04-tools-permissions-and-execution.md

layout	default
title	Chapter 4: Tools, Permissions, and Execution
nav_order	4
parent	OpenCode Tutorial

Chapter 4: Tools, Permissions, and Execution

Welcome to Chapter 4: Tools, Permissions, and Execution. In this part of OpenCode Tutorial: Open-Source Terminal Coding Agent at Scale, you will build an intuitive mental model first, then move into concrete implementation details and practical production tradeoffs.

The tool layer determines whether OpenCode is safe and reliable in real repositories.

Execution Safety Model

Layer	Control
command scope	allowlist or reviewed command boundaries
file edits	review before apply
high-risk ops	explicit confirmation
audit trail	structured log of actions

Best Practices

• keep destructive operations behind explicit review
• treat shell commands as privileged actions
• enforce small, reversible edit batches
• run tests/lint after non-trivial patches

Team Policy Pattern

1. define approved command families
2. require review for package and infra changes
3. log all executed operations in CI contexts
4. rotate credentials and avoid implicit env leakage

Source References

• OpenCode Agents Docs
• OpenCode README

Summary

You now have a practical safety baseline for running OpenCode against important codebases.

Next: Chapter 5: Agents, Subagents, and Planning

How These Components Connect

flowchart TD
    A[Task Request] --> B[Permission Check]
    B -->|Allowed| C[Tool Dispatch]
    B -->|Denied| D[Prompt for Approval]
    C --> E[File Operations]
    C --> F[Shell Commands]
    C --> G[Search / Read]
    E --> H[Result]
    F --> H

Loading