beclab · Terminus-Gitbot · Sep 16, 2026 · Sep 16, 2026
diff --git a/opencode/Chart.yaml b/opencode/Chart.yaml
@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.0.26
+version: 1.0.27
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.18.18"
+appVersion: "1.18.31"
diff --git a/opencode/OlaresManifest.yaml b/opencode/OlaresManifest.yaml
@@ -11,7 +11,7 @@ metadata:
   description: The open source AI coding agent
   appid: opencode
   title: OpenCode
-  version: '1.0.26'
+  version: '1.0.27'
   categories:
   - Developer Tools
   - Productivity_v112
@@ -24,7 +24,7 @@ permission:
   userData:
   - Home
 spec:
-  versionName: '1.18.18'
+  versionName: '1.18.31'
   promoteImage:
   - https://app.cdn.olares.com/appstore/opencode/1.webp
   - https://app.cdn.olares.com/appstore/opencode/2.webp
@@ -45,27 +45,10 @@ spec:
     - Configure your LLM provider and API keys in the Web UI.
     - Your code workspace is mounted at /home/opencode/workspace (linked to your Home/Code directory).
   upgradeDescription: |
-    Run the official OpenResty entrance as UID/GID 1000 with writable runtime paths.
-    Upgrade OpenCode to v1.18.18 (`beclab/opencode:1.18.18.1`).
+    Upgrade OpenCode to v1.18.31 (beclab/opencode:1.18.31.1). Keep nginx health checks local. Bind the Docker API to loopback with explicit TLS settings and allow initialization before startup checks.
+    Release notes: https://github.com/anomalyco/opencode/releases/tag/v1.18.31
 
-    Olares: baked `@olares/cli` upgraded to 1.12.7-cli.0 (from 1.12.6-cli.2).
-    certbot (Let's Encrypt) is pre-installed in the image; init-home
-    installs a `~/.local/bin/certbot` wrapper so `certbot` works for uid 1000
-    without manual `--config-dir` flags (state under `$HOME/.config/letsencrypt`).
-
-    Web UI: on first open, choose Add Project → workspace
-    (`/home/opencode/workspace`); the browser remembers the project afterward
-    (upstream Web still stores opened projects in localStorage).
-
-    Upstream highlights (v1.18.17–v1.18.18): clearer session compaction for
-    smaller models; Copilot PDF attachments; Muse/Moonshot/Kimi system prompts;
-    capped session retries with jitter; default model follows server config;
-    xAI xhigh reasoning fix.
-
-    Optional app-level HTTP basic auth via `OPENCODE_SERVER_PASSWORD` unchanged
-    (off by default; username `OPENCODE_SERVER_USERNAME`, default `opencode`).
-
-    Full release notes: https://github.com/anomalyco/opencode/releases/tag/v1.18.18
+    Upstream highlights (v1.18.19–v1.18.31): improved Qwen/OpenAI-compatible provider compatibility; more reliable network retries and streaming with five-minute default header/chunk timeouts; restored ACP session options and reasoning boundaries; Azure CLI / Microsoft Entra ID sign-in and Cloudflare AI Gateway routing improvements.
   developer: Anomaly
   website: https://opencode.ai/
   sourceCode: https://github.com/anomalyco/opencode

diff --git a/opencode/i18n/de-DE/OlaresManifest.yaml b/opencode/i18n/de-DE/OlaresManifest.yaml
@@ -19,23 +19,7 @@ spec:
     - LLM-Anbieter und API-Schlüssel in der Web-UI konfigurieren.
     - Ihr Code-Workspace ist unter /home/opencode/workspace gemountet (verlinkt mit Ihrem Home/Code-Verzeichnis).
   upgradeDescription: |
-    Upgrade von OpenCode auf v1.18.18 (`beclab/opencode:1.18.18.1`).
+    OpenCode auf v1.18.31 aktualisiert (beclab/opencode:1.18.31.1). Lokale nginx-Prüfungen beibehalten. Docker API auf Loopback begrenzt; TLS-Modus explizit festgelegt und Initialisierungszeit vor Startprüfungen eingeräumt.
+    https://github.com/anomalyco/opencode/releases/tag/v1.18.31
 
-    Olares: gebacktes `@olares/cli` auf 1.12.7-cli.0 aktualisiert (von 1.12.6-cli.2).
-    certbot (Let's Encrypt) ist im Image vorinstalliert; init-home
-    installiert einen `~/.local/bin/certbot`-Wrapper, sodass `certbot` für uid 1000
-    ohne manuelle `--config-dir`-Flags funktioniert (State unter `$HOME/.config/letsencrypt`).
-
-    Web UI: beim ersten Öffnen Add Project → workspace wählen
-    (`/home/opencode/workspace`); der Browser merkt sich das Projekt danach
-    (Upstream-Web speichert geöffnete Projekte weiterhin in localStorage).
-
-    Upstream-Highlights (v1.18.17–v1.18.18): klarere Session-Compaction für
-    kleinere Modelle; Copilot-PDF-Anhänge; Muse/Moonshot/Kimi-Systemprompts;
-    begrenzte Session-Retries mit Jitter; Standardmodell folgt Server-Config;
-    xAI-xhigh-Reasoning-Fix.
-
-    Optionale app-level HTTP-Basic-Auth via `OPENCODE_SERVER_PASSWORD` unverändert
-    (standardmäßig aus; Benutzername `OPENCODE_SERVER_USERNAME`, Standard `opencode`).
-
-    Vollständige Release Notes: https://github.com/anomalyco/opencode/releases/tag/v1.18.18
+    Upstream-Highlights (v1.18.19–v1.18.31): bessere Qwen/OpenAI-Kompatibilität; robustere Netzwerk-Retries und Streams mit fünf Minuten Header-/Chunk-Timeout; Wiederherstellung der ACP-Sitzungsoptionen und Reasoning-Grenzen; Azure CLI / Microsoft Entra ID und verbessertes Cloudflare AI Gateway-Routing.
diff --git a/opencode/i18n/en-US/OlaresManifest.yaml b/opencode/i18n/en-US/OlaresManifest.yaml
@@ -19,23 +19,7 @@ spec:
     - Configure your LLM provider and API keys in the Web UI.
     - Your code workspace is mounted at /home/opencode/workspace (linked to your Home/Code directory).
   upgradeDescription: |
-    Upgrade OpenCode to v1.18.18 (`beclab/opencode:1.18.18.1`).
+    Upgrade OpenCode to v1.18.31 (beclab/opencode:1.18.31.1). Keep nginx health checks local. Bind the Docker API to loopback with explicit TLS settings and allow initialization before startup checks.
+    https://github.com/anomalyco/opencode/releases/tag/v1.18.31
 
-    Olares: baked `@olares/cli` upgraded to 1.12.7-cli.0 (from 1.12.6-cli.2).
-    certbot (Let's Encrypt) is pre-installed in the image; init-home
-    installs a `~/.local/bin/certbot` wrapper so `certbot` works for uid 1000
-    without manual `--config-dir` flags (state under `$HOME/.config/letsencrypt`).
-
-    Web UI: on first open, choose Add Project → workspace
-    (`/home/opencode/workspace`); the browser remembers the project afterward
-    (upstream Web still stores opened projects in localStorage).
-
-    Upstream highlights (v1.18.17–v1.18.18): clearer session compaction for
-    smaller models; Copilot PDF attachments; Muse/Moonshot/Kimi system prompts;
-    capped session retries with jitter; default model follows server config;
-    xAI xhigh reasoning fix.
-
-    Optional app-level HTTP basic auth via `OPENCODE_SERVER_PASSWORD` unchanged
-    (off by default; username `OPENCODE_SERVER_USERNAME`, default `opencode`).
-
-    Full release notes: https://github.com/anomalyco/opencode/releases/tag/v1.18.18
+    Upstream highlights (v1.18.19–v1.18.31): improved Qwen/OpenAI-compatible provider compatibility; more reliable network retries and streaming with five-minute default header/chunk timeouts; restored ACP session options and reasoning boundaries; Azure CLI / Microsoft Entra ID sign-in and Cloudflare AI Gateway routing improvements.
diff --git a/opencode/i18n/es-ES/OlaresManifest.yaml b/opencode/i18n/es-ES/OlaresManifest.yaml
@@ -19,23 +19,7 @@ spec:
     - Configura tu proveedor LLM y las claves API en la Web UI.
     - Tu workspace de código está montado en /home/opencode/workspace (enlazado a tu directorio Home/Code).
   upgradeDescription: |
-    Actualizar OpenCode a v1.18.18 (`beclab/opencode:1.18.18.1`).
+    Actualizar OpenCode a v1.18.31 (beclab/opencode:1.18.31.1). Mantener las comprobaciones locales de nginx. Limitar la API de Docker a loopback, configurar explícitamente TLS y dar tiempo a la inicialización.
+    https://github.com/anomalyco/opencode/releases/tag/v1.18.31
 
-    Olares: `@olares/cli` incluido actualizado a 1.12.7-cli.0 (desde 1.12.6-cli.2).
-    certbot (Let's Encrypt) viene preinstalado en la imagen; init-home
-    instala un wrapper `~/.local/bin/certbot` para que `certbot` funcione con uid 1000
-    sin flags manuales `--config-dir` (estado bajo `$HOME/.config/letsencrypt`).
-
-    Web UI: en la primera apertura, elige Add Project → workspace
-    (`/home/opencode/workspace`); el navegador recuerda el proyecto después
-    (el Web upstream sigue guardando proyectos abiertos en localStorage).
-
-    Aspectos destacados upstream (v1.18.17–v1.18.18): compactación de sesión más clara para
-    modelos pequeños; adjuntos PDF de Copilot; prompts de sistema Muse/Moonshot/Kimi;
-    reintentos de sesión limitados con jitter; el modelo por defecto sigue la config del servidor;
-    corrección de razonamiento xAI xhigh.
-
-    Auth básica HTTP opcional a nivel de app vía `OPENCODE_SERVER_PASSWORD` sin cambios
-    (desactivada por defecto; usuario `OPENCODE_SERVER_USERNAME`, por defecto `opencode`).
-
-    Notas de versión completas: https://github.com/anomalyco/opencode/releases/tag/v1.18.18
+    Novedades upstream (v1.18.19–v1.18.31): mejor compatibilidad Qwen/OpenAI; reintentos y streaming más fiables con timeout de cabeceras y fragmentos de cinco minutos; restauración de opciones y límites de razonamiento ACP; acceso Azure CLI / Microsoft Entra ID y mejoras de Cloudflare AI Gateway.
diff --git a/opencode/i18n/fr-FR/OlaresManifest.yaml b/opencode/i18n/fr-FR/OlaresManifest.yaml
@@ -19,23 +19,7 @@ spec:
     - Configurez votre fournisseur LLM et vos clés API dans la Web UI.
     - Votre workspace de code est monté sur /home/opencode/workspace (lié à votre répertoire Home/Code).
   upgradeDescription: |
-    Mise à niveau d’OpenCode vers v1.18.18 (`beclab/opencode:1.18.18.1`).
+    Mise à niveau vers OpenCode v1.18.31 (beclab/opencode:1.18.31.1). Vérifications nginx locales conservées. API Docker limitée à la boucle locale, mode TLS explicite et délai initial avant les vérifications de démarrage.
+    https://github.com/anomalyco/opencode/releases/tag/v1.18.31
 
-    Olares : `@olares/cli` intégré mis à jour vers 1.12.7-cli.0 (depuis 1.12.6-cli.2).
-    certbot (Let's Encrypt) est préinstallé dans l’image ; init-home
-    installe un wrapper `~/.local/bin/certbot` pour que `certbot` fonctionne pour uid 1000
-    sans flags manuels `--config-dir` (état sous `$HOME/.config/letsencrypt`).
-
-    Web UI : à la première ouverture, choisir Add Project → workspace
-    (`/home/opencode/workspace`) ; le navigateur mémorise le projet ensuite
-    (le Web upstream stocke toujours les projets ouverts dans localStorage).
-
-    Points forts upstream (v1.18.17–v1.18.18) : compaction de session plus claire pour
-    les petits modèles ; pièces jointes PDF Copilot ; prompts système Muse/Moonshot/Kimi ;
-    retries de session plafonnés avec jitter ; le modèle par défaut suit la config serveur ;
-    correctif du raisonnement xAI xhigh.
-
-    Auth HTTP basic optionnelle au niveau app via `OPENCODE_SERVER_PASSWORD` inchangée
-    (désactivée par défaut ; utilisateur `OPENCODE_SERVER_USERNAME`, défaut `opencode`).
-
-    Notes de version complètes : https://github.com/anomalyco/opencode/releases/tag/v1.18.18
+    Nouveautés upstream (v1.18.19–v1.18.31) : compatibilité Qwen/OpenAI améliorée ; reprises réseau et streaming plus fiables avec délais de cinq minutes ; restauration des options ACP et limites de raisonnement ; connexion Azure CLI / Microsoft Entra ID et routage Cloudflare AI Gateway amélioré.
diff --git a/opencode/i18n/it-IT/OlaresManifest.yaml b/opencode/i18n/it-IT/OlaresManifest.yaml
@@ -19,23 +19,7 @@ spec:
     - Configura il provider LLM e le chiavi API nella Web UI.
     - Il workspace del codice è montato in /home/opencode/workspace (collegato alla directory Home/Code).
   upgradeDescription: |
-    Aggiornare OpenCode a v1.18.18 (`beclab/opencode:1.18.18.1`).
+    Aggiornamento a OpenCode v1.18.31 (beclab/opencode:1.18.31.1). Controlli nginx locali mantenuti. API Docker limitata al loopback, modalità TLS esplicita e tempo di inizializzazione prima dei controlli di avvio.
+    https://github.com/anomalyco/opencode/releases/tag/v1.18.31
 
-    Olares: `@olares/cli` incluso aggiornato a 1.12.7-cli.0 (da 1.12.6-cli.2).
-    certbot (Let's Encrypt) è preinstallato nell’immagine; init-home
-    installa un wrapper `~/.local/bin/certbot` così `certbot` funziona per uid 1000
-    senza flag manuali `--config-dir` (stato sotto `$HOME/.config/letsencrypt`).
-
-    Web UI: alla prima apertura, scegli Add Project → workspace
-    (`/home/opencode/workspace`); il browser ricorda il progetto in seguito
-    (il Web upstream continua a memorizzare i progetti aperti in localStorage).
-
-    Highlight upstream (v1.18.17–v1.18.18): compaction di sessione più chiara per
-    modelli più piccoli; allegati PDF Copilot; system prompt Muse/Moonshot/Kimi;
-    retry di sessione limitati con jitter; il modello predefinito segue la config del server;
-    fix del reasoning xAI xhigh.
-
-    Auth HTTP basic opzionale a livello app via `OPENCODE_SERVER_PASSWORD` invariata
-    (disattivata di default; username `OPENCODE_SERVER_USERNAME`, default `opencode`).
-
-    Note di rilascio complete: https://github.com/anomalyco/opencode/releases/tag/v1.18.18
+    Novità upstream (v1.18.19–v1.18.31): migliore compatibilità Qwen/OpenAI; retry e streaming più affidabili con timeout di cinque minuti; ripristino delle opzioni ACP e dei limiti di ragionamento; accesso Azure CLI / Microsoft Entra ID e routing Cloudflare AI Gateway migliorato.
diff --git a/opencode/i18n/ja-JP/OlaresManifest.yaml b/opencode/i18n/ja-JP/OlaresManifest.yaml
@@ -19,23 +19,7 @@ spec:
     - Web UI で LLM プロバイダーと API キーを設定。
     - コードワークスペースは /home/opencode/workspace にマウントされます（Home/Code ディレクトリにリンク）。
   upgradeDescription: |
-    OpenCode を v1.18.18（`beclab/opencode:1.18.18.1`）へアップグレード。
+    OpenCode を v1.18.31（beclab/opencode:1.18.31.1）へ更新。nginx のローカルヘルスチェックを維持。Docker API をループバックに限定し、TLS モードを明示して起動チェック前の初期化時間を確保。
+    https://github.com/anomalyco/opencode/releases/tag/v1.18.31
 
-    Olares: 同梱の `@olares/cli` を 1.12.7-cli.0 へ更新（1.12.6-cli.2 から）。
-    certbot（Let's Encrypt）はイメージにプリインストール。init-home が
-    `~/.local/bin/certbot` ラッパーを入れ、uid 1000 でも手動の `--config-dir`
-    なしで `certbot` が動くようにします（状態は `$HOME/.config/letsencrypt`）。
-
-    Web UI: 初回起動時に Add Project → workspace
-    （`/home/opencode/workspace`）を選択。以降ブラウザがプロジェクトを記憶
-    （上流 Web は開いたプロジェクトを引き続き localStorage に保存）。
-
-    上流ハイライト（v1.18.17–v1.18.18）: 小規模モデル向けのセッション圧縮の改善、
-    Copilot PDF 添付、Muse/Moonshot/Kimi システムプロンプト、
-    ジッター付きのセッション再試行上限、デフォルトモデルがサーバー設定に従う、
-    xAI xhigh 推論の修正。
-
-    アプリレベルの任意 HTTP basic 認証 `OPENCODE_SERVER_PASSWORD` は変更なし
-    （デフォルト off；ユーザー名 `OPENCODE_SERVER_USERNAME`、デフォルト `opencode`）。
-
-    完全なリリースノート: https://github.com/anomalyco/opencode/releases/tag/v1.18.18
+    上流の更新点（v1.18.19–v1.18.31）：Qwen/OpenAI 互換性を改善。ネットワーク再試行とストリーミングを改善し、ヘッダーとチャンクの既定タイムアウトを5分に設定。ACP セッション設定と推論境界を復元。Azure CLI / Microsoft Entra ID ログインと Cloudflare AI Gateway ルーティングを改善。
diff --git a/opencode/i18n/zh-CN/OlaresManifest.yaml b/opencode/i18n/zh-CN/OlaresManifest.yaml
@@ -19,21 +19,7 @@ spec:
     - 在 Web UI 中配置你的 LLM 服务商和 API 密钥。
     - 你的代码工作区已挂载在 /home/opencode/workspace（链接到你的 Home/Code 目录）。
   upgradeDescription: |
-    将 OpenCode 升级至 v1.18.18（`beclab/opencode:1.18.18.1`）。
+    将 OpenCode 升级至 v1.18.31（beclab/opencode:1.18.31.1）。保留 nginx 容器内健康检查。Docker API 仅监听回环地址，显式配置 TLS 模式，并为启动检查预留初始化时间。
+    https://github.com/anomalyco/opencode/releases/tag/v1.18.31
 
-    Olares：镜像内置 `@olares/cli` 升级至 1.12.7-cli.0（原 1.12.6-cli.2）。
-    预装 certbot（Let's Encrypt）；init-home 安装 `~/.local/bin/certbot`
-    包装脚本，uid 1000 下可直接运行 `certbot`，无需手动传 `--config-dir`
-    （状态目录在 `$HOME/.config/letsencrypt`）。
-
-    Web UI：首次打开请选择「添加项目」→ workspace（`/home/opencode/workspace`），
-    浏览器会记住该项目（上游 Web 仍将已打开项目保存在 localStorage）。
-
-    上游要点（v1.18.17–v1.18.18）：小模型 session 压缩摘要更清晰；Copilot PDF
-    附件；Muse/Moonshot/Kimi system prompt 修复；session 自动重试上限与 jitter；
-    默认模型跟随服务端配置；xAI xhigh reasoning 修复。
-
-    可选应用层 HTTP Basic Auth：`OPENCODE_SERVER_PASSWORD` 行为不变（默认关闭；
-    用户名 `OPENCODE_SERVER_USERNAME`，默认 `opencode`）。
-
-    完整发布说明：https://github.com/anomalyco/opencode/releases/tag/v1.18.18
+    上游更新要点（v1.18.19–v1.18.31）：改善 Qwen/OpenAI 兼容接口适配；改善网络重试及流式响应，响应头和分块超时默认五分钟；修复 ACP 会话选项与推理边界恢复；新增 Azure CLI / Microsoft Entra ID 登录并改善 Cloudflare AI Gateway 路由。
diff --git a/opencode/templates/opencode.yaml b/opencode/templates/opencode.yaml
@@ -5,7 +5,7 @@
 {{- $enableDind := ne (index $env "ENABLE_DIND" | default "true") "false" }}
 {{- $serverPassword := index $env "OPENCODE_SERVER_PASSWORD" | default "" }}
 {{- $serverUsername := index $env "OPENCODE_SERVER_USERNAME" | default "opencode" }}
-{{- $image := "beclab/opencode:1.18.18.1" }}
+{{- $image := "beclab/opencode:1.18.31.1" }}
 
 ---
 apiVersion: apps/v1
@@ -297,18 +297,35 @@ spec:
             failureThreshold: 30
             periodSeconds: 10
           readinessProbe:
-            httpGet:
-              path: /healthz
-              port: 8080
+            # Check nginx locally; Pod-IP HTTP probes traverse Envoy external auth.
+            exec:
+              command:
+                - curl
+                - --fail
+                - --silent
+                - --show-error
+                - --noproxy
+                - "*"
+                - --max-time
+                - "2"
+                - http://127.0.0.1:8080/healthz
             initialDelaySeconds: 5
             periodSeconds: 5
             timeoutSeconds: 3
             successThreshold: 1
             failureThreshold: 10
           livenessProbe:
-            httpGet:
-              path: /healthz
-              port: 8080
+            exec:
+              command:
+                - curl
+                - --fail
+                - --silent
+                - --show-error
+                - --noproxy
+                - "*"
+                - --max-time
+                - "2"
+                - http://127.0.0.1:8080/healthz
             initialDelaySeconds: 15
             timeoutSeconds: 5
             periodSeconds: 30
@@ -384,8 +401,10 @@ spec:
               value: ""
           command:
             - dockerd
+            # Explicit local-only plaintext API avoids dockerd's deliberate TLS warning delay.
+            - --tls=false
             - --host
-            - tcp://0.0.0.0:2375
+            - tcp://127.0.0.1:2375
             - --host
             - unix:///var/run/docker.sock
             - --mtu=1450
@@ -394,7 +413,7 @@ spec:
           startupProbe:
             exec:
               command: ["docker", "info"]
-            initialDelaySeconds: 3
+            initialDelaySeconds: 10
             periodSeconds: 5
             failureThreshold: 60
             timeoutSeconds: 10
@@ -553,4 +572,4 @@ subjects:
 roleRef:
   kind: ClusterRole
   name: {{ .Release.Namespace }}
-  apiGroup: rbac.authorization.k8s.io
+  apiGroup: rbac.authorization.k8s.io