mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
Renn F
07f55117de
- pricing.py: add grok-build-0.1 rates ($1/1M input, $0.20 cached, $2/1M output), verified against xAI's published pricing. Grok is a priced non-Anthropic model, so cost computes the moment usage is captured. - secret-scrub.js: an opencode tool.execute.before plugin porting the security-critical bash-guard deny rules (git network ops, credential-file reads, /proc env, internal-host HTTP, roboco.* imports, ROBOCO_AGENT_ID forgery, env dumps, destructive rm) to the opencode runtime — restoring the guard the Claude Code hook can't provide there. Throwing denies the call (confirmed by opencode's env-protection example). Wired into the generated opencode.json plugin array + baked into the grok image. Deny logic verified via node (9 deny + 5 allow cases). UNVALIDATED against a live opencode runtime: confirm it fires in the live E2E spawn before a Grok dev-agent touches a real repo; the bash permission is operator-tunable as a second gate. Cost CAPTURE (distinct from pricing) is intentionally NOT built yet: opencode's plugin hooks expose model info but no token/usage object, so the capture path is unconfirmed and needs the live spawn to settle.
37 lines
1.7 KiB
Docker
37 lines
1.7 KiB
Docker
# Grok (xAI) Agent Image
|
|
# =============================================================================
|
|
# Runs grok-build-0.1 through the opencode CLI (OpenAI protocol) instead of
|
|
# Claude Code, while reusing the base image's roboco venv + uv + the RoboCo MCP
|
|
# gateway servers. The entrypoint renders opencode.json from the spawn env +
|
|
# mounted mcp-config.json (see roboco.llm.providers.opencode_config) and runs
|
|
# opencode. One runtime image serves every role — role behaviour comes from the
|
|
# mounted system prompt / manifest / mcp-config, exactly as on the Claude path.
|
|
# =============================================================================
|
|
|
|
FROM roboco-agent-base
|
|
|
|
USER root
|
|
|
|
# opencode — the OpenAI-protocol agent runtime. The @ai-sdk/openai-compatible
|
|
# package backs the custom xAI provider declared in the generated opencode.json;
|
|
# opencode also resolves it at runtime, but pre-installing keeps first spawn off
|
|
# the network.
|
|
RUN npm install -g opencode-ai @ai-sdk/openai-compatible \
|
|
&& npm cache clean --force \
|
|
&& rm -rf /root/.npm /tmp/*
|
|
|
|
# Command guard / secret-scrub plugin (bash-guard parity for the opencode runtime).
|
|
# Referenced from the generated opencode.json `plugin:` array.
|
|
COPY docker/grok/secret-scrub.js /app/opencode-plugins/secret-scrub.js
|
|
|
|
# Entrypoint: render opencode.json, then run opencode (overrides base's `claude`).
|
|
COPY docker/scripts/grok-agent-entrypoint.sh /app/scripts/grok-agent-entrypoint.sh
|
|
RUN chmod 0755 /app/scripts/grok-agent-entrypoint.sh
|
|
|
|
USER agent
|
|
|
|
LABEL role="grok-runtime"
|
|
LABEL description="Grok (xAI) agent runtime — grok-build-0.1 via opencode (OpenAI protocol)"
|
|
|
|
ENTRYPOINT ["/app/scripts/grok-agent-entrypoint.sh"]
|