[Show & Tell] Opencode Support and more

[verdverm]

Opening this as a PR so it is easier to share and comment on lines in a conversation. I've been porting and updating my OpenCode support to be based on a current main (eg. script based harness creation)

Looking for your feedback on what looks like something I should break out and open as a smaller, more targeted PR.

Caveat, WIP by an agent and I have not dug deeply into the port yet.

Table of contents for the change groups:

Features

1. Full OpenCode Harness Support (event bridge, hook dialect, config capabilities, heartbeat)
2. OPENCODE_API_KEY auth support across the auth pipeline
3. "none" auth type for harness authentication
4. --source CLI flag for git source commit-ish for agent workspaces
5. Default branch detection via git ls-remote --symref in the Hub
6. manifest.json written to object storage during resource bootstrap
7. Harness config sync status display with content hash comparison
8. manifest.json upload to signed URL during harness-config sync
9. --force-harness-configs server flag and RefreshDefaultTemplates
10. disable_local_auth settings field for broker-like auth skipping
11. Docker network mode configuration via settings.yaml
12. scion exec command for in-container command execution
13. WebSocket MaxMessageSize increase from 64KB to 10MB
14. Hub session-end assistant_text forwarding as outbound message
15. internal/testgit test helper with macOS keychain suppression
16. opencode.jsonc support in config mapping and provisioning
17. New scripts (buildkitd.toml, server startup, docker proxy, test specs)

Bugfixes (?)

1. Restored missing StageCaptureAuthAssets call in provision.go
2. Shebang portability fix in 3 image-build shell scripts
3. Inline config Source field not propagated in CLI paths
4. Redundant GIT_ASKPASS=echo env var removed
5. AuthSelectedType fallback to Auth.DefaultType when empty
6. Consolidated duplicate default-branch logic in agent creation
7. Resource validation produces aggregate summaries instead of per-file noise
8. Server startup no longer clobbers user harness-config customizations

[gemini-code-assist]

Code Review

This pull request introduces a new opencode harness dialect and integration, including a JavaScript plugin to bridge OpenCode events to Scion's hook/status system. It also adds a new exec command to run commands inside agent containers, supports a --source flag for specifying workspace base commits, introduces a none authentication method, and adds Docker-specific network settings. Feedback on these changes highlights several critical issues: a regex bug in provision.py that can corrupt JSON strings containing comment-like sequences, a timeout unit mismatch and inefficient temp file usage in scion-plugin.js, a parsing mismatch for _scion_heartbeat in opencode.go, and unsafe byte-slicing of UTF-8 strings in hub.go that could lead to invalid characters.

[gemini-code-assist]

The current regular expression replacement in _strip_jsonc_comments will incorrectly strip comments inside JSON strings (such as URLs containing // or text containing /*). This will corrupt valid JSONC files and cause json.JSONDecodeError during parsing.

To fix this, use a regular expression that matches and preserves double-quoted strings while matching and removing comments.

Suggested change

	def _strip_jsonc_comments(text: str) -> str:
	"""Strip // and /* */ comments from JSONC text for json.loads parsing."""
	import re
	text = re.sub(r"//.*$", "", text, flags=re.MULTILINE)
	text = re.sub(r"/\*.*?\*/", "", text, flags=re.DOTALL)
	return text
	def _strip_jsonc_comments(text: str) -> str:
	"""Strip // and /* */ comments from JSONC text for json.loads parsing."""
	import re
	pattern = r'("(?:\\.|[^"\\])*")|(/\*.*?\*/)|(//.*$)'
	def replace(match):
	if match.group(1):
	return match.group(1)
	return ""
	return re.sub(pattern, replace, text, flags=re.MULTILINE | re.DOTALL)

[verdverm]

we should use a proper jsonc parser package, not hand write this kind of thing

[gemini-code-assist]

There are two issues with the current hook execution:

1. Incorrect Timeout Unit: The timeout command expects the duration in seconds, but String(HOOK_TIMEOUT_MS) passes 5000, which means timeout will wait for 5000 seconds (nearly 1.4 hours) instead of 5 seconds.
2. Unnecessary Temp File: Writing the payload to a temporary file and using sh -c with cat and rm is inefficient and can leave orphaned temp files if the process is terminated.

Instead, you can spawn the process directly and write the payload to its stdin stream. This is cleaner, more secure, and avoids disk I/O.

    const { spawn } = await import("child_process")
    const child = spawn("timeout", [String(HOOK_TIMEOUT_MS / 1000), "sciontool", "hook", "--dialect=opencode"], {
      stdio: ["pipe", "ignore", "ignore"]
    })
    child.on("error", (err) => {
      client.app.log({
        body: {
          service: "scion-plugin",
          level: "error",
          message: "scion hook failed: " + name,
          extra: { error: String(err)?.message || String(err), name: name },
        },
      }).catch(() => {})
    })
    child.stdin.on("error", () => {})
    child.stdin.write(payload)
    child.stdin.end()

[gemini-code-assist]

There is a mismatch between how _scion_heartbeat is sent by the plugin and how it is parsed by the dialect:

1. In scion-plugin.js, _scion_heartbeat is passed inside the nested data object (which becomes payload in the Go parser).
2. In opencode.go, the parser checks the top-level data map instead of payload for _scion_heartbeat.

This causes heartbeats to never be detected in production, which means they won't be skipped by the limits handler. To fix this, check payload (or both data and payload) for _scion_heartbeat.

	isHB, _ := payload["_scion_heartbeat"].(bool)
	if !isHB {
		isHB, _ = data["_scion_heartbeat"].(bool)
	}
	if isHB {
		if event.Data.Raw == nil {
			event.Data.Raw = make(map[string]interface{})
		}
		event.Data.Raw["_scion_heartbeat"] = true
	}

[gemini-code-assist]

Slicing a Go string directly by bytes (e.g., text[:maxAssistantTextBytes]) can cut a multi-byte UTF-8 character in half, resulting in an invalid UTF-8 string. This can cause JSON marshalling errors or rendering issues downstream.

To prevent this, ensure the truncation boundary aligns with a valid UTF-8 rune boundary.

		if event.Data.AssistantText != "" {
			text := event.Data.AssistantText
			const maxAssistantTextBytes = 64 * 1024
			if len(text) > maxAssistantTextBytes {
				// Safely truncate to a valid UTF-8 boundary
				i := maxAssistantTextBytes
				for i > 0 && !utf8.ValidString(text[:i]) {
					i--
				}
				text = text[:i] + "\n[truncated]"
			}

[ptone]

So (obviously) super happy to have agent based contributions - if open code is your daily driver it can be a huge help just to exercise the usage. Fundamentally - as I hope you can see/understand is that scion defines an abstraction around an agent, and the harness-config system projects that into the details of a particular harness. The original implmentation a few months ago had all of this very tightly coupled, then the second iteration separated harness from template, but the harnesses were still hard-coded in the core packages - this is now a time to make it much easier to ship support and maintenance for harnesses outside of the core package.

#613 - which should hopefully be landing soon - will hopefully make the process of fully supporting opencode easier. See if you want to take a crack at having your agent rework some of these features to lean on the new common support file. Honestly what is a huge help is still what I find to be the bottleneck which is the type of QA testing (like harness auth logins) that are harder to fully automate.

Thanks for your involvement.