glob tool ignores deny rules for matched file paths #35684

Description

glob permission rules can allow a broad query pattern while still denying specific matched file paths, but the tool currently only checks the query pattern before executing.

For example, with:

{
  "permission": {
    "glob": {
      "**": "allow",
      "**/secret.txt": "deny"
    }
  }
}

a glob call with pattern: "**/*.txt" can still return src/secret.txt, because the permission check sees only the query pattern (**/*.txt) and never evaluates the matched file path.

Expected behavior: before returning glob results, path-scoped glob deny rules should be enforced against the matched worktree-relative file paths.

Plugins

None

OpenCode version

Current dev branch

Steps to reproduce

1. Configure glob permission rules with a broad allow and a more specific denied path, such as "**/secret.txt": "deny".
2. Create src/secret.txt.
3. Run the glob tool with a broad pattern such as "**/*.txt".
4. The denied file can be returned because only the query pattern is checked.

Screenshot and/or share link

No response

Operating System

macOS

Terminal

No response