Description
Custom agents defined in opencode.json with explicit deny permissions have those permissions completely ignored when the agent is invoked via the OpenCode SDK. The agent can freely use denied tools.
This is related to but distinct from:
The difference here is that I'm not trying to override built-in agents or use plugins - I have a custom agent with explicit denies that are simply not enforced.
Security Impact
This is a security issue for pipelines using OpenCode SDK to run constrained agents. Denied tools can be used freely, bypassing intended restrictions.
Environment
- OpenCode Version: 1.0.218
- OS: macOS (darwin)
- Installation: npm
Reproduction Steps
1. Define a custom agent with denied tools in opencode.json:
{
"agents": {
"edit": {
"model": "anthropic/claude-sonnet-4-20250514",
"permission": {
"read": { "*": "allow" },
"write": { "*": "deny" },
"edit": { "*.mdx": "allow", "*": "deny" },
"glob": { "*": "allow" },
"grep": { "*": "allow" },
"bash": { "*": "deny" },
"pty_spawn": "deny",
"pty_write": "deny",
"pty_read": "deny",
"pty_list": "deny",
"pty_kill": "deny"
}
}
}
}2. Create the agent prompt in .opencode/agent/edit.md:
You are a documentation editor focused on MDX files.
You should ONLY use read, edit, glob, and grep tools.
DO NOT use bash, PTY, or write tools.
3. Invoke the agent via SDK:
import { Session, Permissions } from "@opencode-ai/sdk"
const session = await Session.start({
path: projectPath,
agent: "edit"
})
const response = await session.prompt({
thread: "main",
text: "List all open beads issues"
})4. Observe the agent using denied tools:
✓ pty_spawn: pty_spawn({"command":"bd","args":["list","--status=open"...) (112ms)
✓ pty_write: pty_write({"id":"pty_b4e0438a","data":"bd list --status=i...) (77ms)
✓ pty_read: pty_read({"id":"pty_b4e0438a","limit":50}) (6ms)
Expected Behavior
The agent should be blocked from using pty_spawn, pty_write, pty_read (and other denied tools). The SDK should enforce permissions defined in opencode.json.
Actual Behavior
The agent freely uses all denied tools. Permission denies have no effect when the agent is invoked via SDK.
Additional Context
The agent prompt correctly includes the custom .opencode/agent/edit.md content, so the agent definition is being loaded. Only the permissions are ignored.
This was discovered in a documentation generation pipeline where the edit agent was supposed to be constrained to read/edit/glob/grep only, but was found using PTY tools to run shell commands.
Note: Similar issues were searched before filing. This report was created with AI assistance.
Description
Custom agents defined in
opencode.jsonwith explicitdenypermissions have those permissions completely ignored when the agent is invoked via the OpenCode SDK. The agent can freely use denied tools.This is related to but distinct from:
The difference here is that I'm not trying to override built-in agents or use plugins - I have a custom agent with explicit denies that are simply not enforced.
Security Impact
This is a security issue for pipelines using OpenCode SDK to run constrained agents. Denied tools can be used freely, bypassing intended restrictions.
Environment
Reproduction Steps
1. Define a custom agent with denied tools in
opencode.json:{ "agents": { "edit": { "model": "anthropic/claude-sonnet-4-20250514", "permission": { "read": { "*": "allow" }, "write": { "*": "deny" }, "edit": { "*.mdx": "allow", "*": "deny" }, "glob": { "*": "allow" }, "grep": { "*": "allow" }, "bash": { "*": "deny" }, "pty_spawn": "deny", "pty_write": "deny", "pty_read": "deny", "pty_list": "deny", "pty_kill": "deny" } } } }2. Create the agent prompt in
.opencode/agent/edit.md:3. Invoke the agent via SDK:
4. Observe the agent using denied tools:
Expected Behavior
The agent should be blocked from using
pty_spawn,pty_write,pty_read(and other denied tools). The SDK should enforce permissions defined inopencode.json.Actual Behavior
The agent freely uses all denied tools. Permission denies have no effect when the agent is invoked via SDK.
Additional Context
The agent prompt correctly includes the custom
.opencode/agent/edit.mdcontent, so the agent definition is being loaded. Only the permissions are ignored.This was discovered in a documentation generation pipeline where the edit agent was supposed to be constrained to read/edit/glob/grep only, but was found using PTY tools to run shell commands.
Note: Similar issues were searched before filing. This report was created with AI assistance.