chore: tighten permission rules and rename ibmi toolset to catalog

- Narrow blanket allow rules (npm, dotnet, grep, head, tail, echo, find)
  to explicit read-only commands; route npx/ruff format through ask
- Deny privilege escalation via su and doas
- Add read denies for env files, key material, SSH/cloud credentials,
  package-manager tokens, and container/kube configs
- Add edit denies for dotfiles, .git internals, and git hook injection
- Rename ibmi custom_tools toolset to catalog and enable builtin-tools
  with directory-based tool config and SELECTED_TOOLSETS=catalog
- Document tool-preference rules and scratch workspace in AGENTS.md

.config/opencode/opencode.jsonc

@@ -10,21 +10,18 @@
       "git diff *": "allow",
       "git show *": "allow",
       "git push *": "ask",
-      // GNU Utils
+      // Privilege escalation
       "sudo *": "deny",
+      "su *": "deny",
+      "doas *": "deny",
+      // GNU Util
       "curl *": "ask",
       "wget *": "ask",
       "diff *": "allow",
-      "npm *": "allow",
       "rm *": "ask",
       "rm -rf *": "deny",
-      "grep *": "allow",
       "sort *": "allow",
-      "head *": "allow",
-      "tail *": "allow",
-      "echo *": "allow",
       "which *": "allow",
-      "find *": "allow",
       "ls *": "allow",
       "wc *": "allow",
       // Go
@@ -33,29 +30,92 @@
       "go vet *": "allow",
       "go mod tidy": "allow",
       "go mod download": "allow",
+      // Node.js
+      "npm ci": "allow",
+      "npm test": "allow",
+      "npm run build": "allow",
+      "npm run lint": "allow",
+      "npm run typecheck": "allow",
+      "npm run check": "allow",
+      "npm ls *": "allow",
+      "npm outdated": "allow",
+      "npm audit *": "allow",
+      "npx *": "ask",
       // Python
       "python -m unittest *": "allow",
       "python -m py_compile": "allow",
+      "python3 -m unittest *": "allow",
+      "python3 -m py_compile": "allow",
+      "python -m venv .venv": "allow",
       "python3 -m venv .venv": "allow",
       "source .venv/bin/activate": "allow",
       "ruff check *": "allow",
       "ruff format --check *": "allow",
+      "ruff format *": "ask",
       // Dotnet
-      "dotnet *": "allow",
+      "dotnet build *": "allow",
+      "dotnet test *": "allow",
+      "dotnet restore *": "allow",
+      "dotnet format *": "allow",
+      "dotnet vet *": "allow",
+      "dotnet workload *": "ask",
+      "dotnet run *": "allow",
       // Docker
       "docker ps *": "allow",
       "docker logs *": "allow",
       "docker compose logs *": "allow",
     },
     "read": {
+      "/tmp/opencode": "allow",
+      "/tmp/opencode/*": "allow",
+      "~/.ssh/known_hosts": "allow",
+      // Env / secrets — recursive + variants
       ".env": "deny",
+      ".env.*": "deny",
+      "**/.env": "deny",
+      "**/.env.*": "deny",
       ".secrets": "deny",
+      "**/.secrets": "deny",
+      ".secrets.*": "deny",
+      // Key material
       "*.key": "deny",
       "*.pem": "deny",
+      "*.p12": "deny",
+      "*.pfx": "deny",
+      "*.keystore": "deny",
+      "*.jks": "deny",
+      "*.kdbx": "deny", // KeePass
+      // SSH keys — all algorithms incl. FIDO
       "id_rsa": "deny",
+      "id_ecdsa": "deny",
       "id_ed25519": "deny",
+      "id_dsa": "deny",
+      "id_ecdsa_sk": "deny",
+      "id_ed25519_sk": "deny",
+      "~/.ssh/id_*": "deny", // catch-all absolute
+      "~/.ssh/config": "deny", // may contain HostName + IdentityFile
+      // Cloud / service credentials
       ".aws/credentials": "deny",
-      "~/.ssh/known_hosts": "allow",
+      "~/.aws/credentials": "deny",
+      "~/.aws/config": "deny",
+      "~/.config/gcloud/*": "deny",
+      "~/.kube/config": "deny",
+      "~/.npmrc": "deny", // often contains _authToken
+      "~/.pypirc": "deny",
+      "~/.netrc": "deny",
+      "~/.docker/config.json": "deny",
+      // Misc
+      ".npmrc": "deny", // project-local tokens
+      "**/.npmrc": "deny",
+    },
+    "edit": {
+      "/tmp/opencode": "allow",
+      "/tmp/opencode/*": "allow",
+      // Explicit deny for dotfiles reduces accidental writes
+      ".env*": "deny",
+      ".git/*": "deny",
+      "**/.git/*": "deny",
+      ".hooks/*": "ask", // git hook injection
     },
     "grep": "allow",
     "glob": "allow",
@@ -108,8 +168,9 @@
         "npx",
         "-y",
         "@ibm/ibmi-mcp-server@latest",
+        "--builtin-tools",
         "--tools",
-        "{env:HOME}/.config/opencode/mcp/ibmi-mcp-server/tools/custom-tools.yaml",
+        "{env:HOME}/.config/opencode/mcp/ibmi-mcp-server/tools",
       ],
       "enabled": false,
       "environment": {
@@ -117,7 +178,8 @@
         "DB2i_USER": "{env:DB2i_USER}",
         "DB2i_PASS": "{env:DB2i_PASS}",
         "DB2i_PORT": "8076",
-        "DB2i_IGNORE_UNAUTHORIZED": "true",
+        "YAML_ALLOW_DUPLICATE_SOURCES": "true",
+        "SELECTED_TOOLSETS": "catalog",
       },
     },
   },