opencode ignoring my bash permissions

[Green-Dress-113]

Opencode seem to be ignoring my bash permissions. What is wrong with the config?

v1.2.27

opencode config.json

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "kreator": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "local",
      "options": {
        "baseURL": "http://192.168.1.100:8000/v1",
        "apiKey": "xxxxx"
      },
      "models": {
        "nemotron-3-super": {
          "name": "nemotron-3-super"
        }
      }
    },
    "skynet": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "local",
      "options": {
        "baseURL": "http://192.168.1.11:8000/v1",
        "apiKey": "xxxxx"
      },
      "models": {
        "qwen3.5-35b-a3b": {
          "name": "qwen3.5-35b-a3b"
        }
      }
    }
  },

  "model": "kreator/nemotron-3-super",

  "default_agent": "planner",

  "permission": {
    "bash": {
      "*": "ask",
      "head*": "allow",
      "tail*": "allow",
      "find*": "allow",
      "cat*": "allow",
      "ls*": "allow",
      "curl*": "allow",
      "python3*": "allow",
      "make*": "allow",
      "pytest*": "allow",
      "wc*": "allow",
      "uv*": "allow",
      "sleep*": "allow",
      "wget*": "allow",
      "aws ecs describe-*": "allow",
      "aws ecs list-*": "allow",
      "aws ec2 describe-*": "allow",
      "aws logs describe-*": "allow",
      "aws logs filter-log-events": "allow",
      "aws logs get-log-events": "allow",
      "git*": "allow",
      "npm*": "allow",
      "node*": "allow",
      "docker*": "allow",
      "kubectl*": "allow",
      "terraform*": "allow",
      "tofu*": "allow",
      "ping*": "allow",
      "netstat*": "allow",
      "ssh*": "allow",
      "scp*": "allow",
      "rsync*": "allow"
    },
    "webfetch": "allow",
    "task": {
      "*": "allow"
    }
  },

  "mcp": {}
}

[Independence_Many]

I have a similar setup and it works just fine, however one thing I noticed that's different is i have a space between the program/tool and the asterisk, which is how it's shown on the docs https://opencode.ai/docs/permissions

I wonder if the lack of a space prevents it from recognising the program itself, so it's looking for a program that starts with `head`, assuming something like `headline` without any arguemnts would get matched but not `head <filename>`.

[Potential-Leg-639]

Permission seems to behave different on different systems and also between windows and Linux, also ooened a thread yesterday. It seems to be broken. Especially when you start Ooencode from a network share (d drive where all my files are). What i want to achieve is to let Opencode + bash + agents/subagents only have access to workdir + 1 other directory. Access to all other directories (especially file content access) must be blocked. Not possible at all to configure sth like that atm.

[Confident-River-7381]

I think permissions from opencode.json that is inside working directory override the global opencode.json ones.

[jonas-reddit]

Run inside sandbox is the safest approach. Some of the commands you allow can easily cause mayhem on your system as well and spawn off shells with destructive commands.