Split external_directory permission into read vs write

[charles-cooper]

Currently, external_directory is a single permission that controls all file operations (read, write, edit, patch, bash workdir) outside the working directory. This makes it impossible to allow reading external files while blocking writes.

Use case

I want the agent to be able to read reference files, configs, or documentation outside the project directory without prompts, but still block (or prompt for) any writes to external locations. Currently I must choose between:

• "allow" - permits both reads and writes (too permissive)
• "ask" - prompts for every read (too noisy)
• "deny" - blocks all external access (too restrictive)

Proposed solution

Split into two permissions:

{
  "permission": {
    "external_directory_read": "allow",
    "external_directory_write": "ask"
  }
}

Or alternatively, add a mode qualifier:

{
  "permission": {
    "external_directory": {
      "read": "allow",
      "write": "ask"
    }
  }
}

Implementation notes

Looking at the source, this would require:

1. Update config schema in config/config.ts and agent/agent.ts
2. Modify permission checks in tool/read.ts, tool/write.ts, tool/edit.ts, tool/patch.ts, tool/bash.ts to use the appropriate permission type
3. For backwards compatibility, the existing external_directory could be kept as a shorthand that sets both read and write

---

Note: This issue was drafted with Claude Opus 4.5

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• [FEATURE]: more general external_directory permissions #4991: More general external_directory permissions - proposes making external_directory permissions more granular and extensible
• [FEATURE]: allow /tmp or $TMPDIR folder access option #4743: Allow /tmp or $TMPDIR folder access option - requests path-specific permission control for external directories

Feel free to ignore if your use case is different from these.

[rekram1-node]

Yeah we need more granular permissions

[jgordijn]

It would be nice if instead of just ask/allow/deny we can configure it even on directory bases:
something like:

"external_directory_read": {
   "~/.config/opencode/skills": "allow",
   "*": "ask"
}

[fpdy]

made first proposal implementation at #5841