opencode-config/opencode.jsonc at main · pr-pm/opencode-config · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
{
  "$schema": "https://opencode.ai/config.json",

  // === Models ===
  "model": "anthropic/claude-opus-4-5",
  "small_model": "anthropic/claude-haiku-4-5",  // title gen, lightweight tasks
  "autoupdate": true,

  // === TUI ===
  "tui": {
    "scroll_acceleration": {
      "enabled": true  // macOS-style momentum scrolling
    }
  },

  // === Formatters ===
  // Runs after file writes - uses project's formatter config
  "formatter": {
    "biome": {
      "command": ["npx", "biome", "format", "--write", "$FILE"],
      "extensions": [".js", ".jsx", ".ts", ".tsx", ".json", ".jsonc"]
    },
    "prettier": {
      "command": ["npx", "prettier", "--write", "$FILE"],
      "extensions": [".js", ".jsx", ".ts", ".tsx", ".json", ".md", ".yaml", ".yml", ".css", ".scss"]
    }
  },

  // === Instructions ===
  // AGENTS.md auto-loaded from ~/.config/opencode/ and repo root
  // Knowledge files (knowledge/*.md) are loaded on-demand via @path references

  // === Permissions ===
  "permission": {
    // .env reads without prompts
    "read": {
      ".env": "allow",
      ".env.*": "allow",
      ".env-*": "allow"
    },
    "external_directory": "allow",
    // Only deny the truly catastrophic - everything else just runs
    "bash": {
      "sudo *": "deny",
      "rm -rf /": "deny",
      "rm -rf /*": "deny",
      "rm -rf ~": "deny",
      "rm -rf ~/*": "deny",
      ":(){:|:&};:": "deny"  // fork bomb, just in case
    }
  },

  // === MCP Servers ===
  "mcp": {
    "next-devtools": {
      "type": "local",
      "command": ["npx", "-y", "next-devtools-mcp@latest"]
    },
    // "agent-mail": {
    //   "type": "remote",
    //   "url": "http://127.0.0.1:8765/mcp/"
    // },
    "chrome-devtools": {
      "type": "local",
      "command": ["npx", "-y", "chrome-devtools-mcp@latest"]
    },
    // Docs lookup for libraries - https://context7.com
    "context7": {
      "type": "remote",
      "url": "https://mcp.context7.com/mcp"
    },
    // Web fetching - MCP official server (Python via uvx)
    "fetch": {
      "type": "local",
      "command": ["uvx", "mcp-server-fetch"]
    },
    // Snyk security scanning - deps, code, IaC, containers
    "snyk": {
      "type": "local",
      "command": ["npx", "-y", "snyk@latest", "mcp", "-t", "stdio"]
    }
  },

  // === Agent Overrides ===
  "agent": {
    // Build agent - full capability with slight creativity
    "build": {
      "temperature": 0.3
    },
    // Plan agent - read-only analysis, no file writes
    "plan": {
      "model": "anthropic/claude-sonnet-4-5",  // Sonnet for planning (cheaper)
      "temperature": 0.1,
      "tools": {
        "write": false,
        "edit": false,
        "patch": false
      },
      "permission": {
        "bash": {
          "git status": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow",
          "bd *": "allow",
          "rg *": "allow",
          "tree *": "allow",
          "wc *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "pnpm exec tsc*": "allow",
          "pnpm run lint*": "allow",
          "pnpm test*": "allow",
          "*": "deny"
        }
      }
    },
    // Security agent - read-only vulnerability scanning with Snyk
    "security": {
      "model": "anthropic/claude-sonnet-4-5",
      "temperature": 0.1,  // Low temp for deterministic security analysis
      "tools": {
        "write": false,
        "edit": false,
        "patch": false
      },
      "description": "Security auditor - scans for vulnerabilities using Snyk tools (SCA, SAST, IaC, container). Read-only, reports findings without modification."
    },
    // Test writer agent - generates comprehensive test suites
    "test-writer": {
      "model": "anthropic/claude-sonnet-4-5",
      "temperature": 0.2,  // Slight creativity for test case generation
      "permission": {
        "write": {
          "**/*.test.ts": "allow",
          "**/*.spec.ts": "allow",
          "**/*.test.tsx": "allow",
          "**/*.spec.tsx": "allow",
          "*": "deny"
        }
      },
      "description": "Test specialist - generates comprehensive unit, integration, and e2e tests. Can only write to test files."
    },
    // Docs agent - documentation writer (cheaper model)
    "docs": {
      "model": "anthropic/claude-haiku-4-5",  // Haiku for cost-effective docs
      "temperature": 0.3,  // More creativity for readable documentation
      "permission": {
        "write": {
          "**/*.md": "allow",
          "**/*.mdx": "allow",
          "*": "deny"
        }
      },
      "description": "Documentation writer - generates and updates markdown docs, READMEs, and guides. Can only write to .md/.mdx files."
    }
  }
}