Repository navigation
Bash permission rules don't match commands with env variable prefixes #14110
Description
Description
Commands prefixed with inline environment variables (e.g. GOFLAGS=-mod=vendor go test ./...) don't match permission rules like "go *": "allow". The user gets prompted for permission even though the command should be allowed.
The bash tool uses tree-sitter to parse commands and extracts commandText from the AST node's .text property, which includes leading variable_assignment nodes. So the permission pattern becomes GOFLAGS=-mod=vendor go test ./... instead of go test ./..., and fails to match "go *".
The command array (used for always auto-approval patterns) already correctly skips variable_assignment nodes — only commandText (used for patterns) has the problem.
Steps to reproduce
- Add
"go *": "allow"topermission.bashin config - Have the agent run a command like
GOFLAGS=-mod=vendor go test ./... - You get a permission prompt even though
go *should match
Operating System
macOS
Activity
prydt commentedon Feb 26, 2026
I have been running in to this. Very excited to see a fix!
github-actions commentedon Apr 28, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.
fix(opencode): skip env-var prefixes in shell permission pattern matc…
fix: strip env variable prefixes from permission pattern matching
fix(shell): strip env variable assignments from permission patterns
github-actions commentedon Jul 25, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.
fix(shell): strip env variable assignments from permission patterns