external_directory does not fire for many bash commands that write outside the project

[0xSemizzz]

Description

The docs say external_directory is "triggered when a tool touches paths outside the project working directory". The file tools do that on every call, but the bash tool only checks a short list of command names, so anything outside that list writes outside the project silently.

Separately, any argument containing a $ is discarded before it can be resolved, so even a command that is on the list gets skipped when the path is written with a variable.

This happens with the default config, since external_directory defaults to "ask", so no opt-in is needed to hit it.

Plugins

None

OpenCode version

1.18.11

Steps to reproduce

1. Open any project.
2. Ask the agent to run: echo test | tee ~/opencode-external-test
   No prompt appears and the file is created in your home directory.
3. For contrast, ask it to run: cp ./README.md ~/opencode-external-test2
   This one does prompt, because cp is on the list.
4. Now the $ case. Ask it to run: rm $HOME/opencode-external-test
   No prompt, even though rm is on the list.
5. For contrast, run the same path written literally: rm /home//opencode-external-test
   This one does prompt.

Screenshot and/or share link

No response

Operating System

Ubuntu 26.04

Terminal

GNOME Terminal (Ubuntu default)

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Shell redirect targets bypass the external_directory permission #32628: Shell redirect targets bypass the external_directory permission — covers a related bypass vector in the bash tool's path scanning logic

Both issues describe gaps in external_directory enforcement for the bash/shell tool, though #40159 focuses on the command-name allowlist and $VARIABLE argument discarding, while #32628 focuses on shell redirect targets. They may be worth addressing together.