feat: support granular (object) syntax for webfetch permission #24041

Summary

The webfetch permission does not support the granular object syntax that other permissions like bash, edit, and skill support. Using an object with URL patterns causes a ConfigInvalidError.

Current behavior

This config is rejected with Invalid input permission:

"permission": {
  "webfetch": {
    "https://opencode.ai/docs*": "allow"
  }
}

Only the simple string form works:

"permission": {
  "webfetch": "allow"
}

Expected behavior

The object syntax should work for webfetch, matching against the fetched URL — consistent with how bash matches commands and edit matches file paths:

"permission": {
  "webfetch": {
    "*": "ask",
    "https://opencode.ai/docs*": "allow",
    "https://docs.nestjs.com/*": "allow"
  }
}

Why this matters

Without granular control, users must choose between allowing all URL fetches or being prompted for every single one. Being able to allowlist trusted documentation domains while keeping "ask" as the default would improve the workflow significantly.

References

• The permissions docs list webfetch as matching URLs: webfetch — fetching a URL (matches the URL), which implies granular support should work.
• lsp is explicitly documented as "currently non-granular" — webfetch has no such note.

Environment

• OpenCode version: latest (via opencode-ai npm package)
• OS: macOS