Description
I'm trying to call the opencode cli via opencode run. Given my configuration, some tools are "ask"; if the agent tries, session fails correctly (autoreject). However, if the agent calls a sub-agent and this one tries to call a forbidden tool, the session hangs forever.
Plugins
None
OpenCode version
1.4.3
Steps to reproduce
configuration:
{
"$schema": "https://opencode.ai/config.json",
"autoupdate": true,
"default_agent": "plan",
"share": "disabled",
"permission": {
"*": "allow",
"read": {
"*": "allow",
"*.env": "deny",
"*.env.*": "deny",
"*.pem": "deny",
"*.key": "deny",
"*credentials*": "deny",
"*secret*": "deny",
"**/.aws/**": "deny",
"**/.ssh/**": "deny",
"**/.gnupg/**": "deny",
"**/.kube/**": "deny",
"**/secrets/**": "deny",
".git/config": "deny"
},
"edit": {
"*": "allow",
"*.env": "deny",
"*.pem": "deny",
"*.key": "deny",
"*secret*": "deny"
},
"grep": "allow",
"glob": "allow",
"bash": {
"*": "ask",
"ls *": "allow",
"head *": "allow",
"git status *": "allow",
"git diff *": "allow",
"git log *": "allow",
"git branch -a": "allow",
"env": "deny",
"printenv *": "deny",
"export *": "deny",
"cat *.env*": "deny",
"cat *.key": "deny",
"rm -rf *": "deny",
"rm -r *": "deny",
"ssh *": "deny",
"curl *": "ask",
"npm install *": "ask",
"pip install *": "ask",
"brew install *": "ask",
"uv add *": "ask",
"uv sync": "ask",
"uv run *": "allow"
},
"webfetch": "allow",
"external_directory": "ask",
"tools": {
"websearch": "allow"
},
"experimental": {
"openTelemetry": "deny"
}
}
}run:
opencode run "this is a test, run a subagent. make the subagent run `npm run format`" --agent build --format json
Result: agent will call a subagent; subagent is denied access to the tool, but the cli process hangs and it remains there
Screenshot and/or share link
No response
Operating System
macOS 26.3.1
Terminal
kitty
Description
I'm trying to call the opencode cli via
opencode run. Given my configuration, some tools are "ask"; if the agent tries, session fails correctly (autoreject). However, if the agent calls a sub-agent and this one tries to call a forbidden tool, the session hangs forever.Plugins
None
OpenCode version
1.4.3
Steps to reproduce
configuration:
{ "$schema": "https://opencode.ai/config.json", "autoupdate": true, "default_agent": "plan", "share": "disabled", "permission": { "*": "allow", "read": { "*": "allow", "*.env": "deny", "*.env.*": "deny", "*.pem": "deny", "*.key": "deny", "*credentials*": "deny", "*secret*": "deny", "**/.aws/**": "deny", "**/.ssh/**": "deny", "**/.gnupg/**": "deny", "**/.kube/**": "deny", "**/secrets/**": "deny", ".git/config": "deny" }, "edit": { "*": "allow", "*.env": "deny", "*.pem": "deny", "*.key": "deny", "*secret*": "deny" }, "grep": "allow", "glob": "allow", "bash": { "*": "ask", "ls *": "allow", "head *": "allow", "git status *": "allow", "git diff *": "allow", "git log *": "allow", "git branch -a": "allow", "env": "deny", "printenv *": "deny", "export *": "deny", "cat *.env*": "deny", "cat *.key": "deny", "rm -rf *": "deny", "rm -r *": "deny", "ssh *": "deny", "curl *": "ask", "npm install *": "ask", "pip install *": "ask", "brew install *": "ask", "uv add *": "ask", "uv sync": "ask", "uv run *": "allow" }, "webfetch": "allow", "external_directory": "ask", "tools": { "websearch": "allow" }, "experimental": { "openTelemetry": "deny" } } }run:
opencode run "this is a test, run a subagent. make the subagent run `npm run format`" --agent build --format jsonResult: agent will call a subagent; subagent is denied access to the tool, but the cli process hangs and it remains there
Screenshot and/or share link
No response
Operating System
macOS 26.3.1
Terminal
kitty