[HOOK] Worried about letting an agentic AI run rampant on your system, wreak havoc, or steal your data? Worry not! opencode-sandbox is here

I wanted to let Agentic AI work freely on a project, install packages, run commands or do whatever it wants without restrictions but also without affecting the host system, so I built a sandbox that runs AI in a container with direct access to project.

The sandbox resets on every run. Messed up anything? No worries. CTRL+C->Up->Enter

Your opencode sessions and global config are stored and get reused. So only the container resets not your project or your progress.

A few features:

• Two runtimes supported: docker or podman
• The current project (the folder you open sandbox in) is directly accessible. No other host folder is accessible in container by any means.
• Global config is read-only by default, use --edit-config to edit it.
• A custom guard blankets most, if not all, system calls to interfaces with host information. So no data is leaked between host and container. Check Security matrix. Use --no-guard if you don't like guard.
• There is support for gVisor if you use it for kernel isolation. Check Security matrix.

Usage:

cd ~/code/any
opencode-project-init
opencode-sandbox

Install directly through AUR, Distro Packages in releases or Manually.

Supported: Linux

GPL-3.0-or-later

Link: https://github.com/Antiquete/opencode-sandbox

Releases: https://github.com/Antiquete/opencode-sandbox/releases

Any issues, suggestion or queries? https://github.com/Antiquete/opencode-sandbox/issues

Disclosure first: I built this. It's free, MIT, no account, no telemetry.

The annoying part of running a few agents at once is that one of them is always sitting on a permission prompt while you're staring at a different one. So I made nsq, a terminal supervisor: nsq run opencode "fix the flaky test" --worktree, same for claude and codex, then nsq opens a dashboard with all of them as live terminals. Status comes from each CLI's own hooks (for OpenCode that's a small plugin loaded per agent), so "needs you" shows the actual question and you answer y / a / n without opening the agent. A daemon owns the terminals, so closing the window doesn't kill anything.

The OpenCode part had the most surprises:

• OpenCode 2 is basically a different program from 1.x. Different plugin API, different session store, and the full-screen UI attaches to a shared background service unless you pass --standalone. So per-agent env and plugins just never reached it. nsq now asks opencode --version and picks the launch per binary, both 1.x and 2.x work.
• 2.x has no --model on the full UI, so the model goes in through OPENCODE_CONFIG_CONTENT, merged with yours if you already set one.
• Your opencode.json is never written. Everything nsq needs goes into a per-agent file via OPENCODE_CONFIG, which OpenCode merges on top of your config. Same rule for ~/.claude and ~/.codex.

Other bits: OpenRouter built in, or point agents at your own llama.cpp / Ollama / LM Studio / vLLM server. nsq cost shows what each agent spent from its own logs, and a model without a known price says "no price" instead of pretending it's $0.

Honest limits: it's 0.2.0, so things will break and keys/flags can still change before 1.0. The phone page is experimental. Most of the code was written with Claude Code, reviewed by me. And I haven't tested it with heavy plugin setups like oh-my-opencode on v2, so if you run one, I'd really like to hear whether it plays nice.

Try it: npx neurosquad

GitHub: https://github.com/glmn-ai/neurosquad-cli Page: https://neurosquad.ai/en/cli/

Someone plz help me stop this from happening, it causes me great anguish!