Surfaced by the #667 live smoke (merged in docs/specs/2026-08-13-agent-control-channel-design.md, section "Smoke Test: opencode GET /api/permission/request (2026-08-17)").
What we depend on
packages/agents/src/opencode/sse-bridge.ts:97 answers permission prompts with:
POST /session/{sessionID}/permissions/{permissionID}
opencode's own OpenAPI document (GET /doc) flags that route "deprecated": true.
Why we can't just move
opencode 1.18.18 ships two parallel permission systems:
|
legacy (we use this) |
v2 |
| List pending |
GET /permission |
GET /api/permission/request |
| Reply |
POST /session/{id}/permissions/{permID} — deprecated |
POST /api/session/{id}/permission/{reqID}/reply |
The v2 pair exists, matches its documented schema, and 404s sensibly. But it is fed by the v2 SessionRunner, which cannot complete a turn at all in 1.18.18:
ERROR message="Failed to drain Session" cause="SessionRunnerModel.ModelUnavailableError: Model unavailable: google/gemini-3.1-pro-preview
at SessionRunner.runTurn ...
Reproduced against a second unrelated provider (deepseek/deepseek-chat) with an identical stack, ruling out a credential issue. Because the v2 runner never reaches a tool call, GET /api/permission/request returns data: [] even while a real bash permission is genuinely pending and visible on the legacy endpoint.
The risk
We are pinned to a route upstream has flagged for removal, and the designated replacement is currently non-functional. If opencode removes the legacy pair before fixing SessionRunner, crew permission answering breaks with no migration target.
Suggested handling
Not urgent, but it is a known dependency on a deprecated surface and should not be discovered the hard way during an upgrade.
Surfaced by the #667 live smoke (merged in
docs/specs/2026-08-13-agent-control-channel-design.md, section "Smoke Test: opencodeGET /api/permission/request(2026-08-17)").What we depend on
packages/agents/src/opencode/sse-bridge.ts:97answers permission prompts with:opencode's own OpenAPI document (
GET /doc) flags that route"deprecated": true.Why we can't just move
opencode 1.18.18 ships two parallel permission systems:
GET /permissionGET /api/permission/requestPOST /session/{id}/permissions/{permID}— deprecatedPOST /api/session/{id}/permission/{reqID}/replyThe v2 pair exists, matches its documented schema, and 404s sensibly. But it is fed by the v2
SessionRunner, which cannot complete a turn at all in 1.18.18:Reproduced against a second unrelated provider (
deepseek/deepseek-chat) with an identical stack, ruling out a credential issue. Because the v2 runner never reaches a tool call,GET /api/permission/requestreturnsdata: []even while a real bash permission is genuinely pending and visible on the legacy endpoint.The risk
We are pinned to a route upstream has flagged for removal, and the designated replacement is currently non-functional. If opencode removes the legacy pair before fixing
SessionRunner, crew permission answering breaks with no migration target.Suggested handling
docs/testing/crew-lifecycle-checklist.md).Not urgent, but it is a known dependency on a deprecated surface and should not be discovered the hard way during an upgrade.