Enforce per-state allowed_commands in the opencode plugin - #6
Merged
azurewraith merged 1 commit intoJul 18, 2026
Merged
Conversation
The opencode plugin only sent tool_name to the hook server, so a state's allowed_commands had no effect once bash itself was allowed - unlike the claude-code hook, OMX, and Pi plugins, which all classify bash commands client-side. Port that classification into the opencode plugin (destructive ops always blocked, redirect/interpreter heuristics without Write/Edit, allowed_commands prefix matching) and expose allowed_commands on the /hooks/state response so the plugin has the list to match against. The destructive pattern also treats newline as a command separator and tests the trimmed command, closing two bypasses the anchored patterns elsewhere miss (newline chaining and leading whitespace). Fixes statewright#5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #5.
The opencode plugin sent only
tool_nameto the hook server, so oncebashwas allowed in a state, any command ran —allowed_commandswas advisory. The claude-code hook, OMX, and Pi plugins all classify bash commands client-side; this ports that same classification to opencode:classifyBashCommand(exported, pure): destructive ops always blocked, redirect/interpreter heuristics when Write/Edit aren't in allowed tools,allowed_commandsprefix matching (same semantics as OMX/Pi). Wired intotool.execute.beforeafter the gateway's tool-level decision; fail-open when no state is available so plain opencode sessions are unaffected./hooks/statenow includesallowed_commands(the MCPstatewright_get_statealready returned it; the HTTP endpoint didn't), giving the plugin the list to match against.^-anchored patterns elsewhere miss (echo hi\nrm -rf /riding an allowedechoprefix, and leading whitespace). The OMX/claude-code classifiers may want the same hardening; happy to follow up if there's interest.write/edit), so the Write/Edit heuristics accept both spellings.Tests: 18 vitest cases for the pure classifier (
plugins/opencode/src/index.spec.ts, wired asnpm testmatching the OMX plugin's setup);cargo test --workspacepasses; warning count unchanged vs main.