Skip to content

Opencode ran command explicitly set to ask without asking #45932

Closed as not planned

Description

@Quanalogy

Description

There are similar issues but they involve agents and this does not, therefore I'm opening a new issue.

I just asked opencode to fix an issue I have with kong starting up and it ran kubectl without asking, eventhough I have it set to ask under permissions (see config below).

Image

I asked it if I had allowed it to do so in session and that was a no as well:

Image

my global config at ~/.config/opencode/opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "lsp": true,
  "plugin": ["superpowers@git+https://github.com/obra/superpowers.git"],
  "mcp": {
    "atlassian": {
      "type": "remote",
      "url": "https://mcp.atlassian.com/v1/mcp/authv2",
      "enabled": true
    }
  },
  "permission": {
    "bash": {
      "*": "ask",
      "* --version": "allow",
      "bash --version": "allow",
      "base64 *": "allow",
      "bun --version": "allow",
      "cat *": "allow",
      "diff *": "allow",
      "echo *": "allow",
      "find *": "allow",
      "git add *": "ask",
      "git commit *": "ask",
      "git diff *": "allow",
      "git log *": "allow",
      "git show *": "allow",
      "git tag *": "deny",
      "git push *": "ask",
      "git status*": "allow",
      "git -C * status*": "allow",
      "gh *": "ask",
      "go build *": "allow",
      "go test *": "allow",
      "gofmt *": "allow",
      "golangci-lint *": "allow",
      "grep *": "allow",
      "head *": "allow",
      "kubectl*": "ask",
      "kubectl kustomize*": "allow",
      "ls *": "allow",
      "make lint": "allow",
      "mkdir -p /tmp/opencode/*": "allow",
      "npm --version": "allow",
      "node --version": "allow",
      "nvim --version": "allow",
      "opencode --version": "allow",
      "pwd *": "allow",
      "rg *": "allow",
      "sops *": "deny",
      "sudo *": "deny",
      "tail *": "allow",
      "terraform * fmt*": "allow",
      "uniq *": "allow",
      "wc *": "allow",
      "which *": "allow",
      "xargs *": "allow"
    },
    "external_directory": {
      "*": "ask",
      "/tmp/opencode/*": "allow"
    }
  }
}

Plugins

superpowers

OpenCode version

1.18.25

Steps to reproduce

Usually this does not happen so I don't know how to replicate starting a new session in an empty directory yields a block:

Image

Starting a new session in same directory yields an ask:

Image

Screenshot and/or share link

Sorry but I cannot share this session

Operating System

Fedora 44

Terminal

Ghostty

Activity

  1. github-actions commented on Aug 28, 2026

    @github-actions
    Contributor

    This issue might be a duplicate of existing issues. Please check:

    Your config has "*": "ask" as the first rule and "kubectl*": "ask" further down. The rule evaluation order or pattern matching may be the root cause shared across these issues.

  2. thdxr commented on Oct 11, 2026

    @thdxr
    Member

    Thanks for the report! OpenCode 2.0 is now out and development is focused on V2, so we're closing issues filed against OpenCode 1. Please upgrade (opencode upgrade --major, details: https://anoma.ly/notes/opencode-2-0), and if this is still relevant on 2.0, reopen this issue or open a new one with your 2.0 version.

    — from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions