anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Patch tool should fail fast on paths outside workspace #7930

New Issue
Open
opened 2026-02-16 18:08:42 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:08:42 -05:00
Owner
Copy Link
Copy Source

Originally created by @ilepn on GitHub (Jan 29, 2026).

Originally assigned to: @thdxr on GitHub.

Summary

When patch/apply_patch receives a file path outside the current workspace root, it should fail fast with a clear error and non-zero status instead of silently "succeeding" or writing to the wrong location.

Repro (Windows, but should be general)

  1. Start OpenCode in a workspace on C:
    opencode C:/Users/me/project
  2. Apply a patch targeting an absolute path on D:
    *** Update File: D:/.toolbox/docs/uv-install.md

Observed: patch reports success but no file is created/updated under D:, or paths are mis-interpreted.
Expected: validation error indicating path outside workspace root.

Expected behavior

  • Normalize each patch target path.
  • If target path resolves outside workspace root, abort before making changes.
  • Return a non-zero tool error status, e.g. EOUTSIDE_ROOT, with a clear message:
    "Path outside workspace root. Start OpenCode in that directory or use an allowed root."

Nice-to-have (optional)

  • Configurable allowlist of additional roots (multi-root).
  • Or prompt for explicit approval when patch targets a path outside root.

Related

Originally created by @ilepn on GitHub (Jan 29, 2026). Originally assigned to: @thdxr on GitHub. ## Summary When `patch`/`apply_patch` receives a file path outside the current workspace root, it should fail fast with a clear error and non-zero status instead of silently "succeeding" or writing to the wrong location. ## Repro (Windows, but should be general) 1. Start OpenCode in a workspace on C: `opencode C:/Users/me/project` 2. Apply a patch targeting an absolute path on D: `*** Update File: D:/.toolbox/docs/uv-install.md` Observed: patch reports success but no file is created/updated under D:, or paths are mis-interpreted. Expected: validation error indicating path outside workspace root. ## Expected behavior - Normalize each patch target path. - If target path resolves outside workspace root, abort before making changes. - Return a non-zero tool error status, e.g. `EOUTSIDE_ROOT`, with a clear message: "Path outside workspace root. Start OpenCode in that directory or use an allowed root." ## Nice-to-have (optional) - Configurable allowlist of additional roots (multi-root). - Or prompt for explicit approval when patch targets a path outside root. ## Related - Per-agent filesystem boundaries proposal: https://github.com/anomalyco/opencode/issues/5529 - Allow explicitly changing working directory: https://github.com/anomalyco/opencode/issues/2177 - Multi-directory workspace PR (closed): https://github.com/anomalyco/opencode/pull/2921
yindo added the windows label 2026-02-16 18:08:42 -05:00
yindo commented 2026-02-16 18:08:42 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 29, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #8313: Path traversal vulnerability via symlinks and cross-drive paths - directly addresses missing path validation in Filesystem.contains()
  • #7504: Agent able to read all filesystem outside project directory - comprehensive security audit including patch tool path validation failures
  • #11042: External directory permission does not work on Windows - cross-drive path validation issues on Windows
  • #10872: bash tool external_directory prompt skipped when realpath is missing - path resolution dependency on Windows
  • #10360: Windows apply_patch fails - path handling failures in apply_patch tool on Windows

Related enhancement proposals:

  • #5529: Per-agent filesystem boundaries (allow/deny paths)
  • #5395: Split external_directory permission into read vs write
  • #4991: More general external_directory permissions
  • #6318: Limit tool permissions to specific folders

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 29, 2026): This issue might be a duplicate of existing issues. Please check: - #8313: Path traversal vulnerability via symlinks and cross-drive paths - directly addresses missing path validation in Filesystem.contains() - #7504: Agent able to read all filesystem outside project directory - comprehensive security audit including patch tool path validation failures - #11042: External directory permission does not work on Windows - cross-drive path validation issues on Windows - #10872: bash tool external_directory prompt skipped when realpath is missing - path resolution dependency on Windows - #10360: Windows apply_patch fails - path handling failures in apply_patch tool on Windows Related enhancement proposals: - #5529: Per-agent filesystem boundaries (allow/deny paths) - #5395: Split external_directory permission into read vs write - #4991: More general external_directory permissions - #6318: Limit tool permissions to specific folders Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#7930
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?