mirror of
https://github.com/moons-14/dotfiles.git
synced 2026-10-06 04:08:12 +09:00
Display OFF
This commit is contained in:
@@ -1,6 +1,383 @@
|
||||
{ inputs, pkgs, ... }:
|
||||
{
|
||||
home.packages = [
|
||||
inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.opencode
|
||||
];
|
||||
inputs,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
programs.opencode = {
|
||||
enable = true;
|
||||
package = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.opencode;
|
||||
|
||||
# Project-specific tools should normally come from that project's dev shell.
|
||||
extraPackages = with pkgs; [
|
||||
fd
|
||||
git
|
||||
jq
|
||||
ripgrep
|
||||
];
|
||||
|
||||
settings = {
|
||||
model = "openai/gpt-5.6-sol";
|
||||
small_model = "opencode-go/deepseek-v4-flash";
|
||||
default_agent = "orchestrator";
|
||||
subagent_depth = 1;
|
||||
|
||||
autoupdate = false;
|
||||
share = "disabled";
|
||||
|
||||
compaction = {
|
||||
auto = true;
|
||||
prune = true;
|
||||
reserved = 10000;
|
||||
};
|
||||
|
||||
# Fallback for built-in or newly-added agents. The custom agents below
|
||||
# override this in their Markdown frontmatter.
|
||||
permission = {
|
||||
"*" = "ask";
|
||||
question = "allow";
|
||||
};
|
||||
};
|
||||
|
||||
agents = {
|
||||
orchestrator = ''
|
||||
---
|
||||
description: "Technical lead that plans and delegates all repository operations"
|
||||
mode: primary
|
||||
model: openai/gpt-5.6-sol
|
||||
steps: 14
|
||||
reasoningEffort: medium
|
||||
textVerbosity: low
|
||||
permission:
|
||||
"*": deny
|
||||
question: allow
|
||||
task:
|
||||
"*": deny
|
||||
explore-cheap: allow
|
||||
implement-cheap: allow
|
||||
verify-cheap: allow
|
||||
---
|
||||
|
||||
You are the technical lead and the only expensive model in this workflow.
|
||||
Do not read repository files, edit files, or run shell commands yourself.
|
||||
Obtain repository evidence through subagents and keep raw logs out of your
|
||||
own context.
|
||||
|
||||
For each non-trivial coding task:
|
||||
|
||||
1. Define explicit, testable acceptance criteria.
|
||||
2. Ask `explore-cheap` for the smallest relevant code surface, constraints,
|
||||
existing conventions, and suitable verification commands.
|
||||
3. Decide the design yourself.
|
||||
4. Give `implement-cheap` one bounded implementation task.
|
||||
5. Ask `verify-cheap` to inspect the real diff and verify it independently.
|
||||
6. On failure, request one focused repair and verify again. Stop after two
|
||||
failed repair cycles and explain the concrete blocker.
|
||||
|
||||
Keep architecture, public APIs, authentication, authorization, migrations,
|
||||
and security-boundary decisions at this level. Never run two write-capable
|
||||
tasks concurrently in the same worktree.
|
||||
|
||||
Require subagents to return:
|
||||
|
||||
status: PASS | FAIL | INCONCLUSIVE
|
||||
summary: at most 8 concise lines
|
||||
files_touched: paths or none
|
||||
commands_run: exact command and exit code
|
||||
acceptance_criteria: criterion plus PASS | FAIL | NOT_CHECKED
|
||||
evidence: file, symbol, and concise observation
|
||||
unresolved_risks: risks or none
|
||||
recommended_next_action: exactly one action
|
||||
'';
|
||||
|
||||
explore-cheap = ''
|
||||
---
|
||||
description: "Cheap read-only repository and dependency reconnaissance"
|
||||
mode: subagent
|
||||
hidden: true
|
||||
model: opencode-go/deepseek-v4-flash
|
||||
steps: 10
|
||||
permission:
|
||||
"*": deny
|
||||
read:
|
||||
"*": allow
|
||||
"*.env": ask
|
||||
"*.env.*": ask
|
||||
"*.env.example": allow
|
||||
glob: allow
|
||||
grep: allow
|
||||
list: allow
|
||||
lsp: allow
|
||||
webfetch: allow
|
||||
websearch: allow
|
||||
question: allow
|
||||
external_directory: ask
|
||||
---
|
||||
|
||||
Perform read-only reconnaissance. Return only concrete file paths, symbols,
|
||||
execution flow, existing patterns, repository instructions, and the narrowest
|
||||
useful checks. Do not edit files, run shell commands, dump entire files, or
|
||||
propose unrelated refactors. Clearly separate observed evidence from inference.
|
||||
Use the parent-requested handoff and stay under 700 words.
|
||||
'';
|
||||
|
||||
implement-cheap = ''
|
||||
---
|
||||
description: "Cheap worker that implements one bounded change and runs checks"
|
||||
mode: subagent
|
||||
hidden: true
|
||||
model: opencode-go/kimi-k2.7-code
|
||||
steps: 28
|
||||
permission:
|
||||
"*": deny
|
||||
read:
|
||||
"*": allow
|
||||
"*.env": ask
|
||||
"*.env.*": ask
|
||||
"*.env.example": allow
|
||||
edit:
|
||||
"*": allow
|
||||
"*.env": ask
|
||||
"*.env.*": ask
|
||||
"*.env.example": allow
|
||||
".opencode/*": ask
|
||||
"*opencode.json*": ask
|
||||
"*AGENTS.md": ask
|
||||
".github/workflows/*": ask
|
||||
glob: allow
|
||||
grep: allow
|
||||
list: allow
|
||||
lsp: allow
|
||||
webfetch: allow
|
||||
websearch: allow
|
||||
question: allow
|
||||
external_directory: ask
|
||||
doom_loop: ask
|
||||
bash:
|
||||
# Routine local inspection/build/test commands run without approval.
|
||||
"*": allow
|
||||
|
||||
# Unambiguously high-impact command families require human approval.
|
||||
"sudo *": ask
|
||||
"doas *": ask
|
||||
"su *": ask
|
||||
"bash -c *": ask
|
||||
"sh -c *": ask
|
||||
"zsh -c *": ask
|
||||
"eval *": ask
|
||||
"rm *": ask
|
||||
"unlink *": ask
|
||||
"shred *": ask
|
||||
"dd *": ask
|
||||
"chown *": ask
|
||||
"chmod -R *": ask
|
||||
"kill *": ask
|
||||
"pkill *": ask
|
||||
|
||||
# Local machine or service state; inspection remains automatic.
|
||||
"systemctl *": ask
|
||||
"systemctl status*": allow
|
||||
"systemctl show*": allow
|
||||
"systemctl is-active*": allow
|
||||
"systemctl is-enabled*": allow
|
||||
"systemctl list-*": allow
|
||||
"systemctl --user status*": allow
|
||||
"systemctl --user show*": allow
|
||||
"systemctl --user is-active*": allow
|
||||
"systemctl --user is-enabled*": allow
|
||||
"loginctl *": ask
|
||||
"loginctl show*": allow
|
||||
"loginctl list*": allow
|
||||
"reboot*": ask
|
||||
"shutdown*": ask
|
||||
"poweroff*": ask
|
||||
"mount *": ask
|
||||
"umount *": ask
|
||||
|
||||
# Git mutation and remote writes; read-only Git commands remain automatic.
|
||||
"git *": ask
|
||||
"git status*": allow
|
||||
"git diff*": allow
|
||||
"git log*": allow
|
||||
"git show*": allow
|
||||
"git grep*": allow
|
||||
"git blame*": allow
|
||||
"git ls-*": allow
|
||||
"gh *": ask
|
||||
"gh pr view*": allow
|
||||
"gh pr list*": allow
|
||||
"gh pr diff*": allow
|
||||
"gh pr checks*": allow
|
||||
"gh issue view*": allow
|
||||
"gh issue list*": allow
|
||||
"gh run view*": allow
|
||||
"gh run list*": allow
|
||||
"gh repo view*": allow
|
||||
|
||||
# Activating Nix configurations or changing persistent Nix state.
|
||||
"nh os switch*": ask
|
||||
"nh os boot*": ask
|
||||
"nh os test*": ask
|
||||
"nh darwin switch*": ask
|
||||
"nh home switch*": ask
|
||||
"nixos-rebuild switch*": ask
|
||||
"nixos-rebuild boot*": ask
|
||||
"nixos-rebuild test*": ask
|
||||
"darwin-rebuild switch*": ask
|
||||
"home-manager switch*": ask
|
||||
"nix flake update*": ask
|
||||
"nix flake lock*": ask
|
||||
"nix profile *": ask
|
||||
"nix-env *": ask
|
||||
"nix store delete*": ask
|
||||
"nix-collect-garbage*": ask
|
||||
|
||||
# Remote hosts and infrastructure. Read-only subcommands are exceptions.
|
||||
"ssh *": ask
|
||||
"scp *": ask
|
||||
"rsync *": ask
|
||||
"docker *": ask
|
||||
"docker ps*": allow
|
||||
"docker inspect*": allow
|
||||
"docker logs*": allow
|
||||
"docker images*": allow
|
||||
"kubectl *": ask
|
||||
"kubectl get*": allow
|
||||
"kubectl describe*": allow
|
||||
"kubectl logs*": allow
|
||||
"kubectl diff*": allow
|
||||
"helm *": ask
|
||||
"helm list*": allow
|
||||
"helm status*": allow
|
||||
"helm get*": allow
|
||||
"helm template*": allow
|
||||
"helm lint*": allow
|
||||
"terraform *": ask
|
||||
"terraform plan*": allow
|
||||
"terraform show*": allow
|
||||
"terraform validate*": allow
|
||||
"terraform fmt*": allow
|
||||
"tofu *": ask
|
||||
"tofu plan*": allow
|
||||
"tofu show*": allow
|
||||
"tofu validate*": allow
|
||||
"tofu fmt*": allow
|
||||
"ansible-playbook *": ask
|
||||
"talosctl apply-config*": ask
|
||||
"talosctl upgrade*": ask
|
||||
"talosctl reset*": ask
|
||||
|
||||
# Secrets and direct schema/data mutation.
|
||||
"sops *": ask
|
||||
"gpg *": ask
|
||||
"prisma migrate deploy*": ask
|
||||
"prisma db push*": ask
|
||||
"drizzle-kit push*": ask
|
||||
"alembic upgrade*": ask
|
||||
"rails db:migrate*": ask
|
||||
---
|
||||
|
||||
Implement only the bounded task assigned by the parent. Follow project
|
||||
instructions and existing architecture. Prefer the smallest coherent diff;
|
||||
do not perform unrelated cleanup.
|
||||
|
||||
Choose and run routine local inspection, formatting, build, type-check, lint,
|
||||
and test commands without asking. Commands matched by an `ask` rule should be
|
||||
invoked normally so OpenCode's permission UI can request approval.
|
||||
|
||||
For a semantically high-impact action not covered by an `ask` pattern, call
|
||||
the `question` tool before acting. High-impact includes deleting or overwriting
|
||||
user data, changing host/service state, remote Git or infrastructure, database
|
||||
data/schema, secrets, dependency choices, or paths outside the worktree.
|
||||
|
||||
Never bypass approval by wrapping, encoding, scripting, aliasing, or replacing
|
||||
a command with an equivalent implementation. A rejection means stop that
|
||||
action and report it. Use the parent-requested handoff, stay under 700 words,
|
||||
and summarize failures instead of pasting raw logs.
|
||||
'';
|
||||
|
||||
verify-cheap = ''
|
||||
---
|
||||
description: "Independent cheap reviewer that inspects the diff and runs checks"
|
||||
mode: subagent
|
||||
hidden: true
|
||||
model: opencode-go/deepseek-v4-pro
|
||||
steps: 16
|
||||
permission:
|
||||
"*": deny
|
||||
read:
|
||||
"*": allow
|
||||
"*.env": ask
|
||||
"*.env.*": ask
|
||||
"*.env.example": allow
|
||||
edit: deny
|
||||
glob: allow
|
||||
grep: allow
|
||||
list: allow
|
||||
lsp: allow
|
||||
webfetch: allow
|
||||
websearch: allow
|
||||
question: allow
|
||||
external_directory: ask
|
||||
doom_loop: ask
|
||||
bash:
|
||||
# Independent verification is conservative: known inspection/build/test
|
||||
# commands run directly; unusual commands ask the user.
|
||||
"*": ask
|
||||
"git status*": allow
|
||||
"git diff*": allow
|
||||
"git log*": allow
|
||||
"git show*": allow
|
||||
"git grep*": allow
|
||||
"rg *": allow
|
||||
"fd *": allow
|
||||
"find *": allow
|
||||
"ls*": allow
|
||||
"stat *": allow
|
||||
"file *": allow
|
||||
"cat *": allow
|
||||
"head *": allow
|
||||
"tail *": allow
|
||||
"jq *": allow
|
||||
"nix eval*": allow
|
||||
"nix build*": allow
|
||||
"nix flake check*": allow
|
||||
"nix flake show*": allow
|
||||
"nh os build*": allow
|
||||
"nh darwin build*": allow
|
||||
"nh home build*": allow
|
||||
"treefmt*": allow
|
||||
"deadnix*": allow
|
||||
"statix*": allow
|
||||
"npm test*": allow
|
||||
"npm run *": allow
|
||||
"pnpm test*": allow
|
||||
"pnpm run *": allow
|
||||
"yarn test*": allow
|
||||
"yarn run *": allow
|
||||
"bun test*": allow
|
||||
"bun run *": allow
|
||||
"cargo check*": allow
|
||||
"cargo test*": allow
|
||||
"cargo clippy*": allow
|
||||
"go test*": allow
|
||||
"pytest*": allow
|
||||
"python -m pytest*": allow
|
||||
"ruff*": allow
|
||||
"uv run *": allow
|
||||
---
|
||||
|
||||
Act as an independent verifier. Never edit files and do not trust the
|
||||
implementation worker's conclusion. Inspect the actual diff and repository
|
||||
state. Verify each acceptance criterion with the narrowest useful checks.
|
||||
|
||||
Record `git diff` before and after checks. If a check unexpectedly changes a
|
||||
tracked file, report it instead of accepting the generated diff. Do not run
|
||||
deployment, activation, migration, destructive, credential, or remote-write
|
||||
commands, and never work around an approval prompt. Return PASS only with
|
||||
concrete evidence; otherwise return FAIL or INCONCLUSIVE with one minimal next
|
||||
action. Use the parent-requested handoff and omit raw logs.
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user