fix BYOK OpenCode permission bypass (#5701)

Author: Siri-Ray

apps/daemon/src/runtimes/defs/byok-opencode.ts

@@ -1,4 +1,8 @@
 import { opencodeByokModelId } from '../byok-opencode.js';
+import {
+  OPENCODE_PERMISSION_CAPABILITY,
+  appendOpenCodePermissionBypass,
+} from '../opencode-permissions.js';
 import { DEFAULT_MODEL_OPTION } from './shared.js';
 import type { RuntimeAgentDef } from '../types.js';
 
@@ -8,9 +12,11 @@ export const byokOpenCodeAgentDef = {
   bin: 'opencode-cli',
   fallbackBins: ['opencode'],
   versionArgs: ['--version'],
+  ...OPENCODE_PERMISSION_CAPABILITY,
   fallbackModels: [DEFAULT_MODEL_OPTION],
   buildArgs: (_prompt, _imagePaths, _extra, options = {}) => {
     const args = ['run', '--format', 'json'];
+    appendOpenCodePermissionBypass(args, 'byok-opencode');
     const model = opencodeByokModelId(options.model);
     if (model) args.push('-m', model);
     return args;

apps/daemon/src/runtimes/defs/opencode.ts

@@ -1,19 +1,17 @@
 import { DEFAULT_MODEL_OPTION, parseLineSeparatedModels } from './shared.js';
-import { agentCapabilities } from '../capabilities.js';
+import {
+  OPENCODE_PERMISSION_CAPABILITY,
+  appendOpenCodePermissionBypass,
+} from '../opencode-permissions.js';
 import type { RuntimeAgentDef } from '../types.js';
 
-const SKIP_PERMISSIONS_FLAG = '--dangerously-skip-permissions';
-
 export const opencodeAgentDef = {
     id: 'opencode',
     name: 'OpenCode',
     bin: 'opencode-cli',
     fallbackBins: ['opencode'],
     versionArgs: ['--version'],
-    helpArgs: ['run', '--help'],
-    capabilityFlags: {
-      [SKIP_PERMISSIONS_FLAG]: 'skipPermissions',
-    },
+    ...OPENCODE_PERMISSION_CAPABILITY,
     // `opencode models` prints `provider/model` per line. Real-world
     // `opencode models` calls can take >8s (network round-trip to the
     // provider registry), so the previous 8s budget timed out and fell back
@@ -50,9 +48,7 @@ export const opencodeAgentDef = {
         '--format',
         'json',
       ];
-      if (agentCapabilities.get('opencode')?.skipPermissions) {
-        args.push(SKIP_PERMISSIONS_FLAG);
-      }
+      appendOpenCodePermissionBypass(args, 'opencode');
       // Capture-style resume: OpenCode mints its own session id (reported on
       // the stream as `sessionID`, e.g. `ses_...`). On a follow-up turn the
       // daemon continues that session with `-s <id>` instead of re-sending the

apps/daemon/src/runtimes/opencode-permissions.ts

@@ -0,0 +1,17 @@
+import { agentCapabilities } from './capabilities.js';
+import type { RuntimeAgentDef } from './types.js';
+
+export const OPENCODE_SKIP_PERMISSIONS_FLAG = '--dangerously-skip-permissions';
+
+export const OPENCODE_PERMISSION_CAPABILITY = {
+  helpArgs: ['run', '--help'],
+  capabilityFlags: {
+    [OPENCODE_SKIP_PERMISSIONS_FLAG]: 'skipPermissions',
+  },
+} satisfies Pick<RuntimeAgentDef, 'helpArgs' | 'capabilityFlags'>;
+
+export function appendOpenCodePermissionBypass(args: string[], agentId: string): void {
+  if (agentCapabilities.get(agentId)?.skipPermissions) {
+    args.push(OPENCODE_SKIP_PERMISSIONS_FLAG);
+  }
+}

apps/daemon/tests/runtimes/byok-opencode.test.ts

@@ -1,13 +1,42 @@
 import { describe, expect, it } from 'vitest';
 
+import { agentCapabilities } from '../../src/runtimes/capabilities.js';
 import {
   BYOK_OPENCODE_API_KEY_ENV,
   BYOK_OPENCODE_PROVIDER_ID,
   buildOpenCodeByokProviderConfig,
   opencodeByokModelId,
 } from '../../src/runtimes/byok-opencode.js';
+import { byokOpenCodeAgentDef } from '../../src/runtimes/defs/byok-opencode.js';
 
 describe('byok-opencode runtime config', () => {
+  it('gates non-interactive permission bypass on the installed OpenCode capability', () => {
+    agentCapabilities.delete('byok-opencode');
+    expect(byokOpenCodeAgentDef.helpArgs).toEqual(['run', '--help']);
+    expect(byokOpenCodeAgentDef.capabilityFlags).toEqual({
+      '--dangerously-skip-permissions': 'skipPermissions',
+    });
+    expect(byokOpenCodeAgentDef.buildArgs('', [], [], {})).toEqual([
+      'run',
+      '--format',
+      'json',
+    ]);
+
+    agentCapabilities.set('byok-opencode', { skipPermissions: true });
+    try {
+      expect(byokOpenCodeAgentDef.buildArgs('', [], [], { model: 'gpt-5.5' })).toEqual([
+        'run',
+        '--format',
+        'json',
+        '--dangerously-skip-permissions',
+        '-m',
+        'open-design-byok/gpt-5.5',
+      ]);
+    } finally {
+      agentCapabilities.delete('byok-opencode');
+    }
+  });
+
   it('prefixes raw BYOK models with the run-scoped OpenCode provider id', () => {
     expect(opencodeByokModelId('gpt-4o-mini')).toBe('open-design-byok/gpt-4o-mini');
     expect(opencodeByokModelId('open-design-byok/gpt-4o-mini')).toBe('open-design-byok/gpt-4o-mini');