ceos/opencode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(core): prefer specific permission rules

Browse source
This commit is contained in:
Shoubhit Dash 2026-05-21 23:32:14 +05:30
commit 5530bbe0ac
5 changed files with 100 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

4
packages/web/src/content/docs/agents.mdx
View file

@ -535,7 +535,7 @@ This can take a glob pattern.
```
And you can also use the `*` wildcard to manage permissions for all commands.
Since the last matching rule takes precedence, put the `*` wildcard first and specific rules after.
The most specific matching rule takes precedence, so specific command rules beat the `*` wildcard regardless of order.
```json title="opencode.json" {8}
{
@ -622,7 +622,7 @@ Control which subagents an agent can invoke via the Task tool with `permission.t
When set to `deny`, the subagent is removed from the Task tool description entirely, so the model won't attempt to invoke it.
:::tip
Rules are evaluated in order, and the **last matching rule wins**. In the example above, `orchestrator-planner` matches both `*` (deny) and `orchestrator-*` (allow), but since `orchestrator-*` comes after `*`, the result is `allow`.
Rules are evaluated by specificity. In the example above, `orchestrator-planner` matches both `*` (deny) and `orchestrator-*` (allow), but `orchestrator-*` is more specific, so the result is `allow`.
:::
:::tip

2
packages/web/src/content/docs/permissions.mdx
View file

@ -68,7 +68,7 @@ For most permissions, you can use an object to apply different actions based on
}
```
Rules are evaluated by pattern match, with the **last matching rule winning**. A common pattern is to put the catch-all `"*"` rule first, and more specific rules after it.
Rules are evaluated by pattern match, with the **most specific matching rule winning**. If two matching rules are equally specific, the later rule wins.
### Wildcards