jiang
7383ed6d13
Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore session-scoped learning, credential renewal, typed project queries and controlled frontend actions from the legacy Agent. Replace host Shell execution with an approved Landlock/seccomp executor and persistent per-session workspaces. Add typed Bocha search and Tianditu geocoding bridges using the owning session credential. Require a working kernel sandbox before startup and persist workspace files in deployments. Validation completed before this commit: TypeScript checks, 150 Bun tests, Docker build and UID 10001 sandbox execution, native Shell approval and session recovery. Tianditu succeeded; Bocha currently reports exhausted account quota. Unrelated investigation-report contract work is excluded.
378 lines
7.1 KiB
JSON
378 lines
7.1 KiB
JSON
{
|
|
"$schema": "https://opencode.ai/config.json",
|
|
"model": "deepseek/deepseek-flash",
|
|
"default_agent": "instruction",
|
|
"permissions": [
|
|
{
|
|
"action": "*",
|
|
"resource": "*",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "external_directory",
|
|
"resource": "*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": ".env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": ".env.*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "*.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "**/.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "**/.env.*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "**/*.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "data/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "**/data/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "logs/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "**/logs/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "*",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": ".env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": ".env.*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "*.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "**/.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "**/.env.*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "**/*.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "data/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "**/data/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "logs/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "**/logs/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "rm *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "rmdir *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "mv *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "chmod *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "chown *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "sudo *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "curl *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "wget *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*.env*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*data/*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "* data",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*/data",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*logs/*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "* logs",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*/logs",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "question",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "subagent",
|
|
"resource": "*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "todo",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "todoread",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "todowrite",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "publish_execution_plan",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "get_operational_task_context",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "query_operational_task_data",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "publish_task_report",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "propose_task_action",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "add_task_human_evidence",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "query_project_data",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "final_answer",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "locate_features",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "zoom_to_map",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "show_chart",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "view_history",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "web_search",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "geocode",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
}
|
|
],
|
|
"providers": {
|
|
"deepseek": {
|
|
"name": "DeepSeek",
|
|
"env": [
|
|
"DEEPSEEK_API_KEY"
|
|
],
|
|
"package": "@opencode/ai/providers/openai-compatible",
|
|
"settings": {
|
|
"baseURL": "https://api.deepseek.com/v1",
|
|
"apiKey": "{env:DEEPSEEK_API_KEY}"
|
|
},
|
|
"models": {
|
|
"deepseek-flash": {
|
|
"name": "deepseek-flash",
|
|
"capabilities": {
|
|
"tools": true,
|
|
"input": [
|
|
"text"
|
|
],
|
|
"output": [
|
|
"text"
|
|
]
|
|
},
|
|
"limit": {
|
|
"context": 1000000,
|
|
"output": 393216
|
|
},
|
|
"compatibility": {
|
|
"reasoningField": "reasoning_content",
|
|
"requireReasoning": true
|
|
}
|
|
},
|
|
"deepseek-v4-flash": {
|
|
"name": "deepseek-v4-flash",
|
|
"capabilities": {
|
|
"tools": true,
|
|
"input": [
|
|
"text"
|
|
],
|
|
"output": [
|
|
"text"
|
|
]
|
|
},
|
|
"limit": {
|
|
"context": 1000000,
|
|
"output": 393216
|
|
},
|
|
"compatibility": {
|
|
"reasoningField": "reasoning_content",
|
|
"requireReasoning": true
|
|
}
|
|
},
|
|
"deepseek-v4-pro": {
|
|
"name": "deepseek-v4-pro",
|
|
"capabilities": {
|
|
"tools": true,
|
|
"input": [
|
|
"text"
|
|
],
|
|
"output": [
|
|
"text"
|
|
]
|
|
},
|
|
"limit": {
|
|
"context": 1000000,
|
|
"output": 393216
|
|
},
|
|
"compatibility": {
|
|
"reasoningField": "reasoning_content",
|
|
"requireReasoning": true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|