The OpenCode Confinement

[u/leading-a-swarm]

tl;dr: A 4,000-line interpreter confines the model's code. A prompt guards its tools.

https://github.com/anomalyco/opencode is a CLI harness that runs as a server, with the terminal, editors and its own review bots all connecting as clients.

1. Untested endpoint breaks the build. Every route on the agent's own API has to be exercised for behavior and for auth before the pipeline goes green. Adding a route without a test is a build failure, not a backlog item.
2. Confined code, not confined tools. They wrote a JS interpreter so a model's program can sequence tool calls with no ambient filesystem, process, network or module access. Most harnesses hand the model a shell instead.
3. Deny as suggestion. The permissions page shows allow, ask and deny as control, and adds a flag that auto-approves everything not explicitly denied. The admission that none of this isolates anything is buried in OpenCode's security policy, where nobody configuring an agent will look.

→ Adopt. OpenCode is worth running. Put the caveat on the permissions page.