simonferquel/opencode2-hsp-kit:latest

schemaVersion: "2"
kind: sandbox
name: opencode2-hsp-kit
displayName: OpenCode v2 (HSP Steering)
description: HSP-capable sandbox kit for OpenCode v2 (`opencode2`) -- the harness runs entirely unmodified; HSP v1 (Harness Steering Protocol) is implemented as a pure OpenCode plugin (opencode/, this repo) reusing the same harness-agnostic server core as the sibling pi-hsp-kit. Wired up so the session declares Harness Steering Protocol (hsp/1) support. Prototype for the OpenCode Tier-2 evaluation (APT-1293, "PR 2 -- opencode-hsp plugin + opencode2 kit", superseding the earlier private-fork premise).
sandbox:
    image: docker.io/simonferquel/opencode2-hsp-base:latest
    entrypoint:
        - opencode2
    command:
        default:
            - --standalone
        interactive:
            - --standalone
agentInstructions:
    filename: AGENTS.md
permissions:
    network:
        allow:
            - api.anthropic.com
            - models.opencode.ai
            - registry.npmjs.org
            - platform.claude.com:443
credentials:
    - service: anthropic
      apiKey:
        name: ANTHROPIC_API_KEY
        proxyManaged: true
        inject:
            - domain: api.anthropic.com
              header: x-api-key
              format: '%s'
      oauth:
        tokenEndpoint:
            host: platform.claude.com
            path: /v1/oauth/token
        resourceHosts:
            - api.anthropic.com
        sentinels:
            accessToken: sk-ant-oat01-proxy-managed
            refreshToken: sk-ant-ort01-proxy-managed
        credentialFile:
            path: ~/.local/share/opencode/auth.json
            structure:
                anthropic:
                    access: '{{.AccessToken}}'
                    expires: '{{.ExpiresAt}}'
                    refresh: '{{.RefreshToken}}'
                    type: oauth
setup:
    install:
        - command: if [ -n "${HTTP_PROXY:-}" ]; then npm config set proxy="$HTTP_PROXY" https-proxy="${HTTPS_PROXY:-$HTTP_PROXY}"; fi
          user: "1000"
          description: Point npm at the sandbox proxy in ~/.npmrc so any runtime npm use works in exec contexts that do not inherit the proxy environment variables
        - command: |
            set -e
            mkdir -p "$HOME/.config/opencode"
            # See the Dockerfile: the plugin's entrypoint directory (index.ts)
            # is what a config-driven `plugins` entry must reference -- a
            # direct file path is silently rejected (verified:
            # packages/core/src/config/plugin/source.ts warns "configured
            # plugin path must be a directory" and drops a file target).
            cat > "$HOME/.config/opencode/opencode.json" <<'JSON'
            {
              "$schema": "https://opencode.ai/config.json",
              "plugins": ["/opt/opencode-hsp/opencode/src"]
            }
            JSON
          user: "1000"
          description: Write opencode.json so the HSP plugin loads on every opencode2 boot; a no-op if the file already exists with the same content on sandbox recreate
    startup:
        - command:
            - node
            - /opt/opencode-hsp/opencode/scripts/register-mcp-gateway.mjs
          user: "1000"
          description: Register the sandbox's hosted MCP gateway (when reserved) as a remote MCP server in opencode.json, without clobbering the plugins entry; no-op when no gateway is reserved