- /tmp: the agent gets its own (<state>/tmp, files older than 7 days are
removed on start) — the host's /tmp holds sockets that lead out of the
sandbox (tmux, X11, browsers' singleton sockets, other tools).
OCSB_TMP=shared keeps the old behaviour. /tmp is mounted before the
project and state binds so they stay visible if they live under /tmp
- DISPLAY, WAYLAND_DISPLAY, XAUTHORITY are empty in the sandbox and
~/.Xauthority is hidden; browsers must run headless
- GIT_SSH_COMMAND uses -F ~/.ssh/config: in the user namespace root-owned
system ssh configs look owned by nobody and ssh refuses them
- netlock self-test checks that the proxy opens the tunnel, not that a
remote site answers; failed self-tests now say so instead of exiting
silently
- doctor: no false error for opencode outside a project
- skill and READMEs: worktrees only for code changes, private /tmp,
headless browsers, troubleshooting entries
k.denisov
6dec88641a