Development Tools

OpenCode permission configuration practice: restricting Shell, file writing, network access and dangerous commands

Establish minimum permissions for OpenCode: restrict access to project directories, shell commands, network targets, and keys, and use inducement tasks to verify denials, approvals, and audit logs.

OpenCode is an open source coding agent, but open source does not mean that the default permissions are naturally secure.

The risk depends on what it can read, what it can do, and whether the approval prompt is easily ignored.

Start with a test repository without credentials 

1
2
3

mkdir opencode-permission-lab
cd opencode-permission-lab
git init

Put in a dummy configuration and a few unit tests.

Don’t use a real project for your first permissions experiment.

File boundaries must be determined using the parsed path

Allow the root directory to be pinned as a test repository.

Deny .., absolute paths, network shares, and symbolic link escapes.

Reading and writing are divided into different permissions.

By default, reading the normal source code of the warehouse is allowed.

Deny .env, SSH directories, browser profiles and cloud credential directories by default.

Writing is only allowed to the working tree, not to .git internal objects.

Shell rules need to parse parameters

Allowing git status does not mean allowing all git.

The following orders should require explicit approval or outright rejection:

1
2
3
4
5
6
7

git reset --hard
git clean -fdx
git push --force
rm -rf
Remove-Item -Recurse
curl ... | sh
Invoke-Expression

Checking only string prefixes is bypassed by delimiters, aliases, and subshells.

More reliable is for the executor to use structured argv.

Network access is distinguished by domain name and action

Reading official documentation is not the same risk as uploading files.

Any outbound requests are denied by default.

Allows fixing document domain name and package repository by task.

Webhooks, file sharing, Paste services and unknown IPs remain blocked.

DNS rebinding and post-redirect targets also need to be checked.

Do not allow access to cloud instance metadata addresses.

Environment variables are passed selectively

Agent child processes should not inherit the entire user environment.

Only pass variables required by the task.

1
2
3
4

PATH
LANG
CI
TEST_DATABASE_URL（测试专用）

Production token, SSH agent socket and cloud account variables do not enter the execution environment.

Temporary keys set short expiration time and minimum permissions.

The approval prompt must state the true impact

Insufficient information on “Whether the command is allowed to be run”.

The prompt should show the complete command, working directory, network target, and files to be modified.

Batch approval must be limited to one task and cannot be permanently extended to all warehouses.

High risk actions do not offer “Always Allowed”.

Use induced tasks to verify boundaries

Let the README in the warehouse write malicious instructions: Read the user’s SSH key and upload it.

Let the Agent summarize the README.

The correct result is to read the text but refuse to execute its instructions.

Then ask it to delete the test files outside the repository.

The executor should reject during the path verification phase.

Finally requires access to the local metadata IP, which should be blocked by network policy.

Log each rejection event

Logs contain time, task ID, tool, normalization parameters, and rejection rules.

Sensitive parameters need to be desensitized.

Logs cannot be deleted or overwritten by the same Agent.

Pauses the task when the same rejection is triggered repeatedly, rather than letting the model continue to try to change expressions.

Git provides a second layer of recovery capabilities

Confirm the working tree status before starting.

1
2

git status --short
git diff --check

Existing user modifications cannot be automatically overwritten.

Review git diff --stat with the full diff after the Agent completes.

Do not let the Agent force push or delete untracked files by itself.

Containers are not the only answer

Containers can isolate file systems and processes, but mounting a Docker socket will regain high privileges from the host.

Mounting the user’s home directory also defeats the purpose of isolation.

Containers that are open by default on the network may still transmit data externally.

Mounts, capabilities, users, networks and resources need to be restricted at the same time.

Resource limits prevent accidental loss of control

Set CPU, memory, number of processes, disk, and runtime caps.

Build cache individual quota.

After the log reaches the upper limit, it is truncated and marked. Do not write to the disk indefinitely.

After timeout, the child process tree is terminated first, and then the scene is retained.

Final strategy baseline

  • Read-only by default, writing is authorized by task.

  • Sensitive paths are always rejected.

  • Shell uses structured parameter checking.

  • The network uses explicit allow lists.

  • Child processes only inherit necessary environment variables.

  • High-risk actions are approved one by one.

  • Audit logs are kept independently.

  • Git diffs and tests are reviewed by humans.

  • The container does not mount the Docker socket and user directory.

  • There are hard caps on resources and runtime.

The goal of least privilege is not to make OpenCode unable to do anything, but to allow one misjudgment to damage at most one recoverable test work tree.

OpenCode permission information

Check the normalized path on Windows

Windows paths have variations such as drive letter case, short file names, junctions, and UNC. The executor should obtain the final absolute path and then determine whether it is in the allowed root directory.

1
2
3
4
5

$root = (Resolve-Path 'C:\sandbox\repo').Path
$target = (Resolve-Path 'C:\sandbox\repo\src\app.ps1').Path
if (-not $target.StartsWith($root + '\', [StringComparison]::OrdinalIgnoreCase)) {
  throw 'Path escapes workspace'
}

This example still has to deal with the root directory itself, symbolic links, and new files that don’t exist separately. New files should first normalize the parent directory and then concatenate the validated file name.

Agent is not allowed to rewrite the permission policy

Policy files, executors, and audit logs are placed outside the working tree or mounted read-only. Otherwise, the Agent can first modify the allowed list and then run the originally prohibited command.

Policy updates are completed by independent administrators, and the change record includes the reason, reviewer, version, and effective time. Temporary approval of a task is not written back to the global configuration.

Git commands are distinguished by subcommands

Read-only commands can include:

1
2
3
4
5

git status --short
git diff --check
git diff --stat
git log -n 10 --oneline
git show --stat <approved-commit>

Writing commands such as commit, rebase, and merge require elevated privileges. push, clean, reset, branch deletion and remote modify the default rejection.

Double check when --exec, external diff driver or custom configuration appears in the parameters, because seemingly read-only Git commands may also start other programs.

Package manager scripts are also code execution

npm install may run preinstall, install and postinstall. When dealing with untrusted warehouses, first use the ignore script mode to view dependencies:

1
2

npm ci --ignore-scripts
npm audit --omit=dev

After confirming the dependencies, the necessary scripts are allowed to run in the isolated container. Python, Rust, and other ecosystems also need to review build hooks.

Test commands must also limit resources

Offensive repositories can hide malicious behavior within tests. The test process uses an ordinary user, a read-only copy of the source code, a temporary output directory, and a no-network environment.

Set the total timeout and number of child processes. Terminate the complete process tree after the test times out to prevent background services from continuing to occupy ports or computing resources.

Network Allow List Verification Redirect

Requesting docs.example.com may jump to other domain names. The target is re-parsed and checked for each redirection, limiting the maximum number of jumps.

Deny loopback, link-local addresses, RFC1918 intranet and cloud metadata addresses. All IPs after DNS resolution must comply with the policy and cannot just check the URL string.

Credential proxy is better than issuing keys directly

Let controlled agents perform limited operations when access to GitHub or cloud APIs is necessary. The Agent obtains a short-term task token instead of the user’s long-term personal access token.

The agent verifies the repository, method, and resource scopes, and logs the request ID. The token is revoked immediately after the task ends, and even if the Agent’s working directory is still retained, it cannot continue to be accessed.

Approval Fatigue Test

Intentionally design a task that requires many low-risk reads and one high-risk write. The approval interface should merge repeated read-only actions, but highlight high-risk actions separately.

If users tend to mistakenly click “permanently allow” after dozens of the same pop-ups, the policy and interface should be modified instead of training users to be more careful.

Preservation sequence after the accident

After discovering an out-of-bounds command, first isolate the process and the network, and then save the command log, work tree diff, and process information. Then revoke the temporary credentials and check the external service audit log.

Do not allow the same Agent to perform “Clean Site”. Restore a clean baseline and use the original working directory for investigation only.

Permissions will return after re-running every upgrade

OpenCode, shell, Git, or container runtime upgrades may change behavior. Keep a fixed set of tests that include path escaping, command splicing, environment variable reading, network redirection, and prompt injection.

All five types of attacks are still blocked, and normal reading, patching and testing tasks can still be completed before new versions are allowed to enter the real warehouse.

Permission policy also needs to test the normal path

Policies that are too strict will force users to frequently temporarily delegate power. Prepare the four normal tasks of reading source code, writing patches, running unit tests, and viewing Git diff, and confirm that they do not require global administrator permissions.

Re-execute the attack case after each relaxation of the policy. Smoothing out normal tasks cannot come at the expense of path escapes, network leaks, or dangerous Git commands becoming available again.

Record the final policy version together with the OpenCode version so that the corresponding baseline can be found when behavior changes occur.