v2 dropped session.create/update permission #48346

Description

v1 let a harness set per-session permission rules on create and update:

await client.session.create({
  title: 'worktree session',
  permission: [{ permission: 'edit', action: 'deny', pattern: '/path/to/original-checkout/**' }],
})

await client.session.update({
  sessionID,
  permission: [{ permission: 'edit', action: 'deny', pattern: '/path/to/original-checkout/**' }],
})

v2 session.create has no permission field. session.update is gone.

permission.reply still works for interactive asks. Config permissions still work for the whole server. What is gone is per-session rules after create.

Kimaki used this to deny the original checkout when a session runs in a git worktree. Without it, a worktree session can edit the parent tree.

Please add permission back on session.create, and a way to update it on an existing session (session.update or equivalent).

Related: #48345 (v2 session.prompt dropped system / noReply). Separate hole.

Plugins

None required. This is the v2 client / serve API.

OpenCode version

@opencode-ai/client / @opencode-ai/cli 0.0.0-beta-19271

Steps to reproduce

1. Create a session with v2 session.create({ title }).
2. There is no field to attach a permission ruleset.
3. There is no session.update to set one later.
4. Compare with v1 session.create({ permission }) / session.update({ permission }).

Screenshot and/or share link

N/A

Operating System

macOS

Terminal

N/A, SDK client