k.denisov
55d217e3cf
- run (on exit) and doctor scan the OpenCode log for 'Read-only file system' / EROFS, map the agent's XDG mirror back to the home directory and print a ready OCSB_RW_HOME line; writable, hidden and protected project paths are skipped - docs/known-issues.md: open gaps and planned work (Docker, blocklist egress, DNS, shared network namespace, resource limits, undo, planted repos, credentials, agents working around guards); linked from both READMEs
43 lines
2.0 KiB
Bash
43 lines
2.0 KiB
Bash
# shellcheck shell=bash
|
|
# opencode-sandbox doctor: dependencies and host setup
|
|
|
|
ocsb_doctor() {
|
|
local fail=0 c
|
|
ocsb_load_project --optional
|
|
echo "Required:"
|
|
for c in docker bwrap sg curl jq ncat git; do
|
|
if command -v "${c}" >/dev/null; then echo " ✓ ${c}"; else echo " ✗ ${c}"; fail=1; fi
|
|
done
|
|
local bin
|
|
bin=$(ocsb_opencode_bin)
|
|
if [[ -x ${bin} ]]; then
|
|
echo " ✓ opencode: ${bin} ($("${bin}" --version 2>/dev/null | head -1))"
|
|
elif [[ -z ${OCSB_PROJECT_DIR} ]]; then
|
|
echo " - opencode: not in PATH (fine if projects set OCSB_OPENCODE_BIN; run doctor inside a project to check)"
|
|
else
|
|
echo " ✗ opencode: ${bin:-not in PATH} (set OCSB_OPENCODE_BIN in sandbox.conf or put opencode in PATH)"
|
|
fail=1
|
|
fi
|
|
echo "Optional:"
|
|
command -v xdg-dbus-proxy >/dev/null && echo " ✓ xdg-dbus-proxy (notifications)" || echo " - xdg-dbus-proxy: no desktop notifications in the sandbox"
|
|
if ssh-add -l >/dev/null 2>&1; then echo " ✓ ssh-agent has keys"; else echo " - ssh-agent has no keys: git over SSH fails in the sandbox (ssh-add)"; fi
|
|
[[ -d ${OCSB_HOME}/plugins/context-panel/.git || -f ${OCSB_HOME}/plugins/context-panel/.git ]] &&
|
|
echo " ✓ plugins checked out" || echo " - plugins missing: git -C ${OCSB_HOME} submodule update --init"
|
|
echo "Host:"
|
|
if bwrap --ro-bind / / --dev /dev true 2>/dev/null; then echo " ✓ unprivileged bubblewrap works"
|
|
else echo " ✗ bubblewrap cannot create a sandbox (user namespaces disabled?)"; fail=1; fi
|
|
source "${OCSB_HOME}/lib/netlock.sh"
|
|
ocsb_netlock status
|
|
if [[ -n ${OCSB_PROJECT_DIR} ]]; then
|
|
echo "Project: ${OCSB_PROJECT_DIR} (name ${OCSB_NAME}, state ${OCSB_STATE_DIR})"
|
|
source "${OCSB_HOME}/lib/egress.sh"
|
|
ocsb_egress status
|
|
source "${OCSB_HOME}/lib/run.sh"
|
|
if ocsb_git_audit; then echo " ✓ no planted git metadata in the project and worktrees"; else fail=1; fi
|
|
ocsb_erofs_report
|
|
else
|
|
echo "Project: none here (opencode-sandbox init)"
|
|
fi
|
|
return ${fail}
|
|
}
|