{
  "$schema": "https://opencode.ai/config.json",
  "permission": {
    "bash": {
      "*": "ask",
      // Git
      "git log *": "allow",
      "git commit *": "ask",
      "git status *": "allow",
      "git diff *": "allow",
      "git show *": "allow",
      "git push *": "ask",
      // Privilege escalation
      "sudo *": "deny",
      "su *": "deny",
      "doas *": "deny",
      // GNU Util
      "curl *": "ask",
      "wget *": "ask",
      "diff *": "allow",
      "rm *": "ask",
      "rm -rf *": "deny",
      "sort *": "allow",
      "which *": "allow",
      "ls *": "allow",
      "wc *": "allow",
      "head *": "allow",
      "tail *": "allow",
      // Go
      "go build *": "allow",
      "go test *": "allow",
      "go vet *": "allow",
      "go mod tidy": "allow",
      "go mod download": "allow",
      "gofmt *": "allow",
      // Node.js
      "npm ci": "allow",
      "npm test": "allow",
      "npm run build": "allow",
      "npm run lint": "allow",
      "npm run typecheck": "allow",
      "npm run check": "allow",
      "npm ls *": "allow",
      "npm outdated": "allow",
      "npm audit *": "allow",
      "npm run test:unit": "allow",
      "npm run test:integration": "allow",
      "npm run test:e2e": "allow",
      "npm run type-check": "allow",
      "npm run package:dev": "allow",
      "npx vitest run *": "allow",
      "npx *": "ask",
      // Python
      "python -m unittest *": "allow",
      "python -m py_compile": "allow",
      "python3 -m unittest *": "allow",
      "python3 -m py_compile": "allow",
      "python -m venv .venv": "allow",
      "python3 -m venv .venv": "allow",
      "source .venv/bin/activate": "allow",
      "ruff check *": "allow",
      "ruff format --check *": "allow",
      "ruff format *": "ask",
      // Dotnet
      "dotnet build *": "allow",
      "dotnet test *": "allow",
      "dotnet restore *": "allow",
      "dotnet format *": "allow",
      "dotnet vet *": "allow",
      "dotnet workload *": "ask",
      "dotnet run *": "allow",
      // Docker
      "docker ps *": "allow",
      "docker logs *": "allow",
      "docker compose logs *": "allow",
      "docker manifest inspect": "allow",
      // Ansible
      "ansible-playbook --version": "allow",
      "ansible-playbook --syntax-check *": "allow",
      "ansible-lint --version": "allow",
      // OpenTofu
      "tofu version": "allow",
      "tofu init -backend=false": "allow",
      "tofu validate *": "allow",
      "tofu fmt -check *": "allow",
      "tofu plan *": "allow",
    },
    "read": {
      "/tmp/opencode": "allow",
      "/tmp/opencode/*": "allow",
      "~/.ssh/known_hosts": "allow",
      // Env / secrets — recursive + variants
      ".env": "deny",
      ".env.*": "deny",
      "**/.env": "deny",
      "**/.env.*": "deny",
      ".secrets": "deny",
      "**/.secrets": "deny",
      ".secrets.*": "deny",
      // Key material
      "*.key": "deny",
      "*.pem": "deny",
      "*.p12": "deny",
      "*.pfx": "deny",
      "*.keystore": "deny",
      "*.jks": "deny",
      "*.kdbx": "deny", // KeePass
      // SSH keys — all algorithms incl. FIDO
      "id_rsa": "deny",
      "id_ecdsa": "deny",
      "id_ed25519": "deny",
      "id_dsa": "deny",
      "id_ecdsa_sk": "deny",
      "id_ed25519_sk": "deny",
      "~/.ssh/id_*": "deny", // catch-all absolute
      "~/.ssh/config": "deny", // may contain HostName + IdentityFile
      // Cloud / service credentials
      ".aws/credentials": "deny",
      "~/.aws/credentials": "deny",
      "~/.aws/config": "deny",
      "~/.config/gcloud/*": "deny",
      "~/.kube/config": "deny",
      "~/.npmrc": "deny", // often contains _authToken
      "~/.pypirc": "deny",
      "~/.netrc": "deny",
      "~/.docker/config.json": "deny",
      // Misc
      ".npmrc": "deny", // project-local tokens
      "**/.npmrc": "deny",
    },
    "edit": {
      "/tmp/opencode": "allow",
      "/tmp/opencode/*": "allow",
      // Explicit deny for dotfiles reduces accidental writes
      ".env*": "deny",
      ".git/*": "deny",
      "**/.git/*": "deny",
      ".hooks/*": "ask", // git hook injection
    },
    "grep": "allow",
    "glob": "allow",
    "question": "allow",
    "lsp": "allow",
    "websearch": "allow",
    "webfetch": "allow",
    "task": "allow",
    "todowrite": "allow",
    "skill": "allow",
  },
  "mcp": {
    "zai-mcp-server": {
      "type": "local",
      "command": ["npx", "-y", "@z_ai/mcp-server"],
      "environment": {
        "Z_AI_API_KEY": "{env:ZAI_API_KEY}",
        "Z_AI_MODE": "ZAI",
      },
    },
    "web-search-prime": {
      "type": "remote",
      "url": "https://api.z.ai/api/mcp/web_search_prime/mcp",
      "headers": {
        "Authorization": "Bearer {env:ZAI_API_KEY}",
      },
    },
    "web-reader": {
      "type": "remote",
      "url": "https://api.z.ai/api/mcp/web_reader/mcp",
      "headers": {
        "Authorization": "Bearer {env:ZAI_API_KEY}",
      },
    },
    "zread": {
      "type": "remote",
      "url": "https://api.z.ai/api/mcp/zread/mcp",
      "headers": {
        "Authorization": "Bearer {env:ZAI_API_KEY}",
      },
    },
    "playwright": {
      "type": "local",
      "enabled": false,
      "command": ["npx", "@playwright/mcp@latest"],
    },
    "chrome-devtools": {
      "type": "local",
      "enabled": false,
      "command": ["npx", "-y", "chrome-devtools-mcp@latest"],
    },
    "primevue": {
      "type": "local",
      "enabled": true,
      "command": ["npx", "-y", "@primevue/mcp"],
    },
    "ibmi-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@ibm/ibmi-mcp-server@latest",
        "--builtin-tools",
        "--tools",
        "{env:HOME}/.config/opencode/mcp/ibmi-mcp-server/tools",
      ],
      "enabled": false,
      "environment": {
        "DB2i_HOST": "{env:DB2i_HOST}",
        "DB2i_USER": "{env:DB2i_USER}",
        "DB2i_PASS": "{env:DB2i_PASS}",
        "DB2i_PORT": "8076",
        "YAML_ALLOW_DUPLICATE_SOURCES": "true",
        "SELECTED_TOOLSETS": "catalog",
      },
    },
  },
  "watcher": {
    "ignore": [
      "node_modules/**",
      ".git/**",
      "dist/**",
      "**/.venv/**",
      "**/target/**",
    ],
  },
  "lsp": true,
  "formatter": true,
  "model": "openai/gpt-5.6-sol",
  "small_model": "openai/gpt-5.6-luna",
  "agent": {
    "explore": {
      "model": "openai/gpt-5.6-luna",
    },
  },
  "share": "disabled",
  "snapshot": true,
  "plugin": ["./plugins/ibmi-gate.ts", "@slkiser/opencode-quota@latest"],
  "provider": {
    "zai": {},
    "openai": {},
  },
  "experimental": {
    "disable_paste_summary": true,
  },
}