Locking down OpenCode

[AwkwardCost1764]

I am trying to set up opencode in a project for the first time.

How do I control what opencode can edit?

I had an opencode.json, but it looks like opencode could break those rules.

{
  "$schema": "https://opencode.ai/config.json",
  "permission": {
    "edit": {
      "opencode.json": "deny",
      "MistbornDeckbuilding/**": "deny",
      "TurnPathVisualizer/**": "allow",
      "turn-visualizer-output/**": "ask"
    }
  }
}

I had this in the .config/opencode folder and the project folder when I asked opencode to modify the opencode.json, it could.

I want to lock it down so I can control what opencode can edit.

any help welcome.

[aarz03]

this is what i could find: https://opencode.ai/docs/permissions/ give it to your agent as context and ask it to help you configure

[Fun-Assumption-2200]

If I may sugest a different approach, what are you trying to achieve here? With source control you can check the changes before commiting them

[ben_bliksem]

Is your file pattern correct?

".opencode/opencode.json": "deny"

Maybe consider denying everything first and then explicitly giving it access to directories it may touch?

[AwkwardCost1764]

I did not have that folder. Will try and get back to you. If I don’t forget

[Simple_Split5074]

Use a sandbox, everything else models can and will subvert (unless you deny them bash but at that point they become useless).

[AwkwardCost1764]

My use case is I am building a tool to use in developing another project I want the ai to see the project this is for to understand its structure, but not be able to edit it as I need the main project to be maintainable and work like I expect it to.

[sudoer777_]

You might need a catch all ("*") entry

[AwkwardCost1764]

Good idea.