- AGENTS.md and the skill: only the user's browser is off (xdg-open); browser tools run
in the sandbox, headless or in a Wayland window; host-run project files are read-only
- wt rm: refuse a dirty worktree before wt-pre-rm runs, so its stack is not stopped for
nothing
Runs OpenCode 2 with full permissions while containing its mistakes:
- egress filter: squid in a container per project; squid.conf is rendered
from layered egress.conf files (package, user, project, local) with
allow/block/connect rules and expect-pass/expect-block self-tests
- netlock: nftables rejects direct egress for the opencode-sandbox group
(installed once with sudo as a systemd unit)
- bubblewrap: read-only host, writable project, worktrees and state;
credentials hidden; ssh keys via the host's ssh-agent; session bus
replaced by an xdg-dbus-proxy limited to notifications; no permission
prompts (sudo and systemd-run denied); refuses to run unsandboxed
- per-project state in ~/.local/share/opencode-sandbox/<name>
- worktrees: `wt add|rm|list` with project hooks
- skills mounted per project; the opencode-sandbox skill explains the
environment to the agent
- plugins as submodules: context-panel, skill-compact-resurrect;
global config adds opencode-notifier and cc-safety-net
- README in English and Russian
k.denisov