Repository navigation
Permission deny patterns dont match PowerShell commands when shell is pwsh #41970
Closed as not planned
Description
Summary
When shell is pwsh, bash permission deny patterns (rm *, del *, sudo *, scp *) never match PowerShell commands (Remove-Item, etc). Deny rules are silently bypassed.
Evidence
- Config: "shell": "pwsh" with "rm *": "deny" and "del *": "deny"
- Logs show Remove-Item executed 9 times - zero matched by deny rules
- All bash-style deny rules are irrelevant on Windows pwsh
Expected
Permission matching should be shell-aware. "rm ": "deny" should match Remove-Item when shell is pwsh. Or provide separate pwsh permission block.
Impact
False sense of security - deny list looks complete but does nothing on Windows.
Version: 1.18.16, Electron 42.3.3, Windows 10
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Aug 12, 2026
This issue might be a duplicate of existing issues. Please check:
Test-Path,Get-*) not matching bash-style deny rules whenshellis set topwshon Windows.thdxr commentedon Oct 11, 2026
Thanks for the report! OpenCode 2.0 is now out and development is focused on V2, so we're closing issues filed against OpenCode 1. Please upgrade (
opencode upgrade --major, details: https://anoma.ly/notes/opencode-2-0), and if this is still relevant on 2.0, reopen this issue or open a new one with your 2.0 version.— from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊