feat(setup): run the setup agent in a macOS sandbox (3/6)

[atornsii]

This runs the setup agent in a macOS sandbox. The agent runs shell commands without approvals, and OpenCode's rules limit only its file tools. In a test run, the agent searched the whole disk with find /, read files in another repo, and read the ldcli access token with ldcli config get.

What changed

• On macOS, ldcli starts OpenCode with sandbox-exec and a Seatbelt profile that it writes for each run. The sandbox applies to OpenCode and to every command that it runs.
• The profile denies the home folder. It opens the project and OpenCode's own folders for reading and writing, package caches for writing, and toolchains and ~/.gitconfig for reading. If XDG_CONFIG_HOME is set, only its opencode folder opens. System folders and the network stay open.
• The profile uses resolved paths, because Seatbelt matches the real path behind a symlink, such as /var/folders.
• OpenCode's rules also deny ldcli and npx skills.

Linux and Windows run without a sandbox for now.

Testing

A macOS test runs real sandboxed commands with a fake home folder: they read and write in the project, and they get "Operation not permitted" for a fake ldcli config, an SSH key, and another repo's file. Other tests cover the profile order, quoting, and the install folder rule. The real OpenCode starts in the sandbox.

Stack

This is one of six PRs for the ldcli setup agent. Review and merge them in order, after #877 (Go 1.26):

1. OpenCode adapter
2. Wizard agent step
3. macOS sandbox
4. AI SDK and relay
5. OpenCode handler
6. Run fixes

They replace #876 and #878.

🤖 Generated with Claude Code