OpenCode also defaults to ask for external_directory, which applies to bash commands touching paths outside the workspace.

    sre on archlinux  10.0.0.193 ~/opencode-test took 0s
    ﬌ opencode run "use bash to touch an empty txt file in my home dir"
    
    > build · moonshotai/kimi-k3
    
    ! permission requested: external_directory (/home/sre/*); auto-rejecting
     touch ~/empty.txt && ls -la ~/empty.txt failed
    Error: The user rejected permission to use this specific tool call.

    sre on archlinux  10.0.0.193 ~/opencode-test took 0s
     opencode run --auto "use bash to touch an empty txt file in my home dir"
    
    > build · moonshotai/kimi-k3
    
    $ touch ~/empty.txt && ls -l ~/empty.txt
    -rw-r--r-- 1 sre sre 0 Aug 24 10:34 /home/sre/empty.txt
    
    Done — created `/home/sre/empty.txt` (0 bytes).    

Getting around that external_directory check looks trivial, though. You could ask it to run, e.g., the result of decoding a base64-encoded command that writes outside the current directory, or simply the result of concatenating two strings that together specify a file outside the current directory, etc., etc.