Opencode Permission

OpenCode Permission Manager

Manage permission rules in ~/.config/opencode/opencode.jsonc. Add, remove, list, or format auto-approval rules for shell commands and tool invocations.

Workflow

1. Identify the rule string(s) and action from the user's request (e.g., "kubectl get *" → allow)

2. Determine the subcommand: add / remove / list / list-all / format

3. Run the bundled script:

   # 单条添加
   uv run --script <skill-path>/scripts/manage_permission.py add "kubectl get *" --action allow
   
   # 批量添加
   uv run --script <skill-path>/scripts/manage_permission.py add "kubectl get *" "kubectl describe *" "kubectl logs *"
   

4. Confirm the change was written

5. Remind the user: 修改配置后需要重启 OpenCode 才能生效

Behaviors

• 自动备份：add / remove / format 操作会在写入前创建带时间戳的备份，文件名格式 opencode.jsonc.YYYYMMDDTHHMMSS.bak，多次变更各自保留。
• 自动格式化：add / remove 操作完成后自动规范 bash 段格式，保证每条规则独占一行。
• 批量添加：add 接受多个位置参数，只需一次执行。

Command Reference

Add rules

# 单条（默认 action=allow）
uv run --script manage_permission.py add "kubectl get *"

# 批量添加
uv run --script manage_permission.py add "kubectl get *" "kubectl describe *" "kubectl logs *"

# 指定 action
uv run --script manage_permission.py add "git commit *" --action ask
uv run --script manage_permission.py add "rm -rf *" --action deny

# 自定义配置路径
uv run --script manage_permission.py add "kubectl get *" --config /path/to/opencode.jsonc

Remove a rule

uv run --script manage_permission.py remove "kubectl get *"

List rules

# List permission.bash only
uv run --script manage_permission.py list

# List all permission categories (bash, read, edit, etc.)
uv run --script manage_permission.py list-all

Format rules

# 格式化 bash 规则（一行一条，自动备份）
uv run --script manage_permission.py format

Rule Format Reference

Permission actions

Wildcard syntax

Important: "git status" only matches git status with no arguments. To match with arguments, use "git status *".

Available permission keys

Simple keys (no pattern matching) accept only "allow", "ask", or "deny" as a string value.

Rule matching logic

• Last matching rule wins — more specific rules override "*" defaults
• Common pattern: set "*": "ask" as fallback, then add specific allow rules
• Supports ~ and $HOME path expansion for file-related keys

Configuration file format

• Location: ~/.config/opencode/opencode.jsonc (global) or <project>/.opencode/opencode.jsonc (project-level)

• Format: JSONC (JSON with Comments) — supports // and /* */ comments

• Structure:

  {
    "permission": {
      "edit": "ask",
      "bash": {
        "*": "ask",
        "kubectl get *": "allow",
        "git status *": "allow"
      }
    }
  }
  

• Agent-level override: Rules can also be set per-agent in the agent section, which take precedence over global rules

Examples

Allow all kubectl read operations

uv run --script manage_permission.py add \
  "kubectl get *" \
  "kubectl describe *" \
  "kubectl logs *" \
  "kubectl top *" \
  "kubectl explain *" \
  "kubectl diff *" \
  "kubectl auth can-i *"

Allow git commit but require confirmation for push

uv run --script manage_permission.py add "git commit *" --action allow
uv run --script manage_permission.py add "git push *" --action ask

Block dangerous commands

uv run --script manage_permission.py add "rm -rf *" --action deny

Format existing config

uv run --script manage_permission.py format

View current rules

uv run --script manage_permission.py list

Notes

• Uses json-five (ModelLoader/ModelDumper) to preserve all existing comments during read-modify-write cycles.
• New rules are appended to the end of permission.bash; after writing, the bash section is automatically formatted to one-rule-per-line.
• add / remove / format create a timestamped backup before writing (e.g., opencode.jsonc.20260428T153045.bak).