Repository navigation
Compound shell approval saves already-allowed command patterns #50649
Description
Description
When a compound shell request contains commands with different permission results, Always allow saves every parsed command pattern.
With npm test set to ask and git status already allowed, approving npm test && git status saves both npm test * and git status *. It should save only the pattern that required approval: npm test *.
The project config uses these ordered rules:
{
"permissions": [
{ "action": "shell", "resource": "*", "effect": "ask" },
{ "action": "shell", "resource": "git status", "effect": "allow" }
]
}Plugins
None
OpenCode version
V2, reproduced at 956de96d8b8dbb6431cc555bded5a2a84c1f6134 and confirmed unchanged on current v2
Steps to reproduce
- Add the permission rules shown above to
opencode.jsonc. - Run
npm test && git statusthrough the shell tool. - Select Always allow.
- Inspect the patterns shown in the confirmation.
Screenshot and/or share link
Operating System
Arch Linux (Omarchy)
Terminal
Ghostty
Reacted by Nikita Frolov
Metadata
Metadata
Assignees
Labels
No labels
Activity
opencodejr commentedon Oct 28, 2026
Thanks for the detailed report. I tried to reproduce this on 2.2.0 with your two permission rules and a simulated model running
npm test && git status. My test setup never got the permission prompt to appear, so I couldn't confirm or rule out the problem. That points to my setup, not to your report.The code still looks the way you describe, both in 2.2.0 and on
dev. The shell tool attaches a save pattern for every parsed command, whether or not it was already allowed, and Always allow saves all of them. A maintainer will need to confirm it by hand. You don't need to send anything more; your steps and screenshot already cover it.Related items:
opencodejr commentedon Oct 31, 2026
Closing this as not planned for now. To be clear, this isn't because your report was missing anything. Your steps were complete, and the reproduction attempt failed because of a problem in our test setup, not because the behaviour was ruled out. The code still matches what you describe: the shell tool attaches a save pattern for every command in a compound request, and Always allow saves all of them, including ones already allowed by config.
If you still see this on a newer release, please reply here so a maintainer can look at it. Related: #50659 (your fix PR, closed by the automated PR cleanup) and #49165 (choosing between saving an exact command or a pattern). Thanks for the clear report and the fix.