feat: add 'deny' option to permission configuration system

packages/opencode/src/config/config.ts

@@ -224,7 +224,7 @@ export namespace Config {
   })
   export type Layout = z.infer<typeof Layout>
 
-  export const Permission = z.union([z.literal("ask"), z.literal("allow")])
+  export const Permission = z.union([z.literal("ask"), z.literal("allow"), z.literal("deny")])
   export type Permission = z.infer<typeof Permission>
 
   export const Info = z

packages/opencode/src/tool/bash.ts

@@ -93,15 +93,18 @@ export const BashTool = Tool.define("bash", {
 
       // always allow cd if it passes above check
       if (!needsAsk && command[0] !== "cd") {
-        const ask = (() => {
+        const action = (() => {
           for (const [pattern, value] of Object.entries(permissions)) {
             const match = Wildcard.match(node.text, pattern)
             log.info("checking", { text: node.text.trim(), pattern, match })
             if (match) return value
           }
           return "ask"
         })()
-        if (ask === "ask") needsAsk = true
+        if (action === "ask") needsAsk = true
+        if (action === "deny") {
+          throw new Error(`Command "${node.text.trim()}" is not allowed by permission configuration`)
+        }
       }
     }
 

packages/opencode/src/tool/edit.ts

@@ -60,6 +60,8 @@ export const EditTool = Tool.define("edit", {
               diff,
             },
           })
+        } else if (cfg.permission?.edit === "deny") {
+          throw new Error(`File editing is not allowed by permission configuration`)
         }
         await Bun.write(filePath, params.newString)
         await Bus.publish(File.Event.Edited, {
@@ -89,6 +91,8 @@ export const EditTool = Tool.define("edit", {
             diff,
           },
         })
+      } else if (cfg.permission?.edit === "deny") {
+        throw new Error(`File editing is not allowed by permission configuration`)
       }
 
       await file.write(contentNew)

packages/opencode/src/tool/write.ts

@@ -42,6 +42,9 @@ export const WriteTool = Tool.define("write", {
           exists,
         },
       })
+    else if (cfg.permission?.edit === "deny") {
+      throw new Error(`File writing is not allowed by permission configuration`)
+    }
 
     await Bun.write(filepath, params.content)
     await Bus.publish(File.Event.Edited, {