Repository navigation
fix: guard opencode state against missing volumes and agent deletes - #23
Merged
Merged
Conversation
…eates The entrypoint now exits when $HOME (/data) is not a mountpoint, so sessions, credentials, and logs can never land in the container layer. The smoke test runs both servers on a named volume, then recreates the OpenCode container and checks that a session, the server log, and the config and state directories survive. OpenChamber chats move to /data/workspace/.chats so agent sessions no longer run with a working directory inside /data/.config. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Build and General now ask before rm commands that name a .config or .local path, and AGENTS.md forbids deleting /data/.config or /data/.local. The README lists what lives where under /data and how to restore it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The suffix patterns missed rm -rf .config .local .cache, where neither protected directory is last or followed by a slash. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
Common deletion forms bypass the new permission rules, and the mount requirement masks existing password-validation tests.
2 open findings
What changed in this PR
Adds persistence safeguards for OpenCode and OpenChamber state.
Changes:
- Requires
/datato be mounted and documents persisted state. - Adds recreation-based persistence smoke testing.
- Relocates chats and adds agent deletion guards.
| File | Description |
|---|---|
AGENTS.md |
Prohibits deleting persistent state. |
Dockerfile |
Relocates managed chats. |
README.md |
Documents persistence and safeguards. |
entrypoint.sh |
Enforces the /data mount. |
opencode.jsonc |
Adds deletion confirmation rules. |
scripts/smoke-test.sh |
Tests mounts and persistence. |
tests/routing.test.mjs |
Verifies agent rules. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Adds ask rules for rm commands naming HOME (including XDG_*_HOME), ~, or ending in /data. The integration test now matches each rule's resource as well as its action, and checks ask/allow decisions for sample commands against the agents the server reports. The negative password runs mount a volume, so they fail on the password check rather than the mount guard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
icco
requested
a balanced review from Copilot
and removed request for
Copilot
October 14, 2026 14:15
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The mount guard checked $HOME, which a caller can override while the XDG state paths stay hard-coded under /data. Build and General now also ask before rm commands containing /data/., which catches rm -rf /data/.*. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A host reboot surfaced the loss of OpenCode sessions and logins even though
/datawas bind-mounted. Files inside the volume had been deleted while both servers ran, so the loss only showed on restart.This adds a startup check that
/datais a mount, a smoke-test step that recreates the container and checks a session survives,askrules and an AGENTS.md rule against deleting/data/.configand/data/.local, moves OpenChamber chats to/data/workspace/.chats, and documents what persists where.Risks
The mount check would not have caught this incident. The
rmasks match any command text containing.configor.local, sorm vite.config.tsalso prompts. Existing chats under/data/.config/openchamber/chatsstay listed.