AI coding tools
OpenCode Operating Card
Use OpenCode with version-correct permission rules, scoped agents, protected secrets, and a reviewed terminal evidence loop.
- Format
- Reference
- Level
- Beginner
- Audience
- Practitioner, Developer
- Owner
- Project42 Editorial
- Review cadence
- Every 30 days
- Prerequisites
- A supported OpenCode client; An approved model-provider path; A version-controlled workspace
Select the configuration generation before copying rules
OpenCode is available through terminal, desktop, and IDE surfaces and supports configurable agents and tools. Its permission schema can change between major configuration generations, so use documentation that matches the installed version.
Start from ask or deny rules for consequential actions and explicitly protect environment files, external directories, push operations, and unknown MCP tools.
Layer global and agent-specific authority
Initialize the project instructions, review global configuration, then define narrower agent permissions for specialized work such as read-only review. Pattern order and matching behavior are part of the security contract.
Review requested commands and edits, inspect the Git diff, and run the repository checks. Avoid auto mode until deny rules and the target workspace have been tested.
Task: [one observable result]
Scope: [workspace and external-directory boundary]
Permissions: [read, edit, shell, web, tools, and subagents]
Config generation: [installed version and matching schema]
Protected resources: [secrets, pushes, destructive commands]
Verification: [effective rules, diff, and tests]
Recovery: [deny action, stop agent, restore Git checkpoint]Expected evidence and verification
Expected evidence includes installed version, effective global and agent rules, approvals used, commands, final diff, and test output. Verify that rule precedence produced the intended decision for representative allowed and denied actions.
If the schema or permission result is wrong, stop the task, restore the reviewed configuration and files, correct the version-specific rules, and repeat the permission checks before implementation.