OpenCode bug: default external_directory 'ask' policy silently allows out-of-worktree writes
Gameman2012 · ghdev · 2026-10-11
Issue #54524 in anomalyco/opencode (v2.0.25, Linux) reports a permissions flaw: with pure default config (no permissions key), writes to paths outside the session location/worktree (e.g. /tmp from a /Desktop session) complete silently — no permission dialog appears, even though the built-in base policy resolves externaldirectory to ask.
- Adding an equivalent explicit global rule (externaldirectory -> ask) makes the TUI prompt correctly with Allow once / Always allow / Reject
- deny rules are enforced properly, confirming rule loading and enforcement work; only the built-in default ask fails to surface the dialog
- Per the V2 permissions docs, out-of-worktree paths should require externaldirectory approval
Security-relevant for coding agents: the default 'ask' guarantee isn't actually enforced, letting agents write outside project boundaries under default configs.
More from coding & agent
- Claude Code Pushes Urgent Security Update Across All Installations — umeshonai · 2026-10-23
- Claude cut a 2.6-hour video export to 20 minutes — but only after being told to rebuild the server — byhewar · 2026-10-23
- 3 flight-booking rules my AI agent checks that I'd never do by hand — Efistoffeles · 2026-10-23
- OpenJet claims Qwen3.8-27B coding runs 1.9x faster than llama.cpp on one RTX 3090 — JeremyCMorgan · 2026-10-23
- Building an autonomous SEO agent in Hermes with three skills: programmatic pages, Keywords Everywhere, DataForSEO — EXM7777 · 2026-10-23
- Building a sports betting AI agent with onchain execution and human approval by default: architecture and lessons — Dry-Comfortable-2678 · 2026-10-23