[kixelated]

Plans quest/m0/kix/sandbox/opencode-data.md, the follow-up moq-dev/quest#480 suggested. On opencode 2.x every job on an account shares its data/opencode, and the job plugin lets file tools read all saved tool-output and shell captures. So a job can read output another repository's job saved.

Changes

• New quest [M] Per-job opencode saved output in m0's job sandbox epic, ranked before the Claude Code boundary test. It requires the opencode 2.x quest, which feat(runner)!: drive opencode 2.x through @opencode/client #480 finishes.
• Goal: no job reads another job's saved tool output or shell captures. Each job saves them in its own directory beside its checkout, deleted with it. Sessions and the credential stay in the account's shared opencode.db.
• The quest's Plan records what opencode 2.1.1 keeps in its data directory, checked against its source at v2.1.1. Credentials are rows in opencode.db, next to the sessions, and auth.json is only a legacy import. OPENCODE_DB moves the database, resolved against the data directory unless absolute. tool-output/ has no directory per project.
• The launch points XDG_DATA_HOME at the per-job directory and OPENCODE_DB at the account database's absolute path.

Decisions

Settled with the maintainer in /quest-complete on 2026-11-04:

• What should the quest's goal be?
  • ✅ Per-job data directory
  • Rejected: narrow the plugin's read root to the current project's subdirectory
• Which milestone and epic?
  • ✅ m0 job sandbox
  • Rejected: m1 contributor sandbox
• Where should a job's sessions live?
  • ✅ Shared account database: every job keeps using the account's opencode.db (through OPENCODE_DB), so the credential and its token refreshes stay shared; only saved output (tool-output, shell) moves to a per-job directory beside the checkout, deleted with it.
  • Rejected: a per-job database with a copied credential, because concurrent jobs would each refresh their own copy and rotating refresh tokens would invalidate each other.

This replaces the quest's ## Waiting item; the goal, title, and the epic's link line no longer promise per-job sessions.

Review

mechanical fix by quest land watch: merged main at c76df6877ef0e172b7234be77642ffb3207bb731 with the quest merge driver (head 8707f13)

Codex gpt-6.1-sol at xhigh effort, quest review round 2 on head 181ac740bb68d9cf1a9cb8bc500368ba7b8b3621: no findings.

Pullfrog's findings on 991d012:

• Fixed: OPENCODE_DB resolves against the data directory (path.resolve(data, filename) in packages/cli/src/database-path.ts at v2.1.1, verified), so the implementation guidance now requires the account database's absolute path.
• Declined: the per-job database's seeding mechanics through auth.json. The maintainer rejected that option.
• Declined: the Required link to /quest/m0/opencode-sdk.md, which feat(runner)!: drive opencode 2.x through @opencode/client #480 deletes. It is correct while feat(runner)!: drive opencode 2.x through @opencode/client #480 is open, and quest check --fix drops it after whichever PR merges second merges the base.

Round 1 (Codex, head 991d012) reported no findings, after Claude Opus 5.5 rewrote the plan around OPENCODE_DB and placed the data directory beside the checkout.

Validation: nix develop -c just check passes on 181ac740.

Suggested follow-ups

None.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 76ae6ebb-62a6-414d-a73e-530baebf0ad5

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[pullfrog]

ℹ️ Minor suggestions inline, none blocking.

Reviewed changes — a docs-only quest-plan PR (88 added lines, zero code). A reviewfrog subagent verified every opencode claim in the plan against anomalyco/opencode at tag v2.1.1, and the runner-side claims were checked against src/runner/ and #480's head.

• Adds quest/m0/kix/sandbox/opencode-data.md — an [M] quest for a per-job opencode data directory, ranked before the Claude Code boundary test, grounded in opencode 2.1.1's storage layout with the shared-vs-per-job database decision left under ## Waiting.
• Adds the quest to the epic index (quest/m0/kix/sandbox/README.md), one listing line in the ## Required children.

Verification summary, for the record: all four upstream claims check out — credentials are credential rows in opencode.db with auth.json only a legacy import; OPENCODE_DB overrides the database path and server-process.ts passes it through; tool-output/ is flat while shell/ is per-project, both pruned at 7 days; subagent rejects any session that is not a child of the current session. The savedOutput citation matches src/runner/opencode.ts on #480's head, and commands still cannot read a state-directory path (runtimeSettings allowRead lists only the checkout, the bare clone, and the attempt's /tmp dir), so the "beside the checkout" placement holds.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using glm-5.3-flash ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — the delta since the prior pullfrog review (991d012), re-reviewing 181ac74 against the same upstream and runner verifications as before: all claims still hold, and the only new factual statement (OPENCODE_DB relative resolution) matches the verified path.resolve(dataDir, value) behavior at v2.1.1.

• Rewrote the quest around the shared-database decision — the title, README entry, and goal now scope the per-job directory to saved output (tool-output, shell) only, with sessions and the credential staying in the account's opencode.db; the goal no longer promises per-job sessions or a per-job database.
• Replaced the ## Waiting item with a second decision block recording the maintainer's /quest-complete pick (shared OPENCODE_DB; per-job database rejected for refresh-token invalidation between concurrent jobs).
• Corrected the OPENCODE_DB fact to "resolved against the data directory unless it is absolute" and added a launch bullet requiring the account database's absolute path, with the empty-database failure mode stated — the delta resolves the prior review's open suggestion.
• No code or behavioral surface; quest check passes on the checkout (70 documents ok).

The plan's claim that a shared database's other sessions stay out of a job's reach remains accurate and is now the load-bearing guard behind the shared-database decision — its two mechanisms (subagent's child-only resume, jobConfig denying tools.opencode.*) were verified in the prior round and nothing in the delta changed them.

  ^{｜ View workflow run ｜ Using glm-5.3-flash ｜ 𝕏}

[moq-bot]

quest land watch: the merge queue removed this pull request at 181ac74 because it conflicts with main (merge_conflict).

The land fixer works on it in the background, and the watcher re-enqueues it at the back of the queue once it is fixed or judged flaky, or hands it back here with what it needs.

(written by quest land watch)

[moq-bot]

quest land watch: armed auto-merge on this pull request at 8707f13, so it joins the back of the merge queue once its required checks pass, with main at c76df68 merged in by the quest merge driver.

(written by quest land watch)