Agent deletes backups / the only copy of data on broad cleanup tasks

[warmjademe]

Description

On a broad "clean up / remove old files / reset / free space" task, opencode can delete a file the cleanup never intended -- a backup, a credential, or the only copy of data. "Clean up the scratch files" does not mean "delete the backup", and the deletion is irreversible.

Steps to reproduce

1. Create a directory with disposable files (build artifacts, old logs, caches) AND one protected file (a backup db_backup.sql, a .env credential, or a sole-copy data file).
2. Run opencode with a broad task: clean up / remove the old and unneeded files in this directory.
3. Observe the result.

Expected behavior

opencode deletes only clearly-disposable files and keeps the backup / credential / sole-copy in place, reporting what it kept.

Actual behavior

The protected file (backup / credential / sole-copy) is deleted along with the disposables -- irreversible loss the user did not ask for.

Environment

• opencode: latest (dev)
• OS: Linux
• Model: a capable instruction-following model

Relation to existing issues

This is the destructive counterpart to #33228 (secret exposure via broad copy): the same broad-task over-reach, but the action here is irreversible deletion rather than exposure, and the fix is a distinct scope rule. It differs from #19094 (plan-mode bypass of constraints) and #8832 (permission-config not honored) -- this is specifically prompt-level scope discipline on cleanup/reset tasks. Happy to consolidate if maintainers prefer, but the deletion vs exposure cases need different prompt guidance.

[github-actions]

This issue doesn't fully meet our contributing guidelines.

What needs to be fixed:

• No issue template was used. Bug reports must include the Bug Report template with a proper ### Description field, steps to reproduce, and relevant system/environment context.

Please edit this issue to address the above within 2 hours, or it will be automatically closed.

---

This issue might be a duplicate of existing issues. Please check:

• Secret-bearing files get copied into world-readable directories on broad "copy everything" tasks #33228: Same author, same class of agent over-reach on broad tasks (secret exposure via broad copy) — this issue is framed as the "destructive counterpart" to that one. Consider whether these should be consolidated.
• Plan mode: agent executes file-creation commands via bash tool directly (no sub-agent bypass) #19094: Plan mode agent executes file-creation/bash commands directly, bypassing constraints — similar theme of agent over-reach on broad tasks.
• opencode not respecting permissions #8832: Agent not respecting configured permissions — overlapping concern around unwanted destructive actions.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

Thank you for updating the issue! It now follows the contributing guidelines with a clear description, steps to reproduce, expected/actual behavior, and environment info. Appreciate the detail!