fix: opencode config

tests/test_opencode_deployment.py

@@ -2,17 +2,25 @@ import json
 from pathlib import Path
 
 
-def test_config_grants_all_agents_unrestricted_permissions() -> None:
+def test_config_grants_parent_agents_access_and_restricts_research() -> None:
     root = Path(__file__).parents[1]
     config = json.loads((root / "opencode" / "opencode.json").read_text())
 
     assert config["permission"] == "allow"
     assert all(
         config["agent"][name]["permission"] == "allow"
-        for name in ("build", "plan", "general", "explore", "research")
+        for name in ("build", "plan", "general", "explore")
     )
+    assert config["agent"]["research"]["permission"] == {
+        "*": "deny",
+        "websearch": "allow",
+        "context7_*": "allow",
+        "gh_grep_*": "allow",
+    }
     assert config["mcp"]["codegraph"]["command"] == ["codegraph", "serve", "--mcp"]
     assert config["mcp"]["context7"]["url"] == "https://mcp.context7.com/mcp"
+    assert config["agent"]["explore"]["model"] == "{env:AGENTCI_EXPLORE_MODEL}"
+    assert config["agent"]["explore"]["variant"] == "{env:AGENTCI_EXPLORE_VARIANT}"
     assert config["agent"]["research"]["variant"] == "{env:AGENTCI_RESEARCH_VARIANT}"
 
 
@@ -28,6 +36,8 @@ def test_compose_removes_codex_sandbox_exceptions() -> None:
     assert "HOME: /etc/opencode/home" in compose
     assert "OPENCODE_DISABLE_EXTERNAL_SKILLS" in compose
     assert "OPENCODE_DISABLE_DEFAULT_PLUGINS" not in compose
+    assert 'OPENCODE_ENABLE_EXA: "1"' in compose
+    assert "AGENTCI_EXPLORE_VARIANT: ${AGENTCI_EXPLORE_VARIANT:-low}" in compose
     assert "AGENTCI_RESEARCH_VARIANT: ${AGENTCI_RESEARCH_VARIANT:-high}" in compose
     assert compose.count("/run/agentci:mode=1777") == 2
     assert "AGENTCI_OPENCODE_VERSION: ${AGENTCI_OPENCODE_VERSION:-^1}" in compose