feat: Add AIOps Agent with baked-agents pattern

[tryweb]

Summary

Add a pre-installed AIOps agent to ai-engkit following the existing baked-skills pattern for consistent architecture.

Background

Based on OpenCode's permissions policy (https://opencode.ai/docs/permissions/), ai-engkit needs to provide AIOps functionality through a custom agent with fine-grained permission control.

Requirements

1. Remote Operations: SSH access to query and configure remote hosts
2. Knowledge Base Maintenance: Document findings in docs/knowledge/
3. Maintenance Records: Generate reports in docs/maintenance/
4. lean-ctx Integration: Full access to lean-ctx tools for code exploration

Permission Design

{
  "agent": {
    "aiops": {
      "permission": {
        "bash": {
          "*": "ask",
          "ssh *": "allow",
          "kubectl *": "allow",
          "docker *": "allow",
          "helm *": "allow",
          "systemctl *": "allow"
        },
        "edit": {
          "*": "deny",
          "docs/knowledge/**": "allow",
          "docs/maintenance/**": "allow",
          "docs/CHANGELOG.md": "allow"
        },
        "lean-ctx_*": "allow"
      }
    }
  }
}

Architecture

Follow the existing baked-skills pattern:

Current baked-skills pattern

Dockerfile:
COPY .opencode/baked-skills /opt/opencode/baked-skills

entrypoint.d/02-init-config.sh:
for skill_dir in /opt/opencode/baked-skills/*/; do
  ln -sf "$skill_dir" "$SKILLS_ROOT/$(basename $skill_dir)"
done

Proposed baked-agents pattern

Dockerfile:
COPY .opencode/baked-agents /opt/opencode/baked-agents
RUN chown -R ${USERNAME}:${USERNAME} /opt/opencode/baked-agents

entrypoint.d/07-init-baked-agents.sh:
for agent_dir in /opt/opencode/baked-agents/*/; do
  ln -sf "$agent_dir" "$AGENTS_ROOT/$(basename $agent_dir)"
done

Implementation Plan

Step 1: Create agent definition

.opencode/baked-agents/aiops/aiops.md:

---
description: AIOps monitoring, incident response, and knowledge base maintenance
mode: subagent
hidden: false
temperature: 0.15
permission:
  bash:
    "*": "ask"
    "ssh *": "allow"
    "kubectl *": "allow"
    "docker *": "allow"
    "helm *": "allow"
    "systemctl *": "allow"
    "tail *": "allow"
    "grep *": "allow"
    "cat *": "allow"
  edit:
    "*": "deny"
    "docs/knowledge/**": "allow"
    "docs/maintenance/**": "allow"
    "docs/CHANGELOG.md": "allow"
  lean-ctx_*: "allow"
  webfetch: "allow"
---

# AIOps Agent

You are an AIOps specialist for ai-engkit.

## Responsibilities
- Infrastructure monitoring and alerting via SSH
- Log analysis and anomaly detection
- Incident response automation
- Knowledge base maintenance (docs/knowledge/)
- Maintenance record generation (docs/maintenance/)

## Constraints
- Do not modify production code directly
- Always document findings in knowledge base
- Use lean-ctx tools for code exploration when needed

Step 2: Update Dockerfile

Add after baked-skills section:

# ── Baked Agents（AIOps 等預裝 Agent）──────────────────
COPY .opencode/baked-agents /opt/opencode/baked-agents
RUN chown -R ${USERNAME}:${USERNAME} /opt/opencode/baked-agents

Step 3: Create entrypoint script

entrypoint.d/07-init-baked-agents.sh:

#!/usr/bin/env bash
# 07-init-baked-agents.sh — Symlink ALL baked agents
set -euo pipefail

OPCODE_CONFIG_DIR="${HOME}/.config/opencode"
AGENTS_ROOT="${OPCODE_CONFIG_DIR}/agents"
BAKED_AGENTS_DIR="/opt/opencode/baked-agents"

mkdir -p "$AGENTS_ROOT"

if [ -d "$BAKED_AGENTS_DIR" ]; then
  for agent_dir in "$BAKED_AGENTS_DIR"/*/; do
    agent_name=$(basename "$agent_dir")
    target="$AGENTS_ROOT/${agent_name}"
    
    if [ ! -e "$target" ]; then
      ln -sf "$agent_dir" "$target"
      echo "[init-baked-agents] Linked: $agent_name"
    fi
  done
fi

Step 4: Verify

1. Build Docker image
2. Start container
3. Verify agent is available: @aiops 檢查 nginx 狀態
4. Test permission boundaries

Extensibility

This pattern allows adding more agents in the future:

.opencode/baked-agents/
├── aiops/
│   └── aiops.md
├── security/
│   └── security.md
├── docs/
│   └── docs.md
└── deploy/
    └── deploy.md

New agents only require:

1. Add agent definition directory
2. No changes to entrypoint script
3. No changes to Dockerfile (if using generic copy)

References

• OpenCode Permissions: https://opencode.ai/docs/permissions/
• OpenCode Agents: https://opencode.ai/docs/agents/
• Existing baked-skills pattern: Dockerfile lines 249-251