Trigger a known OpenCode deny before you leave
I start OpenCode with rv wired. Then I trigger a command I already deny.
rm -rf /
I wait for denied. That's a toast titled denied and a tool error like denied <context>: <detail>. If that string is missing, the fallback is denied this command. The command does not run. You get the prompt back.
OpenCode has no ask UI. A leftover unused policy ask is allow. You get a block, or the command runs.
I recorded it once.
If the command starts with no deny, the hook never fired. Stop. I wrote that miss in If a hook never fires, the action already ran.
How I get that screen
curl -fsSL https://rykanv.com/install | sh
rv setup
OpenCode
rv setup is first-run. It creates local packs and wires the OpenCode plugin. Curl plus OpenCode alone skips that.
Ask for rm -rf / only if you already deny it. Wait for the denied toast. Then you can leave.
Install is on the docs. I start from rykanv.com. How the check works is in Runtime guardrails decide allow, ask, or deny before the tool runs. Other posts are on the blog.