auto upgrade to 1.1.1, surprise! commands no longer require approval

[aaronnewsome]

Description

i've been running this in opencode.json since i can remember

"permission": {
      "webfetch": "allow",
      "bash": {
        "rm *": "ask",
        "git push *": "ask",
        "git commit *": "ask",
        "git add *": "ask",
        "git log *": "allow",
        "git status *": "allow",
        "git diff *": "allow",
        "docker *": "ask",
        "kubectl *": "ask",
        "npm run build": "allow",
        "npm run typecheck": "allow",
        "npm run lint": "allow",
        "npm *": "ask",
        "pkill *": "ask",
        "kill *": "ask",
        "python3 *": "ask",
        "python *": "ask",
        "node *": "ask"
      }
  },

since upgrading to 1.1.1, all of these commands are simply run now with no approval required in build mode. is this intentional?

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

[rekram1-node]

can u show me output of:

opencode debug config

[aaronnewsome]

{
  "$schema": "https://opencode.ai/config.json",
  "model": "ai/minimax-m2",
  "agent": {
    "plan": {
      "model": "ai/minimax-m2",
      "tools": {
        "write": false,
        "edit": false,
        "read": true,
        "grep": true,
        "glob": true,
        "list": true,
        "todowrite": true,
        "todoread": true,
        "webfetch": true,
        "bash": false
      },
      "mode": "primary",
      "options": {},
      "permission": {
        "edit": "deny",
        "read": "allow",
        "grep": "allow",
        "glob": "allow",
        "list": "allow",
        "todowrite": "allow",
        "todoread": "allow",
        "webfetch": "allow",
        "bash": "deny"
      }
    },
    "build": {
      "model": "ai/minimax-m2",
      "tools": {
        "write": true,
        "edit": true,
        "read": true,
        "bash": true,
        "grep": true,
        "glob": true,
        "list": true,
        "todowrite": true,
        "todoread": true,
        "webfetch": true,
        "git": true
      },
      "mode": "primary",
      "options": {},
      "permission": {
        "edit": "allow",
        "read": "allow",
        "bash": "allow",
        "grep": "allow",
        "glob": "allow",
        "list": "allow",
        "todowrite": "allow",
        "todoread": "allow",
        "webfetch": "allow",
        "git": "allow"
      }
    },
    "code-reviewer": {
      "model": "ai/minimax-m2",
      "prompt": "You are a code reviewer. Focus on security, performance, and maintainability.",
      "tools": {
        "read": true,
        "write": false,
        "grep": true,
        "glob": true,
        "list": true,
        "todowrite": true,
        "todoread": true,
        "webfetch": true,
        "edit": false
      },
      "description": "Reviews code for best practices and potential issues",
      "mode": "subagent",
      "options": {},
      "permission": {
        "read": "allow",
        "edit": "deny",
        "grep": "allow",
        "glob": "allow",
        "list": "allow",
        "todowrite": "allow",
        "todoread": "allow",
        "webfetch": "allow"
      }
    }
  },
  "provider": {
    "openrouter": {
      "npm": "@ai-sdk/openai-compatible",
      "models": {
        "moonshotai/kimi-k2:nitro": {
          "id": "moonshotai/kimi-k2:nitro",
          "name": "Kimi K2 Nitro",
          "attachment": false,
          "reasoning": true,
          "temperature": true,
          "tool_call": true,
          "limit": {
            "context": 200000,
            "output": 4096
          }
        }
      },
      "options": {
        "baseURL": "https://openrouter.ai/api/v1"
      }
    },
    "hawk": {
      "npm": "@ai-sdk/openai-compatible",
      "models": {
        "minimax-m2": {
          "name": "minimax-m2",
          "reasoning": true,
          "tool_call": true,
          "cost": {
            "input": 0.4,
            "output": 2
          },
          "options": {
            "num_ctx": 131072,
            "temperature": 1,
            "top_p": 0.95,
            "top_k": 40
          }
        },
        "glm-4.5-air": {
          "name": "glm-4.5-air",
          "reasoning": true,
          "tool_call": true,
          "cost": {
            "input": 0.1,
            "output": 1.2
          },
          "options": {
            "num_ctx": 131072,
            "temperature": 1,
            "top_p": 0.95,
            "top_k": 40
          }
        }
      },
      "options": {
        "baseURL": "http://hawk.swift.local:8080/v1",
        "timeout": 10000000,
        "includeUsage": true
      }
    },
    "ai": {
      "npm": "@ai-sdk/openai-compatible",
      "models": {
        "minimax-m2": {
          "name": "minimax-m2",
          "reasoning": true,
          "tool_call": true,
          "cost": {
            "input": 0.1,
            "output": 1.2
          },
          "options": {
            "num_ctx": 131072,
            "temperature": 1,
            "top_p": 0.95,
            "top_k": 40
          }
        },
        "glm-4.5-air": {
          "name": "glm-4.5-air",
          "reasoning": true,
          "tool_call": true,
          "cost": {
            "input": 0.1,
            "output": 1.2
          },
          "options": {
            "num_ctx": 131072,
            "temperature": 1,
            "top_p": 0.95,
            "top_k": 40
          }
        },
        "glm-4.7": {
          "name": "glm-4.7",
          "reasoning": true,
          "tool_call": true,
          "cost": {
            "input": 0.2,
            "output": 1.2
          },
          "options": {
            "num_ctx": 131072,
            "temperature": 1,
            "top_p": 0.95
          }
        }
      },
      "options": {
        "baseURL": "http://ai.swift.local:8080/v1",
        "timeout": 10000000,
        "includeUsage": true
      }
    },
    "ai-vllm": {
      "npm": "@ai-sdk/openai-compatible",
      "models": {
        "PrimeIntellect/INTELLECT-3-FP8": {
          "name": "intellect-3",
          "reasoning": true,
          "tool_call": true,
          "cost": {
            "input": 0.4,
            "output": 3
          },
          "options": {
            "num_ctx": 131072,
            "temperature": 1,
            "top_p": 0.95,
            "top_k": 40
          }
        }
      },
      "options": {
        "baseURL": "http://ai.swift.local:8000/v1",
        "timeout": 10000000,
        "includeUsage": true
      }
    },
    "ollama": {
      "npm": "@ai-sdk/openai-compatible",
      "models": {
        "qwen3-coder:30b": {
          "name": "qwen3-coder:30b",
          "reasoning": true,
          "tool_call": true,
          "cost": {
            "input": 0.1,
            "output": 1.2
          }
        },
        "gpt-oss:120b": {
          "name": "gpt-oss:120b",
          "reasoning": true,
          "tool_call": true,
          "cost": {
            "input": 0.1,
            "output": 1.2
          }
        },
        "ministral-3:14b": {
          "name": "ministral-3:14b",
          "reasoning": true,
          "tool_call": true,
          "cost": {
            "input": 0.1,
            "output": 1.2
          }
        },
        "deepseek-r1:32b": {
          "name": "deepseek-r1:32b",
          "reasoning": true,
          "tool_call": true,
          "cost": {
            "input": 0.1,
            "output": 1.2
          }
        }
      },
      "options": {
        "baseURL": "http://hawk.swift.local:11434/v1",
        "timeout": 1000000,
        "includeUsage": true
      }
    }
  },
  "mcp": {
    "chrome-devtools": {
      "type": "local",
      "command": [
        "npx",
        "chrome-devtools-mcp@latest",
        "--browserUrl",
        "http://127.0.0.1:9222"
      ],
      "environment": {
        "DISPLAY": ":0"
      },
      "enabled": true
    },
    "context7": {
      "type": "remote",
      "url": "https://mcp.context7.com/mcp",
      "enabled": false,
      "headers": {
        "Authorization": ""
      }
    },
    "netvault-mcp": {
      "type": "remote",
      "url": "http://netvault-mcp.swift.local/mcp",
      "enabled": false,
      "headers": {
        "Authorization": ""
      }
    }
  },
  "permission": {
    "bash": {
      "rm *": "ask",
      "git push *": "ask",
      "git commit *": "ask",
      "git add *": "ask",
      "git log *": "allow",
      "git status *": "allow",
      "git diff *": "allow",
      "docker *": "ask",
      "kubectl *": "ask",
      "npm run build": "allow",
      "npm run typecheck": "allow",
      "npm run lint": "allow",
      "npm *": "ask",
      "pkill *": "ask",
      "kill *": "ask",
      "python3 *": "ask",
      "python *": "ask",
      "node *": "ask"
    },
    "webfetch": "allow"
  },
  "mode": {},
  "plugin": [],
  "command": {},
  "username": "anewsome",
  "keybinds": {
    "leader": "ctrl+x",
    "app_exit": "ctrl+c,ctrl+d,<leader>q",
    "editor_open": "<leader>e",
    "theme_list": "<leader>t",
    "sidebar_toggle": "<leader>b",
    "scrollbar_toggle": "none",
    "username_toggle": "none",
    "status_view": "<leader>s",
    "session_export": "<leader>x",
    "session_new": "<leader>n",
    "session_list": "<leader>l",
    "session_timeline": "<leader>g",
    "session_fork": "none",
    "session_rename": "none",
    "session_share": "none",
    "session_unshare": "none",
    "session_interrupt": "escape",
    "session_compact": "<leader>c",
    "messages_page_up": "pageup",
    "messages_page_down": "pagedown",
    "messages_half_page_up": "ctrl+alt+u",
    "messages_half_page_down": "ctrl+alt+d",
    "messages_first": "ctrl+g,home",
    "messages_last": "ctrl+alt+g,end",
    "messages_next": "none",
    "messages_previous": "none",
    "messages_last_user": "none",
    "messages_copy": "<leader>y",
    "messages_undo": "<leader>u",
    "messages_redo": "<leader>r",
    "messages_toggle_conceal": "<leader>h",
    "tool_details": "none",
    "model_list": "<leader>m",
    "model_cycle_recent": "f2",
    "model_cycle_recent_reverse": "shift+f2",
    "model_cycle_favorite": "none",
    "model_cycle_favorite_reverse": "none",
    "command_list": "ctrl+p",
    "agent_list": "<leader>a",
    "agent_cycle": "tab",
    "agent_cycle_reverse": "shift+tab",
    "variant_cycle": "ctrl+t",
    "input_clear": "ctrl+c",
    "input_paste": "ctrl+v",
    "input_submit": "return",
    "input_newline": "shift+return,ctrl+return,alt+return,ctrl+j",
    "input_move_left": "left,ctrl+b",
    "input_move_right": "right,ctrl+f",
    "input_move_up": "up",
    "input_move_down": "down",
    "input_select_left": "shift+left",
    "input_select_right": "shift+right",
    "input_select_up": "shift+up",
    "input_select_down": "shift+down",
    "input_line_home": "ctrl+a",
    "input_line_end": "ctrl+e",
    "input_select_line_home": "ctrl+shift+a",
    "input_select_line_end": "ctrl+shift+e",
    "input_visual_line_home": "alt+a",
    "input_visual_line_end": "alt+e",
    "input_select_visual_line_home": "alt+shift+a",
    "input_select_visual_line_end": "alt+shift+e",
    "input_buffer_home": "home",
    "input_buffer_end": "end",
    "input_select_buffer_home": "shift+home",
    "input_select_buffer_end": "shift+end",
    "input_delete_line": "ctrl+shift+d",
    "input_delete_to_line_end": "ctrl+k",
    "input_delete_to_line_start": "ctrl+u",
    "input_backspace": "backspace,shift+backspace",
    "input_delete": "ctrl+d,delete,shift+delete",
    "input_undo": "ctrl+-,super+z",
    "input_redo": "ctrl+.,super+shift+z",
    "input_word_forward": "alt+f,alt+right,ctrl+right",
    "input_word_backward": "alt+b,alt+left,ctrl+left",
    "input_select_word_forward": "alt+shift+f,alt+shift+right",
    "input_select_word_backward": "alt+shift+b,alt+shift+left",
    "input_delete_word_forward": "alt+d,alt+delete,ctrl+delete",
    "input_delete_word_backward": "ctrl+w,ctrl+backspace,alt+backspace",
    "history_previous": "up",
    "history_next": "down",
    "session_child_cycle": "<leader>right",
    "session_child_cycle_reverse": "<leader>left",
    "session_parent": "<leader>up",
    "terminal_suspend": "ctrl+z",
    "terminal_title_toggle": "none",
    "tips_toggle": "<leader>h"
  }
}

[malhashemi]

The bash:allow in the build agent configuration is overriding the global bash config that you set. This has yet to be documented but from my understanding of the new system this is how it should work. Try removing that line and see what happens

[aaronnewsome]

there's no bash:allow in build agent config, but there is a bash: true, so I've removed that and i'll test. weird thing is, the config was working for months.

[malhashemi]

there's no bash:allow in build agent config, but there is a bash: true, so I've removed that and i'll test.

Oh I was just going by the reply you posted which showed

agent.build.permission.bash was set to allow.

weird thing is, the config was working for months.

Yeah the permission system just got a big overhaul in the latest release few hours ago.

[thdxr]

hm this isn't intentional. can i see your full config?

[thdxr]

oh looking closer this is likely because of your tools config because it says bash: true - we got rid of that field but we try to convert it to permissions

however we merge it before the rest of your permissions so not sure why it seems to be overriding

[thdxr]

can you run opencode debug agent build

[thdxr]

ok looked closer into this - our backwards compatible logic for the tools field isn't great

we see bash: true at the agent level and assume that means you want to enable all bash permissions which overrides the global permissions

i'm not too sure of a good way to do it otherwise though, gets messy. best thing to do is to get rid of tools field everywhere

[aaronnewsome]

ok, i removed bash: true from build agent config. the changed behavior caught me off guard as soon as opencode started automatically running commands that it used to prompt for 5 minutes ago. removing bash:true fixed it.