anomalyco / anomalyco/opencode
Permission dock offers 'always' even when the request has no always patterns
@Brendonovich is already working on this.
Since Aug 30, 2026.
- Dominant language
- TypeScript
- Stars
- 209k
- Forks
- 27.5k
- Avg merge
- 7h 2m
- Merged PRs (30d)
- 384
Description
Title:
Permission dock offers 'always' even when the request has no always patterns
Description:
The permission dock in the session composer renders a button for each of the three
response values once, always, reject. The server-side reply path in
packages/opencode/src/permission/index.ts already treats the always case as a
no-op when the incoming Permission.Info has an empty always pattern list (it
falls through to "once" or rejects), so the client offering a button that the
server will silently downgrade is misleading.
Tracked:
- The client-side
permissionRequest()returns aPermission.Infowhosealways
field may be empty. - The current
decide(response)path does not check whether the request supports
always; it just sendsreply: "always"to the server. - On the server, the
reply === "always"branch is only meaningful when
request.alwaysis a non-empty list of patterns to persist.
Expected behaviour:
- When
request.alwaysis empty, the client should not offer thealwaysbutton
(or, defensively, thedecidepath should refuse to send"always"), so the
user never sees a "remember this choice" affordance that has no effect.
Actual behaviour:
- The dock shows the
alwaysbutton for any permission request, regardless of
whether the request carriesalwayspatterns. - Tapping it sends
reply: "always"to the server, which silently falls through
to a one-off reply.
Plugins: n/a
OpenCode version: dev (10765ff2a9)
Steps to reproduce:
- Trigger a permission request whose
Permission.Info.alwaysis empty (most
default tool/permission paths, e.g. a plainbashrequest without an
explicit pattern list). - The permission dock renders three buttons, including "always".
- Tap "always".
- The server replies with the same behaviour as "once"; no pattern is
remembered.
Expected behaviour:
- The "always" button is hidden or disabled when
request.alwaysis empty. - Tapping it (if still rendered) is a no-op, not a silently-downgraded reply.
Operating System: n/a
Terminal: n/a
Related / duplicate check: no related upstream issue found.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.