refactor: remove legacy tools format, use permission only

BREAKING: Requires OpenCode 1.1.1+

- Remove supportsNewPermissionSystem/usesLegacyToolsSystem checks
- Simplify permission-compat.ts to permission format only
- Unify explore/librarian deny lists: write, edit, task, sisyphus_task, call_omo_agent
- Add sisyphus_task to oracle deny list
- Update agent-tool-restrictions.ts with correct per-agent restrictions
- Clean config-handler.ts conditional version checks
- Update tests for simplified API

src/shared/permission-compat.ts

@@ -1,98 +1,48 @@
-import { supportsNewPermissionSystem } from "./opencode-version"
-
-export { supportsNewPermissionSystem }
+/**
+ * Permission system utilities for OpenCode 1.1.1+.
+ * This module only supports the new permission format.
+ */
 
 export type PermissionValue = "ask" | "allow" | "deny"
 
-export interface LegacyToolsFormat {
-  tools: Record<string, boolean>
-}
-
-export interface NewPermissionFormat {
+export interface PermissionFormat {
   permission: Record<string, PermissionValue>
 }
 
-export type VersionAwareRestrictions = LegacyToolsFormat | NewPermissionFormat
-
+/**
+ * Creates tool restrictions that deny specified tools.
+ */
 export function createAgentToolRestrictions(
   denyTools: string[]
-): VersionAwareRestrictions {
-  if (supportsNewPermissionSystem()) {
-    return {
-      permission: Object.fromEntries(
-        denyTools.map((tool) => [tool, "deny" as const])
-      ),
-    }
-  }
-
+): PermissionFormat {
   return {
-    tools: Object.fromEntries(denyTools.map((tool) => [tool, false])),
+    permission: Object.fromEntries(
+      denyTools.map((tool) => [tool, "deny" as const])
+    ),
   }
 }
 
-/**
- * Common tools that should be denied when using allowlist approach.
- * Used for legacy fallback when `*: deny` pattern is not supported.
- */
-const COMMON_TOOLS_TO_DENY = [
-  "write",
-  "edit",
-  "bash",
-  "task",
-  "sisyphus_task",
-  "call_omo_agent",
-  "webfetch",
-  "glob",
-  "grep",
-  "lsp_diagnostics",
-  "lsp_prepare_rename",
-  "lsp_rename",
-  "ast_grep_search",
-  "ast_grep_replace",
-  "session_list",
-  "session_read",
-  "session_search",
-  "session_info",
-  "background_output",
-  "background_cancel",
-  "skill",
-  "skill_mcp",
-  "look_at",
-  "todowrite",
-  "todoread",
-  "interactive_bash",
-] as const
-
 /**
  * Creates tool restrictions that ONLY allow specified tools.
- * All other tools are denied by default.
- *
- * Uses `*: deny` pattern for new permission system,
- * falls back to explicit deny list for legacy systems.
+ * All other tools are denied by default using `*: deny` pattern.
  */
 export function createAgentToolAllowlist(
   allowTools: string[]
-): VersionAwareRestrictions {
-  if (supportsNewPermissionSystem()) {
-    return {
-      permission: {
-        "*": "deny" as const,
-        ...Object.fromEntries(
-          allowTools.map((tool) => [tool, "allow" as const])
-        ),
-      },
-    }
-  }
-
-  // Legacy fallback: explicitly deny common tools except allowed ones
-  const allowSet = new Set(allowTools)
-  const denyTools = COMMON_TOOLS_TO_DENY.filter((tool) => !allowSet.has(tool))
-
+): PermissionFormat {
   return {
-    tools: Object.fromEntries(denyTools.map((tool) => [tool, false])),
+    permission: {
+      "*": "deny" as const,
+      ...Object.fromEntries(
+        allowTools.map((tool) => [tool, "allow" as const])
+      ),
+    },
   }
 }
 
+/**
+ * Converts legacy tools format to permission format.
+ * For migrating user configs from older versions.
+ */
 export function migrateToolsToPermission(
   tools: Record<string, boolean>
 ): Record<string, PermissionValue> {
@@ -104,40 +54,23 @@ export function migrateToolsToPermission(
   )
 }
 
-export function migratePermissionToTools(
-  permission: Record<string, PermissionValue>
-): Record<string, boolean> {
-  return Object.fromEntries(
-    Object.entries(permission)
-      .filter(([, value]) => value !== "ask")
-      .map(([key, value]) => [key, value === "allow"])
-  )
-}
-
+/**
+ * Migrates agent config from legacy tools format to permission format.
+ * If config has `tools`, converts to `permission`.
+ */
 export function migrateAgentConfig(
   config: Record<string, unknown>
 ): Record<string, unknown> {
   const result = { ...config }
 
-  if (supportsNewPermissionSystem()) {
-    if (result.tools && typeof result.tools === "object") {
-      const existingPermission =
-        (result.permission as Record<string, PermissionValue>) || {}
-      const migratedPermission = migrateToolsToPermission(
-        result.tools as Record<string, boolean>
-      )
-      result.permission = { ...migratedPermission, ...existingPermission }
-      delete result.tools
-    }
-  } else {
-    if (result.permission && typeof result.permission === "object") {
-      const existingTools = (result.tools as Record<string, boolean>) || {}
-      const migratedTools = migratePermissionToTools(
-        result.permission as Record<string, PermissionValue>
-      )
-      result.tools = { ...migratedTools, ...existingTools }
-      delete result.permission
-    }
+  if (result.tools && typeof result.tools === "object") {
+    const existingPermission =
+      (result.permission as Record<string, PermissionValue>) || {}
+    const migratedPermission = migrateToolsToPermission(
+      result.tools as Record<string, boolean>
+    )
+    result.permission = { ...migratedPermission, ...existingPermission }
+    delete result.tools
   }
 
   return result