Opencode V2 sbx agent
This commit is contained in:
Jarek Rozanski
commit
962002aec1
6 changed files with 345 additions and 0 deletions
5
.gitignore
vendored
Normal file
5
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,5 @@
|
||||||
|
*.tar
|
||||||
|
*.log
|
||||||
|
.env
|
||||||
|
.claude
|
||||||
|
.opencode
|
||||||
12
Dockerfile
Normal file
12
Dockerfile
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
# Pins the OpenCode CLI version inside the sandbox to OpenCode v2.
|
||||||
|
#
|
||||||
|
# docker/sandbox-templates:opencode bakes in OpenCode v1 (the `opencode-ai`
|
||||||
|
# npm package, 1.18.32 as of writing). OpenCode v2 ships as a different npm
|
||||||
|
# package, `@opencode/cli` (confirmed via `npm view @opencode/cli version`
|
||||||
|
# and by running `opencode --version` in the built image, which reports
|
||||||
|
# "opencode v2.0.26"). Both packages install a binary named `opencode` into
|
||||||
|
# the same global npm prefix, so the old one has to be removed first.
|
||||||
|
FROM docker/sandbox-templates:opencode
|
||||||
|
ARG OPENCODE_VERSION=2.0.26
|
||||||
|
RUN npm uninstall -g opencode-ai \
|
||||||
|
&& npm install -g @opencode/cli@${OPENCODE_VERSION}
|
||||||
38
Makefile
Normal file
38
Makefile
Normal file
|
|
@ -0,0 +1,38 @@
|
||||||
|
# Utilities for running the OpenCode agent in a Docker Sandbox.
|
||||||
|
# Requires the `sbx` CLI: https://docs.docker.com/ai/sandboxes/install/
|
||||||
|
#
|
||||||
|
# `sbx` doesn't have a nested sandbox-in-sandbox mode, so these targets are
|
||||||
|
# meant to be run on your host machine from this directory (where sbxenv.yaml
|
||||||
|
# lives), not from inside another sandbox.
|
||||||
|
|
||||||
|
NAME ?= opencode-v2
|
||||||
|
AGENT ?= opencode
|
||||||
|
IMAGE_TAG ?= opencode-v2:local
|
||||||
|
OPENCODE_VERSION ?= 2.0.26
|
||||||
|
|
||||||
|
.PHONY: help cli-check image build install
|
||||||
|
|
||||||
|
help:
|
||||||
|
@echo "NAME=$(NAME) AGENT=$(AGENT) OPENCODE_VERSION=$(OPENCODE_VERSION)"
|
||||||
|
@echo ""
|
||||||
|
@echo " make image build the $(IMAGE_TAG) image pinning the opencode CLI version"
|
||||||
|
@echo " make build [OPENCODE_VERSION=...] build the image and register it with sbx as a local template"
|
||||||
|
@echo " make install install the opencode-sandbox shim to ~/.local/bin"
|
||||||
|
|
||||||
|
cli-check:
|
||||||
|
@command -v sbx >/dev/null 2>&1 || { \
|
||||||
|
echo "sbx CLI not found. Install it: https://docs.docker.com/ai/sandboxes/install/"; \
|
||||||
|
exit 1; \
|
||||||
|
}
|
||||||
|
@sbx version
|
||||||
|
|
||||||
|
image:
|
||||||
|
docker build --build-arg OPENCODE_VERSION=$(OPENCODE_VERSION) -t $(IMAGE_TAG) .
|
||||||
|
|
||||||
|
build: cli-check image
|
||||||
|
docker image save $(IMAGE_TAG) -o /tmp/opencode-v2.tar
|
||||||
|
sbx template load /tmp/opencode-v2.tar
|
||||||
|
|
||||||
|
install:
|
||||||
|
sh ./install.sh
|
||||||
|
|
||||||
157
README.md
Normal file
157
README.md
Normal file
|
|
@ -0,0 +1,157 @@
|
||||||
|
# opencodev2
|
||||||
|
|
||||||
|
Config and `make` utilities for running **OpenCode v2** inside a
|
||||||
|
[Docker Sandbox](https://docs.docker.com/ai/sandboxes/) — an isolated
|
||||||
|
environment that mounts your working directory read-write, limits network
|
||||||
|
access by policy, and keeps agent-installed tooling out of your host machine.
|
||||||
|
|
||||||
|
## Prerequisites
|
||||||
|
|
||||||
|
1. Install the `sbx` CLI (one-time, on your host):
|
||||||
|
|
||||||
|
```console
|
||||||
|
# macOS
|
||||||
|
brew trust docker/tap
|
||||||
|
brew install docker/tap/sbx
|
||||||
|
|
||||||
|
# Ubuntu (with Docker Engine already installed)
|
||||||
|
curl -fsSL https://get.docker.com | sudo SBX=1 sh
|
||||||
|
|
||||||
|
# Windows
|
||||||
|
winget install -h Docker.sbx
|
||||||
|
```
|
||||||
|
|
||||||
|
See [docs.docker.com/ai/sandboxes/install](https://docs.docker.com/ai/sandboxes/install/)
|
||||||
|
for other platforms and system-wide installs.
|
||||||
|
|
||||||
|
2. Authenticate and store a credential for whichever model provider OpenCode
|
||||||
|
should use (one-time, host-level secrets — not stored in this repo):
|
||||||
|
|
||||||
|
```console
|
||||||
|
sbx login
|
||||||
|
sbx secret set anthropic # or: openai, google, openrouter, ...
|
||||||
|
sbx secret set github # optional, for repo/PR access via `gh auth token`
|
||||||
|
```
|
||||||
|
|
||||||
|
## Quick start
|
||||||
|
|
||||||
|
```console
|
||||||
|
make build # build the image, register it with sbx as a local template
|
||||||
|
make install # install the opencode-sandbox shim (one-time)
|
||||||
|
. ~/.bashrc # or ~/.zshrc / restart your shell — whatever install.sh edited
|
||||||
|
|
||||||
|
cd ~/some-project
|
||||||
|
opencode-sandbox # launch OpenCode v2 in a sandbox, workspace = current directory
|
||||||
|
```
|
||||||
|
|
||||||
|
`opencode-sandbox` works from **any** directory once installed — it's not tied
|
||||||
|
to this project directory, and it's not named `opencode` so it won't shadow a
|
||||||
|
real, locally-installed OpenCode CLI on your PATH. Re-run `make build` whenever
|
||||||
|
you bump `OPENCODE_VERSION` or change [`./Dockerfile`](./Dockerfile);
|
||||||
|
`make install` only needs to run once per machine.
|
||||||
|
|
||||||
|
On first run, `sbx` asks you to pick a global network policy (Open / Balanced /
|
||||||
|
Locked Down). **Balanced** is a reasonable default. Adjust anytime:
|
||||||
|
|
||||||
|
```console
|
||||||
|
sbx policy ls # show current rules
|
||||||
|
sbx policy allow network <host> # allow an extra host
|
||||||
|
```
|
||||||
|
|
||||||
|
## What `make install` does
|
||||||
|
|
||||||
|
[`install.sh`](./install.sh) is POSIX `/bin/sh` (not shell-specific) and does
|
||||||
|
two things, both idempotent — safe to re-run:
|
||||||
|
|
||||||
|
1. Writes a shim to `~/.local/bin/opencode-sandbox`:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
#!/bin/sh
|
||||||
|
exec sbx run -t localhost/opencode-v2:local "$@" opencode
|
||||||
|
```
|
||||||
|
|
||||||
|
`-t localhost/opencode-v2:local` points at the template `make build`
|
||||||
|
registers (see below); `opencode` is the agent name; `"$@"` forwards any
|
||||||
|
extra args (e.g. `opencode-sandbox --model claude-sonnet-5`). Being a real
|
||||||
|
executable on `PATH` rather than a shell function means it works
|
||||||
|
identically under bash, zsh, fish, or anything else.
|
||||||
|
|
||||||
|
2. If `~/.local/bin` isn't already on `PATH`, adds it — detecting your login
|
||||||
|
shell via `$SHELL` (not whatever shell happens to run this script) and
|
||||||
|
picking the right config file: `~/.zshrc` for zsh (falling back to an
|
||||||
|
existing `~/.zshenv` if that's what you already use), `~/.bash_profile` on
|
||||||
|
macOS / `~/.bashrc` elsewhere for bash, `fish_add_path` for fish (no file
|
||||||
|
to edit), or `~/.profile` otherwise.
|
||||||
|
|
||||||
|
This pattern (shim binary + per-shell/per-OS config detection + marker-based
|
||||||
|
idempotent edit) is adapted from
|
||||||
|
[`install-shortcut.sh`](https://cloud.inputobjects.eu/forge/jrozanski/opencode-sandbox/src/branch/main/scripts/install-shortcut.sh)
|
||||||
|
in a related project.
|
||||||
|
|
||||||
|
## Running OpenCode v2 (not the built-in v1 template)
|
||||||
|
|
||||||
|
`sbx run opencode` on its own uses Docker's stock image, `docker/sandbox-templates:opencode`,
|
||||||
|
which bakes in **OpenCode v1** — the `opencode-ai` npm package, pinned at `1.18.32` as of
|
||||||
|
this writing (verified with
|
||||||
|
`docker run --rm --entrypoint sh docker/sandbox-templates:opencode -c 'opencode --version'`).
|
||||||
|
|
||||||
|
OpenCode v2 is real and actively published, but as a **different npm package**:
|
||||||
|
`@opencode/cli` (currently `2.0.26` — verify with `npm view @opencode/cli version`). The
|
||||||
|
old `opencode-ai` line never became v2; it was superseded by this new package, which is
|
||||||
|
why checking `opencode-ai`'s version history makes v2 look like it doesn't exist. Both
|
||||||
|
packages install a binary named `opencode` into the same global npm prefix, so getting v2
|
||||||
|
means removing the v1 package first, then installing the v2 one — confirmed by actually
|
||||||
|
building this and running `opencode --version` inside the result, which reports
|
||||||
|
`opencode v2.0.26`.
|
||||||
|
|
||||||
|
[`./Dockerfile`](./Dockerfile) does the swap at the image level:
|
||||||
|
|
||||||
|
```dockerfile
|
||||||
|
FROM docker/sandbox-templates:opencode
|
||||||
|
ARG OPENCODE_VERSION=2.0.26
|
||||||
|
RUN npm uninstall -g opencode-ai \
|
||||||
|
&& npm install -g @opencode/cli@${OPENCODE_VERSION}
|
||||||
|
```
|
||||||
|
|
||||||
|
`sbx` runs each sandbox in its own isolated microVM with its own Docker
|
||||||
|
daemon/image cache, so a plain `docker build` on your host is invisible to it
|
||||||
|
— `make build` closes that gap with `docker image save` + `sbx template load`,
|
||||||
|
which registers the image as a local template `sbx run -t localhost/...` (or
|
||||||
|
`sbxenv.yaml`'s `sandboxOptions.template`) can find.
|
||||||
|
|
||||||
|
To bump to a newer v2 release:
|
||||||
|
|
||||||
|
```console
|
||||||
|
make build OPENCODE_VERSION=2.0.27 # or any other published @opencode/cli version
|
||||||
|
```
|
||||||
|
|
||||||
|
or edit the `OPENCODE_VERSION` default in the [`Makefile`](./Makefile). Avoid pinning to
|
||||||
|
`latest` long-term — once the image layer is cached, Docker won't re-resolve `latest` on
|
||||||
|
later builds, so it'll silently stop tracking new releases; use `--no-cache` or bump to
|
||||||
|
an explicit version instead.
|
||||||
|
|
||||||
|
**Note:** [`sbxenv.yaml`](./sbxenv.yaml)'s `sandboxOptions.template` is currently set to
|
||||||
|
the bare tag `opencode-v2:local`, while the `opencode-sandbox` shim above (and `sbx
|
||||||
|
template load`'s own output) use the `localhost/opencode-v2:local` form. If running
|
||||||
|
`sbx run opencode` from inside this directory (reading `sbxenv.yaml`) doesn't find the
|
||||||
|
template, try adding the `localhost/` prefix there too.
|
||||||
|
|
||||||
|
## Makefile targets
|
||||||
|
|
||||||
|
```console
|
||||||
|
make image build the opencode-v2:local image (OPENCODE_VERSION=2.0.26 by default)
|
||||||
|
make build image + register it with sbx as a local template
|
||||||
|
make install install the opencode-sandbox shim to ~/.local/bin
|
||||||
|
```
|
||||||
|
|
||||||
|
Everything else — `sbx login`, `sbx secret set`, `sbx policy`, `sbx run`,
|
||||||
|
`sbx stop`/`rm`/`ls`, `sbx ports` — is plain `sbx`; there's no Makefile wrapper
|
||||||
|
for those.
|
||||||
|
|
||||||
|
## Notes
|
||||||
|
|
||||||
|
- `make build` is meant to run on your **host** machine — `sbx` has no nested
|
||||||
|
sandbox-in-sandbox mode.
|
||||||
|
- The published [CLI reference](https://docs.docker.com/reference/cli/sbx/) page is
|
||||||
|
JS-rendered and didn't fully resolve during research for this README; if a command
|
||||||
|
here doesn't match your installed `sbx` version, check `sbx <command> --help`.
|
||||||
88
install.sh
Executable file
88
install.sh
Executable file
|
|
@ -0,0 +1,88 @@
|
||||||
|
#!/bin/sh
|
||||||
|
# Installs a global `opencode-sandbox` shim at ~/.local/bin so that command,
|
||||||
|
# run from any directory, launches OpenCode v2 from the local sbx template
|
||||||
|
# registered by `make build` — with the directory you're standing in as the
|
||||||
|
# sandbox's workspace.
|
||||||
|
#
|
||||||
|
# POSIX sh only (no bashisms) -- this may run under any login shell's `sh`,
|
||||||
|
# not necessarily the user's interactive shell.
|
||||||
|
#
|
||||||
|
# Named opencode-sandbox, not opencode, so it doesn't shadow a real,
|
||||||
|
# locally-installed opencode CLI on PATH.
|
||||||
|
#
|
||||||
|
# Pattern (shell/OS detection, marker-based idempotent PATH edit, resolving
|
||||||
|
# the login shell via $SHELL rather than the script's own running shell)
|
||||||
|
# adapted from https://cloud.inputobjects.eu/forge/jrozanski/opencode-sandbox/src/branch/main/scripts/install-shortcut.sh
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
BIN_DIR="$HOME/.local/bin"
|
||||||
|
SHIM="$BIN_DIR/opencode-sandbox"
|
||||||
|
|
||||||
|
mkdir -p "$BIN_DIR"
|
||||||
|
|
||||||
|
cat > "$SHIM" <<'EOF'
|
||||||
|
#!/bin/sh
|
||||||
|
exec sbx run -t localhost/opencode-v2:local "$@" opencode
|
||||||
|
EOF
|
||||||
|
chmod +x "$SHIM"
|
||||||
|
echo "==> Installed shim: $SHIM"
|
||||||
|
|
||||||
|
# Already on PATH? Nothing left to do.
|
||||||
|
case ":$PATH:" in
|
||||||
|
*":$BIN_DIR:"*)
|
||||||
|
echo "==> $BIN_DIR is already on PATH."
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
# Resolve the user's *login* shell via $SHELL, not the shell running this
|
||||||
|
# script, so the right config file gets edited regardless of how this
|
||||||
|
# script itself was invoked.
|
||||||
|
shell_name=$(basename "${SHELL:-}")
|
||||||
|
|
||||||
|
if [ "$shell_name" = fish ] && command -v fish >/dev/null 2>&1; then
|
||||||
|
# fish_add_path persists via a universal variable -- no config file to edit.
|
||||||
|
fish -c "fish_add_path $BIN_DIR"
|
||||||
|
echo "==> Added $BIN_DIR to PATH via fish_add_path."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
case "$shell_name" in
|
||||||
|
zsh)
|
||||||
|
# Prefer .zshrc (the standard interactive-shell file); if it doesn't
|
||||||
|
# exist but .zshenv does, respect that existing setup instead of
|
||||||
|
# scattering PATH across two files. Only create .zshrc if neither exists.
|
||||||
|
if [ -f "$HOME/.zshrc" ]; then
|
||||||
|
rc="$HOME/.zshrc"
|
||||||
|
elif [ -f "$HOME/.zshenv" ]; then
|
||||||
|
rc="$HOME/.zshenv"
|
||||||
|
else
|
||||||
|
rc="$HOME/.zshrc"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
bash)
|
||||||
|
# macOS Terminal.app runs bash as a login shell, sourcing
|
||||||
|
# ~/.bash_profile (not ~/.bashrc) unless the user's profile chains to it.
|
||||||
|
case "$(uname -s)" in
|
||||||
|
Darwin) rc="$HOME/.bash_profile" ;;
|
||||||
|
*) rc="$HOME/.bashrc" ;;
|
||||||
|
esac
|
||||||
|
;;
|
||||||
|
*) rc="$HOME/.profile" ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
marker_begin="# >>> opencode-sandbox >>>"
|
||||||
|
marker_end="# <<< opencode-sandbox <<<"
|
||||||
|
|
||||||
|
if [ -f "$rc" ] && grep -qF "$marker_begin" "$rc"; then
|
||||||
|
echo "==> $rc already configures PATH for opencode-sandbox; skipping."
|
||||||
|
else
|
||||||
|
touch "$rc"
|
||||||
|
{
|
||||||
|
printf '\n%s\n' "$marker_begin"
|
||||||
|
printf 'export PATH="%s:$PATH"\n' "$BIN_DIR"
|
||||||
|
printf '%s\n' "$marker_end"
|
||||||
|
} >> "$rc"
|
||||||
|
echo "==> Added $BIN_DIR to PATH in $rc."
|
||||||
|
echo "==> Restart your shell (or run: . $rc) to pick it up."
|
||||||
|
fi
|
||||||
45
sbxenv.yaml
Normal file
45
sbxenv.yaml
Normal file
|
|
@ -0,0 +1,45 @@
|
||||||
|
schemaVersion: "1"
|
||||||
|
name: opencodev2
|
||||||
|
agent: opencode
|
||||||
|
|
||||||
|
# Mount this project directory into the sandbox as the primary workspace.
|
||||||
|
workspace: .
|
||||||
|
|
||||||
|
env: {}
|
||||||
|
|
||||||
|
# Use the image built by `make image` instead of Docker's stock opencode
|
||||||
|
# template, so the sandbox runs the OpenCode CLI version pinned in ./Dockerfile
|
||||||
|
# rather than whatever version Docker last baked into docker/sandbox-templates:opencode.
|
||||||
|
sandboxOptions:
|
||||||
|
template: opencode-v2:local
|
||||||
|
# memory: 8g
|
||||||
|
# cpus: 4
|
||||||
|
|
||||||
|
# Provider credentials are stored on the host (outside this file) with the
|
||||||
|
# sbx CLI, not here. Run one of these once before `make run`:
|
||||||
|
# sbx secret set anthropic
|
||||||
|
# sbx secret set openai
|
||||||
|
# sbx secret set google
|
||||||
|
# sbx secret set openrouter
|
||||||
|
# sbx secret set github --command 'gh auth token' # for PRs/repo access
|
||||||
|
#
|
||||||
|
# OpenCode Zen or another custom API key:
|
||||||
|
# sbx secret set-custom --host opencode.ai --env OPENCODE_API_KEY --value "$OPENCODE_API_KEY"
|
||||||
|
# sbx policy allow network opencode.ai:443
|
||||||
|
|
||||||
|
# Uncomment to expose a port the agent starts inside the sandbox (e.g. a dev
|
||||||
|
# server) on the host:
|
||||||
|
# ports:
|
||||||
|
# - sandbox: 3000
|
||||||
|
# host: 3000
|
||||||
|
# protocol: tcp4
|
||||||
|
|
||||||
|
# lifecycle.* commands (initialize/postCreate/preRemove) run on the HOST, not
|
||||||
|
# inside the sandbox, so they're for preparing the workspace on disk (cloning
|
||||||
|
# repos, host-side `npm install` into a mounted dir) — not for changing tools
|
||||||
|
# installed inside the sandbox. Use ./Dockerfile + sandboxOptions.template for
|
||||||
|
# that instead.
|
||||||
|
# lifecycle:
|
||||||
|
# postCreate:
|
||||||
|
# - command: npm install
|
||||||
|
# workdir: .
|
||||||
Loading…
Add table
Add a link
Reference in a new issue