#27601 — external_directory NOT resolving symlinked directory

[ElioNeto]

Description

If I have the following in my configuration:

    "external_directory": {
      "*": "ask",
      "/tmp/**": "allow",
      "~/ide/**": "allow"
    }

Will ~/ide/ be resolved as an absolute path?

Because I have
~/ide -> /mnt/c/Users/tomak/IdeaProjects/

$ pwd -P                                                                                                                                                                                                                                                              
/mnt/d/tomak/IdeaProjects

Since, in Windows, this path is moved to another drive using a junction.

As while executing opencode it keeps me asking about permissions

Permission required
←
Access external directory /mnt/d/tomak/IdeaProjects/eurowag/azure/CMS/cms
Patterns
- /mnt/d/tomak/IdeaProjects/eurowag/azure/CMS/cms/*

Plugins

"@tarquinen/opencode-dcp@latest",     "opencode-claude-auth@latest",     "opencode-gemini-auth@latest"

OpenCode version

1.14.48

Steps to reproduce

1. Configured based on description
2. In windows C:\Users\tomak IdeaProjects [D:\tomak\IdeaProjects]
3. In WSL 2 symlink ~/ide -> /mnt/c/Users/tomak/IdeaProjects/
4. Run opencode in that symlinked directory
5. Keeps asking about permissions as it resolves absolute path of files

Screenshot and/or share link

No response

Operating System

Windows 11 + WSL 2

Terminal

No response

[ElioNeto]

Skipping — requires investigation of the external_directory permission tool and how symlinks are resolved. Needs manual triage on a system with symlinked directories.

[ElioNeto]

Resolved via commit c3b22de. The expand() function in the permission system now resolves Unix symlinks after expanding ~ and $HOME in permission patterns.

What changed: When you configure "external_directory": { "~/ide/**": "allow" } and ~/ide is a symlink to a different filesystem location (e.g., /mnt/data/projects/), the pattern now gets resolved to the symlink target path (/mnt/data/projects/**) so that file accesses under the real directory are correctly matched.

Limitation for WSL/Windows junctions: If you're accessing files via a DIFFERENT path than the symlink target (e.g., /mnt/c/... via junction vs /mnt/d/... directly), the paths are different strings and symlink resolution won't bridge them. In that case, configure the pattern using the actual path you access, or add both paths as separate patterns:

"external_directory": {
  "~/ide/**": "allow",
  "/mnt/d/tomak/IdeaProjects/**": "allow"
}