[FEATURE]: Permissions separation #48806

Activity

1. github-actions

   assigned

   neriousy

   on Sep 13, 2026
2. opencodejr commented on Oct 28, 2026

   

   opencodejrBot

   on Oct 28, 2026

   More actions

   Thanks for the request, @AzazelHD!

   I think you can already do this with config, without a new feature. Here is how OpenCode v2 treats paths:

   • Paths inside the working directory (or the project's git worktree) count as internal. edit rules match them as relative paths.
   • Any other path triggers the external_directory permission (default ask), and rules match it as an absolute path.
   • Rules use last-match-wins, and * also matches /.

   So a global config (~/.config/opencode/opencode.json) like this should do what you want:

   {
     "$schema": "https://opencode.ai/config.json",
     "permission": {
       "read": "allow",
       "external_directory": {
         "*": "ask",
         "~/path/you/trust/**": "allow"
       },
       "edit": {
         "*": "allow",
         "/*": "ask"
       }
     }
   }

   • Inside the working directory, reads and edits are allowed without asking.
   • Under ~/path/you/trust/**, reads are allowed without asking. Edits still ask, because the absolute path matches "/*": "ask".
   • Anywhere else, you are asked first (external_directory).

   A few caveats:

   • "Internal" covers the project worktree as well as the exact cwd.
   • On Windows, absolute paths look like C:/..., so add a rule such as "?:*": "ask" to edit.
   • bash commands can still write files, so add bash rules if you need that to be strict too.

   More details are in the permissions docs. If this doesn't cover your case, please reply with what's missing and maintainers will consider it.
3. Tarquinen commented on Nov 2, 2026

   

   Tarquinen

   on Nov 2, 2026

   Member

   More actions

   Thanks for the request! This can already be done with permission rules in your config, as described in the comment above. Closing this issue.

   — from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊
4. Tarquinen

   closed this as completedon Nov 2, 2026