How do you configure opencode to always be allowed to read all files in a certain directory

[todor-a]

Question

I have the following project structure:

- projects
  - personal
    - foo
    - bar
    - baz

I run opencode from personal/bar and ask it to reference something in personal/foo.

My config at ~/.config/opencode/opencode.json is:

{
  "$schema": "https://opencode.ai/config.json",
  "theme": "opencode",
  "autoupdate": true,
  "permission": {
  "read": {
    "~/projects/personal/**": "allow"
  }
}

And despite having the ~/projects/personal/** in there, I always get asked to confirm that it's okay to read files. What am I doing wrong?

P.S. When you select always allow when prompted, where is that stored?

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• opencode not respecting permissions #8832: opencode not respecting permissions - Users report that permission configurations in opencode.json are not being respected, requiring manual confirmation prompts despite explicit 'allow' rules

Feel free to ignore if this doesn't address your specific case.

[OpeOginni]

I am able to reproduce, currently looking into it

[OpeOginni]

@todor-a I did some digging, and it seems the right way to do this is to add this to your permission

{
  "$schema": "https://opencode.ai/config.json",
  "theme": "opencode",
  "autoupdate": true,
  "permission": {
    "external_directory": {
        "~/projects/personal/**": "allow"
    }
}

Once this is added it treats matches to the external_directory as part of the directory you are in, this means that after adding this, you dont need to even add permissions for read tools. And the model can read from directories bar and baz just like it can freely do in the current directory foo.

This also means as it can edit on the current dir foo it can also do things to those external directories bar and baz, so you might want to restrict other tools, but if you know you are just reading, there isnt much of an issue.

If you want to be very strict you can then do is to restrict other tools from interacting with the external_directory, for example you want to be able to read from it but not edit, you can go with this

{
  "$schema": "https://opencode.ai/config.json",
  "theme": "opencode",
  "autoupdate": true,
  "permission": {
    "external_directory": {
        "~/projects/personal/**": "allow"
    },
    "edit": {
        "~/projects/personal/**": "deny"
    },
}

Try this please and let me know how it works