orchestrator-host: weekly opencode auto-upgrade (latest-release check, reinstall, restart web) #29

2026-10-05T18:40:07Z

autonomic-bot commented

2026-10-05 18:40:07 +00:00

What changed

nix/modules/orchestrator-host.nix gains opencode-upgrade.service + opencode-upgrade.timer:

Weekly (Tue 02:00 UTC, randomized +/-10min — one hour before the host auto-update at Tue 03:00 UTC, clear of the Thu recipe-upgrade run and the Sunday sweep).
Compares the installed opencode version against the latest GitHub release; no-op when equal.
On difference: reinstalls via the official installer (same code path as boot-time opencode-install), re-links ~/.local/bin/opencode, verifies the reported version matches, then restarts opencode-web so the new binary takes effect, and verifies the UI answers its 401 auth challenge.
Replicates auto-update.nix's busy gate (CI run in flight / nightly sweep / cc-ci-upgrader / cc-ci-report tmux / running Drone builds): busy -> skip, retry next week — so a restart never cuts live agent work.
Per-run outcome appended to .cc-ci-logs/opencode-update-state for /cc-ci-status.

Why

opencode-install only installs when the binary is missing, so the CLI aged in place — it sat on 1.18.29 (Sep 4) while 1.18.33+ was out. opencode's built-in autoupdate doesn't cover this host: it auto-applies patch releases only, and only fires on a fresh interactive TUI start, while every agent here runs inside the long-lived opencode serve. The 2026-09-24 Datadog disclosure (GHSA-632h-h47v-g4x4, RCE in 1.14.30–1.18.21) underlined why a stale CLI is a security liability, not just a freshness one.

Evidence it works

nix eval of nixosConfigurations.cc-ci.config.system.build.toplevel succeeds with the change.
Version detection verified against the live GitHub API: installed 1.18.29, latest parses to 1.18.34 -> the first scheduled run (Tue 2026-10-06 02:00 UTC) will upgrade.
systemd-analyze calendar "Tue *-*-* 02:00:00 UTC" -> next elapse Tue 2026-10-06 02:00:00 UTC.
Deployed via nixos-rebuild test (bootloader untouched) + host health checks, then merged; timer verified active on the host.

Deliberate operator decisions (2026-10-05)

Auto-restart of opencode-web is wanted: without it the new binary never takes effect; attached sessions drop and their supervisors resume — hence the busy gate.
No immediate bump: the upgrade logic is timer-only, so merging/deploying this PR does not bump the CLI today; the first bump happens at the scheduled slot.

## What changed `nix/modules/orchestrator-host.nix` gains `opencode-upgrade.service` + `opencode-upgrade.timer`: - **Weekly** (Tue 02:00 UTC, randomized +/-10min — one hour *before* the host auto-update at Tue 03:00 UTC, clear of the Thu recipe-upgrade run and the Sunday sweep). - Compares the installed opencode version against the latest GitHub release; no-op when equal. - On difference: reinstalls via the official installer (same code path as boot-time `opencode-install`), re-links `~/.local/bin/opencode`, verifies the reported version matches, then **restarts `opencode-web`** so the new binary takes effect, and verifies the UI answers its 401 auth challenge. - Replicates `auto-update.nix`'s **busy gate** (CI run in flight / nightly sweep / `cc-ci-upgrader` / `cc-ci-report` tmux / running Drone builds): busy -> skip, retry next week — so a restart never cuts live agent work. - Per-run outcome appended to `.cc-ci-logs/opencode-update-state` for `/cc-ci-status`. ## Why `opencode-install` only installs when the binary is *missing*, so the CLI aged in place — it sat on 1.18.29 (Sep 4) while 1.18.33+ was out. opencode's built-in `autoupdate` doesn't cover this host: it auto-applies patch releases only, and only fires on a fresh interactive TUI start, while every agent here runs inside the long-lived `opencode serve`. The 2026-09-24 Datadog disclosure (GHSA-632h-h47v-g4x4, RCE in 1.14.30–1.18.21) underlined why a stale CLI is a security liability, not just a freshness one. ## Evidence it works - `nix eval` of `nixosConfigurations.cc-ci.config.system.build.toplevel` succeeds with the change. - Version detection verified against the live GitHub API: installed `1.18.29`, latest parses to `1.18.34` -> the first scheduled run (Tue 2026-10-06 02:00 UTC) will upgrade. - `systemd-analyze calendar "Tue *-*-* 02:00:00 UTC"` -> next elapse Tue 2026-10-06 02:00:00 UTC. - Deployed via `nixos-rebuild test` (bootloader untouched) + host health checks, then merged; timer verified active on the host. ## Deliberate operator decisions (2026-10-05) - **Auto-restart of opencode-web is wanted**: without it the new binary never takes effect; attached sessions drop and their supervisors resume — hence the busy gate. - **No immediate bump**: the upgrade logic is timer-only, so merging/deploying this PR does not bump the CLI today; the first bump happens at the scheduled slot.

autonomic-bot added 1 commit 2026-10-05 18:40:08 +00:00

orchestrator-host: weekly opencode auto-upgrade (latest-release check, reinstall, restart web) 88e5a93f94

opencode-install only installs when the binary is missing, so the standalone
CLI aged in place (1.18.29 for weeks while 1.18.33+ was out); opencode's
built-in autoupdate never fires here because every agent runs inside the
long-lived opencode serve. New opencode-upgrade.service + weekly timer
(Tue 02:00 UTC, an hour before the host auto-update) compares the installed
version with the latest GitHub release, reinstalls via the official
installer when they differ, restarts opencode-web so the new binary takes
effect, and verifies the UI answers its 401 challenge. The auto-update.nix
busy gate is replicated so a mid-flight CI run / weekly upgrade / sweep is
never cut (skipped runs retry next week). Deploying this module does not
itself bump opencode: boot installs stay install-if-missing and the upgrade
is timer-driven only. State per run: .cc-ci-logs/opencode-update-state.

autonomic-bot merged commit 4a043b12ca into main

2026-10-05 18:40:32 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci-orchestrator#29