chriswritescode-dev/opencode-manager v0.17.0

OpenCode Manager v0.17.0

on GitHub

What's Changed

Agent sandboxing (opt-in)

• feat(sandbox): KVM-backed agent sandboxing via microsandbox — OpenCode agent bash tool commands can now run inside an isolated microVM managed by msb instead of directly in the Manager container. OpenCode itself keeps running in the Manager with its normal config, providers, plugins, MCP servers, formatters, LSP servers and hooks; repositories are bind-mounted into the microVM at the same paths, so agent commands touch the same files under a separate kernel without access to Manager config, provider credentials, or SSH keys.
• Enforcement that fails closed — a generated POSIX shell shim is pinned as OpenCode's shell setting by the Manager-owned ocm-sandbox.js plugin, and the sandbox working directory is injected per bash spawn. Both are locked and verified so a later plugin cannot silently restore host execution; if the sandbox cannot be prepared, the tool call fails instead of running on the host.
• Commands are never rewritten — the agent's command reaches msb exec as a single argument, so recorded tool calls, permission rules and model context all keep the original command. Sandboxed calls carry sandbox tool metadata, shown as a badge in the message UI (metadata is not sent to the model).
• Sandbox settings panel — new Settings section to toggle sandboxing and optional git credential forwarding into the microVM.
• Sandbox guest image and overlay — Dockerfile.sandbox / docker.io/cstechdev/ocm-sandbox (ships gh, Playwright Chromium, node:24 toolchain) plus docker-compose.sandbox.yml for KVM access and persistent sandbox state. New env vars: SANDBOX_IMAGE, SANDBOX_MEMORY, SANDBOX_CPUS, SANDBOX_EXEC_USER, SANDBOX_NET, SANDBOX_START_TIMEOUT_MS, SANDBOX_EXEC_TIMEOUT_MS.
• Assistant capabilities routed through the ocm tool — settings, assistant reload, repos, git-info, workspaces, schedules and notifications now go through an allow-listed manager-side tool instead of curling the internal API with a bearer token (impossible under sandboxing). The .opencode/internal-token file and its tmpfs mask are gone, and attestation now rejects any tmpfs other than the runtime /tmp mount.
• Hardening — bounded OpenCode supervisor lifecycle queue (one running plus one pending, stop() exempt) so repeated restarts cannot stack unbounded HTTP requests; enforcement backups with no recoverable removed sections are rejected fail-closed; OpenCode installs through a private mktemp staging directory instead of the predictable /tmp/opencode path; the resolved OpenCode binary is used and its installed version verified; opencode upgrades persist across rebuilds.
• Docs: new Agent Sandboxing page plus Docker, environment, assistant-mode and troubleshooting updates.

Navigation

• feat(navigation): add Home to nav drawer and move sidebar collapse toggle to top — Home is reachable from the mobile nav drawer, and the desktop sidebar collapse control moved to the top of the sidebar.
• fix(sidebar): wire new-session and new-schedule actions to every page — /assistant never registered a listener for the sidebar's new-session event, so the desktop CTA was a no-op there; the Schedules pages had the same gap for new-schedule. useSidebarAction is now the single source of truth for action keys and dispatch, and warns when an action fires with no mounted handler instead of failing silently.

Bug fixes

• fix(files): root file browser at repo directory instead of display name — the file browser now roots at the actual repository directory rather than its display name, so browsing works for repos whose display name differs from the folder on disk.

Full Changelog: v0.16.2...v0.17.0