function opencodes --description 'contained opencode (bwrap); extra args are passed to opencode'
    set -l cfg ~/.config/opencode
    # ~/.config/opencode is stowed as per-file symlinks into ~/.dots. Bind each link's real parent
    # dir read-only too, or the sandbox sees dangling links and opencode starts with NO config.
    set -l dirs
    for f in $cfg/* $cfg/*/*
        test -L $f; or continue
        set -l d (path resolve $f | path dirname)
        string match -q "$cfg*" $d; and continue
        contains -- $d $dirs; or set -a dirs $d
    end
    set -l binds
    for d in $dirs
        set -a binds --ro-bind $d $d
    end
    # --clearenv drops everything; pass through only what the TUI and its tools need.
    set -l env --setenv PATH /usr/local/bin:/usr/bin:/bin
    for v in HOME TERM COLORTERM LANG LC_ALL EDITOR OPENCODE_CONFIG DUSKADIY_API_KEY
        set -l val $$v
        test -n "$val"; and set -a env --setenv $v $val
    end
    mkdir -p ~/.cache/opencode ~/.local/state/opencode ~/.local/share/opencode
    bwrap \
        --unshare-all \
        --new-session \
        --clearenv \
        --die-with-parent \
        --share-net \
        --dev /dev \
        --proc /proc \
        --ro-bind /usr /usr \
        --ro-bind /lib /lib \
        --ro-bind /lib64 /lib64 \
        --ro-bind /bin /bin \
        --ro-bind /etc /etc \
        --ro-bind $cfg $cfg \
        $binds \
        --tmpfs /tmp \
        --bind ~/.cache/opencode ~/.cache/opencode \
        --bind ~/.local/state/opencode ~/.local/state/opencode \
        --bind ~/.local/share/opencode ~/.local/share/opencode \
        --bind $PWD $PWD \
        $env \
        opencode $argv
end