anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

OpenCode crashes when no permissions to read .env in project root #5332

New Issue
Open
opened 2026-02-16 17:51:27 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 17:51:27 -05:00
Owner
Copy Link
Copy Source

Originally created by @robbash on GitHub (Jan 13, 2026).

Originally assigned to: @rekram1-node on GitHub.

Description

Accepting the fact that one can get around OpenCode's permission settings using CLI commands, I'm running it in a sandbox using Apple's sandbox-exec. (See https://github.com/anomalyco/opencode/issues/2242)

Narrowing down the rules to prevent access to the .env* files by sandbox-exec, I found that a .env file in the project root results in an unexpected error.

DOMException {
  line: 236100,
  column: 29,
  sourceURL: "/$bunfs/root/src/index.js",
  stack: "postMessage@[native code]\n@/$bunfs/root/src/index.js:236100:29\nPromise@\ncall@/$bunfs/root/src/index.js:236098:27\n@/$bunfs/root/src/index.js:236212:23\nprocessTicksAndRejections@",
  code: 11,
  name: "InvalidStateError",
  message: "Worker has been terminated",
  ...
}

For simpler replication, I tried to deny access via file system permissions. Even though cat is not allowed to show the content when executed, OpenCode did not run into the error.

I understand it's quite an edge case, but since it's a sensitive area and hoping handling errors when reading the .env in the project root is simple enough, a fix would be appreciated! Alternatively, a config flag to avoid loading .env files in the project folder would also be great.

Thanks, for this, and the whole OpenCode tool - it's awesome!

Plugins

Standard (opencode-copilot-auth@0.0.11, opencode-anthropic-auth@0.0.8)

OpenCode version

1.1.10

Steps to reproduce

  1. On macOS, set up sandbox-exec ie. by using this config file.
  2. Create an empty folder, and change into that folder
  3. Create a .env file (can be empty)
  4. Start sandboxed OpenCode inside that "project folder" with TMPDIR=/tmp sandbox-exec -f ~/.opencode-sandbox.sb opencode (where ~/.opencode-sandbox.sb is the sandbox config)
  5. The issue should appear immediately

Move the .env into a sub-folder and things should be fine.

Screenshot and/or share link

No response

Operating System

macOS Tahoe 26.1

Terminal

kitty

Originally created by @robbash on GitHub (Jan 13, 2026). Originally assigned to: @rekram1-node on GitHub. ### Description Accepting the fact that one can get around OpenCode's permission settings using CLI commands, I'm running it in a sandbox using Apple's `sandbox-exec`. (See https://github.com/anomalyco/opencode/issues/2242) Narrowing down the rules to prevent access to the `.env*` files by `sandbox-exec`, I found that a `.env` file in the project root results in an unexpected error. ``` DOMException { line: 236100, column: 29, sourceURL: "/$bunfs/root/src/index.js", stack: "postMessage@[native code]\n@/$bunfs/root/src/index.js:236100:29\nPromise@\ncall@/$bunfs/root/src/index.js:236098:27\n@/$bunfs/root/src/index.js:236212:23\nprocessTicksAndRejections@", code: 11, name: "InvalidStateError", message: "Worker has been terminated", ... } ``` For simpler replication, I tried to deny access via file system permissions. Even though `cat` is not allowed to show the content when executed, OpenCode did not run into the error. I understand it's quite an edge case, but since it's a sensitive area and hoping handling errors when reading the `.env` in the project root is simple enough, a fix would be appreciated! Alternatively, a config flag to avoid loading `.env` files in the project folder would also be great. Thanks, for this, and the whole OpenCode tool - it's awesome! ### Plugins Standard (opencode-copilot-auth@0.0.11, opencode-anthropic-auth@0.0.8) ### OpenCode version 1.1.10 ### Steps to reproduce 1. On macOS, set up `sandbox-exec` ie. by using this [config file](https://gist.github.com/robbash/84aaa7c4133535b59cbaf0c1761031a4). 2. Create an empty folder, and change into that folder 3. Create a .env file (can be empty) 4. Start sandboxed OpenCode inside that "project folder" with `TMPDIR=/tmp sandbox-exec -f ~/.opencode-sandbox.sb opencode` (where `~/.opencode-sandbox.sb` is the sandbox config) 5. The issue should appear immediately Move the `.env` into a sub-folder and things should be fine. ### Screenshot and/or share link _No response_ ### Operating System macOS Tahoe 26.1 ### Terminal kitty
yindo added the bug label 2026-02-16 17:51:27 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#5332
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?