OpenCode's allowlists are not there for security. They exist for LLM behavior guidance.
I don't honestly believe that the allowlist isn't (naively) intended to be there for security. It's certainly not a very useful ux for providing LLM guidance: prompts, memories & AGENTS.md already provide an avenue for this & having it in a formalised, structured format isn't conducive to LLM guidance. The implementation brings in a lot of dependencies (tree-sitter) & contains enough complex targeted string parsing that's definitely superfluous for something intended to be fed to an LLM as guidance. Perhaps most importantly - the LLM behaviour on encountering limits of the allowlist is neither intuitive nor consistent enough to be considered reliably guiding (& system prompt doesn't do anything to mitigate this).
> I don't expect them to be built into my LLM harness because I value modular software composition
I value software modularity, in particular where software architecture is concerned, but I wouldn't go as far as being prescriptive about the unix philosophy. Direct integration does have its pros, & most of the cons associated with it in practice are specific to bad architecture (or black box software). For example Claude cli does integrate sandbox-exec internally, but it does do in a closed-source inaccessible way that negates its value. I am confident it can be done well though, even if I'm somewhat less confident that it ever will be.
But maybe some people think it's not obvious, and point it out because they think they're clever?
I suppose that's possible.
The downside to democratizing code creation is... it puts it in the hands of non-developers.
F.ex. a team I work with asking OpenClaw "What is SRE?"
I'm beginning to think that the true issue here is that people who dislike AI are largely ignorant of the current state. Because willful ignorance.
I say that because I repeatedly see people making extremely silly statements that they really should know better about. But for some reason they don't.
Obviously I could be wrong. Time will tell.
They're being bought as a hardware solution, not a sandbox solution.
As proof, look at all the people wiring up their personal emails, etc. as soon as they turn them on.
What is it about THIS software, unlike any dev software to come before it, that pushes people to buy new small computers?
Why do you think?
And because it lets them create code without knowing how to code.
You know, I can't prove that the Mac mini problem is due to needing to sandbox agents. All I can offer is my anecdotal experience - and that of everyone I know.
I love that I'm now a 50 year old hipster. This is a wonderful conversation.
If you had any experience with using LLM harnesses, you would be aware that despite instructions (in prompts, AGENTS.md, etc.) the agents will sometimes ignore those instructions.
One solution to remind the agents is to explicitly disallow their instruction-violating attempts.
This is how allowlists are used to guide agent behavior.
You should try it sometime before you speak authoritatively about it further.