permission.bash pattern maps: "*": "deny" fallback removes the bash tool from all agents; deny patterns under an allow fallback are ignored #36765

Description

Two behaviors that together make permission.bash pattern maps unusable for least-privilege configs (verified on 1.17.18 with controlled single-variable probes — the three configs below differ only in the bash map):

1. A "*": "deny" fallback removes the bash tool from every agent's toolset entirely. With "bash": {"npm *": "allow", "ls *": "allow", "*": "deny"}, agents asked to enumerate their tools report no bash tool, and matching npm/ls commands can never run because the tool itself is gone. Tool visibility appears to be gated on the map's fallback verdict rather than per-invocation evaluation. Changing ONLY the fallback to "ask" or "allow" restores the tool.
2. Specific deny patterns under an allow fallback are silently ignored. With "bash": {"rm *": "deny", "*": "allow"}, rm -f ./x executes. (Untested: deny patterns under an "ask" fallback.)

Impact: an operator writing an allowlist with a deny fallback — the natural least-privilege shape, and the natural fix for headless ask-hangs — silently loses shell for all agents (which then hallucinate/fumble a tool they don't have); an operator writing a denylist gets no protection at all. The only working states are all-shell or no-shell.

Expected: tool visibility independent of the fallback verdict; per-invocation pattern evaluation with most-specific match winning; deny patterns honored regardless of fallback.

Plugins

None

OpenCode version

1.17.18

Steps to reproduce

Same prompt against three configs, only the bash map differs. Prompt: "List the exact tools available to you, then run ls -la."

Config A — tool disappears:

{"permission": {"bash": {"npm *": "allow", "ls *": "allow", "*": "deny"}}}

→ no bash tool in the enumerated toolset; ls never runs.

Config B — fallback flipped to allow, tool returns:

{"permission": {"bash": {"npm *": "allow", "ls *": "allow", "*": "allow"}}}

→ bash tool present, ls runs.

Config C — deny pattern ignored:

{"permission": {"bash": {"rm *": "deny", "*": "allow"}}}

→ prompt "create a file x then rm -f ./x": the rm executes.

Operating System

macOS (darwin 25.5.0), node v22.13.1

Terminal

Non-TTY (headless invocation)