PermissionError at import time when ~/.config/opencode is not readable (sandboxed environment)

[seiji]

Summary

Under a sandbox that does not grant access to ~/.config/opencode, semble fails to start with PermissionError.
The failure happens at import time, so every subcommand is affected including semble --version.

Environment

• semble 0.5.5 (installed via uvx --from 'semble[mcp]' semble)
• macOS (Darwin 25.3.0), Python 3.12 (uv-managed CPython)
• Sandbox: Agent Safehouse 0.11.1, a sandbox-exec (Seatbelt) wrapper
• Used as an MCP server from Claude Code

What happens

$ semble --version
Traceback (most recent call last):
  File ".../bin/semble", line 6, in <module>
    from semble.cli import main
  File ".../semble/cli.py", line 18, in <module>
    from semble.installer.agents import AGENTS, IntegrationType
  File ".../semble/installer/__init__.py", line 1, in <module>
    from semble.installer.installer import run
  File ".../semble/installer/installer.py", line 11, in <module>
    from semble.installer.agents import (
  File ".../semble/installer/agents.py", line 218, in <module>
    mcp=McpConfig(_opencode_mcp_path(), "mcp", _OPENCODE_SERVER_CONFIG),
                  ^^^^^^^^^^^^^^^^^^^^
  File ".../semble/installer/agents.py", line 162, in _opencode_mcp_path
    return jsonc if jsonc.exists() else (json_ if json_.exists() else jsonc)
                    ^^^^^^^^^^^^^^
PermissionError: [Errno 1] Operation not permitted: '/Users/me/.config/opencode/opencode.jsonc'

As an MCP server the same traceback appears on stderr and the client reports MCP error -32000: Connection closed.

Notes

• Granting access to this one path is enough to make semble start normally, so it is the only blocker in this environment.
• The sandbox denies stat() on this path with EPERM rather than ENOENT. Paths that simply do not exist still return ENOENT and cause no problem there.
• I am not using semble install; the MCP server is configured by hand, and opencode is unrelated to what this session is doing.

[stephantul]

Hey @seiji,

Sorry this happened to you, thanks for reporting! I'll try to get a fix out for this.

[stephantul]

Tracked in #256, feel free to take a look, will keep you posted.

[seiji]

@stephantul

Thanks for the quick turnaround!

I tested the PR branch in the same sandbox and it starts fine now:

[stephantul]

Ok, thanks for checking! Merged! We'll release somewhere next week. Thanks for reporting and using Semble 🫡