From 6596ec2d9b18bfbac512b61c22384f9accf5ea07 Mon Sep 17 00:00:00 2001
From: Christoph Schmatzler <christoph@schmatzler.com>
Date: Sun, 8 Feb 2026 17:46:29 +0000
Subject: [PATCH] opencode: add oracle research tools, spec-planner question
 tool, deny mcp-auth read

---
 profiles/opencode.nix                         |  1 +
 profiles/opencode/agent/oracle.md             | 12 ++++++++++--
 profiles/opencode/skill/spec-planner/SKILL.md | 17 +++++++++++++++++
 3 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/profiles/opencode.nix b/profiles/opencode.nix
index a7ef2c9..1a90269 100644
--- a/profiles/opencode.nix
+++ b/profiles/opencode.nix
@@ -28,6 +28,7 @@
 					"*.env.*" = "deny";
 					"*.envrc" = "deny";
 					"secrets/*" = "deny";
+					"~/.local/share/opencode/mcp-auth.json" = "deny";
 				};
 			};
 			agent = {
diff --git a/profiles/opencode/agent/oracle.md b/profiles/opencode/agent/oracle.md
index 24b2cd9..fa14462 100644
--- a/profiles/opencode/agent/oracle.md
+++ b/profiles/opencode/agent/oracle.md
@@ -12,6 +12,10 @@ permission:
   grep: allow
   glob: allow
   webfetch: allow
+  opensrc_execute: allow
+  context7_resolve-library-id: allow
+  context7_query-docs: allow
+  grep_app_searchGitHub: allow
   lsp: allow
 ---
 
@@ -72,8 +76,12 @@ Brief outline only if relevant and trade-offs are significant.
 
 ## Tool Usage
 
-You have read-only access: read, grep, glob, LSP, webfetch.
-Use them freely to verify assumptions and gather context. Your extended thinking enables deep analysis - leverage it fully.
+You have read-only access: read, grep, glob, LSP, webfetch, opensrc, context7, grep_app.
+Use them freely to verify assumptions and gather context:
+- **opensrc**: Fetch and explore third-party package/repo source code
+- **context7**: Look up library documentation and API examples (resolve-library-id first, then query-docs)
+- **grep_app**: Search public GitHub repos for real-world usage patterns
+Your extended thinking enables deep analysis - leverage it fully.
 
 ## Guidelines
 
diff --git a/profiles/opencode/skill/spec-planner/SKILL.md b/profiles/opencode/skill/spec-planner/SKILL.md
index 4a8e772..eeaf2e3 100644
--- a/profiles/opencode/skill/spec-planner/SKILL.md
+++ b/profiles/opencode/skill/spec-planner/SKILL.md
@@ -38,6 +38,23 @@ Phase: CLARIFY | Waiting for: answers to questions 1-4
 3. Ask 3-5 pointed questions that would change the approach. USE YOUR QUESTION TOOL. 
 4. **Wait for responses**
 
+**IMPORTANT: Always use the `question` tool to ask clarifying questions.** Do NOT output questions as freeform text. The question tool provides structured options and better UX. Example:
+
+```
+question({
+  questions: [{
+    header: "Scope",
+    question: "Which subsystems need detailed specs?",
+    options: [
+      { label: "VCS layer", description: "jj-lib + gix unified interface" },
+      { label: "Review workflow", description: "GitHub PR-style local review" },
+      { label: "Event system", description: "pub/sub + persistence" }
+    ],
+    multiple: true
+  }]
+})
+```
+
 | Category | Example |
 |----------|---------|
 | Scope | "Share where? Social media? Direct link? Embed?" |