anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[FEATURE]: Support ~ and $HOME expansion in permission patterns #7064

New Issue
Closed
opened 2026-02-16 18:06:03 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:06:03 -05:00
Owner
Copy Link
Copy Source

Originally created by @ferdinandyb on GitHub (Jan 21, 2026).

Originally assigned to: @thdxr on GitHub.

Feature hasn't been suggested before.

  • I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Problem

Permission patterns in opencode.jsonc don't expand ~ or environment variables like $HOME to actual paths. This causes patterns like ~/my-projects/* or $HOME/my-projects/* to never match because the actual paths being checked are absolute (e.g., /Users/username/my-projects/*). This is rather inconvenient as it makes to config not portable between machines with same layout but different username.

Current Behavior

"external_directory": {
  "~/my-projects/*": "allow",
  "$HOME/my-projects/*": "allow",
}

When reading a file at /Users/username/my-projects/somefile.txt, the permission check generates the pattern /Users/username/my-projects/*, which doesn't match either config pattern because ~ and $HOME are treated literally.

Expected Behavior

~ should be expanded to the user's home directory and environment variables like $HOME should be expanded before pattern matching, so ~/my-projects/* or $HOME/my-projects/* would match /Users/username/my-projects/*.

Workaround

Use absolute paths in the config:

"external_directory": {
  "/Users/username/my-projects/*": "allow",
}

However, hardcoding the username makes configs non-portable across machines or users, which defeats the purpose of using ~ or $HOME in the first place.

Suggested Fix

In packages/opencode/src/permission/next.ts, expand ~ and environment variables in rule patterns before matching in the evaluate function, or in fromConfig when creating the ruleset.

Originally created by @ferdinandyb on GitHub (Jan 21, 2026). Originally assigned to: @thdxr on GitHub. ### Feature hasn't been suggested before. - [x] I have verified this feature I'm about to request hasn't been suggested before. ### Describe the enhancement you want to request ## Problem Permission patterns in `opencode.jsonc` don't expand `~` or environment variables like `$HOME` to actual paths. This causes patterns like `~/my-projects/*` or `$HOME/my-projects/*` to never match because the actual paths being checked are absolute (e.g., `/Users/username/my-projects/*`). This is rather inconvenient as it makes to config not portable between machines with same layout but different username. ## Current Behavior ```jsonc "external_directory": { "~/my-projects/*": "allow", "$HOME/my-projects/*": "allow", } ``` When reading a file at `/Users/username/my-projects/somefile.txt`, the permission check generates the pattern `/Users/username/my-projects/*`, which doesn't match either config pattern because `~` and `$HOME` are treated literally. ## Expected Behavior `~` should be expanded to the user's home directory and environment variables like `$HOME` should be expanded before pattern matching, so `~/my-projects/*` or `$HOME/my-projects/*` would match `/Users/username/my-projects/*`. ## Workaround Use absolute paths in the config: ```jsonc "external_directory": { "/Users/username/my-projects/*": "allow", } ``` However, hardcoding the username makes configs non-portable across machines or users, which defeats the purpose of using `~` or `$HOME` in the first place. ## Suggested Fix In `packages/opencode/src/permission/next.ts`, expand `~` and environment variables in rule patterns before matching in the `evaluate` function, or in `fromConfig` when creating the ruleset.
yindo added the discussion label 2026-02-16 18:06:03 -05:00
yindo closed this issue 2026-02-16 18:06:03 -05:00
yindo commented 2026-02-16 18:06:03 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 21, 2026):

This issue might be a duplicate of or related to existing issues. Please check:

  • #4743: [FEATURE]: allow /tmp or $TMPDIR folder access option - Requests environment variable expansion in permission patterns (specifically for $TMPDIR)
  • #4287: [FEATURE]: edit/write permission with deny,allow,ask using glob - Requests glob pattern support for permission patterns
  • #5529: [FEATURE]: Add per-agent filesystem boundaries (allow/deny paths) - Comprehensive feature request for per-agent path-based permissions, which would include path expansion

The core issue (#9806) is about expanding ~ and $HOME in permission patterns to make configs portable. Issue #4743 specifically mentions the need for $TMPDIR expansion, and #5529 discusses more general filesystem path policies that could incorporate this functionality.

Feel free to ignore if your use case differs, but these related issues may provide context or workarounds.

@github-actions[bot] commented on GitHub (Jan 21, 2026): This issue might be a duplicate of or related to existing issues. Please check: - #4743: [FEATURE]: allow /tmp or $TMPDIR folder access option - Requests environment variable expansion in permission patterns (specifically for $TMPDIR) - #4287: [FEATURE]: edit/write permission with deny,allow,ask using glob - Requests glob pattern support for permission patterns - #5529: [FEATURE]: Add per-agent filesystem boundaries (allow/deny paths) - Comprehensive feature request for per-agent path-based permissions, which would include path expansion The core issue (#9806) is about expanding `~` and `$HOME` in permission patterns to make configs portable. Issue #4743 specifically mentions the need for `$TMPDIR` expansion, and #5529 discusses more general filesystem path policies that could incorporate this functionality. Feel free to ignore if your use case differs, but these related issues may provide context or workarounds.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label discussion
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#7064
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?