@agfpd/voicetalk-runtime 0.3.0 → 0.3.3

package/scripts/verify-install.ts

@@ -0,0 +1,202 @@
+// Standalone real macOS install proof shipped IN the package. No dependencies,
+// daemon, keychain identities, lifecycle commands, microphone, speaker, voice
+// service or repository checkout required.
+// Usage after unpacking:
+//   bun package/scripts/verify-install.ts [package-dir] [previous-package-dir] [recovery-backup-dir]
+import { strict as assert } from 'assert'
+import { execFileSync, spawn, spawnSync, type ChildProcess } from 'child_process'
+import { createHash, randomUUID } from 'crypto'
+import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'fs'
+import { join, resolve } from 'path'
+import { proveInstallPair } from './verify-install-pair.ts'
+
+assert.equal(process.platform, 'darwin', 'real codesign proof requires macOS')
+const pkg = resolve(process.argv[2] ?? join(import.meta.dir, '..'))
+const { selfInstall } = await import(join(pkg, 'src/selfInstall.ts')) as typeof import('../src/selfInstall.ts')
+const version = JSON.parse(readFileSync(join(pkg, 'package.json'), 'utf8')).version as string
+// SHORT root on purpose: the router's inbound unix socket lives under IAPEER_ROOT and
+// macOS sun_path is ~104 bytes; $TMPDIR (/var/folders/…) would overflow it.
+const tmp = mkdtempSync('/tmp/vtp-')
+const fakeIap = join(tmp, 'fake-iapeer')
+// Do not inherit host credentials, daemon discovery, identity, audio or voice knobs.
+const env: NodeJS.ProcessEnv = {
+  PATH: process.env.PATH ?? '/usr/bin:/bin',
+  HOME: join(tmp, 'home'), TMPDIR: tmp,
+  IAPEER_TEST_SANDBOX: '1', IAPEER_ROOT: join(tmp, 'root'), IAPEER_BIN_DIR: join(tmp, 'bin'),
+  IAP_BIN: fakeIap, VOICETALK_AUDIO: '0', VOICETALK_PLAYBACK: '0',
+  VOICETALK_VOICE_ENDPOINT: 'http://127.0.0.1:1',
+}
+mkdirSync(env.HOME!, { recursive: true })
+const bin = join(env.IAPEER_BIN_DIR!, 'voicetalk-runtime')
+const manifest = join(env.IAPEER_ROOT!, 'runtimes/voicetalk/runtime.json')
+const hash = (path: string) => createHash('sha256').update(readFileSync(path)).digest('hex')
+const verify = () => execFileSync('/usr/bin/codesign', ['--verify', '--deep', '--strict', bin], { env })
+const runningVersion = () => execFileSync(bin, ['--version'], { env, encoding: 'utf8' }).trim()
+const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms))
+let router: ChildProcess | undefined
+let routerExit: Promise<void> | undefined
+
+// Stand-in for the iapeer daemon: records argv + message body, never contacts a fleet.
+const argvFile = join(tmp, 'daemon-argv.txt')
+const bodyFile = join(tmp, 'daemon-body.txt')
+writeFileSync(fakeIap,
+  `#!/bin/sh\nprintf '%s\\n' "$*" > ${JSON.stringify(argvFile)}\n` +
+  `while [ "$#" -gt 0 ]; do\n  if [ "$1" = "--message-file" ]; then shift; cat "$1" > ${JSON.stringify(bodyFile)}; fi\n  shift || true\ndone\n` +
+  `printf '%s\\n' 'delivered to proof-target (claude)'\nexit 0\n`)
+chmodSync(fakeIap, 0o755)
+
+async function stopRouter(): Promise<void> {
+  if (!router || router.exitCode !== null || router.signalCode !== null) return
+  router.kill('SIGTERM') // ONLY the proof's own child, never a host runtime
+  await Promise.race([routerExit, sleep(3000)])
+  if (router.exitCode === null && router.signalCode === null) {
+    router.kill('SIGKILL')
+    await routerExit
+  }
+}
+
+async function waitFor(predicate: () => boolean, ms = 8000): Promise<boolean> {
+  const deadline = Date.now() + ms
+  while (Date.now() < deadline) {
+    if (predicate()) return true
+    await sleep(50)
+  }
+  return predicate()
+}
+
+/** The installed binary RUNS as a router: headless `run` (audio off) in a bound
+ *  natural peer, an outbound envelope reaches the audio sink, an inbound `say`
+ *  reaches the (fake) daemon framed for the spoken modality. */
+async function proveRunningRouter(executable = bin, expectedVersion = version, runEnv = env): Promise<void> {
+  assert.equal(execFileSync(executable, ['--version'], { env: runEnv, encoding: 'utf8' }).trim(), expectedVersion)
+  const peer = join(tmp, 'proof-owner')
+  mkdirSync(join(peer, '.iapeer'), { recursive: true })
+  writeFileSync(join(peer, '.iapeer/peer-profile.json'), JSON.stringify({
+    personality: 'proof-owner', default_runtime: 'voicetalk', runtimes: ['voicetalk'], intelligence: 'natural',
+    interfaces: { voicetalk: { wake_words: { 'проба': 'proof-target' }, default_target: 'proof-target' } },
+  }))
+  const doctor = spawnSync(executable, ['doctor', '--json'], { cwd: peer, env: runEnv, encoding: 'utf8' })
+  assert.equal(doctor.status, 0, `doctor: ${doctor.stdout}${doctor.stderr}`)
+  assert.equal(JSON.parse(doctor.stdout).ok, true)
+  rmSync(argvFile, { force: true }); rmSync(bodyFile, { force: true })
+  const root = runEnv.IAPEER_ROOT!
+  const sock = join(root, 'runtimes/voicetalk/inbox/proof-owner.sock')
+  assert.ok(Buffer.byteLength(sock) < 104, `socket path too long for sun_path: ${sock}`)
+  router = spawn(executable, ['run'], { cwd: peer, env: runEnv, stdio: ['pipe', 'pipe', 'pipe'] })
+  routerExit = new Promise<void>(resolve => router!.once('close', () => resolve()))
+  let stderr = ''
+  let spawnError: Error | undefined
+  router.once('error', error => { spawnError = error })
+  router.stdout!.resume()
+  router.stderr!.on('data', chunk => { stderr += String(chunk) })
+  try {
+    const up = await waitFor(() => { assert.ifError(spawnError); return existsSync(sock) })
+    assert.ok(up, `router never opened its inbound socket: ${stderr}`)
+    const outbound = `исходящее ${randomUUID()}`
+    router.stdin!.write('<iap from-personality="proof-target" from-runtime="claude" from-intelligence="artificial">' +
+      `<message><![CDATA[${outbound}]]></message></iap>`)
+    const spokenLog = join(root, 'runtimes/voicetalk/spoken.log')
+    assert.ok(await waitFor(() => existsSync(spokenLog) && readFileSync(spokenLog, 'utf8').includes(outbound)),
+      `outbound envelope did not reach the audio sink: ${stderr}`)
+    const inbound = `входящее ${randomUUID()}`
+    const say = spawnSync(executable, ['say', '--peer', 'proof-target', inbound], { cwd: peer, env: runEnv, encoding: 'utf8' })
+    assert.equal(say.status, 0, `say: ${say.stdout}${say.stderr}\nrouter: ${stderr}`)
+    assert.equal(JSON.parse(say.stdout.trim()).ok, true)
+    assert.match(readFileSync(argvFile, 'utf8').trim(), /^send proof-target --message-file /)
+    const body = readFileSync(bodyFile, 'utf8')
+    assert.ok(body.includes('via voicetalk') && body.includes(inbound), body)
+    assert.equal(router.exitCode, null, stderr)
+    console.log(`PASS installed router run: version ${expectedVersion}, doctor ok, outbound→sink, inbound say→daemon (fake), audio off`)
+  } finally {
+    await stopRouter()
+  }
+}
+
+try {
+  // Exercise the actual shipped CLI + default compile/signature runner.
+  const compiled = execFileSync(process.execPath, [join(pkg, 'src/cli.ts'), 'self-install'], { env, encoding: 'utf8', timeout: 120_000 })
+  assert.match(compiled, /\(compiled\)/)
+  verify()
+  assert.equal(runningVersion(), version)
+  assert.equal(JSON.parse(readFileSync(manifest, 'utf8')).version, version)
+  console.log(`PASS package CLI compile: strict signature + executable version ${version}`)
+  await proveRunningRouter()
+
+  const validHash = hash(bin)
+  const copied = execFileSync(bin, ['self-install'], { env, encoding: 'utf8', timeout: 120_000 })
+  assert.match(copied, /\(copied-self\)/)
+  verify()
+  assert.equal(hash(bin), validHash, 'valid copy-self must retain the exact signature/bytes')
+  console.log('PASS package CLI copy-self: strict signature, bytes/signature unchanged')
+
+  // Feed an unsigned native input through the shipped copy-self implementation.
+  const unsigned = join(tmp, 'unsigned-voicetalk-runtime')
+  copyFileSync(bin, unsigned)
+  execFileSync('/usr/bin/codesign', ['--remove-signature', unsigned], { env })
+  const repaired = selfInstall({ env, sourceEntry: join(tmp, 'missing.ts'), execPath: unsigned })
+  assert.equal(repaired.binMode, 'copied-self')
+  assert.equal(repaired.signature, 'repaired')
+  verify()
+  assert.equal(runningVersion(), version)
+  console.log('PASS unsigned native copy: ad-hoc repaired, strict verify + executable')
+
+  await proveInstallPair({ pkg, tmp, env, candidateBin: bin, selfInstall, run: proveRunningRouter,
+    previousPkg: process.argv[3] ? resolve(process.argv[3]) : undefined,
+    recoveryBackup: process.argv[4] ? resolve(process.argv[4]) : undefined,
+  })
+
+  // Impossible-to-sign input: real codesign failure must preserve BOTH old surfaces.
+  const bad = join(tmp, 'truncated-mach-o')
+  writeFileSync(bad, readFileSync(bin).subarray(0, 1024))
+  const invalid = spawnSync('/usr/bin/codesign', ['--verify', '--deep', '--strict', bad], { env, encoding: 'utf8' })
+  assert.ifError(invalid.error)
+  assert.notEqual(invalid.status, 0, 'negative fixture must really be strict-invalid')
+  console.log(`REAL truncated Mach-O strict verify: status=${invalid.status}, SHA256=${hash(bad)}`)
+  const before = [hash(bin), hash(manifest)]
+  assert.throws(() => selfInstall({ env, sourceEntry: join(tmp, 'missing.ts'), execPath: bad,
+    runner: (cmd, args, passedEnv) => {
+      const result = spawnSync(cmd, args, { encoding: 'utf8', env: passedEnv, timeout: 120_000 })
+      console.log(`REAL truncated ${args[0]}: status=${result.status}, stderr=${result.stderr?.trim() ?? ''}`)
+      return result
+    },
+  }), /codesign .* failed/)
+  assert.deepEqual([hash(bin), hash(manifest)], before)
+  assert.deepEqual(readdirSync(env.IAPEER_BIN_DIR!), ['voicetalk-runtime'], 'no stage/.dead artifact left')
+  verify()
+  assert.equal(runningVersion(), version)
+  console.log(`PASS un-signable copy rejected: old bin+manifest SHA256 unchanged ${before.join(' ')}, stage removed`)
+  await proveRunningRouter() // previous router still RUNS after the rejection
+
+  // The incident's minimal fresh-compile input: accept ONLY if strict-valid and
+  // executable, otherwise prove the real failing compiler/signing path is closed.
+  const minimal = join(tmp, 'minimal.ts')
+  const marker = 'minimal fresh compile signature proof'
+  writeFileSync(minimal, `console.log(${JSON.stringify(marker)})\n`)
+  const previous = [hash(bin), hash(manifest)]
+  let failure: unknown
+  try {
+    selfInstall({ env, sourceEntry: minimal, execPath: process.execPath, runner: (cmd, args, passedEnv) => {
+      const r = spawnSync(cmd, args, { encoding: 'utf8', env: passedEnv, timeout: 120_000 })
+      console.log(`REAL minimal ${args[0]}: status=${r.status}, error=${r.error?.message ?? '-'}, stderr=${r.stderr?.trim() ?? ''}`)
+      return r
+    } })
+  } catch (e) {
+    failure = e
+  }
+  if (failure) {
+    assert.match(String(failure), /codesign .* failed/)
+    assert.deepEqual([hash(bin), hash(manifest)], previous)
+    verify()
+    assert.equal(runningVersion(), version)
+    console.log('PASS strict-invalid minimal compile rejected: old bin+manifest SHA256 unchanged')
+  } else {
+    verify()
+    assert.equal(execFileSync(bin, [], { env, encoding: 'utf8' }).trim(), marker)
+    console.log('PASS minimal compile accepted ONLY after strict verify + execution')
+  }
+  assert.deepEqual(readdirSync(env.IAPEER_BIN_DIR!), ['voicetalk-runtime'])
+  console.log(`PASS artifact ${version}: no core/helper/voice-service dependency; all writes sandboxed`)
+} finally {
+  await stopRouter()
+  rmSync(tmp, { recursive: true, force: true })
+}

package/src/cli.ts

@@ -1141,6 +1141,7 @@ async function selfInstallCommand(): Promise<void> {
   const r = selfInstall({ env: process.env, sourceEntry: import.meta.path })
   process.stdout.write(`${BIN_NAME} self-install (idempotent)\n`)
   process.stdout.write(`  bin:      ${r.binPath}  (${r.binMode})\n`)
+  process.stdout.write(`  signature: ${r.signature}\n`)
   process.stdout.write(`  manifest: ${r.manifestPath}\n`)
   process.stdout.write(`  root:     ${r.root}\n`)
   process.stdout.write(`  docs:     ${r.docs.copied ? r.docs.dest : `skipped (${r.docs.reason ?? 'unknown'})`}\n`)
@@ -1148,6 +1149,7 @@ async function selfInstallCommand(): Promise<void> {
     bin: r.binPath,
     manifest: r.manifestPath,
     binMode: r.binMode,
+    signature: r.signature,
     root: r.root,
     docs: r.docs,
   })

package/src/installPair.ts

@@ -0,0 +1,67 @@
+import { randomUUID } from 'crypto'
+import { linkSync, lstatSync, mkdirSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'fs'
+import { dirname } from 'path'
+import { runtimeManifestPath, type RuntimeManifest } from './manifest.ts'
+
+/** Publish an already signature-verified executable and its manifest.
+ * All preparation is fallible BEFORE publication. If the manifest rename fails,
+ * restore the old binary inode/signature (or symlink), or remove a first install.
+ * Two paths are NOT crash-atomic: no power-loss/SIGKILL or concurrent-writer claim.
+ * No lifecycle operations belong here; running processes keep their old inode. */
+export function publishInstallPair(
+  stagedBin: string,
+  binPath: string,
+  manifest: RuntimeManifest,
+  env: NodeJS.ProcessEnv,
+  // Narrow test seam; production always calls the real synchronous rename.
+  rename: typeof renameSync = renameSync,
+): string {
+  const manifestPath = runtimeManifestPath(env)
+  const suffix = `${process.pid}.${randomUUID()}`
+  const stagedManifest = `${manifestPath}.${suffix}.tmp`
+  const backupBin = `${binPath}.${suffix}.rollback`
+  let hadBin = false
+  let publishedBin = false
+  let retainBackup = false
+  // Cleanup cannot turn a completed new pair into a reported publication failure.
+  // If cleanup itself is denied, an unused uniquely named file can remain.
+  const cleanup = (path: string) => { try { rmSync(path, { force: true }) } catch {} }
+  try {
+    mkdirSync(dirname(manifestPath), { recursive: true, mode: 0o755 })
+    writeFileSync(stagedManifest, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o644, flag: 'wx' })
+    let symlink = false
+    try {
+      const stat = lstatSync(binPath)
+      if (!stat.isFile() && !stat.isSymbolicLink()) throw new Error(`self-install: binary is not a file or symlink: ${binPath}`)
+      symlink = stat.isSymbolicLink()
+      hadBin = true
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
+    }
+    if (hadBin) {
+      // macOS link(2) follows symlinks. Preserve link text explicitly, including
+      // dangling/relative links. Hard-link regular files: no copy or re-signing.
+      if (symlink) symlinkSync(readlinkSync(binPath), backupBin)
+      else linkSync(binPath, backupBin)
+    }
+    rename(stagedBin, binPath)
+    publishedBin = true
+    rename(stagedManifest, manifestPath)
+    return manifestPath // no fallible contract operation after the second rename
+  } catch (error) {
+    if (publishedBin) {
+      try {
+        if (hadBin) rename(backupBin, binPath)
+        else rmSync(binPath)
+      } catch (rollbackError) {
+        retainBackup = true
+        throw new AggregateError([error, rollbackError],
+          `self-install: pair publication AND rollback failed; ${hadBin ? `previous binary retained at ${backupBin}` : `could not remove first-install binary ${binPath}`}`)
+      }
+    }
+    throw error
+  } finally {
+    cleanup(stagedManifest)
+    if (!retainBackup) cleanup(backupBin)
+  }
+}

package/src/installSignature.ts

@@ -0,0 +1,58 @@
+// File-scoped macOS install gate. Verify the staged executable BEFORE publishing
+// it; preserve valid signatures (and their TCC identity). No keychain operations.
+import { spawnSync } from 'child_process'
+
+export interface InstallCommandResult {
+  status: number | null
+  stdout?: string
+  stderr?: string
+  error?: Error
+}
+
+/** Injectable for sandbox tests; commands use argv, never a shell or PATH codesign. */
+export type InstallCommandRunner = (
+  command: string,
+  args: string[],
+  env: NodeJS.ProcessEnv,
+) => InstallCommandResult
+
+export const runInstallCommand: InstallCommandRunner = (command, args, env) =>
+  spawnSync(command, args, { encoding: 'utf8', env, timeout: 120_000 })
+
+export interface ExecutableSignatureOptions {
+  env?: NodeJS.ProcessEnv
+  platform?: NodeJS.Platform
+  runner?: InstallCommandRunner
+}
+
+export type ExecutableSignatureState = 'verified' | 'repaired' | 'skipped-platform'
+
+function failed(stage: string, r: InstallCommandResult): Error {
+  const detail = (r.error?.message || r.stderr || r.stdout || `exit ${r.status}`).trim()
+  return new Error(`self-install: codesign ${stage} failed: ${detail}`)
+}
+
+/**
+ * Runtime-package contract: strict verify → repair only an invalid signature →
+ * strict verify again. Any command failure throws; callers must retain the old
+ * binary/manifest and remove the staging file. Sandbox is NOT a skip flag: tests
+ * inject a runner, while real sandbox installs verify their own staged binary.
+ */
+export function ensureExecutableSignature(
+  stagedPath: string,
+  opts: ExecutableSignatureOptions = {},
+): ExecutableSignatureState {
+  if ((opts.platform ?? process.platform) !== 'darwin') return 'skipped-platform'
+  const run = opts.runner ?? runInstallCommand
+  const env = opts.env ?? process.env
+  const verifyArgs = ['--verify', '--deep', '--strict', stagedPath]
+  const initial = run('/usr/bin/codesign', verifyArgs, env)
+  if (initial.error || initial.status === null) throw failed('initial verify', initial)
+  if (initial.status === 0) return 'verified'
+
+  const sign = run('/usr/bin/codesign', ['--force', '--sign', '-', stagedPath], env)
+  if (sign.error || sign.status !== 0) throw failed('ad-hoc repair', sign)
+  const verified = run('/usr/bin/codesign', verifyArgs, env)
+  if (verified.error || verified.status !== 0) throw failed('post-repair verify', verified)
+  return 'repaired'
+}

package/src/selfInstall.ts

@@ -19,13 +19,20 @@
 // (the package now owns this path); a sandbox proof sets IAPEER_BIN_DIR so a test never
 // touches the real ~/.local/bin.
 
-import { spawnSync } from 'child_process'
-import { chmodSync, copyFileSync, existsSync, mkdirSync, renameSync, statSync } from 'fs'
+import { chmodSync, copyFileSync, mkdirSync, renameSync, rmSync, statSync } from 'fs'
+import { publishInstallPair } from './installPair.ts'
+import { randomUUID } from 'crypto'
 import { homedir } from 'os'
 import { dirname, join } from 'path'
 import { BIN_NAME, PACKAGE_NAME } from './constants.ts'
 import { scaffoldHostDocs, type HostDocsResult } from './hostDocs.ts'
-import { buildManifest, resolveIapeerRoot, writeManifestAtomic } from './manifest.ts'
+import { buildManifest, resolveIapeerRoot } from './manifest.ts'
+import {
+  ensureExecutableSignature,
+  runInstallCommand,
+  type ExecutableSignatureState,
+  type InstallCommandRunner,
+} from './installSignature.ts'
 
 /** The launcher binary name (`voicetalk-runtime`). Re-exported so callers/tests have a
  *  single import surface for the self-install contract. */
@@ -44,6 +51,11 @@ export interface SelfInstallOptions {
    *  (`<pkg>/src/cli.ts` → `<pkg>/docs`). Missing (e.g. running from a compiled bin with
    *  no source tree) → soft-skip, never fails the install. */
   docsSource?: string
+  /** Test seams: no host-global mocks or environment-based signature bypass. */
+  runner?: InstallCommandRunner
+  platform?: NodeJS.Platform
+  /** Synchronous publication fault seam for tests; no environment bypass. */
+  publishRename?: typeof renameSync
 }
 
 export type SelfInstallBinMode = 'compiled' | 'copied-self'
@@ -54,6 +66,7 @@ export interface SelfInstallResult {
   binMode: SelfInstallBinMode
   root: string
   binDir: string
+  signature: ExecutableSignatureState
   /** On-host docs scaffolding verdict (best-effort; never blocks the install). */
   docs: HostDocsResult
 }
@@ -88,20 +101,12 @@ function isBunInterpreter(execPath: string): boolean {
 
 function cleanup(path: string): void {
   try {
-    if (existsSync(path)) renameSync(path, `${path}.dead`)
+    rmSync(path, { force: true })
   } catch {
     // best-effort
   }
 }
 
-/** Tiny deterministic string hash for a unique-ish tmp suffix (Math.random is avoided
- *  to keep the tmp name reproducible within a run). */
-function hashStr(s: string): number {
-  let h = 0
-  for (let i = 0; i < s.length; i++) h = (Math.imul(31, h) + s.charCodeAt(i)) | 0
-  return h
-}
-
 /**
  * Self-install: place the launcher on PATH + write the manifest. IDEMPOTENT — a
  * repeat run produces the same on-disk bin and a byte-identical manifest (atomic
@@ -116,42 +121,51 @@ export function selfInstall(opts: SelfInstallOptions = {}): SelfInstallResult {
   const binDir = resolveBinDir(env)
   const binPath = join(binDir, BIN_NAME)
 
+  // Fail closed BEFORE any write/process: a sandbox must isolate BOTH surfaces, so
+  // both must be EXPLICIT overrides. Comparing against a "host home" cannot work —
+  // Bun's os.userInfo().homedir follows $HOME, which a sandbox points at itself.
+  if ((env.IAPEER_TEST_SANDBOX === '1' || process.env.IAPEER_TEST_SANDBOX === '1')
+    && (!env.IAPEER_BIN_DIR?.trim() || !env.IAPEER_ROOT?.trim())) {
+    throw new Error('self-install: refusing real host bin/root under IAPEER_TEST_SANDBOX=1 — set IAPEER_BIN_DIR and IAPEER_ROOT')
+  }
   mkdirSync(binDir, { recursive: true, mode: 0o755 })
 
   // Build to a sibling tmp in the SAME dir (rename is atomic only within one FS), then
-  // chmod +x and rename over the target. A reader of `voicetalk-runtime` never sees a
-  // half-written file, and a legacy symlink at binPath is replaced atomically.
-  const tmp = `${binPath}.tmp.${process.pid}.${Math.abs(hashStr(binPath + execPath))}`
+  // chmod +x, verify/repair its macOS signature, THEN rename over the target. A
+  // reader never sees a half-written file; a legacy symlink is replaced atomically.
+  const tmp = `${binPath}.tmp.${process.pid}.${randomUUID()}`
+  const run = opts.runner ?? runInstallCommand
   let binMode: SelfInstallBinMode
+  let signature: ExecutableSignatureState
+  let manifestPath: string
 
-  if (isCompilableSource(sourceEntry) && isBunInterpreter(execPath)) {
-    // PRIMARY path: running under bun from the package source (npx → bin → bun cli.ts).
-    // Compile a self-contained snapshot so the installed bin does not depend on the npm
-    // cache (GC'd) or the source tree.
-    const r = spawnSync(execPath, ['build', '--compile', '--outfile', tmp, sourceEntry], {
-      encoding: 'utf8',
-      env: env as Record<string, string>,
-    })
-    if (r.error || (r.status ?? 1) !== 0) {
-      cleanup(tmp)
-      throw new Error(
-        `self-install: bun build --compile failed: ${(r.stderr || r.stdout || r.error?.message || `exit ${r.status}`).trim()}`,
-      )
+  try {
+    if (isCompilableSource(sourceEntry) && isBunInterpreter(execPath)) {
+      // PRIMARY: compile a snapshot decoupled from the npm cache/source tree.
+      const r = run(execPath, ['build', '--compile', '--outfile', tmp, sourceEntry], env)
+      if (r.error || (r.status ?? 1) !== 0) {
+        throw new Error(
+          `self-install: bun build --compile failed: ${(r.stderr || r.stdout || r.error?.message || `exit ${r.status}`).trim()}`,
+        )
+      }
+      binMode = 'compiled'
+    } else {
+      // FALLBACK: running from a compiled bin; re-assert by copying the executable.
+      copyFileSync(execPath, tmp)
+      binMode = 'copied-self'
     }
-    binMode = 'compiled'
-  } else {
-    // FALLBACK: running from an already-compiled bin (no .ts source / execPath is not
-    // bun). Re-assert the install by copying the running executable into binDir.
-    copyFileSync(execPath, tmp)
-    binMode = 'copied-self'
-  }
-
-  chmodSync(tmp, 0o755)
-  renameSync(tmp, binPath)
 
-  // Manifest pins the ABSOLUTE installed bin into the self-config descriptor.
-  const manifest = buildManifest(binPath)
-  const manifestPath = writeManifestAtomic(manifest, env)
+    chmodSync(tmp, 0o755)
+    signature = ensureExecutableSignature(tmp, { env, runner: run, platform: opts.platform })
+    // Pair publication: the manifest (pinning the ABSOLUTE installed bin into the
+    // self-config descriptor) is staged BEFORE the binary is published; a manifest
+    // rename failure restores the previous binary inode (or removes a first install).
+    manifestPath = publishInstallPair(tmp, binPath, buildManifest(binPath), env, opts.publishRename)
+  } finally {
+    // Includes partial compiler/copy output and chmod/sign/rename failures. Do not
+    // leave .dead binaries; a failed signature gate never reaches the manifest.
+    cleanup(tmp)
+  }
 
   // On-host docs — stage this version's public docs to <root>/docs/voicetalk-runtime/.
   // Best-effort: scaffoldHostDocs already soft-skips missing source / copy errors; the
@@ -168,5 +182,5 @@ export function selfInstall(opts: SelfInstallOptions = {}): SelfInstallResult {
     }
   }
 
-  return { binPath, manifestPath, binMode, root: resolveIapeerRoot(env), binDir, docs }
+  return { binPath, manifestPath, binMode, signature, root: resolveIapeerRoot(env), binDir, docs }
 }

package/src/voiceConnect.ts

@@ -114,13 +114,15 @@ export type TranscribeOptions = {
   lang?: string
   /** Force an STT engine (`mlx-whisper` keeps it fully local); default = service cascade. */
   engine?: string
-  /** Decoder-priming prompt — biases spelling of fleet names so the wake matcher sees
-   *  «Борис», not «Барис». */
-  prompt?: string
   timeoutMs?: number
 }
 
-/** Transcribe a local audio file. Returns the raw transcript (may be empty). */
+/** Transcribe a local audio file. Returns the raw transcript (may be empty).
+ *
+ * Deliberately no `prompt` option: this client feeds a presence detector, so configured
+ * wake words must never be injected into the decoder and then mistaken for acoustic
+ * evidence. voice-connect supports prompts for other consumers; voicetalk's door does not.
+ */
 export async function transcribe(audioPath: string, opts: TranscribeOptions = {}): Promise<string> {
   const ep = resolveVoiceEndpoint()
   const form = new FormData()
@@ -128,7 +130,6 @@ export async function transcribe(audioPath: string, opts: TranscribeOptions = {}
   form.append('file', new Blob([new Uint8Array(bytes)], { type: 'audio/wav' }), audioPath.split('/').pop() ?? 'audio.wav')
   if (opts.lang) form.append('language', opts.lang)
   if (opts.engine) form.append('engine', opts.engine)
-  if (opts.prompt) form.append('prompt', opts.prompt)
   form.append('response_format', 'json')
   const res = await fetch(ep.stt, {
     method: 'POST',