fix: scope always-allow permissions to parent directory

Most file-access tools (read, write, edit, lsp) use always: [""] in their ctx.ask() call, meaning clicking "always allow" on any single file saves a wildcard that permits ALL future file operations under that permission key. This is inconsistent with the external_directory check which correctly scopes always to [parentDir + "/"].

Scope each tools always pattern to the parent directory of the target file, matching external_directory behavior.

This issue doesn't fully meet our contributing guidelines.

What needs to be fixed:

No issue template was used. Bug reports must use the Bug Report template, which requires a Description field with real content, steps to reproduce, system information (OS, terminal, OpenCode version), and other relevant context.
The title uses a commit-style prefix (fix:) rather than describing the issue as a user-facing problem.

Please edit this issue to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

This issue has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new issue that follows our issue templates.

Navigation Menu

Repository navigation

fix: scope always-allow permissions to parent directory #37283

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

fix: scope always-allow permissions to parent directory #37283

Description

Activity

github-actions commented on Jul 16, 2026

github-actions commented on Jul 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions