OpenCode: a read-only Plan pass that cannot touch your files

The Stack

Steps

1. 1

   Harden the plan agent to read-only and validate

   Pin models for build and plan, and set plan's permission edit=deny and bash=deny so an exploration pass cannot write. Tab into plan to get a proposal, then Tab into build to execute. CI parses opencode.json and asserts plan is read-only.

   cat > opencode.json <<'JSON'
   {
     "$schema": "https://opencode.ai/config.json",
     "agent": {
       "build": { "mode": "primary", "model": "provider/your-strong-model", "permission": { "edit": "allow", "bash": "allow" } },
       "plan":  { "mode": "primary", "model": "provider/your-cheaper-model", "permission": { "edit": "deny", "bash": "deny" } }
     }
   }
   JSON
   node -e 'const c=JSON.parse(require("fs").readFileSync("opencode.json","utf8"));const p=c.agent.plan.permission;if(p.edit==="deny"&&p.bash==="deny"&&c.agent.build){console.log("config OK: plan is read-only (edit=deny, bash=deny), build present")}else{console.log("BAD");process.exit(1)}'

2. 2

   Run the plan → build flow (the model step, not checked by CI)

   Tab into plan to analyze and get a proposal, then Tab into build to execute it. If you want plan to inspect history, swap the blanket deny for a per-command bash map ({"*": "deny", "git diff": "allow", "git log*": "allow"}). The analysis runs the model, so CI never claims it.