fix: defer OpenCode permission policy to local config

[danshapiro]

Summary

Freshell now defers OpenCode permission policy to the OS user's local OpenCode configuration instead of injecting Freshell-specific OpenCode permission overrides. Claude and Codex permission behavior is unchanged.

• Terminal OpenCode panes no longer set the OPENCODE_PERMISSION env var or add a permission-mode CLI arg. Removed the permission metadata from the built-in CLI manifest (extensions/opencode/freshell.json) and the fallback seed in server/terminal-registry.ts.
• Freshopencode panes (fresh-agent provider opencode) no longer carry or transmit permissionMode — not in picker-created content, resumed content, or freshAgent.create/freshAgent.send messages. The Freshopencode registry entry hides the permission control (settingsVisibility.permissionMode: false).
• Freshopencode runs no longer pass --dangerously-skip-permissions to opencode run, so runs honor the user's local OpenCode policy.
• OpenCode model, resume, server endpoint, renderer, scroll-input, session discovery, and MCP behavior are untouched.
• README documents that OpenCode permissions are owned by the OS user's OpenCode config, with OS filesystem permissions as the hard boundary.

Implemented task-by-task via TDD (Red→Green) with per-task spec + code-quality review and a final holistic review.

Notes for reviewers

• Non-interactive opencode run: correctness now depends on the user's local OpenCode config being non-interactive-friendly for the Freshopencode JSON flow. The adapter closes stdin and has a run timeout backstop, so the server won't hang — but a send could error for users whose OpenCode config demands interactive approval. This is the intended tradeoff (policy moves to the OS user's config).
• Guard mechanism inconsistency (latent, harmless today): the pane-content builders suppress permissionMode via the registry settingsVisibility.permissionMode === false flag, while FreshAgentView suppresses via a provider === 'opencode' check. They agree today (opencode is the only provider with the flag false); a future non-opencode provider setting the flag false would diverge. Candidate for a small follow-up to unify on the registry flag.
• The generic/provider-agnostic extension permission-mode plumbing is intentionally retained (still used by Claude); two unit-test fixtures were renamed from OPENCODE_PERMISSION to a neutral AGENT_PERMISSION_MODE to decouple the generic-mechanism tests from the OpenCode product decision.

Test Plan

• npm run check (typecheck + coordinated full suite) green: server config 228 passed / 1 skipped, client config 3731 passed.
• Focused plan tests pass across both vitest configs (default + server).
• Repo scan confirms no OPENCODE_PERMISSION / --dangerously-skip-permissions in extensions/, server/, src/, or test/unit product paths (only intentional negative assertions, README prose, and the upstream-CLI test/integration/real probe remain).
• Manual: launch a terminal OpenCode pane and confirm no OPENCODE_PERMISSION in its environment; run a Freshopencode send and confirm it honors local OpenCode config.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a51c2737d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle ask-mode OpenCode permissions

When the OS user's OpenCode config contains any permission: "ask" rule (including the documented external_directory/doom_loop defaults), this headless opencode run --format json path now relies on OpenCode prompting for approval after the removed auto-approval flag, but runCli closes stdin immediately and this adapter does not implement resolveApproval. OpenCode documents ask as prompting for approval and --dangerously-skip-permissions as auto-approving non-denied permissions, so Freshopencode sends will hang until timeout or fail whenever a valid local policy requires approval; either reject unsupported ask policies clearly or wire OpenCode approval events through the existing Freshell approval UI.

Useful? React with 👍 / 👎.