Permission patterns truncated/skipped when parsing commands with tree-sitter-powershell (Windows) — allow rules never match #52615

Description

On Windows (default PowerShell shell), the bash tool builds permission patterns from a tree-sitter-powershell parse of the command (shell.ts: (ps ? p.ps : p.bash).parse(command)), and that grammar breaks on common POSIX shapes. The broken text is what reaches the permission evaluator:

1. --flag=value truncation — the command node closes before the =, so the pattern loses everything from =value onward. An allow rule matching the full command never matches → last-rule * deny wins → an explicitly allowed command is denied.
2. Trailing standalone -- — parse root becomes ERROR with zero command nodes → patterns.size === 0 → the permission check is skipped entirely → the command runs with no check at all (opposite failure).

tree-sitter-bash 0.25.0 parses every one of these correctly; only the PowerShell path breaks them.

Steps to reproduce

1. Windows 11, PowerShell 5.1, OpenCode 1.18.34 (latest)
2. Config:

   "permission": { "bash": { "git diff --flag=value *": "allow", "*": "deny" } }

3. Ask the agent to run git diff --flag=value a b --
4. Log shows the pattern truncated, then denied:

evaluated permission=bash pattern="git diff --flag" ... action.pattern=* action.action=deny

Second repro (permission check skipped): run chezmoi git -- push — no command node, no evaluated log line at all.

Real-world case

A reviewer agent sent this 380-char command:

env -i PATH="$PATH" LC_ALL=C ... diff --name-status ... --ignore-submodules=none 32fd1b4373498369c... 6f3ceb2e56dc712a... --

The logged pattern was 290 chars, ending at --ignore-submodules (everything from =none on was dropped), so the matching allow rule never matched:

evaluated permission=bash pattern="env -i PATH=\"$PATH\" LC_ALL=C ... --ignore-submodules" action.pattern=* action.action=deny

Parser repro (exact wasm versions from package.json)

tree-sitter-bash 0.25.0:         root=program, (command) [0..118] — full
tree-sitter-powershell 0.25.10:  root=ERROR,    (command) [0..15]  — missing "=value a b --"

Same for the real-world command: bash [0..380] full vs powershell [0..290] truncated.

Related: #6676, #27575 (closed, but these cases still reproduce on 1.18.34).