fix: permission checks for external_directory and doom_loop (#4433)

Co-authored-by: Aiden Cline <aidenpcline@gmail.com>
Co-authored-by: AerionDyseti <AerionDyseti@users.noreply.github.com>

packages/opencode/src/tool/patch.ts

@@ -68,6 +68,17 @@ export const PatchTool = Tool.define("patch", {
               parentDir,
             },
           })
+        } else if (agent.permission.external_directory === "deny") {
+          throw new Permission.RejectedError(
+            ctx.sessionID,
+            "external_directory",
+            ctx.callID,
+            {
+              filepath: filePath,
+              parentDir,
+            },
+            `File ${filePath} is not in the current working directory`,
+          )
         }
       }