A session directory containing .. loads project config from the un-normalized path: another directory's opencode.json (and its permissions) applies #55909

Activity

1. opencode-agent commented on Oct 16, 2026

   

   opencode-agentBot

   on Oct 16, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the clear report. I reproduced this on 2.0.22, and it still happens on the latest dev (7049e5a).

   Setup, in short:

   • <base>/src/opencode.json sets "*": "allow", and the global config sets "*": "ask".
   • A mock OpenAI-compatible model always asks for one shell call, touch marker.txt.
   • Two sessions are created through POST /api/session, one with <base>/proj and one with <base>/src/../proj, and each is sent a prompt.

   Result:

   • <base>/proj: one pending shell permission request, and marker.txt is not created.
   • <base>/src/../proj: no permission request, and the tool runs and creates marker.txt.

   So the sibling directory's opencode.json permissions apply when the path isn't normalized. A likely cause (not yet confirmed) is that the session location directory is only normalized on Windows. On Linux and macOS it is kept exactly as given. I didn't test the reversed deny case, but it is likely the same cause.

   The script below reproduces it with opencode from PATH, or with a source checkout if you set OC_DEV.

   Reproduction script (repro.sh)

   #!/usr/bin/env bash
   # Repro for #55909: session location.directory containing ".." picks up a sibling's opencode.json permissions.
   # Usage: ./repro.sh                 (uses `opencode` from PATH)
   #        OC_DEV=/workspace/repo ./repro.sh   (runs CLI from source checkout)
   set -u
   BASE=$(mktemp -d /tmp/opencode/oc55909.XXXX)
   mkdir -p "$BASE/proj" "$BASE/src" "$BASE/xdg/opencode" "$BASE/data" "$BASE/state" "$BASE/cache"
   echo '{"permission":{"*":"allow"}}' > "$BASE/src/opencode.json"
   MOCK_PORT=$((20000 + RANDOM % 10000)); PORT=$((30000 + RANDOM % 10000))
   
   # Mock OpenAI-compatible server: first turn -> one shell tool call `touch marker.txt`; after a tool result -> text.
   cat > "$BASE/mock.ts" <<'EOF'
   const port = Number(process.env.MOCK_PORT)
   Bun.serve({ port, hostname: "127.0.0.1", async fetch(req) {
     const u = new URL(req.url)
     if (u.pathname.endsWith("/models")) return Response.json({ data: [{ id: "m", object: "model" }] })
     const body: any = await req.json().catch(() => ({}))
     const msgs = body.messages ?? []
     const hasTool = msgs.some((m: any) => m.role === "tool")
     const tools = (body.tools ?? []).map((t: any) => t.function?.name)
     const name = tools.includes("shell") ? "shell" : tools.includes("bash") ? "bash" : tools[0]
     const id = "c" + Date.now()
     const chunks: any[] = hasTool
       ? [{ choices: [{ index: 0, delta: { role: "assistant", content: "done" } }] }, { choices: [{ index: 0, delta: {}, finish_reason: "stop" }] }]
       : [{ choices: [{ index: 0, delta: { role: "assistant", tool_calls: [{ index: 0, id: "call_1", type: "function", function: { name, arguments: JSON.stringify({ command: "touch marker.txt", description: "touch" }) } }] } }] },
          { choices: [{ index: 0, delta: {}, finish_reason: "tool_calls" }] }]
     const s = chunks.map((c) => `data: ${JSON.stringify({ id, object: "chat.completion.chunk", created: 0, model: "m", ...c })}\n\n`).join("") + "data: [DONE]\n\n"
     return new Response(s, { headers: { "content-type": "text/event-stream" } })
   } })
   EOF
   MOCK_PORT=$MOCK_PORT bun "$BASE/mock.ts" & MOCK=$!
   
   cat > "$BASE/xdg/opencode/opencode.json" <<EOF
   { "permission": {"*": "ask"},
     "model": "mock/m",
     "provider": { "mock": { "npm": "@ai-sdk/openai-compatible", "name": "mock",
       "options": { "baseURL": "http://127.0.0.1:$MOCK_PORT/v1", "apiKey": "x" },
       "models": { "m": { "name": "m", "tool_call": true } } } } }
   EOF
   
   export XDG_CONFIG_HOME=$BASE/xdg XDG_DATA_HOME=$BASE/data XDG_STATE_HOME=$BASE/state XDG_CACHE_HOME=$BASE/cache
   export OPENCODE_PASSWORD=pw$RANDOM
   if [ -n "${OC_DEV:-}" ]; then
     OC=(bun --conditions=browser --preload=$OC_DEV/packages/tui/node_modules/@opentui/solid/scripts/preload.js $OC_DEV/packages/cli/src/index.ts)
   else OC=(opencode); fi
   (cd "$BASE" && "${OC[@]}" serve --hostname 127.0.0.1 --port $PORT > "$BASE/serve.log" 2>&1) & SRV=$!
   AUTH="opencode:$OPENCODE_PASSWORD"
   for i in $(seq 1 60); do curl -s -u "$AUTH" -o /dev/null "http://127.0.0.1:$PORT/api/session" && break; sleep 1; done
   
   run() { # $1 = directory
     rm -f "$BASE/proj/marker.txt"
     local sid=$(curl -s -u "$AUTH" -H 'content-type: application/json' -X POST "http://127.0.0.1:$PORT/api/session" \
       -d "{\"location\":{\"directory\":\"$1\"}}" | bun -e 'const j=JSON.parse(await Bun.stdin.text());console.log(j.id??j.data?.id??JSON.stringify(j))')
     curl -s -u "$AUTH" -H 'content-type: application/json' -X POST "http://127.0.0.1:$PORT/api/session/$sid/prompt" -d '{"text":"go"}' > /dev/null
     sleep 8
     local perms=$(curl -s -u "$AUTH" "http://127.0.0.1:$PORT/api/session/$sid/permission")
     echo "dir=$1"
     echo "  session=$sid"
     echo "  pending permissions: $perms" | cut -c1-300
     [ -f "$BASE/proj/marker.txt" ] && echo "  marker.txt: CREATED (tool ran without asking)" || echo "  marker.txt: absent"
   }
   "${OC[@]}" --version
   run "$BASE/proj"
   run "$BASE/src/../proj"
   kill $SRV $MOCK 2>/dev/null; wait 2>/dev/null
   echo "logs: $BASE/serve.log"

   Run it: bash repro.sh
2. opencode-agent

   added

   reproduced

   severity:high

   on Oct 16, 2026
3. Finn763 commented on Oct 16, 2026

   

   Finn763

   on Oct 16, 2026

   Contributor

   More actions

   Taking this one. The location directory should be normalized once at the boundary where project/config discovery walks it (the bot notes only Windows normalizes today, so Linux/macOS keep .. verbatim) — I'll normalize there and pin it with a test that a .. session directory resolves the canonical project's config/permissions.

   ❤️React with ❤️1Reacted by Askar Amirov
4. rekram1-node

   closed this as completedin #59327on Oct 26, 2026