nono-here

[MKuckert]

What

Zero-config sandbox bootstrap: nono/nono-here.sh discovers the workspace, selects a harness (claude/opencode/codex/copilot/pi), provisions .sandbox/ from a template, generates .sandbox/defaults.sh, and hands over to run_harness.sh. Plus portable templates, the test suite nono/test_nono_here.sh, and OpenCode config changes.

Review findings — addressed in the latest commits

Blockers (overcommit review)

• B1 — agent permission guardrails restored: Builder bash back to deny, Testing bash back to ask (validation is delegated to the Testing agent); the ~/env external_directory allow from 79afda0 is removed.
• B2 — no-jq fallback in start.sh: no longer interpolates the unbound $tpl_ver under set -u; ANSI escape terminated; startup continues on the degraded path.
• S1 — defaults.sh generation now rejects any pre-existing non-regular path (-e || -L + ! -f, exit 9); a dangling symlink from a user template can no longer redirect the write outside .sandbox.
• S2 — defaults.sh is generated before the run_harness.sh move, so a failed generation keeps the workspace on the provisioning path where stale-sandbox repair is offered again.
• S3 — the live root run_harness.sh is now byte-identical to templates/default/run_harness.sh (VERSION 3: guarded ${1:-}, empty-array expansion guard for Bash 3.2, absolute start.sh path). The post-mortem's "left open by design" is no longer true.

Copilot inline findings

• Hook filename mismatch (critical): the template now ships hooks/before/after — the names run_hook actually resolves. Fresh provisions fire both hooks; no manual rename step.
• Unquoted $BASH_SOURCE, GNU-only diff --color=always (now probed; BSD diff degrades to plain output), "Couldn't find neither" wording — all fixed in template and deployed .sandbox/start.sh (bodies are now identical).
• Test case 13 matches Bash 3.2 explicitly; a 3.0/3.1-only host still discloses degraded coverage.
• profile.template.json: ~/.gitconfig removed from read_file (the deployed profile denies it; the generic template no longer weakens new workspaces).
• run_harness.sh defaults contract: .sandbox/defaults.sh is generated by nono-here.sh and required; README updated accordingly (this repo's checked-in .sandbox/defaults.sh satisfies it).

Test-suite portability nit: new preflight probe — if the fixture directory ($TMPDIR or /tmp) is a noexec mount, the suite fails loud with the real cause instead of 19 cases failing with misleading "not executable" messages.

Verification

• nono/test_nono_here.sh: 28/28 pass (with an exec-capable TMPDIR; on a noexec /tmp the new preflight fails loud as designed).
• Manual: dangling-symlink defaults.sh → exit 9 with no write-out; fresh provision produces working hooks/before+after; no-jq start.sh path warns and continues; live run_harness.sh argv correct for no-arg / flag / explicit-command invocations.

Remaining known items (disclosed, follow-up)

• run_hook silently skips a present-but-non-executable hook (no warning).
• No upgrade mechanism for scripts copied into a workspace (# VERSION markers are decorative); template/deployed drift is closed for this PR but can recur.
• Exit codes 1 and 10 untested by design (documented in the test header).
• A second, personal profile.template.json divergence exists by design (this repo's own sandbox).

See PROJECT_MAP.md → High-Risk Areas for the current state of each.

[Copilot]

🟡 Changes recommended

Critical permission and provisioning issues, along with additional startup and compatibility defects, remain unresolved.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a portable nono-here.sh sandbox bootstrap flow with templates, provisioning tests, live sandbox updates, and OpenCode configuration changes.

Changes:

• Adds harness discovery, validation, provisioning, defaults generation, and handover.
• Adds portable scripts, profiles, hooks, and integration tests.
• Updates sandbox configuration and archives the implementation plan.

File summaries

File	Changes and final findings
run_harness.sh	Loads sandbox defaults and updates argument handling. Nit (2 votes): breaks documented defaultless usage. Moderate (1 vote): retains unsafe unguarded argument and array handling.
PROJECT_MAP.md	Documents the sandbox subsystem and risks. No final findings.
plans/2026-09-11_nono-here-bootstrap.md	Archives the implementation plan and decisions. No final findings.
PLAN.md	Removed after plan archival. No final findings.
opencode.jsonc	Adds plugins and directory permissions. Moderate (1 vote): /tmp and ~/env access bypasses confirmation boundaries.
nono/test_nono_here.sh	Adds bootstrap integration tests. Nit (2 votes): Bash detection accepts all 3.x versions instead of requiring 3.2.
nono/templates/default/start.sh	Adds startup and hook logic. Critical (3 votes): hook names do not match lookup names. Moderate (3 votes): GNU-only diff option; Moderate (3 votes): unset tpl_ver fallback failure; Moderate (2 votes): unquoted BASH_SOURCE; Nit (2 votes): unclear error wording.
nono/templates/default/run_harness.sh	Adds portable defaults and argument handling. No final findings.
nono/templates/default/profile.template.json	Adds the default sandbox profile. Moderate (1 vote): grants access to ~/.gitconfig.
nono/templates/default/hooks/before-template	Adds the before-hook template. No final findings.
nono/templates/default/hooks/after-template	Adds the after-hook template. No final findings.
nono/templates/default/.gitignore	Ignores generated profiles. No final findings.
nono/nono-here.sh	Implements workspace discovery and provisioning. Critical (1 vote): unsafe handling of dangling or non-regular defaults.sh paths. Moderate (1 vote): exposes the harness before defaults generation completes.
AGENTS.md	Updates the archived plan location. No final findings.
.sandbox/start.sh	Updates the deployed startup marker. No final findings.
.sandbox/profile.template.json	Updates the deployed profile. No final findings.
.sandbox/defaults.sh	Defines deployed harness defaults. No final findings.
.opencode/cost-guard.config.json	Adds cost guard settings. No final findings.
.opencode/agents/Testing.md	Broadens Testing shell permissions. Critical (3 votes): removes approval gates for unrestricted commands.
.opencode/agents/Builder.md	Broadens Builder shell permissions. Critical (2 votes): removes guardrails against arbitrary shell, Git, and network operations.

Review details

Suppressed comments (4)

nono/nono-here.sh:178

• mv makes the workspace harness visible before the next fallible write that creates or preserves defaults.sh. If that write fails, the next invocation sees an executable run_harness.sh and takes the fast path, so it never offers the stale-sandbox repair and repeatedly fails on the missing defaults file. Generate defaults.sh before this move, or make the fast path validate it before handing over.

mv "$workdir/.sandbox/run_harness.sh" "$workdir/run_harness.sh"

nono/templates/default/profile.template.json:13

• The default profile grants the sandbox read access to ~/.gitconfig, which can contain credential-helper settings, embedded tokens, private repository URLs, and other host secrets. The repo's deployed profile explicitly denies this same file (.sandbox/profile.template.json:13), so the new generic template weakens the default security boundary for every freshly provisioned workspace; remove it or allow only a deliberately sanitized config.

    "read_file": ["~/.gitconfig", "~/.gitignore"],

opencode.jsonc:29

• These project permissions grant the agent access to every path under /tmp and the entire ~/env tree without confirmation, overriding the global external_directory: "*": "ask" boundary. That can expose or modify unrelated temporary files and personal repositories; narrow the allowlist to the exact MCP/runtime paths or retain the confirmation gate.

    "external_directory": {
      "/tmp": "allow",
      "~/env": "allow"
    }

run_harness.sh:14

• The live root wrapper now sources the generated empty SANDBOX_COMMAND_DEFAULTS=() file, but it still has the old direct array expansion and unguarded $1 checks below. Invoking this wrapper with no arguments therefore forwards a bogus empty argument (and is unsafe on Bash 3.2), unlike the fixed template that this PR provisions. Apply the same use-site guard here and use the absolute WORKSPACE start-script path.

source "$DEFAULTS_FILE"
SANDBOX_COMMAND="${SANDBOX_COMMAND:-}"

• Files reviewed: 19/20 changed files
• Comments generated: 10
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[overcommit-app]

Review: nono-here — zero-config sandbox bootstrap

Worktree review of 7ecb263. Test run: nono/test_nono_here.sh — 28/28 pass with an exec-capable TMPDIR. (With the default /tmp on a noexec mount, 19 cases fail with misleading "not executable" messages — see N4.)

Blockers

B1. Agent permission guardrails removed, bundled silently.
.opencode/agents/Builder.md bash: "*": deny → allow, Testing.md ask → allow (commit 79afda0). This strips the approval gates that AGENTS.md's hard-stop rules rely on, for unrestricted shell/git/network. It appears deliberate, but the PR body is empty and it's mixed into a bootstrap feature. Needs explicit sign-off, or split into its own PR with rationale.

B2. start.sh no-jq fallback crashes under set -u (nono/templates/default/start.sh:42). In the no-jq branch, $tpl_ver is never assigned (only set in the jq branch), so a profile.json that differs from the template aborts with tpl_ver: unbound variable instead of printing the warning. Same line also has a broken escape ([0m, not \033[0m). Pre-existing in the deployed script, but the new template propagates it to every freshly provisioned workspace — exactly what this PR is for.

Should-fix (in this PR)

S1. defaults.sh dangling-symlink write-out (nono-here.sh, Task 8). [[ -e "$workdir/.sandbox/defaults.sh" ]] is false for a dangling symlink, so cat > follows it and writes to an arbitrary path. Every other ambiguous path in the script gets a -e || -L guard; this one doesn't. One-line fix.

S2. mv before defaults.sh generation breaks self-healing. If the cat > defaults.sh fails after the move, the next run takes the fast path (run_harness.sh present) and never reaches Task 5's stale-sandbox repair; the user gets "missing defaults file" with no recovery prompt. Generate defaults.sh before the mv.

S3. Live run_harness.sh (repo root) is now inconsistent with the template it ships. This PR modified the live script (added defaults validation, VERSION 2) but left the Task-10 bug it exists to fix: SANDBOX_COMMAND_DEFAULTS=("${...[@]:-}") (empty array → one bogus empty argv element) and unguarded "$1" — while the template (VERSION 3) has both fixed. The post-mortem discloses this as "left open by design… needs its own plan" — acceptable if the PR says so, but the PR body is empty.

Accepted as known/deferred (disclosed in post-mortem — verify before merge, fix in follow-up plans)

• Hook filename mismatch: template ships hooks/before-template/after-template; start.sh looks up hooks/before/after. A fresh provision fires no hooks, and nothing renames them (unlike profile.template.json, which is auto-copied).
• profile.template.json grants read_file: ["~/.gitconfig", …] while the deployed profile explicitly denies ~/.gitconfig. The generic template weakens the security boundary for new workspaces — at minimum drop ~/.gitconfig from the template's allowlist.

Nits

• diff -u --color=always is GNU-only; on macOS the BSD-diff error is swallowed by || true, so users get a shell error instead of the diff (pre-existing, now baked into the template).
• Unquoted $BASH_SOURCE; "Couldn't find neither" wording in start.sh.
• Test case 13's bash discovery accepts any 3.x rather than asserting 3.2-era (the stderr WARN disclosure mitigates).
• Test-suite portability: fixtures hardcode ${TMPDIR:-/tmp}. On a noexec /tmp (some hardened systems), most cases fail with messages that look like product bugs. Add a preflight probe (write → chmod +x → -x), fail loud with the real cause, or relocate.

Positives

• nono-here.sh itself is high quality: single exec site, documented exit-code contract fully implemented and tested, strict validate-before-destroy ordering, no silent fallbacks anywhere.
• The archived plan is exemplary — three review rounds logged, and the post-mortem honestly discloses that three task-level reviews ran without a shell tool (trust in Builder-reported evidence).

Verdict: REQUEST CHANGES — B1 (permission relaxation needs explicit approval), B2 (set -u crash shipped to all new workspaces), S1, S2. S3 and the deferred items need at least PR-body disclosure plus follow-up plans before merge.

[overcommit-app]

All four blockers and the should-fix items are addressed; commits 52062d1, 9a1667a, d6823bb:

• B1 — reverted: Builder bash → deny, Testing bash → ask. The permission relaxation was not part of the bootstrap feature and is now out of this PR's diff (the ~/env allow from 79afda0 was removed too).
• B2 — no-jq fallback fixed: no $tpl_ver interpolation, ANSI escape terminated; verified with jq removed from PATH — the warning prints and startup continues.
• S1 — defaults.sh generation rejects non-regular pre-existing paths (-e || -L + ! -f, exit 9); verified a dangling symlink from a user template no longer writes outside .sandbox.
• S2 — defaults.sh is now generated before the mv, so a failed generation keeps the workspace on the provisioning path (stale-sandbox repair still offered).
• S3 — live root run_harness.sh is byte-identical to the template (VERSION 3); no longer "left open by design". The PR body now discloses the remaining known items explicitly.

Also fixed along the way: hook template filenames (before/after — fresh provisions now fire both hooks), ~/.gitconfig dropped from the generic profile template's read allowlist, quoted $BASH_SOURCE, portable diff color probe, "Could not find either" wording, case13 matching Bash 3.2 explicitly, and a noexec-TMPDIR preflight probe in the test suite (fails loud with the real cause instead of 19 misleading failures).

Verification: nono/test_nono_here.sh 28/28 with an exec-capable TMPDIR; manual checks for each fix as listed in the PR body. The deferred items (non-executable hook silent skip, no script upgrade mechanism, exit codes 1/10 untested) remain disclosed in PROJECT_MAP.md and the PR body for follow-up plans.

[MKuckert]

Drop this file (and command and mention on agents.md)

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain in permissions, bootstrap validation, template compatibility, and configuration.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (8)

nono/nono-here.sh:126

• -f follows symlinks, but the subsequent cp -R preserves them. A symlinked template script therefore passes validation and is moved as a symlink into the workspace; relative links can break after the move, while absolute links make handover execute outside the provisioned template. Reject symlinks here (or explicitly dereference them during copying).

  if [[ ! -f "$template/$required" ]]; then

nono/templates/default/profile.template.json:18

• A fresh OpenCode workspace falls back to this default template, but the repository's OpenCode MCP endpoint is http://localhost:12100/mcp and the checked-in profile explicitly permits localhost/port 12100. This template permits no network domain or port, so cold provisioning removes access to the configured web MCP. Provide an OpenCode-specific template or carry the required localhost permissions into the selected template.

  "network": {
    "allow_domain": []
  },

nono/templates/default/run_harness.sh:6

• The template makes the same breaking rename from CLOUD_DEFAULTS_FILE to DEFAULTS_FILE, so newly provisioned workspaces will also ignore existing callers that set the old override. Preserve it as a fallback or document the migration, and keep the deployed copy in sync.

DEFAULTS_FILE="${DEFAULTS_FILE:-$WORKSPACE/.sandbox/defaults.sh}"

nono/templates/default/start.sh:2

• The deployed .sandbox/start.sh has a # VERSION 3 marker, but the template copied by nono-here.sh does not. Because this PR claims the template and deployed runtime are synchronized, fresh provisions will already differ byte-for-byte and future drift checks become misleading; keep the marker in both copies (or remove it from both).

set -euo pipefail

plans/2026-09-11_nono-here-bootstrap.md:41

• This settled-order row still documents move → defaults, but the implementation and the S2 fix intentionally generate defaults.sh before moving run_harness.sh. Leaving this row unchanged makes the plan contradict the safety invariant it is meant to record; change the order to copy → defaults → move → exec.

| Q15 | Strict order: workdir → shortcut check → prompt → **template resolution + validation** → stale-`.sandbox` prompt → `rm -r` → copy → move → defaults → exec. Nothing is ever deleted before a valid replacement template has been located and validated. |

plans/2026-09-11_nono-here-bootstrap.md:60

• The exit-code map says code 9 is only for a non-regular workspace run_harness.sh, but the implementation also returns 9 for a non-directory .sandbox and a non-regular .sandbox/defaults.sh (nono/nono-here.sh:162 and :176). The documented exit contract should include all of these cases or the implementation should use distinct codes.

| 9 | Workspace `run_harness.sh` path exists but is not a regular file (directory, dangling symlink, socket) |

plans/2026-09-11_nono-here-bootstrap.md:705

• This verification record still names hooks/{after,before}-template, but the current template and copied sandbox contain hooks/after and hooks/before. The archived plan therefore records a file set that cannot match the claimed successful copy; correct the verification text.

  `.sandbox` holds `.gitignore`, `hooks/{after,before}-template`, `profile.template.json`,
  `run_harness.sh`, `start.sh`, all six digests byte-identical to the template and all four

run_harness.sh:6

• This replaces the previously supported CLOUD_DEFAULTS_FILE override with DEFAULTS_FILE; callers that still set the old variable will now silently ignore it and load the workspace defaults instead. Preserve the old name as a fallback or document this breaking environment-variable change.

DEFAULTS_FILE="${DEFAULTS_FILE:-$WORKSPACE/.sandbox/defaults.sh}"

• Files reviewed: 17/18 changed files
• Comments generated: 5
• Review effort level: Lite