{

"$schema": "https://opencode.ai/config.json",

"snapshot": true,

"default_agent": "plan",

"model": "amazon-bedrock/us.openai.gpt-6.1-sol",

"autoupdate": false,

"share": "disabled",

"enabled_providers": [

"google-vertex",

"amazon-bedrock",

"ollama"

],

"providers": {

"google-vertex": {

"models": {

"xai/grok-4.6": {

"package": "@opencode/ai/providers/google-vertex/chat",

"settings": {

"baseURL": "https://aiplatform.googleapis.com/v1/projects/genai-saas-tools-593219/locations/global/endpoints/openapi"

}

}

}

},

"ollama": {

"package": "@opencode/ai/providers/openai-compatible",

"name": "Ollama (local)",

"settings": {

"baseURL": "http://localhost:11434/v1"

},

"models": {

"qwen3.8:27b": {

"name": "Qwen3.8 27B (local)",

"compatibility": {

"reasoningField": "reasoning"

},

"capabilities": {

"tools": true,

"input": [

"text",

"image"

]

},

"limit": {

"context": 65536,

"output": 32768

},

"cost": {

"input": 0,

"output": 0

}

}

}

},

"amazon-bedrock": {

"settings": {

"profile": "genai-bedrock",

"region": "us-east-1"

},

"models": {

"us.openai.gpt-5.6-luna": {},

"us.openai.gpt-6-luna": {},

"us.openai.gpt-6-sol": {},

"us.openai.gpt-6.1-sol": {},

"us.openai.gpt-6-astra": {}

}

}

},

"skills": {

"paths": []

},

"permission": {

"tmux-mcp_*": "ask",

// Slack MCP is toggled on manually per-session (Ctrl+P -> MCPs dialog), not enabled

// in config. These gate the write-capable tools behind approval whenever it's

// connected, in any session/subagent; read/search tools are left untouched.

"slack_slack_send_message": "ask",

"slack_slack_send_message_draft": "ask",

"slack_slack_schedule_message": "ask",

"slack_slack_add_reaction": "ask",

"slack_slack_create_canvas": "ask",

"slack_slack_update_canvas": "ask",

"read": {

"*": "allow",

"*.env": "deny",

"*.env.*": "deny",

"*.env.example": "allow",

"secret.auto.tfvars": "deny",

"secret.auto.tfvars.example": "allow",

"secrets.py": "deny",

// .git is internal plumbing, not source. bash-guard handles .git for bash; these

// cover the Read tool. The Read tool evaluates a WORKTREE-RELATIVE path (read.ts:257),

// so the current repo's own .git is matched WITHOUT a leading "/": the "**/.git[/**]"

// forms need a "/" before ".git" and only catch NESTED repos, so the bare ".git"/

// ".git/**" forms are required for the worktree-root .git. All four are needed.

".git": "deny",

".git/**": "deny",

"**/.git": "deny",

"**/.git/**": "deny",

},

"edit": {

"~/.config/opencode/*": "ask",

// scratch dirs (AGENTS.md-designated). The edit/write tool matches a WORKTREE-RELATIVE

// path (write.ts:56), so these are the relative `../…/T/opencode/…` forms.

"**/T/opencode/**": "allow",

"**/tmp/opencode/**": "allow",

},

"external_directory": {

"*": "ask",

"~/.opencode/plan/*": "allow",

"~/.config/opencode/*": "allow",

"~/signifyd_github/*": "allow",

"~/softwarefromsource/*": "allow",

"~/org/*": "allow",

// AGENTS.md-designated scratch dirs (bash-guard already write-allowlists these). The `*`

// glob is dotall, so one rule per root covers all nested depths.

"/tmp/opencode/*": "allow",

"/var/folders/*/T/opencode/*": "allow", // macOS $TMPDIR/opencode

"/private/var/folders/*/T/opencode/*": "allow",

"/private/tmp/opencode/*": "allow",

},

"bash": {

"*": "ask",

// --- Dangerous commands ---

"sudo *": "deny",

"terraform apply *": "deny",

// --- Git (read-only allowed, destructive actions denied/ask) ---

"git log *": "allow",

"git status *": "allow",

"git show *": "allow",

"git blame *": "allow",

"git diff *": "allow",

"git branch *": "allow",

"git branch -d *": "ask",

"git branch -D *": "ask",

"git branch -m *": "ask",

"git branch --delete *": "ask",

"git branch --move *": "ask",

"git tag *": "allow",

"git tag -d *": "ask",

"git tag --delete *": "ask",

"git remote *": "allow",

"git remote add *": "ask",

"git remote remove *": "ask",

"git remote set-url *": "ask",

"git worktree list *": "allow",

"git stash list *": "allow",

"git rev-parse *": "allow",

"git ls-files *": "allow",

// More read-only git verbs (no standalone write/exec side-channel; bash-guard backstops;

// chained clauses still re-checked per-command). `git grep` is intentionally NOT here

// (-O/--open-files-in-pager is a CLI exec the guard can't see).

"git rev-list *": "allow",

"git merge-base *": "allow",

"git check-ignore *": "allow",

"git cherry *": "allow",

"git for-each-ref *": "allow",

"git describe *": "allow",

"git ls-tree *": "allow",

"git range-diff *": "allow",

"git shortlog *": "allow",

"git --version": "allow",

// git config READS only (writes stay ask); `git config -f/--file <path>` is secret-scoped by bash-guard.

"git config --get*": "allow",

"git config --list*": "allow",

"git config -l*": "allow",

"git config --show-origin *": "allow",

"git config --local --list*": "allow",

"git config --global --list*": "allow",

"git add -A *": "deny",

"git add --all *": "deny",

"git add . *": "deny",

"git fetch *": "allow",

"git push *": "deny",

// --- Yadm (dotfiles, same as git) ---

"yadm log *": "allow",

"yadm status *": "allow",

"yadm show *": "allow",

"yadm blame *": "allow",

"yadm diff *": "allow",

"yadm branch *": "allow",

"yadm branch -d *": "ask",

"yadm branch -D *": "ask",

"yadm branch -m *": "ask",

"yadm branch --delete *": "ask",

"yadm branch --move *": "ask",

"yadm tag *": "allow",

"yadm tag -d *": "ask",

"yadm tag --delete *": "ask",

"yadm remote *": "allow",

"yadm remote add *": "ask",

"yadm remote remove *": "ask",

"yadm remote set-url *": "ask",

"yadm stash list *": "allow",

"yadm rev-parse *": "allow",

"yadm ls-files *": "allow",

// yadm mirror of the read-only git verbs (see git block above).

"yadm rev-list *": "allow",

"yadm merge-base *": "allow",

"yadm check-ignore *": "allow",

"yadm cherry *": "allow",

"yadm for-each-ref *": "allow",

"yadm describe *": "allow",

"yadm ls-tree *": "allow",

"yadm range-diff *": "allow",

"yadm shortlog *": "allow",

"yadm --version": "allow",

"yadm config --get*": "allow",

"yadm config --list*": "allow",

"yadm config -l*": "allow",

"yadm config --show-origin *": "allow",

"yadm config --local --list*": "allow",

"yadm config --global --list*": "allow",

"yadm add -A *": "deny",

"yadm add --all *": "deny",

"yadm add . *": "deny",

"yadm fetch *": "allow",

"yadm push *": "deny",

// --- Common CLI tools (read-only/safe) ---

"ls *": "allow",

"wc *": "allow",

"head *": "allow",

"tail *": "allow",

"sort *": "allow",

"uniq *": "allow",

"awk *": "allow", // backstopped by bash-guard (system()/getline/print>/-i inplace)

"sed *": "allow", // backstopped by bash-guard (-i / w,W,r,R / s///w blocked)

"which *": "allow",

"jq *": "allow",

"jaq *": "allow",

"fd *": "allow",

"ug *": "allow",

"rg *": "allow",

"grep *": "allow",

"find *": "allow", // backstopped by bash-guard (-exec/-delete/-fls/-ok + path scoping)

"tree *": "allow",

"echo *": "allow", // safe; only writes via redirect, which bash-guard blocks

"tee *": "allow", // backstopped by bash-guard (tee targets must be tmp)

"diff *": "allow",

// cd/cat are in opencode's FILES set → external_directory still asks for paths

// outside the allow-list; bash-guard scopes reads + blocks secrets/.git.

"cd": "allow",

"cd *": "allow",

"cat *": "allow",

"pwd": "allow",

"pwd *": "allow",

// Inert/read-only tools (guard backstops redirects/exec).

"cut *": "allow",

"printf *": "allow",

"whoami": "allow",

"id": "allow",

"id *": "allow",

"sleep *": "allow",

"ps": "allow",

"ps *": "allow",

"wait": "allow",

"wait *": "allow",

"test *": "allow", // POSIX condition check ([ -f x ], string/number compare); no side effects

"command -v *": "allow", // resolves a command's path (like `which`); NOT bare `command *` (runs a program)

"TMPFILE=$(mktemp)": "allow",

// --- Jira CLI (read-only) ---

"jira issue list *": "allow",

"jira epic list *": "allow",

"jira issue view *": "allow",

"jira --version *": "allow",

// --- Pants build system ---

"pants lint *": "allow",

"pants fmt *": "allow",

"pants test *": "allow",

"pants check *": "allow",

"pants typecheck *": "allow",

"PANTS_CONCURRENT=True pants tecton-plan *": "allow", // read-only plan; apply stays gated

"PANTS_CONCURRENT=True pants test *": "allow",

// --- Rust toolchain (checkers only; cargo build/test/run excluded — those compile/execute) ---

"cargo check *": "allow",

"cargo clippy *": "allow",

"cargo clippy --fix *": "ask", // auto-fixes/mutates files in place; keep human-gated

"cargo fmt --check *": "allow",

"cargo fmt -- --check *": "allow",

"cargo --version": "allow",

"rustc --version": "allow",

// --- Taskagent ---

"taskagent *": "allow",

// Defense-in-depth: block hook-bypassing subcommands when they appear as the

// FIRST argument (covers "taskagent undo" and abbreviations like "taskagent und").

// Filter-before-subcommand ("taskagent +agent undo") is caught by the wrapper,

// which scans ALL args. The multi-token "taskagent * undo*" form was removed

// because it false-positives on task descriptions (e.g. "taskagent add undo this").

"taskagent undo*": "deny",

"taskagent config*": "deny",

"taskagent execute*": "deny",

// Block rc overrides (rc: or rc. as a standalone first arg or anywhere literal)

"taskagent rc:*": "deny",

"taskagent rc.*": "deny",

// --- Taskwarrior ---

"task *": "deny",

"task list *": "allow",

// --- tuicr (review CLI) ---

"tuicr review list *": "allow",

"tuicr review comments *": "allow",

// --- opencode-session (read-only introspection/pricing commands) ---

"opencode-session search *": "allow",

"opencode-session show *": "allow",

"opencode-session cost *": "allow",

"opencode-session --help*": "allow",

"opencode-session -h": "allow",

"~/bin/opencode-session search *": "allow",

"~/bin/opencode-session show *": "allow",

"~/bin/opencode-session cost *": "allow",

"~/bin/opencode-session --help*": "allow",

"~/bin/opencode-session -h": "allow",

// --- gcli (allow by default, ask for destructive actions) ---

// NOTE: these patterns only hold while nothing precedes the subcommand.

// Any global flag (--no-markdown, -q, -t github) shifts the string and

// misses every rule below, falling through to the "*": "ask" default.

// That is why GCLI_RENDER_MARKDOWN is set in plugins/gcli-env.ts instead

// of passing --no-markdown.

"gcli api *": "allow",

"gcli status -l *": "allow",

"gcli status -n *": "allow",

"gcli ci *": "allow",

"gcli issues *": "allow",

"gcli issues -i * close *": "ask",

"gcli issues -i * reopen *": "ask",

"gcli issues -i * assign *": "ask",

"gcli issues -i * labels *": "ask",

"gcli issues -i * milestone *": "ask",

"gcli issues -i * title *": "ask",

"gcli issues -i * edit *": "ask",

"gcli issues create *": "ask",

"gcli pulls *": "allow",

"gcli pulls -i * merge *": "ask",

"gcli pulls -i * close *": "ask",

"gcli pulls -i * reopen *": "ask",

"gcli pulls -i * labels *": "ask",

"gcli pulls -i * milestone *": "ask",

"gcli pulls -i * title *": "ask",

"gcli pulls -i * request-review *": "ask",

"gcli pulls -i * assign *": "ask",

"gcli pulls -i * checkout *": "ask",

"gcli pulls -i * review *": "ask",

"gcli pulls -i * approve *": "ask",

"gcli pulls -i * unapprove *": "ask",

"gcli pulls create *": "ask",

"gcli comment *": "ask",

// --- gh CLI (read-only commands) ---

"gh status *": "allow",

"gh issue list *": "allow",

"gh issue status *": "allow",

"gh issue view *": "allow",

"gh pr list *": "allow",

"gh pr status *": "allow",

"gh pr view *": "allow",

"gh pr checks *": "allow",

"gh pr diff *": "allow",

"gh repo list *": "allow",

"gh repo view *": "allow",

"gh repo gitignore list *": "allow",

"gh repo gitignore view *": "allow",

"gh repo license list *": "allow",

"gh repo license view *": "allow",

"gh run list *": "allow",

"gh run view *": "allow",

"gh workflow list *": "allow",

"gh workflow view *": "allow",

},

},

"mcp": {

"atlassian": {

"type": "remote",

"url": "https://mcp.atlassian.com/v1/mcp/authv2",

"enabled": false,

},

"slack": {

"type": "remote",

"url": "https://mcp.slack.com/mcp",

"oauth": {

"clientId": "1601185624273.8899143856786",

"redirectUri": "http://localhost:3118/callback",

},

"enabled": true,

},

"zoom-mcp": {

"type": "remote",

"url": "https://mcp.zoom.us/mcp/zoom/streamable",

"oauth": {},

"enabled": false,

},

"tmux-mcp": {

"type": "local",

"command": ["tmux-mcp"],

"enabled": false,

},

"mcp-neovim-server": {

"type": "local",

"command": ["mcp-neovim-server"],

"environment": {

"ALLOW_SHELL_COMMANDS": "false",

"NVIM_SOCKET_PATH": "./.nvim.sock",

},

"enabled": false,

},

},

"plugins": [

"@dietrichgebert/[email protected]",

],

"agent": {

"build": {

"model": "amazon-bedrock/us.openai.gpt-6.1-sol",

"variant": "medium",

"color": "#ff79c6",

},

"plan": {

"model": "amazon-bedrock/us.openai.gpt-6.1-sol",

"variant": "high",

"color": "#8be9fd",

},

"explore": {

"model": "amazon-bedrock/us.openai.gpt-6-luna",

"variant": "medium",

"permission": {

"skill": "allow",

"bash": {

// --- Git (read-only) ---

"git log*": "allow",

"git status*": "allow",

"git show*": "allow",

"git blame *": "allow",

"git diff*": "allow",

"git branch*": "allow",

"git tag*": "allow",

"git remote*": "allow",

"git worktree list *": "allow",

"git stash list*": "allow",

"git rev-parse *": "allow",

"git fetch*": "allow",

"git ls-files*": "allow",

// --- Yadm (read-only) ---

"yadm log*": "allow",

"yadm status*": "allow",

"yadm show*": "allow",

"yadm blame *": "allow",

"yadm diff*": "allow",

"yadm branch*": "allow",

"yadm tag*": "allow",

"yadm remote*": "allow",

"yadm stash list*": "allow",

"yadm rev-parse *": "allow",

"yadm fetch*": "allow",

"yadm ls-files*": "allow",

// --- Common CLI tools (read-only/safe) ---

"ls*": "allow",

"wc*": "allow",

"head*": "allow",

"tail*": "allow",

"sort*": "allow",

"uniq*": "allow",

"awk*": "allow",

"sed *": "allow",

"grep *": "allow",

"rg *": "allow",

"which *": "allow",

"jq *": "allow",

"jaq *": "allow",

"fd *": "allow",

"ug *": "allow",

"find *": "allow",

"tree *": "allow",

"echo *": "allow",

"tee *": "allow",

"diff *": "allow",

"TMPFILE=$(mktemp)": "allow",

// --- Jira CLI (read-only) ---

"jira issue list *": "allow",

"jira epic list *": "allow",

"jira issue view *": "allow",

// --- Pants build system ---

"pants lint *": "allow",

"pants fmt *": "allow",

"pants test *": "allow",

// --- Taskagent ---

"taskagent *": "allow",

// --- Taskwarrior (read-only) ---

"task list *": "allow",

// --- opencode-session (read-only) ---

"opencode-session search *": "allow",

"opencode-session show *": "allow",

"opencode-session cost *": "allow",

"opencode-session --help*": "allow",

"opencode-session -h": "allow",

"~/bin/opencode-session search *": "allow",

"~/bin/opencode-session show *": "allow",

"~/bin/opencode-session cost *": "allow",

"~/bin/opencode-session --help*": "allow",

"~/bin/opencode-session -h": "allow",

// --- gcli (read-only) ---

"gcli api *": "allow",

"gcli status -l *": "allow",

"gcli status -n *": "allow",

"gcli ci *": "allow",

"gcli issues *": "allow",

"gcli pulls *": "allow",

// --- gh CLI (read-only) ---

"gh status *": "allow",

"gh issue list *": "allow",

"gh issue status *": "allow",

"gh issue view *": "allow",

"gh pr list *": "allow",

"gh pr status *": "allow",

"gh pr view *": "allow",

"gh pr checks *": "allow",

"gh pr diff *": "allow",

"gh repo list *": "allow",

"gh repo view *": "allow",

"gh repo gitignore list *": "allow",

"gh repo gitignore view *": "allow",

"gh repo license list *": "allow",

"gh repo license view *": "allow",

"gh run list *": "allow",

"gh run view *": "allow",

"gh workflow list *": "allow",

"gh workflow view *": "allow",

},

},

},

"test-runner": {

"model": "google-vertex/gemini-3.5-flash-lite",

"variant": "low",

},

"taskagent-reader": {

"model": "google-vertex/gemini-3.5-flash-lite",

"variant": "low",

},

// Backend agent for the "99" (kilenc) nvim plugin (headless `opencode run`).

"kilenc": {

"mode": "primary",

"hidden": true,

"model": "google-vertex/gemini-3.5-flash-lite",

"variant": "low",

"permission": {

"task": "deny",

"bash": "deny",

"webfetch": "deny",

"todowrite": "deny",

"edit": {

"*": "deny",

"**/T/opencode/**": "allow",

"**/tmp/opencode/**": "allow",

},

},

},

"cli-prompt": {

"mode": "primary",

"hidden": true,

"model": "google-vertex/gemini-3.5-flash-lite",

"variant": "low",

"prompt": "You are a non-interactive CLI assistant, invoked with a single prompt (often piped via stdin) and captured as plain text. Answer directly and concisely. Obey the requested output format exactly: if asked to reply with a single word or specific value, output only that and nothing else — no greeting, no preamble, no explanation, no markdown, no trailing commentary.",

"permission": {

"task": "deny",

"bash": "deny",

"webfetch": "deny",

"todowrite": "deny",

"edit": {

"*": "deny",

},

},

},

},

}