feat: Add allow-read-config command for GSD external directory permission

CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.20.4] - 2026-03-05
+
+Overview: Added allow-read-config command to gsd-oc-tools.cjs for managing external_directory permissions. Introduced automated GSD config folder access configuration with comprehensive test coverage and workflow integration.
+
+### Added
+
+- allow-read-config.cjs command for adding external_directory permission to read GSD config folder in `gsd-opencode/get-shit-done/bin/gsd-oc-commands/allow-read-config.cjs`
+- Comprehensive test suite for allow-read-config command with 5 tests covering permission creation, idempotency, dry-run mode, backup creation, and verbose output in `gsd-opencode/get-shit-done/bin/test/allow-read-config.test.cjs`
+- GSD config read permission step in oc-set-profile.md workflow to ensure access to `~/.config/opencode/get-shit-done/` in `gsd-opencode/get-shit-done/workflows/oc-set-profile.md`
+
+### Changed
+
+- Updated gsd-oc-tools.cjs help text and command routing to include allow-read-config command in `gsd-opencode/get-shit-done/bin/gsd-oc-tools.cjs`
+- Updated opencode.json with external_directory permission for `/Users/roki/.config/opencode/get-shit-done/**` in `opencode.json`
+
 ## [1.20.3] - 2026-03-03
 
 Overview: Major CLI tools release introducing gsd-oc-tools.cjs with comprehensive profile management, validation commands, and atomic transaction support. Added separate oc_config.json for profile configuration, pre-flight model validation, and vitest testing infrastructure.

gsd-opencode/get-shit-done/bin/gsd-oc-commands/allow-read-config.cjs

@@ -0,0 +1,235 @@
+/**
+ * allow-read-config.cjs — Add external_directory permission to read GSD config folder
+ *
+ * Creates or updates local opencode.json with permission to access:
+ * ~/.config/opencode/get-shit-done/
+ *
+ * This allows gsd-opencode commands to read workflow files, templates, and
+ * configuration from the global GSD installation directory.
+ *
+ * Usage:
+ *   node allow-read-config.cjs                    # Add read permission
+ *   node allow-read-config.cjs --dry-run          # Preview changes
+ *   node allow-read-config.cjs --verbose          # Verbose output
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { output, error, createBackup } = require('../gsd-oc-lib/oc-core.cjs');
+
+/**
+ * Error codes for allow-read-config operations
+ */
+const ERROR_CODES = {
+  WRITE_FAILED: 'WRITE_FAILED',
+  APPLY_FAILED: 'APPLY_FAILED',
+  ROLLBACK_FAILED: 'ROLLBACK_FAILED',
+  INVALID_ARGS: 'INVALID_ARGS'
+};
+
+/**
+ * Get the GSD config directory path
+ * Uses environment variable if set, otherwise defaults to ~/.config/opencode/get-shit-done
+ *
+ * @returns {string} GSD config directory path
+ */
+function getGsdConfigDir() {
+  const envDir = process.env.OPENCODE_CONFIG_DIR;
+  if (envDir) {
+    return envDir;
+  }
+
+  const homeDir = os.homedir();
+  return path.join(homeDir, '.config', 'opencode', 'get-shit-done');
+}
+
+/**
+ * Build the external_directory permission pattern
+ *
+ * @param {string} gsdDir - GSD config directory
+ * @returns {string} Permission pattern with wildcard
+ */
+function buildPermissionPattern(gsdDir) {
+  // Use ** for recursive matching (all subdirectories and files)
+  return `${gsdDir}/**`;
+}
+
+/**
+ * Check if permission already exists in opencode.json
+ *
+ * @param {Object} opencodeData - Parsed opencode.json content
+ * @param {string} pattern - Permission pattern to check
+ * @returns {boolean} True if permission exists
+ */
+function permissionExists(opencodeData, pattern) {
+  const permissions = opencodeData.permission;
+
+  if (!permissions) {
+    return false;
+  }
+
+  const externalDirPerms = permissions.external_directory;
+  if (!externalDirPerms || typeof externalDirPerms !== 'object') {
+    return false;
+  }
+
+  // Check if the pattern exists and is set to "allow"
+  return externalDirPerms[pattern] === 'allow';
+}
+
+/**
+ * Main command function
+ *
+ * @param {string} cwd - Current working directory
+ * @param {string[]} args - Command line arguments
+ */
+function allowReadConfig(cwd, args) {
+  const verbose = args.includes('--verbose');
+  const dryRun = args.includes('--dry-run');
+  const raw = args.includes('--raw');
+
+  const log = verbose ? (...args) => console.error('[allow-read-config]', ...args) : () => {};
+
+  const opencodePath = path.join(cwd, 'opencode.json');
+  const backupsDir = path.join(cwd, '.planning', 'backups');
+  const gsdConfigDir = getGsdConfigDir();
+  const permissionPattern = buildPermissionPattern(gsdConfigDir);
+
+  log('Starting allow-read-config command');
+  log(`GSD config directory: ${gsdConfigDir}`);
+  log(`Permission pattern: ${permissionPattern}`);
+
+  // Check for invalid arguments
+  const validFlags = ['--verbose', '--dry-run', '--raw'];
+  const invalidArgs = args.filter(arg => 
+    arg.startsWith('--') && !validFlags.includes(arg)
+  );
+
+  if (invalidArgs.length > 0) {
+    error(`Unknown arguments: ${invalidArgs.join(', ')}`, 'INVALID_ARGS');
+  }
+
+  // Load or create opencode.json
+  let opencodeData;
+  let fileExisted = false;
+
+  if (fs.existsSync(opencodePath)) {
+    try {
+      const content = fs.readFileSync(opencodePath, 'utf8');
+      opencodeData = JSON.parse(content);
+      fileExisted = true;
+      log('Loaded existing opencode.json');
+    } catch (err) {
+      error(`Failed to parse opencode.json: ${err.message}`, 'INVALID_JSON');
+    }
+  } else {
+    // Create initial opencode.json structure
+    opencodeData = {
+      "$schema": "https://opencode.ai/config.json"
+    };
+    log('Creating new opencode.json');
+  }
+
+  // Check if permission already exists
+  const exists = permissionExists(opencodeData, permissionPattern);
+
+  if (exists) {
+    log('Permission already exists');
+    output({
+      success: true,
+      data: {
+        dryRun: dryRun,
+        action: 'permission_exists',
+        pattern: permissionPattern,
+        message: 'Permission already configured'
+      }
+    });
+    process.exit(0);
+  }
+
+  // Dry-run mode - preview changes
+  if (dryRun) {
+    log('Dry-run mode - no changes will be made');
+
+    const changes = [];
+    if (!fileExisted) {
+      changes.push('Create opencode.json');
+    }
+    changes.push(`Add external_directory permission: ${permissionPattern}`);
+
+    output({
+      success: true,
+      data: {
+        dryRun: true,
+        action: 'add_permission',
+        pattern: permissionPattern,
+        gsdConfigDir: gsdConfigDir,
+        changes: changes,
+        message: fileExisted ? 'Would update opencode.json' : 'Would create opencode.json'
+      }
+    });
+    process.exit(0);
+  }
+
+  // Create backup if file exists
+  let backupPath = null;
+  if (fileExisted) {
+    // Ensure backup directory exists
+    if (!fs.existsSync(backupsDir)) {
+      fs.mkdirSync(backupsDir, { recursive: true });
+    }
+
+    backupPath = createBackup(opencodePath, backupsDir);
+    log(`Backup created: ${backupPath}`);
+  }
+
+  // Initialize permission structure if needed
+  if (!opencodeData.permission) {
+    opencodeData.permission = {};
+  }
+
+  if (!opencodeData.permission.external_directory) {
+    opencodeData.permission.external_directory = {};
+  }
+
+  // Add the permission
+  opencodeData.permission.external_directory[permissionPattern] = 'allow';
+
+  log('Permission added to opencode.json');
+
+  // Write updated opencode.json
+  try {
+    fs.writeFileSync(opencodePath, JSON.stringify(opencodeData, null, 2) + '\n', 'utf8');
+    log('Updated opencode.json');
+  } catch (err) {
+    // Rollback if backup exists
+    if (backupPath) {
+      try {
+        fs.copyFileSync(backupPath, opencodePath);
+      } catch (rollbackErr) {
+        error(
+          `Failed to write opencode.json AND failed to rollback: ${rollbackErr.message}`,
+          'ROLLBACK_FAILED'
+        );
+      }
+    }
+    error(`Failed to write opencode.json: ${err.message}`, 'WRITE_FAILED');
+  }
+
+  output({
+    success: true,
+    data: {
+      action: 'add_permission',
+      pattern: permissionPattern,
+      gsdConfigDir: gsdConfigDir,
+      opencodePath: opencodePath,
+      backup: backupPath,
+      created: !fileExisted,
+      message: fileExisted ? 'opencode.json updated' : 'opencode.json created'
+    }
+  });
+  process.exit(0);
+}
+
+module.exports = allowReadConfig;

gsd-opencode/get-shit-done/bin/gsd-oc-tools.cjs

@@ -16,6 +16,7 @@
  *   validate-models         Validate model IDs against opencode catalog
  *   set-profile             Switch profile with interactive model selection
  *   get-profile             Get current profile or specific profile from oc_config.json
+ *   allow-read-config       Add external_directory permission to read GSD config folder
  *   help                    Show this help message
  */
 
@@ -50,12 +51,13 @@ Available Commands:
   validate-models         Validate one or more model IDs against opencode catalog
   set-profile             Switch profile with interactive model selection wizard
   get-profile             Get current profile or specific profile from oc_config.json
+  allow-read-config       Add external_directory permission to read ~/.config/opencode/get-shit-done/**
   help                    Show this help message
 
 Options:
   --verbose              Enable verbose output (stderr)
-  --raw                  Output raw values instead of JSON envelope
-  --dry-run              Preview changes without applying (update-opencode-json)
+  --raw                  Output raw value instead of JSON envelope
+  --dry-run              Preview changes without applying (update-opencode-json, allow-read-config)
 
 Examples:
   node gsd-oc-tools.cjs check-opencode-json
@@ -66,6 +68,8 @@ Examples:
   node gsd-oc-tools.cjs get-profile
   node gsd-oc-tools.cjs get-profile genius
   node gsd-oc-tools.cjs get-profile --raw
+  node gsd-oc-tools.cjs allow-read-config
+  node gsd-oc-tools.cjs allow-read-config --dry-run
 `.trim();
 
   console.log(helpText);
@@ -121,9 +125,11 @@ switch (command) {
     break;
   }
 
-
-
-
+  case 'allow-read-config': {
+    const allowReadConfig = require('./gsd-oc-commands/allow-read-config.cjs');
+    allowReadConfig(cwd, flags);
+    break;
+  }
 
   default:
     error(`Unknown command: ${command}\nRun 'node gsd-oc-tools.cjs help' for available commands.`);