Security: fail-closed shell classifier hardening (waves H-L of PR #48638 series) #49975

Activity

1. AceRothstein71 commented on Sep 19, 2026

   

   AceRothstein71

   on Sep 19, 2026

   Author

   More actions

   Cross-links: sibling tracking issues #49974 (perf/runtime), #49975 (shell classifier H-L), #49976 (shell classifier M-P), #49977 (instance lifecycle), #49978 (MCP/schema), #49979 (server/SSE + event/db), #49980 (updater tooling). Integration PR: #48638. Original tracker: #49565.
2. opencodejr commented on Oct 28, 2026

   

   opencodejrBot

   on Oct 28, 2026

   Contributor

   More actions

   Thanks for putting this together. As written, this is a list of fork commits rather than a report we can check, so we can't act on it yet.

   If you've seen OpenCode run a command without the external_directory permission prompt you expected, please describe it briefly in your own words:

   • Your OpenCode version (opencode --version)
   • Your relevant permission config, if you changed the defaults
   • One or two exact shell commands the agent ran that reached a path outside the project without asking
   • What you expected (a prompt or a denial) and what happened instead

   Please note that, as SECURITY.md explains, the permission system is a UX feature, not a sandbox, and AI-generated security reports are not accepted. A concrete misclassification is still useful as a normal bug report.

   You can reply here with the details or edit the issue. If you edit it, please also leave a comment saying you've updated it so we know you're done.

   Related items, ordered by likelihood:

   • Security: shell classifier convergence waves M-P under v16-v20 adversarial audits (PR #48638 series) #49976: the other shell classifier tracking issue in this series (waves M-P)
   • fix: harden session diffs, snapshots, and write paths; cut worker-thread stalls under parallel agents #48638: the integration PR these commits came from (closed)
   • Worker-thread saturation under concurrent sessions: permission matching, turn-diff recomputation, event fanout, snapshot churn #49565: the earlier tracker for this series (closed)
3. opencodejr

   added

   triaging

   on Oct 28, 2026
4. opencodejr

   closed this as not plannedon Oct 31, 2026
5. opencodejr commented on Oct 31, 2026

   

   opencodejrBot

   on Oct 31, 2026

   Contributor

   More actions

   Closing this as not planned: we asked for a concrete example and haven't heard back. Without one, we can't confirm that any of the listed command shapes actually get past the external_directory prompt in OpenCode.

   If you do see a specific case, please open a new issue using the Bug Report template. Include your opencode --version, any changes to your permission config, the exact command the agent ran, and what you expected compared with what happened. Please write it in your own words, and note the threat model in SECURITY.md: the permission system is a UX feature, not a sandbox. Thanks!