feat(agents): add opencode as the 6th agent - #542
Merged
Conversation
- build cloak in versions-up; resolve cloakbrowser wrapper from npm - write versions.env from the exact versions built, not a re-fetch — a version published mid-build can no longer land in pins untested - new scripts/versions-pr.sh: commit in a temp worktree detached at origin/main, force-push chore/version-pins-refresh, gh pr create; user checkout stays untouched; PR=0 opts out - PR-stage failure warns and exits 0; pins stay written locally - write_version_pins moved to shared version-pins.sh - tests: cloak build args, pin write, outage no-write, PR soft-fail; hermetic versions-pr suite (real git against bare origin, fake gh) Close #538 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- agents/opencode.sh: oauth mounts the XDG trio (.config/opencode, .local/share/opencode, .local/state/opencode); api-key passes OPENCODE_API_KEY only, mounts nothing, blank-overlays auth.json (it outranks the env key). Cache stays container-local. - deva.sh: first agent with nested canonical entries — mount path unchanged, opencode arms added to status display, autolink, config-home scaffold/warning, $HOME fallback, env scrub, auth tag - sandbox: OPENCODE_PERMISSION unlocks external-dir/doom-loop/.env asks (opencode is allow-by-default in-workspace); OPENCODE_DISABLE_AUTOUPDATE=1 since the image pins the CLI - --trace rejected until cctrace ships an opencode profile (thevibeworks/cctrace#89) - image/pins: opencode-ai OPENCODE_VERSION through versions.env, round-trip heredoc, Makefile, Dockerfiles, installer, registry, version-upgrade, CI/release/nightly workflows - tests: scripts/test-opencode-auth.sh (hermetic dry-run, 21 asserts); fixtures updated in install-tooling, release-utils, version-upgrade Close #541 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Pull request overview
This PR adds opencode as a first-class 6th agent in deva, including XDG-native host state mounting, auth mode handling (oauth vs api-key), sandbox env wiring, and pinning/release automation updates so opencode is versioned and tested alongside the existing agent CLIs.
Changes:
- Add opencode agent support end-to-end (agent script, auth parsing, deva.sh mount/env/tag logic, docs + changelog).
- Extend version pinning and automation to include
OPENCODE_VERSION, plus new hermetic PR-opening flow for pin bumps (scripts/versions-pr.sh) and expandedversions-upbehavior. - Add/extend CI + tests to validate opencode auth wiring and the new pin/PR workflow behavior.
Reviewed changes
Copilot reviewed 36 out of 36 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| versions.env | Add OPENCODE_VERSION pin. |
| agents/opencode.sh | New opencode agent entrypoint (auth + env + trace handling). |
| agents/shared_auth.sh | Register opencode auth methods/default. |
| deva.sh | Wire opencode into mount categorization, auth tags, env scrubbing, config-home/autolink, and version labels. |
| scripts/install-agent-tooling.sh | Install opencode-ai and pre-create XDG dirs to avoid root-created mount parents. |
| scripts/release-utils.sh | Add opencode to tool registry. |
| scripts/resolve-tool-versions.sh | Include opencode in resolved version outputs. |
| scripts/version-pins.sh | Add OPENCODE_VERSION and centralize write_version_pins(). |
| scripts/update-version-pins.sh | Use shared write_version_pins() and pin opencode from npm. |
| scripts/version-upgrade.sh | Build/pin flow updates (opencode build arg, cloak image, PR stage). |
| scripts/versions-pr.sh | New script to commit/push pin bumps and open/update the PR. |
| scripts/test-opencode-auth.sh | New smoke test for opencode auth + mount contract behavior. |
| scripts/test-install-agent-tooling.sh | Extend tooling install test harness for opencode. |
| tests/version-upgrade.sh | Extend upgrade tests for new images/tools and pin-writing behavior. |
| tests/versions-pr.sh | New hermetic test covering versions-pr worktree/PR behavior. |
| tests/test_release_utils.sh | Update expected tool groups/images to include opencode. |
| Makefile | Thread OPENCODE_VERSION through build args and versions-up plumbing (incl. PR option). |
| Dockerfile | Add opencode build arg + OCI label. |
| Dockerfile.rust | Add opencode build arg + OCI label. |
| .github/workflows/ci.yml | Build arg + smoke tests for opencode; run opencode auth wiring test. |
| .github/workflows/release.yml | Include opencode version in outputs/release notes/build args. |
| .github/workflows/nightly-images.yml | Include opencode version in outputs/notes/build args. |
| README.md | Update agent list and quick-start examples to include opencode. |
| README.zh-CN.md | Update agent list and examples to include opencode. |
| docs/authentication.md | Document opencode oauth/api-key behavior and mounts. |
| docs/how-it-works.md | Document opencode XDG trio in config-home layouts. |
| docs/quick-start.md | Add opencode install/usage examples. |
| docs/advanced-usage.md | Note opencode trace unsupported and agent list updates. |
| docs/index.md | Update high-level agent list to include opencode. |
| docs/philosophy.md | Update agent list to include opencode. |
| docs/troubleshooting.md | Include opencode path in “empty auth dir” symptom list. |
| .deva.example | Document hybrid config-root behavior including opencode XDG dirs. |
| install.sh | Install new agents/opencode.sh. |
| llms.txt | Update project summary/examples to include opencode. |
| CHANGELOG.md | Changelog entries for opencode agent + versions-up workflow changes. |
| DEV-LOGS.md | Dev log entries describing opencode integration and pin/PR automation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+429
to
+435
| fi | ||
| echo "" | ||
| section "Opening Pin PR" | ||
| if ! bash "$SCRIPT_DIR/versions-pr.sh"; then | ||
| echo -e "${YELLOW}PR creation failed; pins are written locally.${RESET}" >&2 | ||
| echo -e "${YELLOW}Retry with: ./scripts/versions-pr.sh${RESET}" >&2 | ||
| fi |
Comment on lines
+20
to
+25
| REPO_ROOT=${REPO_ROOT:-$(cd "$SCRIPT_DIR/.." && pwd)} | ||
| REMOTE=${REMOTE:-origin} | ||
| BASE_BRANCH=${BASE_BRANCH:-main} | ||
| PR_BRANCH=${PR_BRANCH:-chore/version-pins-refresh} | ||
| PINS_NAME=versions.env | ||
|
|
Comment on lines
+219
to
+230
| for expected in \ | ||
| "CLAUDE_CODE_VERSION=2.1.87" \ | ||
| "CCTRACE_VERSION=0.4.0" \ | ||
| "CODEX_VERSION=0.117.0" \ | ||
| "GEMINI_CLI_VERSION=0.35.3" \ | ||
| "GROK_CLI_VERSION=0.2.93" \ | ||
| "KIMI_CODE_VERSION=0.28.0" \ | ||
| "CCX_VERSION=v0.7.0" \ | ||
| "COPILOT_API_VERSION=0ea08febdd7e3e055b03dd298bf57e669500b5c1" \ | ||
| "PLAYWRIGHT_VERSION=1.60.0" \ | ||
| "CLOAKBROWSER_WRAPPER_VERSION=0.6.0" \ | ||
| "GO_VERSION=1.26.2" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Close #541
opencode (opencode.ai, anomalyco/opencode) joins claude/codex/gemini/grok/kimi.
First XDG-native agent: state spans three nested canonical entries instead
of one dot-dir.
image pins the CLI, OPENCODE_DISABLE_AUTOUPDATE=1)
Auth:
opencode auth login/ TUI /connect (device-code works in-container)over auth.json (it outranks the env key -- same contract as grok/kimi)
Sandbox: opencode is allow-by-default inside the workspace; deva injects
OPENCODE_PERMISSION to unlock the external-directory/doom-loop/.env-read
asks. Container is the sandbox, as usual.
--trace is rejected with a pointer to thevibeworks/cctrace#89 (opencode
profile proposal; multi-provider wire needs per-host dialects).
Pins: OPENCODE_VERSION=1.18.14 (npm opencode-ai) wired through versions.env,
the write_version_pins heredoc, Makefile, both Dockerfiles, the installer,
the tool registry, version-upgrade/--only, and ci/release/nightly workflows.
Tests:
asserts (oauth trio mounts, api-key no-mount on both mount paths, env
scrub, overlay, trace rejection, passthrough after --, missing key)
(agent group now 10 tools), tests/version-upgrade (labels + npm stubs)
Image build deferred on purpose -- pins land here, images bake next.
🤖 Generated with Claude Code