Redirect-only bash statements bypass all permission rules ("> out.txt" runs under "bash": {"*": "deny"}) #52180

Description

{ "permission": { "bash": { "*": "deny", "echo hacheck *": "allow", "*>*": "deny" } } }

No prompt is shown either — the call never reaches the permission layer.

> out.txt creates or truncates the file, >> appends.

"*>*": "deny" is what makes row 2 safe, and it is the only thing that does. It
provably cannot help the rest: the redirect-only statements are never matched
against any pattern, so there is nothing for a pattern to catch. Neither can
">*" or any other pattern — the value being matched does not exist.

Without a redirect deny, row 2 also executes; that was #5330, fixed by #6737.
The statements above are the residual case that fix does not cover.

Root cause

// packages/opencode/src/tool/bash.ts
for (const node of tree.rootNode.descendantsOfType("command")) {
  // ...
  if (command.length && command[0] !== "cd") {
    patterns.add(commandText)
  }
}

A bare redirection parses as a redirected_statement containing only a
file_redirect — there is no command node. The loop body never runs, patterns
stays empty, and no permission check is issued. The command.length guard causes
the same skip for any command node that yields no tokens.

This is the residual case of #5330: the fix in #6737 (commit e7ff7143) attaches
the redirect text via node.parent.text, but only for statements that already
contain a command node. The same commit also introduced the env-prefix bypass in
#16075, so the string handling around here looks worth revisiting.

Likely part of the class covered by #31485.

Version: 1.18.31

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response