bug: undefined in v1 permission metadata breaks GET /permission

[rvaccone]

Description

Five v1 tools write absent optional inputs into permission metadata as undefined. Encoding the GET /permission response then fails, so one pending request makes the entire listing unreadable. Reported as HTTP 400 on v1.17.18, still present on dev at 7534d235.

Flat:

• packages/opencode/src/tool/glob.ts:34 — path
• packages/opencode/src/tool/grep.ts:45 — path, include
• packages/opencode/src/tool/webfetch.ts:46 — timeout
• packages/opencode/src/tool/websearch.ts:125 — numResults, livecrawl, type, contextMaxCharacters

Nested: packages/opencode/src/tool/apply_patch.ts:201 sets movePath: change.movePath inside metadata.files[], undefined for every add, delete, and non-move update.

Writing path: params.path creates the key holding undefined instead of omitting it. Metadata is Schema.Record(Schema.String, Schema.Unknown), and Unknown encodes through Schema.Json, whose guard rejects undefined and recurses into objects and arrays:

Expected JSON value, got undefined
  at [0]["metadata"]["path"]

Expected JSON value, got [{"filePath":"a.ts","type":"update","patch":"Index: a.ts","movePath":undefined}]
  at [0]["metadata"]["files"]

The fix needs two parts. Strip undefined where the pending request is built at packages/opencode/src/permission/index.ts:92 for the four flat tools, and omit movePath at its construction site, since a top level strip cannot reach inside metadata.files[]. Neither half alone is sufficient; I checked by encoding Schema.Array(PermissionV1.Request) with both metadata shapes.

v1 counterpart of #37650. Originally reported by @su-351917 in #38617 and in #37650 (comment).

Happy to open a PR.

OpenCode version

v1.17.18 as reported; code confirmed present on dev at 7534d235

Steps to reproduce

1. Configure permissions to ask.
2. Call glob without the optional path, or apply any ordinary patch with apply_patch.
3. While the permission is pending, request GET /permission.

The endpoint fails to encode its response instead of returning the pending list.

Operating System

Linux, as reported by @su-351917

[rvaccone]

PR: #38918

One correction to the fix described above: the guard is recursive, so it covers apply_patch's nested movePath as well and the separate omission is not needed. Still worth doing as hygiene, since the field is optional in the type.

[github-actions]

To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.

[rvaccone]

Reopening. The stale bot closed this, but the bug is only partly fixed.

Fixed: apply_patch no longer writes movePath: undefined into metadata.files[], as of #45329.

Still present on dev at 7945de208: the four flat tools still write absent optional inputs as undefined keys:

• packages/opencode/src/tool/glob.ts:34: path
• packages/opencode/src/tool/grep.ts:45: path, include
• packages/opencode/src/tool/webfetch.ts:46: timeout
• packages/opencode/src/tool/websearch.ts:125: numResults, livecrawl, type, contextMaxCharacters

I confirmed it by running #38918's test against unmodified dev: a pending request whose metadata holds path: undefined fails to encode through the schema GET /permission declares. With #38918's source change applied to current dev, all three tests pass.

#38918 fixes this where the pending request is built. An automated cleanup closed it without review. It still applies cleanly. Could it be reopened?