feat(aircoding): AirCoding V2 baseline — deterministic multi-agent architecture

Forked from OpenCode v1.17.4 with multi-agent system:
- 5 agents: aircoding, scheduler, worker, architect, reviewer
- Deterministic DAG scheduling engine (coordinator_tick)
- Tool whitelists as hard enforcement
- AirCoding validation plugin
- System prompt injection for routing
- V1 requirements: C4 docs, ADR, AGENTS.md, debug-log.md
- Design documents in docs/

packages/server/src/handlers/permission.ts

@@ -0,0 +1,61 @@
+import { Location } from "@opencode-ai/core/location"
+import { PermissionV2 } from "@opencode-ai/core/permission"
+import { PermissionSaved } from "@opencode-ai/core/permission/saved"
+import { Effect } from "effect"
+import { HttpApiBuilder, HttpApiSchema } from "effect/unstable/httpapi"
+import { Api } from "../api"
+import { PermissionNotFoundError } from "../errors"
+import { response } from "../groups/location"
+
+function missingRequest(id: PermissionV2.ID) {
+  return new PermissionNotFoundError({ requestID: id, message: `Permission request not found: ${id}` })
+}
+
+export const PermissionHandler = HttpApiBuilder.group(Api, "server.permission", (handlers) =>
+  Effect.gen(function* () {
+    return handlers
+      .handle(
+        "permission.request.list",
+        Effect.fn(function* () {
+          return yield* response((yield* PermissionV2.Service).list())
+        }),
+      )
+      .handle(
+        "session.permission.list",
+        Effect.fn(function* (ctx) {
+          const permission = yield* PermissionV2.Service
+          return { data: yield* permission.forSession(ctx.params.sessionID) }
+        }),
+      )
+      .handle(
+        "session.permission.reply",
+        Effect.fn(function* (ctx) {
+          const permission = yield* PermissionV2.Service
+          const request = yield* permission.get(ctx.params.requestID)
+          if (!request || request.sessionID !== ctx.params.sessionID) return yield* missingRequest(ctx.params.requestID)
+          yield* permission
+            .reply({ requestID: ctx.params.requestID, reply: ctx.payload.reply, message: ctx.payload.message })
+            .pipe(Effect.catchTag("PermissionV2.NotFoundError", () => missingRequest(ctx.params.requestID)))
+          return HttpApiSchema.NoContent.make()
+        }),
+      )
+      .handle(
+        "permission.saved.list",
+        Effect.fn(function* (ctx) {
+          const location = yield* Location.Service
+          return {
+            data: yield* (yield* PermissionSaved.Service).list({
+              projectID: ctx.query.projectID ?? location.project.id,
+            }),
+          }
+        }),
+      )
+      .handle(
+        "permission.saved.remove",
+        Effect.fn(function* (ctx) {
+          yield* (yield* PermissionSaved.Service).remove(ctx.params.id)
+          return HttpApiSchema.NoContent.make()
+        }),
+      )
+  }),
+)