`opencode run`: when a permission is auto-rejected, the final message is empty (zero bytes) — no error is surfaced

Summary

In non-interactive opencode run, a tool call that needs a permission the session cannot grant
(e.g. external_directory for a path outside cwd) is auto-rejected. That is reasonable. The bug
is what happens next: the run exits 0 with a zero-byte final message. Nothing on stdout or stderr
tells the caller that the task was not done, or why. Every programmatic consumer (CI, agent
orchestrators, benchmark harnesses) reads that as "the model answered nothing".

Environment

• opencode 1.17.8 (also observed on 1.15.x); Linux (Ubuntu 24.04, aarch64 — NVIDIA DGX Spark), running inside a container
• Provider: custom OpenAI-compatible (@ai-sdk/openai-compatible) → local vLLM 0.27.1
• Model: Qwen3.8-27B (local). Model-independent: the auto-reject path never reaches the model again.

Reproduction

mkdir -p /tmp/oc-repro && cd /tmp/oc-repro && git init -q
opencode run "Run this exact command and report its exact output verbatim: cat /nonexistent-file"
echo "exit=$? bytes=$(opencode run '...' | wc -c)"

With permissions at their defaults the log (enable debug/log) shows:

permission requested: external_directory (/*); auto-rejecting

and the command prints nothing — zero bytes — and exits 0.

Same prompt with --dangerously-skip-permissions → the model runs the command and reports
cat: /nonexistent-file: No such file or directory as asked. So the model behaves correctly; the
harness is silently swallowing the rejection.

Expected

Any of:

1. A non-empty final message from the assistant, e.g. "I could not run that: permission external_directory was denied in non-interactive mode", or
2. A non-zero exit code plus a one-line stderr diagnostic naming the rejected permission, or
3. Both.

Silent success-shaped failure is the worst of the options: callers cannot distinguish "nothing to say" from "blocked".

Why it matters

We measured this in a 5-drill accuracy battery across four coding harnesses. OpenCode scored 0/5 on
the "report a command's error verbatim" drill purely because of this — the same model scored 5/5 in
the other three harnesses and 5/5 in OpenCode once --dangerously-skip-permissions was added.
In real agent pipelines this showed up historically as unexplained "agent returned nothing" failures
whenever a task touched a path outside cwd.

Related: #10411 (non-interactive permission semantics), #20864 (--yolo), #28605 (silent empty
output in a non-git dir — possibly the same silent-exit code path).