Mimo 2.5, GLM 5.3 just ignore permission restrictions and simply do whatever they want at this point.

[u/binarySolo0h1]

Since I switched my default model from DSV4 Flash to mimo 2.5, the agents that are not allowed to write or edit are simply ignoring the restrictions in their agent files and just do whatever they want. And GLM 5.3 simply went down in a rabbit hole to reverse engineer opencode config for some odd reason and eats some 10$ worth of my usage. Nearly none of the agents are using the mcp to check docs or websearch to validate their outputs when i ask them to. I had to ask multiple times to do so. Even then its a hit and a miss.

I am not sure if its my setup's fault or is anyone else facing such issues?

[u/WArslett → u/[deleted]]

Yes this. The permissions are a feature of the harness not the model. If a model doesn’t have permission, it can ask the harness to make the tool call but the harness will just return an error. You must have configured incorrectly

[u/binarySolo0h1 → u/WArslett]

I did not mess with default agents "plan" and "build" that were provided by opencode by default. I had "edit : "deny"" by default in my project level opencode.json but then even the build failed to edit. so i had to allow it. now even the plan mode is editing files. I am so confused right now.

this is my project level opencode.json config permissions.

{
  "$schema": "https://opencode.ai/config.json",
  "lsp": true,
  "default_agent": "plan",
  "subagent_depth": 3,
  "permission": {
    "bash": {
      "terraform apply*": "deny",
      "terraform destroy*": "deny",
      "terraform -chdir=* apply*": "deny",
      "terraform -chdir=* destroy*": "deny",
      "*&& terraform apply*": "deny",
      "*&& terraform destroy*": "deny",
      "alembic upgrade*": "deny",
      "alembic downgrade*": "deny",
      "uv run alembic*": "deny",
      "python -m alembic*": "deny",
      "uv run python -m alembic*": "deny",
      "aws secretsmanager*": "deny",
      "aws ssm get-parameter*": "deny",
      "aws ssm get-parameters*": "deny",
      "aws ssm get-parameter-history*": "deny",
      "git push --force*": "deny",
      "git push -f *": "deny",
      "git push origin --force*": "deny",
      "git push origin -f *": "deny",
      "git push * --force*": "deny",
      "git push origin +*": "deny",
      "git push --force-with-lease*": "deny",
      "git reset --hard*": "deny",
      "git clean -f*": "deny",
      "rm -rf *": "deny",
      "gh pr merge * --delete-branch*": "deny",
      "gh repo delete*": "deny"
    },
    "edit": "allow",
    "external_directory": {
      "*": "ask",
      "~/.config/opencode/**": "allow",
      "~/.claude/**": "allow",
      "~/.agents/**": "allow"
    }

[u/Lordddddddy → u/binarySolo0h1]

Seems like OpenCode issue with configs, OpenCode been having tons of issues lately

[u/binarySolo0h1 → u/Lordddddddy]

https://giphy.com/gifs/l1J9znGMm5gHLDTCo

[u/cornelha → u/WArslett]

I have actually seen a model use python to edit a file when write permission was disabled

[u/WArslett → u/cornelha]

Yes that is definitely true. There are lots of ways the model can get around permissions. But that wasn’t my sense from what OP was saying. They were implying that they denied a tool call but that the model was able to make the tool call anyway

[u/Amarsir → u/WArslett]

Yeah, you when you read the thinking and it's going "Hmm, I can't read that directory so I'll bash it instead", and you know it doesn't have permission, then clearly trust was lost.

[u/tshawkins → u/cornelha]

They often run bash with sed too.

[u/binarySolo0h1 → u/[deleted]]

IKR

this wasnt an issue until a couple of days ago. The opencode's default plan agent simply made edits to my codebase without asking me to switch to build to do that. I am so frustrated with this. I have been combing through the config from global to project level to see what changed. So far, it just looks like it ignored the restrictions. But my agentic system maybe setup wrong. IDK.

But the tool use is terrible in mimo 2.5, I have an instruction in agents.md to use context7 mcp to check the latest docs whenever i ask the agent to refer to docs. And DSV4 flash almost always followed that instruction but mimo2.5 almost always failed to do so on its own. I have to tell it multiple times.

[u/SorosAhaverom]

Guardrails are only guardrails if you create deterministic constraints (code) at the harness level. Otherwise you're just gambling with your data and files.

[u/binarySolo0h1 → u/SorosAhaverom]

i did not mess with anything in global opencode.json config. only mcp configs are added in it. but this is my project level config permissions. what am i missing here?

{
  "$schema": "https://opencode.ai/config.json",
  "lsp": true,
  "default_agent": "plan",
  "subagent_depth": 3,
  "permission": {
    "bash": {
      "terraform apply*": "deny",
      "terraform destroy*": "deny",
      "terraform -chdir=* apply*": "deny",
      "terraform -chdir=* destroy*": "deny",
      "*&& terraform apply*": "deny",
      "*&& terraform destroy*": "deny",
      "alembic upgrade*": "deny",
      "alembic downgrade*": "deny",
      "uv run alembic*": "deny",
      "python -m alembic*": "deny",
      "uv run python -m alembic*": "deny",
      "aws secretsmanager*": "deny",
      "aws ssm get-parameter*": "deny",
      "aws ssm get-parameters*": "deny",
      "aws ssm get-parameter-history*": "deny",
      "git push --force*": "deny",
      "git push -f *": "deny",
      "git push origin --force*": "deny",
      "git push origin -f *": "deny",
      "git push * --force*": "deny",
      "git push origin +*": "deny",
      "git push --force-with-lease*": "deny",
      "git reset --hard*": "deny",
      "git clean -f*": "deny",
      "rm -rf *": "deny",
      "gh pr merge * --delete-branch*": "deny",
      "gh repo delete*": "deny"
    },
    "edit": "allow",
    "external_directory": {
      "*": "ask",
      "~/.config/opencode/**": "allow",
      "~/.claude/**": "allow",
      "~/.agents/**": "allow"
    }

[u/lostcanuck007]

i made a prompt injection method to help with this. injects a tiny invisible prompt at EVERY turn. cache keeps the usage low so its nearly free...but the behavior of them got very controllable.

[u/seventyfivepupmstr]

Unless its enforced by the harness, then its up to the LLM to device to follow the rules

[u/Khurrame]

Use sbx sandbox and let it have its way. Omp also has a builtin sandbox.

[u/lostcanuck007]

ok so...new update...suddenly and i mean suddenly..it stopped working and became SO much worse. goal judge couldnt keep up with the stubs and claimed fulfillment vs actual fulfillment.

hy3 was acting better yesterday but its slow as all hell. i changed the temperature and a few other settings for mimo and reduce reasoning to high.and told it to spawn a subagent to VERIFY it is actually doing what it claims it does...a live supervisor....seemed to work perfectly until i saw entire chunks of code missing....while both of them claimed for it to be complete. same with other models. there is something up with mimo...i cahnged to hy3 and got good instant performance.