Repository navigation
Conversation
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
The fix works. With the #57711 reproduction (allow *, deny execute, simulated model), the main request on the base leaves out execute but still carries the tools.opencode.session_move hint. With this change the hint is gone. bun run test test/tool-opencode.test.ts and bun typecheck pass in packages/core.
The guard reads the request's tools keyed by name, the same way other built-in plugins do (patch, websearch, shell). So it covers the primary, compaction and generate requests, and a narrower execute deny still keeps the hint.
Public API: unchanged.
The new test is heavier than this two-line fix needs (see inline).
There was a problem hiding this comment.
This test is large for a two-line guard. It builds SessionModelRequest with a stub transport, a resolved OpenAI model and three permission rulesets just to check that one system part is or isn't there. It can be dropped to keep the change minimal. If you'd like to keep a regression test, please cut it to a single check that the plugin's context hook adds no hint when event.tools has no execute.
This branch has not been deployed
1 participant
Issue for this PR
Closes #57711
Type of change
What does this PR do?
A deny-all
executerule removes theexecutetool, butopencode.toolsstill tells the model to calltools.opencode.session_movethrough it. The same hint is added on compaction and generate.The hint is skipped when the request does not offer
execute. A narrower deny still offers the tool, so the hint stays.How did you verify your code works?
Bun 1.4.2.
Before: allow
*plus denyexecute*leftexecuteout of the snapshot, and primary, compaction, and generate still included the hint.After: those three requests omit the hint. Allow-all, and a deny limited to resource
secret, still offerexecuteand keep the hint.Passed, from
packages/core:bun run test test/tool-opencode.test.ts: 3 passbun typecheck: passPassed on push:
bun run check(oxlint, ast-grep, sdk docs, turbo typecheck 34/34).Passed on this head:
check-compliance,check-standards,add-contributor-label.test,typecheck, andnix-evalare not in the check list and did not fail. Combined status ispendingwith 0 statuses. The issue's opencode-drive script and the fullpackages/coresuite were not run.Screenshots / recordings
Not a UI change.
Checklist
Added by the opencode bot (AI-generated).
Related: #57720, #56038