bash permission escape via `--` double hyphen

Description

Bash commands containing -- bypass "bash": "ask" bash permission.

Plugins

No

OpenCode version

1.18.10

Steps to reproduce

1. create a new empty folder
2. create ./opencode.json configuration file with the following content

{
  "$schema": "https://opencode.ai/config.json",
  "permission": {
    "*": "ask",
    "bash": "ask"
  }
}

3. start opencode
4. ask a model to run git diff
5. a "Permission required" displayed as expected
6. reject it
7. ask the model to run git diff --
8. the model will run it without asking permission

Screenshot and/or share link

Operating System

Windows 11

Terminal

Windows Terminal