The call
Replace the default policy with ask or deny for edits, shell, and outside paths, and keep --auto runs inside a container.
OpenCode 2 allows every action except .env reads by default and ships no sandbox, so a new session can edit files and run shell commands without a prompt. Decide which actions it may take without asking and where it should run, with isolation wherever credentials matter.
When you need this
- Engineers run OpenCode on machines that hold production or cloud credentials.
- Someone wants --auto mode to stop approval prompts.
- You plan to expose the OpenCode server to other hosts or phones.
- An agent ran a command it should not have.
Evaluation criteria
Start from ask, then allow
What does the agent do on day one without a prompt?
Look forA catch-all "*": "ask" rule first, then specific allows for reads, grep, and known-safe commands, since the last matching rule wins. Deny git push and deploy commands outright.
Close the outside paths
Can the agent read or edit outside the repository?
Look forAn external_directory rule set to ask or deny. In OpenCode 2 paths outside the project proceed without a prompt unless you add one.
Know what pattern rules miss
Does a deny rule on a command stop every way of running it?
Look forRules match the commands OpenCode parses from each shell call. One public test showed a git deny rule blocking git status while the same command piped to bash went through. Treat rules as a guard against mistakes and isolation as the boundary.
Contain --auto
Where may the agent approve itself?
Look for--auto, which approves every request that is not explicitly denied, only inside a container or virtual machine with the project mounted and no SSH keys or cloud credentials.
Secure the server
Who else can reach the agent?
Look forOPENCODE_PASSWORD on OpenCode 2, or OPENCODE_SERVER_PASSWORD on 1.x, set before binding beyond 127.0.0.1, no mDNS discovery on shared networks, and versions at or above the fixes for CVE-2026-22812 and GHSA-632h-h47v-g4x4.
Questions to ask vendors
- Will OpenCode add an optional sandbox, and on which platforms?
- Can an administrator enforce a permission policy through central config so engineers cannot loosen it?
- Which shell constructs does OpenCode 2's permission matching not see?
- Which server endpoints stay reachable without a password when the server binds to localhost?
Red flags
- --auto on a laptop that holds production credentials.
- The server bound to 0.0.0.0 with no password.
- A policy that relies on denying individual commands with no isolation behind it.
- Agents allowed to run deploy or push commands.
Products in this piece
Sources
- Official documentation
- 8
- Public source
- 2
- OpenCode 2 docs: Permissions
- OpenCode docs: Permissions (OpenCode 1)
- OpenCode docs: Agents
- OpenCode docs: Server
- OpenCode docs: Web
- OpenCode docs: Network
- OpenCode security advisory GHSA-vxw4-wv6m-9hhh, CVE-2026-22812 (Jan 12, 2026)
- OpenCode security advisory GHSA-632h-h47v-g4x4 (Sep 24, 2026)
- CyberShadow: Unauthenticated Remote Code Execution in OpenCode (Jan 11, 2026)
- Luke Wren: Stop Using OpenCode (Jul 2026)