fix: enforce strict read-only permissions on explore agent

[A-Souhei]

Changes

fix: enforce strict read-only permissions on explore agent

The explore subagent was able to write files despite being intended as read-only. Two vulnerabilities allowed this:

1. bash: "allow" — bash access lets an agent write files via shell commands (e.g. echo > file, sed -i), bypassing write/edit permission checks entirely.
2. Wrong merge order — user config was merged last, meaning a permissive user config could grant write/edit and it would stick. inspect and keeper already use the safe pattern (merge(defaults, user, hardRestrictions)).
3. Missing explicit denials — unlike learn, explore didn't explicitly deny edit, write, todowrite, todoread, task.
4. Soft prompt wording — the prompt said "Do not create any files" which the model could rationalize around.

Fix: Remove bash: "allow", add explicit denials for bash, edit, write, todowrite, todoread, task, move hard restrictions to the final non-overridable merge position, and strengthen prompt wording.

feat: add /biblion reset TUI command

Adds /biblion reset slash command to the TUI prompt, mirroring the existing /memory reset command. Shows a confirmation dialog then calls sdk.client.biblion.clear() to wipe all biblion entries. Only enabled when biblion_status.type === "ready".

[Copilot]

Pull request overview

This PR hardens the explore subagent to be strictly read-only by fixing the permission merge order and removing bash access. Previously, the explore agent could write files through bash commands or via permissive user config overrides.

Changes:

• Moved user config before the hard restrictions in PermissionNext.merge() so user config cannot override the read-only enforcement, and added explicit denials for bash, edit, write, todowrite, todoread, and task.
• Strengthened the explore prompt to unambiguously prohibit any write operations and removed the bash usage guideline.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
packages/opencode/src/agent/agent.ts	Fixes permission merge order (defaults, user, restrictions), removes bash: "allow", adds explicit denials for write-capable tools
packages/opencode/src/agent/prompt/explore.txt	Removes bash guideline, replaces soft "Do not create" wording with strict read-only directive

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.