plan: plan-mode guard denies writes to configured plan directory (~/.opencode/plan) #50241

Summary

In Plan mode, the AI cannot write or edit files in the configured plan directory (~/.opencode/plan/) despite the plan agent's permissions explicitly allowing it. The guard incorrectly claims the target path is "outside the plan directory" when it's actually inside it.

Environment

• opencode version: 2.0.10
• OS: Linux 7.2.6-1-cachyos (linux x64)
• Terminal: xterm-256color, truecolor
• Shell: /usr/bin/bash
• Install/channel: latest
• Active plugins: None found in config

Reproduction

1. Start opencode in a workspace where ~/.opencode/plan/ exists (created automatically or manually)
2. Enter Plan mode (select the "Plan" agent)
3. Attempt to write a new file to ~/.opencode/plan/new-plan.md or edit an existing file in that directory
4. Observe the denial with error: "Cannot use write to modify files outside the Plan directory: /home/qasha/.opencode/plan"

Expected Behavior

The plan agent should be able to write/edit files in ~/.opencode/plan/ because:

• The agent's resolved permissions include {"action": "edit", "resource": "/home/qasha/.opencode/plan/*", "effect": "allow"}
• The agent's resolved permissions include {"action": "external_directory", "resource": "/home/qasha/.opencode/plan/*", "effect": "allow"}
• The plan mode reminder explicitly states: "You may optionally create or update plan documents in: /home/qasha/.opencode/plan"

Actual Behavior

The plan-mode guard rejects the write/edit with: "Cannot use write to modify files outside the Plan directory: /home/qasha/.opencode/plan" — naming the exact directory the target file resides in.

Additional Context

• The .opencode/plan directory exists at /home/qasha/.opencode/plan/ and contains existing plan files
• The plan agent's permissions (via opencode api get /api/agent) show explicit allow rules for /home/qasha/.opencode/plan/* for both edit and external_directory actions
• This matches the bug reported in plan: Plan-mode guard denies writes to the configured plan directory it names (still present on beta-18721, macOS arm64) #46358 (beta-18721) where the guard's path resolution fails to recognize the absolute plan directory path it advertises
• Workaround: Use the Build agent to write plan files, or use a project-relative path like aidocs/ which succeeds in the same session