Repository navigation
Permission pattern matching silently ignores commands containing '--' #27575
Description
Description
Bash permission rules containing -- in the pattern are silently ignored — the command runs without triggering the configured ask or deny action.
Config
"permission": {
"bash": {
"chezmoi git -- push": "ask",
"chezmoi git -- push *": "ask"
}
}Steps to reproduce
- Add the above permission rules to
opencode.json(tested at both top-level and per-agent level) - Run
chezmoi git -- pushvia the bash tool - The command executes without any permission prompt
Expected behaviour
The command should trigger an ask prompt before executing.
Additional context
- Patterns without
--work correctly. For example,"git push": "ask"triggers the prompt as expected. - Workaround: use
"chezmoi git *": "ask"which matches without relying on the--literal. - The
--is likely being interpreted as an argument separator by the glob matcher rather than matched as a literal string.
OpenCode version
Latest (tested 2026-05-14)
Operating System
Windows 11
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon May 14, 2026
This issue might be a duplicate of existing issues. Please check:
harvzor commentedon May 14, 2026
ngl my agent created this issue without asking me - I've been working on making its permissions less permissive and apparently I need to block its easy access to
ghharvzor commentedon May 14, 2026
I think the issue still stands but I don't feel confident enough to file an issue
harvzor commentedon May 14, 2026
Update: root cause found
Further testing shows the issue is broader than just
--. Even"chezmoi *": "ask"and"chezmoi git *": "ask"fail to blockchezmoi git -- push.This appears to be the same root cause as the closed issue #6676 — the bash tool uses treesitter to tokenize commands before permission matching, and skips certain node types. The
--token is stripped during tokenization, sochezmoi git -- pushis evaluated as if it werechezmoi git push.Confirming the treesitter theory: the pattern
"chezmoi git push": "ask"(without--) does blockchezmoi git -- push. This confirms--is being dropped before pattern matching occurs.So #6676 was closed but the fix was incomplete — it only addressed the
kill -9style flags, not--argument separators.m21-cerutti commentedon Jul 15, 2026
I confirm it still exist, in my case it was
git status --porcelain, even defining without wildcard is not working (of course I restarted my session after permission update).