fix(glob): enforce permissions on matched files

[fengjikui]

Issue for this PR

Closes#35684

Related to #29674, but scoped only to glob result-path permission enforcement.

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

glob previously asked permission only for the requested glob pattern. If that broad pattern was allowed, path-scoped deny rules never saw the files returned by ripgrep, so denied paths could still appear in the tool output.

This PR keeps the existing pattern permission check and adds a second permission check for the unique worktree-relative matched file paths before formatting results.

This is a narrow result-path permission fix and does not change wildcard matching semantics. A denied result path rejects the glob call through the existing ctx.ask flow, so the denied path is never returned.

Current dev@34e58090595d44e3e7cc37498f16753a98627456 still formats matched files without a result-path permission check. #35683 is the only open PR linked to #35684.

Relationship to grep

PR #35682 applies the same existing permission invariant to grep, under its separate issue #35503. The two patches remain separate two-file changes so each tool's result-path behavior and regression test can be reviewed independently.

How did you verify your code works?

• bun test --timeout 30000 test/tool/glob.test.ts test/tool/grep.test.ts test/tool/read.test.ts test/permission/next.test.ts -> 127 passed
• bun test --timeout 30000 test/tool -> 337 passed
• bun run typecheck from packages/opencode
• bun turbo typecheck from repository root -> 30/30 tasks passed
• bunx prettier --check src/tool/glob.ts test/tool/glob.test.ts
• bun run lint packages/opencode/src/tool/glob.ts packages/opencode/test/tool/glob.test.ts -> 0 errors
• git diff --check origin/dev...HEAD

Screenshots / recordings

Not a UI change.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Related PR Found

#35682 - fix(grep): enforce permissions on matched files

This is a closely related PR that applies the same permission enforcement pattern to the grep tool. Both PRs address the same issue (#29674) by adding result-path permission checks to prevent denied paths from appearing in tool output. These PRs appear to be implementing the same fix across different tools in parallel.

[fengjikui]

Refreshed this PR onto current dev@34e580905 as exact head 17f561b5.

Issue #35684 remains open, current dev still returns glob matches without evaluating their worktree-relative paths, and this remains the only linked implementation.

Current-head validation passed: 127 related permission/tool tests, all 337 tool tests, package typecheck, 30/30 monorepo typecheck tasks, Prettier, OXlint with 0 errors, and diff check.

[github-actions]

Automated PR Cleanup

Thank you for contributing to opencode.

Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions.

This PR was closed because it matched the following cleanup criteria:

• The PR was created more than 1 month ago
• The PR had fewer than 2 positive reactions
• Positive reactions are counted as thumbs-up, heart, celebration, or rocket reactions on the PR

PRs created within the last month are not affected by this cleanup.

If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate.

Thanks again for taking the time to contribute.