You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat: add bwopencode2 sandbox launcher for OpenCode 2 - #24
feat: add bwopencode2 sandbox launcher for OpenCode 2
Summary
Adds bin/bwopencode2, the bubblewrap sandbox launcher for OpenCode 2
(command opencode2, npm @opencode/cli), parallel to bin/bwopencode
(OpenCode 1). It reuses lib/bwrap_sandbox_lib.sh and keeps the same wrapper
options (--help, --dry-run, --exec, --new-session, --ro-path, --rw-path, --github-tokens). --init-auth is dropped (see below).
README, docs/bw-wrappers.md and AI_DISCLOSURE.md are updated.
Parallel to bwopencode for the opencode2 command. Uses separate opencode2 XDG dirs, forces --standalone and refuses server-related options so tools cannot run in an unsandboxed background service.
Assisted-by: opencode:claude-sonnet-5-5
Resolve config entries, git includes and the XDG git/pixi/ccache dirs with realpath before the blocked-path check, so a symlinked parent cannot hide a blocked target. bwopencode2 links the XDG git config to the real mount so relative includes resolve. Add a shared bwrap_resolve_tool and account check for all launchers.
Assisted-by: opencode:claude-sonnet-5-5
…antics
The ansible opencode2 wrapper runs the binary from /opt/nsls2/opencode2, which the sandbox did not mount. Git include paths are no longer collapsed lexically: directories walked before a .. are created, and a symlinked directory before a .. mounts the include at its real path only.
Assisted-by: opencode:claude-sonnet-5-5
Mount only allowed_signers, config, ignore and attributes from ~/.config/git (never the directory, never credentials). Recreate symlinked directories on git include paths so .. resolves as on the host. Skip entries that resolve into blocked locations with a warning; ~/.ssh is never mounted.
Assisted-by: opencode:claude-sonnet-5-5
…reated dirs
Treat only the /etc directories actually bound as present in the sandbox. Skip recreating a host symlink whose destination is already a directory in the sandbox mount list (for example ~/.config) and fall back to a warning, mounting includes at their lexical path where safe.
Assisted-by: opencode:claude-sonnet-5-5
…s; refuse dirs containing blocked paths
Deduplicate git includes by raw path, follow nested includes (depth 10, cycle-safe), treat a symlink that is itself a bind root as a conflict, and refuse a working directory or extra path that contains a blocked location.
Assisted-by: opencode:claude-sonnet-5-5
Add ~/.git-credentials and $XDG_CONFIG_HOME/git/credentials to the blocked list so whole-dir and explicit mounts refuse them. Track parsed git includes by the path as opened so symlinked configs sharing a target are all followed.
Assisted-by: opencode:claude-sonnet-5-5
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Credential-exposure paths and configuration-handling regressions remain unresolved.
No open issues 🎉
1 previously missed issue
In code that hasn't changed since last review
Decode quoted Git include paths before selecting mounts
lib/bwrap_sandbox_lib.sh:1760
A valid Git include such as path = "work.conf" now loses its settings when work.conf is in the XDG Git directory. parse_git_includes retains the quotes, so it does not record the file, and this four-file mount omits it. Previously the whole-directory mount made it available. Decode Git's quoted and escaped include values before relying on the parser to select mounts; this regression affects all five wrappers.
Decode include path values the way git does (double quotes, escapes, trailing comments, case-insensitive key) before choosing mounts, so a quoted include in ~/.config/git is found, and a quoted include of a blocked file is refused.
Assisted-by: opencode:claude-sonnet-5-5
The blocked list held literal paths while callers compare canonical ones, so a symlinked ~/.config/git, ~/.git-credentials, ~/.ssh or ~/.config let a blocked file through --ro-path, --rw-path or a git include. List each entry both as written and at its resolved target.
Assisted-by: opencode:claude-opus-5-5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
feat: add bwopencode2 sandbox launcher for OpenCode 2
Summary
Adds
bin/bwopencode2, the bubblewrap sandbox launcher for OpenCode 2(command
opencode2, npm@opencode/cli), parallel tobin/bwopencode(OpenCode 1). It reuses
lib/bwrap_sandbox_lib.shand keeps the same wrapperoptions (
--help,--dry-run,--exec,--new-session,--ro-path,--rw-path,--github-tokens).--init-authis dropped (see below).README,
docs/bw-wrappers.mdandAI_DISCLOSURE.mdare updated.