OpenCode is available as a proof third engine, but only for an explicit read-only, network-off profile. It is not a substitute for the Claude or Codex confinement paths.
The current official OpenCode permissions documentation states that the shell action runs with the host user's filesystem, process, and network authority. It also says the shell resource is raw command text, external arguments receive only best-effort warnings, and the external-directory boundary applies to the shell working directory rather than every path passed to a command:
Those rules are model-tool policy, not an OS-level sandbox. The gateway therefore does not
expose OpenCode shell, edit, web, subagent, LSP, code-execute, skill, external-directory, or MCP
actions. --pure disables external plugins. The inline config carries both stable V1
permission/agent and current V2 permissions/agents forms; both the global policy and the
selected gateway-readonly agent default-deny every action, then allow only workspace-local read,
glob, grep, and list while denying .env reads. Requests for gateway write mode, network access, admin bypass, or MCP are
rejected before process spawn. Unknown capabilities remain denied by the adapter contract.
Like every engine, OpenCode is spawned through the shared runtime target inside the channel's rootless Podman container. Container mounts and process isolation provide the OS boundary; OpenCode's read-action policy restricts access within that boundary. The network-off setting is enforced by the channel's egress proxy (the container has no network of its own) unless the gateway runs its legacy bridge egress mode. Broader adapter admission still requires its own acceptance evidence; the container does not make unsupported tools or permissions available.
The official CLI documents opencode run, raw JSON events with --format json, session continuation
with --session, model selection with --model, model variants with --variant, attachments with
--file, plugin suppression with --pure, and --version:
The adapter consumes those JSON events for text deltas, session identity, token usage, and reported
cost; resumes with the emitted session ID; uses the shared inactivity watchdog; and cancels the
detached process group on AbortSignal. It intentionally performs no MCP discovery and passes no
gateway/Composio/Skills/Toolbox credential bundle.
| Capability | OpenCode proof adapter |
|---|---|
| Workspace read/glob/grep/list | Supported |
| Structured JSON stream | Supported |
| Session identity and resume | Supported |
| Cancellation and stall watchdog | Supported |
| Usage and CLI-reported cost | Supported |
| Health/version | Supported |
| Filesystem writes or shell | Refused |
| Model tool network access | Refused |
| Admin/bypass mode | Refused |
| MCP and external plugins | Omitted/refused |
| OS-level confinement | Shared per-channel rootless Podman runtime; mount policy applies |