fix(opencode): check permission for bare redirects with no parsed command - #53597

Issue for this PR

Closes #49948

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

A bare redirect like > file or >> file is valid POSIX — it truncates or creates the target file — but the tree-sitter shell scanner parses it into zero command nodes. The shell tool built its permission patterns only from parsed commands, so a zero-command statement produced no patterns and the permission check was skipped entirely. The statement then ran unchecked even with an explicit deny:

permission:
  bash:
    "*": "deny"

The issue predates the current scanner, but this still reproduces on dev: both > victim.txt and >> victim.txt parse to 0 command nodes, so nothing is asserted before they execute.

The fix: while scanning, also look at redirected_statement nodes. A redirected statement with no command body (the bare-redirect case) is added as a permission pattern using its raw text, so it flows through the same evaluation as any other statement — denied by an explicit deny, allowed by an explicit allow, or shown as a prompt otherwise. Redirects that do have a command (e.g. echo hi > out.txt) keep their existing pattern and are unaffected.

Scope note

The issue also points to a second fail-open in packages/core/src/permission.ts: an empty resource list falls through to allow. That file belongs to the separate legacy permission system, and changing its default could affect behavior well beyond this path, so I did not touch it here. With this change the shell path no longer reaches that state for bare redirects because a pattern is always produced.

How did you verify your code works?

Added three regression tests in packages/opencode/test/tool/shell.test.ts:

• > victim.txt is denied under a wildcard deny rule and the file is not truncated.
• >> victim.txt produces one bash permission prompt whose pattern is the raw statement.
• echo hi > out.txt keeps its single existing pattern (no extra bare-redirect pattern, no duplicate prompt).

Results on a clean tree:

• bun test test/tool/shell.test.ts — 26 pass / 0 fail
• bun test test/permission/next.test.ts test/permission-task.test.ts — 100 pass / 0 fail
• tsgo --noEmit — passes
• oxlint on the two changed files — 0 errors (12 pre-existing warnings)

Screenshots / recordings

N/A — no UI change.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR