anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #6607] feat: add pattern-based file permissions for edit/write/read tools #11995

New Issue
Closed
opened 2026-02-16 18:16:56 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:16:56 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/6607

State: closed
Merged: No

Summary

Adds glob pattern-based permission controls for edit, write, and read tools, matching the existing functionality of bash permissions.

Changes

  • Config schema: Add pattern support for edit, write, read permissions using z.union([Permission, z.record(z.string(), Permission)])
  • Edit tool: Implement Wildcard.all() pattern matching for file path permissions
  • Write tool: Add separate write permission field with fallback to edit for backward compatibility
  • Read tool: Replace hardcoded .env blocking with configurable pattern-based permissions
  • Tests: Add comprehensive test suite (30 passing tests, 6 skipped for unsupported ** glob patterns)

Example Usage

{
  "permission": {
    "edit": {
      "*.env": "deny",
      "*.md": "allow",
      ".github/workflows/*": "ask",
      "*": "ask"
    },
    "write": {
      "*.env": "deny",
      "credentials.json": "deny",
      "*": "allow"
    },
    "read": {
      "*.env": "deny",
      ".env.sample": "allow",
      "*": "allow"
    }
  }
}

Backward Compatibility

  • Simple string permissions ("ask", "allow", "deny") continue to work
  • Read tool maintains default .env blocking when no read permission is configured
  • Write tool falls back to edit permission if write is not specified

Known Limitations

  • ** glob patterns not supported (limitation of existing Wildcard utility)
  • Pattern priority based on longest match (existing behavior from bash permissions)

Related Issues

Closes #4287

Testing

cd packages/opencode
bun test file-permissions
# 30 pass, 6 skip (** glob patterns), 0 fail
**Original Pull Request:** https://github.com/anomalyco/opencode/pull/6607 **State:** closed **Merged:** No --- ## Summary Adds glob pattern-based permission controls for `edit`, `write`, and `read` tools, matching the existing functionality of `bash` permissions. ## Changes - **Config schema**: Add pattern support for `edit`, `write`, `read` permissions using `z.union([Permission, z.record(z.string(), Permission)])` - **Edit tool**: Implement `Wildcard.all()` pattern matching for file path permissions - **Write tool**: Add separate `write` permission field with fallback to `edit` for backward compatibility - **Read tool**: Replace hardcoded `.env` blocking with configurable pattern-based permissions - **Tests**: Add comprehensive test suite (30 passing tests, 6 skipped for unsupported `**` glob patterns) ## Example Usage ```jsonc { "permission": { "edit": { "*.env": "deny", "*.md": "allow", ".github/workflows/*": "ask", "*": "ask" }, "write": { "*.env": "deny", "credentials.json": "deny", "*": "allow" }, "read": { "*.env": "deny", ".env.sample": "allow", "*": "allow" } } } ``` ## Backward Compatibility - Simple string permissions (`"ask"`, `"allow"`, `"deny"`) continue to work - Read tool maintains default `.env` blocking when no `read` permission is configured - Write tool falls back to `edit` permission if `write` is not specified ## Known Limitations - `**` glob patterns not supported (limitation of existing `Wildcard` utility) - Pattern priority based on longest match (existing behavior from `bash` permissions) ## Related Issues Closes #4287 ## Testing ```bash cd packages/opencode bun test file-permissions # 30 pass, 6 skip (** glob patterns), 0 fail ```
yindo added the pull-request label 2026-02-16 18:16:56 -05:00
yindo closed this issue 2026-02-16 18:16:56 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#11995
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?