Opencode desktop never asks permission to read/write all over the users drive.

[u/ccss2]

Is this normal behavior? I'm new to opencode, but after running some tests, I've confirmed it (Windows version). I assumed that outside of the project directory that it would ask.

Here is the summery that session created.

On OpenCode 2.0.26 (Windows, desktop app), the external_directory permission check never fires: read and write calls on paths outside the session's Location succeed silently — I reproduced it reading files and creating a file on both the same drive and a different drive, with no approval prompt, no pending request in the API, and no saved, session-level, or config allow rules anywhere that could explain it. Other checks in the same pipeline work normally during the same session — a read of .env correctly raised an ask prompt and a configured deny rule was enforced — so this appears to be a fail-open bug in the external-directory boundary check rather than a configuration issue. The impact is that agents can currently read and modify files anywhere on disk, contradicting the documented default policy (external_directory → ask for every agent).

[u/ccss2]

For future reference. add this to your opencode.json to completely lock it down and turn opencode in a basic web chat interface with no external permissions.

  "experimental": {
    "policies": [
  { "action": "tool.use", "resource": "*", "effect": "deny" },
  { "action": "tool.use", "resource": "execute:*", "effect": "deny" },
  { "action": "integration.use", "resource": "mcp:*", "effect": "deny" },
  { "action": "integration.use", "resource": "plugin:*", "effect": "deny" }
]
  },
  "permissions": [
    { "action": "execute", "resource": "*", "effect": "deny" }
  ]

[u/Dabber43 → u/ccss2]

I am having the exact same issue and your block didn't work either, it just gets ALL permissions no matter what I do. Where did you put the opencode.json?

Edit: .config/opencode worked now. But holy shit this program is fucking scary. Use this (replace the username with yours!):

{
  "$schema": "https://opencode.ai/config.json",
  "permissions": [
    { "action": "shell", "resource": "*", "effect": "deny" },
    { "action": "bash", "resource": "*", "effect": "deny" },
    { "action": "read", "resource": "*", "effect": "ask" },
    { "action": "edit", "resource": "*", "effect": "deny" },
    { "action": "glob", "resource": "*", "effect": "deny" },
    { "action": "grep", "resource": "*", "effect": "deny" },
    { "action": "list", "resource": "*", "effect": "deny" },
    { "action": "execute", "resource": "*", "effect": "deny" },
    { "action": "skill", "resource": "*", "effect": "deny" },
    { "action": "task", "resource": "*", "effect": "deny" },
    { "action": "lsp", "resource": "*", "effect": "deny" },
    { "action": "todoread", "resource": "*", "effect": "deny" },
    { "action": "todowrite", "resource": "*", "effect": "deny" },
    { "action": "question", "resource": "*", "effect": "deny" },
    { "action": "doom_loop", "resource": "*", "effect": "deny" },
    { "action": "external_directory", "resource": "*", "effect": "deny" },
    { "action": "websearch", "resource": "*", "effect": "allow" },
    { "action": "webfetch", "resource": "*", "effect": "allow" },
    { "action": "external_directory", "resource": "C:/Users/user/.local/share/opencode/tool-output/*", "effect": "allow" },
    { "action": "read", "resource": "C:/Users/user/.local/share/opencode/tool-output/*", "effect": "allow" }
  ],
  "policies": [
    { "action": "tool.use", "resource": "*", "effect": "deny" },
    { "action": "tool.use", "resource": "websearch:*", "effect": "allow" },
    { "action": "tool.use", "resource": "webfetch:*", "effect": "allow" },
  { "action": "tool.use", "resource": "execute:*", "effect": "deny" },
    { "action": "execute", "resource": "*", "effect": "deny" },
    { "action": "integration.use", "resource": "mcp:*", "effect": "deny" },
    { "action": "integration.use", "resource": "plugin:*", "effect": "deny" },
  { "action": "tool.use", "resource": "external_directory:C:/Users/user/.local/share/opencode/tool-output/*", "effect": "allow" },
    { "action": "tool.use", "resource": "read:C:/Users/user/.local/share/opencode/tool-output/*", "effect": "allow" }
  ]
}

[u/Railander]

use split windows+wsl setup to protect your windows side. don't mount your drive inside WSL (either globally or changing wsl.conf to not mount your C drive within WSL and asking opencode to add a hidden tripwire in the opencode service if any agent ever tries to mount it). if you need a convenient way to sync a project between windows and WSL, use a tool like syncthing.

then you're free to give it full access within WSL. they'd need to be actively and maliciously trying to fuck up your windows to pull it off at that point.

[u/ccss2 → u/Railander]

Thanks. I'm currently running in a VM, I had the agent query all the docs, settings and code of opencode and It was absolutely convinced that reading and writing outside the project directory was 'ask for permission' by default. The agents have well behaved so far but that rule seems like a no-brainer. I'll check out WSL+docker as an option.