From 9c7f1c309947cdd3f25f13b8ac0cf284541a6a0b Mon Sep 17 00:00:00 2001 From: Darren Hinde <107584450+darrenhinde@users.noreply.github.com> Date: Tue, 3 Feb 2026 22:09:09 +0000 Subject: [PATCH] Fix/164 permission key compatibility (#171) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix: migrate all agents to OpenCode v1.1.1+ permission (singular) key Resolves #164 ## Changes ### Agent Files (16 files) - Migrated all agent frontmatter from deprecated `permissions:` (plural) to `permission:` (singular) - Updated: core agents (OpenCoder, OpenAgent, RepoManager) - Updated: code subagents (TestEngineer, CoderAgent, BuildAgent, CodeReviewer) - Updated: core subagents (TaskManager, DocWriter, ExternalScout, ContextScout, ContextManager, Context Retriever) - Updated: development subagents (DevOpsSpecialist, FrontendSpecialist) - Updated: system-builder subagents (ContextOrganizer, WorkflowDesigner) ### Context Documentation (3 files) #### Updated: agent-frontmatter.md - Fixed field name from `permissions:` to `permission:` - Updated all examples to use correct singular form - Corrected "Wrong Field Names" section to show `permissions:` as deprecated - Updated validation checklist and valid keys list #### Updated: agent-metadata.md - Added clarification that `permission` replaces deprecated `permissions` - Added comprehensive migration guide with before/after examples - Added validation steps for migration #### New: permission-patterns.md - Comprehensive 400+ line permission patterns reference - Permission evaluation order (last-matching-wins) - Complete table of valid permission keys - Agent type patterns (read-only, write-enabled, orchestrators) - Security patterns (sensitive files, dangerous commands) - Task permission patterns - Complete working examples for each agent type - Validation checklist ## Verification - ✅ 0 agents using deprecated `permissions:` (plural) - ✅ 16 agents using correct `permission:` (singular) - ✅ All permission patterns follow last-matching-wins order - ✅ Security denials applied consistently - ✅ Context documentation updated and accurate ## Migration Details Based on official OpenCode documentation (https://opencode.ai/docs/agents/): - OpenCode v1.1.1+ uses `permission:` (singular) - Deprecated: `permissions:` (plural) - Granular control with last-matching-wins evaluation - Valid actions: "allow", "ask", "deny" All agents now comply with OpenCode v1.1.1+ standards. * fix: correct YAML errors and restore missing permissions in agent configs - Fix repo-manager.md duplicate permission section - Fix externalscout.md YAML indentation error - Remove old tools: section from devops-specialist.md - Restore context file permissions in context-manager.md - Restore test command permissions in tester.md - Clean up formatting in coder-agent.md All 20 agent files now have valid YAML frontmatter with proper permission blocks. * fix: standardize permission key across agent files - Updated all instances of `permissions:` to `permission:` in agent frontmatter for consistency. - Removed deprecated `write:` and `edit:` sections from externalscout.md. - Adjusted related documentation to reflect the singular form of permission key. These changes ensure compliance with OpenCode v1.1.1+ standards and improve YAML structure across the repository. --- .opencode/agent/subagents/core/externalscout.md | 6 ------ .../command/openagents/new-agents/create-agent.md | 11 ++--------- .opencode/context/core/system/context-paths.md | 1 + .../openagents-repo/errors/tool-permission-errors.md | 4 ++-- .../context/openagents-repo/standards/navigation.md | 2 +- 5 files changed, 6 insertions(+), 18 deletions(-) diff --git a/.opencode/agent/subagents/core/externalscout.md b/.opencode/agent/subagents/core/externalscout.md index 9ace8a1..2fab2c4 100644 --- a/.opencode/agent/subagents/core/externalscout.md +++ b/.opencode/agent/subagents/core/externalscout.md @@ -15,12 +15,6 @@ permission: skill: "*": "deny" "*context7*": "allow" - write: - "**/*": "deny" - ".tmp/external-context/**": "allow" - edit: - "**/*": "deny" - ".tmp/external-context/**": "allow" task: "*": "deny" --- diff --git a/.opencode/command/openagents/new-agents/create-agent.md b/.opencode/command/openagents/new-agents/create-agent.md index 89e2877..00c3e7c 100644 --- a/.opencode/command/openagents/new-agents/create-agent.md +++ b/.opencode/command/openagents/new-agents/create-agent.md @@ -50,15 +50,8 @@ Create a new agent with minimal, high-signal prompts following "right altitude" description: "{one-line purpose}" mode: primary temperature: 0.1-0.7 - tools: - read: true - write: true - edit: true - bash: true - task: {only if delegates} - glob: true - grep: true - permissions: + + permission: bash: "rm -rf *": "ask" "sudo *": "deny" diff --git a/.opencode/context/core/system/context-paths.md b/.opencode/context/core/system/context-paths.md index 32353a3..4b21385 100644 --- a/.opencode/context/core/system/context-paths.md +++ b/.opencode/context/core/system/context-paths.md @@ -15,3 +15,4 @@ Additional paths to context. If set to `false`, ignore. } } ``` + diff --git a/.opencode/context/openagents-repo/errors/tool-permission-errors.md b/.opencode/context/openagents-repo/errors/tool-permission-errors.md index 6504393..54c1d7e 100644 --- a/.opencode/context/openagents-repo/errors/tool-permission-errors.md +++ b/.opencode/context/openagents-repo/errors/tool-permission-errors.md @@ -31,7 +31,7 @@ Agent has tool **disabled** or **denied** in frontmatter: tools: bash: false # ← Tool disabled -permissions: +permission: bash: "*": "deny" # ← Explicitly denied ``` @@ -196,7 +196,7 @@ tools: ## Verification Checklist -After fixing tool permissions: +After fixing tool permission: - [ ] Agent frontmatter has correct `tools:` configuration? - [ ] Prompt emphasizes allowed tools in critical rules section? diff --git a/.opencode/context/openagents-repo/standards/navigation.md b/.opencode/context/openagents-repo/standards/navigation.md index 6405d5c..9115e84 100644 --- a/.opencode/context/openagents-repo/standards/navigation.md +++ b/.opencode/context/openagents-repo/standards/navigation.md @@ -43,7 +43,7 @@ These standards emerged from fixing YAML frontmatter issues across 18 agent file - `hidden` - Hide from autocomplete - `prompt` - Custom prompt file - `tools` - Tool access config -- `permissions` - Permission rules +- `permission` - Permission rules - `skills` - Skills to load ### Invalid Fields (Move to agent-metadata.json)