API tools faq
paste
Guest User

Untitled

a guest
Nov 6th, 2026
49
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
JSON 12.62 KB | Source Code | 0 0
raw download clone embed print report
  1. {
  2.   "$schema": "https://opencode.ai/config.json",
  3.   "model": "opencode-go/deepseek-v4.1-flash",
  4.   "small_model": "opencode/big-pickle",
  5.   "default_agent": "orchestrator",
  6.   //"websearch": { "provider": "deepseek" },
  7.  
  8.   // ===========================================================================
  9.   // Canonical OpenCode V2 configuration (global scope).
  10.   //
  11.   // Migrated from the V1 configuration. The original V1 file is preserved
  12.   // alongside this one as "opencode.jsonc.bak" (and in the timestamped backup
  13.   // directory) for reference/maintainability.
  14.   //
  15.   // V1 -> V2 changes applied:
  16.   //   - "plugin"                              -> "plugins"
  17.   //   - "compaction.preserve_recent_tokens"   -> "compaction.keep.tokens"
  18.   //   - "compaction.prune"                    -> dropped (no native V2 field)
  19.   //   - "provider"                            -> "providers"
  20.   //   - model "options"                       -> model "settings"
  21.   // ===========================================================================
  22.  
  23.   "plugins": [
  24.     "@tarquinen/opencode-dcp@latest",
  25.     "@slkiser/opencode-quota",
  26.     "oh-my-opencode-slim",
  27.     "@falentio/opencode-todo",
  28.     "@upstash/context7-opencode",
  29.     // { "package": "deepseek-web-retrieval", "options": { "fetchOverrideWebfetch": true } }
  30.   ],
  31.  
  32.   // ===========================================================================
  33.   // Secret protection — deny reading the OpenCode auth store and SSH material.
  34.   //
  35.   // Rules are last-match-wins, so the catch-all "allow" is listed first and the
  36.   // specific deny patterns follow. `read` matches the file path; every pattern
  37.   // form (relative, ~, $HOME, absolute, and a bare-name fallback) is included
  38.   // because path normalization for permission matching is not documented.
  39.   //
  40.   // NOTE: this only covers the `read` tool. `bash` and MCP tools are separate
  41.   // paths and are NOT restricted here. See docs/PERMISSIONS.md for the harness
  42.   // agent-level blocks.
  43.   // ===========================================================================
  44.   //"permission": {
  45.   //  "read": {
  46.   //    "*": "allow",
  47.   //    "~/.ssh": "deny",
  48.   //    "~/.ssh/**": "deny",
  49.   //    "$HOME/.ssh": "deny",
  50.   //    "$HOME/.ssh/**": "deny",
  51.   //    "/home/$USER/.ssh": "deny",
  52.   //    "/home/$USER/.ssh/**": "deny",
  53.   //    "**/.ssh/**": "deny",
  54.   //    "~/.local/share/opencode/auth.json": "deny",
  55.   //    "$HOME/.local/share/opencode/auth.json": "deny",
  56.   //    "/home/$USER/.local/share/opencode/auth.json": "deny",
  57.   //    "**/auth.json": "deny"
  58.   //  }
  59.   //},
  60.   "permissions": [
  61.     // Require approval for external-directory access.
  62.     { "action": "external_directory",  "resource": "*",  "effect": "ask"  },
  63.  
  64.     // DeepSeek websearch/webfetch
  65.     { "action": "websearch", "resource": "*", "effect": "allow" },
  66.     { "action": "webfetch", "resource": "*", "effect": "allow" },
  67.     // { "action": "deepseek_fetch", "resource": "*", "effect": "allow" },
  68.  
  69.     // General read access.
  70.     { "action": "read", "resource": "*", "effect": "allow"},
  71.  
  72.     // Protect SSH material and OpenCode authentication.
  73.     { "action": "read", "resource": "~/.ssh", "effect": "deny" },
  74.     { "action": "read", "resource": "~/.ssh/**", "effect": "deny" },
  75.     { "action": "read", "resource": "$HOME/.ssh", "effect": "deny" },
  76.     { "action": "read", "resource": "$HOME/.ssh/**", "effect": "deny" },
  77.     { "action": "read", "resource": "/home/$USER/.ssh", "effect": "deny" },
  78.     { "action": "read", "resource": "/home/$USER/.ssh/**", "effect": "deny" },
  79.     { "action": "read", "resource": "**/.ssh/**", "effect": "deny" },
  80.     { "action": "read", "resource": "~/.local/share/opencode/auth.json", "effect": "deny"},
  81.     { "action": "read", "resource": "$HOME/.local/share/opencode/auth.json", "effect": "deny"},
  82.     { "action": "read", "resource": "/home/$USER/.local/share/opencode/auth.json", "effect": "deny"},
  83.     { "action": "read", "resource": "**/auth.json", "effect": "deny" },
  84.  
  85.     // GitHub tools are scoped per agent through the OMO mcps list; only Wayfinder
  86.     // connects the github server, so no global deny is needed here.
  87.  
  88.   ],
  89.  
  90.   // ===========================================================================
  91.   // Same read-deny, applied explicitly to the built-in default agents.
  92.   //
  93.   // The global `permission` block above is merged with each agent's own rules,
  94.   // and AGENT RULES TAKE PRECEDENCE (docs/permissions). Both built-in agents
  95.   // start from a `*: allow` ruleset (build adds `read *.env: ask`; plan adds
  96.   // only `edit` denies), so the deny must be repeated in the agent block to be
  97.   // reliable. Rules are last-match-wins, so the catch-all allow comes first.
  98.   // ===========================================================================
  99.   "agents": {
  100.     "title": {
  101.       "model": "openrouter/free"
  102.     },
  103.  
  104.     "build": {
  105.       "permissions": [
  106.         { "action": "read", "resource": "*", "effect": "allow" },
  107.         { "action": "read", "resource": "~/.ssh", "effect": "deny" },
  108.         { "action": "read", "resource": "~/.ssh/**", "effect": "deny" },
  109.         { "action": "read", "resource": "$HOME/.ssh", "effect": "deny" },
  110.         { "action": "read", "resource": "$HOME/.ssh/**", "effect": "deny" },
  111.         { "action": "read", "resource": "/home/$USER/.ssh", "effect": "deny" },
  112.         { "action": "read", "resource": "/home/$USER/.ssh/**", "effect": "deny" },
  113.         { "action": "read", "resource": "**/.ssh/**", "effect": "deny" },
  114.         { "action": "read", "resource": "~/.local/share/opencode/auth.json", "effect": "deny" },
  115.         { "action": "read", "resource": "$HOME/.local/share/opencode/auth.json", "effect": "deny" },
  116.         { "action": "read", "resource": "/home/$USER/.local/share/opencode/auth.json", "effect": "deny" },
  117.         { "action": "read", "resource": "**/auth.json", "effect": "deny" }
  118.       ]
  119.     },
  120.  
  121.     "plan": {
  122.       "permissions": [
  123.         { "action": "read", "resource": "*", "effect": "allow" },
  124.         { "action": "read", "resource": "~/.ssh", "effect": "deny" },
  125.         { "action": "read", "resource": "~/.ssh/**", "effect": "deny" },
  126.         { "action": "read", "resource": "$HOME/.ssh", "effect": "deny" },
  127.         { "action": "read", "resource": "$HOME/.ssh/**", "effect": "deny" },
  128.         { "action": "read", "resource": "/home/$USER/.ssh", "effect": "deny" },
  129.         { "action": "read", "resource": "/home/$USER/.ssh/**", "effect": "deny" },
  130.         { "action": "read", "resource": "**/.ssh/**", "effect": "deny" },
  131.         { "action": "read", "resource": "~/.local/share/opencode/auth.json", "effect": "deny" },
  132.         { "action": "read", "resource": "$HOME/.local/share/opencode/auth.json", "effect": "deny" },
  133.         { "action": "read", "resource": "/home/$USER/.local/share/opencode/auth.json", "effect": "deny" },
  134.         { "action": "read", "resource": "**/auth.json", "effect": "deny" }
  135.       ]
  136.     },
  137.  
  138.     "orchestrator": {
  139.       "permissions": [
  140.         { "action": "read", "resource": "*", "effect": "allow" },
  141.         { "action": "read", "resource": "~/.ssh", "effect": "deny" },
  142.         { "action": "read", "resource": "~/.ssh/**", "effect": "deny" },
  143.         { "action": "read", "resource": "$HOME/.ssh", "effect": "deny" },
  144.         { "action": "read", "resource": "$HOME/.ssh/**", "effect": "deny" },
  145.         { "action": "read", "resource": "/home/$USER/.ssh", "effect": "deny" },
  146.         { "action": "read", "resource": "/home/$USER/.ssh/**", "effect": "deny" },
  147.         { "action": "read", "resource": "**/.ssh/**", "effect": "deny" },
  148.         { "action": "read", "resource": "~/.local/share/opencode/auth.json", "effect": "deny" },
  149.         { "action": "read", "resource": "$HOME/.local/share/opencode/auth.json", "effect": "deny" },
  150.         { "action": "read", "resource": "/home/$USER/.local/share/opencode/auth.json", "effect": "deny" },
  151.         { "action": "read", "resource": "**/auth.json", "effect": "deny" }
  152.       ]
  153.     },
  154.  
  155.     "explore": {
  156.       "disabled": true
  157.     },
  158.  
  159.     "general": {
  160.       "disabled": true
  161.     },
  162.  
  163.     "github-helper": {
  164.       "permissions": [
  165.         { "action": "github_*", "resource": "*", "effect": "allow"}
  166.       ]
  167.     },
  168.  
  169.     "wayfinder": {
  170.       "permissions": [
  171.         { "action": "github_*", "resource": "*", "effect": "allow"}
  172.       ]
  173.     }
  174.   },
  175.  
  176.   // V1: "compaction": { "auto": true, "prune": false, "preserve_recent_tokens": 20000 }
  177.   //"compaction": {
  178.   //  "auto": true,
  179.   //  "keep": {
  180.   //    "tokens": 20000
  181.   //  },
  182.   //  "buffer": 20000
  183.   //},
  184.   "compaction": { "auto" : false },
  185.  
  186.   "warming": {
  187.     "prompt": "Do not perform any work. Reply with exactly: OK",
  188.     "interval": "4 minutes",
  189.     "duration": "2 hours"
  190.   },
  191.  
  192.   // V1: "provider" -> "providers"; model "options" -> "settings".
  193.   "providers": {
  194.     "openrouter": {
  195.       "models": {
  196.         "deepseek/deepseek-chat-v3-0324": {
  197.           "settings": {
  198.             "provider": {
  199.               "order": ["deepseek"],
  200.               "allow_fallbacks": false
  201.             }
  202.           }
  203.         },
  204.  
  205.         "deepseek/deepseek-v4.1-flash-1017": {
  206.           "settings": {
  207.             "provider": {
  208.               //"order": ["inference-net/fp8", "cloudflare"],
  209.               "allow_fallbacks": false
  210.             }
  211.           }
  212.         },
  213.  
  214.         "deepseek/deepseek-v4.1-flash": {
  215.           "settings": {
  216.             "provider": {
  217.               "order": ["streamlake/fp8", "coreweave/fp8", "gmicloud/fp8", "novita/fp8"],
  218.               "only": ["streamlake/fp8", "coreweave/fp8", "gmicloud/fp8", "novita/fp8"],
  219.               "allow_fallbacks": false
  220.             }
  221.           }
  222.         },
  223.  
  224.         "deepseek/deepseek-v4-flash-0731": {
  225.           "settings": {
  226.             "provider": {
  227.               "order": ["streamlake/fp8"],
  228.               "only": ["streamlake/fp8"],
  229.               "allow_fallbacks": false
  230.             }
  231.           }
  232.         },
  233.  
  234.         "deepseek/deepseek-v4-pro-0813": {
  235.           "settings": {
  236.             "provider": {
  237.               "order": ["streamlake/fp8", "novita/fp8", "deepseek"],
  238.               "only": ["streamlake/fp8", "novita/fp8", "deepseek"],
  239.               "allow_fallbacks": false
  240.             }
  241.           }
  242.         },
  243.  
  244.         "openai/gpt-6-luna:flex": {
  245.           "limit": {
  246.             "context": 260000,
  247.             "output": 128000
  248.           },
  249.           "settings": {
  250.             "provider": {
  251.               "order": ["openai/flex"],
  252.               "only": ["openai/flex"],
  253.               "allow_fallbacks": false
  254.             }
  255.           }
  256.         },
  257.  
  258.         "openai/gpt-5.6-luna:flex": {
  259.           "limit": {
  260.             "context": 260000,
  261.             "output": 128000
  262.           },
  263.           "settings": {
  264.             "provider": {
  265.               "order": ["openai/flex"],
  266.               "only": ["openai/flex"],
  267.               "allow_fallbacks": false
  268.             }
  269.           }
  270.         },
  271.  
  272.         "z-ai/glm-5.3-flash": {
  273.           "settings": {
  274.             "provider": {
  275.               "order": [ "near-ai/fp8", "streamlake/fp8", "novita/fp8", "z-ai/fp8"], //, "streamlake/fp8", "novita/fp8",
  276.               "only": [ "near-ai/fp8", "streamlake/fp8", "novita/fp8", "z-ai/fp8"], //, "streamlake/fp8", "novita/fp8",
  277.               "allow_fallbacks": false
  278.             }
  279.           }
  280.         },
  281.  
  282.         "xiaomi/mimo-v2.6-flash": {
  283.           "settings": {
  284.             "provider": {
  285.               "order": ["xiaomi/fp8"],
  286.               "only": ["xiaomi/fp8"],
  287.               "allow_fallbacks": false
  288.             }
  289.           }
  290.         },
  291.  
  292.         "xiaomi/mimo-v2.6-pro": {
  293.           "settings": {
  294.             "provider": {
  295.               "order": ["xiaomi/fp8"],
  296.               "only": ["xiaomi/fp8"],
  297.               "allow_fallbacks": false
  298.             }
  299.           }
  300.         },
  301.  
  302.         "stealth/crouton-alpha": {
  303.           "settings": {
  304.             "allow_fallbacks": false
  305.           }
  306.         }
  307.       }
  308.     },
  309.     "deepseek": {}
  310.   },
  311.   "lsp": true,
  312.  
  313.   "mcp": {
  314.     "context7": {
  315.       "type": "remote",
  316.       "url": "https://mcp.context7.com/mcp",
  317.       "headers": {
  318.         "CONTEXT7_API_KEY": "{file:/run/user/1000/secure-secrets/context7_api_key}"
  319.       },
  320.       "enabled": true
  321.     },
  322.     "github": {
  323.       "type": "remote",
  324.       "url": "https://api.githubcopilot.com/mcp/",
  325.       "enabled": true,
  326.       "oauth": false,
  327.       "headers": {
  328.         "Authorization": "Bearer {file:/run/user/1000/secure-secrets/github_mcp_token_opencode}"
  329.       }
  330.     },
  331.     "firecrawl": {
  332.       "type": "remote",
  333.       "url": "https://mcp.firecrawl.dev/v2/mcp",
  334.       "enabled": true,
  335.       //"headers": {
  336.       //  "Authorization": "Bearer <FIRECRAWL_API_KEY>"
  337.       //}
  338.     },
  339.   }
  340. }
  341.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!