From fc8db6cdf9cb81e29c5dda69c8646aa52e453a9c Mon Sep 17 00:00:00 2001
From: Aiden Cline <aidenpcline@gmail.com>
Date: Tue, 28 Oct 2025 17:32:39 -0500
Subject: [PATCH] fix: ensure timeout param passed to bash tool is positive

---
 packages/opencode/src/tool/bash.ts | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/packages/opencode/src/tool/bash.ts b/packages/opencode/src/tool/bash.ts
index 6a7af381..2c377ee1 100644
--- a/packages/opencode/src/tool/bash.ts
+++ b/packages/opencode/src/tool/bash.ts
@@ -27,7 +27,9 @@ const parser = lazy(async () => {
     return p
   } catch (e) {
     const { default: Parser } = await import("web-tree-sitter")
-    const { default: treeWasm } = await import("web-tree-sitter/tree-sitter.wasm" as string, { with: { type: "wasm" } })
+    const { default: treeWasm } = await import("web-tree-sitter/tree-sitter.wasm" as string, {
+      with: { type: "wasm" },
+    })
     await Parser.init({
       locateFile() {
         return treeWasm
@@ -55,6 +57,11 @@ export const BashTool = Tool.define("bash", {
       ),
   }),
   async execute(params, ctx) {
+    if (params.timeout !== undefined && params.timeout < 0) {
+      throw new Error(
+        `Invalid timeout value: ${params.timeout}. Timeout must be a positive number.`,
+      )
+    }
     const timeout = Math.min(params.timeout ?? DEFAULT_TIMEOUT, MAX_TIMEOUT)
     const tree = await parser().then((p) => p.parse(params.command))
     const permissions = await Agent.get(ctx.agent).then((x) => x.permission.bash)
@@ -97,7 +104,10 @@ export const BashTool = Tool.define("bash", {
 
       // always allow cd if it passes above check
       if (command[0] !== "cd") {
-        const action = Wildcard.allStructured({ head: command[0], tail: command.slice(1) }, permissions)
+        const action = Wildcard.allStructured(
+          { head: command[0], tail: command.slice(1) },
+          permissions,
+        )
         if (action === "deny") {
           throw new Error(
             `The user has specifically restricted access to this command, you are not allowed to execute it. Here is the configuration: ${JSON.stringify(permissions)}`,