fix: deny bash commands with arguments when command name matches rule

[Ashwinhegde19]

Summary

Fixes #7063 - Permission system allows explicitly denied bash commands to execute

Problem

Commands configured with 'deny' in opencode.json permissions were being executed anyway. Specifically, package managers (yarn, npm, pnpm, npx, pnpx) ran despite being explicitly denied.

Root Cause: When a user configures "yarn": "deny", this creates a rule with pattern "yarn". However, the bash tool sends patterns like "yarn test" or "yarn install", which don't match the exact pattern "yarn" via Wildcard.match().

Solution

Modified the evaluate() function in packages/opencode/src/permission/next.ts to add special handling for bash permissions:

1. First checks if the full command pattern matches any rule (existing behavior)
2. For bash permissions only: also extracts the command name (first word) and checks if it matches any rule

This ensures that when a user configures yarn: deny, commands like yarn test, yarn install, etc. are correctly denied.

Changes

• packages/opencode/src/permission/next.ts: Added bash-specific command name matching in evaluate()
• packages/opencode/test/permission/next.test.ts: Added 10 new tests for bash command name matching

Testing

All 92 permission tests pass, including 10 new tests specifically for this fix:

• yarn test with yarn: deny → now correctly denies
• npm install with npm: deny → now correctly denies
• pnpm run build with pnpm: deny → now correctly denies
• npx create-react-app with npx: deny → now correctly denies
• Existing wildcard behavior preserved
• Non-bash permissions unaffected

Example Configuration That Now Works

{
  "permissions": {
    "bash": {
      "yarn": "deny",
      "npm": "deny"
    }
  }
}

With this fix, yarn test, yarn install, npm run build, etc. will all be correctly denied.

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Based on my search, I found one potentially related PR:

Related PR Found

PR #6737: "fix: handle redirected_statement treesitter node in bash permissions"

• URL: fix: handle redirected_statement treesitter node in bash permissions #6737
• Why it's related: This PR also addresses bash permission handling and pattern matching issues. It deals with bash command parsing for permissions, which is related to the command name extraction logic in your PR.

All other results either returned the current PR #9257 itself or unrelated PRs about GitHub actions and other features.

The searches did not uncover any other open PRs specifically addressing the issue where denied bash commands with arguments are being incorrectly executed, so this appears to be the first comprehensive fix for issue #7063.