Fix permission rule ordering per opencode v1.1.1+ best practices
Follow opencode v1.1.1+ pattern: catch-all rule first, specific overrides after.
Last matching rule wins, so specific rules override the catch-all.
Changes:
- TestEngineer: Move '*': deny to FIRST (was at end, breaking allows)
- BuildAgent: Move '*': deny to FIRST (was at end)
- RepoManager: Add '*': ask as FIRST rule (was missing catch-all)
- OpenCoder: Add '*': allow as FIRST + change 'rm -rf *' to 'rm -rf /*'
- OpenAgent: Add '*': ask as FIRST + remove redundant 'rm -rf *'
Permission strategy by agent:
- OpenCoder: '*': allow (dev-focused, needs speed)
- OpenAgent: '*': ask (universal, needs caution)
- RepoManager: '*': ask (meta operations, needs approval)
- TestEngineer/BuildAgent: '*': deny (subagents, specific allows only)
References:
- https://opencode.ai/docs/permissions
- Issue #164
darrenhinde