From c14c56147deb3f266f74eff418f89ccca04508a6 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Tue, 8 Sep 2026 16:53:20 +0000 Subject: [PATCH] launchers: the opencode UI is oc.ci.commoninternet.net (not tailnet-only); journal the key switch Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz --- cc-ci-plan/JOURNAL.md | 29 +++++++++++++++++++++++++++++ cc-ci-plan/launch-assistant.py | 2 +- cc-ci-plan/launch-orchestrator.py | 4 ++-- cc-ci-plan/launch.py | 2 +- 4 files changed, 33 insertions(+), 4 deletions(-) diff --git a/cc-ci-plan/JOURNAL.md b/cc-ci-plan/JOURNAL.md index 22910bc..b14387a 100644 --- a/cc-ci-plan/JOURNAL.md +++ b/cc-ci-plan/JOURNAL.md @@ -1101,3 +1101,32 @@ generation and restores the lock. One-line outcome in `.cc-ci-logs/auto-update-s generation, front doors (oc.ci must be 401), sops, fail2ban, all four timers, the orchestrator agent session, and a secrets-inventory check that flags sprawl. Verdict updated. Verified against the box: 0 failed units, 10/10 swarm services, disk 33%, all timers armed. + +## 2026-09-08 16:55 UTC — cc-ci host moved to the operator's OpenCode **Go** key; extra credentials purged + +**The key.** `AUTONOMIC_OPENCODE_KEY` (operator, in `/secrets/files/cc-ci.testenv`) is an OpenCode +**Go subscription** key, not a ZEN one. Installed into the ZEN slot it authenticates but every +request dies `Insufficient balance` (ZEN = pay-as-you-go credit); on the `opencode-go` endpoint the +same key answers immediately. Diagnosis was the operator's — worth remembering as the first thing +to check when an opencode key "does not work". + +- `auth.json` (→ `/secrets/files/opencode-auth.json`) now holds **exactly one** provider, + `opencode-go`, carrying that key. The previous ZEN key is deleted; `opencode/glm-5.2` now errors. +- `agents.toml` orchestrator → `opencode-go/glm-5.2`; `upgrader.env` → `LOOP_TIER=go` and + LOOP/REPORT/SUPERVISOR models all `opencode-go/glm-5.2`; cc-ci PR #36 moved the subagent model in + `cc-ci/opencode.json` the same way. +- **Model note:** `opencode-go/deepseek-v4-flash` (what the weekly run used on ZEN) is China-hosted + on the Go tier and returns an opt-in error until the operator enables it at + `https://opencode.ai/workspace/wrk_01M20RVAY3D3B28XAYY1Z2Q6AZ/go`. `glm-5.2` is used meanwhile. +- Verified: `opencode-go/glm-5.2` answers, the orchestrator agent restarted on it, ZEN gone. + +**Purged while there** (same "only what cc-ci strictly needs" rule): `auth.json` had also carried +`openai` (oauth), `opencode-go` (old) and `infomaniak` credentials copied from the notplants box, +and `~/.config/opencode/opencode.jsonc` carried a **Tinfoil API key inline in plaintext**. All +removed; the config is now a 4-line file with no `apiKey` anywhere. That Tinfoil key still lives in +the notplants-orchestrator config it came from — **operator: consider rotating it**, since it was +briefly present on a second host. + +**Also:** `vim`/`vi` (absent, the operator hit it over ssh), `sqlite`, `bat`, `bc`, `moreutils`, +`pv`, `man-pages` added to the host toolbox with `EDITOR=vim`; on PATH for root and loops. +Stale `oc.commoninternet.net` URLs in the launchers → `oc.ci.commoninternet.net`. diff --git a/cc-ci-plan/launch-assistant.py b/cc-ci-plan/launch-assistant.py index b3cdad6..01ae2d9 100644 --- a/cc-ci-plan/launch-assistant.py +++ b/cc-ci-plan/launch-assistant.py @@ -116,7 +116,7 @@ def start(mode="resume"): f"NO_COLOR=1 {OPENCODE_BIN} attach {OPENCODE_SERVER} --dir {WORKDIR}" ) log(f"starting {SESSION} (backend=opencode, model={LOOP_MODEL or 'default'})") - log(" visible at http://oc.commoninternet.net (tailnet only)") + log(" visible at https://oc.ci.commoninternet.net") else: die(f"unknown LOOP_BACKEND '{BACKEND}' — use 'claude' or 'opencode'") diff --git a/cc-ci-plan/launch-orchestrator.py b/cc-ci-plan/launch-orchestrator.py index 7ecb983..d38c2f0 100644 --- a/cc-ci-plan/launch-orchestrator.py +++ b/cc-ci-plan/launch-orchestrator.py @@ -158,7 +158,7 @@ def start(mode="resume"): f"{model_env}NO_COLOR=1 {OPENCODE_BIN} attach {OPENCODE_SERVER} --dir {shlex.quote(WORKDIR)}" ) log(f"starting {SESSION} (backend=opencode, model={LOOP_MODEL or 'default'})") - log(f" visible at http://oc.commoninternet.net (tailnet only)") + log(f" visible at https://oc.ci.commoninternet.net") else: die(f"unknown LOOP_BACKEND '{BACKEND}' — use 'claude' or 'opencode'") @@ -212,7 +212,7 @@ def main(): else: backend_note = ( "claude: --resume preserves conversation across reboots; viewable at claude.ai/code\n" - " opencode: fresh session each launch (no --resume); viewable at http://oc.commoninternet.net" + " opencode: fresh session each launch (no --resume); viewable at https://oc.ci.commoninternet.net" ) print(f"""cc-ci orchestrator launcher diff --git a/cc-ci-plan/launch.py b/cc-ci-plan/launch.py index 9731add..8b79886 100644 --- a/cc-ci-plan/launch.py +++ b/cc-ci-plan/launch.py @@ -327,7 +327,7 @@ def start_agent(role, session, workdir): f"NO_COLOR=1 {OPENCODE_BIN} attach {OPENCODE_SERVER} --dir {session_cwd}" ) log(f"starting {session} (backend=opencode, phase={pid}, model={model or 'default'})") - log(f" visible at http://oc.commoninternet.net (tailnet only)") + log(f" visible at https://oc.ci.commoninternet.net") else: die(f"unknown BACKEND '{BACKEND}' — set LOOP_BACKEND=claude or LOOP_BACKEND=opencode")