permissions: external_directory check misses directory flags (git -C, make -C, npm --prefix, …) #59564

Activity

1. opencode-agent commented on Oct 27, 2026

   

   opencode-agentBot

   on Oct 27, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the detailed report. I can reproduce this on 2.1.4, and it still happens on the latest dev (8697644).

   I used your config (shell allowed for *, external_directory denied for *) and a simulated model that makes three shell calls against a git repo outside the project:

   1. cd <outside> && git log --oneline → Permission denied: external_directory (as expected)
   2. git -C <outside> log --oneline → runs without a prompt and prints the outside repo's commit
   3. make -C <outside> → runs the outside Makefile without a prompt

   The recording and screenshots below show this, and the script below reproduces it. As you found, the shell scanner only reports directories for cd/pushd-style commands, so directories passed as flags never reach the external_directory check.

   Related: #56288 (file-path arguments and redirects in shell also skip external_directory) and its open PR #56390.

   recording.mp4

   

   

   Reproduction script (drive.ts)

   // Repro for anomalyco/opencode#59564: external_directory deny blocks `cd /outside && git ...`
   // but not `git -C /outside ...` / `make -C /outside ...`.
   import { Effect, Stream } from "effect"
   import { execSync } from "node:child_process"
   import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs"
   import { tmpdir } from "node:os"
   import { join } from "node:path"
   import { Llm, OpenCodeDriver } from "opencode-drive"
   
   // A git repo outside the project, with a recognisable commit message and a Makefile.
   const outside = mkdtempSync(join(tmpdir(), "outside-"))
   mkdirSync(outside, { recursive: true })
   writeFileSync(join(outside, "Makefile"), "all:\n\t@echo MAKE-RAN-IN-OUTSIDE\n")
   execSync(`git init -q && git -c user.email=a@b -c user.name=x commit -q --allow-empty -m SECRET-OUTSIDE-COMMIT`, { cwd: outside })
   
   export default OpenCodeDriver.use(
     {
       ...(process.env.OC_DEV ? { opencode: { dev: process.env.OC_DEV } } : {}),
       tui: { recording: true },
       project: { git: true, files: { "README.md": "project\n" } },
       config: {
         permissions: [
           { action: "shell", resource: "*", effect: "allow" },
           { action: "external_directory", resource: "*", effect: "deny" },
         ],
       } as any,
     },
     ({ ui, llm }) =>
       Effect.gen(function* () {
         const steps: Record<string, { command: string; done: string }> = {
           "STEP1 run git log in the outside dir via cd": { command: `cd ${outside} && git log --oneline`, done: "STEP1-DONE" },
           "STEP2 run git log in the outside dir via git -C": { command: `git -C ${outside} log --oneline`, done: "STEP2-DONE" },
           "STEP3 run make in the outside dir via make -C": { command: `make -C ${outside}`, done: "STEP3-DONE" },
         }
         let current = ""
         // Simulated model: title requests get a title; a user prompt gets the shell call; a tool result ends the turn.
         yield* llm.serve((request: any) => {
           const messages = request.body?.messages ?? []
           if (String(messages[0]?.content ?? "").startsWith("You name conversations")) return Stream.make(Llm.text("Title"))
           const last = messages[messages.length - 1]
           if (last?.role === "tool") return Stream.make(Llm.text(steps[current].done))
           const step = Object.keys(steps).find((k) => JSON.stringify(last?.content ?? "").includes(k))!
           current = step
           return Stream.make(
             Llm.toolCall({ index: 0, id: `call_${step.slice(0, 5)}`, name: "shell", input: { command: steps[step].command } }),
             Llm.finish("tool-calls"),
           )
         })
         let n = 0
         for (const [prompt, step] of Object.entries(steps)) {
           n++
           yield* ui.submit(prompt)
           yield* ui.waitFor(step.done, { timeout: 8000 }).pipe(Effect.catchTag("UiWaitTimeoutError", () => Effect.void))
           yield* Effect.sleep(1500)
           yield* ui.screenshot(`step-${n}`)
         }
       }),
   )

   Run it with opencode-drive: opencode-drive run ./drive.ts. It drives opencode from your PATH; set OC_DEV to the path of an OpenCode checkout to run that from source instead.
2. opencode-agent

   added

   reproduced

   on Oct 27, 2026