feat: switch to opencode

compose.yaml

@@ -1,38 +1,29 @@
 services:
   agentci:
+    image: agentci:local
     build:
       context: .
+      no_cache: true
       args:
-        CODEX_VERSION: ${CODEX_VERSION:-0.144.6}
         CODEGRAPH_VERSION: ${CODEGRAPH_VERSION:-1.3.1}
+        OPENCODE_REFRESH: ${OPENCODE_REFRESH:-}
         TEA_VERSION: ${TEA_VERSION:-0.14.2}
     restart: unless-stopped
-    # Codex applies its own bwrap sandbox inside this otherwise unprivileged container.
-    cap_add:
-      - SYS_ADMIN
-      - SYS_CHROOT
-      - SETUID
-      - SETGID
-      - SYS_PTRACE
-      - NET_ADMIN
-      - NET_RAW
-    security_opt:
-      - seccomp=unconfined
-      - apparmor=unconfined
-      # Docker's masked /proc paths prevent Codex's user namespace from mounting fresh procfs.
-      - systempaths=unconfined
+    depends_on:
+      opencode:
+        condition: service_healthy
     environment:
       AGENTCI_GITEA_URL: ${AGENTCI_GITEA_URL:-http://gitea:3000}
       AGENTCI_BOT_USERNAME: ${AGENTCI_BOT_USERNAME:-agentci}
       AGENTCI_BOT_NAME: ${AGENTCI_BOT_NAME:-Agent CI}
       AGENTCI_BOT_EMAIL: ${AGENTCI_BOT_EMAIL:-agentci@localhost}
-      AGENTCI_PLAN_MODEL: ${AGENTCI_PLAN_MODEL:-gpt-5.6-sol}
-      AGENTCI_PLAN_REASONING: ${AGENTCI_PLAN_REASONING:-medium}
-      AGENTCI_IMPLEMENT_MODEL: ${AGENTCI_IMPLEMENT_MODEL:-gpt-5.6-sol}
-      AGENTCI_IMPLEMENT_REASONING: ${AGENTCI_IMPLEMENT_REASONING:-high}
-      AGENTCI_RESEARCH_MODEL: ${AGENTCI_RESEARCH_MODEL:-gpt-5.6-luna}
-      AGENTCI_RESEARCH_REASONING: ${AGENTCI_RESEARCH_REASONING:-high}
-      AGENTCI_CONTEXT7_API_KEY: ${AGENTCI_CONTEXT7_API_KEY:-}
+      AGENTCI_OPENCODE_URL: http://opencode:4096
+      AGENTCI_OPENCODE_SERVER_USERNAME: ${OPENCODE_SERVER_USERNAME:-opencode}
+      AGENTCI_PLAN_MODEL: ${AGENTCI_PLAN_MODEL:-openai/gpt-5.6-sol}
+      AGENTCI_PLAN_VARIANT: ${AGENTCI_PLAN_VARIANT:-}
+      AGENTCI_IMPLEMENT_MODEL: ${AGENTCI_IMPLEMENT_MODEL:-openai/gpt-5.6-sol}
+      AGENTCI_IMPLEMENT_VARIANT: ${AGENTCI_IMPLEMENT_VARIANT:-}
+      AGENTCI_RESEARCH_MODEL: ${AGENTCI_RESEARCH_MODEL:-openai/gpt-5.6-luna}
       AGENTCI_PLAN_REVIEW_ROUNDS: ${AGENTCI_PLAN_REVIEW_ROUNDS:-4}
       AGENTCI_IMPLEMENT_REVIEW_ROUNDS: ${AGENTCI_IMPLEMENT_REVIEW_ROUNDS:-3}
       AGENTCI_TURN_TIMEOUT_SECONDS: ${AGENTCI_TURN_TIMEOUT_SECONDS:-3600}
@@ -43,26 +34,78 @@ services:
     secrets:
       - gitea_token
       - webhook_secret
+      - opencode_server_password
     volumes:
       - agentci_data:/var/lib/agentci
-      - codex_home:/var/lib/codex
       - ./install-scripts:/etc/agentci/install-scripts:ro
+    tmpfs:
+      - /run/agentci
     expose:
       - "8080"
     networks:
       - gitea
+      - agentci_control
+
+  opencode:
+    image: agentci:local
+    command: ["opencode", "serve", "--hostname", "0.0.0.0", "--port", "4096"]
+    restart: unless-stopped
+    environment:
+      HOME: /etc/opencode/home
+      XDG_CONFIG_HOME: /etc/opencode/xdg
+      XDG_DATA_HOME: /var/lib/opencode/data
+      XDG_CACHE_HOME: /var/lib/opencode/cache
+      XDG_STATE_HOME: /var/lib/opencode/state
+      OPENCODE_CONFIG: /etc/opencode/opencode.json
+      OPENCODE_DISABLE_PROJECT_CONFIG: "1"
+      OPENCODE_DISABLE_DEFAULT_PLUGINS: "1"
+      OPENCODE_DISABLE_EXTERNAL_SKILLS: "1"
+      OPENCODE_DISABLE_CLAUDE_CODE_SKILLS: "1"
+      OPENCODE_DISABLE_CLAUDE_CODE: "1"
+      OPENCODE_DISABLE_AUTOUPDATE: "1"
+      OPENCODE_PURE: "1"
+      OPENCODE_SERVER_USERNAME: ${OPENCODE_SERVER_USERNAME:-opencode}
+      OPENCODE_SERVER_PASSWORD_FILE: /run/secrets/opencode_server_password
+      AGENTCI_GITEA_URL: ${AGENTCI_GITEA_URL:-http://gitea:3000}
+      AGENTCI_TEA_CONFIG_HOME: /run/agentci
+      AGENTCI_RESEARCH_MODEL: ${AGENTCI_RESEARCH_MODEL:-openai/gpt-5.6-luna}
+      CONTEXT7_API_KEY: ${AGENTCI_CONTEXT7_API_KEY:-}
+      PATH: /var/lib/agentci/dev-tools/bin:/opt/agentci/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+    secrets:
+      - gitea_token
+      - opencode_server_password
+    volumes:
+      - agentci_data:/var/lib/agentci
+      - opencode_home:/var/lib/opencode
+    tmpfs:
+      - /run/agentci
+    expose:
+      - "4096"
+    networks:
+      - gitea
+      - agentci_control
+    healthcheck:
+      test: ["CMD-SHELL", "curl --fail --silent --user \"$${OPENCODE_SERVER_USERNAME}:$$(cat $${OPENCODE_SERVER_PASSWORD_FILE})\" http://127.0.0.1:4096/global/health >/dev/null"]
+      interval: 10s
+      timeout: 5s
+      start_period: 20s
+      retries: 6
 
 secrets:
   gitea_token:
     file: ./secrets/gitea_token
   webhook_secret:
     file: ./secrets/webhook_secret
+  opencode_server_password:
+    file: ./secrets/opencode_server_password
 
 volumes:
   agentci_data:
-  codex_home:
+  opencode_home:
 
 networks:
   gitea:
     external: true
     name: ${GITEA_NETWORK:-gitea}
+  agentci_control:
+    internal: true