public/opencode-sandbox
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OCSB_DISPLAY: agent windows on the desktop through the Wayland socket

Browse Source 
Off by default. With OCSB_DISPLAY=1 the sandbox gets only the Wayland socket and /dev/dri: the agent's windows (e.g. a Playwright browser) appear on the desktop, but a Wayland client cannot read other windows or inject input into them. X11 and the X cookie are never passed in.
This commit is contained in:
k.denisov
2026-10-30 01:14:56 -07:00
parent 6dec88641a
commit 5a7567849e
5 changed files with 36 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/opencode-sandbox/SKILL.md
+2 -1
View File
@@ -39,7 +39,8 @@ sandbox is on.
## Things you cannot do
- Open a browser (`xdg-open` is disabled): print the link for the user.
- Run GUI programs: there is no display. Browsers (Playwright, Chrome) must run headless.
- Run GUI programs, unless `WAYLAND_DISPLAY` is set (the project enabled `OCSB_DISPLAY=1`): then
windows open on the user's desktop through Wayland. Without it browsers must run headless.
- `sudo`, `systemd-run`: denied.
- Start processes outside the sandbox through the session bus: only desktop notifications
are reachable.