- Narrow blanket allow rules (npm, dotnet, grep, head, tail, echo, find)
to explicit read-only commands; route npx/ruff format through ask
- Deny privilege escalation via su and doas
- Add read denies for env files, key material, SSH/cloud credentials,
package-manager tokens, and container/kube configs
- Add edit denies for dotfiles, .git internals, and git hook injection
- Rename ibmi custom_tools toolset to catalog and enable builtin-tools
with directory-based tool config and SELECTED_TOOLSETS=catalog
- Document tool-preference rules and scratch workspace in AGENTS.md
RULES.md was not an opencode-recognized rules filename, so global
rules (including the "no AI co-author" Git rule) were never loaded;
only the stale, un-version-controlled ~/.claude/CLAUDE.md fallback
applied, which lacked that rule. Rename to AGENTS.md so opencode
loads it natively as the global rules file.
Also add watcher.ignore for node_modules/.git/dist/.venv/target dirs.
colem