"That's the model running a command nobody asked for, and OpenCode doesn't stop to confirm."

Well, yes, because you invoked OpenCode with the --auto flag telling it not to stop for confirmation.