Claude Code vs OpenCode: opposite permission order trips users

The article frames permission settings not as a security wall but as a way to reduce the accidents that happen with the commands an agent normally writes. Claude Code's own documentation notes that instructions in prompts or CLAUDE.md affect what Claude tries to do but not what Claude Code permits, so writing "don't read .env" in an instruction file is not a restriction.

Both tools match rules against command strings. Bash(rm *) stops rm -rf build/ but not /bin/rm -rf build/ or bash -c 'rm -rf build/', and Bash(git push *) does not match git -C . push origin main — the article suggests combining sandboxing or containers when OS-level limits are needed.

The comparison table also flags a gap: Claude Code applies a repository's allow rules only after the trust dialog is accepted, while the author found no equivalent statement in OpenCode's documentation. The suggested check is to actually ask each agent four things in a practice repository — read .env, delete a file, git push, and run tests — then verify output with git status and git diff rather than trusting the agent's own report.