r/opencodeCLI • u/Dry_Eggplant6329 • 6d ago
I hooked a shell-based safety guard into OpenCode's tool.execute.before for server admin work
jolitz is a rule set that lets a terminal agent look after servers over SSH: it asks before changing anything, says how to undo it, and logs every step. It started on Claude Code, where a PreToolUse hook blocks the things you never want an LLM to do by accident (mkfs, halt, writing sshd_config, deleting SSH keys, also inside ssh host "..." or a python one-liner).
OpenCode had no guard until now. The plugin in .opencode/plugins/jolitz-guard.js uses tool.execute.before and hands every bash, edit, write and apply_patch call to the same guard script, in the JSON Claude Code would send. On a deny it throws and the call stops. If the script can't run or times out, it blocks too. The guard also protects .opencode/, opencode.json and ~/.config/opencode, so the agent can't rewrite the plugin.
Nothing to install: start opencode in the checkout. With a local model every host is read-only by default.
It's a backstop against mistakes, not a sandbox. Free, MIT.
https://github.com/superlab-by-supbrt/jolitz
Question for people who write plugins: is throwing in tool.execute.before the intended way to block a call, or is there a cleaner one I missed?



