diff --git a/packages/protocol/openapi.json b/packages/protocol/openapi.json
index 4d175c8a6d..af4dde5e2c 100644
--- a/packages/protocol/openapi.json
+++ b/packages/protocol/openapi.json
@@ -8024,6 +8024,9 @@
                       "type": "string"
                     }
                   },
+                  "opaque": {
+                    "type": "boolean"
+                  },
                   "metadata": {
                     "type": "object"
                   },
@@ -20401,6 +20404,9 @@
               "type": "string"
             }
           },
+          "opaque": {
+            "type": "boolean"
+          },
           "metadata": {
             "type": "object"
           },
@@ -21179,6 +21185,9 @@
                   "type": "string"
                 }
               },
+              "opaque": {
+                "type": "boolean"
+              },
               "metadata": {
                 "type": "object"
               },
diff --git a/packages/www/content/docs/(Configure)/permissions.mdx b/packages/www/content/docs/(Configure)/permissions.mdx
index c6b35961a7..24b7ee7f22 100644
--- a/packages/www/content/docs/(Configure)/permissions.mdx
+++ b/packages/www/content/docs/(Configure)/permissions.mdx
@@ -122,7 +122,8 @@ raw command text and are **not** home-expanded.
   working directory, not every path embedded in a command. Prefer a narrow shell allowlist over patterns intended to
   identify every dangerous command. Shell permission scanning identifies commands introduced by shell syntax, but it
   does not inspect source, callbacks, plugins, package scripts, remote commands, or other executable behavior delegated
-  through an allowed program. For example, allowing `npm *`, `make *`, or `ssh *` also trusts what that program executes.
+  through an allowed program. For example, allowing `npm *`, `make *`, or `ssh *` also trusts what that program
+  executes.
 </Callout>
 
 Relative mutation paths cannot escape the active Location, and symlink escapes
diff --git a/packages/www/openapi.json b/packages/www/openapi.json
index 4d175c8a6d..af4dde5e2c 100644
--- a/packages/www/openapi.json
+++ b/packages/www/openapi.json
@@ -8024,6 +8024,9 @@
                       "type": "string"
                     }
                   },
+                  "opaque": {
+                    "type": "boolean"
+                  },
                   "metadata": {
                     "type": "object"
                   },
@@ -20401,6 +20404,9 @@
               "type": "string"
             }
           },
+          "opaque": {
+            "type": "boolean"
+          },
           "metadata": {
             "type": "object"
           },
@@ -21179,6 +21185,9 @@
                   "type": "string"
                 }
               },
+              "opaque": {
+                "type": "boolean"
+              },
               "metadata": {
                 "type": "object"
               },
diff --git a/packages/www/public/openapi.json b/packages/www/public/openapi.json
index 4d175c8a6d..af4dde5e2c 100644
--- a/packages/www/public/openapi.json
+++ b/packages/www/public/openapi.json
@@ -8024,6 +8024,9 @@
                       "type": "string"
                     }
                   },
+                  "opaque": {
+                    "type": "boolean"
+                  },
                   "metadata": {
                     "type": "object"
                   },
@@ -20401,6 +20404,9 @@
               "type": "string"
             }
           },
+          "opaque": {
+            "type": "boolean"
+          },
           "metadata": {
             "type": "object"
           },
@@ -21179,6 +21185,9 @@
                   "type": "string"
                 }
               },
+              "opaque": {
+                "type": "boolean"
+              },
               "metadata": {
                 "type": "object"
               },