feat(hook): opencode hook should add prefixed versions of the rewritten commands

[mmfallacy]

Summary

• The OpenCode plugin hook now carries configured bash permissions over to commands rewritten with the rtk prefix.
• This would allow rtk users to use rtk rewritten commands without explicitly adding a per-command rtk prefixed rule entry, or even a broad unsecure rtk *: allow

Closes #4195

Test plan

Sample permissions for my staged-review agent:

permission:
  ...
  bash:
    "*": deny
    "git status": allow
    "git status *": allow
    ...
---

Behavior

Before:

git status fallback did not run as it got rewritten by the hook.

After:

opencode debug agent staged-review also reflects the added prefixed permission entries when the hook modification is active.

• cargo fmt --all && cargo clippy --all-targets && cargo test
• Manual testing: rtk <command> output inspected

Did not edit rust related files, nor added a command hence these aren't run

Important: All PRs must target the develop branch (not master).
See CONTRIBUTING.md for details.

[CLAassistant]

All committers have signed the CLA.

[rtk-wshm-sync-bot]

wshm · Automated triage by AI

📊 Automated PR Analysis

🐛 Type	bug-fix
🟢 Risk	low

Summary

This PR modifies the OpenCode plugin hook so that when a bash command is rewritten with the rtk prefix, the corresponding bash permission entries are also carried over with the prefixed pattern. This keeps OpenCode's permission decisions consistent with the original (unprefixed) rules after rewriting, addressing a case where a fallback command like git status failed to run because the rewritten rtk git status had no matching permission rule.

Review Checklist

• Tests present
• Breaking change
• Docs updated

Linked issues: #4195

---

Analyzed automatically by wshm · This is an automated analysis, not a human review.

[KuSh]

Thanks for working on this, @mmfallacy.

#4349 is merged and covers the root-level case a different way: rtk hook opencode judges the command as typed against OpenCode's own rules and returns no rewrite when it would change the verdict, so nothing is added to the user's config.

What this PR still does that develop does not is the agent-scoped case. On OpenCode 1.18.34, with agent.build.permission.bash = {"*": "deny", "git status": "allow"}, develop denies git status (OpenCode evaluates rtk git status), and this branch's config hook lets it through. #4195 stays open for that.

I'm closing this one because OpenCode 2.0 hands tool.execute.before the agent name ({tool, sessionID, agent, ...}, checked in the 2.0.22 binary), where 1.x does not. A 2.0 plugin can pass --agent to rtk hook opencode, which already reads agent.<name>.permission, and that also covers structural rewrites like head -n 5 f → rtk read, which a prefixed-rule approach cannot. I did not find a config hook among 2.0.22's plugin trigger points. 1.x agent-scoped rules stay uncovered that way.

If you would rather keep this open for 1.x, feel free to reopen it; the branch conflicts with develop in hooks/opencode/rtk.ts and the two docs files.