diff --git a/.opencode/agents/async-agent-manager.md b/.opencode/agents/async-agent-manager.md
index d5d5dcec7..540dea49b 100644
--- a/.opencode/agents/async-agent-manager.md
+++ b/.opencode/agents/async-agent-manager.md
@@ -11,6 +11,7 @@ model: openai/gpt-5-codex
 color: "#DC2626"
 permission:
   bash:
+    "*": deny
     "curl*localhost:4096*": allow
     "curl*127.0.0.1:4096*": allow
     "python3*": allow
@@ -23,7 +24,6 @@ permission:
     "cat*": allow
     "rm*": allow
     "sleep*": allow
-    "*": deny
   forgejo:
     "*": allow
     # CRITICAL: Label creation is COMPLETELY FORBIDDEN