接入 AI Agent（容器环境）

#!/usr/bin/env bash
set -uo pipefail
log() { echo "[entrypoint] $*"; }

: "${HOME:=/home/appuser}"
: "${ONESUITE_PILOT_DATA_DIR:=${HOME}/.onesuite-pilot}"
OPENCODE_CONFIG_DIR="${HOME}/.config/opencode"
OPENCODE_CONFIG="${OPENCODE_CONFIG_DIR}/opencode.json"
PILOT_BIN="${HOME}/.local/bin/onesuite-pilot"
INSTALLER_URL="https://onesuite-pilot-1254077820.cos.ap-shanghai.myqcloud.com/onesuite-pilot/installer.sh"

# 1) 预置 OpenCode 配置文件
mkdir -p "${OPENCODE_CONFIG_DIR}"
[ -f "${OPENCODE_CONFIG}" ] || echo '{}' > "${OPENCODE_CONFIG}"

# 2) 安装 onesuite-pilot
install_pilot() {
  curl -fsSL --retry 3 --max-time 180 -o /tmp/installer.sh "${INSTALLER_URL}"

  local args=(
    --cls-endpoint "${ONESUITE_PILOT_CLS_ENDPOINT}"
    --cls-topic-id "${ONESUITE_PILOT_CLS_TOPIC_ID}"
    --user-id      "${ONESUITE_PILOT_USER_ID}"
    --data-dir     "${ONESUITE_PILOT_DATA_DIR}"
    # OpenCode 对应 opencode；接入其他 Agent 时替换为相应标识
    --agents opencode
    --lang en
  )
  [ -n "${ONESUITE_PILOT_USER_NAME:-}" ] && \\
    args+=(--user-name "${ONESUITE_PILOT_USER_NAME}")

  if [ -n "${ONESUITE_PILOT_CLS_SECRET_ID:-}" ]; then
    args+=(--cls-secret-id  "${ONESUITE_PILOT_CLS_SECRET_ID}")
    args+=(--cls-secret-key "${ONESUITE_PILOT_CLS_SECRET_KEY}")
  else
    args+=(--cls-uin "${ONESUITE_PILOT_CLS_UIN}")
  fi

  bash /tmp/installer.sh install "${args[@]}" 2>&1 | tail -20
  rm -f /tmp/installer.sh
}

if [ -x "${PILOT_BIN}" ]; then
  "${PILOT_BIN}" start
else
  install_pilot
fi

"${PILOT_BIN}" doctor 2>&1 | tail -10

# 3) 退出时刷出采集缓冲区
shutdown() {
  "${PILOT_BIN}" restart >/dev/null 2>&1
  sleep 3
  "${PILOT_BIN}" stop >/dev/null 2>&1
  [ -n "${OPENCODE_PID:-}" ] && kill -TERM "${OPENCODE_PID}" 2>/dev/null
  wait 2>/dev/null
  exit 0
}
trap shutdown SIGTERM SIGINT

# 4) 启动 OpenCode
log "starting opencode serve"
opencode serve --port "${AGENT_PORT:-4096}" --hostname 0.0.0.0 &
OPENCODE_PID=$!
wait "${OPENCODE_PID}"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ai-agent-<USER_ID>
  namespace: <NAMESPACE>
  labels:
    app: ai-agent
    user: "<USER_ID>"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ai-agent
      user: "<USER_ID>"
  template:
    metadata:
      labels:
        app: ai-agent
        user: "<USER_ID>"
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      terminationGracePeriodSeconds: 45
      containers:
        - name: ai-agent
          image: <AGENT_IMAGE>
          securityContext:
            readOnlyRootFilesystem: false
          ports:
            - containerPort: <AGENT_PORT>
          env:
            - name: HOME
              value: /home/appuser
            - name: ONESUITE_PILOT_DATA_DIR
              value: /home/appuser/.onesuite-pilot

            # 用户标识
            - name: ONESUITE_PILOT_USER_ID
              value: "<USER_ID>"
            - name: ONESUITE_PILOT_USER_NAME
              value: "<USER_NAME>"
            - name: ONESUITE_PILOT_SERVICE_NAME
              value: "opencode"
            - name: AGENT_PORT
              value: "<AGENT_PORT>"

            # CLS 上报目标
            - name: ONESUITE_PILOT_CLS_ENDPOINT
              value: "<CLS_ENDPOINT>"
            - name: ONESUITE_PILOT_CLS_TOPIC_ID
              value: "<CLS_TOPIC_ID>"

            # 强鉴权
            - name: ONESUITE_PILOT_CLS_SECRET_ID
              valueFrom:
                secretKeyRef: { name: cls-credential, key: secretId }
            - name: ONESUITE_PILOT_CLS_SECRET_KEY
              valueFrom:
                secretKeyRef: { name: cls-credential, key: secretKey }

            # 弱鉴权：删除上面两项，使用下面一项
            # - name: ONESUITE_PILOT_CLS_UIN
            #   value: "<CLS_UIN>"

            - name: ONESUITE_PILOT_AUTO_UPDATE_ENABLED
              value: "false"
            - name: ONESUITE_PILOT_ENABLE_STATUS_BAR_APP
              value: "false"
          lifecycle:
            preStop:
              exec:
                command:
                  - /bin/bash
                  - -c
                  - '$HOME/.local/bin/onesuite-pilot restart; sleep 8'
          readinessProbe:
            httpGet: { path: /global/health, port: <AGENT_PORT> }
            initialDelaySeconds: 20
            periodSeconds: 10
            failureThreshold: 15
          volumeMounts:
            - name: home
              mountPath: /home/appuser
          resources:
            requests: { cpu: 300m, memory: 768Mi }
            limits:   { cpu: "2",  memory: 2Gi }
      volumes:
        - name: home
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: ai-agent-<USER_ID>
  namespace: <NAMESPACE>
spec:
  type: ClusterIP
  selector:
    app: ai-agent
    user: "<USER_ID>"
  ports:
    - port: <AGENT_PORT>
      targetPort: <AGENT_PORT>

FROM <YOUR_OPENCODE_BASE_IMAGE>

USER root
RUN apt-get update && apt-get install -y --no-install-recommends \\
      curl ca-certificates \\
 && rm -rf /var/lib/apt/lists/*

ENV HOME=/home/appuser
RUN mkdir -p /home/appuser && chown -R 1000:1000 /home/appuser
USER 1000
WORKDIR /home/appuser

ENV ONESUITE_PILOT_DATA_DIR=/home/appuser/.onesuite-pilot

# 预置 OpenCode 配置文件
RUN mkdir -p $HOME/.config/opencode \\
 && echo '{}' > $HOME/.config/opencode/opencode.json

# 安装 onesuite-pilot 并注入插件
# 构建阶段使用占位值，真实凭证在运行期通过环境变量提供
# OpenCode 对应 opencode；接入其他 Agent 时替换为相应标识
ARG INSTALLER_URL=https://onesuite-pilot-1254077820.cos.ap-shanghai.myqcloud.com/onesuite-pilot/installer.sh
RUN curl -fsSL --max-time 180 -o /tmp/installer.sh "${INSTALLER_URL}" \\
 && bash /tmp/installer.sh install \\
      --cls-endpoint "placeholder.cls.tencentcs.com" \\
      --cls-topic-id "00000000-0000-0000-0000-000000000000" \\
      --cls-uin      "0" \\
      --user-id      "placeholder" \\
      --data-dir     "${ONESUITE_PILOT_DATA_DIR}" \\
      --agents opencode --lang en \\
 && rm -f /tmp/installer.sh

# 校验插件已注入
RUN grep -q "plugin.mjs" $HOME/.config/opencode/opencode.json \\
 && test -f ${ONESUITE_PILOT_DATA_DIR}/plugins/opencode/plugin.mjs

COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

kubectl -n <NAMESPACE> exec <POD> -- \\
  bash -c '$HOME/.local/bin/onesuite-pilot doctor'

POD=$(kubectl -n <NAMESPACE> get pod -l user=<USER_ID> -o jsonpath='{.items[0].metadata.name}')
kubectl -n <NAMESPACE> exec "$POD" -- \\
  bash -c '$HOME/.local/bin/onesuite-pilot doctor'

kubectl -n <NAMESPACE> exec "$POD" -- \\
  bash -c '$HOME/.local/bin/onesuite-pilot status'

kubectl -n <NAMESPACE> exec "$POD" -- \\
  cat /home/appuser/.config/opencode/opencode.json