Cli Agent
Invoke CLI coding agents (claude, opencode, amp, gemini, codex, grok, pi) with typed inputs and capture structured outputs — tokens, cost, duration, retries, and exit code. Supports slash command resolution and JSON response parsing.
Support standard linked Git worktrees inside Linux bwrap with read-only canonical Git metadata mounts.
Global Arguments
| Argument | Type | Description |
|---|---|---|
| commandsDir | string | |
| commandSubdirs | array | Additional subdirectories under commandsDir to search for slash commands |
| claudePath | string | |
| opencodePath | string | |
| ampPath | string | |
| geminiPath | string | |
| codexPath | string | |
| grokPath | string | |
| piPath | string | |
| maxRetries | number | |
| sandboxProfile? | string | Override path to the Seatbelt .sb profile (defaults to the shipped cli_agent.sandbox.sb, resolved from the extension's files dir) |
| sandboxRequired | boolean | When true, fail the invocation instead of degrading when a sandbox is requested but the platform can't apply it (no backend for the OS, or the backend's binary is missing). Default false: warn and run unsandboxed. |
| Argument | Type | Description |
|---|---|---|
| date? | string | |
| timeZone? | string |
| Argument | Type | Description |
|---|---|---|
| prompt | string | The prompt or slash command to execute |
| cwd? | string | Working directory for the CLI (defaults to Deno.cwd()) |
| tags? | record | Arbitrary key-value tags for grouping/filtering invocations |
| toolAllowlist? | array | Restrict the child to ONLY these tool names (e.g. specific MCP tools like 'mcp__granola__list_meetings'). Every other tool is rejected. Layered on top of toolProfile's rules. Currently honored by the amp provider; other providers ignore it. |
| sandboxRequired? | boolean | Override the global sandboxRequired for this invocation: fail closed instead of warn-and-degrade when the sandbox can't be applied. |
| Argument | Type | Description |
|---|---|---|
| prompt | string | The prompt or slash command to execute |
| cwd? | string | Working directory for the CLI (defaults to Deno.cwd()) |
| tags? | record | Arbitrary key-value tags for grouping/filtering invocations |
| toolAllowlist? | array | Restrict the child to ONLY these tool names (e.g. specific MCP tools like 'mcp__granola__list_meetings'). Every other tool is rejected. Layered on top of toolProfile's rules. Currently honored by the amp provider; other providers ignore it. |
| sandboxRequired? | boolean | Override the global sandboxRequired for this invocation: fail closed instead of warn-and-degrade when the sandbox can't be applied. |
Resources
Configure OpenCode actor invocations for noninteractive tool execution and default-deny readonly tools, including custom, plugin, and MCP mutation surfaces.
updated binaries
Automated republish 2026.08.14.2 (regression suite + quality 14/14)
Modified 1 models. updated binaries
updated binaries
updated binaries
Adds read-only local-day usage aggregation across native Claude Code, Amp, and Codex session stores with timezone-aware attribution, cross-midnight cumulative deltas, and cache-safe combined totals.
Modified 1 models. updated binaries
updated binaries
Modified 1 models. updated binaries
updated binaries
updated binaries
updated binaries
updated binaries
updated binaries
updated binaries
updated binaries
Normalize provider subprocess PWD to the requested cwd so agent CLIs select the intended checkout or Git worktree. Adds a regression test for stale parent PWD.
updated binaries
v2026.07.21.3: add the upgrades[] entry matching the localhost-egress strict-profile change (v.2 omitted it, causing a version-mismatch on run). No behavior change vs .2.
updated binaries
v2026.07.21.2: strict sandbox profile (sandboxNetwork:deny) now allows localhost egress so network-denied flows can use a LOCAL model (Ollama) while external egress stays blocked. Default profile unchanged.
updated binaries
v2026.07.21.1: add opt-in sandboxNetwork:'allow'|'deny' (default 'allow' — existing behavior unchanged). 'deny' selects a hardened Seatbelt profile that denies all network egress + the per-repo .swamp/secrets vault, for flows running an LLM on untrusted input (prompt-injection exfiltration defense). Additive schema change; ADW/software-factory/watchers unaffected (never set the flag).
updated binaries
updated binaries
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned