Symlink inside the project bypasses external_directory, and the permission prompt shows the wrong path

Description

The project containment check is pure path arithmetic and does not resolve symlinks, but the file read or write that follows does. A symlink inside the project pointing somewhere outside it passes the check, so external_directory never fires and the operation lands outside the project.

The prompt you do get is also misleading rather than just absent. read and edit show the path relative to the worktree, so you see the in-project link path while a different file is being opened.

Windows does not have this, because it already resolves the path at this point. It is POSIX only.

Plugins

None

OpenCode version

1.18.11

Steps to reproduce

1. mkdir -p /tmp/outside && echo secret > /tmp/outside/notes.txt
2. In your project root: ln -s /tmp/outside vendor
3. Ask the agent to read vendor/notes.txt
4. No external_directory prompt appears, and the file contents are returned.
5. The read prompt shows vendor/notes.txt, not /tmp/outside/notes.txt
6. Same with a write. Ask it to write to vendor/new.txt and the file appears in /tmp/outside/

Screenshot and/or share link

No response

Operating System

Ubuntu 26.04

Terminal

GNOME Terminal (Ubuntu default)