feat(opencode): home-manager-managed opencode config — generated AGENTS.md, env plugin, permissions, 3 subagents

[ZacxDev]

Brings opencode under home-manager, the way ~/.claude/ already is. Measured against opencode v1.18.4 on this host; no home-manager switch was run and the live ~/.config/opencode/ was never modified.

---

🔴 2bacd5f — the glob approach is replaced by a parser

Everything below the next horizontal rule describes the glob permission system and the two rounds of patching it. That approach has now been abandoned as the primary control, and this section says why and what replaced it. The rest of the PR body (generated AGENTS.md, the env.js correction, cost measurements, subagents) is unaffected and still stands.

The measurement that ended it

Two rounds of pattern-patching each closed the spellings we thought of and left the ones we did not. Replaying c1e4c02's own config through the resolver model, on the primary agent:

Command	Resolved at c1e4c02	Now
talosctl -n 192.168.50.94 reset	allow — a node wipe, no prompt	deny
talosctl --nodes 192.168.50.94 reset	allow	deny
talosctl --nodes=192.168.50.94 reset	allow	deny
talosctl -e 1.2.3.4 -n 5.6.7.8 reset	allow	deny
rm -f -r /	allow	deny
rm --recursive --force /	allow	deny
mke2fs /dev/sdc	allow	deny
mkswap /dev/sdd	allow	deny
git -C /tmp/x reset --hard	allow (on review)	deny

The ask block required the tool and the verb to be adjacent ("*kubectl delete*"), so any interleaved flag walked past it. The deny block had been given infix wildcards in the previous round; the ask block had not. "*rm -rf*" and "*mkfs*" each knew exactly one flag order and one binary name.

And on the review agent, git -C * diff* sits after its own "*": deny, and opencode's * is an unrestricted dotAll .* that crosses spaces — so the word "diff" anywhere in the argument text satisfied it. Verified by execution:

git -C <path> stash push -m 'wip on the diff'   -> RAN, and created a stash
git -C <path> stash push -m 'wip'               -> denied

A glob over full command text cannot express "this command wipes a node" — the set of spellings is unbounded. So the hard denies moved to something that parses.

The architecture

Layer 1 — opencode.jsonc globs: FRICTION. Broad ask on mutation families so a human sees the command. Now infix-tolerant (*kubectl*delete*), deliberately over-matching, and honest about being non-airtight. Shrunk from 73 rules to 64, and the header no longer claims the patterns catch everything.

Layer 2 — scripts/opencode/plugin/guard.js → scripts/claude-hooks/guard_core.py: ENFORCEMENT. Splits on ;/&&/||/|/&, strips VAR=… prefixes and sudo/doas/env/timeout/nice/… wrappers, recurses into bash -c '…' and eval, scans $( )/backtick bodies, and reasons about argv. Throws from tool.execute.before, which hard-blocks the call. ~26 ms per bash call.

One implementation, two harnesses, two named policy sets — guard_core.py is deployed by home-manager to both ~/.claude/hooks/guard_core.py (imported by bash-guard.py) and ~/.config/opencode/guard_core.py (resolved by the plugin relative to its own module URL).

Which hook — and whether ask is expressible

Measured on 1.18.4, this host, 2026-08-02, with a probe plugin in a sandbox OPENCODE_CONFIG_DIR:

• permission.ask is in the Hooks type and its output.status is typed "ask" | "deny" | "allow", so returning an ask decision looks expressible. It is not. The hook never fired in any probe — not on the allow path, and not on the ask path either (an ask rule under opencode run printed auto-rejecting without the hook logging a single line). A hook that does not run cannot upgrade an allow into an ask, which is the one thing a guard would need it for.
• tool.execute.before fired on every bash call, and throwing from it hard-blocks: opencode reports the thrown message to the model as a tool error and the command never runs. (The probe model then tried printf, type echo and a PROBE_THROW='' … re-spelling — every matching variant was blocked.)

So DENY is expressible from a plugin and ASK is not. Ask-grade families stay as globs, per the brief: globs are acceptable for friction, unacceptable as the only thing between the agent and an irreversible action.

Two further measurements worth recording: opencode run AUTO-REJECTS an ask (it prints auto-rejecting) — only the interactive TUI turns one into a prompt, while opencode debug agent --tool auto-approves it. So ask is friction for a human, never a control on an unattended agent. And tool.execute.before fires before the permission check.

Not verified: whether permission.ask fires in the interactive TUI. Driving the TUI was out of reach here, so the claim is scoped to headless opencode run and debug agent --tool.

🔴 Claude Code's behaviour is unchanged — and here is the proof

bash-guard.py becomes a thin adapter running the claude-code policy, which is frozen at the original six checks. It fires on every Bash call in every Claude Code session on both hosts, so this was treated as untouchable.

Evidence	Result
Existing test_bash_guard.py (unmodified)	113 PASS, 0 FAIL
Before/after decision matrix, 2,097-command corpus, OLD(c1e4c02) vs NEW	0 rows differ
Positive control: OLD vs OLD	0 diffs
Negative control: OLD vs OLD-with-check_git_add_all-removed	324 diffs — the harness can see a change
test_claude_code_policy_is_frozen_at_the_original_six	pins the six by name against a literal list, so a check added to the shared core cannot leak in
test_the_new_checks_do_not_leak_into_claude_code	pins the same thing by outcome for each new rule

The corpus is an outer product of blind/safe pathspecs × git global-option hops × wrapper prefixes, plus every new-check family across nine prefixes and every separator.

New checks — opencode policy ONLY, none reach Claude Code

• talosctl reset (any argv position — -n <ip>, --nodes, --nodes=, --talosconfig … -n … reset)
• mkfs / mkfs.* / mke2fs / mkswap / newfs / mkntfs / mkdosfs
• dd of=<block device> (/dev/null, /dev/zero, /dev/std*, /dev/fd/N remain allowed; reading a device with if= is allowed)
• rm -r of /, /*, ~, $HOME, ., .., or a top-level system dir
• git stash (list and show stay allowed — RULES calls stash list the safe diagnostic)
• git clean -f
• git reset --hard through a -C hop

🔴 One thing for you to veto or approve

git -C <path> reset --hard is a live gap in Claude Code right now. The frozen check_git_reset_hard is a raw-text regex anchored on \bgit\s+reset\b, so the worktree-first spelling RULES.md mandates does not match it. Measured: it passed the Claude Code guard at c1e4c02 and still does.

check_git_reset_hard_argv closes it and is enabled for opencode only. Turning it on for Claude Code is a one-line change (_CLAUDE_CODE_CHECKS.append(check_git_reset_hard_argv)) and is deliberately left to you, because it is a new deny on your primary tool. It is the only item on this list I would actually recommend adopting.

One deliberate loosening

The old glob "*rm -rf /*" also denied rm -rf /tmp/scratch, because * crosses /. With a parser the fatal set is exact, so an ordinary absolute-path cleanup now resolves to the broad rm -r ask instead of a deny. Recorded in check_rm_rf_critical's docstring so it is a decision rather than an accident.

The other audit 🔴s

• review.md — the writing verbs (stash, commit, push, reset, clean, checkout, restore, rebase, add -A, branch -D, worktree add|remove, rm , mv , >) are re-stated as denies after the allow-list, so last-match-wins makes them win. Scoped rather than blanket: an unscoped *merge*/*branch*/*add* would also block git log --merges, --branches and -S'add', and a reviewer that cannot read history invents findings. The agent prompt now tells the reviewer this over-block exists and not to route around it.
• browser-agent:136-137 — the command -v opencode preflight is hoisted above the bootstrap. Without opencode on $PATH, readlink -f resolved a bare string against cwd, the stamp could never match, oc_is_warm always failed, and _oc_bootstrap_locked took its "stale tree" branch and rm -rf'd node_modules out of the shared cache on every run — then failed to re-warm, leaving the dir cold. Reachable from systemd/cron/a switch.
• test_opencode_config.py:93 — pytest.importorskip("yaml") → a hard import yaml, and the false comment above it is replaced with what was actually measured (486 passed, 1 skipped, exit 0, with 384 assertions silently gone).
• Lock wait vs. the work it guards — was a fixed 30 s around a 90 s warm, so the loser force-stole the lock and rm -rf'd node_modules while the first process was still writing. Now derived from OC_WARM_TIMEOUT + 30 s.
• Interrupted warm stamped valid — [ -d node_modules ] alone is not completeness. Now requires the timeout not to have fired (rc != 124) and node_modules/@opencode-ai/plugin to resolve.
• browser-agent tests were substring greps — they now run against comment-stripped source, with a negative control proving the stripper works. One assertion ("--version" in src) was being satisfied by a comment saying the code deliberately does not use --version. Added: preflight-ordering, config-dir-is-not-the-live-one, complete-warm, and lock-wait tests.

Test discipline

Red/green. The new tests were run against a pre-change seed tree (c1e4c02's opencode.jsonc + review.md + browser-agent, guard degraded to the six): 175 failing there, 1,171 passing at HEAD.

That run earned its keep immediately — it caught a vacuous assertion in one of the new tests. test_browser_agent_checks_for_opencode_before_touching_the_cache matched the bare substring command -v "$OPENCODE_BIN", which also matches the copy inside oc_warm_version() at line ~136 — before the bootstrap even at c1e4c02. It passed against the exact ordering bug it was written to catch. It is now anchored on the || die preflight and is red on the seed.

Multi-spelling matrices, not one spelling per rule. The glob-era suite pinned one spelling per pattern — always the one the pattern was written around — which is precisely why it was blind. Every new rule is now exercised across an outer product of nine prefixes (bare, VAR=, sudo, sudo -n, doas, env VAR=, timeout N, nohup, KUBECONFIG=… sudo), each git global-option hop (-C, doubled -C, --git-dir=, --no-pager, -c k=v, -P), and each of the five separators plus bash -c / eval / $( ).

That matrix found a real bug in the first draft of the parser: sudo -n <cmd> peeled to the wrong argv, because -n had been put in a shared value-flag set for nice -n 5, so sudo -n talosctl reset became ['reset'] and the node-wipe guard silently stopped firing on the most ordinary sudo spelling there is. Fixed with per-wrapper arity tables plus _peel_variants, which branches on the other arity interpretation so a future table error cannot fail open.

Mutation-tested by an independently-constructed sweep (fe2e56e). 52 mutants, built deliberately unlike the suite they attack — pattern-narrowing mutants that keep the function, the policy entry and the deny action and change only what matches, plus parser, policy and off-by-one mutants. 39/50 killed, 11 survived, every kill by assertion (test counts were checked per run — no truncation, no collection errors scored as kills).

The sweep's own harness was broken on its first run: a helper-argument bug made all 52 "mutants" byte-identical to pristine, and the pre-flight "all mutants apply and parse" check passed because nothing was applied. Only the known-bad control caught it. Both controls now behave: the obvious mutant is killed (49 failures), the byte-identical control survives with counts matching pristine exactly.

All 11 survivors were holes in the test suite, not defects in guard_core.py — the code already handled each case; nothing pinned it. Closed in fe2e56e:

Survivor	Gap	Why it mattered
N16 / P14	no test used an absolute argv[0] or wrapper path	on NixOS /run/current-system/sw/bin/talosctl and /run/wrappers/bin/sudo are the normal spellings
P04	_peel_variants' arity branching was pure prose	it is the safety net the docstring says exists so a wrong flag table cannot fail open — the exact sudo -n class of bug
P13	bundled -c shells (bash -xc '…')	only bare -c was pinned
S08	the unlexable-input fallback in _tokenise	untested for every check, and reachable from any unbalanced quote
S09	cd <path> **;** git …	only the && spelling was pinned
S11	private-key headers other than RSA PRIVATE KEY	i.e. the wildcard that covers modern OPENSSH keys
N14	no test pinned any individual secret shape	deleting three sk-* patterns changed nothing
N15	only gh … create sinks	gh pr comment/edit/review could post a secret
S12	the public-IP arm was entirely unpinned	the check whose docstring says it exists because a real session leaked an ingress origin IP into a public-repo comment — exemptions unpinned too
S03	the -- boundary in _flags_and_operands	brute-forced over 1,102 shapes and confirmed currently safety-neutral, so pinned on the helper directly rather than through an outcome that does not depend on it

Three weak kills were also strengthened: N13 (check_git_reset_hard_argv was killed by exactly one test — a one-test-deep guard on its own headline case) and S01/S04 (killed only by over-block assertions, so relaxing those would silently un-cover them).

And the new coverage found one real code bug. The generated (wrapper, value-flag) matrix went red immediately on timeout -k talosctl reset and chrt -p talosctl reset: for a wrapper that takes positionals, the alternate arity branch still hit the positional consumption and swallowed the real command, so both peelings produced ['reset']. _peel_variants now branches on positional consumption too. Same class as the sudo -n bug, invisible for the same reason.

Claude Code was re-verified after that parser change: the 2,097-command matrix still differs on 0 rows and test_bash_guard.py is still 113/113.

Invariant guards are labelled as such (test_browser_agent_config_dir_is_not_the_live_one, test_browser_agent_warm_handles_races_staleness_and_failure, the harness negative controls) and are not counted as regression coverage.

Full hermetic suite: 4,230 passed, 1 skipped, 0 errors (scripts/run-tests.sh under nix-shell -p 'python312.withPackages(p:[p.pytest p.pyyaml p.psycopg2 p.requests p.minio])'). Test counts were read per-suite, not from an exit code. Note: scripts/mail-actions/tests and scripts/initiatives/tests fail only when psycopg2/minio are absent from the shell — with them present both are green.

Live end-to-end verification

Against a sandbox OPENCODE_CONFIG_DIR laid out exactly as home-manager deploys it (plugin/guard.js + ../guard_core.py), with the sandbox config set to bash {"*": "allow"} so only the guard could refuse anything:

Probe	Result
echo guard-negative-control (negative control)	ran
mkswap /dev/zzz-nonexistent-device	BLOCKED with the guard's message
talosctl --talosconfig /nonexistent-zzz -n 1.2.3.4 reset	BLOCKED — the flag-interleaved spelling that was allow at c1e4c02
echo hello with DEVRC_GUARD_CORE=/nonexistent/guard_core.py	refused — fail-closed confirmed

Harmless targets were chosen deliberately, so a guard failure could not have caused damage.

The review fix, verified through the task tool

opencode run --agent review silently falls back to build (review is a subagent), which invalidated an earlier probe matrix — so this was delegated properly via the task tool, in a throwaway git repo with a dirty tree, and with DEVRC_GUARD_DISABLE=1 so layer 1 (the globs) was tested in isolation:

Probe	Result	What it proves
ls -la	denied	we are genuinely in review — under the build fallback this runs. The discriminating negative control.
git -C <repo> log --oneline -3	ran (a24edc0 initial)	the git -C <path> … allow-list still works; the agent is not over-blocked into uselessness
git -C <repo> stash push -m "wip on the diff"	denied	the exact command that executed and created a stash at c1e4c02

git stash list in that repo: 0 before, 0 after.

What I could not verify

• Whether permission.ask fires in the interactive TUI — only headless opencode run and debug agent --tool were probed.
• Nothing was deployed: no home-manager switch was run, ~/.config/opencode/ and ~/.claude/ were not touched, and ~/.cache/browser-agent-opencode-config was left alone. The home-manager wiring is asserted by tests over home.nix and by checking every source = path exists, not by a switch.
• ask outcomes rest on the ported resolver model, not on execution: ask is auto-approved under --tool and auto-rejected under opencode run, so neither mode can distinguish it from allow/deny. Test docstrings say so.
• Coverage gaps the guard does not claim (documented in guard_core.py): ssh host talosctl reset, xargs-fed argv, and argv assembled from variables ($CMD reset). The command text does not carry those values. The broad ask globs still apply to them.

---

🔴 Correction — the original permission claims in this PR were too strong

The first version of this PR described the permission block by reading the config, not by resolving it. An adversarial audit resolved it with opencode debug agent, and three of the four load-bearing guarantees did not hold. c1e4c02 fixes them. Recording it plainly, because the wrong version read as thorough:

Claimed	Actually measured
""*": "allow" is first and every deny/ask follows it, so the denies apply"	True of the global block, and irrelevant on k8s — its agent-level bash: {"*": allow} is appended after all 30 global rules and nullified every one of them
"plan is genuinely read-only"	Its built-in task: {general: deny} had been flipped to allow by the global task: allow, so plan could reach a shell by delegating to general
"the tests pin the ordering for exactly this reason"	Both mutations that matter — a trailing "git *": "allow" and an alphabetical key sort — passed at 82/82
"opencode's bash tool does not source zsh startup files"	False on this host. The tool shell IS zsh (ZSH_VERSION = 5.9 inside a bash tool call) and it does source .zshenv

The AGENTS.md, cost-measurement and subagent sections below were re-checked and stand.

What was wrong, and what it meant

1. The k8s agent nullified the entire global bash block. Agent rules are appended AFTER the global ones, and opencode is last-match-wins over one flat array. k8s's bash: {"*": allow} landed at index 74 — after all 30 global rules — so only its own 4 survived. On that agent, blind-staging, git stash, hard-reset, rm -rf ~…, sops -d, nixos-rebuild and home-manager switch were all plain allow.

Fix: the agent block now only ever TIGHTENS — no wildcard at all (the global one already keeps bash enabled), just *talosctl*: ask with *talosctl reset*: deny restated after it so last-match-wins cannot re-open it.

2. The global block re-enabled every tool on the hidden title/summary/compaction agents. Their stock tool set is empty (verified against a bare config dir: enabled=[]). Listing tools in the global permission block appended them to these agents too, giving all three bash, edit, glob, grep, read, skill, task, todowrite, webfetch, write. compaction runs automatically on every context overflow, on the cheap model, on a path nobody watches — so this handed it a shell and a writer, and made every title generation carry the ~3,730-token skill catalogue.

Fix: each carries an explicit "permission": {"*": "deny"}. All three now resolve enabled=[], matching the stock control.

3. Every deny/ask was bypassable by a prefix or a wrapper. opencode matches a command node's full text, so an anchored "git stash*" misses FOO=1 git stash, sudo -n git stash and git -C /tmp stash. That is acute here because the house style mandates the bypassing spelling — k8s.md says to write KUBECONFIG=$KC_HOMELAB kubectl …, RULES.md says to write git -C <path> ….

Fix: every dangerous pattern is leading-*. Confirmed against the real engine that * compiles to an unrestricted dotAll .* crossing spaces, / and -, so *git*stash* catches all four spellings. (&& chains and pipelines are already checked per-command, so only the prefix/wrapper case needed closing.)

4. The ordering tests were vacuous. A key-order assertion cannot catch an alphabetical sort, because "*" (0x2A) sorts to the front — the wildcard still looks correct while everything else reorders and a broad ask overtakes the narrow deny it should lose to.

Fix: added the missing "no allow after the wildcard" and "all asks precede all denies" assertions, and — the real protection — a faithful port of opencode's resolver (findLast over the flat array + its glob→regex) that pins the effective resolved action for a matrix of dangerous commands on every agent.

Also fixed

• Dropped the blanket read: allow. opencode ships a built-in .env guard (*.env → ask at index 25-27); the blanket allow landed at index 30 and silently defeated it on every agent. The default already allows every non-.env read.
• Restored plan's task: {general: deny} and added write: deny.
• Closed ~30 unlisted command families: kubectl get/describe secret (base64 = plaintext), exec/cp/edit/replace/rollout undo, flux delete, helm rollback, sops exec-env, age -d, sudo/doas as wrappers, recursive chmod/chown, dd/mkfs, mutating systemctl verbs, nix profile remove, git checkout -- /restore/branch -D/push --force, talosctl upgrade/apply-config/shutdown, and the . / $HOME delete targets.
• review could not run git -C <path> diff — resolved DENY. In the worktree-first workflow RULES.md mandates, that is the only spelling a reviewer uses, so it silently fell back to read/grep and reported a review it had never performed. The git -C * <verb>* forms are now allow-listed, deliberately anchored (a leading-* allow there would punch a hole through the global deny block).
• The browser-agent config dir existed but was EMPTY — byte-for-byte the cold-start this change exists to avoid. Added a warm/bootstrap step; details below.
• env.js was a checked-in file hardcoding /home/zach/workspace/homelab-talos, with no existence guard, duplicating programs/zsh and defining a KC_PROD zsh lacked. Both are now generated from one source (nix/agent-handles.nix); KC_PROD is reconciled into zsh.

🔴 Correction: why the env.js plugin exists

The claim that "opencode's bash tool does not source zsh startup files" is false here. With the plugin absent and VITEST_MAX_WORKERS explicitly unset in the parent, a bash tool call still reported 4 — a value set only by .zshenv — and ZSH_VERSION reported 5.9.

The original negative control ("with the plugin present $KC_HOMELAB resolves; with it absent it is empty") was real but misattributed. The kubeconfigs are gitignored and absent from the checkout, so zsh's existence guard correctly declines to export KC_HOMELAB — while the old unguarded env.js exported it regardless. The plugin looked load-bearing because it was pointing a handle at a file that does not exist — precisely the "runs against no cluster while looking like it worked" failure k8s.md warns about.

The plugin is kept as belt-and-braces (it is independent of $SHELL), and now existence-guards exactly as zsh does. The "169 hand-retyped KUBECONFIG=" motivation is unaffected.

---

What each item does

1 — generated ~/.config/opencode/AGENTS.md. Built at switch time by concatenating claude/PRINCIPLES.md + claude/RULES.md + claude/opencode-addendum.md.

It has to be a concatenation: opencode does not expand @-imports in AGENTS.md/CLAUDE.md. Proven with an all-tools-denied agent, so no file read was possible — an imported passphrase returned NONE, the same content inline returned verbatim. ~/.claude/CLAUDE.md is ~1.5 KB of import lines, so opencode reading it would receive none of the 32 KB of rules. A project AGENTS.md also suppresses CLAUDE.md (first match wins).

Measured: 38,363 B (37.5 KB) ≈ 8.9k tokens (previously stated as 38,033 B — stale). Tests enforce a 100 KB ceiling; a 331 KB file causes a permanent compaction loop.

2 — generated plugin/env.js. From nix/agent-handles.nix, the single source of truth that also generates the zsh exports. Existence-guarded. Deployed as a single file — the glob is {plugin,plugins}/*.{ts,js}, non-recursive, and a .mjs will not load.

3 — opencode.jsonc. Model + small_model; the hidden agents pinned to flash and tool-denied; plan made genuinely read-only; compaction/tool_output/watcher/subagent_depth; autoupdate: false, share: "disabled".

The bash block is ordered "*": allow → every ASK → every DENY. Deny-last is load-bearing: it is what lets a narrow *talosctl reset*: deny beat a broad *talosctl*: ask.

4 — three subagents. nav (read-only navigator, bash denied), k8s (three clusters, read-before-mutate, commit-to-trunk-is-a-deploy), review (adversarial). Deliberately only three — every subagent permanently enlarges the primary's task tool description on every request. (The addendum previously said "there is deliberately no third agent" while three shipped; corrected, and review is now described to the primary agent.)

There is no list tool and no websearch tool on 1.18.4; both dead keys are removed.

---

browser-agent: isolation was right, warming was missing

The global AGENTS.md does reach browser-agent's scratch-dir runs — a tool-less probe in an unrelated scratch dir quoted a passphrase planted at the end of the file.

Condition	Passphrase	Input tokens
Isolated config dir (control)	NONE	631 / 631
Global AGENTS.md present	quoted verbatim	8,343 / 8,422
+ OPENCODE_DISABLE_CLAUDE_CODE=1	quoted verbatim	8,340 — zero effect
+ project-local AGENTS.md	both passphrases	8,408 — went up (concatenated)

cache.read/cache.write were 0 in every run, so it is multiplied by $STEPS (default 12): up to ~90k tokens per run.

But the dir shipped EMPTY (ls -A → 0 entries), which is exactly the cold-start case. Fixed with a warm/bootstrap step:

• 🔴 Verified by outcome, not exit code. debug paths, debug config, debug skill, debug v2 and even debug agent from a plain directory all exit 0 in ~1.2 s and install nothing. Only resolving a project's .opencode/tools/ (browser.js imports @opencode-ai/plugin) triggers the 62 MB install. A warm step using a bare debug command would have looked successful and left the dir just as cold.
• Concurrency: an atomic mkdir lock with a bounded wait. 4 simultaneous cold runs all succeed, one warms, no lock leak.
• Staleness: stamped with the resolved binary identity (on nix the store path encodes the version). Deliberately not opencode --version — that is an extra process, and it lands in the test rig's invocation log.
• Failure: degrades to the global config loudly on stderr rather than hanging. Costly but working beats broken.
• Isolation drops autoupdate:false, share:"disabled" and the tool_output caps. Decision: re-state all three in the isolated dir (no self-update mid-run; a browser session must never be shareable; a page dump is exactly the huge tool result those caps exist for). Deliberately not copied: the permission block, agent/, plugin/ and AGENTS.md — those are the cost this exists to shed, and the agent denies every host tool anyway.

Measured: cold 7.0 s, warm 0.73 s, stale stamp → clean re-warm 5.2 s, unwritable dir → loud degrade.

The browser-agent tests now pin their own OPENCODE_CONFIG_DIR — without it the new bootstrap would judge the operator's real warmed cache stale and rm -rf it as a side effect of running the suite.

---

Verification

Suite: 82 → 384 tests. 162 are red at e353841 and green at HEAD, covering every finding.

Mutation matrix (each applied to a copy, whole suite re-run, tests counted — never a bare exit code):

Mutation	Old suite	New suite
control (no mutation)	82 passed	384 passed
trailing "git *": "allow"	82 passed — survived	RED 37 failed (test_no_allow_rule_follows_the_wildcard + effective-action)
alphabetical key sort	82 passed — survived	RED 15 failed (test_all_asks_precede_all_denies; sudo -n git stash deny→ask)
re-add "*": allow to k8s	n/a	RED 52 failed
de-star *git*stash* → git stash*	n/a	RED 9 failed
restore read: allow	n/a	RED test_no_blanket_read_allow
drop compaction's permission	n/a	RED test_hidden_agents_are_pinned_and_tool_less
drop plan's task deny	n/a	RED test_plan_agent_is_genuinely_read_only
drop review's git -C * allows	n/a	RED 4 failed
move a deny above the asks	n/a	RED 5 failed
negative control (drop *git*stash*)	RED 1	RED 13

Each fails with its own assertion, not a collateral parse error (errors=0 throughout). The harness itself was validated against a known-bad state first — the negative control turns it red.

Real-engine probes. opencode debug agent <a> --tool bash performs a genuine permission check. All 18 deny cases pass on build, k8s and review, including every prefix/wrapper form, with 3 allow controls. Every probe is inert if executed (destructive ones are probed in echo <cmd> form, which still exercises the leading-* pattern).

F3 bypass matrix — before → after (real engine)

Command	Before	After
git stash	deny	deny
FOO=1 git stash	ALLOW	deny
sudo -n git stash	ALLOW	deny
git -C /tmp stash	ALLOW	deny
git -C /tmp reset --hard	ALLOW	deny
FOO=1 git add -A	ALLOW	deny
KUBECONFIG=… talosctl reset	ALLOW	deny
sudo rm -rf /…	ALLOW	deny
KUBECONFIG=… kubectl delete pod x	ALLOW	ask
kubectl get secret x -o yaml	ALLOW	ask

Resolved enabled= for the hidden agents: title / summary / compaction → [] (stock control: []; before this commit: 10 tools each).

Full repo gate (scripts/run-tests.sh): green except scripts/mail-actions/tests (3 failures, missing minio) — identical at e353841, pre-existing and unrelated.

What I could NOT verify

• No home-manager switch was run. The nix now evaluates (nix eval renders the generated env.js and the zsh envExtra in full, and the generated plugin was loaded into a sandbox and confirmed to inject handles against a scrubbed environment), but activation and the resulting symlinks are unverified against a real switch.
• ask cannot be distinguished from allow by the executing prober. In debug agent --tool (non-interactive) an ask is auto-approved — proven by a 3-way control (allow/ask/deny on the same pattern → ALLOW/ALLOW/DENY). So the ask rows are pinned by the resolver model, validated against the real engine on the semantics that decide them, not by execution.
• The resolver model does not implement the shell-AST split. opencode matches each command node separately and denies if any node denies; the model matches a single node. Chains are therefore safer than the model suggests, never less safe — but no test asserts chain behaviour.
• No end-to-end browser-agent run (needs a live tab + token spend). The warm/bootstrap path was exercised directly; the browser tool's runtime behaviour under isolation is not re-verified here.
• Offline warm behaviour is inferred, not re-measured — the 62 MB install was observed to require network on this host as-is; I did not re-test with the network down.
• Kubeconfigs are absent from this checkout (gitignored), so KC_HOMELAB/KC_WORKBENCH/KC_PROD resolve to unset under the new existence guard. That is correct behaviour and matches zsh, but it means the guarded handles could not be observed resolving to a real file.
• Known limitation, now documented: session "always allow" approvals are concatenated after the config ruleset, so an in-session always-allow outranks a config deny, and the auto-generated pattern is arity-derived (approving git -C /tmp stash once would install git -C *). Not fixable in config.

🤖 Generated with Claude Code