let the OpenCode harness run the pr-reviewer eligibility gate on a local model

[atomantic]

Summary

Stage 2 of the pr-reviewer pipeline (the tool-free eligibility gate) would not accept the OpenCode harness, so the only way to run a local Ollama model through it was a Claude binary pointed at an Anthropic-compatible shim — which also emits [stderr] [claude-code:unrecognized_model] for every Ollama model id it is handed. OpenCode is the natural harness for Ollama; this makes it eligible.

Why it had no recipe. Unlike every other vendor, OpenCode has no read-only argv flag — its tool posture, permission block and per-model tool_call advertisement all live in OPENCODE_CONFIG_CONTENT. So the recipe is two halves that must be read together:

• providerVendors.js builds opencode run --agent plan -m ollama/<model>, not forwarding provider args (a saved --agent build would pick the tool-enabled agent);
• opencodeConfig.js hardens that config under the same safetyProfile: root permission: "deny" (the string shorthand, so a category OpenCode adds later cannot default to allowed), an emptied tool map on every agent, tool_call: false on every declared model, and MCP/plugins/share/autoupdate cleared.

The public-review env allowlist used to strip that variable outright, which did not harden the child — it pointed OpenCode back at the user's own ~/.config/opencode. It now survives on the same terms as the local Anthropic credential.

Eligibility and the allowlist share one locality rule (opencodeConfigIsLocalOnly). They have to: a provider the vendor row accepts but whose config the allowlist strips would spawn with tools intact while every signal still reported an enforced gate. An ollamaBacked record with a relocated off-box baseURL is exactly that shape, and a marker-only check cannot see it. The recipe is scoped to Ollama because validatePublicReviewModel rejects every other local runtime unconditionally — offering them would put a permanently blocking choice in the picker.

Existing spawn-time validation is unchanged and still applies: the model must be installed and its /api/show must report no tools capability.

Also folded in (three duplications the change would otherwise have made worse): localRuntimeNamespace replaces three copies of "local namespace, not a gateway"; parseOpencodeConfigContent replaces three copies of the OPENCODE_CONFIG_CONTENT parse; and two hand-rolled loopback tests now use the existing isLocalInstanceEndpoint.

Test plan

• cd server && npm test — 38.6k tests green.
• New coverage pins each enforcement half and the seam between them:
  • providerVendors.publicReview.test.js — an Ollama-backed OpenCode wrapper is gate-eligible and enforced; the argv is run --agent plan -m ollama/<model> with provider args dropped; a gateway wrapper, an off-box baseURL, and the four non-Ollama local runtimes are all withheld.
  • opencodeConfig.test.js — hardening overrides a stored allow-everything config while preserving generation settings and the endpoint; the stage's effort reaches agent.plan; a user-declared agent.plan still wins.
  • cliChildEnv.test.js — the hardened config survives the allowlist while GH_TOKEN/API_KEY do not; an off-box config is stripped key and all; and the allowlist keeps the config for exactly the providers the vendor row makes eligible.
• Reviewed by antigravity (gemini-3.8-flash); its four findings — the eligibility/allowlist disagreement, the unvalidatable runtimes, the effort never reaching --agent plan, and the root-permission wording — are each fixed and pinned by a test above.
• Follow-up filed as Pin the invariant that a public-review stage never dispatches through the CoS runner #6105 (pin the "public-review never dispatches through the CoS runner" invariant; needs mock scaffolding beyond this diff).