Skip to content

fix(core): map legacy apply_patch permissions to edit - #57900

Merged
rekram1-node merged 1 commit into
devfrom
apply-patch-permission
Oct 21, 2026
Merged

rekram1-node merged 1 commit into
devfrom
apply-patch-permission

Conversation

@rekram1-node

Copy link
Copy Markdown
Contributor

Issue for this PR

Fixes #50183

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

Problem. V1 treated apply_patch as part of the edit permission family, and the docs still list it there. The V1 config migration maps write and patch to edit but not apply_patch. So { "permission": { "apply_patch": "deny" } } (or tools: { apply_patch: false }) became a rule for an apply_patch action that no tool checks, and the deny silently did nothing.

Change. Map apply_patch to edit alongside write and patch:

 normalizeAction(action)
-  write | patch               → edit
+  write | patch | apply_patch → edit
   task                        → subagent
   bash                        → shell

Both the permission and tools migration paths go through normalizeAction, so both are covered.

How did you verify your code works?

From packages/core:

bun test test/config/config.test.ts -t "normalizes renamed permission"   # passes; fails without the fix
bun test test/config      # 249 pass, 0 fail
bun typecheck

Screenshots / recordings

No UI changes.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. I passed {"permission":{"apply_patch":"deny"}} and {"tools":{"apply_patch":false}} through ConfigNormalize.normalize on the base and on this branch. On the base both became a rule for an apply_patch action that nothing checks. With this change both become an edit deny, which the patch tool does check. The updated test fails on the base and passes here; test/config (249 pass) and typecheck in packages/core are clean.

Public API: no config keys are added or removed. Legacy apply_patch entries under permission / tools now apply to the edit permission, which matches the docs. Backwards compatible.

No concerns.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Legacy apply_patch permission rules stop matching after config migration

1 participant