Repository navigation
Conversation
`collect()` accumulated one arity-widened `always` pattern per command node into a single set, and `Permission.reply` installs an allow rule for every entry of that set when the user answers "always". For a compound command this turns one user decision into several grants: approving `git status && rm -rf ~` installs both `git status *` and `rm *`, and `rm *` matches `rm -rf /` on the next turn. Keep the widened prefix only when the request covers exactly one command. Otherwise fall back to the literal command strings, so "always" grants exactly the commands that were displayed in the prompt.
|
Thanks for your contribution! This PR doesn't have a linked issue. All PRs must reference an existing issue. Please:
See CONTRIBUTING.md for details. |
github-actions
Bot
added
needs:compliance
|
Thanks for updating your PR! It now meets our contributing guidelines. 👍 |
|
Automated PR Cleanup Thank you for contributing to opencode. Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions. This PR was closed because it matched the following cleanup criteria:
PRs created within the last month are not affected by this cleanup. If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate. Thanks again for taking the time to contribute. |
collect()accumulated one arity-widenedalwayspattern per command node into a single set, andPermission.replyinstalls an allow rule for every entry of that set when the user answers "always".For a compound command this turns one user decision into several grants: approving
git status && rm -rf ~installs bothgit status *andrm *, andrm *matchesrm -rf /on the next turn.Keep the widened prefix only when the request covers exactly one command. Otherwise fall back to the literal command strings, so "always" grants exactly the commands that were displayed in the prompt.
Issue for this PR
Closes #40158
Type of change
What does this PR do?
scan.alwaysintool/shell.tsis aSetthat gets one entry per command node found in the parsed command.ask()sends the whole set as the request'salwayslist, andpermission/index.tsloops that list on an "always" reply, pushing an allow rule for each entry.So the widening is per command but the approval is per request. With one command that is fine: you approve
git status, you getgit status *. With two it is wrong, because you see one prompt, click once, and get a rule for each command in it. Thermcase is the bad one, sinceBashAritygivesrman arity of 1, sorm -rf ~widens torm *, which then matches any futurerm.The fix keeps the existing widening when
found.length === 1and otherwise uses the literal command text. Re-running the same compound command still matches and stays allowed.rm -rf /does not matchrm -rf tmpand still prompts.How did you verify your code works?
Two tests in
packages/opencode/test/tool/shell.test.ts. One assertsgit statusstill widens togit status *. The other assertsgit status && rm -rf tmpyields neitherrm *norgit status *, but does yield both literals. Both use the existingcapture(requests, err)helper so the command never actually executes.cd packages/opencode && bun test test/tool/shell.test.tsScreenshots / recordings
N/A, no UI change.
Checklist