Opencode ignoring deny permissions?

[mejobloggs-cw]

Description

I was using my "Plan-Expensive" mode, and during planning I asked it to write a todo.md file expecting it to update the plan with a plan to write the todo.md file, but actually it created the file

        "plan-expensive": {
            "description": "A higher-capability planning mode for difficult design, refactoring, and codebase analysis tasks.",
            "mode": "primary",
            "model": "github-copilot/gpt-5.5",
            "variant": "high",
            "reasoningEffort": "high",
            "textVerbosity": "low",
            "permission": {
                "edit": "deny",
                "bash": "deny"
            }
        }

The docs (https://opencode.ai/docs/permissions/) say:

edit — all file modifications (covers edit, write, patch)

Why / How did it create the file when it was denied edit permission, which the docs say includes "write"?

Plugins

None

OpenCode version

1.14.33

Steps to reproduce

Create an agent with

"permission": {
                "edit": "deny",
                "bash": "deny"
            }

Then ask it to create a todo.md file saying "say hi"

It creates the file. I believe it should not have permission to create the file

Screenshot and/or share link

No response

Operating System

Debian

Terminal

No response

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• opencode not respecting permissions #8832: opencode not respecting permissions — same symptom of permission rules being ignored
• Permissions ignored #16331: Permissions ignored — similar report of configured deny rules not being enforced
• Permission rules not enforced for "edit" operation performed by Task subagents #23519: Permission rules not enforced for "edit" operation performed by Task subagents — specifically about edit deny not being enforced
• Granular permissions not working (or documentation bad?) #20307: Granular permissions not working (or documentation bad?) — same class of issue with per-agent permission config not working

If your issue is distinct from the above (e.g. it reproduces without subagents, or on a specific version), please note that in the issue.

[thdxr]

can you share opencode debug config

[mejobloggs-cw]

opencode debug config

{
  "$schema": "https://opencode.ai/config.json",
  "snapshot": false,
  "disabled_providers": [
    "opencode"
  ],
  "provider": {
    "copilot": {}
  },
  "model": "github-copilot/gpt-5.4",
  "agent": {
    "build": {
      "mode": "primary",
      "model": "github-copilot/gpt-5.4",
      "variant": "medium",
      "reasoningEffort": "medium",
      "textVerbosity": "low",
      "options": {
        "reasoningEffort": "medium",
        "textVerbosity": "low"
      },
      "permission": {}
    },
    "plan": {
      "mode": "primary",
      "model": "github-copilot/gpt-5.4",
      "variant": "high",
      "reasoningEffort": "high",
      "textVerbosity": "low",
      "permission": {
        "edit": "deny",
        "bash": "deny"
      },
      "options": {
        "reasoningEffort": "high",
        "textVerbosity": "low"
      }
    },
    "plan-expensive": {
      "description": "A higher-capability planning mode for difficult design, refactoring, and codebase analysis tasks.",
      "mode": "primary",
      "model": "github-copilot/gpt-5.5",
      "variant": "high",
      "reasoningEffort": "high",
      "textVerbosity": "low",
      "permission": {
        "edit": "deny",
        "bash": "deny"
      },
      "options": {
        "reasoningEffort": "high",
        "textVerbosity": "low"
      }
    }
  },
  "watcher": {
    "ignore": [
      ".git/**",
      ".vs/**",
      "bin/**",
      "obj/**",
      "node_modules/**",
      "dist/**",
      "build/**",
      "coverage/**",
      "**/*.map",
      "**/*.min.*",
      "*.log"
    ]
  },
  "mode": {},
  "plugin": [],
  "command": {},
  "username": "xxxx"
}

[thdxr]

i tested that config and it works fine. you might want to have it deny the task: { general: "deny"} so it can't spawn a subagent that can edit

[mejobloggs-cw]

With my config, using "Plan-Expensive", it will create a new file 100% of the time with the prompt:

```create a todo.md file that says hello world"``

I confirm that by adding permission:

"task": { "general": "deny"}

Plan-Expensive can no longer create the file.

But why does it ignore "edit": "deny" and "bash": "deny" ?

It seems like a permissions vulnerability if an agent is explicitly denied write access, but can just spawn a subagent that's allowed write access