OpenCode /tmp/* Permission Blocking Subagent Workflows #73

New Issue

shoko · 2026-04-01T11:06:04+02:00

shoko commented

2026-04-01 11:06:04 +02:00

Problem

When kugetsu delegates tasks to subagents via opencode, subagents sometimes need to write temporary files to /tmp. However, opencode blocks /tmp/* access by default.

Root Cause

OpenCode has an application-level permission layer. Each agent has:

{"permission": "external_directory", "pattern": "*", "action": "ask"}

When running headless, ask becomes auto-reject.

Affected Files

docs/SUBAGENT_WORKFLOW.md - Write findings to /tmp/findings-{N}.md
docs/hermes-communication-patterns.md - Temp file paths
docs/hermes-setup.md - curl with @/tmp/findings-{N}.md
docs/kugetsu-setup.md - tee /tmp/task.log
skills/kugetsu/pm/SKILL.md - Example with /tmp/test.txt

Proposed Solution

Add KUGETSU_TEMP_DIR config option defaulting to /home/shoko/.local/share/opencode/tool-output (already allowed by opencode)
Update /tmp references to use ${KUGETSU_TEMP_DIR:-/tmp}
Export KUGETSU_TEMP_DIR to opencode sessions in kugetsu script

Alternative Solutions

Modify opencode DB to add /tmp/* permission globally
Always use opencode-allowed directories instead of /tmp

Priority

Medium - Blocks some subagent workflows but can be worked around using worktree directories.

## Problem When kugetsu delegates tasks to subagents via opencode, subagents sometimes need to write temporary files to /tmp. However, opencode blocks /tmp/* access by default. ## Root Cause OpenCode has an application-level permission layer. Each agent has: {"permission": "external_directory", "pattern": "*", "action": "ask"} When running headless, ask becomes auto-reject. ## Affected Files - docs/SUBAGENT_WORKFLOW.md - Write findings to /tmp/findings-{N}.md - docs/hermes-communication-patterns.md - Temp file paths - docs/hermes-setup.md - curl with @/tmp/findings-{N}.md - docs/kugetsu-setup.md - tee /tmp/task.log - skills/kugetsu/pm/SKILL.md - Example with /tmp/test.txt ## Proposed Solution 1. Add KUGETSU_TEMP_DIR config option defaulting to /home/shoko/.local/share/opencode/tool-output (already allowed by opencode) 2. Update /tmp references to use ${KUGETSU_TEMP_DIR:-/tmp} 3. Export KUGETSU_TEMP_DIR to opencode sessions in kugetsu script ## Alternative Solutions 1. Modify opencode DB to add /tmp/* permission globally 2. Always use opencode-allowed directories instead of /tmp ## Priority Medium - Blocks some subagent workflows but can be worked around using worktree directories.

shoko added the task-delegation label 2026-04-02 00:30:40 +02:00

shoko referenced this issue from a commit

2026-04-02 01:15:03 +02:00

fix(kugetsu): export KUGETSU_TEMP_DIR for subagent workflows

shoko referenced a pull request that will close this issue

2026-04-02 01:15:13 +02:00

fix(kugetsu): export KUGETSU_TEMP_DIR for subagent workflows #85

shoko referenced this issue from a commit

2026-04-02 02:55:43 +02:00

fix(kugetsu): export KUGETSU_TEMP_DIR for subagent workflows

shoko referenced a pull request that will close this issue

2026-04-02 02:55:57 +02:00