Permission glob patterns in agent .md files silently never match — docs show relative paths but runtime uses absolute paths #38351

Description

When defining permissions in a custom agent .md file, path patterns like "docs/specs/**"
silently never match. No error, no warning. The permission falls through to default
(ask/deny) as if the pattern doesn't exist.

This is because the runtime resolves files to absolute paths
(e.g. /home/user/project/docs/specs/api.md) before glob-matching,
but the docs and examples show project-relative patterns.

Plugins

No plugin

OpenCode version

1.18.3

Steps to reproduce

1. Create .opencode/agents/spec-writer.md:

name: spec-writer
model: anthropic/claude-sonnet-4-20250514
permission:
edit:
"*": deny
"docs/specs/**": allow

You are a spec writer. Only edit files under docs/specs/.

2. Run opencode, invoke spec-writer, ask it to edit docs/specs/api.md

3. Expected: edit is allowed
   (last matching pattern "docs/specs/**" should override "*": deny)

   Actual: edit is DENIED.
   The runtime tests patterns against the absolute path
   /home/user/project/docs/specs/api.md.

   • "*" → matches → deny
   • "docs/specs/**" → does NOT match (relative vs absolute)
     Last match is "*": deny. Agent cannot edit anything.

4. No warning is emitted. The allow rule is silently dead.

5. Change to "*/docs/specs/**": allow → works as intended:

   • "*" → matches → deny
   • "*/docs/specs/**" → matches → allow (last hit wins)
     Result: ALLOW

Screenshot and/or share link

No response

Operating System

Ubuntu 26.04 LTS

Terminal

Windows treminal