opencode-sandbox: OpenCode 2 in a sandbox for any project

Runs OpenCode 2 with full permissions while containing its mistakes:

- egress filter: squid in a container per project; squid.conf is rendered
  from layered egress.conf files (package, user, project, local) with
  allow/block/connect rules and expect-pass/expect-block self-tests
- netlock: nftables rejects direct egress for the opencode-sandbox group
  (installed once with sudo as a systemd unit)
- bubblewrap: read-only host, writable project, worktrees and state;
  credentials hidden; ssh keys via the host's ssh-agent; session bus
  replaced by an xdg-dbus-proxy limited to notifications; no permission
  prompts (sudo and systemd-run denied); refuses to run unsandboxed
- per-project state in ~/.local/share/opencode-sandbox/<name>
- worktrees: `wt add|rm|list` with project hooks
- skills mounted per project; the opencode-sandbox skill explains the
  environment to the agent
- plugins as submodules: context-panel, skill-compact-resurrect;
  global config adds opencode-notifier and cc-safety-net
- README in English and Russian

opencode/AGENTS.md

@@ -0,0 +1,10 @@
+# Environment: opencode-sandbox
+
+You run inside opencode-sandbox. Load the `opencode-sandbox` skill before working with the
+network, files outside the project, git remotes, Docker, or worktrees. In short:
+
+- You may write only to the project, its worktrees and paths listed in `OCSB_RW`; the rest of
+  the system is read-only. "Read-only file system" is the sandbox, not a bug — do not retry.
+- Network goes through a filtering proxy. A 403 from the proxy is policy: tell the user which
+  domain you need and why; do not try to bypass it.
+- You cannot open a browser; give the user the link instead.

opencode/opencode.jsonc

@@ -0,0 +1,20 @@
+// Global OpenCode 2 config used by opencode-sandbox for every project. Override it with
+// ~/.config/opencode-sandbox/opencode.jsonc or OCSB_OPENCODE_CONFIG. Project settings
+// (model, MCP servers, project plugins) stay in the project's opencode.jsonc.
+{
+  "$schema": "https://opencode.ai/config.json",
+  "share": "disabled",
+  "update": "disable",
+
+  // Plugin lists from the global and project configs are merged. Versions are pinned: a
+  // plugin is code inside the OpenCode process with all of its rights.
+  "plugins": [
+    // desktop notifications (in the sandbox: through a D-Bus proxy limited to notifications)
+    "@mohak34/opencode-notifier@1.1.0",
+    // parses commands before tools run and blocks destructive ones (git reset --hard,
+    // clean -f, checkout --, branch -D, rm -rf on dangerous paths, curl | bash) and secret
+    // access (~/.ssh, .env). Project exceptions: <project>/.cc-safety-net/policy.json.
+    // Does not inspect docker or kubectl
+    "cc-safety-net@2.7.0"
+  ]
+}