opencode-web-runtime

name	opencode-web-runtime
description	Build and maintain the runtime layer for opencode_web_yolo. Use when implementing or changing wrapper CLI behavior, Docker image/runtime entrypoint, mandatory authentication checks, workspace/config/data mounts, -gh integration, --mount-ssh behavior, dry-run output, or health/diagnostics commands.

Runtime Scope

Implement runtime behavior in:

• .opencode_web_yolo.sh
• .opencode_web_yolo.Dockerfile
• .opencode_web_yolo_entrypoint.sh
• .opencode_web_yolo_config.sh (if used)

Follow TECHNICAL.md as the source of truth.

References

Load only the file that matches the active task:

• Read references/runtime-checklist.md when implementing or reviewing end-to-end runtime behavior.
• Read references/flag-contracts.md when adding/changing CLI flags or pass-through parsing.
• Read references/mounts-and-security.md when touching mounts, auth checks, or warning text.

Required Contracts

Enforce these contracts on every runtime change:

• Require OPENCODE_SERVER_PASSWORD; fail fast when empty or unset.
• Publish local-only by default: -p 127.0.0.1:${OPENCODE_WEB_PORT}:${OPENCODE_WEB_PORT}.
• Run OpenCode Web with host 0.0.0.0 and configured port unless explicitly overridden.
• Install and expose gh, git, and SSH client binaries inside the image.
• Persist both OpenCode config and state directories across restarts.
• Show explicit warnings before enabling sensitive mounts (-gh, --mount-ssh).