Add pattern-based directory access restrictions to prevent verbose per-tool configurations #3585

Feature Request: Pattern-based directory access restrictions

Problem

Currently, restricting access to sensitive directories requires denying specific commands (e.g., ls /sensitive/path, cat /sensitive/path) for every tool and path, which is extremely verbose and error-prone. This leads to incomplete coverage and security gaps.

Proposal

Introduce a new config option like "exclude_patterns": ["**/.env*", "**/.ssh/**", "**/journal/**"] that applies globally across all tools, preventing access to matching paths without needing per-command denials.

Benefits

• Simplifies security configuration
• Reduces verbosity in opencode.json
• Prevents accidental exposure of sensitive files
• Avoids need for containerization or over-reliance on system prompts for security

Example Configuration

{
  "exclude_patterns": [
    "**/.env*",
    "**/.ssh/**",
    "**/.aws/**",
    "**/.kube/**",
    "**/.terraform/**",
    "**/.docker/**",
    "**/.vscode/**",
    "**/.idea/**",
    "**/journal/**"
  ]
}

This would block any tool from accessing files/directories matching these patterns, enhancing security without tool-specific workarounds.

Current Workaround Limitations

The current approach requires verbose per-command denials:

{
  "permission": {
    "bash": {
      "ls /sensitive/path": "deny",
      "cat /sensitive/path": "deny",
      "cd /sensitive/path": "deny"
    }
  }
}

This is impractical for comprehensive security coverage across all tools and paths.