[ixjosemi]

Summary

Fixes #518. On OpenCode V2, unattended flow agent steps hang forever when the agent reads its own spilled tool output. Large tool results are written to $XDG_DATA_HOME/opencode/tool-output/, which is outside the workspace, so reading them hits the rendered external_directory: * -> ask. Because rules are last-match-wins, neither access nor an agent's own rules could allow it.

Changes

• Keep external_directory: * -> ask, and right after it, both globally and per agent, allow only <toolOutputDirectory>/*.
• Pass the directory through RuntimeConfigModel the same way scratch is passed, so the adapter hardcodes no container path:
  • web: WEB_XDG_DATA_HOME/opencode/tool-output, the same constant now used for the container's XDG_DATA_HOME;
  • desktop: getDesktopXdgDataHome()/opencode/tool-output, the same value that feeds the spawned runtime's XDG_DATA_HOME.
• Validate the directory like scratch: it must be absolute with no wildcards, and a filesystem root is rejected.
• Nothing extra is rendered when the field is absent. V1 is unaffected.

Trade-off to confirm

The tool-output folder is shared by every session and agent of the workspace (OpenCode keeps it for about 7 days). With this allow, an agent that has read/glob can read what another agent's tools returned without an approval prompt. The boundary is still the same user's workspace. OpenCode V1's own defaults allowed this directory, and there is no per-session folder to narrow the rule to. @Inakitajes, please confirm this is acceptable (also asked in #518).

Deployment note

The rendered V2 config changes, so every running V2 workspace reports config-status: pending (config) until it restarts. The fix applies on that restart.

Testing

• Adapter tests:
  • the allow follows the ask, globally and per agent, including with an agent's own external_directory rules and a tools allowlist;
  • sibling paths and secrets still ask;
  • Windows path normalization;
  • invalid and root values are rejected.
• Wiring tests: runtime artifacts, the runtime config hash, the desktop host and the desktop workspace dirs.
• pnpm test, pnpm lint and bash scripts/check-podman-images.sh pass on the final HEAD.
• Verified on a live deployment: the scheduled Magua daily-report flow previously hung on Approval required — external_directory: /home/workspace/.local/share/opencode/tool-output/*. With this fix it runs to completion.

🤖 Generated with Claude Code

[ixjosemi]

cc @albertoperdomo2