glob tool ignores permission rules for path parameter (external drives/paths) #25268

Description

Permission rules configured in opencode.json are not enforced on the glob tool when paths are provided via the path parameter. Other tools (read, bash, grep, edit) correctly respect these rules.

Plugins

No response

OpenCode version

1.14.31

Steps to reproduce

1. Configure opencode.json with permission rules to deny access to specific paths (e.g., external drives on Windows):
   {
   "$schema": "https://opencode.ai/config.json",
   "permission": {
   "glob": {
   "": "allow",
   "D:/": "deny",
   "E:/": "deny",
   "D:": "deny",
   "E:*": "deny"
   },
   "external_directory": {
   "D:/": "deny",
   "E:/": "deny"
   }
   }
   }
2. Restart opencode to load the new config.
3. Attempt to glob files on the restricted drives:
   glob with path="D:" pattern=""
   glob with path="E:" pattern=""

Expected behavior:
The glob tool should be blocked by the permission rules, same as read and bash are. The glob tool receives the target directory via the path parameter, and permission rules should match against it.
Actual behavior:
The glob tool returns results from D:\ and E:\ without being blocked. The permission rules for glob only match against the pattern parameter, not the path parameter, so they are ineffective for restricting access to specific directories.
Other tools work correctly:

• read with D:\ → correctly blocked ✅
• bash with ls D:\ → correctly blocked ✅
• glob with path="D:" → returns results ❌
  Environment:
• OS: Windows 11
• OpenCode version: (latest)
• The external_directory rule also does not block glob access to paths outside the working directory.
  Suggested fix:
  The glob permission rules should check both the pattern and the path parameter, similar to how read and edit check their filePath parameter. Additionally, external_directory should also be enforced when glob is called with a path outside the project working directory.

Screenshot and/or share link

No response

Operating System

windows 11

Terminal

windows terminal