anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #5864] Add Protected Mode for macOS #11620

New Issue
Open
opened 2026-02-16 18:16:30 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:16:30 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/5864

State: open
Merged: No

Addresses Issue #5076

Problem

AI agents in OpenCode have full filesystem access, creating security risks for credentials and sensitive files. Recent vulnerabilities (including the Antigravity credential leak) demonstrate that prompt-level protections are insufficient to prevent AI from accessing and leaking credentials.

Solution

Protected Mode uses Unix file permissions to enforce file restrictions at the kernel level. Commands run as a restricted user (opencode-agent) that cannot read protected files. Even if prompt injection succeeds, the OS blocks unauthorized access before data is read.

Demo

OpenCodeProtectDemo

Commands

opencode protect setup
Creates the opencode-agent user, initializes ~/.opencode/security.json, configures sudo rules

opencode protect lock
Applies protections to files specified in security.json

opencode protect status
Shows currently protected files and security configuration state

How It Works

File Protection via Unix Permissions

Users specify sensitive files in .opencode/security.json. The setup modifies file permissions (chmod 600) to make files owner-only readable, preventing the opencode-agent user from accessing them. These restrictions are enforced at the kernel level—even successful prompt injection cannot bypass OS security.

Command Whitelisting

Development commands may be committed via a sudo wrapper with explicit allow-lists. This is particularly important for commands like git which enforce particular permissions. Users can configure which commands the agent can run without additional restrictions, balancing security with workflow convenience.

Potential Roadmap

File protection is only one step toward making OpenCode the most secure AI coding agent. Clear next steps include:

  • Linux support
  • Network isolation
  • Full sandboxing (sandbox-exec for macOS, bubblewrap for Linux)

Implementation

~1,000 lines within the src/util/security module
~70 lines integration

Duplication Note:
The protected executor duplicates ~100 LOC from bash.ts (process management, timeout handling, result formatting). Kept separate in this PR to maintain focus on the security feature. Happy to propose a refactor extracting shared utilities if desired.

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/5864 **State:** open **Merged:** No --- Addresses Issue #5076 ### Problem AI agents in OpenCode have full filesystem access, creating security risks for credentials and sensitive files. Recent vulnerabilities (including the Antigravity credential leak) demonstrate that prompt-level protections are insufficient to prevent AI from accessing and leaking credentials. ### Solution Protected Mode uses Unix file permissions to enforce file restrictions at the kernel level. Commands run as a restricted user (opencode-agent) that cannot read protected files. Even if prompt injection succeeds, the OS blocks unauthorized access before data is read. ## Demo ![OpenCodeProtectDemo](https://github.com/user-attachments/assets/77a94845-dbfb-4f0b-ab07-a2e0ea685fda) ## Commands **`opencode protect setup`** Creates the opencode-agent user, initializes ~/.opencode/security.json, configures sudo rules **`opencode protect lock`** Applies protections to files specified in security.json **`opencode protect status`** Shows currently protected files and security configuration state ## How It Works ### File Protection via Unix Permissions Users specify sensitive files in `.opencode/security.json`. The setup modifies file permissions (chmod 600) to make files owner-only readable, preventing the opencode-agent user from accessing them. These restrictions are enforced at the kernel level—even successful prompt injection cannot bypass OS security. ### Command Whitelisting Development commands may be committed via a sudo wrapper with explicit allow-lists. This is particularly important for commands like git which enforce particular permissions. Users can configure which commands the agent can run without additional restrictions, balancing security with workflow convenience. ## Potential Roadmap File protection is only one step toward making OpenCode the most secure AI coding agent. Clear next steps include: * Linux support * Network isolation * Full sandboxing (sandbox-exec for macOS, bubblewrap for Linux) ## Implementation ~1,000 lines within the src/util/security module ~70 lines integration Duplication Note: The protected executor duplicates ~100 LOC from bash.ts (process management, timeout handling, result formatting). Kept separate in this PR to maintain focus on the security feature. Happy to propose a refactor extracting shared utilities if desired.
yindo added the pull-request label 2026-02-16 18:16:30 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#11620
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?