Opencode2 shell tool bypasses edit/write tool permission checks on blocked file paths

Description

The edit and write tools enforce a permission check that blocks modification of files at paths requiring external_directory approval. However, the shell tool can achieve the same file modification (e.g. via sed, cat >>, python3) while its path-based warnings are advisory-only and do not block execution. This allows the model to bypass the permission layer by switching from a denied edit/write call to a shell call that performs the same operation.

Plugins

No response

OpenCode version

0.0.0-next-16116

Steps to reproduce

1. Request a file modification that triggers permission.rejected on edit or write (e.g. editing a file where the path requires external_directory approval)
2. The edit tool is denied with "error":{"type":"permission.rejected","message":"Permission denied: edit"}
3. The model falls back to using sed, cat, python3, or other file-modifying commands via the shell tool
4. The shell tool succeeds despite operating on the same path, because its path check is advisory-only: "this scan is advisory only"

Screenshot and/or share link

No response

Operating System

Linux 6.18.35.2-microsoft-standard-WSL2 (archlinux x64)

Terminal

windows terminal