Skip to content

New permission system issues with wildcards and glob patterns #7029

Description

@shanepadgett

Description

Below is the frontmatter in one of my agents. You can see the intent here is to deny the ability to write to any file or edit any file outside of the specific folders and filetypes I've globbed. I already checked and found one issue in the code is likely that you are using minimatch for the pattern matching, but that main issue is if you set "*": deny the whole tool no longer works. Specific patterns should take precedence over wildcard denys.

---
name: sdd/plan
description: SDD planning and artifact authoring - specs, proposals, tasks, and plans
color: "#BFB8AD"
permission:
  edit:
    "changes/**/*.md": allow
    "*": deny
  write:
    "changes/**/*.md": allow
    "*": deny
---

Plugins

No response

OpenCode version

1.1.3

Steps to reproduce

Use the agent and see that it cannot write file to such a folder.

Screenshot and/or share link

No response

Operating System

macOS 26.1

Terminal

Ghostty

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions