[Stuart B. Wilkins (stuwilkins)]

Summary

bwopencode2 launched the ansible wrapper /usr/local/bin/opencode2, which
exports XDG_*_HOME=~/.{config,local/share,local/state,cache}/opencode2.
Since af7bc7f the sandbox mounts the OpenCode 2 directories at the standard
locations, so inside the sandbox OpenCode 2 read empty directories and ignored
the mounted cli.json, opencode.json, plugins and database. This PR runs the
OpenCode 2 binary directly instead.

Description

• Run /opt/nsls2/opencode2/node_modules/@opencode/cli/bin/opencode.exe
  directly when no --exec is given. guard_tool_args already adds
  --standalone, which was the wrapper's other job. If the binary is missing,
  fall back to the wrapper.
• Register /opt/nsls2/opencode2 as already mounted, so the dynamic tool
  mounts don't bind the binary's directory a second time.
• No XDG_* is set inside the sandbox, so git, pixi and ccache also find their
  config at the standard paths. That was the goal of af7bc7f.
• The ansible wrapper and host-side v1/v2 separation are unchanged.
• Docs: docs/bw-wrappers.md explains why the wrapper is skipped.

Considered instead: having the ansible wrapper skip its XDG_* exports when
a flag is set. That would be cleaner, but it needs changes in two repos and an
ansible rollout first.

Testing

• bash -n bin/bwopencode2; pixi run -e dev lint-files on the changed files
  (shellcheck, shfmt, markdownlint, codespell, gitleaks) passes.
• bin/bwopencode2 --dry-run ends with
  -- /opt/nsls2/opencode2/node_modules/@opencode/cli/bin/opencode.exe --standalone.
• In a real sandbox session, standard XDG_* paths are used,
  ~/.config/opencode contains cli.json, opencode.json, plugins,
  tui-plugins, skills, agents and commands, server plugins load, the
  host session database is used (sessions resume with -s), and git finds
  ~/.gitconfig and ~/.config/git/allowed_signers.

Checklist

• Edit the sections above with relevant information
• Update in-repo documentation, if applicable
• Run pixi run -e dev lint locally (or wait for CI) — see .github/workflows/lint.yml
• Test the changes on a representative managed host (or runansible deployment)

[Copilot]

🟢 Approval recommended

The targeted changes preserve existing argument guards and command overrides, with no blocking issues identified.

No open issues 🎉

What changed in this PR

This PR fixes bwopencode2 so OpenCode 2 uses the configuration, plugins, and database mounted at standard sandbox paths rather than paths redirected by the host wrapper.

Changes:

• Run the managed OpenCode 2 binary directly, preserving wrapper fallback, standalone guarding, and --exec behavior.
• Register the install directory as mounted to prevent duplicate dynamic mounts.
• Document the launch behavior and update the AI disclosure metadata.

File	Description
docs/​bw-wrappers.md	Explain direct binary execution, fallback, and --exec usage.
bin/​bwopencode2	Select the managed binary and prevent duplicate install-directory mounts.
AI_DISCLOSURE.md	Update the model list and disclosure date.

_{Review effort: Balanced}