[Fix] Tasks crash when agents read icon files

[roomote-community]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote, in the web UI, or in Discord.

What changed

Added a managed OpenCode safety hook that rejects reads of ICO and CUR files before their binary content can be attached to the model conversation. The hook checks both the requested path and its resolved filesystem target so a safe-looking symlink cannot bypass the guard. It accepts the supported OpenCode read argument shapes, preserves ordinary file and image reads, and returns guidance for text-only inspection or safe conversion.

Added focused coverage for case-insensitive extensions, Windows-style paths, query-suffixed paths, hook argument variants, safe and blocked symlink targets, ordinary reads, and worker bootstrap installation.

Why this change was made

OpenCode can treat icon files returned by the read tool as model image input even though inference providers do not consistently support those formats. The resulting provider failure could terminate an otherwise healthy task.

Impact

Attempts to read unsupported icon formats, including through symlink aliases, now fail as a recoverable tool error before reaching the model provider. Other read operations and tools are unchanged.

[roomote-community]

No new code issues found. See task

• apps/worker/src/run-task/opencode-tool-safety-plugin-script.ts:33-35 The hook only checks the requested filename. OpenCode follows symlinks, so reading preview.png that points to favicon.ico passes this check and attaches ICO bytes under the PNG MIME type, preserving the provider-crash path this PR is intended to prevent. Resolve the target or validate the file content before allowing image reads.

_{Reviewed 6b75d4d}

[roomote-community]

Resolved the symlink bypass in 6b75d4d. The read guard now checks the resolved filesystem target before allowing image reads, with regression coverage for both blocked and safe symlinks. See task.