Repository navigation
[Bug] Windows path references and permissions on external directory path not working #36681
Description
Description
Hello,
I tried to configure my opencode with windows path but it is not working, and there is no documentation of how you would handle path on windows.
Here my configuration :
{
"$schema": "https://opencode.ai/config.json",
"permission": {
"external_directory": {
"~/.config/opencode/**": "allow",
"$HOME/.config/opencode/**": "allow",
"C:\\Users\\User\\.config\\opencode": "allow",
"C:\\Projects\\AI\\lm-studio-assistant": "allow",
},
},
"references": {
"global-config": {
"path": "~/.config/opencode",
"description": "Global config folder for opencode.",
},
"lm-studio-assistant": {
"path": "C:\\Projects\\AI\\lm-studio-assistant",
"description": "LM Studio assistant project.",
},
}
}But when inspecting logs:
timestamp=2026-07-13T13:58:14.712Z level=INFO run=7ae11f63 message=asking id=per_f5bc573b8001VMtIrmKNCaFDdL permission=external_directory patterns="[\"C:\\\\Projects\\\\AI\\\\lm-studio-assistant\\\\*\"]"
There is confusion from if ~/ would work on windows first (and so $HOME)
Possibilities could be :
"/c/Projects/AI/lm-studio-assistant"
"/mnt/c/Projects/AI/lm-studio-assistant" (WSL)
"C:\\Projects\\AI\\lm-studio-assistant"
"C:/Projects/AI/lm-studio-assistant" (mic mac ?)
"C:\\\\Projects\\\AI\\\\lm-studio-assistant" (from logs)
I would expect automatic handling of windows paths to detect unix windows convention (C:\\Users, /c/Projects) or at least document it.
Plugins
None
OpenCode version
1.17.18
Steps to reproduce
- Set a new project with opencode.jsonc
- Ask to search files and verify paths on others projects listed on references
- Permission to explore is asked.
Screenshot and/or share link
On a subagent researcher, but would have the same problem with default agents (no override on external directory permissions)
Agent permissions:
---
description: Read-only research librarian — extracts facts from project files and the web, cross-references sources, every fact cited — outputs a three-part report (facts, cross-references, gaps)
mode: all
temperature: 0.3
color: info
permission:
edit: deny
read: allow
glob: allow
grep: allow
webfetch: allow
websearch: allow
task: deny
bash:
'*': deny
'echo *': 'allow'
'ls *': 'allow'
'dir *': 'allow'
'cat *': 'allow'
'head *': 'allow'
'tail *': 'allow'
'wc *': 'allow'
'find *': 'allow'
'grep *': 'allow'
'rg *': 'allow'
'diff *': 'allow'
'file *': 'allow'
'rg *': allow
'Get-Content*': 'allow',
'Get-ChildItem*': 'allow',
'Get-Item*': 'allow',
'Select-String*': 'allow',
'Test-Path*': 'allow',
---Operating System
Windows 11 25H2 26200.8655
Terminal
OpenCode desktop
Causes
Seems external_directory is not cumulative with home configuration.
see #36681 (comment)
#36681 (comment) is a point on unclear documentation with references.
And there is others problems after that.
Activity
github-actions commentedon Jul 13, 2026
This issue might be a duplicate of existing issues. Please check:
external_directorypermission bypassed for cross-drive paths on Windows #27596:external_directorypermission bypassed for cross-drive paths on Windows — covers Windows path handling bugs in the same permission system{env:VAR}in permission keys expands to native Windows backslashes, producing invalid JSON on Windows — related Windows backslash path issue in configm21-cerutti commentedon Jul 13, 2026
Also one point not in original issue, references and external_directory collide and is not clear on usage, if we make a reference but deny autorisations what would be the result and use case ? For now it's an "ask" permission but not very clear of why.
m21-cerutti commentedon Jul 13, 2026
It seems permissions for external_directory (https://opencode.ai/docs/permissions/#external-directories) is not working at all, would expect the read to fail or have an error, not asking since all external_directory path are denied.
EDIT: seems the inverse is also true
Possible hint, my opencode.jsonc in home ask for permission.
m21-cerutti commentedon Jul 13, 2026
Seems
external_directoryis not cumulative with home configuration.Having commented the corresponding section in ~.config\opencode\ make at least wilcard working
It contradicts documentation :
https://opencode.ai/docs/config/#locations
Work also on deny but seems maybe confused with references permissions
Others working examples:
See the convention working is
C:\\Usersand not
/c/Users/m21-cerutti commentedon Jul 13, 2026
But
touchpermission not follow permissions for external directory (would be denied or allow, not ask)Same for Glob
m13v commentedon Jul 14, 2026
the allow-list patterns read correct, but that's not what the runtime checks them against. your log shows it prompting on "C:\Projects\AI\lm-studio-assistant\*", a normalized + globbed form your literal external_directory entry never string-matches. so a fully-specified block still asks. and since external_directory isn't cumulative with the home config, the ~/.config allows quietly drop at the same time. the gate isn't the policy text you wrote, it's the path-normalization pass it gets compared against, and that pass is exactly what the config can't show you.
m21-cerutti commentedon Aug 17, 2026
Seems it have been improve with last versions of opencode, but still lack documentation for windows in https://opencode.ai/docs/permissions/.
thdxr commentedon Oct 11, 2026
Thanks for the report! OpenCode 2.0 is now out and development is focused on V2, so we're closing issues filed against OpenCode 1. Please upgrade (
opencode upgrade --major, details: https://anoma.ly/notes/opencode-2-0), and if this is still relevant on 2.0, reopen this issue or open a new one with your 2.0 version.— from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊