Repository navigation
Security: shell classifier convergence waves M-P under v16-v20 adversarial audits (PR #48638 series) #49976
Closed as not planned
Description
Context
Part of the fork hardening series proposed in #48638 (branch session-diff-events). Tracker: #49565.
Problem
Convergence waves under repeated adversarial audit (v16-v20): remote-CLI global option handling, podman/local-file subcommands, quoted substitution payloads, attached-value precision, order-aware variables, evalScript program-text channels, payload-local scopes, redirect-site scoping, quote handling in option names, --opt= attached values, and an exponential-expansion regression in the variable resolver.
Change set (commit list)
Validation
- Final deepseek convergence gate: CONVERGED (1,122 replay rows, 0 negative flips; all named findings closed with real-effect proofs incl. live docker exfil gated both directions).
- Shell suite 108/0 (pre-existing load-correlated truncation flake noted, arm-independent); all cross-suites green; typechecks green.
- Intended to land as a standalone stacked PR.
Linked: PR #48638 · tracker #49565 · sibling tracking issues listed in a follow-up comment.
Activity
AceRothstein71 commentedon Sep 19, 2026
Cross-links: sibling tracking issues #49974 (perf/runtime), #49975 (shell classifier H-L), #49976 (shell classifier M-P), #49977 (instance lifecycle), #49978 (MCP/schema), #49979 (server/SSE + event/db), #49980 (updater tooling). Integration PR: #48638. Original tracker: #49565.
opencodejr commentedon Oct 28, 2026
Thanks for putting this together. As written, though, this issue tracks commits on your fork (#48638 series) rather than describing a problem we can verify in OpenCode. Those commits aren't in this repository, and the audit results can't be checked from here.
If there is a real problem with how OpenCode v2 decides whether a shell command needs permission, please describe it briefly in your own words:
opencode --version) and your OSIf it is a way to bypass permissions that could be exploited, please report it privately through the repository's security policy instead of a public issue.
You can reply here with the details or edit the issue. If you edit it, please also leave a comment saying you've updated it, so we know you're done editing.
Related issues, ordered by likelihood:
opencodejr commentedon Oct 31, 2026
Closing this as not planned, since we haven't heard back. We were waiting for a concrete problem to verify in OpenCode v2: a specific shell command, the permission config, what you expected and what happened, plus your version. The fork commits and audit results listed here aren't something we can check from this repository.
If you can show a real case where a shell command is classified wrongly, please open a new issue with those details. If it is a permission bypass that could be exploited, please report it privately through the repository's security policy instead. Thanks for your time.