Repository navigation
agent: shell deny on a child agent breaks model calls with free-tier auth error #53908
Closed as duplicate
Description
Summary
A custom subagent whose permissions deny shell fails every model call with an authentication error about the free tier, instead of running with shell commands simply unavailable. The identical agent with edit denied instead of shell works fine — so the deny rule itself appears to break the auth path.
Environment
- opencode version: v2.0.24
- OS: Linux 7.0.0-38-generic (linux x86_64)
- Terminal: ghostty (TERM=xterm-256color, TERM_PROGRAM=ghostty, COLORTERM=truecolor)
- Shell: /bin/bash
- Install/channel: latest release
- Active plugins: custom-tools (repo-local
.opencode/plugins/custom-tools.ts)
Reproduction
-
Create
~/.config/opencode/agents/probe-shell-deny.md:--- description: "Probe agent - shell deny only" mode: subagent permissions: - action: shell resource: "*" effect: deny --- Reply with exactly: PROBE-SHELL-DENY-OK
-
From any parent agent, launch it as a subagent (e.g. from
build): "Launch the probe-shell-deny subagent and report its verbatim reply". -
The child session is created successfully; the model call inside it fails.
Expected Behavior
The child session runs and replies; actual shell commands are denied when it attempts them.
Actual Behavior
Every model call in the child fails:
AI.Error.Authentication: OpenCode's free tier can only be used from within OpenCode
Server log:
level=ERROR message="Failed to drain Session"
cause="AI.Error: OpenCode's free tier can only be used from within OpenCode ...
[cause]: AI.Error.Authentication: OpenCode's free tier can only be used from within OpenCode"
role=server sessionID=<child-session-id>
Additional Context
- Controls from the same parent session, same model (
opencode/big-pickleon every child session record):shelldeny → fails (4/4 across two agents)editdeny only → works- no permissions block → works
- builtin
explore→ works
- The child session is always created; failure happens at the first model step, which suggests the free-tier auth path exercises an internal shell/tool operation that the child's deny rule silently blocks, surfacing as an auth error rather than a permission error.
- Consistent, not intermittent.
- Workaround: deny
editonly (docs sayeditcovers edit/write/patch tools) and enforce "no shell commands" via the system prompt.
Activity
opencode-agent commentedon Oct 8, 2026
Thanks for the careful control experiments! I think this is a duplicate of #50627. It's the same
shelldeny rule on a custom agent causing the same free-tier error on v2, and changing the rule toaskorallowmakes it work. People there narrowed it down: the free-tier check rejects requests whose tool list doesn't include the shell tool, and adenyrule removes that tool from the list. That would explain whyeditdeny works andshelldeny doesn't.Possible duplicates and related issues, ordered from most to least likely:
shelldeny on a custom agent) and the same free-tier error on v2, with the root-cause analysisedit+shelldenytools.read = false) causes the same free-tier failureUntil it's fixed, a workaround reported in #50627 is to set
shelltoaskinstead ofdeny. The tool then stays in the tool list and each command still needs approval.The bot will close this issue as a duplicate in 1 day unless you reply explaining how your problem is different.
MohamedElseify commentedon Oct 8, 2026
Confirmed — this is a duplicate of #50627, thank you for the root-cause pointer.
Our control matrix on v2.0.24 corroborates the tool-list explanation exactly:
shelldeny → 4/4 auth failures (two different custom agents)editdeny only → worksexplore→ worksAll children on the same model, same parent session, and it reproduced after a service restart. One small additional data point: it also happens with
mode: allagents spawned as subagents, not onlymode: subagent.We've adopted the
askworkaround from #50627 on our read-only agents and can confirm it holds on v2.0.24: withshell: effect: askthe child launches and replies normally, while every command still needs approval. Agreeing to close as duplicate.opencode-agent commentedon Oct 9, 2026
Closing this as a duplicate of #50627. We waited a day for a reply explaining how this differs, and there wasn't one. #50627 reports the same problem on v2: a
shelldeny rule on a custom agent makes free-tier model calls fail with "OpenCode's free tier can only be used from within OpenCode". Please follow that issue for updates, and add your v2.0.24 subagent results there if they help. Until it's fixed, the workaround reported there is to setshelltoaskinstead ofdeny. If your problem turns out to be different, reply here and we can reopen.