anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Add pattern-based directory access restrictions to prevent verbose per-tool configurations #2368

New Issue
Closed
opened 2026-02-16 17:35:22 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 17:35:22 -05:00
Owner
Copy Link
Copy Source

Originally created by @jmtornetta on GitHub (Oct 30, 2025).

Feature Request: Pattern-based directory access restrictions

Problem

Currently, restricting access to sensitive directories requires denying specific commands (e.g., ls /sensitive/path, cat /sensitive/path) for every tool and path, which is extremely verbose and error-prone. This leads to incomplete coverage and security gaps.

Proposal

Introduce a new config option like "exclude_patterns": ["**/.env*", "**/.ssh/**", "**/journal/**"] that applies globally across all tools, preventing access to matching paths without needing per-command denials.

Benefits

  • Simplifies security configuration
  • Reduces verbosity in opencode.json
  • Prevents accidental exposure of sensitive files
  • Avoids need for containerization or over-reliance on system prompts for security

Example Configuration

{
  "exclude_patterns": [
    "**/.env*",
    "**/.ssh/**",
    "**/.aws/**",
    "**/.kube/**",
    "**/.terraform/**",
    "**/.docker/**",
    "**/.vscode/**",
    "**/.idea/**",
    "**/journal/**"
  ]
}

This would block any tool from accessing files/directories matching these patterns, enhancing security without tool-specific workarounds.

Current Workaround Limitations

The current approach requires verbose per-command denials:

{
  "permission": {
    "bash": {
      "ls /sensitive/path": "deny",
      "cat /sensitive/path": "deny",
      "cd /sensitive/path": "deny"
    }
  }
}

This is impractical for comprehensive security coverage across all tools and paths.

Originally created by @jmtornetta on GitHub (Oct 30, 2025). ## Feature Request: Pattern-based directory access restrictions ### Problem Currently, restricting access to sensitive directories requires denying specific commands (e.g., `ls /sensitive/path`, `cat /sensitive/path`) for every tool and path, which is extremely verbose and error-prone. This leads to incomplete coverage and security gaps. ### Proposal Introduce a new config option like `"exclude_patterns": ["**/.env*", "**/.ssh/**", "**/journal/**"]` that applies globally across all tools, preventing access to matching paths without needing per-command denials. ### Benefits - Simplifies security configuration - Reduces verbosity in opencode.json - Prevents accidental exposure of sensitive files - Avoids need for containerization or over-reliance on system prompts for security ### Example Configuration ```json { "exclude_patterns": [ "**/.env*", "**/.ssh/**", "**/.aws/**", "**/.kube/**", "**/.terraform/**", "**/.docker/**", "**/.vscode/**", "**/.idea/**", "**/journal/**" ] } ``` This would block any tool from accessing files/directories matching these patterns, enhancing security without tool-specific workarounds. ### Current Workaround Limitations The current approach requires verbose per-command denials: ```json { "permission": { "bash": { "ls /sensitive/path": "deny", "cat /sensitive/path": "deny", "cd /sensitive/path": "deny" } } } ``` This is impractical for comprehensive security coverage across all tools and paths.
yindo closed this issue 2026-02-16 17:35:22 -05:00
yindo commented 2026-02-16 17:35:22 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Oct 30, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #3164: Similar request for excluding files from being used, asking about regex patterns to prevent access to passwords and secret files
  • #539: Comprehensive security feature request for allowing ignoring files to prevent secrets being leaked from .env to LLM, with suggestion for .opencodeignore file support
  • #2242: Related request about sandboxing agents to restrict terminal commands from accessing/editing files outside current directory
  • #2206: Related security enhancement proposing an exec tool as more secure alternative to bash tool, addressing similar security concerns about file access controls

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Oct 30, 2025): This issue might be a duplicate of existing issues. Please check: - #3164: Similar request for excluding files from being used, asking about regex patterns to prevent access to passwords and secret files - #539: Comprehensive security feature request for allowing ignoring files to prevent secrets being leaked from .env to LLM, with suggestion for .opencodeignore file support - #2242: Related request about sandboxing agents to restrict terminal commands from accessing/editing files outside current directory - #2206: Related security enhancement proposing an exec tool as more secure alternative to bash tool, addressing similar security concerns about file access controls Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#2368
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?