Symlink inside the project bypasses external_directory, and the permission prompt shows the wrong path

[0xSemizzz]

Description

The project containment check is pure path arithmetic and does not resolve symlinks, but the file read or write that follows does. A symlink inside the project pointing somewhere outside it passes the check, so external_directory never fires and the operation lands outside the project.

The prompt you do get is also misleading rather than just absent. read and edit show the path relative to the worktree, so you see the in-project link path while a different file is being opened.

Windows does not have this, because it already resolves the path at this point. It is POSIX only.

Plugins

None

OpenCode version

1.18.11

Steps to reproduce

1. mkdir -p /tmp/outside && echo secret > /tmp/outside/notes.txt
2. In your project root: ln -s /tmp/outside vendor
3. Ask the agent to read vendor/notes.txt
4. No external_directory prompt appears, and the file contents are returned.
5. The read prompt shows vendor/notes.txt, not /tmp/outside/notes.txt
6. Same with a write. Ask it to write to vendor/new.txt and the file appears in /tmp/outside/

Screenshot and/or share link

No response

Operating System

Ubuntu 26.04

Terminal

GNOME Terminal (Ubuntu default)

[github-actions]

This issue might be a duplicate of or closely related to existing issues. Please check:

• [FEATURE]: allow external symlink targets via external_directory consent #30788: This feature request describes the exact same symlink escape scenario and proposes the fix (triggering external_directory for in-project symlinks pointing outside the project). Your bug report documents the current vulnerable behavior that [FEATURE]: allow external symlink targets via external_directory consent #30788 wants addressed — they may be resolved together.

If you believe this is a distinct report worth tracking separately, please let a maintainer know.