permissions: external_directory ask is skipped for shell #56288

Activity

1. opencode-agent commented on Oct 17, 2026

   

   opencode-agentBot

   on Oct 17, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the detailed report. I can reproduce this on 2.0.32, and it still happens on the latest dev (65932e8).

   There's no Windows or PowerShell in my sandbox, so I tested on Linux with bash, using your external_directory ask rule and a simulated model:

   1. The agent runs echo x > /tmp/oc-56288-outside/shell.txt; cp /etc/hostname …/copied.txt; touch …/touched.txt through shell. All three files are created, no prompt appears, and no permission request is created.
   2. The agent then calls read on /tmp/oc-56288-outside/shell.txt. The "Permission required / Access external directory" dialog appears right away.

   The recording and screenshot below show both steps, and the script below reproduces it.

   From the code, the shell scanner seems to infer directories only from commands that change the working directory (cd, pushd, Set-Location, …). Paths passed to other commands or cmdlets, and redirect targets, never reach the external_directory check. Your Set-Content case goes through the same code path, though I haven't run it on Windows.

   Related: #46398 (the same PowerShell symptom, filed with the older config syntax), and #49948 / #52083 (shell redirects bypassing permission checks). Until this is fixed, your workaround of a shell ask rule is the way to keep a prompt in front of shell commands.

   recording.mp4

   

   Reproduction script (drive.ts)

   // Repro for anomalyco/opencode#56288: with
   //   permissions: [{ action: "external_directory", resource: "*", effect: "ask" }]
   // the shell tool writes to an absolute path outside the project without any
   // external_directory check, while the read tool prompts for the same directory.
   import { Effect, Stream } from "effect"
   import * as fs from "node:fs"
   import { Llm, OpenCodeDriver } from "opencode-drive"
   
   const OUT = "/tmp/oc-56288-outside"
   
   export default OpenCodeDriver.use(
     {
       ...(process.env.OC_DEV ? { opencode: { dev: process.env.OC_DEV } } : {}),
       tui: { recording: true },
       config: {
         permissions: [{ action: "external_directory", resource: "*", effect: "ask" }],
       },
     },
     ({ ui, llm, opencode }) =>
       Effect.gen(function* () {
         fs.rmSync(OUT, { recursive: true, force: true })
         fs.mkdirSync(OUT, { recursive: true })
   
         yield* llm.serve((request: unknown, index: number) => {
           const text = JSON.stringify(request)
           if (index === 0)
             return Stream.make(
               Llm.toolCall({
                 index: 0,
                 id: "call_shell",
                 name: "shell",
                 input: { command: `echo x > ${OUT}/shell.txt; cp /etc/hostname ${OUT}/copied.txt; touch ${OUT}/touched.txt` },
               }),
               Llm.finish("tool-calls"),
             )
           if (index === 1) return Stream.make(Llm.text("SHELL STEP DONE"))
           if (index === 2)
             return Stream.make(
               Llm.toolCall({ index: 0, id: "call_read", name: "read", input: { path: `${OUT}/shell.txt` } }),
               Llm.finish("tool-calls"),
             )
           const i = text.lastIndexOf("call_read")
           console.log("read tool result seen by the model:", text.slice(i, i + 160))
           return Stream.make(Llm.text("WRITE STEP DONE"))
         })
   
         // 1. shell writes to an absolute path outside the project
         yield* ui.submit("Write files outside the project with shell")
         yield* ui.waitFor("SHELL STEP DONE", { timeout: 60_000 })
         yield* ui.screenshot("after-shell")
         console.log("files after shell:", fs.readdirSync(OUT))
         console.log("pending permission requests:", JSON.stringify((yield* opencode.permission.request.list()).data))
   
         // 2. read tool on the file shell just wrote -> external_directory prompt
         yield* ui.submit("Now read that file with the read tool")
         yield* ui.waitFor("Access external directory", { timeout: 60_000 })
         yield* Effect.sleep("1 second")
         yield* ui.screenshot("read-prompt")
         console.log("pending permission requests:", JSON.stringify((yield* opencode.permission.request.list()).data))
       }),
   )

   Run it with opencode-drive: opencode-drive run ./drive.ts. It drives opencode from your PATH; set OC_DEV to the path of an OpenCode checkout to run that from source instead.
2. opencode-agent

   added

   reproduced

   severity:high

   on Oct 17, 2026
3. pulkit777exe commented on Oct 17, 2026

   

   pulkit777exe

   on Oct 17, 2026

   More actions

   I looked into the issue and found that both the tree-sitter and portable shell scanners were only picking up directory paths from commands like cd, pushd, and Set-Location.

   They were missing file paths passed to commands like cp, touch, and Set-Content, as well as paths used in shell redirects like > and >>. Because of this, those paths were never passed to FileAccess.authorizeExternal.

   I've updated both Bash and PowerShell scanners to extract these paths from command arguments and redirections, and pass them to FileAccess.authorizeExternal along with the existing directory targets.

   I also added tests in packages/core/test/shell-parse.test.ts to cover Bash redirects, file paths in command arguments, and PowerShell cmdlets and redirects.

   I'm opening a PR with these changes.
4. wortkarg commented on Oct 29, 2026

   

   wortkarg

   on Oct 29, 2026

   More actions

   Not only external_directory, you can read e.g. .env files via shell commands like "Get-Content -Force .env", even if the read permission is set to "deny".

   "permissions": [
   { "action": "external_directory", "resource": "", "effect": "deny" },
   { "action": "read", "resource": ".env", "effect": "deny" },
   ...
   ],