anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #13640] feat: add PowerShell Core (pwsh) tool with Windows security hardening #14753

New Issue
Closed
opened 2026-02-16 18:19:31 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:19:31 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/13640

State: closed
Merged: No

Summary

Adds a dedicated pwsh tool for Windows users alongside the existing bash tool. Uses
tree-sitter-powershell for AST-based permission analysis and includes Windows-specific
security hardening for bypass techniques, registry protection, and cmd.exe nested command
detection.

What changed

  • pwsh tool (pwsh.ts): tree-sitter parsing, path resolution, permission/auto-approval
    logic, spawns pwsh -NoProfile -NonInteractive -Command

  • Windows security (pwsh-windows.ts): encoded command detection, execution policy bypass,
    download-and-execute cradles, registry critical-path blocking, provider-aware read/write
    checks, BLOCK > ASK > ALLOW decision model

  • Permission analysis (pwsh-arity.ts): PowerShell-specific arity table for cmdlets,
    aliases, and external tools

  • UI wiring: routes pwsh through existing bash rendering paths in TUI, web share view,
    and i18n labels across 15 locales

  • Symlink fix: replaced broken custom-elements.d.ts symlinks in app/enterprise with
    actual file content (Windows compatibility)

Verification

From packages/opencode:

  • bun test test/tool/pwsh.test.ts — 32 pass, 0 fail
  • bun test test/tool/pwsh-windows.test.ts — 82 pass, 0 fail
  • bun test test/permission/pwsh-arity.test.ts — 12 pass, 0 fail
  • bun run typecheck — clean

Fixes #8924
Fixes #6703
Refs #8136
Refs #4683
Refs #11288

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/13640 **State:** closed **Merged:** No --- ## Summary Adds a dedicated `pwsh` tool for Windows users alongside the existing bash tool. Uses tree-sitter-powershell for AST-based permission analysis and includes Windows-specific security hardening for bypass techniques, registry protection, and cmd.exe nested command detection. ## What changed - **pwsh tool** (`pwsh.ts`): tree-sitter parsing, path resolution, permission/auto-approval logic, spawns `pwsh -NoProfile -NonInteractive -Command` - **Windows security** (`pwsh-windows.ts`): encoded command detection, execution policy bypass, download-and-execute cradles, registry critical-path blocking, provider-aware read/write checks, `BLOCK > ASK > ALLOW` decision model - **Permission analysis** (`pwsh-arity.ts`): PowerShell-specific arity table for cmdlets, aliases, and external tools - **UI wiring**: routes pwsh through existing bash rendering paths in TUI, web share view, and i18n labels across 15 locales - **Symlink fix**: replaced broken `custom-elements.d.ts` symlinks in app/enterprise with actual file content (Windows compatibility) ## Verification From `packages/opencode`: - `bun test test/tool/pwsh.test.ts` — 32 pass, 0 fail - `bun test test/tool/pwsh-windows.test.ts` — 82 pass, 0 fail - `bun test test/permission/pwsh-arity.test.ts` — 12 pass, 0 fail - `bun run typecheck` — clean Fixes #8924 Fixes #6703 Refs #8136 Refs #4683 Refs #11288
yindo added the pull-request label 2026-02-16 18:19:31 -05:00
yindo closed this issue 2026-02-16 18:19:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#14753
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?