OpenHarness BotandClaude Opus 4.7
7bb3c4b3f0
Deletes the in-repo .openharness/ subdir, moves composeOverrides config to repo-root config.json (gitignored, seeded from config.example.json), and reworks scripts/install.sh to clone into ~/.openharness/ with an in-place migration for existing ~/openharness/ checkouts. Closes #251 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
48 lines
2.2 KiB
YAML
48 lines
2.2 KiB
YAML
# OpenCode Host Auth Mount Overlay
|
|
# =================================
|
|
# Purpose: Bind-mount the host's ~/.local/share/opencode directory into
|
|
# the sandbox, so the sandboxed `opencode` CLI inherits host provider
|
|
# auth tokens and session state. Developers running multiple sandboxes no
|
|
# longer re-authenticate OpenCode per sandbox.
|
|
#
|
|
# One mount, one concern:
|
|
# - ~/.local/share/opencode/ (dir) — auth.json (provider OAuth/API-key
|
|
# credentials), sessions, app state
|
|
#
|
|
# Pre-flight:
|
|
# $HOST_OPENCODE_DIR (default ~/.local/share/opencode) must exist as a
|
|
# directory. If the target is missing, Docker auto-creates it as a
|
|
# directory owned by root — `opencode` then fails to read/write auth.json.
|
|
#
|
|
# Requirements: Host UID MUST equal the sandbox UID (1000). Provider auth
|
|
# files may be owner-only, so the group-membership trick used elsewhere
|
|
# in entrypoint.sh does NOT grant access. If host UID != 1000, `opencode`
|
|
# may fail to read credentials despite the bind-mount succeeding.
|
|
#
|
|
# Security tradeoff: this mounts provider credentials and session history
|
|
# into a container that may execute untrusted agent code. Enable only for
|
|
# trusted workflows. OpenAI OAuth through OpenCode's /connect flow is the
|
|
# expected default auth path for opencode in this harness, so the overlay
|
|
# is enabled by default in config.json.
|
|
#
|
|
# Permissions: Read-write (sandbox writes host sessions/provider state).
|
|
# Replaces: opencode-auth named volume from base docker-compose.yml at the
|
|
# /home/sandbox/.local/share/opencode target path. The named volume
|
|
# declaration stays in the base compose — it becomes orphaned (unmounted)
|
|
# while this overlay is active and is reinstated when the overlay is
|
|
# removed.
|
|
#
|
|
# Entrypoint coordination: sets OPENCODE_HOST_BIND_MOUNT=1 so
|
|
# entrypoint.sh skips recursive chown on /home/sandbox/.local/share/opencode
|
|
# (which would otherwise rewrite host file ownership).
|
|
#
|
|
# Usage: enable via config.json composeOverrides[]:
|
|
# ".devcontainer/docker-compose.opencode-host.yml"
|
|
|
|
services:
|
|
sandbox:
|
|
volumes:
|
|
- ${HOST_OPENCODE_DIR:-~/.local/share/opencode}:/home/sandbox/.local/share/opencode
|
|
environment:
|
|
- OPENCODE_HOST_BIND_MOUNT=1
|