diff --git a/packages/opencode/src/tool/bash.ts b/packages/opencode/src/tool/bash.ts
index 0e18525d..9d84ac7f 100644
--- a/packages/opencode/src/tool/bash.ts
+++ b/packages/opencode/src/tool/bash.ts
@@ -7,7 +7,8 @@ import { Config } from "../config/config"
 import { Filesystem } from "../util/filesystem"
 import path from "path"
 import { lazy } from "../util/lazy"
-import { minimatch } from "minimatch"
+import { Log } from "../util/log"
+import { Wildcard } from "../util/wildcard"
 
 const MAX_OUTPUT_LENGTH = 30000
 const DEFAULT_TIMEOUT = 1 * 60 * 1000
@@ -85,7 +86,9 @@ export const BashTool = Tool.define("bash", {
       if (!needsAsk && command[0] !== "cd") {
         const ask = (() => {
           for (const [pattern, value] of Object.entries(permissions)) {
-            if (minimatch(node.text, pattern)) {
+            const match = Wildcard.match(node.text, pattern)
+            Log.Default.info("checking", { text: node.text, pattern, match })
+            if (match) {
               return value
             }
           }
diff --git a/packages/opencode/src/util/wildcard.ts b/packages/opencode/src/util/wildcard.ts
new file mode 100644
index 00000000..58448f1a
--- /dev/null
+++ b/packages/opencode/src/util/wildcard.ts
@@ -0,0 +1,13 @@
+export namespace Wildcard {
+  export function match(str: string, pattern: string) {
+    const regex = new RegExp(
+      "^" +
+        pattern
+          .replace(/[.+^${}()|[\]\\]/g, "\\$&") // escape special regex chars
+          .replace(/\*/g, ".*") // * becomes .*
+          .replace(/\?/g, ".") + // ? becomes .
+        "$",
+    )
+    return regex.test(str)
+  }
+}