> ## Documentation Index
> Fetch the complete documentation index at: https://nono.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenCode

> Sandboxing OpenCode AI coding assistant with nono

[OpenCode](https://github.com/opencode-ai/opencode) can read files, write code, and execute commands. Use the pack matching your installed OpenCode major version.

## Choose Your Version

| OpenCode | Pack | Run |
| - | - | - |
| 2.x | `nolabs-ai/opencode` | `nono run --profile nolabs-ai/opencode -- opencode --standalone` |
| 1.x | `nolabs-ai/opencode-v1` | `nono run --profile nolabs-ai/opencode-v1 -- opencode` |

Both packs install a plugin and skill into the same OpenCode locations. Remove the installed pack before switching versions:

```bash theme={null}
nono remove nolabs-ai/opencode
nono pull nolabs-ai/opencode-v1
```

## OpenCode 2

Install and run the current pack with a private server inside the sandbox:

```bash theme={null}
nono pull nolabs-ai/opencode
nono run --profile nolabs-ai/opencode -- opencode --standalone
```

> [!WARNING]
>
> OpenCode 2 normally connects its client to a background server that owns tool execution, plugins, and model requests. Use `--standalone` for interactive sessions that require full containment. Without it, nono constrains the client but cannot guarantee that work performed by an existing external server is inside the active sandbox.

The pack does not append `--standalone` automatically because administrative commands such as `serve`, `auth`, and `acp` do not support it.

### Startup Compatibility

nono grants the active worktree rather than its parent directories or the entire home directory. OpenCode 2 probes those broader locations during project and instruction discovery, so the pack sets:

* `OPENCODE_DISABLE_PROJECT_CONFIG=1` to stop parent-directory project discovery
* `OPENCODE_TEST_HOME=$WORKDIR` to keep instruction initialization inside the granted worktree

These variables prevent expected sandbox denials from becoming startup failures; nono remains the security boundary. Project `opencode.json`, `AGENTS.md`, plugins, and other project-discovered components are disabled. Global OpenCode configuration and the nono plugin remain available.

The OpenCode installation at `~/.opencode` is read-only because its `bin` directory can be on `PATH`. Run OpenCode upgrades outside the sandbox. Runtime configuration, cache, data, and state directories remain writable.

## OpenCode 1

The v1 pack preserves the configuration known to work with OpenCode 1.18.x:

```bash theme={null}
nono pull nolabs-ai/opencode-v1
nono run --profile nolabs-ai/opencode-v1 -- opencode
```

OpenCode 1 keeps its client, tools, and plugin runtime in the sandboxed process. Do not add `--standalone`; that flag belongs to OpenCode 2.

## Customize a Profile

Extend the pack rather than copying its runtime grants and compatibility settings:

```json theme={null}
{
  "extends": "nolabs-ai/opencode",
  "meta": {
    "name": "opencode-local",
    "version": "1.0.0"
  },
  "filesystem": {
    "read": ["$HOME/shared-libs"]
  }
}
```

Save it as `~/.config/nono/profiles/opencode-local.json`, then run:

```bash theme={null}
nono run --profile opencode-local -- opencode --standalone
```

For OpenCode 1, extend `nolabs-ai/opencode-v1` and omit `--standalone`.

## Credentials

Load provider keys from the system keystore instead of exporting them into the whole shell:

```bash theme={null}
# macOS
security add-generic-password -s "nono" -a "openai_api_key" -w

# Linux
secret-tool store --label="nono: openai_api_key" service nono username openai_api_key
```

Then inject the credential for the session:

```bash theme={null}
nono run --profile nolabs-ai/opencode --env-credential openai_api_key -- opencode --standalone
```

See [Credential Injection](https://nono.sh/docs/cli/features/credential-injection.md) for details.

## Additional Access

Add only the paths a session needs:

```bash theme={null}
nono run --profile nolabs-ai/opencode --allow ~/shared-libs -- opencode --standalone
```

OpenCode may harmlessly probe denied parent and system paths during startup. Do not grant broad paths such as all of `$HOME` merely to silence the exit report.

## Gemini Credential Injection

OpenCode sends Gemini requests directly to the Google API, so proxy-based credential injection is not supported for Gemini models. Use environment credential injection:

```bash theme={null}
nono run --profile nolabs-ai/opencode --env-credential gemini_api_key -- opencode --standalone
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.