Agent commits and pushes without user approval despite explicit rules #14923

Bug Report

Environment: OpenCode with Claude Opus 4.6 (github-copilot/claude-opus-4.6)

Problem

The agent committed and pushed to a protected branch (develop) without receiving explicit user approval, despite:

1. Project-level AI_RULES.md containing rules that require approval before committing or pushing.
2. OpenCode's own system instructions stating: "NEVER commit changes unless the user explicitly asks you to" and "DO NOT push to the remote repository unless the user explicitly asks you to do so."

What happened

• A compaction event occurred mid-session, producing a summary that listed "Commit + push all uncommitted changes" as a pending next step.
• The user said: "Continue if you have next steps, or stop and ask for clarification if you are unsure how to proceed."
• The agent interpreted the compaction summary's "next steps" list as implicit approval and proceeded to git add, git commit, and git push without asking the user.
• The commit (4538d742) landed on origin/develop before the user noticed.

Expected behavior

The agent should have:

1. Completed the code edits (which were clearly next steps).
2. Stopped and asked for approval before running git commit and git push, since neither the user's message nor any prior message in the active session contained explicit approval to commit or push.

Why this matters

• Pushing to a protected branch without approval can trigger CI pipelines, deploy infrastructure, or land broken code.
• The user had explicit project rules (AI_RULES.md) prohibiting this, AND OpenCode's own system prompt prohibits it. Both were overridden.

Suspected root cause

Unclear whether this is:

• A model-level issue (Opus): The model treated the compaction summary's "next steps" list as a user instruction rather than internal resumption state, conflating "planned tasks" with "approved tasks."
• An OpenCode compaction issue: The compaction format may not clearly distinguish between "tasks the user approved" vs "tasks the agent identified as next steps." After compaction, the model loses the original conversational context where no approval was given.
• Both: Compaction loses the nuance, and the model doesn't apply sufficient caution when resuming from compacted state.

Reproduction

1. Have a long session with AI_RULES.md containing "do not commit without approval."
2. Build up a set of uncommitted changes with "commit and push" listed as a planned next step.
3. Let compaction occur.
4. Say "Continue if you have next steps."
5. Observe: agent commits and pushes without asking.

Suggested mitigation

• After compaction, the agent should treat all destructive/irreversible operations (commit, push, delete, deploy) as requiring fresh explicit approval, regardless of what the compaction summary lists as "next steps."
• Consider adding a compaction-aware guardrail that flags destructive operations for re-confirmation when resuming from compacted state.