Change default permissions for bash, edit, and webfetch from allow → ask #2148
+162
−110
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Why rather than ? https://opencode.ai/docs/permissions/#bash I don't understand why this PR is not default, I don't want the agent all over my hard drive by default! |
Author
|
rebased |
github-actions
bot
force-pushed
the
dev
branch
from
f16de3d to
cc0d460
Compare
github-actions
bot
force-pushed
the
dev
branch
from
772b621 to
eb855e1
Compare
github-actions
bot
force-pushed
the
dev
branch
3 times, most recently
from
f1dc981 to
3e15a39
Compare
github-actions
bot
force-pushed
the
dev
branch
2 times, most recently
from
df8bdf9 to
0dd5039
Compare
2 tasks
BackSlasher
added a commit
to BackSlasher/opencode
that referenced
this pull request
Jan 16, 2026
Changes the default "*": "allow" to "*": "ask" in agent defaults to prevent auto-execution of potentially dangerous operations like bash commands, file edits, and web fetches without user approval. This addresses security concerns raised in anomalyco#2148 where users were surprised that OpenCode allowed arbitrary shell commands and file modifications by default without prompting. The build agent and other agents still function correctly as they explicitly override permissions where needed. Testing: - `bun test test/tool/bash.test.ts`: 12 pass, 0 fail - `bun test test/tool/ test/agent/ test/permission/`: 106 pass, 28 fail - Agent test failures are due to unrelated import issues, not this change - Verified bash permission tests work correctly with new default
|
Did fresh in #8939 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR changes the defaults for bash, edit, and webfetch tools to ask instead of allow.
Why:
Safety: Prevents accidental shell commands, file edits, or network requests that could be destructive or surprising for new users.
Trust & onboarding: New users expect potentially risky actions to require confirmation. Default-allow can feel unsafe and discourage adoption.
I was personally burned by these defaults when trying out opencode for the first time and qwen 3 coder just edited files with shell commands when it could not use the edit tool because it was in Planning mode.
The gemini-cli defaults to ask which felt much saner when trying it out i don't expect an ai-cli tool to just let an agent run arbitrary shell commands on my system by default.