Permissions

Permissions — portable security policy

Generic, reusable reference for an OpenCode opencode.jsonc permissions array. Replace <user> with the actual username.

For OpenCode permission semantics (rule shape, wildcards, last-match-wins, external_directory vs read/edit, shell resource handling), load the built-in opencode skill — do not duplicate it here.

1. Policy template (categories)

Generic template — copy from references/permissions.jsonc and substitute <user>:

1a. Cross-platform username isolation

macOS uses /Users/*, Linux /home/*, Windows C:/Users/* (and other drive letters). All use forward slashes — OpenCode normalizes them and matches case-insensitive on Windows. Keep the same deny-then-allow pattern per platform:

// Linux (uncomment when porting)
// { "action": "read", "resource": "/home/*", "effect": "deny" },
// { "action": "edit", "resource": "/home/*", "effect": "deny" },
// { "action": "external_directory", "resource": "/home/*", "effect": "deny" },
// { "action": "shell", "resource": "*/home/*", "effect": "deny" },
// { "action": "read", "resource": "/home/<user>", "effect": "allow" },
// { "action": "read", "resource": "/home/<user>/*", "effect": "allow" },
// ... same for edit/external_directory + shell "*/home/<user>*"

// Windows (uncomment when porting — forward slashes, covers C: and D:)
 // { "action": "read", "resource": "C:/Users/*", "effect": "deny" },
 // { "action": "read", "resource": "D:/Users/*", "effect": "deny" },
 // { "action": "shell", "resource": "*C:/Users/*", "effect": "deny" },
 // ... then allow C:/Users/<user> + D:/Users/<user>

See references/permissions.jsonc §§2b/2c (username) and §§5a/5b (private data).

1b. Cross-platform shell history

Add once:

{ "action": "read", "resource": "~/.local/share/history/*", "effect": "deny" }, // cross-platform shells
{ "action": "read", "resource": "~/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine/*", "effect": "deny" },
{ "action": "read", "resource": "~/.cache/*", "effect": "ask" } // optional: be cautious

2. Apply / update

# edit global config
code ~/.config/opencode/opencode.jsonc
# copy ordered block from references/permissions.jsonc into "permissions": [ ... ]
# trigger daemon reload (watches global dir):
touch ~/.config/opencode/opencode.jsonc
opencode2 service status
opencode2 api get /api/health

Validation after change:

node -e "const fs=require('fs');let t=fs.readFileSync(process.env.HOME+'/.config/opencode/opencode.jsonc','utf8');let o='',s=false,e=false;for(let i=0;i<t.length;){let c=t[i];if(s){o+=c;if(e)e=false;else if(c=='')e=true;else if(c=='\"')s=false;i++}else{if(c=='\"'){s=true;o+=c;i++}else if(c=='/'&&t[i+1]=='/'){while(i<t.length&&t[i]!='\n')i++}else if(c=='/'&&t[i+1]=='*'){i+=2;while(i<t.length&&!(t[i]=='*'&&t[i+1]=='/'))i++;i+=2}else{o+=c;i++}}} JSON.parse(o.replace(/,\s*([}\]])/g,'$1'));console.log('JSONC OK')"
# then test: substitute <user> with actual name first

• read /Users/<user>/dev/... → allow
• read /Users/<other>/... → deny (external_directory)
• shell cat /Users/<user>/... → allow, cat /Users/<other>/... → deny

3. New machine / port

• Substitute <user> in blocks 2/2b/2c with the real username (e.g. via sed -i '' 's/<user>/myname/g' references/permissions.jsonc before copying).
• Adjust block 9 if the external volume path differs (/Volumes/Daten/dev), block 10 if Homebrew prefix differs (/opt/homebrew vs /usr/local vs C:/Program Files).
• Do not move block 2 after block 3 — secrets must stay after the username allow so they override it.

Reference files

• references/permissions.jsonc — copy-paste ready ordered permissions array (10 active blocks + commented cross-platform §§2b/2c/5a/5b).