anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-23 02:36:57 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #7009] fix(bash): wildcard patterns now match commands with flags #12203

New Issue
Closed
opened 2026-02-16 18:17:07 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:17:07 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/7009

State: closed
Merged: No

Fixes #6676

Problem

Bash permission patterns like "kill *" fail to match commands with flags (e.g., kill -9 PID).

Solution

Integrate the existing Wildcard.allStructured() function into the production permission path for position-independent flag matching.

Approach & Precedent

This implementation follows patterns established by widely-adopted CLI permission systems:

Project Pattern Type Precedence Source
sudo fnmatch glob Last-match-wins match.c
doas Simple patterns Last-match-wins doas.c
git wildmatch Last-match-wins wildmatch.c

Key design decisions:

  • Glob patterns over regex — Matches sudo, doas, and gitignore for readability and predictability
  • Last-match-wins precedence — Consistent with doas.conf(5): "The last matching rule determines the action taken"
  • Structured command parsing — Commands parsed as {head, tail} for position-independent flag matching

Changes

  • bash.ts: Parse commands as {head, tail} structure capturing all tokens including flags
  • next.ts: Add evaluateBash() using structured matching via allStructured()
  • read.test.ts: Handle optional patterns field
**Original Pull Request:** https://github.com/anomalyco/opencode/pull/7009 **State:** closed **Merged:** No --- Fixes #6676 ## Problem Bash permission patterns like `"kill *"` fail to match commands with flags (e.g., `kill -9 PID`). ## Solution Integrate the existing `Wildcard.allStructured()` function into the production permission path for position-independent flag matching. ## Approach & Precedent This implementation follows patterns established by widely-adopted CLI permission systems: | Project | Pattern Type | Precedence | Source | |---------|--------------|------------|--------| | **sudo** | fnmatch glob | Last-match-wins | [match.c](https://github.com/sudo-project/sudo/blob/main/plugins/sudoers/match.c) | | **doas** | Simple patterns | Last-match-wins | [doas.c](https://github.com/openbsd/src/blob/master/usr.bin/doas/doas.c) | | **git** | wildmatch | Last-match-wins | [wildmatch.c](https://github.com/git/git/blob/master/wildmatch.c) | Key design decisions: - **Glob patterns over regex** — Matches sudo, doas, and gitignore for readability and predictability - **Last-match-wins precedence** — Consistent with [doas.conf(5)](https://man.openbsd.org/doas.conf.5): *"The last matching rule determines the action taken"* - **Structured command parsing** — Commands parsed as `{head, tail}` for position-independent flag matching ## Changes - `bash.ts`: Parse commands as `{head, tail}` structure capturing all tokens including flags - `next.ts`: Add `evaluateBash()` using structured matching via `allStructured()` - `read.test.ts`: Handle optional `patterns` field
yindo added the pull-request label 2026-02-16 18:17:07 -05:00
yindo closed this issue 2026-02-16 18:17:07 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#12203
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?