Guardrail .opencode ignore advisory blocks team workers with permission prompts #214

Problem

A broad implementation in persona-village-v2 repeatedly stopped on a permission prompt for edits inside an internal team worker path such as .opencode/team/<run>-spike-hermes/.gitignore.

Root Cause

The guardrail profile treated .opencode/ missing from .gitignore as a chat-message advisory injected into the user's message. The model then interpreted that advisory as actionable work and created a .gitignore edit task. Because the same guardrail plugin runs inside isolated .opencode/team/... worker worktrees, it also injected the advisory there, producing permission prompts for internal worker .gitignore files.

The same hook also used raw crypto.randomUUID() for injected text parts, which violates OpenCode's PartID schema requiring prt... ids and produced invalid user part before save log entries.

Expected Fix

• Do not inject .opencode/ gitignore hygiene as LLM-visible work.
• For normal repositories, handle .opencode/ locally via .git/info/exclude without changing project .gitignore.
• Skip this hygiene entirely inside .opencode/team/... worker worktrees.
• Use OpenCode-compatible part ids for guardrail/team injected text.

Validation

• bun test test/plugin/guardrail.test.ts test/plugin/guardrail-access.test.ts test/plugin/guardrail-git.test.ts test/plugin/team.test.ts
• bun typecheck from packages/opencode
• pre-push bun turbo typecheck: 14/14 successful
• bun run local:deploy
• bun run local:check
• Local deployed binary includes openrouter/google/gemini-3.5-flash, openrouter/z-ai/glm-5.1, zai/glm-5.1, and zai-coding-plan/glm-5.1.