k.denisov
01fc1627c1
- read-only in the sandbox: .opencode-sandbox/, .cc-safety-net/, .git/hooks, .git/config, an in-project core.hooksPath, the egress rules and the safety-net home; .git is pinned by a bind onto itself so it cannot be swapped - only trusted projects are loaded (init / trust): a .opencode-sandbox/ in a worktree or a subdirectory is no longer sourced on the host - run (before and after the session) and doctor report planted .git entries, redirected worktrees and per-worktree overrides - hide Firefox, Claude, VS Code, Cursor and Codex configs
42 lines
1.9 KiB
Bash
42 lines
1.9 KiB
Bash
# shellcheck shell=bash
|
|
# opencode-sandbox doctor: dependencies and host setup
|
|
|
|
ocsb_doctor() {
|
|
local fail=0 c
|
|
ocsb_load_project --optional
|
|
echo "Required:"
|
|
for c in docker bwrap sg curl jq ncat git; do
|
|
if command -v "${c}" >/dev/null; then echo " ✓ ${c}"; else echo " ✗ ${c}"; fail=1; fi
|
|
done
|
|
local bin
|
|
bin=$(ocsb_opencode_bin)
|
|
if [[ -x ${bin} ]]; then
|
|
echo " ✓ opencode: ${bin} ($("${bin}" --version 2>/dev/null | head -1))"
|
|
elif [[ -z ${OCSB_PROJECT_DIR} ]]; then
|
|
echo " - opencode: not in PATH (fine if projects set OCSB_OPENCODE_BIN; run doctor inside a project to check)"
|
|
else
|
|
echo " ✗ opencode: ${bin:-not in PATH} (set OCSB_OPENCODE_BIN in sandbox.conf or put opencode in PATH)"
|
|
fail=1
|
|
fi
|
|
echo "Optional:"
|
|
command -v xdg-dbus-proxy >/dev/null && echo " ✓ xdg-dbus-proxy (notifications)" || echo " - xdg-dbus-proxy: no desktop notifications in the sandbox"
|
|
if ssh-add -l >/dev/null 2>&1; then echo " ✓ ssh-agent has keys"; else echo " - ssh-agent has no keys: git over SSH fails in the sandbox (ssh-add)"; fi
|
|
[[ -d ${OCSB_HOME}/plugins/context-panel/.git || -f ${OCSB_HOME}/plugins/context-panel/.git ]] &&
|
|
echo " ✓ plugins checked out" || echo " - plugins missing: git -C ${OCSB_HOME} submodule update --init"
|
|
echo "Host:"
|
|
if bwrap --ro-bind / / --dev /dev true 2>/dev/null; then echo " ✓ unprivileged bubblewrap works"
|
|
else echo " ✗ bubblewrap cannot create a sandbox (user namespaces disabled?)"; fail=1; fi
|
|
source "${OCSB_HOME}/lib/netlock.sh"
|
|
ocsb_netlock status
|
|
if [[ -n ${OCSB_PROJECT_DIR} ]]; then
|
|
echo "Project: ${OCSB_PROJECT_DIR} (name ${OCSB_NAME}, state ${OCSB_STATE_DIR})"
|
|
source "${OCSB_HOME}/lib/egress.sh"
|
|
ocsb_egress status
|
|
source "${OCSB_HOME}/lib/run.sh"
|
|
if ocsb_git_audit; then echo " ✓ no planted git metadata in the project and worktrees"; else fail=1; fi
|
|
else
|
|
echo "Project: none here (opencode-sandbox init)"
|
|
fi
|
|
return ${fail}
|
|
}
|