* fix: migrate all agents to OpenCode v1.1.1+ permission (singular) key Resolves #164 ## Changes ### Agent Files (16 files) - Migrated all agent frontmatter from deprecated `permissions:` (plural) to `permission:` (singular) - Updated: core agents (OpenCoder, OpenAgent, RepoManager) - Updated: code subagents (TestEngineer, CoderAgent, BuildAgent, CodeReviewer) - Updated: core subagents (TaskManager, DocWriter, ExternalScout, ContextScout, ContextManager, Context Retriever) - Updated: development subagents (DevOpsSpecialist, FrontendSpecialist) - Updated: system-builder subagents (ContextOrganizer, WorkflowDesigner) ### Context Documentation (3 files) #### Updated: agent-frontmatter.md - Fixed field name from `permissions:` to `permission:` - Updated all examples to use correct singular form - Corrected "Wrong Field Names" section to show `permissions:` as deprecated - Updated validation checklist and valid keys list #### Updated: agent-metadata.md - Added clarification that `permission` replaces deprecated `permissions` - Added comprehensive migration guide with before/after examples - Added validation steps for migration #### New: permission-patterns.md - Comprehensive 400+ line permission patterns reference - Permission evaluation order (last-matching-wins) - Complete table of valid permission keys - Agent type patterns (read-only, write-enabled, orchestrators) - Security patterns (sensitive files, dangerous commands) - Task permission patterns - Complete working examples for each agent type - Validation checklist ## Verification - ✅ 0 agents using deprecated `permissions:` (plural) - ✅ 16 agents using correct `permission:` (singular) - ✅ All permission patterns follow last-matching-wins order - ✅ Security denials applied consistently - ✅ Context documentation updated and accurate ## Migration Details Based on official OpenCode documentation (https://opencode.ai/docs/agents/): - OpenCode v1.1.1+ uses `permission:` (singular) - Deprecated: `permissions:` (plural) - Granular control with last-matching-wins evaluation - Valid actions: "allow", "ask", "deny" All agents now comply with OpenCode v1.1.1+ standards. * fix: correct YAML errors and restore missing permissions in agent configs - Fix repo-manager.md duplicate permission section - Fix externalscout.md YAML indentation error - Remove old tools: section from devops-specialist.md - Restore context file permissions in context-manager.md - Restore test command permissions in tester.md - Clean up formatting in coder-agent.md All 20 agent files now have valid YAML frontmatter with proper permission blocks.
4.3 KiB
Standard: Agent YAML Frontmatter
Purpose: Valid OpenCode agent frontmatter structure and common mistakes to avoid
Priority: CRITICAL - Load this before creating or modifying agent files
Core Principle
Agent frontmatter must contain ONLY valid OpenCode fields. All other metadata (id, name, category, tags, dependencies) belongs in .opencode/config/agent-metadata.json.
Why: OpenCode validates frontmatter strictly. Extra fields cause validation errors.
Valid OpenCode Fields
Required
---
name: AgentName # Display name
description: "What this agent does" # When to use
mode: subagent # primary, subagent, or all
---
Optional
temperature: 0.1 # Response randomness (0.0-1.0)
model: anthropic/claude-sonnet-4 # Model override
maxSteps: 50 # Max iterations
disable: false # Disable agent
hidden: false # Hide from autocomplete
prompt: "{file:./prompts/custom.txt}" # Custom prompt
tools: # Tool access
read: true
write: false
edit: false
bash: false
task: false
permission: # Permission rules (v1.1.1+)
"*": "ask" # Catch-all (last-match-wins)
read: "allow" # Specific override
bash:
"*": "deny"
"git status*": "allow"
edit:
"**/*.env*": "deny"
task:
contextscout: "allow"
"*": "deny"
skills: # Skills to load
- task-management
Complete Example
---
name: TestEngineer
description: Test authoring and TDD agent
mode: subagent
temperature: 0.1
tools:
read: true
grep: true
edit: true
write: true
bash: true
task: true
permission:
bash:
"npx vitest *": "allow"
"pytest *": "allow"
"sudo *": "deny"
"*": "deny"
edit:
"**/*.env*": "deny"
task:
contextscout: "allow"
"*": "deny"
---
Common Mistakes (Fixed in 18 Agents)
1. Duplicate Keys ❌
tools:
read: true
read: {"**/*": "allow"} # ❌ Duplicate key
Fix: Use only one declaration per key
2. Orphaned List Items ❌
tools:
read: true
- write: false # ❌ No parent key
Fix: Proper YAML structure (no orphaned items)
3. Wrong Field Names ❌
permissions: # ❌ Deprecated - use 'permission' (singular)
bash:
"*": "deny"
Fix: Use correct field name permission: (singular, v1.1.1+)
4. Extra Delimiter Blocks ❌
---
name: MyAgent
---
# Content
--- # ❌ Extra delimiter
More content
Fix: Only one --- block at top
5. Invalid OpenCode Fields ❌
---
id: my-agent # ❌ Not valid
category: development # ❌ Not valid
type: agent # ❌ Not valid
version: 1.0.0 # ❌ Not valid
tags: [coding] # ❌ Not valid
dependencies: [] # ❌ Not valid
Fix: Move to .opencode/config/agent-metadata.json:
{
"agents": {
"my-agent": {
"id": "my-agent",
"category": "development",
"type": "agent",
"version": "1.0.0",
"tags": ["coding"],
"dependencies": []
}
}
}
Validation Checklist
- Only valid OpenCode fields?
- No duplicate keys?
- No orphaned list items?
- Correct field names (
permissionnotpermissions)? - Only one
---delimiter at top? - Metadata moved to agent-metadata.json?
- Valid YAML syntax?
Validation Commands
# Check YAML syntax
yq eval '.opencode/agent/category/agent.md' > /dev/null
# Find duplicate keys
grep -A 50 "^---$" agent.md | grep -E "^[a-z_]+:" | sort | uniq -d
# List all frontmatter keys
grep -A 50 "^---$" agent.md | grep -E "^[a-z_]+:" | cut -d: -f1
Valid keys: name, description, mode, temperature, model, maxSteps, disable, hidden, prompt, tools, permission, skills
Related
- Agent Metadata:
core-concepts/agent-metadata.md - Subagent Structure:
standards/subagent-structure.md - Adding Agents:
guides/adding-agent.md - OpenCode Docs: https://opencode.ai/docs/agents/
Last Updated: 2026-01-31 | Version: 1.0.0