anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #7811] fix: check worktree for external_directory permission in subdirs #12518

New Issue
Closed
opened 2026-02-16 18:17:25 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:17:25 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/7811

State: closed
Merged: Yes

Summary

Fixes spurious external_directory permission prompts when running opencode from a subdirectory within a git worktree (e.g., monorepo packages/some-package).

Closes #7758

Root cause: Path containment was checked only against Instance.directory (CWD), not Instance.worktree (git root). Paths within the worktree but outside CWD were incorrectly treated as external.

Related Issues

  • #3321 - Partially helps: running from subdirectory now allows access to worktree paths without permission prompts
  • #3603 - Partially helps: AGENTS.md at worktree root can be read without permission prompts when running from subdirectory

Changes

  • Add Instance.containsPath() method that checks both directory and worktree
  • Guard against non-git projects where worktree === "/" to prevent allowing all paths
  • Update assertExternalDirectory() helper to use Instance.containsPath()
  • Update direct usages in file/index.ts and bash.ts
  • Add comprehensive test coverage

Test Plan

bun test test/file/path-traversal.test.ts test/tool/external-directory.test.ts

Tests cover:

  • Path inside directory
  • Path inside worktree but outside directory (monorepo scenario)
  • Path outside both directory and worktree
  • Path with .. escaping worktree
  • directory === worktree (repo root)
  • Non-git project doesn't allow arbitrary paths

Note

This PR was written with AI assistance.

AI Session Export 

{
  "info": {
    "title": "fix external_directory permission in monorepos",
    "agent": "opencode",
    "models": ["claude-opus-4-5"]
  },
  "summary": [
    "user requested fix for issue #7758 and PR creation",
    "agent analyzed external_directory permission bug in monorepo subdirectories",
    "agent added Instance.containsPath() method checking both directory and worktree",
    "agent updated path checks in read.ts, edit.ts, patch.ts, bash.ts, file/index.ts",
    "agent added guard for non-git projects where worktree === '/'",
    "agent created comprehensive test coverage for path containment scenarios",
    "agent committed changes and opened PR #7811",
    "agent ran multi-agent code review with 3 parallel reviewers",
    "reviews confirmed fix addresses root cause correctly with no critical issues"
  ]
}

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/7811 **State:** closed **Merged:** Yes --- ## Summary Fixes spurious `external_directory` permission prompts when running opencode from a subdirectory within a git worktree (e.g., monorepo `packages/some-package`). Closes #7758 **Root cause:** Path containment was checked only against `Instance.directory` (CWD), not `Instance.worktree` (git root). Paths within the worktree but outside CWD were incorrectly treated as external. ## Related Issues - **#3321** - Partially helps: running from subdirectory now allows access to worktree paths without permission prompts - **#3603** - Partially helps: AGENTS.md at worktree root can be read without permission prompts when running from subdirectory ## Changes - Add `Instance.containsPath()` method that checks both `directory` and `worktree` - Guard against non-git projects where `worktree === "/"` to prevent allowing all paths - Update `assertExternalDirectory()` helper to use `Instance.containsPath()` - Update direct usages in `file/index.ts` and `bash.ts` - Add comprehensive test coverage ## Test Plan ```bash bun test test/file/path-traversal.test.ts test/tool/external-directory.test.ts ``` Tests cover: - Path inside directory - Path inside worktree but outside directory (monorepo scenario) - Path outside both directory and worktree - Path with `..` escaping worktree - `directory === worktree` (repo root) - Non-git project doesn't allow arbitrary paths --- > [!NOTE] > This PR was written with AI assistance. <details><summary>AI Session Export</summary> <p> ```json { "info": { "title": "fix external_directory permission in monorepos", "agent": "opencode", "models": ["claude-opus-4-5"] }, "summary": [ "user requested fix for issue #7758 and PR creation", "agent analyzed external_directory permission bug in monorepo subdirectories", "agent added Instance.containsPath() method checking both directory and worktree", "agent updated path checks in read.ts, edit.ts, patch.ts, bash.ts, file/index.ts", "agent added guard for non-git projects where worktree === '/'", "agent created comprehensive test coverage for path containment scenarios", "agent committed changes and opened PR #7811", "agent ran multi-agent code review with 3 parallel reviewers", "reviews confirmed fix addresses root cause correctly with no critical issues" ] } ``` </p> </details>
yindo added the pull-request label 2026-02-16 18:17:25 -05:00
yindo closed this issue 2026-02-16 18:17:25 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#12518
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?