involve agents and this does not, therefore I'm opening a new issue.
I just asked opencode to fix an issue I have with kong starting up and it ran kubectl without asking, eventhough I have it set to ask under permissions (see config below).
I asked it if I had allowed it to do so in session and that was a no as well:
my global config at ~/.config/opencode/opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"lsp": true,
"plugin": ["superpowers@git+https://github.com/obra/superpowers.git"],
"mcp": {
"atlassian": {
"type": "remote",
"url": "https://mcp.atlassian.com/v1/mcp/authv2",
"enabled": true
}
},
"permission": {
"bash": {
"*": "ask",
"* --version": "allow",
"bash --version": "allow",
"base64 *": "allow",
"bun --version": "allow",
"cat *": "allow",
"diff *": "allow",
"echo *": "allow",
"find *": "allow",
"git add *": "ask",
"git commit *": "ask",
"git diff *": "allow",
"git log *": "allow",
"git show *": "allow",
"git tag *": "deny",
"git push *": "ask",
"git status*": "allow",
"git -C * status*": "allow",
"gh *": "ask",
"go build *": "allow",
"go test *": "allow",
"gofmt *": "allow",
"golangci-lint *": "allow",
"grep *": "allow",
"head *": "allow",
"kubectl*": "ask",
"kubectl kustomize*": "allow",
"ls *": "allow",
"make lint": "allow",
"mkdir -p /tmp/opencode/*": "allow",
"npm --version": "allow",
"node --version": "allow",
"nvim --version": "allow",
"opencode --version": "allow",
"pwd *": "allow",
"rg *": "allow",
"sops *": "deny",
"sudo *": "deny",
"tail *": "allow",
"terraform * fmt*": "allow",
"uniq *": "allow",
"wc *": "allow",
"which *": "allow",
"xargs *": "allow"
},
"external_directory": {
"*": "ask",
"/tmp/opencode/*": "allow"
}
}
}Plugins
superpowers
OpenCode version
1.18.25
Steps to reproduce
Usually this does not happen so I don't know how to replicate starting a new session in an empty directory yields a block:
Starting a new session in same directory yields an ask:
Screenshot and/or share link
Sorry but I cannot share this session
Operating System
Fedora 44
Terminal
Ghostty
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Aug 28, 2026
This issue might be a duplicate of existing issues. Please check:
bashpermissiondenyrules are ignored when*: askis present #28682:bashpermissiondenyrules are ignored when*: askis present — similar pattern where specific permission rules are not respected when a wildcard catch-all (*: ask) is also configuredrm *,mv *,cp *patterns #39001: bash permission rules non-deterministic forrm *,mv *,cp *patterns — related to glob pattern matching issues in permission evaluationpermission.bashpattern maps: "*": "deny" fallback removes the bash tool from all agents; deny patterns under an allow fallback are ignored #36765:permission.bashpattern maps: deny patterns under an allow fallback are ignored — overlapping theme of specific rules losing to catch-all rulesYour config has
"*": "ask"as the first rule and"kubectl*": "ask"further down. The rule evaluation order or pattern matching may be the root cause shared across these issues.thdxr commentedon Oct 11, 2026
Thanks for the report! OpenCode 2.0 is now out and development is focused on V2, so we're closing issues filed against OpenCode 1. Please upgrade (
opencode upgrade --major, details: https://anoma.ly/notes/opencode-2-0), and if this is still relevant on 2.0, reopen this issue or open a new one with your 2.0 version.— from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊