opencode.jsonc

{
  "$schema": "https://opencode.ai/config.json",
  // =========================================================================
  //  PROVIDER: self-hosted models exposed by the Onyxia platform.
  //  The gateway is Open WebUI (https://llm.lab.sspcloud.fr): it exposes an
  //  OpenAI-compatible layer on /v1 (distinct from the native /api API).
  //
  //  baseURL expected by OpenCode:  https://llm.lab.sspcloud.fr/v1
  //    -> OpenCode calls {baseURL}/chat/completions = /v1/chat/completions
  //    -> Fallback if /v1 is absent: https://llm.lab.sspcloud.fr/api  (see INSTALL.md)
  //
  //  The "models" KEYS below are confirmed (curl .../api/models):
  //  gemma4-26b-moe, qwen3-6-35b-moe, qwen3-vl. The gateway does not publish
  //  context/output limits; see the note in INSTALL.md if generation truncates.
  // =========================================================================
  "provider": {
    "onyxia": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "SSPCloud LLM (self-hosted)",
      "options": {
        "baseURL": "{env:OPENAI_BASE_URL}",
        "apiKey": "{env:OPENAI_API_KEY}"
      },
      "models": {
        "qwen3-6-35b-moe": {
          "name": "Qwen3 35B MoE — code & reasoning",
          "tools": true,
          "limit": {
            "context": 131072,
            "output": 32768
          }
        },
        "gemma4-26b-moe": {
          "name": "Gemma 4 26B MoE — fast / review",
          "tools": true,
          "limit": {
            "context": 131072,
            "output": 16384
          }
        },
        "qwen3-vl": {
          "name": "Qwen3 VL — vision (charts, diagrams, screenshots)",
          "tools": true,
          "limit": {
            "context": 65536,
            "output": 16384
          }
        }
      }
    }
  },
  // ---- Default model + small model (titles, summaries, compaction) ----
  "model": "onyxia/qwen3-6-35b-moe",
  "small_model": "onyxia/gemma4-26b-moe",
  // ---- Default agent at startup ----
  "default_agent": "plan",
  // =========================================================================
  //  PERMISSIONS — OpenCode is NOT sandboxed: every `bash` runs on the pod.
  //  Common data science tooling is broadly allowed; anything destructive or
  //  outbound (network, k8s mutations, rm) asks for confirmation.
  // =========================================================================
  "permission": {
    "edit": "allow",
    "webfetch": "ask",
    "bash": {
      "git *": "allow",
      "uv *": "allow",
      "pip *": "allow",
      "pixi *": "allow",
      "python *": "allow",
      "python3 *": "allow",
      "pytest*": "allow",
      "ruff *": "allow",
      "mypy *": "allow",
      "Rscript *": "allow",
      "R -e *": "allow",
      "quarto *": "allow",
      "make *": "allow",
      "mc *": "allow",
      "aws s3*": "allow",
      "mlflow *": "allow",
      "duckdb *": "allow",
      // Vault: read-only allowed; put/delete fall through to "*": "ask".
      "vault kv get*": "allow",
      "vault kv list*": "allow",
      // Argo: browsing is free, but submitting a workflow launches containers
      // on the cluster -> confirmation (consistent with kubectl apply).
      "argo list*": "allow",
      "argo get*": "allow",
      "argo logs*": "allow",
      "argo watch*": "allow",
      "argo submit*": "ask",
      "argo *": "ask",
      "kubectl get*": "allow",
      "kubectl describe*": "allow",
      "kubectl logs*": "allow",
      "kubectl top*": "allow",
      "kubectl apply*": "ask",
      "kubectl delete*": "ask",
      "docker *": "ask",
      "rm *": "ask",
      "curl *": "ask",
      "wget *": "ask",
      "*": "ask"
    },
    "skill": {
      "*": "allow"
    }
  },
  // =========================================================================
  //  AGENTS — 2 primary agents (Tab to switch) + 5 subagents, delegated
  //  automatically based on their "description" or invoked via @name.
  //  Each agent's system prompt lives in ./prompts/<agent>.md
  //
  //  python-ds / r-ds / mlops deliberately have NO tool restriction:
  //  they must execute and verify code; the global bash allowlist above
  //  (rm/curl/kubectl apply/docker/argo submit on "ask") keeps them in check.
  // =========================================================================
  "agent": {
    "build": {
      "mode": "primary",
      "model": "onyxia/qwen3-6-35b-moe",
      "temperature": 0.2,
      "prompt": "./prompts/build.md"
    },
    "plan": {
      "mode": "primary",
      "model": "onyxia/gemma4-26b-moe",
      "temperature": 0.1,
      "prompt": "./prompts/plan.md",
      "tools": {
        "write": false,
        "edit": false
      },
      "permission": {
        "bash": {
          "*": "ask"
        }
      }
    },
    "python-ds": {
      "mode": "subagent",
      "description": "Python data science / ML specialist on Onyxia (uv, ruff, polars, pandas, scikit-learn, pyarrow, s3fs). Use to write or refactor Python code for analysis, modelling, or pipelines.",
      "model": "onyxia/qwen3-6-35b-moe",
      "temperature": 0.2,
      "prompt": "./prompts/python-ds.md"
    },
    "r-ds": {
      "mode": "subagent",
      "description": "R data science specialist (tidyverse, data.table, targets, renv, testthat, aws.s3, arrow). Use for any R code for analysis, modelling, or reproducible pipelines.",
      "model": "onyxia/qwen3-6-35b-moe",
      "temperature": 0.2,
      "prompt": "./prompts/r-ds.md"
    },
    "mlops": {
      "mode": "subagent",
      "description": "Onyxia MLOps engineer: MLflow experiment tracking, parallel training via Argo Workflows (argo submit, CronWorkflow), GitOps deployment via ArgoCD, model packaging and productionization. Use to industrialize/deploy a model or schedule recurring jobs.",
      "model": "onyxia/qwen3-6-35b-moe",
      "temperature": 0.2,
      "prompt": "./prompts/mlops.md"
    },
    "reviewer": {
      "mode": "subagent",
      "description": "Read-only code reviewer: quality, reproducibility, security (no hardcoded secrets), R/Python best practices. Use to review a diff or a module before a commit.",
      "model": "onyxia/gemma4-26b-moe",
      "temperature": 0.1,
      "prompt": "./prompts/reviewer.md",
      "tools": {
        "write": false,
        "edit": false,
        "bash": false
      },
      "permission": {
        "bash": {
          // Read-only diagnostics — no file mutation, no network, no rm
          "ruff *lint*": "allow",
          "ruff check *": "allow",
          "ruff format --check *": "allow",
          "mypy *": "allow",
          "python -m py_compile *": "allow",
          "python -m pytest --collect-only *": "allow",
          "python -m pytest -q --collect-only *": "allow",
          "Rscript -e *": "allow",
          "R -e *": "allow",
          "*": "ask"
        }
      }
    },
    "dataviz-vision": {
      "mode": "subagent",
      "description": "Visual analysis (vision model): reads screenshots, matplotlib/ggplot charts, architecture diagrams, or dashboards to interpret them or suggest improvements. Use whenever an image is provided.",
      "model": "onyxia/qwen3-vl",
      "temperature": 0.3,
      "prompt": "./prompts/dataviz-vision.md",
      "tools": {
        "write": false,
        "edit": false,
        "bash": false
      }
    }
  },
  // =========================================================================
  //  MCP (optional) — disabled by default.
  //  Careful: a "local" MCP server executes a command on the pod;
  //  a "remote" one sends context outside the platform.
  //  Enable only knowingly (confidentiality of Insee data).
  // =========================================================================
  "mcp": {
    "excalidraw": {
      "type": "remote",
      "url": "https://api.excalidraw.com/api/v1/mcp",
      "enabled": false,
      "headers": {
        "Authorization": "Bearer {env:EXCALIDRAW_API_KEY}"
      }
    },
    "datagouv": {
      "type": "remote",
      "url": "https://mcp.data.gouv.fr/mcp",
      "enabled": false
    }
  },
  "autoupdate": "notify"
}