OpenConfig

    ╭───╮
    │oc │──── OpenConfig
    ╰───╯     Pinned stack for OpenCode · OpenRouter · OmO

Pinned, hardened config-as-code stack for OpenCode + OpenRouter + oh-my-openagent (OmO). OpenRouter general gateway, Venice content-aware lane, 13 curated OpenRouter models + 4 Venice DeepSeek slugs, deployment guards, cost-aware fallbacks — one install, zero drift.

v1.5.74 · CLI oc · identity jesseoue/opencode-configs

Keywords: OpenCode config · OpenRouter gateway · Venice · oh-my-openagent · AI agent config · LLM model routing · multi-agent coding · DeepSeek · Gemini · GLM · Qwen · Kimi · circuit breaker · cost-aware fallback · deployment protection · content-aware research

# Clone
git clone https://github.com/jesseoue/opencode-configs
cd opencode-configs
./install.sh --yes          # or: oc install --quick

# Fresh machine
curl -fsSL https://github.com/jesseoue/opencode-configs/raw/main/install.sh | bash
source ~/.zshrc && oc doctor && oc launch

Pins	OpenConfig 1.5.74 · OpenCode 1.18.30+ · OmO oh-my-openagent@4.19.4 · @opencode-ai/plugin 1.18.30
Default lead	sisyphus (GLM 5.3)
Config path	~/.config/opencode → this repo (symlink)
Projects home	oc new → ~/Projects/<name>
Health	oc doctor · oc versions · oc test · oc models --probe

Plugin name must stay oh-my-openagent@… (not legacy oh-my-opencode).
Schema URL basename stays omo.schema.json (legacy oh-my-opencode.schema.json / oh-my-openagent.schema.json 404 — oc validate rejects both).

Decision log: AGENTS.md · Stance: prompts/core.md · Changelog: CHANGELOG.md

Forking: update signature.json → github_b64 to your repo URL, then oc fix && oc signature --refresh.

---

Features

Capability	What you get
OpenRouter general gateway	GLM, DeepSeek, Gemini, MiniMax, Qwen, Kimi via one OPENROUTER_API_KEY — no direct OpenAI/Anthropic/Google keys
13 curated OpenRouter models	DeepSeek V4 Pro 0813 / V4.1 Flash / Flash 0731 · GLM 5.3 / GLM 5.3 Flash · Gemini 3.1 Pro / 3.8 Flash · Qwen 3.8 Max-0902 · Kimi K2.7 Code · MiniMax M3 · Hermes 4 405B (catalog-only) · Laguna S 2.1 · LongCat 2.0
Venice content-aware lane	content-aware-research / -deep on venice/deepseek-v4-pro-0813; flash agent content-aware-fast on venice/deepseek-v4-1-flash; fallbacks -pro / -flash-0731. Edit denied on research. Never openrouter/… here
Cost-aware fallbacks	runtime_fallback with per-request budget caps, budget-pressure degradation, and credit thresholds
Circuit breaker	Consecutive-failure trip, half-open retries, cooldown, notify-on-trip — protects against provider outages
Deployment guards	oc deploy check gates on credits, model health, rate limits, git cleanliness, and signature before you ship
Quarantine mode	oc deploy quarantine auto-swaps to cheaper models when credits run low; one command to restore
Multi-agent teams	Sisyphus / Hephaestus / Prometheus / Atlas / content-aware-research + 7 team specs (tmux panes)
T3 Code pin	t3-opencode.json — OpenCode serve 127.0.0.1:4097, same curated slugs, no keys
Config-as-code hygiene	Deny-all .gitignore, signature fingerprinting, oc validate (113 checks), oc fix self-repair, smoke via oc test, hermetic GitHub Actions (.github/workflows/check.yml)
Privacy by default	Telemetry off everywhere, .env never committed, allowlist-only env sync, no host paths in source

---

Install

export OPENROUTER_API_KEY=…     # required — GLM / DeepSeek / Gemini / Qwen / Kimi via OpenRouter
export VENICE_API_KEY=…         # content-aware lane only (venice/deepseek-v4-*)
export EXA_API_KEY=…            # OmO websearch
export CONTEXT7_API_KEY=…       # library docs

oc install --quick
oc signature && oc test && oc versions && oc doctor
oc launch

Or edit keys after install:

$EDITOR ~/.config/opencode/.env   # chmod 600; never commit
source ~/.zshrc
oc doctor && oc launch

---

CLI

oc install --quick     # install / refresh
oc check               # validate + doctor --quick
oc heal                # probe-first self-repair
oc launch [dir]        # TUI (never starts in the config repo)
oc new myapp           # scaffold under ~/Projects
oc run "…"             # headless to completion
oc admin health        # live OpenRouter model probes + rate limits
oc cursor apply        # point Cursor at OpenRouter /api/v1/cursor
oc models --probe       # fast parallel live test (latency + moderation flags)
oc models --moderation  # provider moderation/data-policy catalog (no chat calls)
oc models --providers   # OpenRouter endpoint health for routed models
oc versions            # pins vs npm + GitHub (+ other opencode.json)
oc versions --fix       # align ~/.opencode @opencode-ai/plugin to CLI
oc plugin doctor       # OmO pin-cache doctor (also: oc plugin --fix)
oc cursor setup        # Cursor + OpenRouter wiring (dedicated /api/v1/cursor endpoint)
oc locate              # repo / CLI / keys
oc signature           # identity fingerprint
oc test                # smoke + idempotency + runtime diagnostics
oc doctor              # full readiness
oc doctor --quick --json   # machine summary (heal/check tooling)
oc deploy check        # pre-deployment gate (credits, models, rate limits, git, signature)
oc deploy quarantine   # cost-saving mode (swap to cheaper models)
oc deploy status       # lock state + credit balance + alert log

Prefer oc <cmd> over raw ./foo.sh. Full help: oc help.

Aliases: oc health/ready → check · oc repair → heal · oc verify → validate · oc where → locate · oc sig → signature · oc pins → versions · oc omo → plugin

---

Package pins

Floors and the OmO pin live in versions.json. The OmO plugin string in opencode.json must match. Audit anytime:

oc versions              # local pins + npm/GitHub latest
oc versions --local      # no network
oc versions --json       # machine-readable
oc versions --fix         # set ~/.opencode @opencode-ai/plugin to match OpenCode CLI

Package	Source of truth	Current
OpenConfig	versions.json → opencode_configs	1.5.74
OpenCode CLI	install + versions.json → opencode.min	1.18.30+
OmO	opencode.json plugin + versions.json → oh_my_openagent.pin	4.19.4
@opencode-ai/plugin	~/.opencode/package.json (peer; not in this repo)	match CLI

oc versions also lists other opencode.json files under your projects home (projects.json → projects_dir, override with OC_PROJECTS_DIR). Those are project overlays — OmO stays pinned globally here.

---

Tools

Need	Tool	Notes
Local code	read · grep · glob · codegraph · LSP	Always first
Library / framework APIs	Context7 MCP	resolve-library-id → query-docs
GitHub call sites	grep_app (OmO)	Public-repo patterns
Current web	websearch (Exa)	Ideal-page queries; then webfetch
Known URL	webfetch	Clean markdown
Screenshots / UI	look_at (OmO)	multimodal-looker

Exa: describe the ideal page, not keyword soup. Optional: category:company · category:people · category:news · category:research paper.

Surface	Status
Context7 MCP	Enabled (CONTEXT7_API_KEY)
Exa websearch	Enabled (EXA_API_KEY)
codegraph	OmO-managed 1.4.1 daemon · auto-index off · telemetry off · ~/.omo/codegraph
LSP	TypeScript · Python · Go only
Formatters	Prettier + Ruff
Skills	content-aware-recon · content-aware-audit under skills/ (fenced)
OmO security-* skills	Disabled (hang headless oc run) — use local content-aware skills
Extra MCPs	Disabled (PostHog, Sentry, Playwright, Slack, Stripe, Supabase, Clerk, Vercel, Axiom, AgentMemory)
Telemetry	Off (OpenCode share/OTel · OmO PostHog · codegraph · DO_NOT_TRACK)

Disabled on purpose (noisy / footguns): interactive_bash, monitor tools, session_list / session_search.

Encoded in prompts/core.md, sisyphus, and librarian.

---

Cursor + OpenRouter

Cursor BYOK must use OpenRouter's dedicated Cursor endpoint, not the generic OpenAI-compatible URL. The generic /api/v1 path does not accept Cursor's flat tool format.

Docs: OpenRouter Cursor integration

oc cursor setup     # print wiring + current settings.json check
oc cursor apply     # set openai.baseUrl → https://openrouter.ai/api/v1/cursor
oc cursor models    # pinned model ids (same whitelist as OpenCode)
oc cursor usage     # last-30-day OpenRouter activity by model
oc cursor probe     # tiny live call through /api/v1/cursor

oc cursor apply writes openai.baseUrl, injects every pin in cursor-openrouter.json, and stores your .env OPENROUTER_API_KEY in Cursor Safe Storage (not git). Fully quit Cursor (Cmd+Q) before the sqlite inject; Reload Window flushes the old in-memory list and undoes it. Reopen, then pick z-ai/glm-5.3 in Agent — not Composer (Composer ignores BYOK). Tab completions stay Cursor-native.

---

Agents

Primary

Agent	Model	Role
sisyphus	GLM 5.3	Default orchestrator / lead
hephaestus	GLM 5.3	Implementation
prometheus	GLM 5.3	Planner
atlas	GLM 5.3	Plan executor after /start-work
content-aware-research	Venice DeepSeek V4 Pro 0813	Full-depth research (edit denied)
content-aware-fast	Venice DeepSeek V4.1 Flash	Flash recon (edit denied); same-name category for teams

Subagents (task / call_omo_agent — not team members)

Agent	Model	Role
oracle	GLM 5.3	Critique / adjudication
librarian	DeepSeek V4 Pro 0813	Docs / OSS (Context7-first, unmoderated)
explore	DeepSeek V4 Pro 0813	Codebase + web recon (edit denied, unmoderated)
multimodal-looker	Gemini 3.1 Pro	Vision (look_at, unmoderated)
metis	GLM 5.3	Pre-planning critic (unmoderated)
momus	GLM 5.3 max	Plan / review gate
sisyphus-junior	GLM 5.3 Flash	Cheap delegated work

Native OpenCode build is disabled. plan stays demoted for hyperplan handoff — do not put it in disabled_agents.

---

Categories

Category	Model	Use
bug-hunt	GLM 5.3	Reproduce → root cause → fix
refactor-safe	GLM 5.3	Behavior-preserving refactors
arch-review	GLM 5.3	Coupling / blast radius (unmoderated)
content-aware-fast	Venice DeepSeek V4.1 Flash	Flash attack-surface recon
content-aware-deep	Venice DeepSeek V4 Pro 0813	Deep vuln research
writing	Gemini 3.8 Flash	Docs / prose
visual-engineering	Gemini 3.1 Pro	Ship UI
artistry	Gemini 3.1 Pro	Design direction
quick	GLM 5.3 Flash	Cheap fast tasks
deep	DeepSeek V4 Pro 0813	Autonomous problem-solving (unmoderated)
ultrabrain	GLM 5.3	Heavy / max reasoning
unspecified-low / unspecified-high	GLM 5.3 Flash / GLM 5.3	Hyperplan critics

---

Keywords & handoff

Say	Effect
ultrawork / ulw	GLM 5.3 max ceiling
team	Team-mode expansion
hyperplan / hpp / /hyperplan	Adversarial planning (from sisyphus)
/goal	Disabled — OmO 4.19 goal hook breaks /start-work. Use /start-work → Atlas (prompts/goal.md)
/start-work [plan] [--worktree <path>] [--make-pr|--ship]	Atlas executes an approved plan and preserves the requested delivery mode

---

Teams

Lead: sisyphus. Specs in teams/ are symlinked to ~/.omo/teams/ by oc setup (targets the live ~/.config/opencode tree, not a secondary checkout).

Direct members use kind: subagent_type: sisyphus, atlas, sisyphus-junior, or hephaestus (teammate: allow). Categories use kind: category and require a prompt. Hard-rejected as direct teammates: explore · librarian · oracle · metis · momus · multimodal-looker · prometheus.

Knobs: max_parallel_members=4 · max_members=5 · mailbox poll 1000ms · tmux main-vertical / inline.

Team	Members (inline prompts: ROLE / DELIVERABLE / Mailbox)
explorers	scout-code (content-aware-fast) + scout-docs (quick)
ship-feature	forge (hephaestus) + junior + verifier (bug-hunt)
debug-team	reproducer (bug-hunt) + root-cause (content-aware-deep)
review-panel	arch (arch-review) + bugs (bug-hunt) + cleanup (refactor-safe)
refactor-team	analyzer (arch-review) + executor (refactor-safe)
docs-team	api-docs + guide (writing)
content-aware-audit	recon (content-aware-fast) + deep (content-aware-deep)

---

Model routing

Lane	Models	Used for
Orchestration	z-ai/glm-5.3	Sisyphus / Atlas / Prometheus / bug-hunt / refactor-safe / arch-review / metis
Deep implement	GLM 5.3 · DeepSeek V4 Pro 0813	Hephaestus / Oracle / Momus / ultrabrain (GLM 5.3) · deep (Pro 0813)
Deep fallback	Qwen 3.8 Max · Kimi K2.7 Code	hephaestus / oracle / deep / bug-hunt / refactor-safe / sisyphus
Recon (unmoderated)	DeepSeek V4 Pro 0813 · GLM 5.3 · MiniMax M3	explore / librarian / deep (Pro 0813) · metis / arch-review (GLM) · multimodal-looker (Gemini)
Content-aware	Venice DeepSeek V4 Pro 0813 / Pro / V4.1 Flash / Flash 0731	venice/* only — never OpenRouter on this lane
Fast parallel	GLM 5.3 Flash · Venice DeepSeek V4.1 Flash	sisyphus-junior / quick (GLM Flash) · content-aware-fast (venice/deepseek-v4-1-flash)
Housekeeping	openrouter/z-ai/glm-5.3-flash	title / summary / compaction / default small_model
Visual / writing	Gemini 3.1 Pro · 3.8 Flash	artistry / visual / writing
Ceiling	z-ai/glm-5.3	ultrawork · unspecified-high

Recon routes never use Claude/GPT primaries or fallbacks — oc validate and oc fix enforce this. Check moderation policy: oc models --moderation; live probes: oc models --probe.

OpenRouter serves every non-content-aware lane. Content-aware stays on the Venice API (venice/deepseek-v4-*). OpenRouter DeepSeek and MiniMax pin live-verified unmoderated fp8/full-precision hosts (provider.only — no fp4, no moderating proxies); GLM 5.3 stays unpinned so Auto Exacto can pick among live hosts (require_parameters: true). Auto Exacto is a host sort, not a catalog slug — do not pin :exacto. Transient-only fallback retries capped at three. Request / stalled-chunk timeouts: 300s / 60s.

Concurrency

Priority: modelConcurrency → providerConcurrency → defaultConcurrency. oc heal / fix.sh re-apply caps if they drift.

Knob	Value
background_task.defaultConcurrency	10
OpenRouter provider concurrency	12 (OpenRouter gateway)
Flash / GLM / DeepSeek Pro 0813 / Venice / Hermes	10 / 8 / 8 / 5 / 2
Team parallel / max members	4 / 5
Goal / stale / TTL	off / 180s / 30m

---

API keys

Key	Required	Enables
OPENROUTER_API_KEY	yes	GLM, DeepSeek, Gemini, MiniMax, Qwen, Kimi via OpenRouter
VENICE_API_KEY	content-aware lane	venice/deepseek-v4-pro-0813 / -pro / -1-flash / -flash-0731
EXA_API_KEY	for websearch	OmO Exa
CONTEXT7_API_KEY	recommended	Context7
OPENROUTER_MGMT_KEY	optional	oc admin
OC_PROJECTS_DIR	optional	oc new home (default ~/Projects)

Copy .env.example → .env (chmod 600). Never commit .env.
vault.json is a public template (op://Vault/Item/field examples). Copy it to vault.local.json (gitignored) and put your own 1Password account / vault / item refs there. oc secrets sync (or oc setup --sync-env) merges local over public and imports allowlisted keys only from 1Password, then Infisical (INFISICAL_DIR), then Doppler — never a full vault dump, never op run / infisical run. Empty or example refs no-op.

---

Deployment protection

Guard your production runs against credit exhaustion, provider outages, and rate limits.

oc deploy check                # Pre-deployment gate (credits, models, rate limits, git, signature)
oc deploy lock                 # Prevent concurrent deploys (TTL 5m, PID-based)
oc deploy unlock --force       # Force-release a stale lock
oc deploy status               # Lock state + credit balance + alert log
oc deploy quarantine           # Enter cost-saving mode (swap to cheaper models)
oc deploy quarantine exit      # Restore from git
oc deploy health 60            # Continuous credit heartbeat (every 60s)

Guard	Threshold	Behavior
Credit critical	$10	Blocks deploy, logs alert, suggests quarantine
Credit warning	$50	Warns during gate check
Credit caution	$100	Informational
Rate limit	<10% remaining	Warns during gate check
Circuit breaker	8 consecutive failures	Trips → cooldown 30s → half-open retries (3) → notify
Budget pressure	80% / 95%	Degrades to cheaper fallbacks via runtime_fallback.cost_aware_routing

Override thresholds via env: OC_CREDIT_CRITICAL, OC_CREDIT_WARN, OC_CREDIT_CAUTION, OC_MODEL_PROBE_TIMEOUT, OC_DEPLOY_LOCK_TTL.

---

Prompts

Every OmO agent/category loads a prompt_append from prompts/. Profiles under prompts/profiles/ brief oc new scaffolds.

Path	What
prompts/core.md	Session-wide stance, tool matrix, team eligibility
prompts/goal.md	Why /goal is off; use /start-work → Atlas
prompts/agents/*.md	Agent appends
prompts/categories/*.md	Category appends
prompts/profiles/*.md	Profile briefs
agents/content-aware-research.md	OpenCode primary-agent def (synced with prompts)
agents/content-aware-fast.md	OpenCode flash-agent def (Venice V4.1 Flash)

---

Profiles & scaffolding

oc new myapp                     # ~/Projects/myapp · profile high
oc new myapp --profile research
oc new myapp --profile content-aware
oc projects --list

Profile	Agent	Tuning
high	sisyphus	Default GLM 5.3 · balanced tool_output
low	sisyphus	Cost-first · smaller tool_output
fast	hephaestus	Direct GLM 5.3 · skip ceremony
research	sisyphus	Large tool_output · deep / ultrabrain / content-aware
debug	sisyphus	Large tool_output · bug-hunt / debug-team
writing	sisyphus	Gemini Flash small_model · writing category
content-aware	content-aware-research	Edit deny · Pro + recon/audit skills

Each project gets opencode.json + AGENTS.md. Do not set OPENCODE_CONFIG to .opencode/profile.json.

---

Safety

• Allow-everything locally for normal tools (trusted box).
• Hard-deny bash: rm -rf /|~, mkfs, sudo, git push --force*, gh repo delete*.
• Providers allowed: OpenRouter (general) + Venice (content-aware only). No direct OpenAI/Anthropic/Google.
• Server: 127.0.0.1:4097 · share disabled · mdns off.

---

Terminal

• Ghostty ≥ 1.3.0 · tmux ≥ 3.3 (rec. 3.7+) · zsh snippet
• OpenCode leader Ctrl+X · tmux prefix Ctrl+B · Tab cycles agents
• Teardown never sends \033[?1049l (won’t wipe the visible screen)
• opencode() / oc launch never start inside the config repo or bare ~/Projects

---

Layout

opencode-configs/
├── oc · install.sh · setup.sh · doctor.sh · validate.sh · fix.sh
├── models.sh · versions.sh · cleanup.sh · signature.sh · locate.sh
├── deploy-guard.sh · diagnose.sh · maintain.sh · run.sh · opencode.sh
├── openrouter-admin.sh · cursor.sh · cursor-openrouter.json
├── opencode.json · oh-my-openagent.json · tui.json
├── versions.json · signature.json · projects.json · vault.json · AGENTS.md
├── .github/workflows/check.yml
├── agents/content-aware-research.md · content-aware-fast.md
├── profiles/ · prompts/ · teams/ · skills/
├── .env.example  (vault.local.json is gitignored)
└── zshrc.snippet · ghostty.conf · tmux.conf

~/.config/opencode  →  this repo
~/Projects/         →  oc new home
~/.omo/teams/       →  team specs
~/.opencode-backups/→  backups + heal/install logs

---

Verify

oc signature && oc test && oc validate && oc versions && oc doctor
oc deploy check                    # pre-deployment gate (credits, models, git, signature)
bunx oh-my-openagent@4.19.4 doctor   # upstream: System OK

Hermetic checks (no API keys, no live ~/.config/opencode — same as GitHub Actions .github/workflows/check.yml):

OC_VALIDATE_REPO="$PWD" OC_VALIDATE_OFFLINE=1 ./validate.sh --quiet
bash -n oc && find . -name '*.sh' -not -path './.git/*' -exec bash -n {} +
./signature.sh --json
OC_CI=1 ./tests/smoke.sh

Idempotency: re-running install / setup / heal / fix on a healthy box must not clobber .env, rewrite correct symlinks, or bump clean config mtimes.

---

Upstream

Layer	Docs	Source
OpenCode	opencode.ai/docs	anomalyco/opencode
OmO	omo.vibetip.help/docs	code-yeongyu/oh-my-openagent
OpenRouter	openrouter.ai/docs	GLM 5.3 / DeepSeek V4 routing
Context7	context7.com	upstash/context7
Exa	docs.exa.ai	exa-labs

Installer pulls OpenCode from https://opencode.ai/install and OmO from npm oh-my-openagent@4.19.4 only.

---

Anti-patterns

• Don’t rename the plugin away from oh-my-openagent
• Don’t pin $schema to oh-my-opencode.schema.json / oh-my-openagent.schema.json — runtime + oc validate require omo.schema.json
• Don’t add Cloudflare / AI Gateway / OpenAI-compatible shims
• Don’t put plan in disabled_agents (breaks hyperplan)
• Don’t commit .env, vault.local.json, package.json, node_modules, .omo, .sisyphus, or plugins/ here
• Don’t scaffold apps into this repo — use oc new
• Don’t load .opencode/profile.json as OPENCODE_CONFIG
• Don’t re-enable telemetry or OmO security-* skills
• Don’t re-enable /goal on OmO 4.19 until /start-work is safe

---

Config-only scope

Keep:

• Prompt tweaks when a lane misbehaves
• Local skills under skills/ (fenced) — never re-enable OmO security-*
• Weekly oc models --providers after OpenRouter host churn (don’t hand-edit order/ignore blindly)
• oc versions after OpenCode / OmO releases (bump versions.json + plugin pin together)
• Project scaffolds via oc new (apps stay outside this tree)

Skip:

• Extra MCP servers — keep disabled_mcps
• Cloudflare AI Gateway / Claude Code bridge imports
• Packaging as npm / shipping node_modules into the config dir
• Turning this repo into an application

T3 local and Railway synchronization

OpenCode 1.18.30 is the verified compatibility floor for this shared setup. Local T3 uses serve-desktop.sh on 127.0.0.1:4097; run python3 sync-t3.py to synchronize its OpenCode instance and curated models. This operation preserves other providers and backs up settings before changes.

For Railway T3, run python3 export-t3.py /path/to/buzz-relay/t3/openconfig. The export carries the full agents, model catalog, prompts, skills, and teams, with Linux shell and absolute instruction paths. It includes no credentials. Railway's managed installer and private OpenCode launcher consume this snapshot; provider and research-tool credentials stay in the private persistent volume. Run oc validate after changes and verify real OpenRouter and Venice agent requests before calling the integration complete.