opencode-v2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61// The session permission ruleset Convergence pushes for a chat. OpenCode
// decides a request against the agent's rules followed by the session's,
// and the last matching rule wins, so the session's rules settle what the
// composer's permission mode promises.
import type { PermissionRequest } from "./api.ts";
import { permissionMode } from "../sdk/agent.ts";

export interface Rule {
  action: string;
  resource: string;
  effect: "allow" | "ask" | "deny";
}

const rule = (action: string, resource: string, effect: Rule["effect"]): Rule => ({ action, resource, effect });

/// The ruleset for a shared permission mode. Order matters: a narrow rule
/// only wins when it comes after the broad one it refines.
///
/// Auto is read as Supervised: OpenCode has no approval reviewer, so the
/// honest reading of "approve routine actions" is to keep asking.
export function ruleset(mode: string): Rule[] {
  // Reads outside the workspace are an action of their own that the
  // wildcard does not cover.
  if (mode === permissionMode.FULL) return [rule("*", "*", "allow"), rule("external_directory", "*", "allow")];
  const edits = mode === permissionMode.AUTO_EDITS ? "allow" : "ask";
  return [
    rule("*", "*", "ask"),
    rule("read", "*", "allow"),
    // OpenCode asks before reading environment files whatever the agent
    // allows; a blanket read rule must not quietly remove that.
    rule("read", "*.env", "ask"),
    rule("read", "*.env.*", "ask"),
    rule("read", "*.env.example", "allow"),
    rule("glob", "*", "allow"),
    rule("grep", "*", "allow"),
    rule("list", "*", "allow"),
    rule("lsp", "*", "allow"),
    rule("skill", "*", "allow"),
    rule("todowrite", "*", "allow"),
    // Starting a subagent is not an action on the machine; its own tools
    // ask under the same rules.
    rule("subagent", "*", "allow"),
    // The question tool only asks the user something; asking to ask is noise.
    rule("question", "*", "allow"),
    rule("edit", "*", edits),
    rule("external_directory", "*", "ask"),
  ];
}

/// Whether the mode answers permission requests without the user. The
/// ruleset alone is not enough: a subagent session can carry rules of its
/// own.
export const repliesAutomatically = (mode: string) => mode === permissionMode.FULL;

/// The title of an approval card: the action and what it touches.
export function approvalTitle(request: PermissionRequest): string {
  if (request.message) return request.message;
  const action = request.action === "shell" ? "Run" : request.action[0]?.toUpperCase() + request.action.slice(1);
  const resources = request.resources.filter(Boolean);
  return resources.length ? `${action} ${resources.join(", ")}` : action;
}