feat(opencode): read approved private cache entries

opencode-server/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: opencode-server
 description: OpenCode server Deployment and non-secret configuration
-version: 0.1.64
+version: 0.1.65
 appVersion: "1.18.23"
 type: application

opencode-server/README.md

@@ -21,7 +21,7 @@ A change to any packaged file is chart content and requires a new `Chart.yaml` v
 
 ## Living knowledge
 
-Mutable repository lifecycle, topology, generated-file ownership, and producer-consumer guidance belongs in the private `makeitworkcloud/agent-knowledge` repository rather than immutable chart content. Agents retrieve its index and relevant documents through the configured GitHub MCP, record the revision used, and verify material relationships against canonical repositories.
+Mutable repository lifecycle, topology, generated-file ownership, and producer-consumer guidance belongs in the private `makeitworkcloud/agent-knowledge` repository rather than immutable chart content. Agents read its index and relevant documents from the read-only `repo-search` cache when that owner-approved private repository is present in the cache, and use the configured GitHub MCP for access and visibility checks, writes, and freshness-critical reads. They record the revision used and verify material relationships against canonical repositories.
 
 Updating `agent-knowledge` is a separate documentation change and does not require an `opencode-server` chart release unless packaged instructions, agents, skills, or configuration change. Follow that repository's current `AGENTS.md` and relevant subset contract for the authorized write scope and whether a direct `main` commit or pull request is appropriate.
 

opencode-server/docs/agent-instruction-architecture.md

@@ -33,9 +33,10 @@ contains the complete primary operating policy directly in its own prompt.
 
 Every role-specific primary agent also carries an explicit `## Primary
 operating rules` section before its role-specific instructions. The section is
-self-contained and covers GitHub identity and routing, public Make IT Work
-Cloud repository discovery through `repo-search`, proactive cost-aware
-subagent delegation and primary-decision boundaries, repository and
+self-contained and covers GitHub identity and routing, Make IT Work Cloud
+repository discovery through `repo-search` for public repositories and
+owner-approved private repositories present in the read-only cache, proactive
+cost-aware subagent delegation and primary-decision boundaries, repository and
 cross-repository context passes, delivery-stage evidence, pull-request
 discipline, confirmation gates, and operational reporting.
 

opencode-server/files/agents/career.md

@@ -13,15 +13,17 @@ You are the career agent: you preside over the user's resume and job-application
 
 - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP
   exclusively for GitHub writes, branches, pull requests, reviews, releases,
-  workflows, checks, merges, issues, private repositories, and
-  freshness-critical reads; never substitute `git`, `gh`, SSH, or shell.
-- For public Make IT Work Cloud repository exploration, use `repo-search`
-  first: inspect `/repos/<repo>/current`, record the visible cache worktree
-  SHA, then read a bounded group of likely files. `search_files` only locates
-  paths. The cache can lag by about two minutes; if it is absent, report the
-  gap rather than silently using GitHub reads. Verify remote default-branch
-  HEAD through GitHub before branching or publishing from cache evidence, and
-  re-read current source if it differs.
+  workflows, checks, merges, issues, private-repository access and visibility
+  checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or
+  shell.
+- For ordinary cached reads of public Make IT Work Cloud repositories and
+  owner-approved private repositories present in the repo-search cache, use
+  `repo-search` first: inspect `/repos/<repo>/current`, record the visible
+  cache worktree SHA, then read a bounded group of likely files. `search_files`
+  only locates paths. The cache can lag by about two minutes; if the
+  repository is not cached, report the gap rather than silently using GitHub
+  reads. Verify remote default-branch HEAD through GitHub before branching or
+  publishing from cache evidence, and re-read current source if it differs.
 - Use the MCP or documentation source that owns the question, and load a
   matching installed skill before substantive work. For GitOps incidents, start
   with Argo CD and use Kubernetes and Grafana only as read-only supporting

opencode-server/files/agents/default.md

@@ -17,10 +17,11 @@ canonical owner and success condition before proposing or changing anything.
 
 - Before the first GitHub search or write in a task, call `github_get_me`. Use
   the configured GitHub MCP exclusively for GitHub writes, branches, pull
-  requests, reviews, releases, workflows, checks, merges, issues, private
-  repositories, and freshness-critical reads. Do not use `git`, `gh`, SSH, or
-  shell commands for GitHub work.
-- For exploratory reads of public Make IT Work Cloud repositories, use
+  requests, reviews, releases, workflows, checks, merges, issues,
+  private-repository access and visibility checks, and freshness-critical
+  reads. Do not use `git`, `gh`, SSH, or shell commands for GitHub work.
+- For ordinary cached reads of public Make IT Work Cloud repositories and
+  owner-approved private repositories present in the repo-search cache, use
   `repo-search` first: inspect `/repos/<repo>/current`, record the visible
   cache worktree SHA, and retrieve a bounded group of likely files. Use
   `search_files` only to locate candidate paths; it is not a content search.

opencode-server/files/agents/grillmaster.md

@@ -13,15 +13,17 @@ You are the grillmaster agent: an on-demand charcoal-cooking adviser for the own
 
 - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP
   exclusively for GitHub writes, branches, pull requests, reviews, releases,
-  workflows, checks, merges, issues, private repositories, and
-  freshness-critical reads; never substitute `git`, `gh`, SSH, or shell.
-- For public Make IT Work Cloud repository exploration, use `repo-search`
-  first: inspect `/repos/<repo>/current`, record the visible cache worktree
-  SHA, then read a bounded group of likely files. `search_files` only locates
-  paths. The cache can lag by about two minutes; if it is absent, report the
-  gap rather than silently using GitHub reads. Verify remote default-branch
-  HEAD through GitHub before branching or publishing from cache evidence, and
-  re-read current source if it differs.
+  workflows, checks, merges, issues, private-repository access and visibility
+  checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or
+  shell.
+- For ordinary cached reads of public Make IT Work Cloud repositories and
+  owner-approved private repositories present in the repo-search cache, use
+  `repo-search` first: inspect `/repos/<repo>/current`, record the visible
+  cache worktree SHA, then read a bounded group of likely files. `search_files`
+  only locates paths. The cache can lag by about two minutes; if the
+  repository is not cached, report the gap rather than silently using GitHub
+  reads. Verify remote default-branch HEAD through GitHub before branching or
+  publishing from cache evidence, and re-read current source if it differs.
 - Use the MCP or documentation source that owns the question, and load a
   matching installed skill before substantive work. For GitOps incidents, start
   with Argo CD and use Kubernetes and Grafana only as read-only supporting

opencode-server/files/agents/homerepair.md

@@ -13,15 +13,17 @@ You are the homerepair agent. You assist the owner in real time with safe, image
 
 - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP
   exclusively for GitHub writes, branches, pull requests, reviews, releases,
-  workflows, checks, merges, issues, private repositories, and
-  freshness-critical reads; never substitute `git`, `gh`, SSH, or shell.
-- For public Make IT Work Cloud repository exploration, use `repo-search`
-  first: inspect `/repos/<repo>/current`, record the visible cache worktree
-  SHA, then read a bounded group of likely files. `search_files` only locates
-  paths. The cache can lag by about two minutes; if it is absent, report the
-  gap rather than silently using GitHub reads. Verify remote default-branch
-  HEAD through GitHub before branching or publishing from cache evidence, and
-  re-read current source if it differs.
+  workflows, checks, merges, issues, private-repository access and visibility
+  checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or
+  shell.
+- For ordinary cached reads of public Make IT Work Cloud repositories and
+  owner-approved private repositories present in the repo-search cache, use
+  `repo-search` first: inspect `/repos/<repo>/current`, record the visible
+  cache worktree SHA, then read a bounded group of likely files. `search_files`
+  only locates paths. The cache can lag by about two minutes; if the
+  repository is not cached, report the gap rather than silently using GitHub
+  reads. Verify remote default-branch HEAD through GitHub before branching or
+  publishing from cache evidence, and re-read current source if it differs.
 - Use the MCP or documentation source that owns the question, and load a
   matching installed skill before substantive work. For GitOps incidents, start
   with Argo CD and use Kubernetes and Grafana only as read-only supporting

opencode-server/files/agents/homesteader.md

@@ -13,15 +13,17 @@ You steward the confidential `makeitworkcloud/agent-knowledge` repository, espec
 
 - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP
   exclusively for GitHub writes, branches, pull requests, reviews, releases,
-  workflows, checks, merges, issues, private repositories, and
-  freshness-critical reads; never substitute `git`, `gh`, SSH, or shell.
-- For public Make IT Work Cloud repository exploration, use `repo-search`
-  first: inspect `/repos/<repo>/current`, record the visible cache worktree
-  SHA, then read a bounded group of likely files. `search_files` only locates
-  paths. The cache can lag by about two minutes; if it is absent, report the
-  gap rather than silently using GitHub reads. Verify remote default-branch
-  HEAD through GitHub before branching or publishing from cache evidence, and
-  re-read current source if it differs.
+  workflows, checks, merges, issues, private-repository access and visibility
+  checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or
+  shell.
+- For ordinary cached reads of public Make IT Work Cloud repositories and
+  owner-approved private repositories present in the repo-search cache, use
+  `repo-search` first: inspect `/repos/<repo>/current`, record the visible
+  cache worktree SHA, then read a bounded group of likely files. `search_files`
+  only locates paths. The cache can lag by about two minutes; if the
+  repository is not cached, report the gap rather than silently using GitHub
+  reads. Verify remote default-branch HEAD through GitHub before branching or
+  publishing from cache evidence, and re-read current source if it differs.
 - Use the MCP or documentation source that owns the question, and load a
   matching installed skill before substantive work. For GitOps incidents, start
   with Argo CD and use Kubernetes and Grafana only as read-only supporting

opencode-server/files/agents/lawnmowerman.md

@@ -13,15 +13,17 @@ You are the lawnmowerman agent: you assist the owner in real time with troublesh
 
 - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP
   exclusively for GitHub writes, branches, pull requests, reviews, releases,
-  workflows, checks, merges, issues, private repositories, and
-  freshness-critical reads; never substitute `git`, `gh`, SSH, or shell.
-- For public Make IT Work Cloud repository exploration, use `repo-search`
-  first: inspect `/repos/<repo>/current`, record the visible cache worktree
-  SHA, then read a bounded group of likely files. `search_files` only locates
-  paths. The cache can lag by about two minutes; if it is absent, report the
-  gap rather than silently using GitHub reads. Verify remote default-branch
-  HEAD through GitHub before branching or publishing from cache evidence, and
-  re-read current source if it differs.
+  workflows, checks, merges, issues, private-repository access and visibility
+  checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or
+  shell.
+- For ordinary cached reads of public Make IT Work Cloud repositories and
+  owner-approved private repositories present in the repo-search cache, use
+  `repo-search` first: inspect `/repos/<repo>/current`, record the visible
+  cache worktree SHA, then read a bounded group of likely files. `search_files`
+  only locates paths. The cache can lag by about two minutes; if the
+  repository is not cached, report the gap rather than silently using GitHub
+  reads. Verify remote default-branch HEAD through GitHub before branching or
+  publishing from cache evidence, and re-read current source if it differs.
 - Use the MCP or documentation source that owns the question, and load a
   matching installed skill before substantive work. For GitOps incidents, start
   with Argo CD and use Kubernetes and Grafana only as read-only supporting

opencode-server/files/agents/makeitwork.md

@@ -13,15 +13,17 @@ You are a pragmatic senior software and infrastructure engineer for the `makeitw
 
 - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP
   exclusively for GitHub writes, branches, pull requests, reviews, releases,
-  workflows, checks, merges, issues, private repositories, and
-  freshness-critical reads; never substitute `git`, `gh`, SSH, or shell.
-- For public Make IT Work Cloud repository exploration, use `repo-search`
-  first: inspect `/repos/<repo>/current`, record the visible cache worktree
-  SHA, then read a bounded group of likely files. `search_files` only locates
-  paths. The cache can lag by about two minutes; if it is absent, report the
-  gap rather than silently using GitHub reads. Verify remote default-branch
-  HEAD through GitHub before branching or publishing from cache evidence, and
-  re-read current source if it differs.
+  workflows, checks, merges, issues, private-repository access and visibility
+  checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or
+  shell.
+- For ordinary cached reads of public Make IT Work Cloud repositories and
+  owner-approved private repositories present in the repo-search cache, use
+  `repo-search` first: inspect `/repos/<repo>/current`, record the visible
+  cache worktree SHA, then read a bounded group of likely files. `search_files`
+  only locates paths. The cache can lag by about two minutes; if the
+  repository is not cached, report the gap rather than silently using GitHub
+  reads. Verify remote default-branch HEAD through GitHub before branching or
+  publishing from cache evidence, and re-read current source if it differs.
 - For GitOps incidents, start with Argo CD for ownership, desired revision,
   sync, health, resources, and events; use Kubernetes and Grafana as read-only
   supporting evidence. Use the MCP or documentation source that owns the

opencode-server/files/agents/teacher.md

@@ -13,15 +13,17 @@ Apply the shared server instructions.
 
 - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP
   exclusively for GitHub writes, branches, pull requests, reviews, releases,
-  workflows, checks, merges, issues, private repositories, and
-  freshness-critical reads; never substitute `git`, `gh`, SSH, or shell.
-- For public Make IT Work Cloud repository exploration, use `repo-search`
-  first: inspect `/repos/<repo>/current`, record the visible cache worktree
-  SHA, then read a bounded group of likely files. `search_files` only locates
-  paths. The cache can lag by about two minutes; if it is absent, report the
-  gap rather than silently using GitHub reads. Verify remote default-branch
-  HEAD through GitHub before branching or publishing from cache evidence, and
-  re-read current source if it differs.
+  workflows, checks, merges, issues, private-repository access and visibility
+  checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or
+  shell.
+- For ordinary cached reads of public Make IT Work Cloud repositories and
+  owner-approved private repositories present in the repo-search cache, use
+  `repo-search` first: inspect `/repos/<repo>/current`, record the visible
+  cache worktree SHA, then read a bounded group of likely files. `search_files`
+  only locates paths. The cache can lag by about two minutes; if the
+  repository is not cached, report the gap rather than silently using GitHub
+  reads. Verify remote default-branch HEAD through GitHub before branching or
+  publishing from cache evidence, and re-read current source if it differs.
 - Use the MCP or documentation source that owns the question, and load a
   matching installed skill before substantive work. For GitOps incidents, start
   with Argo CD and use Kubernetes and Grafana only as read-only supporting

opencode-server/files/agents/xnoto.md

@@ -13,17 +13,19 @@ You are a pragmatic senior software engineer for the public `xnoto` repositories
 
 - Before the first GitHub search or write, call `github_get_me`. Use GitHub MCP
   exclusively for GitHub writes, branches, pull requests, reviews, releases,
-  workflows, checks, merges, issues, private repositories, and
-  freshness-critical reads; never substitute `git`, `gh`, SSH, or shell.
-- For public Make IT Work Cloud repository exploration, use `repo-search`
-  first: inspect `/repos/<repo>/current`, record the visible cache worktree
-  SHA, then read a bounded group of likely files. `search_files` only locates
-  paths. The cache can lag by about two minutes; if it is absent, report the
-  gap rather than silently using GitHub reads. For xnoto, cached worktrees are
-  `/repos/xnoto-<repository>/current`, with `.github` at
-  `/repos/xnoto-dotgithub/current`. Verify remote default-branch HEAD through
-  GitHub before branching or publishing from cache evidence, and re-read
-  current source if it differs.
+  workflows, checks, merges, issues, private-repository access and visibility
+  checks, and freshness-critical reads; never substitute `git`, `gh`, SSH, or
+  shell.
+- For ordinary cached reads of public Make IT Work Cloud repositories and
+  owner-approved private repositories present in the repo-search cache, use
+  `repo-search` first: inspect `/repos/<repo>/current`, record the visible
+  cache worktree SHA, then read a bounded group of likely files. `search_files`
+  only locates paths. The cache can lag by about two minutes; if the
+  repository is not cached, report the gap rather than silently using GitHub
+  reads. For xnoto, cached worktrees are `/repos/xnoto-<repository>/current`,
+  with `.github` at `/repos/xnoto-dotgithub/current`. Verify remote
+  default-branch HEAD through GitHub before branching or publishing from cache
+  evidence, and re-read current source if it differs.
 - For GitOps incidents, start with Argo CD for ownership, desired revision,
   sync, health, resources, and events; use Kubernetes and Grafana as read-only
   supporting evidence. Use the MCP or documentation source that owns the

opencode-server/files/opencode.json

@@ -9,12 +9,12 @@
   "enabled_providers": ["kimi-for-coding", "minimax-coding-plan", "openai", "zai-coding-plan"],
   "provider": {"kimi-for-coding": {"options": {"apiKey": "{env:KIMI_API_KEY}"}}},
   "permission": {
-    "external_directory": {"/artifacts/*": "allow"},
-    "glob": {"/artifacts/*": "allow"},
-    "grep": {"/artifacts/*": "allow"},
-    "list": {"/artifacts/*": "allow"},
-    "read": {"/artifacts/*": "allow"},
-    "edit": {"/artifacts/*": "allow"},
+    "external_directory": {"/artifacts/*": "allow", "/repos/*": "allow"},
+    "glob": {"/artifacts/*": "allow", "/repos/*": "allow"},
+    "grep": {"/artifacts/*": "allow", "/repos/*": "allow"},
+    "list": {"/artifacts/*": "allow", "/repos/*": "allow"},
+    "read": {"/artifacts/*": "allow", "/repos/*": "allow"},
+    "edit": {"/artifacts/*": "allow", "/repos/*": "allow"},
     "agent-pipe_download_artifact": "ask",
     "agent-pipe_inspect_artifact": "allow",
     "agent-pipe_upload_artifact": "ask",