pi
37960186c6
Not tagged yet; this is the v2.9.0 changeset landing on main. Added - agent-browser + a Playwright-managed headless Chromium in the base (~625 MB after deleting the redundant chromium_headless_shell build), so an agent can drive a real browser and VERIFY front-end work instead of assuming it renders. Ported from pi-devbox. AGENT_BROWSER_EXECUTABLE_PATH points at the stable symlink /usr/local/bin/agent-chrome, which the Dockerfile resolves with `find` rather than hardcoding: Playwright's browser dir is per-version AND per-arch (chrome-linux on arm64, chrome-linux64 on amd64), and the headless shell binary is named chrome-headless-shell so `-name chrome` skips it. - opencode-devbox-version: a reader for the build manifest. The image has baked ground truth to /etc/opencode-devbox/build-manifest.json for several releases, but nothing read it and nothing printed it — so "which image am I running?" meant knowing the path by heart. Three modes (--json/--quiet/human), plus a live-vs-baked drift check, because NPM_CONFIG_PREFIX points at the persistent config volume and a user `npm install -g opencode` can shadow the baked binary. entrypoint-user.sh prints it as its first output. - ENV COLORTERM=truecolor, completing a true-colour story the image already half-shipped (terminfo entries + Neovim termguicolors, but no capability advertisement, so bat/delta fell back to 256 colours). - Smoke assertions for agent-browser, that agent-chrome resolves to an executable (catches a Playwright layout change, not just a dangling symlink), COLORTERM, the manifest's release_tag, and all three version-command modes. Changed - opencode 1.17.20 -> 1.18.13. Verified by diffing upstream source, not release notes: core config.ts, config/provider.ts and schema.json are byte-identical, so generate-config.py needs no change. 1.18.13 (published mid-audit) was re-verified separately — 249 files in the compare payload, under GitHub's 300-file cap, so the list is complete rather than truncated; content is the Electron app plus localisation; the five contract-surface files hash identical at both tags. The bg-subagents removal trigger has NOT fired: runtime-flags.ts still gates the flag behind OPENCODE_EXPERIMENTAL at all three tags. - yq: dropped Debian's apt package (the unrelated Python kislyuk/yq — jq syntax, 3.x line) for mikefarah's Go yq v4 from GitHub. The cloud-init repo's provision.sh/deploy.sh need v4 syntax, and THIRD_PARTY.md already credited "yq (mikefarah)" while the image shipped the Python one, so this also closes a documented-vs-shipped mismatch. Smoke pins the contract to mikefarah v4. BEHAVIOUR CHANGE for any in-image script calling yq with jq-style syntax. - mempalace pin 3.5.0 -> 3.6.0, in lockstep with pi-devbox (5724302). Reviewed for MCP tool-schema changes before bumping — none, and nothing touches diary_write. - Default models -> claude-opus-5 (anthropic, and bedrock's global.anthropic.claude-opus-5) and openai/gpt-5.6. gpt-5.4 had gone stale: gpt-5.6 shipped four days before the v2.8.0 cut. Affects only new containers with no OPENCODE_MODEL and no existing config. - Smoke size thresholds +650 MB (base 2950->3600, omos 3650->4300), sized to keep the same ~250 MB headroom so the guardrail still catches runaway growth rather than routine apt drift. Do NOT copy pi-devbox's number: it sums `docker history`, this repo uses `docker image inspect .Size`. Documentation - New README section "Choosing a provider and model", making explicit that the baked defaults are only defaults and nobody is locked to Anthropic/Bedrock, including the three real gotchas: defaults seed only a NEW config, an existing opencode.jsonc on the persistent volume is never rewritten, and switching model needs no rebuild. - New README section "Browser automation (agent-browser)"; opencode-devbox-version documented under Build provenance; COLORTERM under Terminal compatibility. - README Build Args table drift fixed — FOUR missing args added (AGENT_BROWSER_VERSION, PLAYWRIGHT_VERSION, YQ_VERSION and GITLEAKS_VERSION, the last of which had existed as an ARG but was never listed), plus rows for the two pinned args absent entirely (MEMPALACE_VERSION, DEBIAN_VERSION), plus a refreshed stale OPENCODE_VERSION example. Third consecutive release to find drift in this table. - AGENTS.md: the stale MemPalace anyOf convention rewritten. It described a perl RUN block already DELETED at the 3.5.0 bump and asserted "PyPI latest is 3.4.0 (== our pin), no release contains the fix yet, the workaround must stay" — all three false. Replaced with a pin-review rule. Two new conventions added: the agent-browser/Chromium size coupling, and the yq identity trap. - THIRD_PARTY.md: agent-browser, Playwright, Chromium. Verified locally with the CI-pinned hadolint 2.14.0 and actionlint 1.7.7, the shell guard, DOCKER_HUB.md sync, bash -n, py_compile, and by generating the config for all three providers.
130 lines
6.9 KiB
Bash
130 lines
6.9 KiB
Bash
# opencode-devbox environment configuration
|
|
# Copy this file to .env and fill in your values:
|
|
# cp .env.example .env
|
|
|
|
# ── LLM Provider ─────────────────────────────────────────────────────
|
|
# Which provider to auto-configure (anthropic, openai, amazon-bedrock)
|
|
OPENCODE_PROVIDER=anthropic
|
|
|
|
# Model override (optional). Unset = the per-provider default baked into
|
|
# generate-config.py: anthropic/claude-opus-5, amazon-bedrock/
|
|
# global.anthropic.claude-opus-5, or openai/gpt-5.6. Set this to use any other
|
|
# model — the value is written verbatim as the `model` field, so it works for
|
|
# providers with no baked default too. Format: <provider>/<model>.
|
|
# OPENCODE_MODEL=anthropic/claude-opus-5
|
|
|
|
# ── API Keys (set the one matching your provider) ────────────────────
|
|
# ANTHROPIC_API_KEY=
|
|
# OPENAI_API_KEY=
|
|
# GEMINI_API_KEY=
|
|
|
|
# ── AWS Bedrock (if using amazon-bedrock provider) ───────────────────
|
|
# AWS_REGION=eu-west-1
|
|
# AWS_PROFILE=default
|
|
# AWS_ACCESS_KEY_ID=
|
|
# AWS_SECRET_ACCESS_KEY=
|
|
|
|
# ── Git Configuration ────────────────────────────────────────────────
|
|
GIT_USER_NAME=
|
|
GIT_USER_EMAIL=
|
|
|
|
# ── Workspace ────────────────────────────────────────────────────────
|
|
# Path on host to mount as /workspace in the container
|
|
WORKSPACE_PATH=~/projects
|
|
|
|
# Path to SSH keys on host
|
|
SSH_KEY_PATH=~/.ssh
|
|
|
|
# ── MemPalace memory (local by default) ───────────────────────────
|
|
# By default each container runs its OWN MemPalace (a local stdio server;
|
|
# palace stored at ~/.mempalace). Uncomment the devbox-palace volume in
|
|
# docker-compose.yml to persist it across container recreation.
|
|
#
|
|
# To instead share ONE MemPalace across several containers / harnesses
|
|
# (pi + opencode + native), point every container at an external HTTP
|
|
# endpoint. When MEMPALACE_REMOTE_URL is set, no local mempalace-mcp is
|
|
# spawned and the devbox-palace volume is irrelevant.
|
|
# Serve it with: mempalace-mcp --transport http --host 0.0.0.0 --port 8765
|
|
# MEMPALACE_REMOTE_URL=http://mempalace.lan:8765/mcp
|
|
# MEMPALACE_REMOTE_TOKEN= # optional — sent as: Authorization: Bearer <token>
|
|
|
|
# ── LAN access from the container (host-OS-agnostic) ─────────────────
|
|
# On VM-backed hosts (macOS OrbStack / Docker Desktop, also Docker Desktop
|
|
# on Windows) the container runs in a Linux VM and CANNOT reach the host's
|
|
# directly-attached LAN peers by default. On native Linux Docker the LAN is
|
|
# reachable directly and nothing is needed. The entrypoint detects this and,
|
|
# on VM-backed hosts, generates ~/.ssh-local/config so the host can be used
|
|
# as an SSH jump (use the `dssh` alias). Reach the host itself with
|
|
# `dssh host`. To reach named LAN peers, put `ProxyJump host` overrides in a
|
|
# host-owned ~/.config/devbox-shell/ssh-lan.conf (bind-mounted in) rather than
|
|
# editing your ~/.ssh/config — see ssh-lan.conf.example. Public-IP hosts (and
|
|
# anything reached via a public jump host) connect directly, no jump needed.
|
|
#
|
|
# DEVBOX_LAN_ACCESS: auto (default) | jump | off
|
|
# auto = set up the jump only on VM-backed hosts; no-op on native Linux.
|
|
# jump = always set up (e.g. native Linux with extra_hosts host-gateway).
|
|
# off = disable entirely.
|
|
# DEVBOX_LAN_ACCESS=auto
|
|
#
|
|
# HOST_SSH_USER: your username on the host. REQUIRED for the jump to
|
|
# authenticate. On first start the entrypoint prints the public key to
|
|
# authorize on the host (append to the host's ~/.ssh/authorized_keys) and
|
|
# reminds you to enable the host's SSH server (e.g. macOS Remote Login).
|
|
# HOST_SSH_USER=
|
|
#
|
|
# DEVBOX_HOST_ALIAS: host hostname to reach (default host.docker.internal).
|
|
# DEVBOX_HOST_ALIAS=host.docker.internal
|
|
#
|
|
# DEVBOX_LAN_AUTOJUMP_PRIVATE: 1 = ProxyJump ANY RFC1918 (private) IP through
|
|
# the host, so bare `dssh user@<ip>` works on whatever LAN the (roaming) host
|
|
# is currently joined to, without naming peers. Matches the typed address, not
|
|
# the resolved HostName, so named hosts with their own ProxyJump are unaffected.
|
|
# DEVBOX_LAN_AUTOJUMP_PRIVATE=0
|
|
|
|
# ── Skillset (agent skills and instructions) ─────────────────────────
|
|
# If you have a skillset repo, the entrypoint auto-deploys skills and
|
|
# instructions on container start using relative symlinks (portable
|
|
# across host/container).
|
|
#
|
|
# Detection is automatic if the skillset lives directly at the workspace
|
|
# root (i.e. WORKSPACE_PATH/skillset → /workspace/skillset in container).
|
|
#
|
|
# If the skillset lives in a subdirectory of your workspace, set
|
|
# SKILLSET_CONTAINER_PATH to its location *inside the container*. This
|
|
# is determined by the workspace mount: whatever is at
|
|
# WORKSPACE_PATH/<subpath> on the host becomes /workspace/<subpath>
|
|
# in the container.
|
|
#
|
|
# Examples:
|
|
# Host skillset at ~/projects/skillset → already at /workspace/skillset (auto-detected, no config needed)
|
|
# Host skillset at ~/projects/tools/skillset → SKILLSET_CONTAINER_PATH=/workspace/tools/skillset
|
|
# Host skillset at ~/projects/local/skillset → SKILLSET_CONTAINER_PATH=/workspace/local/skillset
|
|
#
|
|
# Alternatively, mount the skillset repo at a dedicated path using the
|
|
# SKILLSET_PATH volume in docker-compose.yml (see comments there). In
|
|
# that case the entrypoint finds it at ~/skillset automatically.
|
|
#
|
|
# SKILLSET_CONTAINER_PATH=
|
|
|
|
# ── Locale (defaults to en_US.UTF-8) ─────────────────────────────────
|
|
# LANG=sv_SE.UTF-8
|
|
# LANGUAGE=sv_SE:sv
|
|
# LC_ALL=sv_SE.UTF-8
|
|
|
|
# ── oh-my-opencode-slim (multi-agent orchestration) ──────────────────
|
|
# Requires image built with INSTALL_OMOS=true
|
|
# ENABLE_OMOS=false
|
|
# OMOS_TMUX=false # Enable tmux multiplexer integration
|
|
# OMOS_SKILLS=true # Symlink bundled OMOS skills (clonedeps, codemap,
|
|
# # deepwork, oh-my-opencode-slim, simplify) from the
|
|
# # image into ~/.agents/skills/ each start; updates
|
|
# # on image pull. Independent of ENABLE_OMOS.
|
|
# # See docs/omos-skills.md
|
|
# OMOS_RESET=false # Force regenerate oh-my-opencode-slim config on next start (does not affect skills)
|
|
|
|
# ── Background subagents (opencode experimental flag) ────────────────
|
|
# Baked ON in the image (ENV in Dockerfile.base) because OMOS V2+ default
|
|
# orchestration depends on opencode's native background subagents. Uncomment
|
|
# to opt out (e.g. to force blocking/foreground orchestration).
|
|
# OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS=false
|