My OpenCode configuration file (Simplified)

opencode.jsonc

{
  "$schema": "https://opencode.ai/config.json",
  "model": "openai/gpt-5.6-luna",
  "small_model": "opencode/nemotron-3.5-lightning-free",
  "default_agent": "build",
  "subagent_depth": 1,

  // Default deny; each safe capability is explicitly granted below.
  "permission": {
    "*": "deny",
    "read": {
      "*": "allow",
      "*.env": "deny",
      "*.env.*": "deny",
      "*.env.example": "allow",
      "/tmp/**": "allow"
    },
    "glob": "allow",
    "grep": "allow",
    "lsp": "allow",
    "question": "allow",
    "edit": "allow",
    // Browser inspection is available to every role.
    "chrome-devtools_*": "allow",
    "external_directory": { "*": "deny", "/tmp/**": "allow" },
    // Any shell command not explicitly allowed still requires approval.
    "bash": {
      "*": "ask",
      "pwd": "allow",
      "ls": "allow",
      "ls *": "allow",
      "git status": "allow",
      "git status *": "allow",
      "git ls-files": "allow",
      "git ls-files *": "allow",
      "git diff --stat": "allow",
      "git diff --name-only": "allow",
      "git diff --name-status": "allow",
      "git diff --cached --stat": "allow",
      "git diff --cached --name-only": "allow",
      "git diff --cached --name-status": "allow",
      "sudo *": "deny",
      "doas *": "deny",
      "su *": "deny",
      "rm *": "deny",
      "rmdir *": "deny",
      "git reset --hard *": "deny",
      "git clean *": "deny",
      "git push --force *": "deny",
      "git push -f *": "deny"
    },
    "task": { "*": "deny" }
  },

  // Ignore generated and dependency directories.
  "watcher": {
    "ignore": [
      ".git/**", "node_modules/**", "vendor/**", ".venv/**", "venv/**",
      "__pycache__/**", "dist/**", "build/**", "target/**", ".terraform/**"
    ]
  },
  "compaction": { "auto": true, "prune": true, "reserved": 10000 },

  // Primary roles orchestrate work; subagents have narrow responsibilities.
  "agent": {
    "plan": {
      // Analysis only; it cannot edit files.
      "mode": "primary",
      "model": "openai/gpt-5.6-sol",
      "reasoningEffort": "high",
      "textVerbosity": "low",
      "steps": 15,
      "permission": {
        "edit": "deny",
        "bash": { "*": "deny", "git status": "allow", "git status *": "allow", "git diff": "allow", "git diff *": "allow" },
        "task": { "*": "deny", "explore": "allow", "scout": "allow" }
      }
    },

    "build": {
      // Default implementation role.
      "mode": "primary",
      "model": "openai/gpt-5.6-luna",
      "reasoningEffort": "medium",
      "textVerbosity": "low",
      "permission": {
        "task": { "*": "deny", "explore": "allow", "scout": "allow", "general": "allow", "expert": "allow" }
      }
    },

    "expert": {
      // The single high-reasoning escalation path.
      "description": "Use only for difficult analysis, architecture, security, concurrency, migrations, trade-offs, or high-risk reviews.",
      "mode": "subagent",
      "model": "openai/gpt-5.6-sol",
      "reasoningEffort": "high",
      "textVerbosity": "low",
      "steps": 15,
      "prompt": "Analyze and recommend; never modify files or expose secrets. Give concrete risks and actions, not speculative redesigns.",
      "permission": {
        "edit": "deny",
        "bash": { "*": "deny", "git status": "allow", "git status *": "allow", "git diff": "allow", "git diff *": "allow", "git log --oneline *": "allow" }
      }
    },

    "general": { "mode": "subagent", "model": "openai/gpt-5.6-luna", "reasoningEffort": "medium", "textVerbosity": "low" },

    "explore": {
      // Read-only repository discovery.
      "mode": "subagent",
      "model": "openai/gpt-5.6-luna",
      "steps": 10,
      "permission": { "edit": "deny", "bash": "deny" }
    },

    "scout": {
      // Read-only external research.
      "mode": "subagent",
      "model": "openai/gpt-5.6-luna",
      "steps": 10,
      "permission": { "edit": "deny", "bash": "deny", "webfetch": "allow", "websearch": "allow" }
    },

    "web-admin": {
      "description": "Own website strategy, content, SEO, structured data, social, and publishing quality.",
      "mode": "primary",
      "model": "openai/gpt-5.6-luna",
      "reasoningEffort": "medium",
      "prompt": "Preserve site voice. Edit content and metadata only; use research only when facts require it.",
      "permission": {
        "skill": { "*": "deny", "web-admin-*": "allow" },
        "task": { "*": "deny", "explore": "allow", "scout": "allow", "general": "allow", "expert": "allow" }
      }
    },

    "devops": {
      // Infrastructure MCP tools are scoped to this role.
      "description": "Own infrastructure, Kubernetes, CI/CD, networking, observability, and operations.",
      "mode": "primary",
      "model": "openai/gpt-5.6-luna",
      "reasoningEffort": "medium",
      "prompt": "Inspect first, prefer minimal reversible changes, and never expose secrets.",
      "permission": {
        "skill": { "*": "deny", "devops-*": "allow" },
        "kubernetes_*": "allow",
        "kubernetes-local_*": "allow",
        "grafana_*": "ask",
        "task": { "*": "deny", "explore": "allow", "scout": "allow", "general": "allow", "expert": "allow" }
      }
    },

    "backend-dev": {
      "description": "Own APIs, services, data access, jobs, integrations, and server-side reliability.",
      "mode": "primary",
      "model": "openai/gpt-5.6-luna",
      "reasoningEffort": "medium",
      "prompt": "Inspect contracts and tests first. Make minimal, secure backend changes with clear error handling.",
      "permission": {
        "task": { "*": "deny", "explore": "allow", "scout": "allow", "general": "allow", "expert": "allow" }
      }
    },

    "frontend-dev": {
      "description": "Own UI, UX, accessibility, responsiveness, and frontend quality.",
      "mode": "primary",
      "model": "openai/gpt-5.6-luna",
      "temperature": 0.7,
      "reasoningEffort": "medium",
      "prompt": "Preserve existing patterns and optimize usability, accessibility, and responsive behavior.",
      "permission": {
        "skill": { "*": "deny", "designer-*": "allow" },
        "task": { "*": "deny", "explore": "allow", "scout": "allow", "general": "allow", "expert": "allow" }
      }
    }
  },

  // Replace the version placeholders and set the three environment variables.
  "mcp": {
    "chrome-devtools": {
      "type": "local",
      "command": ["npx", "-y", "chrome-devtools-mcp@<PINNED_VERSION>", "--slim", "--headless"]
    },
    "kubernetes": {
      "type": "local",
      "command": ["npx", "-y", "kubernetes-mcp-server@<PINNED_VERSION>", "--read-only", "--disable-multi-cluster"]
    },
    "kubernetes-local": {
      "type": "local",
      "command": ["npx", "-y", "kubernetes-mcp-server@<PINNED_VERSION>", "--kubeconfig", "{env:LOCAL_KUBECONFIG}", "--disable-multi-cluster"]
    },
    "grafana": {
      "type": "local",
      "command": ["mcp-grafana", "-t", "stdio"],
      "environment": {
        // Never paste credentials into this file.
        "GRAFANA_URL": "{env:GRAFANA_URL}",
        "GRAFANA_SERVICE_ACCOUNT_TOKEN": "{env:GRAFANA_SERVICE_ACCOUNT_TOKEN}"
      }
    }
  }
}