opencode: support ordered settings entries

Use the shared DAG-aware JSON generator for programs.opencode.settings so order-sensitive permission rules can be expressed with lib.hm.dag entries.

Add a focused NMT test for last-match-wins permission output and news for existing opencode users.

modules/misc/news/2026/06/2026-06-12_12-00-00.nix

@@ -0,0 +1,12 @@
+{ config, ... }:
+{
+  time = "2026-06-12T12:00:00+00:00";
+  condition = config.programs.opencode.enable;
+  message = ''
+    The 'programs.opencode.settings' option now supports ordered Home Manager
+    DAG entries in nested attribute sets.
+
+    This allows order-sensitive OpenCode permission rules to be expressed with
+    'lib.hm.dag.entryBefore' and 'lib.hm.dag.entryAfter'.
+  '';
+}

modules/programs/opencode.nix

@@ -17,6 +17,9 @@ let
   webCfg = cfg.web;
 
   jsonFormat = pkgs.formats.json { };
+  orderedJsonFormat = lib.hm.generators.mkDAGOrderedJsonFormat {
+    inherit pkgs jsonFormat;
+  };
 
   toOpencodeShape =
     s:
@@ -116,6 +119,11 @@ in
         Configuration written to {file}`$XDG_CONFIG_HOME/opencode/opencode.json`.
         See <https://opencode.ai/docs/config/> for the documentation.
 
+        Attribute sets containing ordered `lib.hm.dag.entryBefore` or
+        `lib.hm.dag.entryAfter` values are rendered in topological order, with
+        raw sibling values treated as unordered entries. This is useful for
+        OpenCode permission rules, where the last matching rule wins.
+
         Note, `"$schema": "https://opencode.ai/config.json"` is automatically added to the configuration.
       '';
     };
@@ -485,7 +493,7 @@ in
             mergedSettings =
               cfg.settings // (lib.optionalAttrs (mergedMcpServers != { }) { mcp = mergedMcpServers; });
           in
-          jsonFormat.generate "opencode.json" (
+          orderedJsonFormat.generate "opencode.json" (
             {
               "$schema" = "https://opencode.ai/config.json";
             }

tests/modules/programs/opencode/default.nix

@@ -1,5 +1,6 @@
 {
   opencode-settings = ./settings.nix;
+  opencode-settings-ordered-permissions = ./settings-ordered-permissions.nix;
   opencode-empty-settings = ./empty-settings.nix;
   opencode-context-inline = ./rules-inline.nix;
   opencode-context-path = ./rules-path.nix;

tests/modules/programs/opencode/settings-ordered-permissions.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "permission": {
+    "bash": {
+      "zz *": "ask",
+      "aa *": "allow"
+    }
+  }
+}

tests/modules/programs/opencode/settings-ordered-permissions.nix

@@ -0,0 +1,18 @@
+{ lib, ... }:
+{
+  programs.opencode = {
+    enable = true;
+    settings = {
+      permission.bash = {
+        "aa *" = lib.hm.dag.entryAfter [ "zz *" ] "allow";
+        "zz *" = "ask";
+      };
+    };
+  };
+
+  nmt.script = ''
+    assertFileExists home-files/.config/opencode/opencode.json
+    assertFileContent home-files/.config/opencode/opencode.json \
+      ${./settings-ordered-permissions.json}
+  '';
+}