fix(runtime): keep host paths out of opencode acp directories

apps/api/src/modules/runtime/infrastructure/runtime-sandbox-provisioning/runtime-driver-execution-spec.builder.ts

@@ -27,7 +27,7 @@ import type { DriverInstanceMcpGrantRecord } from "../driver-instance/mcp-grants
 import { createRuntimeActionToken } from "../runtime-boot-token";
 import type { RuntimeActionTokenBindings } from "../runtime-boot-token";
 import { buildModelConnection } from "./runtime-model-connection.builder";
-import { listAdditionalDirectories } from "./runtime-sandbox-provisioning.paths";
+import { listProvisioningDirectories } from "./runtime-sandbox-provisioning.paths";
 
 interface RuntimeActionUrlContext {
   bindings: RuntimeExecutionSpecBindings;
@@ -202,7 +202,12 @@ export async function buildExecutionSpec(
     provider: input.profile.provider,
     providerOptions: input.profile.providerOptions,
     session: {
-      additionalDirectories: listAdditionalDirectories(input.profile),
+      // Host cache and native HOME are provisioned separately; they are not
+      // optional directories requested from the OpenCode ACP provider.
+      additionalDirectories:
+        input.profile.runtimeId === "acp-fallback"
+          ? []
+          : listProvisioningDirectories(input.profile),
       context: {
         sandboxSessionId: input.profile.session.sandboxSessionId,
         homePath: input.profile.session.homePath,

apps/api/src/modules/runtime/infrastructure/runtime-sandbox-provisioning/runtime-driver-files.service.ts

@@ -6,7 +6,7 @@ import type { DriverProfileConfig } from "../../domain/driver-snapshot";
 import type { ExecutionSessionHandle } from "../sandbox-handles";
 import {
   getParentDirectory,
-  listAdditionalDirectories,
+  listProvisioningDirectories,
 } from "./runtime-sandbox-provisioning.paths";
 
 async function sha256(value: string): Promise<string> {
@@ -18,7 +18,7 @@ export async function ensureProvisioningDirectories(
   session: ExecutionSessionHandle,
   profile: DriverProfileConfig,
 ): Promise<void> {
-  const directories = listAdditionalDirectories(profile);
+  const directories = listProvisioningDirectories(profile);
   const result = await session.exec(
     `mkdir -p ${directories.map((directory) => quoteShellArg(directory)).join(" ")}`,
   );

apps/api/src/modules/runtime/infrastructure/runtime-sandbox-provisioning/runtime-sandbox-provisioning.paths.ts

@@ -37,7 +37,7 @@ export function getParentDirectory(path: string): string {
   return `/${parts.slice(0, -1).join("/")}`;
 }
 
-export function listAdditionalDirectories(profile: DriverProfileConfig): string[] {
+export function listProvisioningDirectories(profile: DriverProfileConfig): string[] {
   return [
     ...new Set([
       SANDBOX_CACHE_PATH,

apps/api/tests/api-driver-boundary.test.ts

@@ -55,6 +55,22 @@ const artifactPaths = {
 };
 
 describe("API to driver boundary", () => {
+  test("OpenCode provisioning does not request unsupported ACP additional directories", async () => {
+    const profile = createDriverProfile();
+    const execution = await buildExecutionSpec(bindings, {
+      builtInTools: [],
+      driverInstanceId: API_DRIVER_BOUNDARY_IDS.driverInstance,
+      profile: { ...profile, runtimeId: "acp-fallback" },
+      requestUrl: "https://api.example.com/",
+      resolvedMcpServers: [],
+      resolvedSkills: [],
+      resolvedSkillCatalog: [],
+    });
+    expect(execution.session.additionalDirectories).toEqual([]);
+    expect(execution.session.cwd).toBe(profile.session.sessionOrganizationPath);
+    expect(execution.session.context.homePath).toBe(profile.session.homePath);
+  });
+
   test.each(["cattle", "pet"] as const)(
     "requires a committed native checkpoint even when the boot input retains a historical %s label",
     async (kind) => {