Tool Permissions

Kimaki surfaces OpenCode's permission system in Discord. When the agent tries something that needs approval, you get buttons in the thread. You can also pre-configure defaults and restrict individual sessions.

Approval buttons

When the agent attempts a tool call that requires permission (a shell command, accessing files outside the project, etc.), Kimaki posts three buttons in the thread:

   agent wants to run a command
            │
            ▼
   ┌──────────┐  ┌────────────────┐  ┌────────┐
   │  Accept  │  │ Accept Always  │  │  Deny  │
   └──────────┘  └────────────────┘  └────────┘
        │               │                │
     run once      remember rule      reject + tell agent

Accept — allow this one call.
Accept Always — allow and remember the rule for the session so similar calls don't ask again.
Deny — reject the call; the agent is told and continues.

Directory access

Every directory is allowed by default. The agent can read and edit files outside the project without asking. OpenCode's own default is to ask for each external folder, which turned ordinary reads into a stream of approval prompts.

To protect specific folders, add deny or ask rules to your opencode.json. Your project config is merged after Kimaki's defaults and the last matching rule wins, so your rules take priority:

12345678910{
  "$schema": "https://opencode.ai/config.json",
  "permission": {
    "external_directory": {
      "~/.ssh": "deny",
      "~/.ssh/*": "deny",
      "~/Documents/*": "ask"
    }
  }
}

Kimaki writes "external_directory": { "*": "allow" }, so the keys above merge on top of that wildcard. Paths you don't list stay allowed.

To flip the default back to a strict allow-list, start the bot with --restrict-directories:

1kimaki --restrict-directories

The agent is then limited to the session working directory plus a few known-safe paths (/tmp, ~/.config/opencode, ~/.opensrc, ~/.kimaki, and common toolchain caches). Anything else raises an approval prompt in the thread.

Default permissions in opencode.json

Set project-wide defaults in your opencode.json. See the OpenCode Permissions docs for the full schema, pattern matching, and per-agent overrides.

Agent files can also carry permissions, which is handy for an auto-allow agent that never stalls on prompts:

1234567---
description: Build agent that never stalls on prompts
mode: primary
permission:
  question: allow
  plan_enter: allow
---

Locking down a single session

When starting a session with kimaki send, restrict tools for that session only with repeatable --permission rules:

1234# Read-only review session
kimaki send -c <channel-id> -p 'Review this code' \
  --permission 'bash:deny' \
  --permission 'edit:deny'

Rules are evaluated last-match-wins. This is ideal for CI, scheduled tasks, or sandboxed runs. See CI & Automation for the full --permission reference.