deploy: combined opencode image + k8s + docs

- pilot/Dockerfile: python:3.12-slim + node 20 + opencode-ai@1.3.10 + ripgrep + pyright/typescript-language-server/eslint (npm) + ruff (pip). Factory + pilot scripts baked at /app. imagePullPolicy: Never (local import into microk8s containerd). - .dockerignore: lean build context. - ~/k8s/pragent-webhook.yaml: image pragent-webhook:opencode, emptyDir work at /tmp/pragent-work, env (PRAGENT_ENGINE, OPENCODE_MODEL, PRAGENT_FACTORY_DIR, PRAGENT_OPENCODE_BIN, PRAGENT_WORK_ROOT, PRAGENT_RTK_DIR='', timeout 540), resources 200m/512Mi -> 1500m/2Gi. Drops the ConfigMap scripts volume. - pilot/README-webhook.md + .opencode/README.md: opencode engine section, build/import/apply steps, factory guide fixes (parse_review_output, steps). Image builds (1.62GB, smoke-tested: opencode+LSPs+factory+env all present). Import into microk8s containerd + apply pending (ctr needs sudo). Co-Authored-By: Claude <noreply@anthropic.com>
2026-08-17 23:11:58 +00:00
parent 6e3a9eb5b0
commit 8912f6721b
4 changed files with 162 additions and 16 deletions
@@ -0,0 +1,51 @@
+# pragent pilot — combined webhook + opencode review-engine image.
+#
+# One container runs the Gitea webhook server (python) and subprocess-calls the
+# opencode CLI headlessly to analyze each PR. Includes node + the LSPs / linters
+# the pragent agent's bash tool can invoke on the checked-out repo. The factory
+# (opencode.json + .opencode/ agents/skills) lives at /app and is discovered via
+# PRAGENT_FACTORY_DIR=/app.
+#
+# Build:
+#   docker build -t pragent-webhook:opencode -f pilot/Dockerfile .
+# Import into microk8s (needs sudo for containerd):
+#   docker save pragent-webhook:opencode | sudo microk8s ctr images import -
+# (or: sudo microk8s ctr images import pragent-webhook-opencode.tar)
+#
+FROM python:3.12-slim
+
+# System deps: git (archive/repo reads by the agent), ripgrep (opencode dep),
+# curl + ca-certs (archive fetch), xz-utils (node install).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        git ripgrep curl ca-certificates xz-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+# Node 20 — opencode runtime + the npm-installed LSP servers below.
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/*
+
+# opencode CLI, pinned to the verified version. opencode bun-installs its
+# @opencode-ai runtime into $HOME/.config/opencode/node_modules on first run
+# (cold-start ~30-60s, once per pod lifetime; the webhook returns 202 async so
+# no Gitea delivery timeout is risked). HOME is an emptyDir at runtime.
+RUN npm install -g opencode-ai@1.3.10
+
+# LSPs + linters the pragent agent's bash tool can invoke on reviewed repos.
+# (opencode's own LSP tool is opportunistic; the real signal is the agent
+# running the repo's own tsc/ruff/eslint/go vet — these make that available.)
+RUN npm install -g pyright typescript-language-server typescript eslint \
+    && pip install --no-cache-dir ruff
+
+# pragent repo: factory (opencode.json + .opencode/) + pilot scripts.
+WORKDIR /app
+COPY . /app
+
+ENV PRAGENT_FACTORY_DIR=/app \
+    PRAGENT_OPENCODE_BIN=/usr/local/bin/opencode \
+    PRAGENT_ENGINE=opencode \
+    OPENCODE_MODEL=headroom/glm-5.2:cloud \
+    OPENCODE_EXPERIMENTAL_LSP_TOOL=true \
+    PRAGENT_RTK_DIR=""
+
+CMD ["python3", "/app/pilot/webhook_server.py"]
@@ -22,12 +22,22 @@ ai_review.review_pr()  (same core the CI-step uses)
   2. fetch PR diff     → GET .../pulls/{i}.diff
   3. fetch .pr-review.json @ head ref (optional repo-local focus/config)
   4. prior review bodies → fed as "already said" context (light §6.1)
-   5. review prompt     → POST http://100.74.17.70:8789/v1/messages  (glm-5.2:cloud)
-      model emits JSON: {findings:[{severity,path,line,problem,fix,suggestion}]}
+   5. PRAGENT_ENGINE=opencode (default):
+      a. fetch repo archive @ head sha → /tmp/pragent-work/<repo>-<sha>
+      b. write .pragent/brief.md (title/body/diff/config/prior/sha/anchor-hint)
+      c. drop the factory (opencode.json + .opencode/) into the workdir
+      d. opencode run --pure --agent pragent --dir <workdir> --model headroom/glm-5.2:cloud
+         → the pragent agent reads the brief, inspects the repo, runs the
+         repo's own linters via bash, loads review-methodology + findings-schema
+         skills, delegates to security/tests/perf subagents only on big/risky
+         diffs, and emits: {"summary":..., "findings":[{severity,path,line,
+         problem,fix,suggestion,reference}]}
+      (=ollama: legacy single POST to http://100.74.17.70:8789/v1/messages)
   6. parse diff hunks → valid (path, new_line) anchors (RIGHT side)
   7. post review       → POST .../pulls/{i}/reviews  (event: COMMENT) as pragent-bot
+      - prose summary → review body intro
      - anchored findings → inline line comments, body wraps `suggestion` in a
-        ```suggestion fence (Gitea renders an apply-button)
+        ```suggestion fence (Gitea renders an apply-button); reference → 📎 ref link
      - unanchored findings → summary-body bullets
      - summary body carries the <!-- pragent:sha=... --> marker for dedupe
 ```
@@ -138,28 +148,101 @@ blanket "allow all private". A future `helm upgrade` may overwrite the inline
 secret; bake it into `gitea.config.webhook.ALLOWED_HOST_LIST` in the helm values
 for permanence.

+## The opencode review engine
+
+The review "brain" runs on **opencode** (the AI coding-agent CLI), not a single
+cramped model call. `pilot/opencode_review.py` is the glue:
+
+1. `fetch_archive` — `GET .../archive/{sha}.tar.gz`, untar into a temp workdir
+   (stripping the top dir) so the agent has the real files, not just the diff.
+2. `write_brief` — renders `.pragent/brief.md` (title, body, diff, repo
+   `.pr-review.json`, prior reviews, sha, anchor hint).
+3. `drop_factory` — copies `opencode.json` + `.opencode/` (agents/skills/commands)
+   into the workdir as the project config.
+4. `run_opencode` — `opencode run --pure --agent pragent --dir <workdir>
+   --model headroom/glm-5.2:cloud` headlessly; returns the agent's stdout.
+
+It does **no Gitea I/O and no parsing** — `review_pr` parses the stdout into
+`(summary, findings)`, validates findings against diff anchors, and posts. So
+all v2 logic (dedupe marker, anchor validation, ```suggestion fencing, posting)
+is reused and never depends on the model remembering it.
+
+The factory lives in the pragent repo root: `opencode.json` (provider/model/
+permission) + `.opencode/` (agents, skills, commands). It is **both** the
+in-cluster deploy factory **and** the local interactive factory (run
+`opencode` in the repo, or `/review` via `.opencode/commands/review.md`).
+`.opencode/README.md` is the factory guide: pipeline diagram, how to add a
+subagent (drop a `.md` + one allow-list line), how to add a skill, how the
+engine flag works, how to switch the model. **Lean by default**: the `pragent`
+primary does summary + findings in one pass and runs the repo's own
+`tsc`/`ruff`/`eslint`/`go vet` via bash; `security`/`tests`/`perf` subagents are
+dormant lenses the primary delegates to only on large/security-sensitive diffs,
+so small PRs never fan out.
+
+### Engine flag + model ref
+
+`PRAGENT_ENGINE=opencode` (default) selects it; `=ollama` keeps the legacy
+direct `POST .../v1/messages` path as a fallback. opencode wants a
+**provider-prefixed** model ref, so `review_pr` maps the bare `OLLAMA_MODEL`
+(`glm-5.2:cloud`) to `headroom/glm-5.2:cloud` (override with `OPENCODE_MODEL`).
+The `headroom` provider is defined in `opencode.json` with
+`options.baseURL=http://100.74.17.70:8789/v1` (the headroom Anthropic proxy).
+
+### Local one-shot (no posting)
+
+```bash
+cd ~/Projects/pragent
+python3 /tmp/pragent-e2e.py <owner>/<repo> <pr_number>   # driver script
+# or, with opencode installed locally:
+opencode run --pure --agent pragent --dir <checkout> --model headroom/glm-5.2:cloud \
+  "$(python3 -c 'import sys;sys.path.insert(0,"pilot");import opencode_review as o;print(o._PROMPT)')"
+```
+
+### Gotchas baked into `opencode_review.py`
+
+- **stdin=DEVNULL** — opencode blocks on stdin (permission prompt) when run
+  headlessly via subprocess; closing stdin is required or it hangs to timeout.
+- **Strip `ANTHROPIC_*`** — the host shell exports `ANTHROPIC_BASE_URL` /
+  `ANTHROPIC_AUTH_TOKEN` / `ANTHROPIC_DEFAULT_*_MODEL` (for Claude Code /
+  headroom). Leaked into opencode, `ANTHROPIC_DEFAULT_SONNET_MODEL=glm-5.2:cloud`
+  makes opencode look for provider `glm-5.2:cloud` → `ProviderModelNotFoundError`.
+  The headroom provider's config is self-contained, so all `ANTHROPIC_*` are
+  dropped from the subprocess env.
+- **Shared warmed HOME** — opencode bun-installs its `@opencode-ai` runtime into
+  `$HOME/.config/opencode/node_modules` on first run (cold-start, ~30-60s, once
+  per pod lifetime). A shared, marker-warmed HOME makes every review a warm run.
+
 ## K8s deployment

 Manifest: `~/k8s/pragent-webhook.yaml` (Namespace `pragent`, Deployment pinned to
-`kubernets`, ClusterIP Service). The two scripts are a ConfigMap
-(`pragent-scripts`) and the webhook secret + bot token are a Secret
-(`pragent-webhook`). Verified: a regular pod on kubernets reaches both
+`kubernets`, ClusterIP Service). The container image `pragent-webhook:opencode`
+(pilot/Dockerfile: python:3.12-slim + node 20 + opencode-ai@1.3.10 + pyright /
+typescript-language-server / eslint / ruff) is built locally and imported into
+microk8s containerd — it is **not** pulled from a registry (`imagePullPolicy:
+Never`). The webhook secret + bot token are a Secret (`pragent-webhook`). An
+emptyDir at `/tmp/pragent-work` holds the per-review checkout + the warmed
+opencode runtime. Verified: a regular pod on kubernets reaches both
 `100.74.17.70:8789` (headroom/glm) and `gitea-http.gitea.svc.cluster.local:3000`.

-Update the scripts after editing `pilot/ai_review.py` or `pilot/webhook_server.py`:
+Build + deploy after editing the pilot scripts or the factory:

 ```bash
 K="microk8s kubectl"; cd ~/Projects/pragent
-$K -n pragent create configmap pragent-scripts \
-  --from-file=webhook_server.py=pilot/webhook_server.py \
-  --from-file=ai_review.py=pilot/ai_review.py \
-  --dry-run=client -o yaml | $K apply -f -
+# 1. build the image (docker is in the microk8s group, no sudo)
+docker build -t pragent-webhook:opencode -f pilot/Dockerfile .
+# 2. import into microk8s containerd (needs sudo — one command)
+docker save pragent-webhook:opencode | sudo microk8s ctr images import -
+# 3. apply + roll
+$K apply -f ~/k8s/pragent-webhook.yaml
 $K -n pragent rollout restart deploy/pragent-webhook
+$K -n pragent logs -f deploy/pragent-webhook
 ```

-Env on the Deployment: `GITEA_API`, `OLLAMA_URL`, `OLLAMA_MODEL`, `OLLAMA_MAX_TOKENS`,
-`DIFF_MAX_CHARS` are literals; `WEBHOOK_SECRET` + `PRAGENT_BOT_TOKEN` come from the
-Secret.
+Env on the Deployment: `PRAGENT_ENGINE`, `OPENCODE_MODEL`,
+`OPENCODE_EXPERIMENTAL_LSP_TOOL`, `PRAGENT_FACTORY_DIR`, `PRAGENT_OPENCODE_BIN`,
+`PRAGENT_WORK_ROOT`, `PRAGENT_REVIEW_TIMEOUT`, `GITEA_API`, `OLLAMA_URL`,
+`OLLAMA_MODEL`, `OLLAMA_MAX_TOKENS`, `DIFF_MAX_CHARS` are literals;
+`WEBHOOK_SECRET` + `PRAGENT_BOT_TOKEN` come from the Secret.

 ## Relationship to the CI-step pilot