A standalone client extension for OpenCode 2.2.1, using the machine's existing OpenCode sign-in. Its official icon is recorded in ICON-SOURCE.md.

Requires Pointman node 0.4.3 or newer with AGC-75 support: opencode-stream, machine-data path preservation, native MCP conversion and private agent configuration. The manifest alone does not provide these features; older nodes must reject it. The runtime owner confirmed the 0.4.3 release floor.

Install the official OpenCode v2 CLI for the machine, then run opencode auth login in the ordinary machine environment. The release installer uses this repository’s checksum-verified repacks of official 2.2.1 binaries; it does not install npm’s potentially different CLI generation. mac-m4 currently has /opt/homebrew/bin/opencode, version 2.2.1. Other platforms are unverified. No key form or vault secret is defined by this extension.

The repository has no published release yet. The artifact-only repack.yml workflow downloads pinned official archives and produces node-compatible archives plus checksums. It does not publish a release. The existing release-extension workflow remains the publication path after review. See UPSTREAM.md.

The runtime starts a private server for one wake, with closed stdin:

opencode run --standalone --format json --session <node-chosen-id> --auto -m <provider/model> -- <prompt>

Both first and later wakes use the same explicit --session argument. The CLI creates the ID if missing and resumes it otherwise. Never use --continue or attach to the person's background service. The node maps Pointman's stored UUID to ses_<uuid>, as required by the installed OpenCode Session.ID schema, and maps events back to the same stored UUID.

Default and auto modes use --auto; plan selects OpenCode's plan agent. Pointman refuses acceptEdits mode: OpenCode's --auto would also approve shell and tool operations, so it cannot represent that narrower permission mode. The prompt is one argv item after --, including when it starts with a dash. The supplied model wins; otherwise private config selects zai-coding-plan/glm-5.3. Plan mode uses --agent plan without --auto. Instructions are appended to the prompt by the node, avoiding file discovery.

Before replacing HOME, the node resolves the machine data root from the original absolute XDG_DATA_HOME, falling back to original HOME plus .local/share. It passes that exact root as XDG_DATA_HOME. OpenCode v2 stores credentials in its data database; auth.json is a legacy import. Do not copy credentials or databases, symlink sign-in files, edit the user's config, or print resolved config/auth.

Each agent has private <node-state>/homes/opencode/<handle> as HOME, config, cache and state paths set by the manifest. The runtime must remove ambient OPENCODE_DB (otherwise it overrides the preserved machine DB), service connection, model/source overrides and other conflicting OpenCode environment values before applying the manifest. Both project-disable variable names are set because the new name takes precedence over the legacy name. Claude compatibility is disabled; private HOME also excludes machine .agents and .claude discovery.

The node writes only the private .config/opencode/opencode.json, replacing its entire MCP table on every launch so revoked grants disappear. OpenCode needs type: remote, url, headers, oauth: false for Pointman's HTTP MCP entry. Local entries use type: local, an argv-array command, and environment. Generic key renaming cannot perform this conversion. See the synthetic fixture in tests/fixtures/mcp-contract.json.

Private XDG_CONFIG_HOME keeps the machine's user config out of agent runs. Effective config and remember/recall runs were verified with OpenCode 2.2.1 on mac-m4. No Python or database preflight runs before the client starts. If OpenCode produces no stdout within 120 seconds, the node ends the run with "OpenCode didn't start" and the timeout, rather than waiting silently.

Shared machine data includes sessions, logs and credentials, so this is config isolation, not a security boundary between mutually untrusted agents. OpenCode may migrate or refresh that database; permission to run it must include its normal data and lock writes. Do not bypass a sandbox denial by copying machine data.

python3 -m unittest discover -s tests -v

Checks parse the manifest, verify explicit resume and prompt boundaries, prevent vault-key delivery and machine-data hardcoding, and check synthetic MCP data. If opencode is installed, help/version probes run with entirely temporary HOME and XDG roots and a minimal environment. They never run a prompt, sign in, connect to MCP, or read machine data. Set OPENCODE_CHECK_BINARY to an absolute executable to check a particular installation. Native stream decoding tests belong in the Pointman node; this repo does not invent a captured native stream.

The installed binary reported v2.2.1 and confirmed all required run flags. Runtime review verified isolated effective config and a signed-in remember/recall pair on mac-m4. Real native captures are used in the Pointman node's goldens. Live Pointman MCP acceptance, OAuth refresh, hosted packaging CI and Linux/NixOS remain release checks.

Sources and exact installed-code evidence are in research/isolation.md.