Bug: permission pathing crossplatform #7279

Activity

1. KoalaHao

   added

   bugSomething isn't workingSomething isn't working

   on Jan 8, 2026
2. github-actions

   assigned

   rekram1-node

   on Jan 8, 2026
3. github-actions

   added

   windows

   on Jan 8, 2026
4. github-actions commented on Jan 8, 2026

   

   github-actionsBot

   on Jan 8, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of existing issues. Please check:

   • [FEATURE]: Limit tool (e.g. write, edit) permissions to specific folders #6318: Limit tool (e.g. write, edit) permissions to specific folders - addresses the same permission path matching functionality
   • [FEATURE]: Add per-agent filesystem boundaries (allow/deny paths) + optional run-as user for bash #5529: Add per-agent filesystem boundaries (allow/deny paths) - includes similar path-based permission requirements
   • Windows Support #631: Windows Support - umbrella issue tracking all Windows compatibility problems

   This bug highlights a critical flaw in path-based permission matching when using forward slashes on Windows systems. The path normalization issue affects the core functionality requested in those feature issues.
5. pschiel commented on Jan 28, 2026

   

   pschiel

   on Jan 28, 2026

   Contributor

   More actions

   #6763 fixes this via path normalization
6. moonxorsun commented on Feb 25, 2026

   

   moonxorsun

   on Feb 25, 2026

   More actions

   I can confirm this issue still exists in v1.2.8 and is particularly problematic for custom agents defined in markdown files (agents/*.md).

   After diving into the opencode source code to debug why .opencode/plans/*.md was working for the built-in plan agent but failing for my custom analyze agent on Windows, here is the exact root cause:

   1. How write.ts / edit.ts check permissions:
      Tools like write.ts pass the relative path to ctx.ask:

      patterns: [path.relative(Instance.worktree, filepath)]

      On Windows, path.relative produces a path with backslashes (e.g., .opencode\plans\test.md).

   2. Why the built-in plan agent works:
      In src/agent/agent.ts, the built-in plan agent constructs its permission rule using path.join:

      edit: {
        "*": "deny",
        [path.join(".opencode", "plans", "*.md")]: "allow",
      }

      This generates the pattern .opencode\plans\*.md dynamically on Windows, which perfectly matches the tool output above.

   3. Why custom Agent configs fail:
      When defining an agent in agents/my-agent.md, we typically write:

      permission:
        edit:
          "*": deny
          ".opencode/plans/*.md": allow

      This is parsed exactly as-is. The pattern is .opencode/plans/*.md (with forward slashes).

   4. The gap in Wildcard.match (src/util/wildcard.ts):
      While Wildcard.match attempts to normalize paths:

      if (str) str = str.replaceAll("\\", "/")
      if (pattern) pattern = pattern.replaceAll("\\", "/")

      This logic executes during the match evaluation (PermissionNext.evaluate). However, there seems to be a disconnect where the findLast lookup or the initial ruleset merging either ignores this normalized pattern or the Windows path \ fails to match the / based globs before it reaches this normalization.

   Workaround:
   For custom agents on Windows, you must escape the Windows path separator in the YAML file:

   permission:
     edit:
       "*": deny
       ".opencode\plans\*.md": allow

   Proposed Fix:
   The easiest fix would be for the config parser (PermissionNext.fromConfig) to run .replaceAll("\\", "/") on all pattern keys immediately upon loading them, or to enforce a standard separator representation throughout the permission state instead of normalizing it at the very end in Wildcard.match.

   👍React with 👍1Reacted by Michael Yochpaz
7. MichaelYochpaz commented on Mar 24, 2026

   

   MichaelYochpaz

   on Mar 24, 2026

   Last edited by MichaelYochpaz

   Contributor

   More actions

   I'm getting this on v1.3.0 with agent-level permissions in opencode.json.

   In my case, a custom agent uses ~/.config/opencode/.tmp/** as an allow pattern for edit.
   After tilde expansion on Windows, the pattern becomes C:\Users\<user>/.config/opencode/.tmp/** (mixed separators), which fails to match the fully backslash-resolved path the Write tool passes.
8. KoalaHao commented on Mar 25, 2026

   

   KoalaHao

   on Mar 25, 2026

   Author

   More actions

   its almost 3 months now devs are overwhelmed by the amount of issues and pull requests, i dont see this getting fixed anytime soon
9. thdxr

   removed

   bugSomething isn't workingSomething isn't working

   windows

   on May 3, 2026
10. github-actions commented on Jul 3, 2026

    

    github-actionsBot

    on Jul 3, 2026 – with GitHub Actions

    Contributor

    More actions

    To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.
11. github-actions

    closed this as not plannedon Jul 3, 2026