From 987ce4a2fd9ee85cc24b3be05c0783241ff1f6a7 Mon Sep 17 00:00:00 2001 From: Aditya Mathur <57684218+MathurAditya724@users.noreply.github.com> Date: Thu, 30 Apr 2026 00:36:28 +0000 Subject: [PATCH 1/4] chore: remove Sentry and GitHub MCP integrations Removes the Sentry MCP server, GitHub MCP server, and bundled Sentry CLI along with their associated environment variables and documentation. --- .env.example | 13 ------------- Dockerfile | 7 ------- README.md | 9 +++------ opencode-user-config.json | 12 ------------ 4 files changed, 3 insertions(+), 38 deletions(-) diff --git a/.env.example b/.env.example index 1d71622..a685966 100644 --- a/.env.example +++ b/.env.example @@ -30,19 +30,6 @@ PORT= # Context7 (https://context7.com) — get from your Context7 dashboard. CONTEXT7_API_KEY= -# GitHub MCP server — a GitHub Personal Access Token (classic or fine-grained) -# with the scopes the agent will need. Used as `Authorization: Bearer `. -GITHUB_MCP_TOKEN= - -# === Optional: Sentry CLI (https://cli.sentry.dev) === -# Used by the bundled `sentry` CLI. For non-interactive auth, run -# `sentry auth login --token "$SENTRY_AUTH_TOKEN"` from inside an OpenCode -# bash session. -SENTRY_AUTH_TOKEN= - -# Self-hosted Sentry endpoint (omit for sentry.io). -# SENTRY_URL=https://sentry.example.com - # === Optional: outbound proxy === # HTTPS_PROXY= # HTTP_PROXY= diff --git a/Dockerfile b/Dockerfile index 5ed000d..4966e5c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -68,12 +68,6 @@ RUN mkdir -p /out/usr/local/bin \ -o /out/usr/local/bin/yq \ && chmod +x /out/usr/local/bin/yq -# Sentry CLI. Env var on the right of the pipe so bash inherits it. -RUN mkdir -p /out/usr/local/bin \ - && curl -fsSL https://cli.sentry.dev/install \ - | SENTRY_INSTALL_DIR=/out/usr/local/bin \ - bash -s -- --no-modify-path --no-completions - # Pre-fetch the gh apt keyring while curl is handy — saves bootstrapping # curl in the runtime stage just to grab one file. RUN install -d -m 0755 /out/etc/apt/keyrings \ @@ -128,7 +122,6 @@ RUN chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \ # Only copy bun's bin/ — the rest is installer scratch. COPY --from=downloader /out/usr/local/bin/yq /usr/local/bin/yq -COPY --from=downloader /out/usr/local/bin/sentry /usr/local/bin/sentry COPY --from=downloader /out/opt/bun/bin /opt/bun/bin RUN ln -s /opt/bun/bin/bun /usr/local/bin/bun \ && ln -s /opt/bun/bin/bunx /usr/local/bin/bunx diff --git a/README.md b/README.md index 4e0c4e5..3d4e92a 100644 --- a/README.md +++ b/README.md @@ -7,11 +7,9 @@ Self-hosted [OpenCode](https://opencode.ai) web UI in a Docker image, ready to d ## What's inside - **OpenCode** built from source from the [`BYK/opencode`](https://github.com/BYK/opencode/tree/byk/cumulative) fork (`byk/cumulative` branch) — carries question-dock UX, plan-mode, and db perf fixes that aren't yet in upstream. Built fresh into the image; auto-update is effectively disabled because the fork has no release feed. -- [Sentry CLI](https://cli.sentry.dev), GitHub CLI, **nvm + Node 22 LTS** (`pnpm` / `yarn` via corepack), **Bun**, plus `git`, `ripgrep`, `fd`, `fzf`, `jq`, `yq`, and `build-essential`. -- **Three remote MCP servers** preconfigured; credentials are pulled from env vars via `{env:VAR}` substitution, so nothing sensitive is baked into the image: +- GitHub CLI, **nvm + Node 22 LTS** (`pnpm` / `yarn` via corepack), **Bun**, plus `git`, `ripgrep`, `fd`, `fzf`, `jq`, `yq`, and `build-essential`. +- **One remote MCP server** preconfigured; credentials are pulled from env vars via `{env:VAR}` substitution, so nothing sensitive is baked into the image: - [Context7](https://context7.com) → `CONTEXT7_API_KEY` - - [GitHub MCP](https://github.com/github/github-mcp-server) → `GITHUB_MCP_TOKEN` - - [Sentry MCP](https://mcp.sentry.dev) → no env var - Non-root `developer` user. OpenCode starts in `~/dev`. Mount a single persistent volume at `~/dev` (= `/home/developer/dev`) to keep your projects **and** OpenCode session/auth data across redeploys — `~/.local/share/opencode` is symlinked into `~/dev/.opencode`. ## Deploy on Railway @@ -42,8 +40,7 @@ See [`.env.example`](./.env.example) for the full template. | Variable | What it does | |---|---| | One of `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `GROQ_API_KEY`, `OPENROUTER_API_KEY` | **Required.** LLM provider key. | -| `CONTEXT7_API_KEY`, `GITHUB_MCP_TOKEN` | Credentials for the preconfigured MCP servers. | -| `SENTRY_AUTH_TOKEN`, `SENTRY_ORG`, `SENTRY_PROJECT`, `SENTRY_URL` | For the bundled `sentry` CLI. | +| `CONTEXT7_API_KEY` | Credentials for the preconfigured MCP server. | | `PORT` | Set automatically by most PaaS providers. Defaults to `4096`. | ## Local test diff --git a/opencode-user-config.json b/opencode-user-config.json index 3fe585b..9dd5267 100644 --- a/opencode-user-config.json +++ b/opencode-user-config.json @@ -10,18 +10,6 @@ "headers": { "CONTEXT7_API_KEY": "{env:CONTEXT7_API_KEY}" } - }, - "github": { - "type": "remote", - "url": "https://api.githubcopilot.com/mcp/", - "headers": { - "Authorization": "Bearer {env:GITHUB_MCP_TOKEN}" - } - }, - "sentry": { - "type": "remote", - "url": "https://mcp.sentry.dev/mcp", - "headers": {} } } } From 6835f9288ddbe9f76f891542e277e8411a4d054e Mon Sep 17 00:00:00 2001 From: Aditya Mathur <57684218+MathurAditya724@users.noreply.github.com> Date: Thu, 30 Apr 2026 16:52:04 +0000 Subject: [PATCH 2/4] chore: also drop the preconfigured Context7 MCP Removes the remaining 'context7' MCP entry from opencode-user-config.json along with CONTEXT7_API_KEY in .env.example and the README env table. The image now ships with no MCP servers preconfigured; users add their own via project-local opencode.json or by editing the user config before building. --- .env.example | 7 ------- README.md | 4 +--- opencode-user-config.json | 11 +---------- 3 files changed, 2 insertions(+), 20 deletions(-) diff --git a/.env.example b/.env.example index a685966..a870a2b 100644 --- a/.env.example +++ b/.env.example @@ -23,13 +23,6 @@ OPENROUTER_API_KEY= # (Railway / Fly / Render). Defaults to 4096. PORT= -# === Optional: MCP server credentials === -# Substituted into opencode-user-config.json via {env:VAR}. Leave empty to -# skip a server — opencode will just fail to authenticate to that one. - -# Context7 (https://context7.com) — get from your Context7 dashboard. -CONTEXT7_API_KEY= - # === Optional: outbound proxy === # HTTPS_PROXY= # HTTP_PROXY= diff --git a/README.md b/README.md index 3d4e92a..4271517 100644 --- a/README.md +++ b/README.md @@ -8,8 +8,7 @@ Self-hosted [OpenCode](https://opencode.ai) web UI in a Docker image, ready to d - **OpenCode** built from source from the [`BYK/opencode`](https://github.com/BYK/opencode/tree/byk/cumulative) fork (`byk/cumulative` branch) — carries question-dock UX, plan-mode, and db perf fixes that aren't yet in upstream. Built fresh into the image; auto-update is effectively disabled because the fork has no release feed. - GitHub CLI, **nvm + Node 22 LTS** (`pnpm` / `yarn` via corepack), **Bun**, plus `git`, `ripgrep`, `fd`, `fzf`, `jq`, `yq`, and `build-essential`. -- **One remote MCP server** preconfigured; credentials are pulled from env vars via `{env:VAR}` substitution, so nothing sensitive is baked into the image: - - [Context7](https://context7.com) → `CONTEXT7_API_KEY` +- No MCP servers preconfigured — add your own via a project-local `opencode.json` or by editing [`opencode-user-config.json`](./opencode-user-config.json) before building. - Non-root `developer` user. OpenCode starts in `~/dev`. Mount a single persistent volume at `~/dev` (= `/home/developer/dev`) to keep your projects **and** OpenCode session/auth data across redeploys — `~/.local/share/opencode` is symlinked into `~/dev/.opencode`. ## Deploy on Railway @@ -40,7 +39,6 @@ See [`.env.example`](./.env.example) for the full template. | Variable | What it does | |---|---| | One of `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `GROQ_API_KEY`, `OPENROUTER_API_KEY` | **Required.** LLM provider key. | -| `CONTEXT7_API_KEY` | Credentials for the preconfigured MCP server. | | `PORT` | Set automatically by most PaaS providers. Defaults to `4096`. | ## Local test diff --git a/opencode-user-config.json b/opencode-user-config.json index 9dd5267..cbf03ee 100644 --- a/opencode-user-config.json +++ b/opencode-user-config.json @@ -2,14 +2,5 @@ "$schema": "https://opencode.ai/config.json", "plugin": [ "@loreai/opencode@latest" - ], - "mcp": { - "context7": { - "type": "remote", - "url": "https://mcp.context7.com/mcp", - "headers": { - "CONTEXT7_API_KEY": "{env:CONTEXT7_API_KEY}" - } - } - } + ] } From 66f16b5e0b1ff73978e32db1c638d9885d607aa1 Mon Sep 17 00:00:00 2001 From: Aditya Mathur <57684218+MathurAditya724@users.noreply.github.com> Date: Thu, 30 Apr 2026 16:57:24 +0000 Subject: [PATCH 3/4] chore: keep the bundled Sentry CLI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reverts the Sentry CLI install + binary copy that 987ce4a removed. The PR's intent is now strictly 'remove MCP integrations' — the standalone `sentry` CLI in /usr/local/bin (and its SENTRY_* env vars) is back. --- .env.example | 9 +++++++++ Dockerfile | 7 +++++++ README.md | 3 ++- 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/.env.example b/.env.example index a870a2b..3b9a38e 100644 --- a/.env.example +++ b/.env.example @@ -23,6 +23,15 @@ OPENROUTER_API_KEY= # (Railway / Fly / Render). Defaults to 4096. PORT= +# === Optional: Sentry CLI (https://cli.sentry.dev) === +# Used by the bundled `sentry` CLI. For non-interactive auth, run +# `sentry auth login --token "$SENTRY_AUTH_TOKEN"` from inside an OpenCode +# bash session. +SENTRY_AUTH_TOKEN= + +# Self-hosted Sentry endpoint (omit for sentry.io). +# SENTRY_URL=https://sentry.example.com + # === Optional: outbound proxy === # HTTPS_PROXY= # HTTP_PROXY= diff --git a/Dockerfile b/Dockerfile index 4966e5c..5ed000d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -68,6 +68,12 @@ RUN mkdir -p /out/usr/local/bin \ -o /out/usr/local/bin/yq \ && chmod +x /out/usr/local/bin/yq +# Sentry CLI. Env var on the right of the pipe so bash inherits it. +RUN mkdir -p /out/usr/local/bin \ + && curl -fsSL https://cli.sentry.dev/install \ + | SENTRY_INSTALL_DIR=/out/usr/local/bin \ + bash -s -- --no-modify-path --no-completions + # Pre-fetch the gh apt keyring while curl is handy — saves bootstrapping # curl in the runtime stage just to grab one file. RUN install -d -m 0755 /out/etc/apt/keyrings \ @@ -122,6 +128,7 @@ RUN chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \ # Only copy bun's bin/ — the rest is installer scratch. COPY --from=downloader /out/usr/local/bin/yq /usr/local/bin/yq +COPY --from=downloader /out/usr/local/bin/sentry /usr/local/bin/sentry COPY --from=downloader /out/opt/bun/bin /opt/bun/bin RUN ln -s /opt/bun/bin/bun /usr/local/bin/bun \ && ln -s /opt/bun/bin/bunx /usr/local/bin/bunx diff --git a/README.md b/README.md index 4271517..13c6f8f 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ Self-hosted [OpenCode](https://opencode.ai) web UI in a Docker image, ready to d ## What's inside - **OpenCode** built from source from the [`BYK/opencode`](https://github.com/BYK/opencode/tree/byk/cumulative) fork (`byk/cumulative` branch) — carries question-dock UX, plan-mode, and db perf fixes that aren't yet in upstream. Built fresh into the image; auto-update is effectively disabled because the fork has no release feed. -- GitHub CLI, **nvm + Node 22 LTS** (`pnpm` / `yarn` via corepack), **Bun**, plus `git`, `ripgrep`, `fd`, `fzf`, `jq`, `yq`, and `build-essential`. +- [Sentry CLI](https://cli.sentry.dev), GitHub CLI, **nvm + Node 22 LTS** (`pnpm` / `yarn` via corepack), **Bun**, plus `git`, `ripgrep`, `fd`, `fzf`, `jq`, `yq`, and `build-essential`. - No MCP servers preconfigured — add your own via a project-local `opencode.json` or by editing [`opencode-user-config.json`](./opencode-user-config.json) before building. - Non-root `developer` user. OpenCode starts in `~/dev`. Mount a single persistent volume at `~/dev` (= `/home/developer/dev`) to keep your projects **and** OpenCode session/auth data across redeploys — `~/.local/share/opencode` is symlinked into `~/dev/.opencode`. @@ -39,6 +39,7 @@ See [`.env.example`](./.env.example) for the full template. | Variable | What it does | |---|---| | One of `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `GROQ_API_KEY`, `OPENROUTER_API_KEY` | **Required.** LLM provider key. | +| `SENTRY_AUTH_TOKEN`, `SENTRY_ORG`, `SENTRY_PROJECT`, `SENTRY_URL` | For the bundled `sentry` CLI. | | `PORT` | Set automatically by most PaaS providers. Defaults to `4096`. | ## Local test From 46bd6a0792811b85344c982d69b542d90112ca9e Mon Sep 17 00:00:00 2001 From: Aditya Mathur <57684218+MathurAditya724@users.noreply.github.com> Date: Thu, 30 Apr 2026 17:08:11 +0000 Subject: [PATCH 4/4] feat: document GH_TOKEN env var for gh CLI gh CLI auto-detects GH_TOKEN from env on every invocation, so auth survives Railway redeploys without persisting ~/.config/gh (which is on the ephemeral overlay rootfs and wiped each deploy). --- .env.example | 6 ++++++ README.md | 1 + 2 files changed, 7 insertions(+) diff --git a/.env.example b/.env.example index 3b9a38e..db139e2 100644 --- a/.env.example +++ b/.env.example @@ -32,6 +32,12 @@ SENTRY_AUTH_TOKEN= # Self-hosted Sentry endpoint (omit for sentry.io). # SENTRY_URL=https://sentry.example.com +# === Optional: GitHub CLI (https://cli.github.com) === +# Used by the bundled `gh` CLI. gh auto-detects this env var on every +# invocation, so auth survives Railway redeploys with no on-disk state. +# Use a PAT with the scopes you need (typical: repo, read:org, workflow). +GH_TOKEN= + # === Optional: outbound proxy === # HTTPS_PROXY= # HTTP_PROXY= diff --git a/README.md b/README.md index 13c6f8f..5f1a410 100644 --- a/README.md +++ b/README.md @@ -40,6 +40,7 @@ See [`.env.example`](./.env.example) for the full template. |---|---| | One of `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `GROQ_API_KEY`, `OPENROUTER_API_KEY` | **Required.** LLM provider key. | | `SENTRY_AUTH_TOKEN`, `SENTRY_ORG`, `SENTRY_PROJECT`, `SENTRY_URL` | For the bundled `sentry` CLI. | +| `GH_TOKEN` | For the bundled `gh` CLI. PAT with the scopes you need. | | `PORT` | Set automatically by most PaaS providers. Defaults to `4096`. | ## Local test