fix: opencode config

tests/test_config.py

@@ -32,6 +32,12 @@ def test_defaults_research_variant_to_high() -> None:
     assert settings.research_variant == "high"
 
 
+def test_defaults_explore_agent_to_luna_low() -> None:
+    settings = Settings(_env_file=None)  # type: ignore[call-arg]
+    assert settings.explore_model == "openai/gpt-5.6-luna"
+    assert settings.explore_variant == "low"
+
+
 def test_reads_comma_delimited_install_scripts_from_environment(monkeypatch) -> None:
     monkeypatch.setenv("AGENTCI_INSTALL_SCRIPTS", "python,dotnet")
 
@@ -40,7 +46,9 @@ def test_reads_comma_delimited_install_scripts_from_environment(monkeypatch) ->
     assert settings.install_scripts == ["python", "dotnet"]
 
 
-@pytest.mark.parametrize("field", ["plan_model", "implement_model", "research_model"])
+@pytest.mark.parametrize(
+    "field", ["plan_model", "implement_model", "explore_model", "research_model"]
+)
 def test_requires_provider_qualified_opencode_models(field: str) -> None:
     with pytest.raises(ValidationError, match="provider/model"):
         Settings(_env_file=None, **{field: "model-only"})  # type: ignore[call-arg]

tests/test_opencode_deployment.py

@@ -2,17 +2,25 @@ import json
 from pathlib import Path
 
 
-def test_config_grants_all_agents_unrestricted_permissions() -> None:
+def test_config_grants_parent_agents_access_and_restricts_research() -> None:
     root = Path(__file__).parents[1]
     config = json.loads((root / "opencode" / "opencode.json").read_text())
 
     assert config["permission"] == "allow"
     assert all(
         config["agent"][name]["permission"] == "allow"
-        for name in ("build", "plan", "general", "explore", "research")
+        for name in ("build", "plan", "general", "explore")
     )
+    assert config["agent"]["research"]["permission"] == {
+        "*": "deny",
+        "websearch": "allow",
+        "context7_*": "allow",
+        "gh_grep_*": "allow",
+    }
     assert config["mcp"]["codegraph"]["command"] == ["codegraph", "serve", "--mcp"]
     assert config["mcp"]["context7"]["url"] == "https://mcp.context7.com/mcp"
+    assert config["agent"]["explore"]["model"] == "{env:AGENTCI_EXPLORE_MODEL}"
+    assert config["agent"]["explore"]["variant"] == "{env:AGENTCI_EXPLORE_VARIANT}"
     assert config["agent"]["research"]["variant"] == "{env:AGENTCI_RESEARCH_VARIANT}"
 
 
@@ -28,6 +36,8 @@ def test_compose_removes_codex_sandbox_exceptions() -> None:
     assert "HOME: /etc/opencode/home" in compose
     assert "OPENCODE_DISABLE_EXTERNAL_SKILLS" in compose
     assert "OPENCODE_DISABLE_DEFAULT_PLUGINS" not in compose
+    assert 'OPENCODE_ENABLE_EXA: "1"' in compose
+    assert "AGENTCI_EXPLORE_VARIANT: ${AGENTCI_EXPLORE_VARIANT:-low}" in compose
     assert "AGENTCI_RESEARCH_VARIANT: ${AGENTCI_RESEARCH_VARIANT:-high}" in compose
     assert compose.count("/run/agentci:mode=1777") == 2
     assert "AGENTCI_OPENCODE_VERSION: ${AGENTCI_OPENCODE_VERSION:-^1}" in compose