Repository navigation
Global config silently ignored when ~/.config/opencode/opencode.json is a symlink (stow/dotfile managers broken since ~v1.18.x) #39738
Description
Description
When ~/.config/opencode/opencode.json is a symlink (e.g. managed via GNU Stow or similar dotfile managers), the config is silently ignored and opencode falls back to defaults. No error or warning is logged.
This worked correctly before the external_directory permission system was introduced (~v1.18.x). It appears the new permission system creates a chicken-and-egg problem: when loading the global config file, opencode resolves the symlink, detects the real path is outside ~/.config/opencode/, triggers external_directory authorization, but has no config loaded yet to evaluate the permission — so it silently discards the file.
Plugins
@mohak34/opencode-notifier@latest
OpenCode version
1.18.5
Steps to reproduce
- Place your opencode.json in a different directory, e.g. ~/dotfiles/opencode/.config/opencode/opencode.json
- Create a symlink: ln -sf ~/dotfiles/opencode/.config/opencode/opencode.json ~/.config/opencode/opencode.json
- Run: opencode debug config --print-logs
- Observe: logs show
message=loading path=~/.config/opencode/opencode.jsonbut the resolved config is empty (all defaults) - Compare: OPENCODE_CONFIG=~/dotfiles/opencode/.config/opencode/opencode.json opencode debug config → config loads correctly
Screenshot and/or share link
No response
Operating System
macOS 26.6
Terminal
Terminal
Metadata
Metadata
Assignees
Labels
No labels
Activity
mohangk commentedon Sep 20, 2026
Adding on to the symlink writing issue -
~/.config/opencode/opencode.json, I find that it also persists the resolved secret.On 1.18.31 (still reproduces on dev@83abc64): with
"apiKey": "{env:MY_KEY}"in the global config,GET /global/configreturns the substituted value, andPATCH /global/configwrites its payload back over the file. A client that reads-then-saves therefore replaces the{env:...}token with the literal key, and the write swaps the symlink for a regular file (same atomic temp+rename path described here).Minimal repro, no client needed: start
opencode serve,GET /global/config,PATCHthat same body back, thengrep apiKey ~/.config/opencode/opencode.json→ literal secret.Relevant code:
updateGlobal()inpackages/opencode/src/config/config.tsmerges the resolved payload over the file, and substitution runs inconfig/variable.tsbefore parsing.@tomhuettmann do you already have a PR for your original issue? I am happy to attach a failing test / small repro script if useful and also add on to your fix , if it makes sense
tomhuettmann commentedon Sep 28, 2026
@mohangk Thank You! I did not work further on this and also do not have a PR. Feel free to take over :)
thdxr commentedon Oct 11, 2026
Thanks for the report! OpenCode 2.0 is now out and development is focused on V2, so we're closing issues filed against OpenCode 1. Please upgrade (
opencode upgrade --major, details: https://anoma.ly/notes/opencode-2-0), and if this is still relevant on 2.0, reopen this issue or open a new one with your 2.0 version.— from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊