Windows: `permission.bash` deny rules are skipped and built-in `bash` executes denied commands

Description

On Windows 11 with OpenCode 1.18.31, a subagent can execute a command through the built-in bash tool even though its effective agent configuration contains a catch-all Bash deny rule.

The same agent configuration behaves correctly on macOS: the command is denied.

This does not appear to be a config-loading issue. On Windows, opencode debug agent CoderAgent shows the deny rule is present, and the exported subagent session shows the command used the built-in bash tool. However, the OpenCode log contains no corresponding evaluated permission=bash ... entry before the command executes.

Expected behavior

With:

permission:
  bash:
    "*": "deny"
    "git status *": "allow"

a command such as:

echo "permission-test"

should be denied.

Actual behavior

• macOS: echo "permission-test" is denied.
• Windows 11: the same command executes successfully.

On Windows, the effective agent config includes:

permission bash "*" deny

and the exported session shows:

{
  "type": "tool",
  "tool": "bash",
  "command": "echo \"permission-test\""
}

but there is no matching evaluated permission=bash ... log entry before execution.

I also tested after disabling alternative execution tools:

shell:
  "*": "deny"

oc_bash:
  "*": "deny"

opencode debug agent CoderAgent then showed:

shell "*"   -> deny
oc_bash "*" -> deny
bash "*"    -> deny

tools:
  shell: false
  oc_bash: false
  bash: true

The command still executed via "tool": "bash" on Windows.

Changing the configured shell between PowerShell, cmd, and Git Bash did not change the behavior.

Plugins

Configured globally:

• opencode-vibeguard
• @tarquinen/opencode-dcp@latest
• cursor-acp
• opencode-cmd-provider

Project plugins include Graphify/Caveman/DCP integrations.

The failing Windows reproduction described above was verified after shell and oc_bash were disabled for the agent, with the exported session showing the built-in bash tool.

OpenCode version

1.18.31

Steps to reproduce

1. On Windows 11, create a subagent with a restrictive Bash permission map:

   ---
   name: CoderAgent
   mode: subagent
   permission:
     bash:
       "*": "deny"
       "git status *": "allow"
   ---
   

2. Restart OpenCode.

3. Verify the effective agent configuration:

   opencode debug agent CoderAgent
   

   Confirm it contains:

   permission bash "*" deny
   

4. Ask the subagent to run exactly:

   echo "permission-test"
   

5. Observe that the command executes on Windows.

6. Export/inspect the session and confirm the tool is:

   "tool": "bash"
   

7. Inspect the OpenCode log. In the failing Windows case there is no corresponding:

   evaluated permission=bash ...
   

   entry before execution.

8. Run the same configuration/test on macOS. The command is denied as expected.

Screenshot and/or share link

NA

Operating System

• Windows 11 � affected
• macOS � same agent configuration denies the command as expected

Terminal

Reproduced on Windows with OpenCode directly.

Tested with:

• PowerShell 7
• cmd
• Git Bash configured as the shell

Related issues

These appear related but do not describe this exact reproduction:

• #36765 � permission.bash pattern-map behavior with "*": "deny"
• #36696 � Windows PowerShell/cmdlet permission matching
• #31485 � broader Bash permission/parser bypass discussion
• #28682 � Windows Bash deny-rule behavior with different fallback configuration