Yes, I am aware that sandboxing technology exists. I use them. I don't expect them to be built into my LLM harness because I value modular software composition - and sandboxing should be provided by a product that specializes in that area.
OpenCode's allowlists are not there for security. They exist for LLM behavior guidance.
I don't honestly believe that the allowlist isn't (naively) intended to be there for security. It's certainly not a very useful ux for providing LLM guidance: prompts, memories & AGENTS.md already provide an avenue for this & having it in a formalised, structured format isn't conducive to LLM guidance. The implementation brings in a lot of dependencies (tree-sitter) & contains enough complex targeted string parsing that's definitely superfluous for something intended to be fed to an LLM as guidance. Perhaps most importantly - the LLM behaviour on encountering limits of the allowlist is neither intuitive nor consistent enough to be considered reliably guiding (& system prompt doesn't do anything to mitigate this).
> I don't expect them to be built into my LLM harness because I value modular software composition
I value software modularity, in particular where software architecture is concerned, but I wouldn't go as far as being prescriptive about the unix philosophy. Direct integration does have its pros, & most of the cons associated with it in practice are specific to bad architecture (or black box software). For example Claude cli does integrate sandbox-exec internally, but it does do in a closed-source inaccessible way that negates its value. I am confident it can be done well though, even if I'm somewhat less confident that it ever will be.
Well - maybe. But as I understand it - you can't buy Mac minis right now because agentic coders are buying all of them, so they can properly sandbox their agents. Which means a LOT of people know they need to sandbox their agents.
I'm beginning to think that the true issue here is that people who dislike AI are largely ignorant of the current state. Because willful ignorance.
I say that because I repeatedly see people making extremely silly statements that they really should know better about. But for some reason they don't.
Mac Minis are out of stock because they're the cheapest entry point to reasonably capable local agents (read: 64+GB of GPU accessible RAM), which TikTok is all about.
They're being bought as a hardware solution, not a sandbox solution.
As proof, look at all the people wiring up their personal emails, etc. as soon as they turn them on.
They can't run it on the laptop they already own, unless they happen to already have a decently-spec'd M-series MBP, which most of the non-hipster-coder world didn't.
And because it lets them create code without knowing how to code.
HA! So now Apple users are hipsters! Your ugly biases are beginning to show.
You know, I can't prove that the Mac mini problem is due to needing to sandbox agents. All I can offer is my anecdotal experience - and that of everyone I know.
I love that I'm now a 50 year old hipster. This is a wonderful conversation.
> I don't honestly believe that the allowlist isn't (naively) intended to be there for security. It's certainly not a very useful ux for providing LLM guidance: prompts, memories & AGENTS.md already provide an avenue for this & having it in a formalised, structured format isn't conducive to LLM guidance.
If you had any experience with using LLM harnesses, you would be aware that despite instructions (in prompts, AGENTS.md, etc.) the agents will sometimes ignore those instructions.
One solution to remind the agents is to explicitly disallow their instruction-violating attempts.
This is how allowlists are used to guide agent behavior.
You should try it sometime before you speak authoritatively about it further.
OpenCode's allowlists are not there for security. They exist for LLM behavior guidance.