[BUG] v2 fails under filesystem sandboxe #52458

Description

Detached spawn chdir($HOME) + config discovery walks to / treating EPERM as fatal with opencode v2.0.21 (macOS arm64); macOS Seatbelt sandbox (w/ nono 0.79.0) granting the project workdir but not $HOME or its ancestors. Both start modes affected (managed background service and --standalone).

Suggested fixes:

1. spawnServiceContender: pass an explicit cwd (e.g. process.cwd() or a granted dir) so the detached child never needs $HOME access.
2. FSUtil.resolve: catch PermissionDenied alongside NotFound — treat unreadable as absent. Makes the ancestor walk safe under any sandbox.
3. Optionally bound the walk (stop at $HOME) instead of probing candidates at every level to /.

Plugins

none

OpenCode version

v2.0.21

Steps to reproduce

1. opencode serve --service (or plain opencode) under a profile that doesn't grant $HOME:

   Error: EPERM: operation not permitted, getcwd '/path/to/project' -> '/Users/<user>'
       at chdir (unknown)
   Error: Server process exited with code 1
   

   spawnServiceContender (packages/client/src/service-conteder.ts) spawns with { detached: true, ... } and no cwd; the runtime's detached-spawn path performs an internal chdir targeting $HOME (observed: at chdir, error formatted getcwd '<cwd>' -> '<home>'). Home-denying sandboxes kill every start at this spawn.

2. After granting chdir($HOME), the TUI starts but /api/location and /api/fs/list
   return 500:

   PlatformError: Unknown: FileSystem.realPath (/Users/antoine)
       at FileSystem.resolve
       at ConfigDiscovery.discover
       at ServerProcess.start
     [cause]: Error: EPERM: operation not permitted, lstat '/Users/<user>'
   

   ConfigDiscovery.discover (packages/core/src/config/discovery.ts) walks from the project to / (fs.up({ targets: ["."], start: location.directory })), resolving every ancestor dir and five candidate paths per level (.claude, .agents, .opencode, opencode.json[c]). FSUtil.resolve (packages/util/src/fs-util.ts) only catches NotFound; any other errno is Effect.orDie, so the first unreadable ancestor kills startup with a bare 500.

Screenshot and/or share link

No response

Operating System

macOS 26.7

Terminal

Ghostty