fix(opencode): align tool visibility with session permissions by jackoatmon · Pull Request #17089 · anomalyco/opencode · GitHub

Issue for this PR

Type of change

Bug fix
New feature
Refactor / code improvement
Documentation

What does this PR do?

This patch aligns tool visibility with permission enforcement so the model and API only see tools that are actually callable.

Concretely:

merges session permission rules into runtime tool filtering before tool exposure in session/llm.ts
passes session permissions through session/prompt.ts into the LLM stream path
makes /experimental/tool and /experimental/tool/ids permission-aware via optional agent and sessionID query params
updates generated SDK query types/signatures for these optional params
adds regression tests for session-level filtering and experimental route filtering

How did you verify your code works?

bun test test/session/llm.test.ts
bun test test/server/experimental-tools.test.ts
bun test test/server/experimental-tools.test.ts test/session/llm.test.ts
bun run typecheck (packages/opencode)
bun run typecheck (packages/sdk/js)
bun run typecheck (repo root, also required by pre-push hook)

Screenshots / recordings

Not a UI change.

Checklist

I have tested my changes locally
I have not included unrelated changes in this PR

Ensure session-level permission rules are merged before tool exposure so denied tools are not advertised to providers. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Align tool and tool/ids endpoints with runtime visibility rules so API consumers receive only tools they can invoke. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Expose provider/model/agent/sessionID query fields in generated SDK contracts so clients can request permission-aware tool listings. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Replace raw declaration path placeholders with valid triple-slash references so workspace typecheck and pre-push hooks pass on Windows. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Hey! Your PR title Align tool visibility with session permissions and update SDK query types doesn't follow conventional commit format.

Please update it to start with one of:

feat: or feat(scope): new feature
fix: or fix(scope): bug fix
docs: or docs(scope): documentation changes
chore: or chore(scope): maintenance tasks
refactor: or refactor(scope): code refactoring
test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, opencode).

See CONTRIBUTING.md for details.

The following comment was made by an LLM, it may be inaccurate:

Based on my searches, I found one potentially related PR:

Related PR:

feat(config): add subagent_tools to complement primary_tools and unifies tool visibility under permission system #7725 - "feat(config): add subagent_tools to complement primary_tools and unifies tool visibility under permission system"
- This PR addresses tool visibility under a permission system, which is related to your PR's focus on aligning tool visibility with session permissions.

However, the search results indicate that #7725 appears to be a separate feature focused on configuration-level tool management (subagent_tools), while your PR (#17089) focuses on runtime permission filtering at the session level for the experimental tool endpoints.

The other results (#15028, #8943, #7756, #12731) don't appear to be directly related to the core functionality of this PR.

No exact duplicates found for PR #17089.

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

Open an issue describing the bug/feature (if one doesn't exist)
Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

Thanks for updating your PR! It now meets our contributing guidelines. 👍

Follow-up on CI status:

All policy, unit, typecheck, and compliance checks are green.
The only failing jobs are e2e (linux) and e2e (windows) in run 22971287522.
A separate recent upstream PR run (22971376239) shows the same two e2e jobs failing, which suggests this is a baseline/flaky e2e issue rather than a regression unique to this patch.

I attempted to trigger a failed-job rerun via API, but this token does not have permission to rerun upstream Actions jobs (403).

Opened a dedicated follow-up for the cross-PR flaky E2E failures: #17093 (#17093).

Given this affects unrelated PRs, I propose treating current e2e (linux) and e2e (windows) failures here as infra flakiness pending that issue's resolution.

Maintainer context for merge decision:

All policy and code-quality gates for this PR are green (pr-standards, check-compliance, check-standards, typecheck, unit (linux/windows), etc.).
The only red checks are e2e (linux) and e2e (windows) from run 22971287522.
The same two E2E jobs also fail in another unrelated PR test workflow run (22971376239), which points to a broader E2E flake/infra issue rather than a regression unique to this patch.
Follow-up tracking issue is open here: Flaky CI: e2e (linux) and e2e (windows) fail across unrelated PRs #17093.

If maintainers are comfortable with the current E2E flake baseline, this PR appears otherwise ready from a code/policy perspective.

Thanks! is what I need!

Any update on this PR? I would need this

I need this too

Same here! It would be very helpful for me

jackoatmon and others added 4 commits March 11, 2026 15:14

jackoatmon requested a review from adamdotdevin as a code owner March 11, 2026 19:45

github-actions Bot added the needs:title label Mar 11, 2026

github-actions Bot added the needs:compliance This means the issue will auto-close after 2 hours. label Mar 11, 2026

jackoatmon changed the title Align tool visibility with session permissions and update SDK query types fix(opencode): align tool visibility with session permissions Mar 11, 2026

github-actions Bot added needs:issue and removed needs:title labels Mar 11, 2026

github-actions Bot removed needs:issue needs:compliance This means the issue will auto-close after 2 hours. labels Mar 11, 2026

jackoatmon mentioned this pull request Mar 11, 2026

Flaky CI: e2e (linux) and e2e (windows) fail across unrelated PRs #17093

Closed

opencode-agent Bot force-pushed the dev branch from 2f2ed11 to 9f201d6 Compare April 16, 2026 21:55

thdxr requested review from Brendonovich and Hona as code owners June 11, 2026 00:18

github-actions Bot mentioned this pull request Jun 13, 2026

feat: nested sub-agent spawning (up to 5 levels) + multi-agent workflow orchestration #32167

Closed

3 tasks

github-actions Bot mentioned this pull request Jul 7, 2026

feat(core): configure tool availability per session #35691

Closed

6 tasks

fix(opencode): align tool visibility with session permissions by jackoatmon · Pull Request #17089 · anomalyco/opencode · GitHub

Uh oh!

fix(opencode): align tool visibility with session permissions - #17089

fix(opencode): align tool visibility with session permissions#17089
jackoatmon wants to merge 4 commits into
anomalyco:devfrom
jackoatmon:dev-permission-visibility-fix

jackoatmon commented Mar 11, 2026 •
edited
Loading

Uh oh!

Uh oh!

github-actions Bot commented Mar 11, 2026

Uh oh!

github-actions Bot commented Mar 11, 2026

Uh oh!

github-actions Bot commented Mar 11, 2026

Uh oh!

github-actions Bot commented Mar 11, 2026

Uh oh!

jackoatmon commented Mar 11, 2026

Uh oh!

jackoatmon commented Mar 11, 2026

Uh oh!

jackoatmon commented Mar 11, 2026

Uh oh!

ainexxo-master commented Apr 29, 2026

Uh oh!

AndreaDiTrani commented Apr 29, 2026

Uh oh!

thomasbonenfant commented Apr 29, 2026

Uh oh!

AleBonini1 commented Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

fix(opencode): align tool visibility with session permissions by jackoatmon · Pull Request #17089 · anomalyco/opencode · GitHub

Uh oh!

fix(opencode): align tool visibility with session permissions - #17089

fix(opencode): align tool visibility with session permissions#17089jackoatmon wants to merge 4 commits intoanomalyco:devanomalyco/opencode:devfrom jackoatmon:dev-permission-visibility-fixjackoatmon/opencode:dev-permission-visibility-fixCopy head branch name to clipboard

Conversation

jackoatmon commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue for this PR

Type of change

What does this PR do?

How did you verify your code works?

Screenshots / recordings

Checklist

Uh oh!

github-actions Bot commented Mar 11, 2026

Uh oh!

github-actions Bot commented Mar 11, 2026

Uh oh!

github-actions Bot commented Mar 11, 2026

Uh oh!

github-actions Bot commented Mar 11, 2026

Uh oh!

jackoatmon commented Mar 11, 2026

Uh oh!

jackoatmon commented Mar 11, 2026

Uh oh!

jackoatmon commented Mar 11, 2026

Uh oh!

ainexxo-master commented Apr 29, 2026

Uh oh!

AndreaDiTrani commented Apr 29, 2026

Uh oh!

thomasbonenfant commented Apr 29, 2026

Uh oh!

AleBonini1 commented Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

fix(opencode): align tool visibility with session permissions#17089
jackoatmon wants to merge 4 commits into
anomalyco:devfrom
jackoatmon:dev-permission-visibility-fix

jackoatmon commented Mar 11, 2026 •
edited
Loading