From 45858bff062c78784a0558ed967211dc17a71968 Mon Sep 17 00:00:00 2001 From: StanPonomarev Date: Tue, 21 Jul 2026 00:28:19 +0200 Subject: [PATCH] fix: restore auth and research variant --- .env.example | 1 + Dockerfile | 1 + README.md | 12 +++++++----- compose.yaml | 3 ++- opencode/opencode.json | 1 + src/agentci/config.py | 1 + src/agentci/container.py | 2 +- tests/test_config.py | 5 +++++ tests/test_opencode_deployment.py | 3 +++ 9 files changed, 22 insertions(+), 7 deletions(-) diff --git a/.env.example b/.env.example index 96490e1..91739b1 100644 --- a/.env.example +++ b/.env.example @@ -10,6 +10,7 @@ AGENTCI_PLAN_VARIANT= AGENTCI_IMPLEMENT_MODEL=openai/gpt-5.6-sol AGENTCI_IMPLEMENT_VARIANT= AGENTCI_RESEARCH_MODEL=openai/gpt-5.6-luna +AGENTCI_RESEARCH_VARIANT=high # Optional; Context7 works without a key at lower rate limits. AGENTCI_CONTEXT7_API_KEY= AGENTCI_PLAN_REVIEW_ROUNDS=4 diff --git a/Dockerfile b/Dockerfile index b3a409d..862986e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -66,6 +66,7 @@ RUN chmod 0755 \ OPENCODE_DISABLE_PROJECT_CONFIG=1 \ OPENCODE_PURE=1 \ AGENTCI_RESEARCH_MODEL=openai/gpt-5.6-luna \ + AGENTCI_RESEARCH_VARIANT=high \ CONTEXT7_API_KEY= \ opencode debug config >/dev/null diff --git a/README.md b/README.md index a9a84c3..8740886 100644 --- a/README.md +++ b/README.md @@ -59,7 +59,8 @@ has a connected provider. The worker leaves jobs queued while the runtime is una Models use OpenCode's `provider/model` format. Planning, implementation, and research can use different providers. Optional `AGENTCI_PLAN_VARIANT` and `AGENTCI_IMPLEMENT_VARIANT` values are -passed directly to OpenCode for providers that support variants. +passed directly to OpenCode for providers that support variants. `AGENTCI_RESEARCH_VARIANT` +configures the research subagent and defaults to `high`. `AGENTCI_OPENCODE_VERSION` controls the npm version or range installed into the image and defaults to `^1`. The build verifies that the resolved version is still OpenCode 1.x and prints it. Compose @@ -68,10 +69,11 @@ auto-update is disabled so an image cannot cross into OpenCode 2.x after it is b The trusted configuration is `opencode/opencode.json`. It grants `permission: "allow"` globally and to every built-in or custom agent that Agent CI can invoke. Repository-local OpenCode config -and plugins are disabled so a clone cannot replace the service policy. OpenCode's scanned home and -global configuration paths are root-owned and read-only, and external skill discovery is disabled, -so an agent cannot persist instructions for later repositories. CodeGraph, Context7, and `gh_grep` -are configured as MCP servers. Set `AGENTCI_CONTEXT7_API_KEY` to raise Context7 rate limits. +and external plugins are disabled so a clone cannot replace the service policy. OpenCode's default +plugins remain enabled for provider authentication. Its scanned home and global configuration paths +are root-owned and read-only, and external skill discovery is disabled, so an agent cannot persist +instructions for later repositories. CodeGraph, Context7, and `gh_grep` are configured as MCP +servers. Set `AGENTCI_CONTEXT7_API_KEY` to raise Context7 rate limits. The `research` subagent has the same unrestricted permissions as every other agent. Its prompt asks it to focus on external evidence, but this is guidance rather than an isolation boundary. diff --git a/compose.yaml b/compose.yaml index 46dcbc1..1c84ae2 100644 --- a/compose.yaml +++ b/compose.yaml @@ -24,6 +24,7 @@ services: AGENTCI_IMPLEMENT_MODEL: ${AGENTCI_IMPLEMENT_MODEL:-openai/gpt-5.6-sol} AGENTCI_IMPLEMENT_VARIANT: ${AGENTCI_IMPLEMENT_VARIANT:-} AGENTCI_RESEARCH_MODEL: ${AGENTCI_RESEARCH_MODEL:-openai/gpt-5.6-luna} + AGENTCI_RESEARCH_VARIANT: ${AGENTCI_RESEARCH_VARIANT:-high} AGENTCI_PLAN_REVIEW_ROUNDS: ${AGENTCI_PLAN_REVIEW_ROUNDS:-4} AGENTCI_IMPLEMENT_REVIEW_ROUNDS: ${AGENTCI_IMPLEMENT_REVIEW_ROUNDS:-3} AGENTCI_TURN_TIMEOUT_SECONDS: ${AGENTCI_TURN_TIMEOUT_SECONDS:-3600} @@ -58,7 +59,6 @@ services: XDG_STATE_HOME: /var/lib/opencode/state OPENCODE_CONFIG: /etc/opencode/opencode.json OPENCODE_DISABLE_PROJECT_CONFIG: "1" - OPENCODE_DISABLE_DEFAULT_PLUGINS: "1" OPENCODE_DISABLE_EXTERNAL_SKILLS: "1" OPENCODE_DISABLE_CLAUDE_CODE_SKILLS: "1" OPENCODE_DISABLE_CLAUDE_CODE: "1" @@ -69,6 +69,7 @@ services: AGENTCI_GITEA_URL: ${AGENTCI_GITEA_URL:-http://gitea:3000} AGENTCI_TEA_CONFIG_HOME: /run/agentci AGENTCI_RESEARCH_MODEL: ${AGENTCI_RESEARCH_MODEL:-openai/gpt-5.6-luna} + AGENTCI_RESEARCH_VARIANT: ${AGENTCI_RESEARCH_VARIANT:-high} CONTEXT7_API_KEY: ${AGENTCI_CONTEXT7_API_KEY:-} PATH: /var/lib/agentci/dev-tools/bin:/opt/agentci/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin secrets: diff --git a/opencode/opencode.json b/opencode/opencode.json index 7f55636..bb82f5f 100644 --- a/opencode/opencode.json +++ b/opencode/opencode.json @@ -22,6 +22,7 @@ "description": "Research current documentation, web evidence, and public code examples.", "mode": "subagent", "model": "{env:AGENTCI_RESEARCH_MODEL}", + "variant": "{env:AGENTCI_RESEARCH_VARIANT}", "permission": "allow", "prompt": "Research external, current, or unfamiliar technical facts for the parent agent. Use Context7 for library documentation, gh_grep for public-code examples, and web search for primary sources or broader verification. Prefer authoritative sources, report links, distinguish facts from inference, and return a concise evidence-focused summary. Do not include secrets or proprietary source in external queries." } diff --git a/src/agentci/config.py b/src/agentci/config.py index 141b267..f128699 100644 --- a/src/agentci/config.py +++ b/src/agentci/config.py @@ -37,6 +37,7 @@ class Settings(BaseSettings): implement_model: str = "openai/gpt-5.6-sol" implement_variant: str | None = None research_model: str = "openai/gpt-5.6-luna" + research_variant: str = "high" plan_review_rounds: int = Field(default=4, ge=1, le=20) implement_review_rounds: int = Field(default=3, ge=1, le=20) turn_timeout_seconds: int = Field(default=3600, ge=60) diff --git a/src/agentci/container.py b/src/agentci/container.py index 30555c3..3dcb153 100644 --- a/src/agentci/container.py +++ b/src/agentci/container.py @@ -59,7 +59,7 @@ async def build_container(settings: Settings) -> Container: required_models=( (settings.plan_model, settings.plan_variant), (settings.implement_model, settings.implement_variant), - (settings.research_model, None), + (settings.research_model, settings.research_variant), ), timeout_seconds=settings.turn_timeout_seconds, ) diff --git a/tests/test_config.py b/tests/test_config.py index 78d84d4..b27fdfc 100644 --- a/tests/test_config.py +++ b/tests/test_config.py @@ -27,6 +27,11 @@ def test_empty_install_scripts_disable_setup() -> None: assert settings.install_scripts == [] +def test_defaults_research_variant_to_high() -> None: + settings = Settings(_env_file=None) # type: ignore[call-arg] + assert settings.research_variant == "high" + + def test_reads_comma_delimited_install_scripts_from_environment(monkeypatch) -> None: monkeypatch.setenv("AGENTCI_INSTALL_SCRIPTS", "python,dotnet") diff --git a/tests/test_opencode_deployment.py b/tests/test_opencode_deployment.py index ebc68fc..36ada5a 100644 --- a/tests/test_opencode_deployment.py +++ b/tests/test_opencode_deployment.py @@ -13,6 +13,7 @@ def test_config_grants_all_agents_unrestricted_permissions() -> None: ) assert config["mcp"]["codegraph"]["command"] == ["codegraph", "serve", "--mcp"] assert config["mcp"]["context7"]["url"] == "https://mcp.context7.com/mcp" + assert config["agent"]["research"]["variant"] == "{env:AGENTCI_RESEARCH_VARIANT}" def test_compose_removes_codex_sandbox_exceptions() -> None: @@ -26,6 +27,8 @@ def test_compose_removes_codex_sandbox_exceptions() -> None: assert "opencode_home:/var/lib/opencode" in compose assert "HOME: /etc/opencode/home" in compose assert "OPENCODE_DISABLE_EXTERNAL_SKILLS" in compose + assert "OPENCODE_DISABLE_DEFAULT_PLUGINS" not in compose + assert "AGENTCI_RESEARCH_VARIANT: ${AGENTCI_RESEARCH_VARIANT:-high}" in compose assert compose.count("/run/agentci:mode=1777") == 2 assert "AGENTCI_OPENCODE_VERSION: ${AGENTCI_OPENCODE_VERSION:-^1}" in compose assert "ARG AGENTCI_OPENCODE_VERSION=^1" in dockerfile