build: restricted bash to durther prevent force merges or sudo escalation

.opencode/agents/async-agent-util.md

@@ -119,7 +119,8 @@ permission:
     "*api/v1/repos/*/labels*": deny
     "*https://git.cleverthis.com/api/v1/repos/cleveragents/cleveragents-core/labels*": deny
 
-    "sudo *": deny
+    "*force_merge": deny
+    "*sudo*": deny
 
   # All the subagents you want this agent to have access to
   task:

.opencode/agents/auto-agents.md

@@ -125,6 +125,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/estimator-implementation.md

@@ -123,6 +123,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/git-checkout-util.md

@@ -114,7 +114,8 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
-    "sudo *": deny
+    "*force_merge*": deny
+    "*sudo*": deny
 
   task:
     "*": deny

.opencode/agents/git-cleanup-util.md

@@ -114,7 +114,8 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
-    "sudo *": deny
+    "*force_merge*": deny
+    "*sudo*": deny
 
   task:
     "*": deny

.opencode/agents/git-clone-util.md

@@ -122,7 +122,8 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
-    "sudo *": deny
+    "*force_merge*": deny
+    "*sudo*": deny
 
   task:
     "*": deny

.opencode/agents/git-commit-and-push-util.md

@@ -113,7 +113,8 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
-    "sudo *": deny
+    "*force_merge*": deny
+    "*sudo*": deny
 
   task:
     "*": deny

.opencode/agents/git-commit-util.md

@@ -124,6 +124,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/git-create-commit-util.md

@@ -116,7 +116,8 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
-    "sudo *": deny
+    "*force_merge*": deny
+    "*sudo*": deny
 
   task:
     "*": deny

.opencode/agents/git-fetch-util.md

@@ -113,7 +113,8 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
-    "sudo *": deny
+    "*force_merge*": deny
+    "*sudo*": deny
 
   task:
     "*": deny

.opencode/agents/git-force-push-with-lease-util.md

@@ -113,7 +113,8 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
-    "sudo *": deny
+    "*force_merge*": deny
+    "*sudo*": deny
 
   task:
     "*": deny

.opencode/agents/git-isolator-util.md

@@ -129,6 +129,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/git-push-util.md

@@ -114,7 +114,8 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
-    "sudo *": deny
+    "*force_merge*": deny
+    "*sudo*": deny
 
   task:
     "*": deny

.opencode/agents/git-rebase-and-push-util.md

@@ -115,7 +115,8 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
-    "sudo *": deny
+    "*force_merge*": deny
+    "*sudo*": deny
 
   task:
     "*": deny

.opencode/agents/git-rebase-util.md

@@ -129,6 +129,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/git-stage-util.md

@@ -115,7 +115,8 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
-    "sudo *": deny
+    "*force_merge*": deny
+    "*sudo*": deny
 
   task:
     "*": deny

.opencode/agents/implementation-supervisor.md

@@ -126,6 +126,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/implementation-worker.md

@@ -128,6 +128,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/pr-merge-supervisor.md

@@ -118,6 +118,10 @@ permission:
     # CRITICAL: No direct HTTP calls to the OpenCode server
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
+
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/pr-merge-worker.md

@@ -127,6 +127,10 @@ permission:
     # CRITICAL: No direct HTTP calls to the OpenCode server
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
+
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/pr-review-supervisor.md

@@ -121,6 +121,10 @@ permission:
     # CRITICAL: No direct HTTP calls to the OpenCode server
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
+
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/pr-review-worker.md

@@ -137,6 +137,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/session-health-full-util.md

@@ -118,6 +118,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   task:
     "*": deny
 

.opencode/agents/session-health-quick-util.md

@@ -118,6 +118,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   task:
     "*": deny
 

.opencode/agents/session-health-util.md

@@ -118,6 +118,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   task:
     "*": deny
     "session-health-quick-util": allow

.opencode/agents/supervisor.md

@@ -124,6 +124,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/task-implementor.md

@@ -137,6 +137,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/tier-codex.md

@@ -122,6 +122,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # target_agent is caller-controlled but is required by convention to be a
   # `task-*` agent (the final inner work agent in the tiered dispatch flow).
   # Restricting the wildcard to `task-*` enforces that contract while keeping

.opencode/agents/tier-dispatcher.md

@@ -130,6 +130,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need

.opencode/agents/tier-gpt5-mini.md

@@ -121,6 +121,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # target_agent is caller-controlled but is required by convention to be a
   # `task-*` agent (the final inner work agent in the tiered dispatch flow).
   # Restricting the wildcard to `task-*` enforces that contract while keeping

.opencode/agents/tier-gpt5-nano.md

@@ -121,6 +121,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # target_agent is caller-controlled but is required by convention to be a
   # `task-*` agent (the final inner work agent in the tiered dispatch flow).
   # Restricting the wildcard to `task-*` enforces that contract while keeping

.opencode/agents/tier-haiku.md

@@ -121,6 +121,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # target_agent is caller-controlled but is required by convention to be a
   # `task-*` agent (the final inner work agent in the tiered dispatch flow).
   # Restricting the wildcard to `task-*` enforces that contract while keeping

.opencode/agents/tier-kimi.md

@@ -120,6 +120,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # target_agent is caller-controlled but is required by convention to be a
   # `task-*` agent (the final inner work agent in the tiered dispatch flow).
   # Restricting the wildcard to `task-*` enforces that contract while keeping

.opencode/agents/tier-o4-mini.md

@@ -121,6 +121,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # target_agent is caller-controlled but is required by convention to be a
   # `task-*` agent (the final inner work agent in the tiered dispatch flow).
   # Restricting the wildcard to `task-*` enforces that contract while keeping

.opencode/agents/tier-opus.md

@@ -122,6 +122,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # target_agent is caller-controlled but is required by convention to be a
   # `task-*` agent (the final inner work agent in the tiered dispatch flow).
   # Restricting the wildcard to `task-*` enforces that contract while keeping

.opencode/agents/tier-qwen-large.md

@@ -120,6 +120,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # target_agent is caller-controlled but is required by convention to be a
   # `task-*` agent (the final inner work agent in the tiered dispatch flow).
   # Restricting the wildcard to `task-*` enforces that contract while keeping

.opencode/agents/tier-qwen-med.md

@@ -121,6 +121,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # target_agent is caller-controlled but is required by convention to be a
   # `task-*` agent (the final inner work agent in the tiered dispatch flow).
   # Restricting the wildcard to `task-*` enforces that contract while keeping

.opencode/agents/tier-qwen-small.md

@@ -121,6 +121,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # target_agent is caller-controlled but is required by convention to be a
   # `task-*` agent (the final inner work agent in the tiered dispatch flow).
   # Restricting the wildcard to `task-*` enforces that contract while keeping

.opencode/agents/tier-sonnet.md

@@ -121,6 +121,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # target_agent is caller-controlled but is required by convention to be a
   # `task-*` agent (the final inner work agent in the tiered dispatch flow).
   # Restricting the wildcard to `task-*` enforces that contract while keeping

.opencode/agents/work-group-util.md

@@ -129,6 +129,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # No subagents needed
   task:
     "*": deny