{
  "$schema": "https://opencode.ai/config.json",
  // Prevent accidentally sharing code on a remote edge server
  "share": "disabled",
  // OpenCode is in beta
  "autoupdate": false,
  // Global permissions - ensure all agents and sub-agents play safely
  "permission": {
    "bash": {
      // Default: always prompt for ANY shell command
      "*": "ask",
      // Remote-damaging Git operations
      "git push": "deny",
      "git push *": "deny",
      // Changing remotes can enable accidental pushes to the wrong place
      "git remote add *": "deny",
      "git remote remove *": "deny",
      "git remote set-url *": "deny",
      // Local destructive operations
      "git clean -f*": "deny",
      "git clean -x*": "deny",
      "git clean *-f*": "deny", // catches reordered flags
      "git reset --hard": "deny",
      "git reset --hard *": "deny",
      // Directory removal
      "rm -rf*": "deny",
      "rm -fr*": "deny",
      "rm -r *": "deny",
      "rm --recursive*": "deny",
      "rmdir *": "deny",
      // Repo hosting CLIs (if installed)
      "gh repo delete*": "deny",
      "glab repo delete*": "deny",
      // Safe commonly requested commands
      "dotnet *": "allow",
      "git diff *": "allow",
      "git log *": "allow",
      "git ls-files *": "allow",
      "git status *": "allow",
      "javap *": "allow",
      "ls *": "allow",
      "mkdir *": "allow",
      "mvn *": "allow",
      "npm *": "allow",
      "wc *": "allow"
    },
    "external_directory": "ask",
    // An agent can ask sub-agents with broader permissions to do work on their behalf
    "task": {
      "*": "ask",
      // Explore is read-only so safe to allow
      "explore": "allow",
      "general": "ask"
    },
    "skill": "deny",
    "lsp": "deny"
  },
  // Agent-specific overrides (agent rules take precedence)
  "agent": {
    // Prevent Plan agent from doing anything potentially dangerous at all
    "plan": {
      "permission": {
        "bash": "deny",
        "edit": "deny"
      }
    }
  }
}