fix(permissions): read permission and question subjects from the 1.18.30 payload

[Juliusolsson05]

Problem

Juliusolsson05/agent-code#878. The structured runtime's permission modal showed no subject, so users approved bash: ls -1 blind, and the question modal showed no question. OpenCode is bundled in Agent Code now, so this is on the default path and a release blocker.

The payload shape (permission, patterns, metadata.command, an object tool, and questions[].question) is present since at least 1.14 and is recorded on 1.18.30. Neither parser matched it:

• the dispatcher's first-non-null walk stopped at the object tool;
• the pending-request builder had no key that exists in this shape.

Implemented

src/permissions/subject.ts is one parser, shared by the dispatcher (the modal) and OpencodeHeadless (the pending request).

• bash shows the whole metadata.command, the same as OpenCode's own UI ($ <command>). patterns skips cd/pushd/export, so building the subject from it can hide part of what runs.
• Other kinds show permission: patterns, for example edit: src/a.ts or webfetch: <url>.
• A wildcard-only ["*"] (MCP, todowrite, lsp) shows the tool name alone.
• Questions read questions[].question, one line per question.
• Legacy keys stay as string-only fallbacks for 0.x servers, so an object can never shadow a later key again.

Verification

• Replays of recorded OpenCode 1.18.30 SSE streams (testing/fixtures/live-1.18.30, provenance in its README) run through the real EventDispatcher and channels. On the unfixed code, the modal title and the question text were undefined.
• Correction to the first version of this body: the test-only commit fails with Cannot find module './subject.js'. The subject failures quoted there came from running the new test against a stub.
• Two more cases are derived from the recorded event by a visible transformation: a compound cd … && npm test command, and an MCP ["*"] ask. Both failed first.
• Package suite 19/19; tsc --noEmit and test:contract are clean.
• Not tested, stated honestly: the legacy 0.x fallbacks. No recording of a 0.x server exists, and a hand-typed payload would only test my own guess. Also untested: that OpencodeHeadless.handleSseMessage calls the shared function. It is a direct import, but no test drives the SSE handler.

Review (independent, round 1) → resolved

1. Fixed: the bash subject could hide part of the command. It is the full command now.
2. Fixed: the wildcard-only subject.
3. Fixed: the inaccurate WHY comment and PR claims.

Three app-side follow-ups ship in Agent Code's submodule-bump PR:

• a long command must scroll inside the modal, not push its buttons off-screen;
• "Allow always" must show its real scope;
• questions are now visible but still cannot be answered. That one becomes its own issue.

🤖 Generated with Claude Code