fix: strip inline env var prefixes from bash permission patterns

[prullanferragut]

Issue for this PR

Closes#16075

Type of change

• Bug fix

What does this PR do?

In collect() inside shell.ts, the permission pattern for a command was built by calling source(node), which returns the raw node.text. For a command like GITHUB_TOKEN=x git push --force, tree-sitter parses the variable_assignment as a child of the command node, so node.text includes it. The resulting pattern GITHUB_TOKEN=x git push --force does not match a rule like "git push --force*": deny, allowing the bypass.

The parts() function already walks the command node's children and intentionally skips variable_assignment nodes — it's what builds the tokens array used for the always pattern, which was already correct. The fix replaces source(node) with tokens.join(" ") for the patterns entry, bringing it in line with how always was already computed. Redirection suffixes (e.g. > output.txt, 2>&1) are re-attached from the parent redirected_statement node so that existing redirect-pattern matching continues to work.

The now-dead source() function is removed.

How did you verify your code works?

Ran bun test test/tool/shell.test.ts --timeout 60000 — 26 pass, 0 fail.

Three new integration tests exercise the permission-scanning path directly via the capture() helper (halting execution at the permission prompt):

• CI=true git commit -m "test" → pattern must be git commit -m "test", not contain CI=true
• FOO=1 BAR=2 echo hello → pattern must be echo hello, not contain FOO=1
• CI=true echo hello > output.txt → pattern must be echo hello > output.txt, not contain CI=true (exercises both branches simultaneously)

The existing redirect test (echo test > output.txt → echo test > output.txt) continues to pass, confirming the redirection re-attachment is correct.

Test groundwork from #16086.

Screenshots / recordings

N/A — no UI change.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for updating your PR! It now meets our contributing guidelines. 👍

[github-actions]

Automated PR Cleanup

Thank you for contributing to opencode.

Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions.

This PR was closed because it matched the following cleanup criteria:

• The PR was created more than 1 month ago
• The PR had fewer than 2 positive reactions
• Positive reactions are counted as thumbs-up, heart, celebration, or rocket reactions on the PR

PRs created within the last month are not affected by this cleanup.

If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate.

Thanks again for taking the time to contribute.