fix(jail): expose the opencode install root inside the fs-jail - #164
Merged
Conversation
opencode installs itself under $HOME, and an fs-jail deliberately hides /home. A jailed opencode run therefore exits 127 on a binary that exists: opencode exited 127: timeout: failed to run command '/home/<user>/.opencode/bin/opencode': No such file or directory `toolchainReadPaths` reaches the install root only when the on-PATH entry realpaths into it. An operator whose `opencode` is a wrapper script elsewhere realpaths to the wrapper's own directory, so the install root stays hidden. The install root is a fixed property of this harness, so the backend declares it. `OPENCODE_INSTALL_DIR` is honoured for a moved install. `registerJailReadable` stays a no-op when reads are not confined. Measured: 12 consecutive opencode runs failed this way and the seat was recorded as an unusable harness. With the path exposed the same profile completes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was wrong
opencode installs itself under
$HOME(~/.opencode/bin/opencode). An fs-jail deliberately excludes/home. A jailed opencode run therefore exits 127 on a binary that exists:toolchainReadPathsalready tries to expose the CLI's install root, but it only reaches it when the on-PATH entry realpaths into it. An operator whoseopencodeis a symlink to a wrapper script elsewhere realpaths to the wrapper's directory, so the install root stays hidden.BRIDGE_JAIL_RO_PATHScan paper over this, but only after the operator has diagnosed a 127 that names a file which is plainly present.Why the backend should declare it
The install root is a fixed property of this harness, exactly like the MCP config dir the claude backend registers. Leaving it to per-operator config makes every new machine rediscover the same 127.
Impact measured here
12 consecutive opencode runs failed this way. The seat was recorded as an unusable harness with a "capability gap" — two conclusions that were both wrong. With the path exposed, the same AgentProfile completes normally (
finish_reason: stop).Verification
New test
tests/opencode-jail-binary.test.ts, three cases: install root exposed underreadConfine;OPENCODE_INSTALL_DIRhonoured when the install moved; nothing registered when reads are not confined.Fails without the fix, passes with it:
Full suite:
typechecktestOne thing worth knowing
A fresh
pnpm install --frozen-lockfilein a worktree leavesbetter-sqlite3unbuilt, and the suite then reports 119 failures across 15 files that are pure environment.pnpm rebuild better-sqlite3clears all of them. Anyone baselining this repo should run that first or they will chase phantom regressions.🤖 Generated with Claude Code