refactor tests

2026-07-26 23:49:40 +02:00
parent 5ef10d28fe
commit ce9f1e3d20
32 changed files with 1546 additions and 1923 deletions
@@ -105,14 +105,15 @@ OpenCode configuration. It may require network access and takes longer than the

 ## Security and operational boundaries

- Never commit or expose `.env`, `secrets/`, tokens, passwords, provider credentials, runtime
-  databases, cloned private repositories, or Docker volume contents. Do not send secrets or private
-  repository content to external search or research services.
+- Never commit or expose `.env`, `secrets/`, tokens, passwords, provider credentials, runtime data
+  directories, databases, cloned private repositories, or Docker volume contents. Do not send
+  secrets or private repository content to external search or research services.
 - Preserve webhook HMAC verification, bot-comment filtering, requester write-permission checks, and
  secret-file loading.
 - OpenCode is not an OS sandbox. Do not weaken its permissions, enable repository-local configuration
  or external skills, expose its server to the host, add privileged/capability settings, or add
-  writable host mounts without an explicit security review.
+  writable host mounts beyond the documented `./data/agentci` and `./data/opencode` state directories
+  without an explicit security review.
 - `install-scripts/` is trusted operator code. Keep scripts idempotent, path-safe, and compatible with
  the sanitized environment documented in `install-scripts/README.md`; never pass Agent CI or Gitea
  credentials to them.