fix(server): full-access OpenCode threads no longer ask for approvals

[shivamhwp]

A user reported that OpenCode threads set to full access still pop approval dialogs. I reproduced it live against OpenCode 1.18.26 with a ChatGPT subscription. Ordinary tool calls are fine, but two paths in OpenCode ignore the session-level allow we send:

• Doom loop. When the model repeats the same tool call three times, OpenCode evaluates the ask against the agent ruleset only, so our wildcard allow is never consulted. This showed up in the UI as an "unknown" approval.
• Subagents. Child sessions spawned by the task tool keep only deny and external-directory rules from the parent, so a subagent reading *.env or hitting any agent default prompts. Since fix(opencode): handle child approvals, stops, and model catalogs #8480 routes child asks to the thread, this also shows a dialog.

Both are upstream OpenCode behavior, and full access means the user already said yes. The adapter now answers any permission ask that arrives while the session is in full access, and swallows the matching replied event so nothing reaches the UI. If the reply call fails, it falls back to showing the approval as before. Other modes are untouched.

The reply is "once", not "always". OpenCode stores "always" grants per directory, so on a shared external server an "always" from a full-access thread would widen what a supervised thread on the same directory is allowed to do.

Product note. Auto-answering the doom-loop ask means a full-access thread can repeat the same tool call without a guard. That matches what the docs promise for full access ("runs unattended") and what Codex and Claude do today, so it is intentional.

Tests cover the doom-loop ask on the parent session, a child-session ask, the failed-reply fallback, and a failed reply whose terminal event landed while the reply was in flight. The final ordering change (no yield between the terminal check and the publish) is a scheduler-interleaving race that the mock cannot reproduce deterministically, so it has no dedicated test.

Work done by Claude Fable 5.1 via Claude Code.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes permission handling and event emission for full-access OpenCode sessions; incorrect suppression or fallback could hide needed approvals or leave stuck dialogs, though other runtime modes are unchanged and tests cover key races.

Overview
Full-access OpenCode threads no longer surface approval dialogs for permission asks that upstream ignores the session ruleset on—doom-loop detection and subagent sessions. The adapter calls permission.reply with once (not always, to avoid widening grants for other threads on a shared directory), tracks auto-replied IDs, and suppresses matching request.opened / request.resolved UI events. If the SDK reply fails, behavior falls back to showing the approval dialog; failed in-flight replies after a terminal event must not reopen the request.

Implementation adds autoReplyFullAccess, autoRepliedRequestIds, and emitUnsafe so request.opened is not published after a terminal permission.replied lands between an async check and enqueue. Tests extend the mock with a configurable permission-reply hook and cover auto-approve (parent doom-loop + child session), reply failure fallback, and terminal/reply ordering. Docs note why full-access auto-answers these asks and why replies use once.

^{Reviewed by Cursor Bugbot for commit 4d250db. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix full-access OpenCode threads to auto-approve permissions without dialogs

• Full-access sessions now automatically reply once to permission asks (doom-loop and subagent) instead of surfacing an approval dialog, using a one-time grant rather than a persistent directory-scoped grant
• A synchronous enqueue helper (emitUnsafe) prevents an async gap between the terminal-event check and publishing request.opened, eliminating a race where a terminal reply arrives during event construction
• Failed auto-replies remove the auto-reply marker but keep a resolved marker so the request falls through to the dialog without reopening from recovered duplicate asks; terminal events for successful auto-replies are swallowed (no request.resolved)
• Behavioral Change: emitTerminalOpenCodeRequest now suppresses terminal events for request IDs in the auto-reply set; reviewers should verify that no request.resolved or request.opened is emitted for successfully auto-replied asks in OpenCodeAdapter.ts
• Documents full-access adapter behavior in providers.md

^{Macroscope summarized 4d250db.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The server now automatically grants and suppresses OpenCode permission requests in full-access sessions, including requests that bypass upstream rules and the doom-loop safeguard. This is a localized, tested change, but it materially alters production authorization behavior and its side effects warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ace0116. Configure here.}

[shivamhwp]

Addressed the review in 605dcff.

1. Reply is now "once". Confirmed against upstream Permission.reply: it returns before touching the per-directory approved list on "once" and appends to it on "always".
2. Full-access branch extracted into autoReplyFullAccess returning replied | fallback | already-terminal. Added emitUnsafe next to emit with the one-line reason. Comments trimmed to the why.
3. Tests 1 and 2 collapsed into one it.effect.each case. Sentinel is commented. The blind yieldNow pair in test 4 is replaced with a single microtask drain. PR body now says the final ordering change has no dedicated test.
4. One line added to docs/internals/providers.md on the upstream ruleset quirk.

PR body rewritten: bot summary blocks removed, doom-loop product decision stated explicitly.