Skip to content

v7.198.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 05:47
v7.198.1
6e73a8e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Stop misreading POSIX shell-tool commands as cmd.exe, and stop rejecting >&1; in compound commands

What changed

  • OpenCode 2 dispatches terminal commands as the shell tool on POSIX hosts as well as Windows. The shell-write scope guard inherited a Windows (cmd/PowerShell) grammar for the shell tool from command content alone, so a Linux command that merely started with echo was parsed as cmd.exe syntax and could be rejected with a false-positive write-guard denial. The shell tool now inherits that content-based Windows grammar only on Windows; off Windows it is a POSIX executor like bash. An explicit cmd /c / powershell -Command wrapper, or a PowerShell-shaped body, still selects the Windows grammar on every platform, and Windows behavior is unchanged. /swarm guardrail explain shares the same resolver, so its preview matches the gate.
  • The cmd redirect scanner now treats ; as the end of a >&<descriptor> token. Compound commands that duplicate a descriptor and are read under the cmd grammar, such as git status 2>&1; echo done on the shell tool or cmd /c "git status 2>&1; dir", were previously rejected as an unresolvable write target; they are now recognized as plain descriptor duplication (no file written). A non-numeric target such as >&name; is still fail-closed, and a real redirect after the ; is still detected and scope-checked.
  • Inline interpreter evaluation (python -c, node -e, …) is unchanged: it stays fail-closed for every role. A safer way to let read-only pipelines through is tracked separately. This release therefore does not permit inline evaluation; the originally proposed change that did (and whose commit subject reads "permit read-only interpreter evals") was removed before merge because it let non-coder roles and scoped coders write protected paths.

Migration

No configuration or schema migration is required.

Addresses part of #3323 (items 1 and 2).

7.198.1 (2026-10-16)

Bug Fixes

  • guard: key shell-tool Windows grammar on platform; test semicolon boundary (#3323) (eae72e6)
  • guard: key shell-tool Windows grammar on platform; treat ; as >& descriptor boundary (#3323) (12a3839)
Assets 2
Loading