OpenCode safe default permissions

opencode.jsonc

{
  "$schema": "https://opencode.ai/config.json",
  "permission": {
    "external_directory": {
      "*": "ask",
      "~/.ssh/**": "deny",
      "~/.aws/**": "deny",
      "~/.azure/**": "deny",
      "~/.config/gcloud/**": "deny",
      "~/.kube/**": "deny",
      "~/.gnupg/**": "deny",
      "~/.password-store/**": "deny",
      "~/.strongbox_identity": "deny",
      "~/.strongbox_keyring": "deny",
      "**/.docker/config.json": "deny",
      "~/.ansible.cfg": "deny",
      "/etc/shadow": "deny",
      "/var/run/secrets/kubernetes.io/**": "deny"
    },
    "read": {
      "*": "allow",
      "**/secrets/**": "deny",
      "**/*.tfstate*": "deny",
      "**/terraform.tfvars*": "deny",
      "**/.terraform/**": "deny",
      "**/.env*": "deny",
      "**/.vault_pass*": "deny",
      "**/.git-credentials": "deny",
      "**/.bash_history": "deny",
      "**/.zsh_history": "deny",
      "**/.strongbox_*": "deny"
    },
    "edit": {
      "*": "allow",
      "~/.config/opencode/opencode.jsonc": "deny", // The "Meta-Lock"
      "**/secrets/**": "deny",
      "~/.gnupg/**": "deny",
      "**/.strongbox_*": "deny"
    },
    "bash": {
      "*": "allow",
      "git add*": "ask",
      "git commit*": "ask",
      "git push*": "ask",
      "git checkout*": "ask",
      "git reset*": "ask",
      "git rm*": "ask",
      "git stash*": "ask",
      "pass": "deny",
      "pass *": "deny",
      "gpg --export*": "deny",
      "sudo *": "deny"
    }
  }
}