- read-only in the sandbox: .opencode-sandbox/, .cc-safety-net/, .git/hooks, .git/config,
an in-project core.hooksPath, the egress rules and the safety-net home; .git is pinned
by a bind onto itself so it cannot be swapped
- only trusted projects are loaded (init / trust): a .opencode-sandbox/ in a worktree or a
subdirectory is no longer sourced on the host
- run (before and after the session) and doctor report planted .git entries, redirected
worktrees and per-worktree overrides
- hide Firefox, Claude, VS Code, Cursor and Codex configs
k.denisov
01fc1627c1