New permission system issues with wildcards and glob patterns #7029

Activity

1. shanepadgett

   added

   bugSomething isn't workingSomething isn't working

   on Jan 6, 2026
2. github-actions

   assigned

   thdxr

   on Jan 6, 2026
3. github-actions commented on Jan 6, 2026

   

   github-actionsBot

   on Jan 6, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of existing issues. Please check:

   • [BUG] Bash permission patterns with wildcards don't match commands with flags (e.g., "kill *" doesn't match "kill -9 PID") #6676: [BUG] Bash permission patterns with wildcards don't match commands with flags (e.g., "kill *" doesn't match "kill -9 PID") - Similar issue with wildcard pattern matching in permissions
   • MCP tool permissions not working after migration from tools to permissions #6892: MCP tool permissions not working after migration from tools to permissions - Related to the new permission system not working correctly
   • Should we actually implement the new granular permissions in .md agent files? #6856: Should we actually implement the new granular permissions in .md agent files? - Discusses implementation of granular permissions in agent frontmatter

   The core issue appears to be with how wildcard and glob patterns are processed in the new permission system, where specific patterns should take precedence over wildcard denies.

   Feel free to ignore if none of these address your specific case.
4. malhashemi commented on Jan 6, 2026

   

   malhashemi

   on Jan 6, 2026

   Contributor

   More actions

   @shanepadgett I think it is about ordering see 6856
5. rekram1-node commented on Jan 6, 2026

   

   rekram1-node

   on Jan 6, 2026

   Last edited by rekram1-node

   Collaborator

   More actions

   @shanepadgett try:

   permission:
     edit:
       "*": deny
       "changes/**/*.md": allow
     write:
       "*": deny
       "changes/**/*.md": allow
   
6. rekram1-node

   closed this as completedon Jan 6, 2026
7. shanepadgett commented on Jan 6, 2026

   

   shanepadgett

   on Jan 6, 2026

   Last edited by shanepadgett

   Author

   More actions

   So switching the ordering at least allowed the write tool to be recognized, but glob patterns like my changes folder do not work still. So switching was an improvement, but when it tried to write a markdown file to changes folder it was denied.
8. kylerm42 commented on Jan 7, 2026

   

   kylerm42

   on Jan 7, 2026

   More actions

   Just wanted to share my experience with this. The documentation does not make it clear that these read/edit/write permissions are relative to the workspace root, which is NOT always the directory you launch Opencode from. Opencode uses git rev-parse --git-common-dir to set the root, so patterns have to match from that directory.

   I had my agent set up like this:

     edit:
       "*": deny
       "test_dir*": allow
     write:
       "*": deny
       "test_dir/*": allow

   This is my setup that's problematic with those permissions:

   repo-root/                          [Git Root, Opencode worktree root]
   ├── test_dir/                       ✅ Pattern: test_dir/*
   │   └── file.md                        Can edit depending on external_directory permission
   │
   └── sub_dir/                        [Working Directory - where Opencode launches]
       └── test_dir/                   ❌ Pattern: test_dir/*
           └── file.md                    Does NOT match (full path is sub_dir/test_dir/*)
   

   So after figuring out what the issue is, I changed my permissions to this:

     edit:
       "*": deny
       "*/test_dir*": allow
     write:
       "*": deny
       "*/test_dir/*": allow
   

   Which leads to some other potential problems.

   repo-root/                          [Git Root]
   ├── test_dir/                       ❌ Pattern: */test_dir/*
   │   └── file.md                        Does NOT match (no prefix before test_dir)
   │
   └── sub_dir/                        [Working Directory - where Opencode launches]
       └── test_dir/                   ✅ Pattern: */test_dir/*
           └── file.md                    DOES match (sub_dir/ matches the */)
   External Repository (SECURITY ISSUE)
   =====================================
   /some/other/repo/                   [Different Git Root]
   └── any_dir/                        
       └── test_dir/                   ⚠️  Pattern: */test_dir/*
           └── file.md                    ALSO MATCHES! (any_dir/ matches the */)
   

   I think it's easy enough to manage the permissions now that I know, but it took a while to figure out and diving into the code to understand. My suggestions would be to 1. standardize external_directory permission (uses Instance.directory) and read/edit/write permissions (uses Instance.worktree), and 2. Update the permissions documentation to include a note about this. @rekram1-node

   @shanepadgett Not sure if this applies to your situation, but also wanted to point out that the wildcard matching is a simple one, not like glob patterns. So yours should let you edit changes/some_dir/test.md but wouldn't let you edit changes/test.md.

   👍React with 👍1Reacted by CedarFox

   ❤️React with ❤️1Reacted by CedarFox

   🚀React with 🚀1Reacted by CedarFox