opencode-sandbox: OpenCode 2 in a sandbox for any project

Runs OpenCode 2 with full permissions while containing its mistakes:

- egress filter: squid in a container per project; squid.conf is rendered
  from layered egress.conf files (package, user, project, local) with
  allow/block/connect rules and expect-pass/expect-block self-tests
- netlock: nftables rejects direct egress for the opencode-sandbox group
  (installed once with sudo as a systemd unit)
- bubblewrap: read-only host, writable project, worktrees and state;
  credentials hidden; ssh keys via the host's ssh-agent; session bus
  replaced by an xdg-dbus-proxy limited to notifications; no permission
  prompts (sudo and systemd-run denied); refuses to run unsandboxed
- per-project state in ~/.local/share/opencode-sandbox/<name>
- worktrees: `wt add|rm|list` with project hooks
- skills mounted per project; the opencode-sandbox skill explains the
  environment to the agent
- plugins as submodules: context-panel, skill-compact-resurrect;
  global config adds opencode-notifier and cc-safety-net
- README in English and Russian

templates/project/cc-safety-net-policy.json

@@ -0,0 +1,5 @@
+{
+  "destructive_command_protection": {
+    "overrides": {}
+  }
+}

templates/project/egress.conf

@@ -0,0 +1,19 @@
+# Network rules for this project, on top of the package defaults. Commit this file;
+# personal or secret rules go to local/egress.conf.
+#
+# Policy: everything is allowed except what is blocked; private networks, names without a
+# dot and ports other than 80/443 are always blocked unless allowed here.
+#
+#   allow        <domain>...     .domain = the domain and all subdomains
+#   allow-regex  <regex>...
+#   block        <domain>...
+#   block-regex  <regex>...
+#   connect      <host:port>...  tunnel to a non-443 port or an internal address
+#   expect-block <url>           self-test (opencode-sandbox egress verify)
+#   expect-pass  <url>
+#
+# Example: allow internal services but keep production out of reach
+#   allow   git.example.internal ci.example.internal
+#   block   .example.internal
+#   connect git.example.internal:2222     # git over SSH
+#   expect-block https://prod.example.internal/

templates/project/hooks/wt-post-add.example

@@ -0,0 +1,10 @@
+#!/bin/sh
+# Runs after `opencode-sandbox wt add <branch> [args]` in the new worktree.
+# Environment: WT_DIR, WT_BRANCH, WT_SLUG, MAIN_ROOT. Arguments: extra args of `wt add`.
+# Rename to wt-post-add and chmod +x to enable. A non-zero exit fails the command.
+set -eu
+
+# Example: give each worktree its own port and start its stack
+# port=$((3000 + $(git -C "$MAIN_ROOT" worktree list | wc -l) * 10))
+# echo "APP_PORT=$port" > .env
+# make up

templates/project/hooks/wt-pre-rm.example

@@ -0,0 +1,8 @@
+#!/bin/sh
+# Runs before `opencode-sandbox wt rm <name> [args]` removes the worktree, in the worktree.
+# Environment: WT_DIR, WT_BRANCH, WT_SLUG, MAIN_ROOT. Arguments: extra args of `wt rm`.
+# Rename to wt-pre-rm and chmod +x to enable. A non-zero exit aborts the removal.
+set -eu
+
+# Example: stop the worktree's stack
+# make down || true

templates/project/sandbox.conf

@@ -0,0 +1,28 @@
+# opencode-sandbox settings for this project (bash). Commit this file; personal overrides
+# go to local/sandbox.conf. All settings and defaults: `opencode-sandbox config`.
+# OCSB_PROJECT_DIR is set when this file is read.
+
+# OCSB_NAME=myproject          # container/state name; default: directory name
+# OCSB_WEB_PORT=4196           # web UI; OpenCode listens on +1. Different per project
+# OCSB_EGRESS_PORT=3128        # egress filter. Different per project
+
+# Writable for the agent besides the project and its worktrees (relative to the project)
+# OCSB_RW=(../shared-fixtures)
+# Hidden from the agent (relative to the project)
+# OCSB_HIDE=(../secrets)
+
+# Skills mounted for the agent: names of skill directories from the package's skills/
+# or OCSB_SKILL_DIRS
+# OCSB_SKILLS=(opencode-sandbox)
+# OCSB_SKILL_DIRS=(~/skills)
+
+# Tokens for MCP servers and the model provider: KEY=VALUE file, keep it out of git
+# OCSB_ENV_FILE=~/.config/myproject/agent.env
+# OCSB_KUBECONFIG=~/.kube/myproject-agent.yaml
+# OCSB_ENV=(SOME_FLAG=1)
+
+# Worktrees: <OCSB_WORKTREES_DIR>/<OCSB_WT_PREFIX><slug>
+# OCSB_WORKTREES_DIR=../myproject-worktrees
+# OCSB_WT_PREFIX=myproject-wt-
+# OCSB_WT_BASE=main
+# OCSB_WT_SLUG_REGEX='PROJ-([0-9]+)'   # branch feature-PROJ-42-x → slug 42