feat(core): add portable shell permission scanner - #42351

What

Replace Core's tree-sitter Bash and PowerShell permission parsing with a dependency-free, fail-closed scanner.

This removes the tree-sitter runtime, grammar packages, WASM assets, asset staging, and parser environment variables used by Core shell-permission parsing. The private scanner is bundled into published Core artifacts.

Before / After

Before: shell permission analysis initialized tree-sitter at runtime and depended on staged WASM assets. Unsupported syntax could not carry an explicit opaque permission boundary through every API and UI surface.

After: supported Bash, zsh, and PowerShell command positions produce reusable command resources. Unsupported, dynamic, or uncertain syntax produces one opaque request, never a reusable save, preserves configured asks and denies, and conservatively requires external-directory authorization because it may conceal a directory change.

Validation

• Removes Core's three direct shell-parser dependencies, parser shim files, WASM loading, and staged shell-parser assets.
• Adds 583 scanner tests with 873 assertions.
• Runs 9,825 generated Bash/zsh programs and observes 13,870 fake-command dispatches with zero omissions.
• Compares 2,684 PowerShell inputs with the official parser, with 1,934 supported scans and zero omissions.
• Keeps OpenTUI's separate tree-sitter runtime and Bash grammar for syntax highlighting.

How

• packages/shell-scan implements bounded Bash/zsh and PowerShell scanners with recursive command-substitution handling and explicit opaque reasons.
• packages/core/src/shell/parse.ts adapts scanner output into command resources, reusable prefixes, and directory authorization boundaries.
• packages/core/src/permission.ts evaluates opaque requests only against safe blanket rules while preserving scoped configured asks and denies.
• packages/core/src/tool/plugin/shell.ts forwards opaque state, removes reusable saves, and asserts wildcard external-directory access for uncertain directories.
• Protocol, server, client, ACP, app, and generated surfaces forward and render opaque requests consistently.
• Core's build bundles the private scanner package into dist, so published Core has no scanner runtime dependency.
• Core shell-permission tree-sitter dependencies and parser assets are removed. TUI's independent tree-sitter runtime and Bash grammar remain for syntax highlighting.

flowchart TD
  A[Shell tool input] --> B{Portable scanner}
  B -->|Supported syntax| C[Command resources and known directories]
  B -->|Dynamic or uncertain| D[Opaque command resource]
  C --> E[Normal permission evaluation]
  D --> F[No reusable save]
  D --> G[Scoped deny and ask preservation]
  D --> H[Wildcard external-directory check]
  E --> I[Execute after authorization]
  F --> I
  G --> I
  H --> I

Scope

The scanner identifies shell-language command positions for supported Bash, zsh, and PowerShell syntax. Behavior delegated to an allowed external program, including package scripts, plugins, makefiles, interpreter files, and remote commands, remains that program's permission boundary.

Unsupported or uncertain syntax intentionally fails closed as opaque. This PR does not replace the TUI's tree-sitter grammar used for syntax highlighting.

Testing

• packages/shell-scan: 583 tests, 873 assertions; typecheck passed.
• packages/core: 54 focused shell parser, permission, and shell tool tests; typecheck and production build passed.
• packages/cli: 10 focused ACP and node-asset tests; typecheck passed.
• Protocol, Schema, Server, App, Client generation, and full repository typechecks passed.
• Bash 5.3, system Bash 3.2, and zsh 5.9 execution oracle: 3,275 programs per shell, 13,870 observed fake-command dispatches, zero omissions.
• PowerShell 7.3 official AST oracle: 2,684 inputs, 1,934 supported scans, zero omissions.
• Windows CI runs the PowerShell oracle under both PowerShell 7 and Windows PowerShell 5.1 even when an earlier unit-test step fails.
• Packed Core artifact contains the scanner implementation with no @opencode-ai/shell-scan runtime dependency.
• Full push-hook repository typecheck: 35 packages passed.