chore(config): add opencode.ai configuration file

[bgzo]

No description provided.

[bgzo]

PR Reviewer Guide 🔍

(Review updated until commit 8edc3a3)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns Broad agent permissions with no confirmation gates: the config auto-allows all bash commands except a few deletion prefixes (bypassable via find -delete, git clean, dd, shell redirection), allows reading external directories, and allows webfetch/websearch without prompting. Combined, this enables unattended reading of sensitive files outside the repository and exfiltration to external URLs, including via prompt injection from fetched web content. Since this file is committed, these permissions apply to any contributor running opencode on the repo.

⚡ Recommended focus areas for review Bypassable destructive-command guard The "*": "allow" fallback for bash means the agent can run any command without confirmation, so the "ask" rules only catch the exact rm/rmdir/shred/truncate prefixes. Equivalent destructive operations — e.g., find . -delete, git clean -fdx, dd, mkfs, or shell redirection like > file — execute silently. If the intent is to require confirmation before destructive actions, the wildcard should be "ask" (or the guarded list greatly expanded); otherwise the guard provides a false sense of safety while still committing a broadly permissive agent config for everyone using this repo. "bash": { "rm *": "ask", "rmdir *": "ask", "shred *": "ask", "truncate *": "ask", "*": "allow" Data exfiltration path read: "allow" plus external_directory: "allow" lets the agent read files outside the repo (e.g., ~/.ssh, ~/.aws/credentials, other projects' .env files), and webfetch: "allow" lets it send content to arbitrary URLs — all without prompts. A realistic trigger is prompt injection: the agent fetches a web page containing malicious instructions, then reads sensitive local files and posts them outward, with no confirmation step in the chain. This may be an intentional convenience trade-off, but given the high impact it is worth an explicit decision (e.g., set external_directory or webfetch to "ask"). "read": "allow", "edit": "allow", "glob": "allow", "grep": "allow", "list": "allow", "task": "allow", "external_directory": "allow", "todowrite": "allow", "question": "allow", "webfetch": "allow",

[github-actions]

Persistent review updated to latest commit 8edc3a3