fix: restore auth and research variant

.env.example

@@ -10,6 +10,7 @@ AGENTCI_PLAN_VARIANT=
 AGENTCI_IMPLEMENT_MODEL=openai/gpt-5.6-sol
 AGENTCI_IMPLEMENT_VARIANT=
 AGENTCI_RESEARCH_MODEL=openai/gpt-5.6-luna
+AGENTCI_RESEARCH_VARIANT=high
 # Optional; Context7 works without a key at lower rate limits.
 AGENTCI_CONTEXT7_API_KEY=
 AGENTCI_PLAN_REVIEW_ROUNDS=4

Dockerfile

@@ -66,6 +66,7 @@ RUN chmod 0755 \
         OPENCODE_DISABLE_PROJECT_CONFIG=1 \
         OPENCODE_PURE=1 \
         AGENTCI_RESEARCH_MODEL=openai/gpt-5.6-luna \
+        AGENTCI_RESEARCH_VARIANT=high \
         CONTEXT7_API_KEY= \
         opencode debug config >/dev/null
 

README.md

@@ -59,7 +59,8 @@ has a connected provider. The worker leaves jobs queued while the runtime is una
 
 Models use OpenCode's `provider/model` format. Planning, implementation, and research can use
 different providers. Optional `AGENTCI_PLAN_VARIANT` and `AGENTCI_IMPLEMENT_VARIANT` values are
-passed directly to OpenCode for providers that support variants.
+passed directly to OpenCode for providers that support variants. `AGENTCI_RESEARCH_VARIANT`
+configures the research subagent and defaults to `high`.
 
 `AGENTCI_OPENCODE_VERSION` controls the npm version or range installed into the image and defaults
 to `^1`. The build verifies that the resolved version is still OpenCode 1.x and prints it. Compose
@@ -68,10 +69,11 @@ auto-update is disabled so an image cannot cross into OpenCode 2.x after it is b
 
 The trusted configuration is `opencode/opencode.json`. It grants `permission: "allow"` globally
 and to every built-in or custom agent that Agent CI can invoke. Repository-local OpenCode config
-and plugins are disabled so a clone cannot replace the service policy. OpenCode's scanned home and
+and external plugins are disabled so a clone cannot replace the service policy. OpenCode's default
-global configuration paths are root-owned and read-only, and external skill discovery is disabled,
+plugins remain enabled for provider authentication. Its scanned home and global configuration paths
-so an agent cannot persist instructions for later repositories. CodeGraph, Context7, and `gh_grep`
+are root-owned and read-only, and external skill discovery is disabled, so an agent cannot persist
-are configured as MCP servers. Set `AGENTCI_CONTEXT7_API_KEY` to raise Context7 rate limits.
+instructions for later repositories. CodeGraph, Context7, and `gh_grep` are configured as MCP
+servers. Set `AGENTCI_CONTEXT7_API_KEY` to raise Context7 rate limits.
 
 The `research` subagent has the same unrestricted permissions as every other agent. Its prompt
 asks it to focus on external evidence, but this is guidance rather than an isolation boundary.

compose.yaml

@@ -24,6 +24,7 @@ services:
       AGENTCI_IMPLEMENT_MODEL: ${AGENTCI_IMPLEMENT_MODEL:-openai/gpt-5.6-sol}
       AGENTCI_IMPLEMENT_VARIANT: ${AGENTCI_IMPLEMENT_VARIANT:-}
       AGENTCI_RESEARCH_MODEL: ${AGENTCI_RESEARCH_MODEL:-openai/gpt-5.6-luna}
+      AGENTCI_RESEARCH_VARIANT: ${AGENTCI_RESEARCH_VARIANT:-high}
       AGENTCI_PLAN_REVIEW_ROUNDS: ${AGENTCI_PLAN_REVIEW_ROUNDS:-4}
       AGENTCI_IMPLEMENT_REVIEW_ROUNDS: ${AGENTCI_IMPLEMENT_REVIEW_ROUNDS:-3}
       AGENTCI_TURN_TIMEOUT_SECONDS: ${AGENTCI_TURN_TIMEOUT_SECONDS:-3600}
@@ -58,7 +59,6 @@ services:
       XDG_STATE_HOME: /var/lib/opencode/state
       OPENCODE_CONFIG: /etc/opencode/opencode.json
       OPENCODE_DISABLE_PROJECT_CONFIG: "1"
-      OPENCODE_DISABLE_DEFAULT_PLUGINS: "1"
       OPENCODE_DISABLE_EXTERNAL_SKILLS: "1"
       OPENCODE_DISABLE_CLAUDE_CODE_SKILLS: "1"
       OPENCODE_DISABLE_CLAUDE_CODE: "1"
@@ -69,6 +69,7 @@ services:
       AGENTCI_GITEA_URL: ${AGENTCI_GITEA_URL:-http://gitea:3000}
       AGENTCI_TEA_CONFIG_HOME: /run/agentci
       AGENTCI_RESEARCH_MODEL: ${AGENTCI_RESEARCH_MODEL:-openai/gpt-5.6-luna}
+      AGENTCI_RESEARCH_VARIANT: ${AGENTCI_RESEARCH_VARIANT:-high}
       CONTEXT7_API_KEY: ${AGENTCI_CONTEXT7_API_KEY:-}
       PATH: /var/lib/agentci/dev-tools/bin:/opt/agentci/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     secrets:

opencode/opencode.json

@@ -22,6 +22,7 @@
       "description": "Research current documentation, web evidence, and public code examples.",
       "mode": "subagent",
       "model": "{env:AGENTCI_RESEARCH_MODEL}",
+      "variant": "{env:AGENTCI_RESEARCH_VARIANT}",
       "permission": "allow",
       "prompt": "Research external, current, or unfamiliar technical facts for the parent agent. Use Context7 for library documentation, gh_grep for public-code examples, and web search for primary sources or broader verification. Prefer authoritative sources, report links, distinguish facts from inference, and return a concise evidence-focused summary. Do not include secrets or proprietary source in external queries."
     }

src/agentci/config.py

@@ -37,6 +37,7 @@ class Settings(BaseSettings):
     implement_model: str = "openai/gpt-5.6-sol"
     implement_variant: str | None = None
     research_model: str = "openai/gpt-5.6-luna"
+    research_variant: str = "high"
     plan_review_rounds: int = Field(default=4, ge=1, le=20)
     implement_review_rounds: int = Field(default=3, ge=1, le=20)
     turn_timeout_seconds: int = Field(default=3600, ge=60)

src/agentci/container.py

@@ -59,7 +59,7 @@ async def build_container(settings: Settings) -> Container:
         required_models=(
             (settings.plan_model, settings.plan_variant),
             (settings.implement_model, settings.implement_variant),
-            (settings.research_model, None),
+            (settings.research_model, settings.research_variant),
         ),
         timeout_seconds=settings.turn_timeout_seconds,
     )

tests/test_config.py

@@ -27,6 +27,11 @@ def test_empty_install_scripts_disable_setup() -> None:
     assert settings.install_scripts == []
 
 
+def test_defaults_research_variant_to_high() -> None:
+    settings = Settings(_env_file=None)  # type: ignore[call-arg]
+    assert settings.research_variant == "high"
+
+
 def test_reads_comma_delimited_install_scripts_from_environment(monkeypatch) -> None:
     monkeypatch.setenv("AGENTCI_INSTALL_SCRIPTS", "python,dotnet")
 

tests/test_opencode_deployment.py

@@ -13,6 +13,7 @@ def test_config_grants_all_agents_unrestricted_permissions() -> None:
     )
     assert config["mcp"]["codegraph"]["command"] == ["codegraph", "serve", "--mcp"]
     assert config["mcp"]["context7"]["url"] == "https://mcp.context7.com/mcp"
+    assert config["agent"]["research"]["variant"] == "{env:AGENTCI_RESEARCH_VARIANT}"
 
 
 def test_compose_removes_codex_sandbox_exceptions() -> None:
@@ -26,6 +27,8 @@ def test_compose_removes_codex_sandbox_exceptions() -> None:
     assert "opencode_home:/var/lib/opencode" in compose
     assert "HOME: /etc/opencode/home" in compose
     assert "OPENCODE_DISABLE_EXTERNAL_SKILLS" in compose
+    assert "OPENCODE_DISABLE_DEFAULT_PLUGINS" not in compose
+    assert "AGENTCI_RESEARCH_VARIANT: ${AGENTCI_RESEARCH_VARIANT:-high}" in compose
     assert compose.count("/run/agentci:mode=1777") == 2
     assert "AGENTCI_OPENCODE_VERSION: ${AGENTCI_OPENCODE_VERSION:-^1}" in compose
     assert "ARG AGENTCI_OPENCODE_VERSION=^1" in dockerfile