k.denisov
01fc1627c1
- read-only in the sandbox: .opencode-sandbox/, .cc-safety-net/, .git/hooks, .git/config, an in-project core.hooksPath, the egress rules and the safety-net home; .git is pinned by a bind onto itself so it cannot be swapped - only trusted projects are loaded (init / trust): a .opencode-sandbox/ in a worktree or a subdirectory is no longer sourced on the host - run (before and after the session) and doctor report planted .git entries, redirected worktrees and per-worktree overrides - hide Firefox, Claude, VS Code, Cursor and Codex configs
34 lines
1.4 KiB
Bash
34 lines
1.4 KiB
Bash
# shellcheck shell=bash
|
|
# opencode-sandbox init: add .opencode-sandbox/ to the current git repository
|
|
|
|
ocsb_init() {
|
|
local root t=${OCSB_HOME}/templates/project f
|
|
root=$(git rev-parse --show-toplevel 2>/dev/null) || ocsb_die "run init inside a git repository"
|
|
if [[ -f ${root}/.opencode-sandbox/sandbox.conf ]]; then
|
|
ocsb_die "${root}/.opencode-sandbox already exists"
|
|
fi
|
|
mkdir -p "${root}/.opencode-sandbox/hooks" "${root}/.opencode-sandbox/local"
|
|
cp "${t}/sandbox.conf" "${t}/egress.conf" "${root}/.opencode-sandbox/"
|
|
printf '/local/\n' >"${root}/.opencode-sandbox/.gitignore"
|
|
for f in "${t}"/hooks/*.example; do
|
|
cp "${f}" "${root}/.opencode-sandbox/hooks/"
|
|
done
|
|
if [[ ! -e ${root}/.cc-safety-net/policy.json ]]; then
|
|
mkdir -p "${root}/.cc-safety-net"
|
|
cp "${t}/cc-safety-net-policy.json" "${root}/.cc-safety-net/policy.json"
|
|
fi
|
|
ocsb_trust "${root}" >/dev/null
|
|
cat <<EOF
|
|
✓ created ${root}/.opencode-sandbox/
|
|
sandbox.conf settings (ports, writable paths, skills, worktrees) — commit it
|
|
egress.conf domains for this project — commit it
|
|
hooks/ worktree hooks: drop .example and chmod +x to enable
|
|
local/ personal overrides (sandbox.conf, egress.conf), git-ignored
|
|
The project is trusted on this machine; a clone elsewhere needs: opencode-sandbox trust
|
|
|
|
Next:
|
|
opencode-sandbox doctor check the host
|
|
opencode-sandbox run start OpenCode in the sandbox
|
|
EOF
|
|
}
|