fix(automation): restore pinned OpenCode bootstrap

[seonghobae]

RCA

The hourly OpenCode commercial-development workflow fails before any repository selection or model work. pnpm@10.15.0 installs the exact opencode-ai@1.18.9 dependency but blocks dependency lifecycle scripts by default; the subsequent opencode --version boundary therefore fails because the package postinstall never materialized its platform executable.

Remedy

• add a regression contract proving only the reviewed OpenCode package is allowed to run dependency lifecycle scripts;
• allow only opencode-ai in the pnpm workspace build allowlist;
• keep the existing exact 1.18.9 package pin and all model/governance boundaries unchanged;
• deliberately do not approve the separately reported esbuild lifecycle script because this failure does not require it.

The first commit captures the failing contract before the configuration remedy. The final contract is intentionally scoped to the first failing boundary; receipt generation after an earlier bootstrap failure is a separate diagnostics hardening concern, not required to restore the executable.

Acceptance

• frozen install executes the exact pinned OpenCode postinstall without broad build-script authorization;
• commercial-development-agent tests and normal repository CI pass on the exact head;
• after merge, the protected-main OpenCode workflow reaches and passes Verify the exact OpenCode installation on a fresh run.

Summary by CodeRabbit

• 개선 사항

  • OpenCode 설치 시 필요한 빌드 및 생명주기 스크립트가 정상적으로 실행되도록 설치 구성을 조정했습니다.
  • 허용되지 않은 의존성의 설치 스크립트 실행을 방지해 설치 과정의 보안을 강화했습니다.

• 테스트

  • OpenCode 의존성 버전 형식과 설치 정책을 자동으로 검증하는 테스트를 추가했습니다.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 21 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 42a4184b-b4d1-4491-8bb5-9deb29ee9643

📥 Commits

Reviewing files that changed from the base of the PR and between e19ad54 and 7fc88a9.

📒 Files selected for processing (1)

• packages/commercial-development-agent/src/opencode-install-contract.test.mjs

📝 Walkthrough

Walkthrough

opencode-ai의 정확한 버전 형식과 설치 생명주기 스크립트 허용 설정을 검증하는 테스트를 추가했습니다. 워크스페이스는 opencode-ai만 빌드 허용 의존성으로 등록합니다.

Changes

OpenCode 설치 경계

Layer / File(s)	Summary
설치 계약 및 허용 설정 packages/commercial-development-agent/src/opencode-install-contract.test.mjs, pnpm-workspace.yaml	opencode-ai의 버전 형식과 onlyBuiltDependencies 설정을 검증합니다. 워크스페이스에 opencode-ai를 빌드 허용 목록으로 등록합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ContextualWisdomLab/life-os#122: opencode-ai 의존성 도입과 관련된 워크스페이스 빌드 허용 설정 및 경계 테스트를 추가합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 고정된 OpenCode 부트스트랩을 복원하는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/opencode-postinstall-approval

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@packages/commercial-development-agent/src/opencode-install-contract.test.mjs`:
- Around line 12-15: Update the opencode-ai version assertion in the test to
require the reviewed exact version by replacing the broad semantic-version regex
check with an exact `1.18.9` expectation.
- Around line 16-18: Update the test around the workspace configuration
assertion to parse the YAML content and compare the parsed onlyBuiltDependencies
value exactly against ['opencode-ai']. Replace the substring-based check in the
relevant test with a structured equality assertion so additional entries such as
another-package cause the test to fail.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 749fc203-9f56-455f-8bee-300e4332cfe8

📥 Commits

Reviewing files that changed from the base of the PR and between 7c3fd32 and e19ad54.

📒 Files selected for processing (2)

• packages/commercial-development-agent/src/opencode-install-contract.test.mjs
• pnpm-workspace.yaml