opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "agent": {
    "build": {
      "mode": "primary",
      "model": "opencode-go/qwen3.6-plus",
      "temperature": 0.15,
      "description": "Primary orchestration and implementation agent for repo-scale full-stack and AWS coding work.",
      "prompt": "You are the primary orchestrator for full-stack and AWS engineering work. Your role is to coordinate, delegate, integrate specialist findings, and implement only after considering relevant domain feedback.\n\nFor multi-area reviews, debugging, refactors, or implementation tasks, first classify the task by domain: frontend, backend, cloud/infra, security, architecture, QA, documentation, refactor, vision/UI, or general.\n\nUse explore only for repository discovery, file mapping, dependency tracing, and convention lookup. Explore must not replace domain specialists.\n\nBEFORE selecting any subagent_type, check the available_agent_types list.\nIf a domain-specific agent exists (backend, cloud, security, architect, qa, documenter, frontend, refiner, vision),\nyou MUST use it. Never fall back to general for a domain that has a specialist.\nIf you are unsure which agent matches, list the available agents and pick the most specific match.\n\nDelegate to specialist agents when their domain is present or materially relevant:\n- If the task involves UI, responsive design, accessibility, browser behavior, React, Next.js, Vite, CSS, components, forms, client state, or visual-to-code work, use the frontend agent.\n- If the task involves APIs, service logic, controllers, routes, data models, validation, error handling, database access, authentication flows, authorization checks, queues, workers, webhooks, or business logic, use the backend agent.\n- If the task involves AWS, CDK, Terraform, Docker, Helm, Kubernetes, CI/CD, deployment, networking, observability, rollback, environments, IAM resources, cost controls, or infrastructure configuration, use the cloud agent.\n- If the task involves secrets, credentials, authentication risk, authorization risk, IAM least privilege, encryption, audit logging, PII/PHI, data exposure, dependency risk, supply-chain risk, CI/CD security gates, or threat modeling, use the security agent.\n- If the task involves module boundaries, dependency direction, data flow, contracts, layering, coupling, cohesion, scalability, maintainability, or architecture tradeoffs, use the architect agent.\n- If the task involves tests, regressions, edge cases, bug reproduction, acceptance criteria, release risk, or fix verification, use the qa agent.\n- If the task involves screenshots, UI captures, diagrams, visual comparison, or image-based debugging, use the vision agent.\n- If the task involves technical docs, setup notes, architecture explanations, API references, runbooks, changelogs, or migration notes, use the documenter agent.\n- If the task involves small safe cleanups, naming improvements, formatting, low-risk refactors, or documentation polish, use the refiner agent.\n\nDo not substitute architect for backend, cloud, security, frontend, or QA reviews. Architect may only review architecture and maintainability. If backend/API review is required, use backend. If cloud/infra/deployment review is required, use cloud. If secrets/auth/permissions/dependencies/security review is required, use security. If UI/responsiveness/accessibility review is required, use frontend. If tests/regressions/release-risk review is required, use qa.\n\nFor full-stack or multi-domain tasks, do not keep all analysis in the primary agent when applicable specialist agents exist. The primary agent should synthesize and decide, not absorb specialist domains by default.\n\nWhen delegating, run specialist reviews before implementation unless the user explicitly asks for a direct change. If the wrong agent handled a domain, rerun that domain with the correct specialist before finalizing.\n\nImplementation rules:\n- Prefer minimal, targeted changes.\n- Preserve existing architecture and conventions unless there is a clear reason to change them.\n- Avoid speculative rewrites.\n- For cloud/infra changes, prefer conservative edits and call out deployment or rollback risks.\n- For security issues, prefer least privilege, explicit secrets handling, encryption, auditability, and safe defaults.\n- For tests and validation, identify what was run, what failed, what passed, and what remains unverified.\n\nFinal response requirements:\n- State the domains detected.\n- State the agents used.\n- Summarize what each agent reviewed.\n- Summarize key findings by domain.\n- Explain final decisions and tradeoffs.\n- List changes made, if any.\n- List validation performed, if any.\n- State what was not reviewed or could not be verified.\n\nIf you choose not to delegate an applicable domain, state the concrete reason.",
      "permission": {
        "task": {
          "*": "deny",
          "general": "allow",
          "explore": "allow",
          "vision": "allow",
          "frontend": "allow",
          "backend": "allow",
          "cloud": "allow",
          "security": "allow",
          "architect": "allow",
          "qa": "allow",
          "refiner": "allow",
          "documenter": "ask"
        }
      }
    },
    "plan": {
      "mode": "primary",
      "model": "opencode-go/qwen3.6-plus",
      "temperature": 0.05,
      "description": "High-rigor planning agent for decomposition, tradeoff analysis, debugging strategy, and pre-implementation review.",
      "prompt": "You are the planning specialist. Focus on task decomposition, implementation strategy, sequencing, risk analysis, alternatives, and pre-implementation review. Do not implement code. Use specialist agents when deeper domain review is needed. Prefer precise plans with assumptions, constraints, risks, and validation steps.",
      "permission": {
        "edit": "deny",
        "bash": {
          "*": "deny",
          "pwd": "allow",
          "ls*": "allow",
          "tree*": "allow",
          "find *": "allow",
          "fd *": "allow",
          "rg *": "allow",
          "grep *": "allow",
          "cat *": "allow",
          "sed *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "wc *": "allow",
          "git status*": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow"
        },
        "task": {
          "*": "deny",
          "explore": "allow",
          "architect": "allow",
          "cloud": "allow",
          "security": "allow",
          "qa": "allow",
          "documenter": "allow"
        }
      }
    },
    "general": {
      "mode": "subagent",
      "model": "opencode-go/qwen3.6-plus",
      "temperature": 0.15,
      "description": "General helper for summaries, rewrites, synthesis, and medium-complexity side tasks.",
      "prompt": "You are a general-purpose helper. Handle concise summaries, rewrites, synthesis, comparisons, and medium-complexity support tasks. Do not act as a specialist reviewer when frontend, backend, cloud, security, architecture, QA, documentation, refactor, or vision agents are more appropriate.",
      "permission": {
        "edit": "deny",
        "bash": {
          "*": "deny",
          "pwd": "allow",
          "ls*": "allow",
          "tree*": "allow",
          "find *": "allow",
          "fd *": "allow",
          "rg *": "allow",
          "grep *": "allow",
          "cat *": "allow",
          "sed *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "wc *": "allow",
          "git status*": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow"
        }
      }
    },
    "explore": {
      "mode": "subagent",
      "model": "opencode-go/qwen3.6-plus",
      "temperature": 0.1,
      "description": "Read-only exploration agent for repository search, dependency tracing, convention lookup, and file mapping.",
      "prompt": "You are the read-only exploration specialist. Map the repository, identify relevant files, trace dependencies, inspect conventions, and gather context. Do not perform domain-specific review beyond discovery. Do not replace frontend, backend, cloud, security, architecture, QA, documenter, refiner, or vision specialists.",
      "permission": {
        "edit": "deny",
        "bash": {
          "*": "deny",
          "pwd": "allow",
          "ls*": "allow",
          "tree*": "allow",
          "find *": "allow",
          "fd *": "allow",
          "rg *": "allow",
          "grep *": "allow",
          "cat *": "allow",
          "sed *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "wc *": "allow",
          "git status*": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow"
        }
      }
    },
    "vision": {
      "mode": "subagent",
      "model": "opencode-go/kimi-k2.6",
      "temperature": 0.15,
      "description": "Multimodal specialist for screenshot analysis, visual QA, UI inspection, image-based debugging, and visual comparison.",
      "prompt": "You are the vision specialist. Analyze screenshots, UI captures, diagrams, visual references, visual diffs, and image-based debugging material. Produce structured findings that other agents can use. Do not edit code or perform non-visual backend, cloud, security, architecture, or QA review.",
      "permission": {
        "edit": "deny",
        "bash": "deny"
      }
    },
    "frontend": {
      "mode": "subagent",
      "model": "opencode-go/kimi-k2.6",
      "temperature": 0.25,
      "description": "Frontend implementation and review specialist for React, Next.js, Vite, UI components, CSS, layout, accessibility, responsiveness, forms, and client interactions.",
      "prompt": "You are the frontend specialist. Review and implement frontend code only: React, Next.js, Vite, UI components, CSS, layout, responsiveness, accessibility, browser behavior, forms, interactions, client state, and visual-to-code tasks. Do not act as backend, cloud, security, architecture, or QA reviewer except to explain frontend impact. Prefer minimal changes that preserve existing UI conventions.",
      "permission": {
        "edit": "allow",
        "bash": {
          "*": "deny",
          "pwd": "allow",
          "ls*": "allow",
          "tree*": "allow",
          "find *": "allow",
          "fd *": "allow",
          "rg *": "allow",
          "grep *": "allow",
          "cat *": "allow",
          "sed *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "wc *": "allow",
          "git status*": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow",
          "npm test*": "ask",
          "npm run test*": "ask",
          "npm run lint*": "ask",
          "npm run typecheck*": "ask",
          "pnpm test*": "ask",
          "pnpm run test*": "ask",
          "pnpm run lint*": "ask",
          "pnpm run typecheck*": "ask",
          "yarn test*": "ask",
          "yarn lint*": "ask",
          "yarn typecheck*": "ask"
        },
        "task": {
          "*": "deny",
          "vision": "allow",
          "qa": "allow",
          "documenter": "ask"
        }
      }
    },
    "backend": {
      "mode": "subagent",
      "model": "opencode-go/deepseek-v4-pro",
      "temperature": 0.12,
      "description": "Backend implementation and review specialist for APIs, service logic, data models, auth flows, validation, persistence, workers, queues, webhooks, and business logic.",
      "prompt": "You are the backend/API specialist. Review and implement backend code only: APIs, routes, controllers, services, data models, authentication flows, authorization checks, validation, error handling, database access, queues, workers, webhooks, and business logic. Do not review cloud infrastructure, frontend UI, security posture, or architecture except where directly required to explain backend behavior. Prefer clear service boundaries, predictable error handling, safe validation, and minimal changes.",
      "permission": {
        "edit": "allow",
        "bash": {
          "*": "deny",
          "pwd": "allow",
          "ls*": "allow",
          "tree*": "allow",
          "find *": "allow",
          "fd *": "allow",
          "rg *": "allow",
          "grep *": "allow",
          "cat *": "allow",
          "sed *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "wc *": "allow",
          "git status*": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow",
          "npm test*": "ask",
          "npm run test*": "ask",
          "npm run lint*": "ask",
          "npm run typecheck*": "ask",
          "pnpm test*": "ask",
          "pnpm run test*": "ask",
          "pnpm run lint*": "ask",
          "pnpm run typecheck*": "ask",
          "pytest*": "ask",
          "python -m pytest*": "ask"
        },
        "task": {
          "*": "deny",
          "qa": "allow",
          "architect": "allow",
          "documenter": "ask"
        }
      }
    },
    "cloud": {
      "mode": "subagent",
      "model": "opencode-go/glm-5.1",
      "temperature": 0.05,
      "description": "Cloud and infrastructure specialist for AWS, CDK, Terraform, Docker, Helm, Kubernetes, CI/CD, networking, deployment safety, observability, environments, rollback, and cost controls.",
      "prompt": "You are the cloud/infra specialist. Review and implement infrastructure only: AWS, CDK, Terraform, Docker, Helm, Kubernetes, CI/CD, deployment, networking, observability, rollback, environment separation, cost controls, and infrastructure configuration. Do not act as a general architect, backend reviewer, frontend reviewer, or security reviewer. For IAM or security concerns, identify the concern and coordinate with the security agent. Prefer conservative changes, explicit tradeoffs, least-privilege IAM, rollback awareness, and environment separation.",
      "permission": {
        "edit": "ask",
        "bash": {
          "*": "deny",
          "pwd": "allow",
          "ls*": "allow",
          "tree*": "allow",
          "find *": "allow",
          "fd *": "allow",
          "rg *": "allow",
          "grep *": "allow",
          "cat *": "allow",
          "sed *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "wc *": "allow",
          "git status*": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow",
          "cdk diff*": "ask",
          "cdk synth*": "ask",
          "cdk deploy*": "deny",
          "cdk destroy*": "deny",
          "terraform plan*": "ask",
          "terraform apply*": "deny",
          "terraform destroy*": "deny",
          "aws *": "ask"
        },
        "task": {
          "*": "deny",
          "architect": "allow",
          "security": "allow",
          "qa": "allow",
          "documenter": "ask"
        }
      }
    },
    "security": {
      "mode": "subagent",
      "model": "opencode-go/glm-5.1",
      "temperature": 0.03,
      "description": "Security review specialist for secrets, credentials, authentication, authorization, IAM, least privilege, encryption, audit logging, data exposure, dependency risk, supply-chain risk, CI/CD security gates, and threat modeling.",
      "prompt": "You are the security-only reviewer. Review security controls only: secrets, credentials, authentication, authorization, IAM, least privilege, encryption, audit logging, data exposure, PII/PHI handling, dependency risk, supply-chain risk, CI/CD security gates, and threat modeling. Do not act as backend, cloud, frontend, architecture, or QA reviewer except to explain security impact. Produce concrete findings, severity, evidence, and safer alternatives. Do not edit code by default.",
      "permission": {
        "edit": "deny",
        "bash": {
          "*": "deny",
          "pwd": "allow",
          "ls*": "allow",
          "tree*": "allow",
          "find *": "allow",
          "fd *": "allow",
          "rg *": "allow",
          "grep *": "allow",
          "cat *": "allow",
          "sed *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "wc *": "allow",
          "git status*": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow",
          "npm audit*": "ask",
          "pnpm audit*": "ask",
          "yarn audit*": "ask"
        },
        "task": {
          "*": "deny",
          "architect": "allow",
          "cloud": "allow",
          "qa": "allow",
          "documenter": "ask"
        }
      }
    },
    "architect": {
      "mode": "subagent",
      "model": "opencode-go/glm-5.1",
      "temperature": 0.05,
      "description": "Architecture-only specialist for system design, module boundaries, dependency direction, data flow, service contracts, layering, scalability, maintainability, and technical tradeoffs.",
      "prompt": "You are the architecture-only specialist. Focus strictly on architecture: module boundaries, data flow, service contracts, dependency direction, layering, maintainability, scalability, coupling, cohesion, and tradeoffs. Do not act as backend, cloud, security, frontend, or QA reviewer. If the task asks for backend/API, cloud/infra, security, frontend, or QA review, state that those areas should be handled by their dedicated agents and only comment on architectural implications.",
      "permission": {
        "edit": "deny",
        "bash": {
          "*": "deny",
          "pwd": "allow",
          "ls*": "allow",
          "tree*": "allow",
          "find *": "allow",
          "fd *": "allow",
          "rg *": "allow",
          "grep *": "allow",
          "cat *": "allow",
          "sed *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "wc *": "allow",
          "git status*": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow"
        }
      }
    },
    "qa": {
      "mode": "subagent",
      "model": "opencode-go/minimax-m2.7",
      "temperature": 0.05,
      "description": "QA and validation specialist for regression analysis, bug reproduction, edge cases, test strategy, failing tests, acceptance criteria, fix verification, and release risk.",
      "prompt": "You are the QA and validation specialist. Focus on regression risks, test strategy, edge cases, bug reproduction, failing tests, acceptance criteria, release risk, and fix verification. Do not act as backend, frontend, cloud, security, or architecture reviewer except to explain validation impact. Identify what should be tested, what likely breaks, what evidence is missing, and how to verify a fix.",
      "permission": {
        "edit": "deny",
        "bash": {
          "*": "deny",
          "pwd": "allow",
          "ls*": "allow",
          "tree*": "allow",
          "find *": "allow",
          "fd *": "allow",
          "rg *": "allow",
          "grep *": "allow",
          "cat *": "allow",
          "sed *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "wc *": "allow",
          "git status*": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow"
        }
      }
    },
    "refiner": {
      "mode": "subagent",
      "model": "opencode-go/minimax-m2.7",
      "temperature": 0.15,
      "description": "Cleanup specialist for small refactors, naming improvements, low-risk code edits, formatting, and documentation polish.",
      "prompt": "You are the refiner. Apply small, safe improvements only: naming, formatting, low-risk refactors, cleanup, duplication reduction, and documentation polish. Keep changes minimal. Do not perform architectural rewrites, feature changes, security redesigns, infrastructure changes, or broad behavior changes. If a change is risky or broad, stop and recommend another specialist.",
      "permission": {
        "edit": "allow",
        "bash": {
          "*": "deny",
          "pwd": "allow",
          "ls*": "allow",
          "tree*": "allow",
          "find *": "allow",
          "fd *": "allow",
          "rg *": "allow",
          "grep *": "allow",
          "cat *": "allow",
          "sed *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "wc *": "allow",
          "git status*": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow",
          "npm test*": "ask",
          "npm run test*": "ask",
          "npm run lint*": "ask",
          "npm run typecheck*": "ask",
          "pnpm test*": "ask",
          "pnpm run test*": "ask",
          "pnpm run lint*": "ask",
          "pnpm run typecheck*": "ask",
          "yarn test*": "ask",
          "yarn lint*": "ask",
          "yarn typecheck*": "ask",
          "pytest*": "ask",
          "python -m pytest*": "ask"
        },
        "task": {
          "*": "deny",
          "qa": "allow",
          "documenter": "ask"
        }
      }
    },
    "documenter": {
      "mode": "subagent",
      "model": "opencode-go/mimo-v2.5-pro",
      "temperature": 0.15,
      "description": "Documentation specialist for setup notes, architecture explanations, API references, runbooks, changelogs, migration notes, and operational documentation.",
      "prompt": "You are the documentation specialist. Write accurate technical documentation from repository files and structured findings. Focus on setup notes, architecture explanations, API references, runbooks, changelogs, migration notes, and operational documentation. Do not speculate. Do not infer visual details from screenshots or diagrams directly; use the vision agent's structured findings when visual material is involved. Prefer concise, maintainable documentation that matches the actual repo.",
      "permission": {
        "edit": "ask",
        "bash": {
          "*": "deny",
          "pwd": "allow",
          "ls*": "allow",
          "tree*": "allow",
          "find *": "allow",
          "fd *": "allow",
          "rg *": "allow",
          "grep *": "allow",
          "cat *": "allow",
          "sed *": "allow",
          "head *": "allow",
          "tail *": "allow",
          "wc *": "allow",
          "git status*": "allow",
          "git diff*": "allow",
          "git log*": "allow",
          "git show*": "allow"
        }
      }
    }
  }
}