public/opencode-sandbox
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update agent instructions; check a worktree is clean before its pre-rm hook

Browse Source 
- AGENTS.md and the skill: only the user's browser is off (xdg-open); browser tools run
  in the sandbox, headless or in a Wayland window; host-run project files are read-only
- wt rm: refuse a dirty worktree before wt-pre-rm runs, so its stack is not stopped for
  nothing
This commit is contained in:
k.denisov
2026-10-30 01:41:08 -07:00
parent 01fc1627c1
commit 727feb6be3
3 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/worktree.sh
+1 -1
View File
@@ -64,12 +64,12 @@ ocsb_wt_rm() {
[[ $(realpath "${dir}") != "$(realpath "${main}")" ]] || ocsb_die "refusing to remove the main worktree" [[ $(realpath "${dir}") != "$(realpath "${main}")" ]] || ocsb_die "refusing to remove the main worktree"
branch=$(git -C "${dir}" rev-parse --abbrev-ref HEAD 2>/dev/null || true) branch=$(git -C "${dir}" rev-parse --abbrev-ref HEAD 2>/dev/null || true)
export WT_DIR=${dir} WT_BRANCH=${branch} WT_SLUG=${name##*/} MAIN_ROOT=${main} export WT_DIR=${dir} WT_BRANCH=${branch} WT_SLUG=${name##*/} MAIN_ROOT=${main}
ocsb_wt_hook wt-pre-rm "${dir}" "${extra[@]}"
status=$(git -C "${dir}" status --porcelain) status=$(git -C "${dir}" status --porcelain)
if [[ -n ${status} && ${force} -ne 1 ]]; then if [[ -n ${status} && ${force} -ne 1 ]]; then
echo "${status}" >&2 echo "${status}" >&2
ocsb_die "worktree has uncommitted changes — commit them or pass --force (they will be lost)" ocsb_die "worktree has uncommitted changes — commit them or pass --force (they will be lost)"
fi fi
ocsb_wt_hook wt-pre-rm "${dir}" "${extra[@]}"
if [[ ${force} -eq 1 ]]; then if [[ ${force} -eq 1 ]]; then
git -C "${main}" worktree remove --force "${dir}" git -C "${main}" worktree remove --force "${dir}"
else else
opencode/AGENTS.md
+5 -1
View File
@@ -7,4 +7,8 @@ network, files outside the project, git remotes, Docker, or worktrees. In short:
the system is read-only. "Read-only file system" is the sandbox, not a bug — do not retry. the system is read-only. "Read-only file system" is the sandbox, not a bug — do not retry.
- Network goes through a filtering proxy. A 403 from the proxy is policy: tell the user which - Network goes through a filtering proxy. A 403 from the proxy is policy: tell the user which
domain you need and why; do not try to bypass it. domain you need and why; do not try to bypass it.
- You cannot open a browser; give the user the link instead. - You cannot open the user's browser (`xdg-open` is disabled); give the user the link instead.
Browser tools (Playwright) run inside the sandbox: headless, or in a window on the user's
desktop when `WAYLAND_DISPLAY` is set.
- `.opencode-sandbox/`, `.cc-safety-net/`, `.git/hooks` and `.git/config` are read-only: the
host runs them. Ask the user to change them.
skills/opencode-sandbox/SKILL.md
+1 -1
View File
@@ -44,7 +44,7 @@ sandbox is on.
## Things you cannot do ## Things you cannot do
- Open a browser (`xdg-open` is disabled): print the link for the user. - Open the user's browser (`xdg-open` is disabled): print the link for the user.
- Run GUI programs, unless `WAYLAND_DISPLAY` is set (the project enabled `OCSB_DISPLAY=1`): then - Run GUI programs, unless `WAYLAND_DISPLAY` is set (the project enabled `OCSB_DISPLAY=1`): then
windows open on the user's desktop through Wayland. Without it browsers must run headless. windows open on the user's desktop through Wayland. Without it browsers must run headless.
- `sudo`, `systemd-run`: denied. - `sudo`, `systemd-run`: denied.