jiang
75d8d526f9
Reuse OpenCode 2 HTTP/stdio clients with per-session read-only grants, native approval and sanitized owner-scoped MCP status. Narrow the environment inherited by trusted local MCP processes. Validated in an isolated checkout with bun run check and 20 focused tests.
391 lines
7.3 KiB
JSON
391 lines
7.3 KiB
JSON
{
|
|
"$schema": "https://opencode.ai/config.json",
|
|
"model": "deepseek/deepseek-flash",
|
|
"default_agent": "instruction",
|
|
"permissions": [
|
|
{
|
|
"action": "*",
|
|
"resource": "*",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "external_directory",
|
|
"resource": "*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": ".env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": ".env.*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "*.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "**/.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "**/.env.*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "**/*.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "data/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "**/data/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "logs/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "read",
|
|
"resource": "**/logs/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "*",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": ".env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": ".env.*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "*.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "**/.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "**/.env.*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "**/*.env",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "data/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "**/data/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "logs/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "edit",
|
|
"resource": "**/logs/**",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "rm *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "rmdir *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "mv *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "chmod *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "chown *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "sudo *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "curl *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "wget *",
|
|
"effect": "ask"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*.env*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*data/*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "* data",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*/data",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*logs/*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "* logs",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "*/logs",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "question",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "subagent",
|
|
"resource": "*",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"action": "todo",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "todoread",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "todowrite",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "publish_execution_plan",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "get_operational_task_context",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "query_operational_task_data",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "publish_task_report",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "propose_task_action",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "add_task_human_evidence",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "query_project_data",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "final_answer",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "locate_features",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "zoom_to_map",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "show_chart",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "view_history",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "web_search",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "geocode",
|
|
"resource": "*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "mcp_*",
|
|
"resource": "*",
|
|
"effect": "ask"
|
|
}
|
|
],
|
|
"providers": {
|
|
"deepseek": {
|
|
"name": "DeepSeek",
|
|
"env": [
|
|
"DEEPSEEK_API_KEY"
|
|
],
|
|
"package": "@opencode/ai/providers/openai-compatible",
|
|
"settings": {
|
|
"baseURL": "https://api.deepseek.com/v1",
|
|
"apiKey": "{env:DEEPSEEK_API_KEY}"
|
|
},
|
|
"models": {
|
|
"deepseek-flash": {
|
|
"name": "deepseek-flash",
|
|
"capabilities": {
|
|
"tools": true,
|
|
"input": [
|
|
"text"
|
|
],
|
|
"output": [
|
|
"text"
|
|
]
|
|
},
|
|
"limit": {
|
|
"context": 1000000,
|
|
"output": 393216
|
|
},
|
|
"compatibility": {
|
|
"reasoningField": "reasoning_content",
|
|
"requireReasoning": true
|
|
}
|
|
},
|
|
"deepseek-v4-flash": {
|
|
"name": "deepseek-v4-flash",
|
|
"capabilities": {
|
|
"tools": true,
|
|
"input": [
|
|
"text"
|
|
],
|
|
"output": [
|
|
"text"
|
|
]
|
|
},
|
|
"limit": {
|
|
"context": 1000000,
|
|
"output": 393216
|
|
},
|
|
"compatibility": {
|
|
"reasoningField": "reasoning_content",
|
|
"requireReasoning": true
|
|
}
|
|
},
|
|
"deepseek-v4-pro": {
|
|
"name": "deepseek-v4-pro",
|
|
"capabilities": {
|
|
"tools": true,
|
|
"input": [
|
|
"text"
|
|
],
|
|
"output": [
|
|
"text"
|
|
]
|
|
},
|
|
"limit": {
|
|
"context": 1000000,
|
|
"output": 393216
|
|
},
|
|
"compatibility": {
|
|
"reasoningField": "reasoning_content",
|
|
"requireReasoning": true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"mcp": {
|
|
"timeout": {
|
|
"startup": 10000,
|
|
"catalog": 10000,
|
|
"execution": 60000
|
|
},
|
|
"servers": {}
|
|
}
|
|
}
|