Allowlist
The process refuses to start with an open disk. Pass at least one root as a positional argument or as --allowed-paths. Missing roots exit 2. --bench may run without a sandbox. --insecure-open disables the sandbox (entire disk). Labs only. Do not combine it with a file-security pattern that contains a separator.
IsPathAllowed resolves symlinks with filepath.EvalSymlinks before the containment check. WSL paths use the same check. There is no blanket \\wsl.localhost\ bypass.
list_allowed_directories takes no parameters. Text and structured output include version, commit, and build date. Structured output also includes profile, roots mode, readonly, and tool count.
Client roots
Section titled “Client roots”--roots-mode controls how MCP client Roots combine with the CLI list.
| Mode | Default | Effect |
|---|---|---|
replace | yes | Client Roots replace the CLI list. |
union | no | CLI paths plus client Roots. Recommended for OpenCode. |
ignore | no | CLI list only. |
On Windows, file:///c%3A/temp becomes c:\temp. file://server/share/dir becomes \\server\share\dir. Reserved device names (CON, NUL, COM1–COM9, LPT1–LPT9, including NUL.txt) are rejected. NTFS alternate data streams (file.txt:stream) are rejected. 8.3 short names are not rewritten. ASCII controls and bidi / zero-width characters in paths are rejected.
delete_file, soft-delete, and move_file reject an allowlist root itself.
File security policy
Section titled “File security policy”--file-security-config adds an owner-controlled layer on top of the allowlist. Without the flag, behavior is unchanged. The file is loaded at startup and is immutable until restart. A missing, malformed, or invalid file exits 2.
| Level | List name | Read content | Mutate | Copy out |
|---|---|---|---|---|
normal | yes | yes | yes | yes |
read_only | yes | yes | no | yes |
protected | name, type, level only | no | no | no |
hidden | no | no (looks missing) | no | no |
The most restrictive matching rule wins (normal < read_only < protected < hidden). A directory rule is inherited by descendants. A child rule cannot weaken it. Patterns without / match the name at any depth. Patterns with separators are relative to each sandbox root (*, ?, **). \ is a separator. Absolute paths, .., $, ~, and character classes are rejected. Case follows the platform.
security_policy is read-only. It does not list patterns, protected paths, or the config location. force, allow_rewrite, and dry_run do not bypass the policy.
While a policy is active, git is unavailable, WSL sync and auto-sync are disabled, and .git trees are not readable through these tools. Path resolution for github_issues and gitlab_issues is refused. Pass repo (and base_url for GitLab) to skip local git.
The dashboard is a separate process. Pass it the same --file-security-config and --allowed-paths, or it can still serve backup bytes.
This policy is not an OS sandbox. Another shell or program with filesystem permission can still read the files. Hard links, concurrent external changes, and OS case-sensitivity differences are not fully closed.