feat(agent): migrate OpenCode 2 runtime and sandbox tools

Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore
session-scoped learning, credential renewal, typed project queries and
controlled frontend actions from the legacy Agent.

Replace host Shell execution with an approved Landlock/seccomp executor
and persistent per-session workspaces. Add typed Bocha search and Tianditu
geocoding bridges using the owning session credential. Require a working
kernel sandbox before startup and persist workspace files in deployments.

Validation completed before this commit: TypeScript checks, 150 Bun tests,
Docker build and UID 10001 sandbox execution, native Shell approval and
session recovery. Tianditu succeeded; Bocha currently reports exhausted
account quota. Unrelated investigation-report contract work is excluded.

This commit is contained in:

jiang

2026-10-08 15:46:37 +08:00

parent 1a9b0cafc1

commit 7383ed6d13

93 changed files with 8065 additions and 1098 deletions

									
										entrypoint.sh
									
		+1
		-1
	
												View File
												
				@@ -2,6 +2,6 @@

				set -e

				# 直接启动 TJWaterAgent

				# SDK 会根据 src/runtime/opencode.ts 中的逻辑自动管理 opencode 实例

				# src/runtime/opencode.ts 负责启动和关闭私有 opencode2 实例

				echo "Starting TJWaterAgent..."

				exec bun run start