fix(github): auto-deny permissions and emit events in non-interactive mode

[elithrar]

Fixes issues where permissions requests block indefinitely in CI/GitHub Actions, with no output indicating why. I keep running into this in CI runs, especially when the harness is trying to solve a problem or I'm testing/building plugins.

Since there's no way to prompt a user, it should just auto-deny by default + emit this to the logs so users can understand what happened.

Changes

• Add isInteractive() utility - checks CI env var, OPENCODE_CLIENT, and TTY state
• Auto-deny permission requests when !isInteractive() (no one to approve)
• Emit permission.asked events before denying so they're visible in logs
• Subscribe to permission events in github.ts and run.ts with actionable guidance on how to allow
• Add OPENCODE_EMIT_SUBAGENT_EVENTS flag for verbose subagent output in CI
• Add emit_subagent_events input to GitHub Action
• Deny question permission by default in GitHub Action sessions (merged from dev)

isInteractive() Logic

Only auto-denies for the CLI client in non-TTY/CI environments:

1. OPENCODE_FORCE_INTERACTIVE=true → interactive (for tests)
2. CI=true → non-interactive (auto-deny)
3. OPENCODE_CLIENT is not cli (e.g. desktop) → interactive (GUI handles permissions)
4. Otherwise, check stdin.isTTY && stdout.isTTY

current possible OPENCODE_CLIENT values: cli (default), desktop

Example Output

When a permission is denied in CI:

| Denied  external_directory: /tmp/opencode-source
  To allow, add to opencode.json: { "permission": { "external_directory": "allow" } }

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[elithrar]

@rekram1-node wanted to bring this one back: getting more info in CI when 'headless' is hugely useful to us.

right now any subagents are invisible, and any permissions errors just stall the workflows.

also applies to sandbox environments - setting OPENCODE_EMIT_SUBAGENT_EVENTS allows us to capture and emit those + any questions asked.

[elithrar]

another example: https://github.com/ask-bonk/ask-bonk/actions/runs/22177421690/job/64129579673#step:3:281

(it’s hard to debug as it just stalls forever - it shouldn’t prompt for questions when non-interactive)

[elithrar]

updated and resolved conflicts