Approving "always" on a compound bash command grants a rule for every command in it

[0xSemizzz]

Description

If a bash permission prompt covers a compound command, answering "always" installs a separate allow rule for each command in it, not just for the one you think you are approving.

Approving git status && rm -rf ./tmp installs git status * and also rm *. The second one matches any later rm, including rm -rf /, so the next destructive rm runs without a prompt.

The widening itself is reasonable for a single command, since git status to git status * is the intended behaviour. The problem is that it is applied per command while the approval is per prompt, so one click produces several grants.

Plugins

None

OpenCode version

1.18.11

Steps to reproduce

1. Add { "permission": { "bash": "ask" } } to opencode.json. Bash is "allow" by default, so the prompt will not appear otherwise.
2. Ask the agent to run: git status && rm -rf ./tmp
3. On the permission prompt, choose "always".
4. Ask the agent to run: rm -rf ./some-other-dir
5. It runs with no prompt, because the rm * rule from step 3 matches it.

Screenshot and/or share link

No response

Operating System

Ubuntu 26.04

Terminal

GNOME Terminal (Ubuntu default)