From 84d259edda6a482c9d5a4d146c38c18ebf00c8ad Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Fri, 16 Oct 2026 23:34:28 +0100
Subject: [PATCH] =?UTF-8?q?fix(novel):=20make=20the=20pack=20headless-capa?=
 =?UTF-8?q?ble=20=E2=80=94=20bash=20allowed,=20destructive=20commands=20de?=
 =?UTF-8?q?nied?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OpenNovelAgent and Importer had bash "*": "ask", which opencode cannot prompt for
in `opencode run` — every tool call was auto-rejected, so the pack only worked in
the interactive TUI or with --dangerously-skip-permissions.

Both now allow bash by default and deny the dangerous commands explicitly
(rm -rf, sudo, mkfs, diskutil, shutdown, reboot). The other eight agents keep
bash: "deny" on purpose: they are note-editing subagents that read and write
through opencode's file tools and never need a shell.

Approval is now expressed as denies for the irreversible commands rather than a
gate on every command.
---
 novel/.opencode/agent/Importer.md       | 9 ++++++++-
 novel/.opencode/agent/OpenNovelAgent.md | 6 +++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/novel/.opencode/agent/Importer.md b/novel/.opencode/agent/Importer.md
index 0aa691e..ae873e8 100644
--- a/novel/.opencode/agent/Importer.md
+++ b/novel/.opencode/agent/Importer.md
@@ -5,7 +5,14 @@ mode: subagent
 temperature: 0.2
 permission:
   bash:
-    "*": "ask"
+    "*": "allow"
+    "rm -rf *": "deny"
+    "rm -rf /*": "deny"
+    "sudo *": "deny"
+    "mkfs*": "deny"
+    "diskutil *": "deny"
+    "shutdown *": "deny"
+    "reboot*": "deny"
   edit:
     "**/*.md": "allow"
     "**/DATA/**": "allow"
diff --git a/novel/.opencode/agent/OpenNovelAgent.md b/novel/.opencode/agent/OpenNovelAgent.md
index 0986264..abf86bd 100644
--- a/novel/.opencode/agent/OpenNovelAgent.md
+++ b/novel/.opencode/agent/OpenNovelAgent.md
@@ -6,10 +6,14 @@ temperature: 0.8
 permission:
   question: "allow"
   bash:
-    "*": "ask"
+    "*": "allow"
     "rm -rf *": "deny"
     "rm -rf /*": "deny"
     "sudo *": "deny"
+    "mkfs*": "deny"
+    "diskutil *": "deny"
+    "shutdown *": "deny"
+    "reboot*": "deny"
   edit:
     "**/*.env*": "deny"
     "**/*.key": "deny"