Description

Bug: external_directory permission bypassed for cross-drive paths on Windows

Summary

On Windows, when the workspace is on a different drive (e.g., D:\), tools like read, write, edit, grep, and glob bypass the external_directory permission check for paths on other drives (e.g., C:\). The root cause is a cross-drive bug in AppFileSystem.contains().

Version

Reproduced on v1.14.49 and v1.14.50 (Desktop, Windows 11).

Root Cause

packages/core/src/filesystem.ts:241-243:

export function contains(parent: string, child: string) {
  return !relative(parent, child).startsWith("..")
}

On Windows, Node.js path.relative() behaves differently across drives:

When drives differ, path.relative returns the full absolute path of the target, which does NOT start with ... This causes contains() to incorrectly return true, making containsPath() (in instance-context.ts) treat cross-drive paths as "inside the project" — completely skipping the external_directory permission gate.

The issue is also present in normalizePathPattern() and potentially affects overlaps() (same path.relative pattern).

Affected Code

Reproduction

1. Start OpenCode in workspace D:\opencode\test0 (no .git)
2. Configuration: defaults (no permission field in opencode.jsonc)
3. Try to read or write a file on C:\Users\<user>\Desktop\:

Suggested Fix

export function contains(parent: string, child: string) {
  // Windows: paths on different drives cannot be contained
  if (process.platform === "win32") {
    const parentParsed = path.parse(parent)
    const childParsed = path.parse(child)
    if (parentParsed.root.toLowerCase() !== childParsed.root.toLowerCase()) {
      return false
    }
  }
  return !relative(parent, child).startsWith("..")
}

Same fix should be applied to overlaps() and the duplicate contains() in packages/opencode/src/util/filesystem.ts.

Related Issues

• #25097 — Permission glob matcher doesn't match deep absolute paths
• #25268 — glob tool ignores permission rules for external drives/paths
• #24468 — CRITICAL: external_directory bypassed on Windows

Plugins

No response

OpenCode version

v1.14.49 and v1.14.50 (Desktop, Windows 11)

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

windows11

Terminal

No response