Write mode disables OpenCode's workspace and approval safety guards (H-01)
Surfaced by the gpt-5.6-sol final review, verified locally against OpenCode 1.17.15.
buildWritePermissionRules() (plugins/opencode/scripts/lib/opencode.mjs) passes a single session rule {permission: "*", action: "allow", pattern: "*"}, and respondToPermission() answers "always" to every permission.asked event in write mode. The rescue subagent defaults to --write.
The code comment claims parity with OpenCode's built-in build agent, but the real build agent ships the wildcard plus guard overrides layered after it: external_directory: ask, .env/.env.* reads: ask, doom_loop: ask. The bare session wildcard drops those guards, and the auto-"always" responder would self-approve any that survived. sandbox: "workspace-write" is only converted to a boolean; nothing enforces a path boundary.
Impact: a delegated write task (the rescue default) can approve itself for paths outside the repository, secret-file reads, and arbitrary shell under the user's OS identity.
Fix:
- Replace the bare wildcard with build-agent-parity rules whose ask-guards become deterministic denies for headless runs (
external_directory, .env reads, doom_loop).
- Make the write-mode permission responder category-aware: approve workspace edit/command categories, reject guard categories, keep read-only turns reject-all.
- Fix the misleading comment; document that OpenCode permissions are approval controls, not an OS sandbox.
Tests: session-create params carry the guard rules; responder rejects external_directory/.env asks even in write mode; read-only review sends no permission override and rejects asks.
Source: gpt-5.6-sol final review H-01 (opencode-plugin-cc-analysis.md).
Write mode disables OpenCode's workspace and approval safety guards (H-01)
Surfaced by the gpt-5.6-sol final review, verified locally against OpenCode 1.17.15.
buildWritePermissionRules()(plugins/opencode/scripts/lib/opencode.mjs) passes a single session rule{permission: "*", action: "allow", pattern: "*"}, andrespondToPermission()answers "always" to everypermission.askedevent in write mode. The rescue subagent defaults to--write.The code comment claims parity with OpenCode's built-in
buildagent, but the realbuildagent ships the wildcard plus guard overrides layered after it:external_directory: ask,.env/.env.*reads: ask,doom_loop: ask. The bare session wildcard drops those guards, and the auto-"always" responder would self-approve any that survived.sandbox: "workspace-write"is only converted to a boolean; nothing enforces a path boundary.Impact: a delegated write task (the rescue default) can approve itself for paths outside the repository, secret-file reads, and arbitrary shell under the user's OS identity.
Fix:
external_directory,.envreads,doom_loop).Tests: session-create params carry the guard rules; responder rejects
external_directory/.envasks even in write mode; read-only review sends no permission override and rejects asks.Source: gpt-5.6-sol final review H-01 (
opencode-plugin-cc-analysis.md).