opencode-armor

OpenCode plugin that blocks bash commands for long-running dev servers and prepends/appends arbitrary commands to every bash invocation.

Usage

Add to your OpenCode config (opencode.json):

{
  "plugin": ["opencode-armor"]
}

Configuration

Create a config file in any of these locations. Layers are merged in this order (later wins and merged instead of replacing):

1. ~/.opencode-armor.json — global
2. ./.opencode-armor.json — project root
3. ./.opencode/armor.json — project root

{
  "$schema": "https://github.com/NazmusSayad/opencode-armor/raw/refs/heads/schema/schema.json",
  "armor": {
    "priority": "whitelist",
    "message": "Blocked: `{{COMMAND}}` (matched `{{PATTERN}}`)",
    "blacklist": {
      "commands": ["custom-pattern"],
      "disableDefaults": false,
      "disableGlobal": false
    },
    "whitelist": {
      "commands": ["vitest"],
      "disableDefaults": false,
      "disableGlobal": false
    }
  },
  "command": {
    "before": { "command": "set -e", "comment": "Fail fast" },
    "after": { "command": "echo done", "comment": "Notify" }
  }
}

armor

Controls which bash commands are blocked. Patterns are case-insensitive and whitespace-normalized.

• priority — "whitelist" (default) or "blacklist".
• blacklist / whitelist — commands are substring patterns. disableDefaults skips the built-in list; disableGlobal skips the global config's list.
• message — custom block error. Placeholders: {{COMMAND}}, {{PATTERN}}.

By default, dev servers and watchers are blocked — e.g. npm run dev, yarn start, npx vite, npx next, npx nodemon, npx tsx watch, node --watch, pm2 start. npx next lint is allowed by default.

command

Inject a command at the start or end of every bash invocation. Skipped when the command already starts/ends with the injected string.

• before / after — { command, comment }. comment is appended after #.

Debugging

Set OPENCODE_ARMOR_ENABLE_LOG=true to write logs to os.tmpdir()/.opencode-armor-logs/.