Permission deny rules overridden by 'Allow always' approval

[de-mh]

Description

Once a user clicks "Allow always" on any edit permission prompt, all deny rules in the permission config stop working for the rest of the session.

The edit tool passes always: ["*"], which stores {permission: "edit", pattern: "*", action: "allow"} in the approved list. Because evaluate() uses findLast across [...ruleset, ...approved], this broad approved allow always wins over specific deny rules from the user's config.

Example config that stops being enforced:

"permission": {
  "edit": {
    "*": "ask",
    "AGENTS.md": "deny"
  }
}

After clicking "Allow always" on any single edit prompt, edits to AGENTS.md go through without any denial or prompt.

Plugins

None

OpenCode version

1.14.30 (also reproduced on latest dev)

Steps to reproduce

1. Configure "edit": { "*": "ask", "SECRET.md": "deny" } in opencode.json
2. Ask the agent to edit any file (e.g., test.txt)
3. When the permission prompt appears, click "Allow always"
4. Ask the agent to edit SECRET.md
5. The edit goes through — no denial, no prompt. The deny rule is silently bypassed.

Screenshot and/or share link

No response

Operating System

macOS but but exists on any OS.

Terminal

macOS Terminal

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• [BUG] “Always allow” TUI approvals override restrictions for all agents #9554: Describes the same root cause — "Always allow" TUI approvals use findLast across [...ruleset, ...approved], causing approved broad rules to override specific deny rules from config, affecting all agents/sessions in the process.

[de-mh]

This issue might be a duplicate of existing issues. Please check:

• [BUG] “Always allow” TUI approvals override restrictions for all agents #9554: Describes the same root cause — "Always allow" TUI approvals use findLast across [...ruleset, ...approved], causing approved broad rules to override specific deny rules from config, affecting all agents/sessions in the process.

This is similar but no it's not duplicate. That one is about cross agent leakage but this is more severe. The permissions from ~/.config/opencode/opencode.json are overridden.