chore: upgrade opencode to 2.0.29 and openchamber to 2.3.2

Dockerfile

@@ -25,8 +25,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/* \
     && ln -s /usr/bin/fdfind /usr/local/bin/fd
 
-ARG OPENCODE_VERSION=2.0.27
-ARG OPENCHAMBER_VERSION=2.2.0
+ARG OPENCODE_VERSION=2.0.29
+ARG OPENCHAMBER_VERSION=2.3.2
 ARG TYPESCRIPT_VERSION=7.0.2
 ARG PNPM_VERSION=12.11.2
 ARG TARGETARCH

README.md

@@ -75,7 +75,7 @@ Grafana and Karakeep can connect before their credentials are validated; check a
 - **Build** is the default agent and can use all configured tools. **General** can implement and test; **Explore** is read-only. Both subagents may use Context7 but deny Grafana, Lunch Money, Karakeep, Notion, Robinhood, and further delegation. Build and General ask before `rm` commands whose text contains `.config`, `.local`, `HOME`, `~`, or `/data/.`, or ends in `/data`. Tool permissions do not sandbox shell access.
 - [Superpowers](https://github.com/obra/superpowers) supplies planning, debugging, testing, and review skills. The image also ships [`commit-push-pr` and `go-repo`](skills/). [`AGENTS.md`](AGENTS.md) requires repository edits in `/data/workspace/.worktrees/<repository>/<task>`.
 - [OpenCode Quota](https://github.com/slkiser/opencode-quota) provides `/quota` and `/quota_status`.
-- Defaults and pinned plugins live in [`opencode.jsonc`](opencode.jsonc). The image converts it to `/etc/opencode/opencode.json`; project `opencode.json(c)` files can override settings. See the [V2 configuration guide](https://opencode.ai/v2/docs/config).
+- Defaults and pinned plugins live in [`opencode.jsonc`](opencode.jsonc). The image converts it to `/etc/opencode/opencode.json`, which overrides matching settings in global and project `opencode.json(c)` files. See the [V2 configuration guide](https://opencode.ai/v2/docs/config).
 - Each startup copies the image's [`AGENTS.md`](AGENTS.md) to `/data/.config/opencode/AGENTS.md`, replacing local edits. Change instructions in this repository and rebuild.
 
 To replace the image defaults, install dependencies, edit `opencode.jsonc`, run `node scripts/build-config.mjs runtime.json`, and mount the output read-only at `/etc/opencode/opencode.json`. Restart the container after replacing it.

opencode.jsonc

@@ -128,23 +128,21 @@
     "superpowers@git+https://github.com/obra/superpowers.git#bb92a77741419a4ab5f06e711a283343f1ada0c3",
     "@slkiser/opencode-quota@5.0.2"
   ],
-  "experimental": {
-    "policies": [
-      {
-        "action": "provider.use",
-        "resource": "*",
-        "effect": "deny"
-      },
-      {
-        "action": "provider.use",
-        "resource": "google",
-        "effect": "allow"
-      },
-      {
-        "action": "provider.use",
-        "resource": "github-copilot",
-        "effect": "allow"
-      }
-    ]
-  }
+  "policies": [
+    {
+      "action": "provider.use",
+      "resource": "*",
+      "effect": "deny"
+    },
+    {
+      "action": "provider.use",
+      "resource": "google",
+      "effect": "allow"
+    },
+    {
+      "action": "provider.use",
+      "resource": "github-copilot",
+      "effect": "allow"
+    }
+  ]
 }

package.json

@@ -7,9 +7,9 @@
     "test": "node --test tests/*.test.mjs"
   },
   "devDependencies": {
-    "@opencode/plugin": "2.0.27",
-    "@opencode/schema": "2.0.27",
-    "effect": "4.0.2",
+    "@opencode/plugin": "2.0.29",
+    "@opencode/schema": "2.0.29",
+    "effect": "4.0.4",
     "jsonc-parser": "3.3.1"
   }
 }

pnpm-workspace.yaml

@@ -1,21 +1,23 @@
 minimumReleaseAgeStrict: true
 minimumReleaseAgeExclude:
-  - '@opencode/ai@2.0.27'
-  - '@opencode/cli-darwin-arm64@2.0.27'
-  - '@opencode/cli-darwin-x64-baseline@2.0.27'
-  - '@opencode/cli-darwin-x64@2.0.27'
-  - '@opencode/cli-linux-arm64-musl@2.0.27'
-  - '@opencode/cli-linux-arm64@2.0.27'
-  - '@opencode/cli-linux-x64-baseline-musl@2.0.27'
-  - '@opencode/cli-linux-x64-baseline@2.0.27'
-  - '@opencode/cli-linux-x64-musl@2.0.27'
-  - '@opencode/cli-linux-x64@2.0.27'
-  - '@opencode/cli-windows-arm64@2.0.27'
-  - '@opencode/cli-windows-x64-baseline@2.0.27'
-  - '@opencode/cli-windows-x64@2.0.27'
-  - '@opencode/cli@2.0.27'
-  - '@opencode/client@2.0.27'
-  - '@opencode/plugin@2.0.27'
-  - '@opencode/protocol@2.0.27'
-  - '@opencode/schema@2.0.27'
-  - '@opencode/util@2.0.27'
+  - '@openchamber/sdk@2.3.2'
+  - '@openchamber/web@2.3.2'
+  - '@opencode/ai@2.0.29'
+  - '@opencode/cli-darwin-arm64@2.0.29'
+  - '@opencode/cli-darwin-x64-baseline@2.0.29'
+  - '@opencode/cli-darwin-x64@2.0.29'
+  - '@opencode/cli-linux-arm64-musl@2.0.29'
+  - '@opencode/cli-linux-arm64@2.0.29'
+  - '@opencode/cli-linux-x64-baseline-musl@2.0.29'
+  - '@opencode/cli-linux-x64-baseline@2.0.29'
+  - '@opencode/cli-linux-x64-musl@2.0.29'
+  - '@opencode/cli-linux-x64@2.0.29'
+  - '@opencode/cli-windows-arm64@2.0.29'
+  - '@opencode/cli-windows-x64-baseline@2.0.29'
+  - '@opencode/cli-windows-x64@2.0.29'
+  - '@opencode/cli@2.0.29'
+  - '@opencode/client@2.0.29'
+  - '@opencode/plugin@2.0.29'
+  - '@opencode/protocol@2.0.29'
+  - '@opencode/schema@2.0.29'
+  - '@opencode/util@2.0.29'

scripts/test-router-integration.mjs

@@ -132,6 +132,9 @@ try {
       assert.ok(data.some(server => server.name === name), `missing ${name}`);
     return true;
   });
+  // Without credentials, a dropped provider policy shows up as OpenCode's free models.
+  const models = (await request("/api/model")).data;
+  assert.ok(models.every(m => ["google", "github-copilot"].includes(m.providerID)), `policies hide other providers' models: ${models.map(m => m.providerID)}`);
   session = (await request("/api/session", { title: "V2 integration test", agent: "build",
     location: { directory } })).data;
   await request(`/api/session/${session.id}/command`, { name: "quota_announcements", text: "" });