opencode-tamer-judge

LLM-powered guard for opencode — configurable approval system for file modifications and bash commands. The AI assistant asks your LLM before making changes. You stay in control.

How it works

A lightweight plugin intercepts tool calls (write, edit, bash) and forwards them to your configured LLM. The judge receives:

• The tool name and arguments being attempted
• The last messages from the conversation, in chronological order
• The active rules from rules.json

The LLM decides:

• ALLOW — permits the action
• BLOCK — rejects the action if it wasn't requested, is ambiguous, or is dangerous

The decision is based on the judge prompt, active rules, tool arguments, and conversation context.

This prevents the AI assistant from:

• Modifying files without being asked
• Running destructive commands
• Making changes that weren't requested

Configuration

All configuration lives in a single rules.json file.

Full example

{
  "version": "0.1.0",
  "rules": [
    {
      "id": "rule_001",
      "name": "Confirm before editing files",
      "trigger": {
        "tool": ["write", "edit", "bash"],
        "condition": "cross_file_or_delete"
      },
      "instruction": "Before modifying or deleting files, tell the user which files and changes are planned, then wait for explicit confirmation.",
      "intercept_level": "L2",
      "status": "active"
    }
  ],
  "judges": [
    {
      "id": "judge_001",
      "name": "Main Judge",
      "trigger": {
        "tool": ["edit", "bash", "write"],
        "condition": "always"
      },
      "status": "active",
      "promptFile": "judge_prompt.md",
      "judge": {
        "maxMessages": 10,
        "api": {
          "endpoint": "http://localhost:8080/v1/chat/completions",
          "model": "your-model-name",
          "apiKey": null,
          "temperature": 0.1,
          "maxTokens": 200
        },
        "bashModifyPatterns": [
          "rm.*-rf",
          "git.*reset.*--hard",
          "git.*push.*--force",
          "drop.*table",
          "dd.*if=",
          "mkfs"
        ]
      }
    }
  ]
}

Judges

| Field | Description | |---|---| | trigger.tool | Tools this judge applies to (write, edit, bash, * for all) | | promptFile | Path to the judge prompt (markdown file) | | judge.api.endpoint | OpenAI-compatible API URL | | judge.api.model | Model name | | judge.api.apiKey | API key (optional) | | judge.api.temperature | Sampling temperature | | judge.bashModifyPatterns | Regex patterns for bash commands that modify files | | judge.maxMessages | Max conversation context messages sent to LLM |

Intercept levels

| Level | Behavior | |---|---| | L1 | Hard block — instant rejection, no LLM call | | L2 | Logs the match and records a hit — does not block or confirm | | L3 | Logs a warning and suggests alternatives, does not block |

Trigger conditions

| Condition | When it activates | |---|---| | always | Every matching tool call | | cross_file_or_delete | Triggers on all write operations (v0.0 simplification) | | dangerous_command | Only for high-risk bash commands | | sudo | Bash commands requiring elevated privileges | | uncertainty_signal | Agent expresses uncertainty | | unread_file | Disabled in v0.0 — always false (needs session-level read tracking) |

Prompt file

The judge's reasoning logic lives in a separate markdown file (judge_prompt.md). Edit it without touching code to change judge behavior — personality, examples, permission categories, response format.

The prompt instructs the LLM to respond with pure JSON: {"allow": true, "reason": "..."} or {"allow": false, "reason": "..."}.

Built-in tools

The plugin registers two additional tools that the assistant can call on your behalf:

• tamer_remember — persists a correction as a personal rule. Requires explicit user confirmation before saving.
• tamer_rules — lists, enables, disables, or archives rules by ID. Useful for troubleshooting which rules are active.

Hits log

Every tool call evaluation is logged to ~/.tamer/hits.jsonl. This file can be used to audit which rules fired, how often, and what decisions the judge made.

Installation

npm install opencode-tamer-judge

Add the plugin to your opencode configuration. Configure rules.json (typically at ~/.tamer/rules.json) and the judge starts intercepting tool calls.

License

MIT