shell: bare redirect bypasses the permission check (scanner returns no commands) #49948

Activity

1. AceRothstein71 commented on Sep 19, 2026

   

   AceRothstein71

   on Sep 19, 2026

   More actions

   Relates to PR #48638. On the branch head (7063bdd9ea), redirect targets are now scanned regardless of command count (packages/opencode/src/tool/shell.ts:1939-1949 plus addPath/ask at :1671-1686, :1487-1506), so a bare redirect to an external path (> /etc/x) does raise the external_directory prompt. However, a bare redirect whose target is inside the project still yields zero scan patterns, so the shell-tool permission (shell.ts:1506) is not evaluated and a "*": deny rule does not block the write — the in-project repro in this issue is not fully closed. Wave commits 9c5eb44d12 … 7063bdd9ea. No claim of full resolution.
2. Hotragn commented on Sep 27, 2026

   

   Hotragn

   on Sep 27, 2026

   Author

   More actions

   Thanks — that's a useful split, and it matches what I'm seeing.

   To be clear about scope, since #48638 and my PR touch different files on different branches:

   • fix: harden session diffs, snapshots, and write paths; cut worker-thread stalls under parallel agents #48638 is on dev, in packages/opencode/src/tool/shell.ts.
   • fix(core): evaluate permissions for commands the scanner cannot decompose #49954 is on v2, in packages/core/src/tool/plugin/shell.ts.

   On current v2 (e22c1622e0) the guard you're describing is still there verbatim:

   yield* access.authorizeExternal([target, ...directories], context)
   if (parsed.commands.length > 0)
     yield* permission.assert({ … })

   Same shape as what you found: authorizeExternal runs unconditionally, so an external redirect target still raises the external-directory prompt, while the shell permission itself is gated on the scan having produced commands. So the in-project case you describe as not fully closed is exactly the one that remains open on v2 too, and it's what #49954 addresses — it drops the count gate and falls back to the raw invocation, so "*": deny applies to > in-project-file.

   The two are complementary rather than overlapping: yours covers the path-authorization side, this covers the permission-rule side on the other branch. Worth someone porting the dev redirect-target scanning across as well, since v2 gets the same benefit for external targets only through directories.
3. code-sayuri commented on Oct 20, 2026

   

   code-sayuri

   on Oct 20, 2026

   More actions

   Another trigger of the same zero-commands path, on Windows with pwsh: a bare .NET expression statement.

   opencode server 2.0.32, Windows 11 10.0.22631. The shell tool runs PowerShell. Subagent rules: { action: "*", resource: "*", effect: deny }, then a shell allowlist (git *, Get-Content *, …), then pattern denies such as '*?:\*'.

   command	result
   Get-Content C:\Windows\win.ini	Permission denied: shell
   1 | ForEach-Object { [IO.File]::ReadAllText('C:\Windows\win.ini') }	Permission denied: shell
   python -c "print(open('C:/Windows/win.ini').read()[:20])"	Permission denied: shell
   [IO.File]::ReadAllText('C:\Windows\win.ini')	runs and prints the file

   Reproduced in 3 of 3 runs. One run had experimental.portable_shell_scanner: true; I did not confirm that the server reloaded the setting first. The statement has no command word, so I assume the scanner returns zero commands, as with a bare redirect. I have not called ShellParse.scan directly. As with -- in #54393, a deny-by-default shell policy still lets the agent read any file the user can read.
4. opencodejr commented on Oct 28, 2026

   

   opencodejrBot

   on Oct 28, 2026

   Contributor

   More actions

   Thanks for the detailed report. I can confirm this on v2.2.0 and on the latest dev (62ae125d9).

   What I ran, with a simulated model:

   • victim.txt contains important data.
   • Shell permissions deny everything except git status.
   • The model runs cat victim.txt, which is rejected with Permission denied: shell.
   • The model then runs > victim.txt. It runs with no prompt or denial, and reading the file afterwards shows 0 lines.

   The recording and screenshot below show this, and the script below reproduces it.

   One detail: with only "*": "deny", the shell tool is removed from the model's tool list entirely, so the call never reaches the scanner. The bypass shows up once there is at least one later allow rule, or with the default ask behaviour, which covers most real configs. The commands.length > 0 guard in packages/core/src/tool/plugin/shell.ts is still there on dev.

   Related issues:

   • permission: an empty resources list resolves to allow, discarding the ask default #51648: an empty resources list evaluates to allow in permission.ts
   • shell: bare "--" in a pwsh command skips the permission check #54393: a bare -- in a pwsh command also skips the permission check
   • permissions: compound shell commands drop redirection, so an allowed command becomes an unprompted file write #52083: redirections dropped from permission resources in compound commands
   • Redirect-only bash statements bypass all permission rules ("> out.txt" runs under "bash": {"*": "deny"}) #52180 / fix(opencode): check permission for bare redirects with no parsed command #53597: the earlier v1 report and PR for this same bypass, both closed when development moved to v2

   recording.mp4

   

   Reproduction script (drive.ts)

   // Reproduces anomalyco/opencode#49948: with every shell command denied except one
   // explicit allow, a bare redirect (`> victim.txt`) still runs through the shell
   // tool without any permission check and empties the file.
   import { Effect, Stream } from "effect"
   import { Llm, OpenCodeDriver } from "opencode-drive"
   
   const call = (id: string, name: string, input: any) =>
     Stream.make(Llm.toolCall({ index: 0, id, name, input }), Llm.finish("tool-calls"))
   
   export default OpenCodeDriver.use(
     {
       ...(process.env.OC_DEV ? { opencode: { dev: process.env.OC_DEV } } : {}),
       tui: { recording: true },
       project: { git: true, files: { "victim.txt": "important data\n" } },
       config: {
         autoupdate: false,
         // Deny every shell command except `git status`. (A lone `"*": "deny"`
         // removes the shell tool from the model entirely, so one allow keeps it visible.)
         permissions: [
           { action: "shell", resource: "*", effect: "deny" },
           { action: "shell", resource: "git status", effect: "allow" },
         ],
       },
     } as any,
     ({ ui, llm }) =>
       Effect.gen(function* () {
         yield* llm.serve((req: any) => {
           const messages = req.body.messages as any[]
           if (JSON.stringify(messages[0]).includes("You name conversations")) return Stream.make(Llm.text("Bare redirect"))
           const results = messages.filter((m) => m.role === "tool")
           for (const r of results) console.error(`TOOL RESULT ${r.tool_call_id}: ${String(r.content).slice(0, 400)}`)
           switch (results.length) {
             case 0: return call("call_cat", "shell", { command: "cat victim.txt", description: "control: denied" })
             case 1: return call("call_redirect", "shell", { command: "> victim.txt", description: "bare redirect" })
             case 2: return call("call_read", "read", { path: "victim.txt" })
             default: return Stream.make(Llm.text("ALL DONE"))
           }
         })
         yield* ui.submit("Run cat victim.txt, then > victim.txt, then read victim.txt")
         yield* ui.waitFor("ALL DONE")
         yield* Effect.sleep(1000)
         yield* ui.screenshot("result")
       }),
   )

   Run it with opencode-drive: opencode-drive run ./drive.ts. It drives opencode from your PATH; set OC_DEV to the path of an OpenCode checkout to run that from source instead.
5. opencodejr

   added

   reproduced

   severity:high

   on Oct 28, 2026
6. kitlangton

   closed this as completedin #60376on Oct 29, 2026