Legacy apply_patch permission rules stop matching after config migration
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 85/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
- Domain
- authorization
Research direction
Start in packages/core/src/v1/config/migrate.ts at normalizeAction, then compare its output with the edit assertion in packages/core/src/tool/plugin/patch.ts. Run ConfigNormalize.normalize and Permission.evaluate using the reproduction objects. Done means apply_patch permission and tools rules normalize to the edit action and the deny is enforced.
Written by the indexing model from the issue text.
Description
Description
normalizeAction in packages/core/src/v1/config/migrate.ts maps the tool names people write in config onto the permission actions v2 tools actually assert: write/patch → edit, task → subagent, bash → shell. apply_patch is missing from the table.
So { "permission": { "apply_patch": "deny" } } normalizes to a rule whose action is apply_patch. Nothing asserts that action — packages/core/src/tool/plugin/patch.ts calls permission.assert with action: "edit" — and unmapped keys produce no diagnostic, so the deny is silently inert. Same for { "tools": { "apply_patch": false } }.
The name is legitimately part of the edit family: agents.mdx lists write, edit, apply_patch under the edit permission, tools.mdx does the same in its apply_patch section, and the TUI (packages/tui/src/util/tool-display.ts) and ACP (packages/cli/src/acp/tool.ts) still canonicalize apply_patch.
Plugins
None
OpenCode version
v2 at 1ca8f63a7
Steps to reproduce
Call ConfigNormalize.normalize on each object and print encoded.permissions:
{"permission":{"write":"deny"}} -> [{"action":"edit","resource":"*","effect":"deny"}]
{"permission":{"apply_patch":"deny"}} -> [{"action":"apply_patch","resource":"*","effect":"deny"}]
Permission.evaluate("edit", path, rules) returns deny for the first and passes the second.
Related history: #16028 reported this mapping gap on the v1 codebase, and #16051 proposed the same one-line alias there; both are closed, and #16051 was not merged. Also worth deciding together: #47352 proposes documenting that a write block "is never consulted", but write does get consulted because normalizeAction rewrites it to edit.
Screenshot and/or share link
No response
Operating System
macOS (Apple Silicon)
Terminal
Not a runtime UI issue.
- Dominant language
- TypeScript
- Stars
- 209k
- Forks
- 27.5k
- Avg merge
- 7h 20m
- Merged PRs (30d)
- 358
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from anomalyco/opencode
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
[FEATURE]: Bump gitlab-ai-provider to 6.15.1 on v2 (Fable 5.1, GPT-6 Astra, workflow reconnect fix) Open
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
All issues in anomalyco/opencode
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug clawsweeper:linked-pr-open clawsweeper:needs-live-repro clawsweeper:no-new-fix-pr impact:message-loss issue-rating: 🐚 platinum hermit P2 regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
fullcalendar/fullcalendar#8106 ·