This OpenCode plugin wraps every bash command the agent runs in OS-level filesystem and network restrictions, using Anthropic's sandbox-runtime library. It uses native sandboxing instead of containers or virtual machines: Seatbelt profiles on macOS and bubblewrap namespace isolation on Linux. Windows commands are not sandboxed yet.
The sandbox enforces three layers. Writes are limited to the project directory, a validated Git worktree, and the system temp directory. Reads of credential locations such as SSH keys, GPG keys, cloud provider credentials, Kubernetes and Docker config, and package registry tokens are denied. Network traffic goes through a local proxy that allows only package registries, Git hosts, and the OpenAI, Anthropic, and Google API domains by default.
Configuration lives outside the project directory, so a sandboxed command cannot rewrite it, which stops indirect prompt injection from weakening the sandbox. Settings resolve from a JSON string, a per-project file, a global file, or the built-in defaults. In the default permissive mode, a command runs unsandboxed if the sandbox cannot start, and enforce mode blocks it instead.
The plugin hooks OpenCode's tool execution before and after each call, restores the original command in the UI and persisted history, and correlates sandbox violations with each tool call. The model reads sandbox errors directly from command output.
Features
- Filesystem write protection: writes allowed only in the project directory, worktree, and temp directory
- Credential read protection: SSH, GPG, cloud, Kubernetes, Docker, and registry credential locations are denied by default
- Network allowlist: a local proxy blocks every domain outside an editable allowlist
- Platform mechanisms: Seatbelt on macOS and bubblewrap on Linux, with no containers or VMs
- Layered configuration: global and per-project JSON config kept outside the sandboxed project
- Enforcement modes: permissive mode falls back to unsandboxed execution, and enforce mode blocks the command
- Deferred startup: the sandbox initializes on the first command, and diagnostics go to OpenCode's structured logger
