@sandlada/opencode-ask

Read-only Ask agent for OpenCode v2. It answers questions without modifying the project, and appears alongside Build / Plan in the TUI agent cycle (Shift+Tab, Ctrl+X A, /agents).

• edit * → deny (never creates, edits, or deletes files)
• shell → a read-only allowlist runs without approval — git status/log/diff/show, ls / dir / rg / cat / head / tail / tree, tool --version, and pnpm test (running the project's tests is ask mode's job)
• anything else still pops one approval, then answers — git commit, rm, npm install, other test commands and builds (they execute project code), and any command not on the allowlist
• guard rules drop chained, redirected, and egress commands back to ask: compound commands (&&, ||, ;, &) and commands containing > or curl / ssh / rsync / Invoke-WebRequest / … prompt even when they start with an allowlisted program, so a read or a test run can never be turned into a write, an exfiltration, or a smuggled mutation silently
• subagent → deny except explore (can't escalate to a writing agent)
• question → allow
• Model-call guard: when the session agent is ask, the write / edit / patch tools are stripped from the request and a read-only reminder is appended to the system prompt.

Install

opencode plugin add @sandlada/opencode-ask

Or manually in opencode.jsonc:

{
  "$schema": "https://opencode.ai/config.json",
  "plugins": ["@sandlada/opencode-ask"]
}

Then restart the service (or the TUI) and run /agents — ask shows up as a primary agent.

Usage

Switch to Ask and ask anything read-only:

how does auth work in this project?
are tests green?

If you ask for a code change, it explains the plan and asks you to switch back to Build (or Plan) instead of editing.

Development

pnpm install
pnpm typecheck
pnpm build

Verify locally without publishing:

mkdir /tmp/ask-check
printf '{ "$schema": "https://opencode.ai/config.json", "plugins": ["%s"] }' "$PWD" > /tmp/ask-check/opencode.jsonc
cd /tmp/ask-check && opencode debug agents

ask should appear with mode: primary, edit: deny, shell resolving to allow for inspection commands (e.g. git status, pnpm test) and ask for everything else.

License

MIT © Kai Orion & Sandlada — see LICENSE.