@explore agent can trigger broad scans of macOS home directory and privacy prompts when launched from $HOME

Description

When OpenCode is started from $HOME, the built-in @explore agent may perform broad filesystem searches across the home directory.

Example:

@explore models

This can traverse unrelated directories and trigger macOS privacy prompts for protected locations.

Expected

@explore should default to the detected project/worktree, not the entire home directory.

Suggested improvements:

Warn when launched from $HOME without a detected project.
Restrict Explore to the project/worktree by default.
Exclude protected/user-data directories from broad searches.
Require explicit approval before expanding outside the project scope.
Do not follow symlinks outside the project boundary.

Plugins

terminal - none

OpenCode version

1.18.22

Steps to reproduce

in terminal, try "@explore agents".

Screenshot and/or share link

Operating System

macos 26.6.2

Terminal

terminal macos