Adding/Changing Allowed Commands
When to use this skill
Use this skill when:
- A command needs to be added to the allow list for AI agents
- Permission settings need to be modified for existing commands
- Setting up a new AI tool that requires command permissions
How it works
Commands must be explicitly allowed in the permission configs before agents can run them. This skill covers adding entries to both OpenCode and Claude Code configuration files.
IMPORTANT: The config files are stowed into ~ via GNU Stow symlinks. Always edit them directly from within the ai-config repository, NOT from ~. The paths below are relative to the ai-config repository root.
OpenCode Configuration
File: .config/opencode/opencode.json under permission.bash
Format:
"uname *": "allow",Pattern: "command argpatterns": "action" where * matches any args
Important: Insert new entries in alphabetical order by command name. When adding a new command, find the correct position to maintain sorting. Do NOT reorder existing entries.
Claude Code Configuration
File: .claude/settings.json under permissions.allow
Format:
"Bash(uname:*)",Important: Insert new entries in alphabetical order. Commands are sorted by the command name (the part after Bash( and before :). Do NOT reorder existing entries.
General Pattern for New AI Tools
When adding new AI tools:
- Find their config file (usually in
~/.config/or project root) - Look for
permissions,allowedCommands, or similar sections - Add the command with glob patterns for arguments
- Insert new entries in alphabetical order by command name
- Do NOT reorder existing entries.
After Adding Commands
After adding the new command entries to both config files:
- Check if there are any other staged changes with
git status - If there are NO other staged changes, stage ONLY the new hunks in the two config files using the
git-stagersubagent (be careful not to stage unrelated changes) - Invoke the
git-committersubagent to commit the changes
Examples
Adding rg (ripgrep) to both configs:
OpenCode (insert after rev *, before rpm -q*):
"rg *": "allow",Claude Code (insert after Bash(rg:*), before Bash(rpm -q:*)):
"Bash(rg:*)",