Increase OpenCode rule coverage to align with S-tier expectations

[avifenesh]

Summary

OpenCode is S-tier but only has 18 rules vs Claude Code's 79. Research revealed a comprehensive TypeScript config schema.

OpenCode config surface (from research)

Config file: opencode.json (with $schema support)

Full schema discovered (from config.ts source):

Field	Type	Default	Validatable
$schema	string	https://opencode.ai/config.json	Validate URL
model	string (format: provider/model)	-	Validate format
small_model	string	-	Validate format
default_agent	string	build	Validate known agents
username	string	system	-
share	enum	-	manual/auto/disabled
autoupdate	boolean|"notify"	-	Type check
disabled_providers	string[]	-	Validate provider names
enabled_providers	string[]	-	Validate provider names
snapshot	boolean	-	Type check
plugin	string[]	-	Validate plugin identifiers

Agent configuration

Field	Type	Validatable
name	string	-
model	string	Validate format
variant	string	-
temperature	number	Range 0-2
top_p	number	Range 0-1
prompt	string	Content quality
disable	boolean	-
mode	enum	subagent/primary/all
color	string	Hex or theme color
steps	number	Positive integer
permission	Permission	Validate structure

Permission configuration

Field	Type	Values
read/edit/glob/grep/list/bash/task/lsp/skill	PermissionRule	ask/allow/deny or per-pattern
todowrite/todoread/question/webfetch/websearch	PermissionAction	ask/allow/deny
external_directory	PermissionRule	-
doom_loop	PermissionAction	-

MCP configuration

Local server: type: "local", command: string[], environment, enabled, timeout
Remote server: type: "remote", url, headers, oauth, enabled, timeout

Provider configuration

whitelist, blacklist, models, options (apiKey, baseURL, timeout)

Other

• compaction: auto, prune, reserved
• skills: paths[], urls[]
• formatter: per-language config or false
• lsp: per-language config or false
• server: port, hostname, mdns, cors
• experimental: feature flags

Proposed new rules

Config validation (OC-CFG-*)

Rule	What	Confidence
OC-CFG-001	Invalid model format (must be provider/model)	HIGH
OC-CFG-002	Invalid share value	HIGH
OC-CFG-003	Unknown top-level config field	MEDIUM
OC-CFG-004	Invalid default_agent (must be build or custom)	MEDIUM
OC-CFG-005	Hardcoded API key in provider options	HIGH
OC-CFG-006	Invalid MCP server structure	HIGH
OC-CFG-007	MCP server missing command (local) or url (remote)	HIGH

Agent validation (OC-AG-*)

Rule	What	Confidence
OC-AG-001	Invalid agent mode value	HIGH
OC-AG-002	Invalid color format (not hex or theme color)	HIGH
OC-AG-003	temperature out of range (0-2)	HIGH
OC-AG-004	steps not a positive integer	HIGH

Permission validation (OC-PM-*)

Rule	What	Confidence
OC-PM-001	Invalid permission action (not ask/allow/deny)	HIGH
OC-PM-002	Unknown permission key	MEDIUM

AGENTS.md quality (OC-AGM-*)

Rule	What	Confidence
OC-AGM-001	Empty AGENTS.md	HIGH
OC-AGM-002	Secrets in AGENTS.md	HIGH

Total: 15 new rules (18 current + 15 = 33, exceeds 30 target)

Acceptance criteria

• 15 new rules added to knowledge-base/rules.json and VALIDATION-RULES.md
• New OpenCodeConfigValidator extended
• Schema for opencode.json updated
• Tests for each new rule

[avifenesh]

Completed

All 24 OpenCode rules are implemented, tested (unit + fixture), and documented in rules.json + VALIDATION-RULES.md.

Existing 24 Rules

Rule	Name	Severity	Autofix
OC-001	Invalid Share Mode	HIGH	yes (unsafe)
OC-002	Invalid Instruction Path	HIGH	no
OC-003	opencode.json Parse Error	HIGH	no
OC-004	Unknown Config Key	MEDIUM	no
OC-006	Remote URL in Instructions	LOW	no
OC-007	Invalid Agent Definition	MEDIUM	no
OC-008	Invalid Permission Config	HIGH	yes (unsafe)
OC-009	Invalid Variable Substitution	MEDIUM	no
OC-SK-001	Unsupported Skill Field	MEDIUM	yes (safe)
OC-CFG-001	Invalid Model Format	HIGH	no
OC-CFG-002	Invalid autoupdate Value	HIGH	no
OC-CFG-003	Unknown Top-level Config Field	MEDIUM	no
OC-CFG-004	Invalid Default Agent	MEDIUM	no
OC-CFG-005	Hardcoded API Key	HIGH	no
OC-CFG-006	Invalid MCP Server Structure	HIGH	no
OC-CFG-007	MCP Server Missing Command or URL	HIGH	no
OC-AG-001	Invalid Agent Mode Value	HIGH	no
OC-AG-002	Invalid Color Format	HIGH	no
OC-AG-003	Temperature Out of Range	HIGH	no
OC-AG-004	Steps Not a Positive Integer	HIGH	no
OC-PM-001	Invalid Permission Action	HIGH	no
OC-PM-002	Unknown Permission Key	MEDIUM	no
OC-AGM-001	Empty AGENTS.md	HIGH	no
OC-AGM-002	Secrets in AGENTS.md	HIGH	no

Follow-up issue for additional rules based on latest OpenCode schema changes filed separately.