chop3766/private-opencode:latest

schemaVersion: "2"
kind: sandbox
name: private-opencode
version: 1.0.1
displayName: Private OpenCode
description: Private OpenCode kit with Abliterated and HuggingFace providers pre-baked into opencode.json.
sandbox:
    image: docker.io/sbx/opencode-image:latest
    entrypoint:
        - opencode
agentInstructions:
    filename: AGENTS.md
permissions:
    network:
        allow:
            - api.abliteration.ai
            - router.huggingface.co
            - huggingface.co
            - registry.npmjs.org
            - opencode.ai
            - '*.opencode.ai'
            - '**.githubusercontent.com'
            - codeload.github.com
            - github.com
            - archive.ubuntu.com
            - security.ubuntu.com
            - ports.ubuntu.com
            - download.docker.com
credentials:
    - service: abliterated
      apiKey:
        name: ABLITERATED_API_KEY
        proxyManaged: true
        inject:
            - domain: api.abliteration.ai
              header: Authorization
              format: Bearer %s
    - service: huggingface
      apiKey:
        name: HUGGINGFACE_API_KEY
        proxyManaged: true
        inject:
            - domain: router.huggingface.co
              header: Authorization
              format: Bearer %s
setup:
    startup:
        - command:
            - sh
            - -c
            - |
              set -e
              umask 077
              mkdir -p "$HOME/.config/opencode"
              cat > "$HOME/.config/opencode/opencode.json" <<EOF
              {
                "\$schema": "https://opencode.ai/config.json",
                "model": "huggingface/zai-org/GLM-4.7",
                "provider": {
                  "abliterated": {
                    "npm": "@ai-sdk/openai-compatible",
                    "name": "Abliterated",
                    "options": {
                      "baseURL": "https://api.abliteration.ai/v1",
                      "apiKey": "${ABLITERATED_API_KEY}"
                    },
                    "models": {
                      "abliterated-model-large-v2": {
                        "name": "Abliterated Large v2"
                      },
                      "abliterated-model-large": {
                        "name": "Abliterated Large"
                      },
                      "abliterated-model": {
                        "name": "Abliterated Model"
                      }
                    }
                  },
                  "huggingface": {
                    "npm": "@ai-sdk/openai-compatible",
                    "name": "HuggingFace",
                    "options": {
                      "baseURL": "https://router.huggingface.co/v1",
                      "apiKey": "${HUGGINGFACE_API_KEY}"
                    },
                    "models": {
                      "zai-org/GLM-4.7": {
                        "name": "GLM-4.7 (HuggingFace)"
                      }
                    }
                  }
                }
              }
              EOF
              if [ -n "$MCP_GATEWAY_URL" ] && command -v jq >/dev/null 2>&1; then
                tmp=$(mktemp)
                jq --arg url "$MCP_GATEWAY_URL" --arg tok "$MCP_SENTINEL_TOKEN_NAME" \
                  '. + {mcp: {"mcp-gateway": {type: "remote", url: $url, enabled: true, headers: {Authorization: "Bearer " + $tok}}}}' \
                  "$HOME/.config/opencode/opencode.json" > "$tmp" \
                  && mv -f "$tmp" "$HOME/.config/opencode/opencode.json"
              fi
          user: agent
          description: Write opencode.json with Abliterated and HuggingFace providers
        - command:
            - sh
            - -c
            - '{ command -v apt-get && apt-get update -qq -y || true; } >/dev/null 2>&1 </dev/null &'
          user: root
          description: Update apt package cache in background