Switch permissions to allowlist model

[gonpombo8]

Summary

• Replaces denylist-based bash command gating with an allowlist model
• Only known read-only/informational commands (ls, cat, grep, git status, npm test, etc.) pass without prompting
• Everything else — including previously-missed commands like screencapture, osascript, open — requires user confirmation
• Git add/commit are no longer auto-allowed (require confirmation)
• Subcommand-level filtering for git and npm (e.g. git status is safe, git push prompts)
• Unsafe flags on otherwise-safe commands are caught (e.g. sed -i, curl -X POST)

What could break

• Commands that were previously auto-allowed (like git add, git commit, cp, mkdir, touch) will now prompt for confirmation
• The agent may feel slower for users who are used to auto-allowing everything — they can use --no-permissions or "Always allow" to restore speed
• tee and output redirection (>, >>) still caught, but now via the allowlist gap rather than explicit denylist entries

How to test

• npm test — all 503 tests pass
• Run opendcl and try safe commands (ls, git status, npm test) — should pass silently
• Try screencapture, open, rm, git push — should prompt for confirmation
• Verify "Always allow" still works per-pattern across a session

🤖 Generated with Claude Code