fix: reasoning token double-count and permission disabled() specificity

- Token total: remove reasoningTokens from total computation since it's
  a subset of outputTokens (from completion_tokens_details). Adding both
  was double-counting reasoning tokens for models like o1/o3.

- Permission disabled(): use specificity scoring instead of findLast()
  so that a specific allow rule (e.g. permission: "edit") beats a
  catch-all deny (permission: "*"). Consistent with evaluate() fix.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Author: EBrown

packages/opencode/src/permission/next.ts

@@ -267,9 +267,22 @@ export namespace PermissionNext {
     for (const tool of tools) {
       const permission = EDIT_TOOLS.includes(tool) ? "edit" : tool
 
-      const rule = ruleset.findLast((r) => Wildcard.match(permission, r.permission))
-      if (!rule) continue
-      if (rule.pattern === "*" && rule.action === "deny") result.add(tool)
+      // Use specificity scoring (consistent with evaluate()) so that a
+      // specific allow like { permission: "edit" } beats a catch-all
+      // deny like { permission: "*" }.
+      let bestRule: Rule | undefined
+      let bestSpecificity = -1
+      for (const r of ruleset) {
+        if (!Wildcard.match(permission, r.permission)) continue
+        const nonWild = r.permission.replace(/\*/g, "")
+        const specificity = nonWild.length + (r.permission.includes("*") ? 0 : 100)
+        if (specificity >= bestSpecificity) {
+          bestSpecificity = specificity
+          bestRule = r
+        }
+      }
+      if (!bestRule) continue
+      if (bestRule.pattern === "*" && bestRule.action === "deny") result.add(tool)
     }
     return result
   }

packages/opencode/src/session/index.ts

@@ -818,7 +818,9 @@ export namespace Session {
       // mismatches across providers. Some providers (OpenRouter, Copilot)
       // include cached tokens in totalTokens differently than Anthropic,
       // causing inflated counts and premature compaction (#3314).
-      const total = adjustedInputTokens + outputTokens + reasoningTokens + cacheReadInputTokens + cacheWriteInputTokens
+      // Note: reasoningTokens is a subset of outputTokens (from
+      // completion_tokens_details), so it must NOT be added separately.
+      const total = adjustedInputTokens + outputTokens + cacheReadInputTokens + cacheWriteInputTokens
 
       const tokens = {
         total,