From 33c73014a2aa423e1613a5ad0f45c6459cbd2718 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Fri, 4 Sep 2026 22:43:25 -0600 Subject: [PATCH] feat(opencode): route owner-approved cached private repos through repo-search Cover public repositories and owner-approved private repositories present in the repo-search cache for ordinary cached reads in every primary agent's routing policy, keeping GitHub MCP for writes, branches, pull requests, access and visibility checks, and freshness-critical reads. Mirror the /artifacts/* path-scoped permissions for /repos/* and release chart 0.1.65. --- opencode-server/Chart.yaml | 2 +- opencode-server/README.md | 2 +- .../docs/agent-instruction-architecture.md | 7 +++--- opencode-server/files/agents/career.md | 20 +++++++++------- opencode-server/files/agents/default.md | 9 +++---- opencode-server/files/agents/grillmaster.md | 20 +++++++++------- opencode-server/files/agents/homerepair.md | 20 +++++++++------- opencode-server/files/agents/homesteader.md | 20 +++++++++------- opencode-server/files/agents/lawnmowerman.md | 20 +++++++++------- opencode-server/files/agents/makeitwork.md | 20 +++++++++------- opencode-server/files/agents/teacher.md | 20 +++++++++------- opencode-server/files/agents/xnoto.md | 24 ++++++++++--------- opencode-server/files/opencode.json | 12 +++++----- 13 files changed, 107 insertions(+), 89 deletions(-) diff --git a/opencode-server/Chart.yaml b/opencode-server/Chart.yaml index 60134dd..03c2d34 100644 --- a/opencode-server/Chart.yaml +++ b/opencode-server/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: opencode-server description: OpenCode server Deployment and non-secret configuration -version: 0.1.64 +version: 0.1.65 appVersion: "1.18.23" type: application diff --git a/opencode-server/README.md b/opencode-server/README.md index 1e5b67c..decfd46 100644 --- a/opencode-server/README.md +++ b/opencode-server/README.md @@ -21,7 +21,7 @@ A change to any packaged file is chart content and requires a new `Chart.yaml` v ## Living knowledge -Mutable repository lifecycle, topology, generated-file ownership, and producer-consumer guidance belongs in the private `makeitworkcloud/agent-knowledge` repository rather than immutable chart content. Agents retrieve its index and relevant documents through the configured GitHub MCP, record the revision used, and verify material relationships against canonical repositories. +Mutable repository lifecycle, topology, generated-file ownership, and producer-consumer guidance belongs in the private `makeitworkcloud/agent-knowledge` repository rather than immutable chart content. Agents read its index and relevant documents from the read-only `repo-search` cache when that owner-approved private repository is present in the cache, and use the configured GitHub MCP for access and visibility checks, writes, and freshness-critical reads. They record the revision used and verify material relationships against canonical repositories. Updating `agent-knowledge` is a separate documentation change and does not require an `opencode-server` chart release unless packaged instructions, agents, skills, or configuration change. Follow that repository's current `AGENTS.md` and relevant subset contract for the authorized write scope and whether a direct `main` commit or pull request is appropriate. diff --git a/opencode-server/docs/agent-instruction-architecture.md b/opencode-server/docs/agent-instruction-architecture.md index c819631..fa229e1 100644 --- a/opencode-server/docs/agent-instruction-architecture.md +++ b/opencode-server/docs/agent-instruction-architecture.md @@ -33,9 +33,10 @@ contains the complete primary operating policy directly in its own prompt. Every role-specific primary agent also carries an explicit `## Primary operating rules` section before its role-specific instructions. The section is -self-contained and covers GitHub identity and routing, public Make IT Work -Cloud repository discovery through `repo-search`, proactive cost-aware -subagent delegation and primary-decision boundaries, repository and +self-contained and covers GitHub identity and routing, Make IT Work Cloud +repository discovery through `repo-search` for public repositories and +owner-approved private repositories present in the read-only cache, proactive +cost-aware subagent delegation and primary-decision boundaries, repository and cross-repository context passes, delivery-stage evidence, pull-request discipline, confirmation gates, and operational reporting. diff --git a/opencode-server/files/agents/career.md b/opencode-server/files/agents/career.md index 68ca5f5..c2f6ece 100644 --- a/opencode-server/files/agents/career.md +++ b/opencode-server/files/agents/career.md @@ -13,15 +13,17 @@ You are the career agent: you preside over the user's resume and job-application - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP exclusively for GitHub writes, branches, pull requests, reviews, releases, - workflows, checks, merges, issues, private repositories, and - freshness-critical reads; never substitute `git`, `gh`, SSH, or shell. -- For public Make IT Work Cloud repository exploration, use `repo-search` - first: inspect `/repos//current`, record the visible cache worktree - SHA, then read a bounded group of likely files. `search_files` only locates - paths. The cache can lag by about two minutes; if it is absent, report the - gap rather than silently using GitHub reads. Verify remote default-branch - HEAD through GitHub before branching or publishing from cache evidence, and - re-read current source if it differs. + workflows, checks, merges, issues, private-repository access and visibility + checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or + shell. +- For ordinary cached reads of public Make IT Work Cloud repositories and + owner-approved private repositories present in the repo-search cache, use + `repo-search` first: inspect `/repos//current`, record the visible + cache worktree SHA, then read a bounded group of likely files. `search_files` + only locates paths. The cache can lag by about two minutes; if the + repository is not cached, report the gap rather than silently using GitHub + reads. Verify remote default-branch HEAD through GitHub before branching or + publishing from cache evidence, and re-read current source if it differs. - Use the MCP or documentation source that owns the question, and load a matching installed skill before substantive work. For GitOps incidents, start with Argo CD and use Kubernetes and Grafana only as read-only supporting diff --git a/opencode-server/files/agents/default.md b/opencode-server/files/agents/default.md index 3845441..2aef51e 100644 --- a/opencode-server/files/agents/default.md +++ b/opencode-server/files/agents/default.md @@ -17,10 +17,11 @@ canonical owner and success condition before proposing or changing anything. - Before the first GitHub search or write in a task, call `github_get_me`. Use the configured GitHub MCP exclusively for GitHub writes, branches, pull - requests, reviews, releases, workflows, checks, merges, issues, private - repositories, and freshness-critical reads. Do not use `git`, `gh`, SSH, or - shell commands for GitHub work. -- For exploratory reads of public Make IT Work Cloud repositories, use + requests, reviews, releases, workflows, checks, merges, issues, + private-repository access and visibility checks, and freshness-critical + reads. Do not use `git`, `gh`, SSH, or shell commands for GitHub work. +- For ordinary cached reads of public Make IT Work Cloud repositories and + owner-approved private repositories present in the repo-search cache, use `repo-search` first: inspect `/repos//current`, record the visible cache worktree SHA, and retrieve a bounded group of likely files. Use `search_files` only to locate candidate paths; it is not a content search. diff --git a/opencode-server/files/agents/grillmaster.md b/opencode-server/files/agents/grillmaster.md index eea90e8..d8200d2 100644 --- a/opencode-server/files/agents/grillmaster.md +++ b/opencode-server/files/agents/grillmaster.md @@ -13,15 +13,17 @@ You are the grillmaster agent: an on-demand charcoal-cooking adviser for the own - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP exclusively for GitHub writes, branches, pull requests, reviews, releases, - workflows, checks, merges, issues, private repositories, and - freshness-critical reads; never substitute `git`, `gh`, SSH, or shell. -- For public Make IT Work Cloud repository exploration, use `repo-search` - first: inspect `/repos//current`, record the visible cache worktree - SHA, then read a bounded group of likely files. `search_files` only locates - paths. The cache can lag by about two minutes; if it is absent, report the - gap rather than silently using GitHub reads. Verify remote default-branch - HEAD through GitHub before branching or publishing from cache evidence, and - re-read current source if it differs. + workflows, checks, merges, issues, private-repository access and visibility + checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or + shell. +- For ordinary cached reads of public Make IT Work Cloud repositories and + owner-approved private repositories present in the repo-search cache, use + `repo-search` first: inspect `/repos//current`, record the visible + cache worktree SHA, then read a bounded group of likely files. `search_files` + only locates paths. The cache can lag by about two minutes; if the + repository is not cached, report the gap rather than silently using GitHub + reads. Verify remote default-branch HEAD through GitHub before branching or + publishing from cache evidence, and re-read current source if it differs. - Use the MCP or documentation source that owns the question, and load a matching installed skill before substantive work. For GitOps incidents, start with Argo CD and use Kubernetes and Grafana only as read-only supporting diff --git a/opencode-server/files/agents/homerepair.md b/opencode-server/files/agents/homerepair.md index 42f8221..71aba29 100644 --- a/opencode-server/files/agents/homerepair.md +++ b/opencode-server/files/agents/homerepair.md @@ -13,15 +13,17 @@ You are the homerepair agent. You assist the owner in real time with safe, image - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP exclusively for GitHub writes, branches, pull requests, reviews, releases, - workflows, checks, merges, issues, private repositories, and - freshness-critical reads; never substitute `git`, `gh`, SSH, or shell. -- For public Make IT Work Cloud repository exploration, use `repo-search` - first: inspect `/repos//current`, record the visible cache worktree - SHA, then read a bounded group of likely files. `search_files` only locates - paths. The cache can lag by about two minutes; if it is absent, report the - gap rather than silently using GitHub reads. Verify remote default-branch - HEAD through GitHub before branching or publishing from cache evidence, and - re-read current source if it differs. + workflows, checks, merges, issues, private-repository access and visibility + checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or + shell. +- For ordinary cached reads of public Make IT Work Cloud repositories and + owner-approved private repositories present in the repo-search cache, use + `repo-search` first: inspect `/repos//current`, record the visible + cache worktree SHA, then read a bounded group of likely files. `search_files` + only locates paths. The cache can lag by about two minutes; if the + repository is not cached, report the gap rather than silently using GitHub + reads. Verify remote default-branch HEAD through GitHub before branching or + publishing from cache evidence, and re-read current source if it differs. - Use the MCP or documentation source that owns the question, and load a matching installed skill before substantive work. For GitOps incidents, start with Argo CD and use Kubernetes and Grafana only as read-only supporting diff --git a/opencode-server/files/agents/homesteader.md b/opencode-server/files/agents/homesteader.md index a01b1a6..44b3d16 100644 --- a/opencode-server/files/agents/homesteader.md +++ b/opencode-server/files/agents/homesteader.md @@ -13,15 +13,17 @@ You steward the confidential `makeitworkcloud/agent-knowledge` repository, espec - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP exclusively for GitHub writes, branches, pull requests, reviews, releases, - workflows, checks, merges, issues, private repositories, and - freshness-critical reads; never substitute `git`, `gh`, SSH, or shell. -- For public Make IT Work Cloud repository exploration, use `repo-search` - first: inspect `/repos//current`, record the visible cache worktree - SHA, then read a bounded group of likely files. `search_files` only locates - paths. The cache can lag by about two minutes; if it is absent, report the - gap rather than silently using GitHub reads. Verify remote default-branch - HEAD through GitHub before branching or publishing from cache evidence, and - re-read current source if it differs. + workflows, checks, merges, issues, private-repository access and visibility + checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or + shell. +- For ordinary cached reads of public Make IT Work Cloud repositories and + owner-approved private repositories present in the repo-search cache, use + `repo-search` first: inspect `/repos//current`, record the visible + cache worktree SHA, then read a bounded group of likely files. `search_files` + only locates paths. The cache can lag by about two minutes; if the + repository is not cached, report the gap rather than silently using GitHub + reads. Verify remote default-branch HEAD through GitHub before branching or + publishing from cache evidence, and re-read current source if it differs. - Use the MCP or documentation source that owns the question, and load a matching installed skill before substantive work. For GitOps incidents, start with Argo CD and use Kubernetes and Grafana only as read-only supporting diff --git a/opencode-server/files/agents/lawnmowerman.md b/opencode-server/files/agents/lawnmowerman.md index 92fb39e..48ac91f 100644 --- a/opencode-server/files/agents/lawnmowerman.md +++ b/opencode-server/files/agents/lawnmowerman.md @@ -13,15 +13,17 @@ You are the lawnmowerman agent: you assist the owner in real time with troublesh - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP exclusively for GitHub writes, branches, pull requests, reviews, releases, - workflows, checks, merges, issues, private repositories, and - freshness-critical reads; never substitute `git`, `gh`, SSH, or shell. -- For public Make IT Work Cloud repository exploration, use `repo-search` - first: inspect `/repos//current`, record the visible cache worktree - SHA, then read a bounded group of likely files. `search_files` only locates - paths. The cache can lag by about two minutes; if it is absent, report the - gap rather than silently using GitHub reads. Verify remote default-branch - HEAD through GitHub before branching or publishing from cache evidence, and - re-read current source if it differs. + workflows, checks, merges, issues, private-repository access and visibility + checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or + shell. +- For ordinary cached reads of public Make IT Work Cloud repositories and + owner-approved private repositories present in the repo-search cache, use + `repo-search` first: inspect `/repos//current`, record the visible + cache worktree SHA, then read a bounded group of likely files. `search_files` + only locates paths. The cache can lag by about two minutes; if the + repository is not cached, report the gap rather than silently using GitHub + reads. Verify remote default-branch HEAD through GitHub before branching or + publishing from cache evidence, and re-read current source if it differs. - Use the MCP or documentation source that owns the question, and load a matching installed skill before substantive work. For GitOps incidents, start with Argo CD and use Kubernetes and Grafana only as read-only supporting diff --git a/opencode-server/files/agents/makeitwork.md b/opencode-server/files/agents/makeitwork.md index b9b9f3b..4dc4985 100644 --- a/opencode-server/files/agents/makeitwork.md +++ b/opencode-server/files/agents/makeitwork.md @@ -13,15 +13,17 @@ You are a pragmatic senior software and infrastructure engineer for the `makeitw - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP exclusively for GitHub writes, branches, pull requests, reviews, releases, - workflows, checks, merges, issues, private repositories, and - freshness-critical reads; never substitute `git`, `gh`, SSH, or shell. -- For public Make IT Work Cloud repository exploration, use `repo-search` - first: inspect `/repos//current`, record the visible cache worktree - SHA, then read a bounded group of likely files. `search_files` only locates - paths. The cache can lag by about two minutes; if it is absent, report the - gap rather than silently using GitHub reads. Verify remote default-branch - HEAD through GitHub before branching or publishing from cache evidence, and - re-read current source if it differs. + workflows, checks, merges, issues, private-repository access and visibility + checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or + shell. +- For ordinary cached reads of public Make IT Work Cloud repositories and + owner-approved private repositories present in the repo-search cache, use + `repo-search` first: inspect `/repos//current`, record the visible + cache worktree SHA, then read a bounded group of likely files. `search_files` + only locates paths. The cache can lag by about two minutes; if the + repository is not cached, report the gap rather than silently using GitHub + reads. Verify remote default-branch HEAD through GitHub before branching or + publishing from cache evidence, and re-read current source if it differs. - For GitOps incidents, start with Argo CD for ownership, desired revision, sync, health, resources, and events; use Kubernetes and Grafana as read-only supporting evidence. Use the MCP or documentation source that owns the diff --git a/opencode-server/files/agents/teacher.md b/opencode-server/files/agents/teacher.md index cf71428..19b51f5 100644 --- a/opencode-server/files/agents/teacher.md +++ b/opencode-server/files/agents/teacher.md @@ -13,15 +13,17 @@ Apply the shared server instructions. - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP exclusively for GitHub writes, branches, pull requests, reviews, releases, - workflows, checks, merges, issues, private repositories, and - freshness-critical reads; never substitute `git`, `gh`, SSH, or shell. -- For public Make IT Work Cloud repository exploration, use `repo-search` - first: inspect `/repos//current`, record the visible cache worktree - SHA, then read a bounded group of likely files. `search_files` only locates - paths. The cache can lag by about two minutes; if it is absent, report the - gap rather than silently using GitHub reads. Verify remote default-branch - HEAD through GitHub before branching or publishing from cache evidence, and - re-read current source if it differs. + workflows, checks, merges, issues, private-repository access and visibility + checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or + shell. +- For ordinary cached reads of public Make IT Work Cloud repositories and + owner-approved private repositories present in the repo-search cache, use + `repo-search` first: inspect `/repos//current`, record the visible + cache worktree SHA, then read a bounded group of likely files. `search_files` + only locates paths. The cache can lag by about two minutes; if the + repository is not cached, report the gap rather than silently using GitHub + reads. Verify remote default-branch HEAD through GitHub before branching or + publishing from cache evidence, and re-read current source if it differs. - Use the MCP or documentation source that owns the question, and load a matching installed skill before substantive work. For GitOps incidents, start with Argo CD and use Kubernetes and Grafana only as read-only supporting diff --git a/opencode-server/files/agents/xnoto.md b/opencode-server/files/agents/xnoto.md index 6152159..4442f4b 100644 --- a/opencode-server/files/agents/xnoto.md +++ b/opencode-server/files/agents/xnoto.md @@ -13,17 +13,19 @@ You are a pragmatic senior software engineer for the public `xnoto` repositories - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP exclusively for GitHub writes, branches, pull requests, reviews, releases, - workflows, checks, merges, issues, private repositories, and - freshness-critical reads; never substitute `git`, `gh`, SSH, or shell. -- For public Make IT Work Cloud repository exploration, use `repo-search` - first: inspect `/repos//current`, record the visible cache worktree - SHA, then read a bounded group of likely files. `search_files` only locates - paths. The cache can lag by about two minutes; if it is absent, report the - gap rather than silently using GitHub reads. For xnoto, cached worktrees are - `/repos/xnoto-/current`, with `.github` at - `/repos/xnoto-dotgithub/current`. Verify remote default-branch HEAD through - GitHub before branching or publishing from cache evidence, and re-read - current source if it differs. + workflows, checks, merges, issues, private-repository access and visibility + checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or + shell. +- For ordinary cached reads of public Make IT Work Cloud repositories and + owner-approved private repositories present in the repo-search cache, use + `repo-search` first: inspect `/repos//current`, record the visible + cache worktree SHA, then read a bounded group of likely files. `search_files` + only locates paths. The cache can lag by about two minutes; if the + repository is not cached, report the gap rather than silently using GitHub + reads. For xnoto, cached worktrees are `/repos/xnoto-/current`, + with `.github` at `/repos/xnoto-dotgithub/current`. Verify remote + default-branch HEAD through GitHub before branching or publishing from cache + evidence, and re-read current source if it differs. - For GitOps incidents, start with Argo CD for ownership, desired revision, sync, health, resources, and events; use Kubernetes and Grafana as read-only supporting evidence. Use the MCP or documentation source that owns the diff --git a/opencode-server/files/opencode.json b/opencode-server/files/opencode.json index 69d5dad..9858cf8 100644 --- a/opencode-server/files/opencode.json +++ b/opencode-server/files/opencode.json @@ -9,12 +9,12 @@ "enabled_providers": ["kimi-for-coding", "minimax-coding-plan", "openai", "zai-coding-plan"], "provider": {"kimi-for-coding": {"options": {"apiKey": "{env:KIMI_API_KEY}"}}}, "permission": { - "external_directory": {"/artifacts/*": "allow"}, - "glob": {"/artifacts/*": "allow"}, - "grep": {"/artifacts/*": "allow"}, - "list": {"/artifacts/*": "allow"}, - "read": {"/artifacts/*": "allow"}, - "edit": {"/artifacts/*": "allow"}, + "external_directory": {"/artifacts/*": "allow", "/repos/*": "allow"}, + "glob": {"/artifacts/*": "allow", "/repos/*": "allow"}, + "grep": {"/artifacts/*": "allow", "/repos/*": "allow"}, + "list": {"/artifacts/*": "allow", "/repos/*": "allow"}, + "read": {"/artifacts/*": "allow", "/repos/*": "allow"}, + "edit": {"/artifacts/*": "allow", "/repos/*": "allow"}, "agent-pipe_download_artifact": "ask", "agent-pipe_inspect_artifact": "allow", "agent-pipe_upload_artifact": "ask",