[FEATURE]: Provide a default pre-approved temp directory for skills/tools writing outside the workspace #48100

Activity

1. github-actions

   assigned

   kitlangton

   on Sep 9, 2026
2. github-actions commented on Sep 9, 2026

   

   github-actionsBot

   on Sep 9, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue doesn't fully meet our contributing guidelines.

   What needs to be fixed:

   • Feature requests must use the feature request issue template, which requires a title prefixed with [FEATURE]: and includes a verification checkbox confirming you've searched for existing issues.

   Please edit this issue to address the above within 2 hours, or it will be automatically closed.

   ---

   This issue might be a duplicate of existing issues. Please check:

   • Allow writes to /tmp by default without permission prompt #5386: Allow writes to /tmp by default without permission prompt (closed, same core request)
   • Skills ignore global AGENTS.md rule to use ~/.opencode/tmp instead of /tmp #46815: Skills ignore global AGENTS.md rule to use ~/.opencode/tmp instead of /tmp (open, same friction with temp dir permissions)
   • agent env: /tmp/opencode advertised as writable scratch but owned by another user #44696: agent env: /tmp/opencode advertised as writable scratch but owned by another user (open, related temp dir permission issue)

   If you believe this was flagged incorrectly, please let a maintainer know.
3. github-actions

   added

   needs:complianceThis means the issue will auto-close after 2 hours.This means the issue will auto-close after 2 hours.

   on Sep 9, 2026
4. spartan-suale

   changed the title [-]Provide a default pre-approved temp directory for skills/tools writing outside the workspace[/-] [+][FEATURE]: Provide a default pre-approved temp directory for skills/tools writing outside the workspace[/+] on Sep 9, 2026
5. github-actions

   removed

   needs:complianceThis means the issue will auto-close after 2 hours.This means the issue will auto-close after 2 hours.

   on Sep 9, 2026
6. github-actions commented on Sep 9, 2026

   

   github-actionsBot

   on Sep 9, 2026 – with GitHub Actions

   Contributor

   More actions

   Thanks for updating the issue! It now follows the feature request template with the [FEATURE]: title prefix, verification checkbox, and a clear description of the problem and proposed solution. The label has been removed.
7. aanbrn commented on Sep 14, 2026

   

   aanbrn

   on Sep 14, 2026

   More actions

   Adding a few findings after checking the source — the gap turns out to be narrower than it looks, and one detail matters for anyone reaching for a config rule today.

   {env:VAR} does substitute inside permission patterns. Config substitution runs over the whole file, so "{env:TMPDIR}/opencode/**": "allow" is accepted and expands. Two catches:

   • On macOS TMPDIR ends with a separator (/var/folders/…/T/), so the pattern becomes …/T//opencode/** — a double slash that does not match the real …/T/opencode/… path (the matcher compares wildcards literally).
   • When TMPDIR is unset it substitutes to an empty string, so there is no fallback for a platform whose temp dir is /tmp.

   A small plugin avoids both, since os.tmpdir() returns the same directory without the trailing separator, and the config(cfg) hook runs once on init with the live merged config:

   import os from "os"
   
   export default async () => ({
     config: (cfg: { permission?: Record<string, unknown> }) => {
       const existing = (cfg.permission?.external_directory as Record<string, string>) ?? {}
       cfg.permission ??= {}
       cfg.permission.external_directory = { ...existing, [`${os.tmpdir()}/opencode/**`]: "allow" }
     },
   })

   That is what shipped in the project where we hit this; the effect is verifiable rather than assumed — ~/.local/share/opencode/log/opencode.log records each evaluation, and the injected rule shows as the matched action.pattern.

   So two small fixes would make the <tmpdir>/opencode path the issue names expressible without a plugin: a {env:VAR:-default} form for the unset case, and normalizing a trailing separator in the substitution for the macOS case. The remaining ask here (an out-of-the-box pre-approved temp dir, exposed portably) still stands on its own.
8. aanbrn

   added a commit that references this issue on Sep 14, 2026

   Record the upstream-report practice, and park the reference-report id…

   ...

   a99ae2b
9. opencodejr commented on Oct 28, 2026

   

   opencodejrBot

   on Oct 28, 2026

   Contributor

   More actions

   Thanks for the clear write-up, @spartan-suale!

   You're asking for a standard, documented temp location that skills and tools can find and write to without a permission prompt. Examples are an OPENCODE_TMPDIR environment variable, or making mktemp -d / $TMPDIR land in the pre-approved directory. That way portable skills don't need opencode-specific branches.

   Your reading of the current behaviour is right. The pre-approved directory is opencode's own tmp root, under the system temp directory. The only place it's surfaced is the instruction given to the model. Shell commands don't get it as an environment variable and TMPDIR doesn't point to it, so mktemp -d ends up outside it and triggers the external_directory prompt.

   In the meantime, you can allow the system temp directory yourself with an external_directory allow rule in your permission config. That only helps on your own machine, though, not for skills shared with others.

   I've marked this as a feature request for the maintainers to consider.