Repository navigation
fix: bind OpenCode edit approvals to the workspace target - #17
Merged
erikleblansch merged 1 commit intoOct 15, 2026
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Normalize only an exactly bound single-edit target before passing it to the unchanged owner approval policy. The pinned OpenCode runtime uses worktree-relative permission patterns; for a non-Git workspace its worktree is the filesystem root, not the selected workspace.
The running tool input, absolute canonical metadata target and one accepted pattern must identify the same path within the selected workspace. Other tools, cancellation, replay protection, deadlines and execution authority are unchanged. This is lexical target normalization, not symlink or filesystem authorization.
Evidence
71 unique inert Node tests pass, including 43 new target/negative/replay/cancellation cases. The valid non-Git pattern regression fails on the preceding source and passes with this change. Independent read-only review completed.
Hosted source checks are pending. Previous actual run 38797816570 forwarded one edit permission which the fixture rejected, but did not retain its private payload: this fixes a source-proven contract mismatch, not a claimed reconstruction of that private request. A new actual model-backed trial remains required after source validation.