feat: align permission defaults with Claude Code

[terisuke]

Summary

• Expands .opencode/opencode.jsonc permission config to mirror Claude Code's acceptEdits + allow-list model
• Adds pattern-based bash whitelist for common dev tools (git, gh, node, npm, bun, python, curl, docker, etc.)
• Adds explicit deny rules for dangerous operations (rm -rf, sudo, force-push, curl-pipe-sh)
• Adds .env/secrets deny rules for read and edit operations
• Sets glob/grep/list/websearch/webfetch/codesearch/lsp/task/skill to "allow"

Motivation

OpenCode's default permission config only specifies one deny rule (packages/opencode/migration/*), causing all other tool operations to fall through to "ask". This results in significantly more approval prompts compared to Claude Code, which has a broad allow-list and acceptEdits mode.

Closes #28

Test plan

• Start OpenCode TUI with updated config
• Verify read/edit/glob/grep operations proceed without prompts
• Verify bash commands (git, npm, bun, ls) auto-approve
• Verify dangerous commands (rm -rf, sudo) are blocked
• Verify .env file access is denied

🤖 Generated with Claude Code

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[Copilot]

Pull request overview

Updates the repository’s checked-in OpenCode configuration to reduce permission prompts by expanding .opencode/opencode.jsonc with a Claude Code–style allow/deny ruleset (broad allows for common tools, explicit denies for sensitive operations/files).

Changes:

• Expands permission.read / permission.edit defaults to allow-by-default with deny exceptions.
• Adds a pattern-based permission.bash whitelist for common dev commands plus targeted deny rules.
• Sets several non-file tools (glob/grep/list/websearch/webfetch/codesearch/lsp/task/skill) to "allow", while keeping external_directory at "ask".

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The PR description/test plan says .env access should be denied, but the bash whitelist includes cat * (and other file-reading tools). That allows cat .env without prompting/denial, bypassing the read/edit deny rules. If the intent is to block .env/secrets access, consider removing cat from the allow-list (leave it as ask) and/or adding explicit bash deny patterns for .env*/**/.env* and **/secrets/** (plus similar read utilities like head/tail).

Suggested change

	"cat *": "allow",
	"head *": "allow",
	"tail *": "allow",
	// File-reading commands must not bypass sensitive-file deny rules
	"cat .env": "deny",
	"cat .env.*": "deny",
	"cat **/.env": "deny",
	"cat **/.env.*": "deny",
	"cat secrets/**": "deny",
	"cat **/secrets/**": "deny",
	"head .env": "deny",
	"head .env.*": "deny",
	"head **/.env": "deny",
	"head **/.env.*": "deny",
	"head secrets/**": "deny",
	"head **/secrets/**": "deny",
	"tail .env": "deny",
	"tail .env.*": "deny",
	"tail **/.env": "deny",
	"tail **/.env.*": "deny",
	"tail secrets/**": "deny",
	"tail **/secrets/**": "deny",
	"cat *": "ask",
	"head *": "ask",
	"tail *": "ask",

[Copilot]

git push --force* won't match common force-push forms like git push origin main --force or git push --force-with-lease because the pattern requires --force immediately after git push. Since git * is allowed above, those commands would be allowed. Consider adding deny patterns such as git push * --force* (and potentially git push * --force-with-lease*) to reliably block force pushes.

Suggested change

	"git push --force*": "deny",
	"git push --force*": "deny",
	"git push * --force*": "deny",
	"git push * --force-with-lease*": "deny",

[Copilot]

The PR description says it adds .env/secrets deny rules for both read and edit, but edit only denies .env* patterns and does not deny secrets/** (or **/secrets/**). Either add the secrets deny patterns under edit as well, or update the PR description to match the actual behavior.

[Copilot]

In read, patterns like .env and .env.* are unlikely to match because the Read tool checks permissions against an absolute file path (e.g. /repo/.env). The **/.env* entries will work, but the non-globbed variants are effectively dead rules and can be misleading. Consider using patterns like *.env / *.env.* (as in the guardrails configs) or dropping the redundant entries to keep the rule set clear.