fix(opencode): show what an OpenCode permission is for, safely

[Juliusolsson05]

Problem

#878 (release blocker). With OpenCode bundled, the structured runtime's permission modal said "OpenCode is requesting permission." with no subject, so users approved bash: ls -1 blind, and the question modal showed no question. The parsers didn't match the payload OpenCode actually sends.

Implemented

• Package: bump opencode-headless to 62440add (fix(permissions): read permission and question subjects from the 1.18.30 payload opencode-headless#14, reviewed and merged). One shared subject parser, tested on recorded 1.18.30 streams:
  • bash shows the whole command (metadata.command), so cd x && … or export …&& prefixes can't hide;
  • other kinds show permission: patterns;
  • questions read questions[].question.
• Modal (views.tsx): the subject is now populated for the first time, so render it safely:
  • the command goes in a bounded, scrolling, wrapping <pre>, untruncated, because this modal is the only place the user sees it. A 100-line heredoc can no longer push the buttons off-screen while the auto-focused "Allow once" answers Enter;
  • "Allow always covers …" is spelled out from the payload's own always list, with an explicit warning when it is * (edit, write and MCP asks mean every such request for the session). OpenCode's own UI confirms this scope; ours showed nothing.

Verification (fail-first, recorded input)

• opencodePermissionView.renderer.test.tsx replays the recorded OpenCode 1.18.30 stream through the bumped package's real EventDispatcher into the real view. It asserts the subject is in the scroll container, the recorded always scope (ls *) is shown, and a derived 60-line heredoc renders in full.
• Before the fix: 3/3 failed. The subject arrived, which proves the package bump end to end, but it was inline (SPAN) with no scope.
• After the fix: 3/3 pass. The OpenCode renderer and unit suites are green (unit 39/39), and tsc -b is clean.

Follow-up

Questions are now visible but can only be rejected; answering them is a separate issue: #1025

🤖 Generated with Claude Code

[Juliusolsson05]

Review round 1 (independent): CHANGES REQUESTED → resolved in 48bce88a:

1. Medium-High, fixed: default OpenCode permissions ask external_directory for shell commands, so the modal now also shows the command from metadata.command whenever the subject does not contain it. Fail-first test on the recorded ask, reshaped to that default-permission shape.
2. Fixed: the Allow-always reach now matches OpenCode's own wording: this agent and its subagents, until this agent restarts. The permission is named, and the wildcard case reads "every request". Tested.
3. Fixed: the * warning is tested.
4. Fixed: the question body is bounded and scrollable, so Reject stays on screen. Tested with the recorded question stream.
5. Fixed: the scope line has break-words, and the unused data attribute is removed. The tests read the recording shipped in the bumped package.

• Deferred with an issue: bidi/format-character spoofing, app-wide: bug(security): bidi/format control characters can spoof the command shown in approval modals #1029.
• Not changed: the newline-padding hint (the always-visible scrollbar plus the scope line mitigate it), and the interpreter-prefix warning (python3 *), which matches OpenCode's UI.

Renderer suite 6/6; tsc -b clean.