OCX CLI

repository·main·Indexed 21 days ago

https://github.com/kdcokenny/ocx

A ShadCN-style CLI for OpenCode extensions, providing configuration and component management for agents, skills, plugins, commands, tools, bundles, and profiles. OCX allows developers to use custom profiles and verified components across repositories via registries, supporting ephemeral access, permanent aliases, and global profile installations.

Tokens
113K
Snippets
384
Records
576
Agent score
74%

What's inside ocx

  1. Overview of OCX

    main

    OCX is a configuration manager for OpenCode. It provides portable profiles, curated component registries, and SHA-256 verified integrity to ensure that AI agents only run code that has been reviewed and verified.

    Key features include:

    • Profiles: Use your own configuration in any repository without modifying the project files.
    • Registries: Install versioned profiles and components from curated registries.
    • Auditable Components: Every component is verified via SHA-256 to ensure code integrity and ownership.
  2. OpenCode Developer Reference Overview

    main

    The OpenCode reference provides guidance for developers building with OpenCode and OCX components. It covers the following core areas of extension and configuration:

    • Plugin Development: Building plugins using hooks and tools.
    • Configuration: Managing opencode.jsonc options and utilizing variable substitution.
    • Agents: Configuring different agent types and managing their permissions.
    • Skills & Instructions: Implementing reusable AI instruction sets and discovery mechanisms.
    • Custom Tools: Implementing custom tool logic for AI agents.
    • MCP Servers: Configuring Model Context Protocol (MCP) servers.
    • Permissions: Implementing fine-grained access control for tools and agents.
  3. Plan Review Checklist: Citation, Completeness, and Actionability

    main

    When performing a plan review, evaluate the following criteria:

    1. Citation Quality

    Ensure decisions reference sources using the ref:delegation-id format.

    • Red Flags: Decisions table with empty or - in the Source column; claims like "industry standard" without citation; research tasks marked complete without → ref:id.

    2. Completeness

    • Goal: Must be specific and measurable (e.g., ✅ "Add JWT authentication with refresh token support" vs ❌ "Improve authentication").
    • Phases: Must be logical and sequential.
    • Edge Cases: Error handling and failure modes must be addressed.
    • Context: Must include a Notes section and a Context & Decisions table.

    3. Actionability

    • Tasks: Must be specific, identifying exactly which file or component is affected (e.g., ✅ "Create src/auth/jwt.ts" vs ❌ "Set up the backend").
    • Dependencies: Sequential tasks must show a clear logical order.
    • Path: The implementation path must be obvious so a developer can start without clarification.
  4. Implement the OCX Registry Protocol

    main

    To create an OCX-compatible registry, you must implement an HTTP API that serves component metadata and files as static JSON endpoints. Registries serve as the source for components like skills, plugins, and agents.

    Key V2 Requirement: Registry targets must be root-relative. The OCX CLI handles path resolution based on the component type.

    Discovery (Optional): Clients can optionally look up GET /.well-known/ocx.json to find the registry index path. If this is not implemented, clients must be manually configured with the full registry URL.

  5. How profile layering works (Global Base + Local Overlay)

    main

    OCX uses a layering system for configuration. A Global Profile acts as a base, while a Local Config (in the current project directory) acts as an overlay. When both exist, the local configuration takes precedence over the global profile settings.

    You can verify the resolution of these layers using the config show --origin command, which displays the sources used to resolve the current configuration.

    # 1. Setup a global profile
    $OCX_BIN profile rm work --global 2>/dev/null || true
    $OCX_BIN profile add work --global
    
    # 2. Configure the global profile with a registry
    echo '{"model": "opencode/big-pickle", "registries": {"kit": {"url": "http://localhost:8788"}}}' > $XDG_CONFIG_HOME/opencode/profiles/work/ocx.jsonc
    
    # 3. Initialize local project and set local profile overlay
    cd /tmp/ocx-v2-test-project
    test -f .opencode/ocx.jsonc || $OCX_BIN init
    echo '{"profile": "work"}' > .opencode/ocx.jsonc
    
    # 4. Verify layering
    $OCX_BIN config show --origin
  6. How OCX integrity verification works

    main

    OCX uses SHA-256 cryptographic hashes to protect against component tampering. The process follows a three-step lifecycle:

    1. Receipt: Upon initial installation, the component's content is hashed, and the hash is stored in .ocx/receipt.jsonc.
    2. Verification: During subsequent installs or updates, OCX re-hashes the incoming content.
    3. Protection: If the new hash differs from the one recorded in .ocx/receipt.jsonc, OCX aborts the operation with an INTEGRITY_ERROR.

    This mechanism ensures that once a specific version of a component is locked, it cannot be replaced by different content without an explicit update command.

  7. Compare Local Mode vs Profile Mode

    main

    OCX operates in two primary modes. Choose between them based on whether you want to modify the repository or maintain a portable, external configuration.

    AspectLocal ModeProfile Mode
    Config location./.opencode/~/.config/opencode/profiles/<name>/
    Modifies repoYesNo
    Per-project settingsYesProfile-isolated
    Requires ocx initYesNo (uses profile config)
    Visibility controlNoYes (exclude/include)
    Registry scopeProject-onlyProfile-isolated
    Best forSingle project customizationMulti-project workflows
  8. Configure registry isolation in profiles

    main

    OCX implements registry isolation to prevent global configurations from affecting all projects.

    • Global Base Config: ~/.config/opencode/ocx.jsonc is used only for downloading profiles; it is never used for components.
    • Profile Config: When using a specific profile, all registries must be defined within that profile's configuration. This ensures that a project only uses the registries explicitly allowed by its active profile.
  9. Manage anchor stability and redirects

    main

    Because Mintlify does not support anchor-specific redirects, you must follow these strategies when moving content that contains anchors (headings, code blocks, or tables):

    1. Preserve Anchor Types: Recreate heading anchors (e.g., #installation) in the new location. For large code anchors, consider moving them to a separate page.
    2. Handle Anchor Changes: If an anchor must change:
      • Update all internal links to the new anchor.
      • Add a note at the old location pointing to the new location.
      • Optionally, keep the deprecated anchor as a hidden heading to prevent link breakage.
    3. Best Practices:
      • Keep anchor IDs stable (e.g., ## Installation should always map to #installation).
      • Avoid changing heading text without updating all associated links.
      • Use explicit HTML anchors for maximum stability: <a name="stable-anchor"></a>.
      • Document anchor changes in migration commit messages.
  10. How instruction file discovery and priority works

    main

    OCX discovers instruction files using a specific hierarchy and a "first type wins" strategy.

    Discovery Order (Low to High Priority)

    1. Global: ~/.config/opencode/AGENTS.md (Always included)
    2. Global Profile: ~/.config/opencode/profiles/<name>/AGENTS.md (Always included)
    3. Local (Project): Files like ./AGENTS.md (Filtered by your exclude/include patterns)

    The "First Type Wins" Strategy

    OpenCode searches for specific file types in a strict order. Once a type is found, it stops looking for other types:

    1. AGENTS.md: If any AGENTS.md is found (walking up from the current directory to the git root), OCX collects all AGENTS.md files and stops. It will completely ignore CLAUDE.md and CONTEXT.md files.
    2. CLAUDE.md: If no AGENTS.md is found, it searches for CLAUDE.md. If found, it ignores CONTEXT.md.
    3. CONTEXT.md: If no AGENTS.md or CLAUDE.md is found, it searches for CONTEXT.md (Note: This is deprecated).

    Claude Code Fallback

    If no global AGENTS.md exists, OCX checks ~/.claude/CLAUDE.md as a fallback. You can disable this by setting the environment variable OPENCODE_DISABLE_CLAUDE_CODE_PROMPT=1.

  11. How OCX profiles control visibility

    main

    Profiles define what OpenCode can access within a repository using exclude/include patterns.

    Security Note: An empty exclude list will include all project instruction files. The default profile template includes a secure exclude list. If you are working in a trusted repository, you may need to edit your profile to loosen these restrictions. Each profile maintains isolated registries for security.