From b8736917e575552d09db5388d7652bae64d4335f Mon Sep 17 00:00:00 2001
From: Alex Alecu <a.marian.alexandru@gmail.com>
Date: Mon, 27 Apr 2026 17:41:51 +0300
Subject: [PATCH] fix(cli): deny sort output flag

---
 packages/opencode/src/kilocode/agent/index.ts                 | 2 ++
 packages/opencode/test/kilocode/ask-agent-permissions.test.ts | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/packages/opencode/src/kilocode/agent/index.ts b/packages/opencode/src/kilocode/agent/index.ts
index f122a4cc6ae..e591545429a 100644
--- a/packages/opencode/src/kilocode/agent/index.ts
+++ b/packages/opencode/src/kilocode/agent/index.ts
@@ -118,6 +118,8 @@ export const readOnlyBash: Record<string, "allow" | "ask" | "deny"> = {
   "* >| *": "deny",
   "sort -o *": "deny",
   "sort * -o *": "deny",
+  "sort --output*": "deny",
+  "sort * --output*": "deny",
 }
 
 function askGuard(mcp: Record<string, "allow" | "ask" | "deny"> = {}) {
diff --git a/packages/opencode/test/kilocode/ask-agent-permissions.test.ts b/packages/opencode/test/kilocode/ask-agent-permissions.test.ts
index dc80b61c2ac..ee9a60f2ea0 100644
--- a/packages/opencode/test/kilocode/ask-agent-permissions.test.ts
+++ b/packages/opencode/test/kilocode/ask-agent-permissions.test.ts
@@ -114,6 +114,8 @@ describe("Ask agent bash permissions", () => {
       "cat a > b",
       "jq . a.json > b.json",
       "sort names.txt -o names.txt",
+      "sort --output=names.txt names.txt",
+      "sort names.txt --output=names.txt",
     ]
 
     for (const cmd of denied) {