@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/integrations/store.ts

@@ -16,6 +16,7 @@ import {
   captureSnapshot,
   clearPruneFailure,
   countSnapshots,
+  discardUncommittedSnapshot,
   findOperation,
   findCommittedOperation,
   listOperations,
@@ -53,6 +54,7 @@ export interface IntegrationStateStore {
   findOperation(opId: string): JournalEntry | null;
   findCommittedOperation(opId: string): JournalEntry | null;
   captureSnapshot(clientId: IntegrationClientId, opId: string, text: string | null): SnapshotRef;
+  discardUncommittedSnapshot(clientId: IntegrationClientId, opId: string): void;
   readSnapshot(entry: JournalEntry):
     | { kind: "none" }
     | { kind: "stored"; text: string; path: string }
@@ -92,6 +94,7 @@ export function createIntegrationStateStore(root: string = integrationsDir()): I
     findOperation: opId => findOperation(opId, dir),
     findCommittedOperation: opId => findCommittedOperation(opId, dir),
     captureSnapshot: (clientId, opId, text) => captureSnapshot(clientId, opId, text, dir),
+    discardUncommittedSnapshot: (clientId, opId) => discardUncommittedSnapshot(clientId, opId, dir),
     readSnapshot: entry => readSnapshot(entry, dir),
     countSnapshots: clientId => countSnapshots(clientId, dir),
     pruneSnapshots: clientId => pruneSnapshots(clientId, dir),

package/src/integrations/target.ts

@@ -23,11 +23,11 @@
  *    nesting into a file holding the user's other providers would trade a
  *    silent no-op for a silent loss.
  */
-import { EXPORT_CLIENTS, ClientPathError, type BuildContribution, type ConfigFormat } from "../clients/config-export";
+import { EXPORT_CLIENTS, ClientPathError, zcodeLegacyHomeDir, zcodeProviderStorePath, type BuildContribution, type ConfigFormat } from "../clients/config-export";
 import { PARSE_FAILED, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
 import { AmbiguousSelectorError, InvalidSelectorError, readPath } from "./merge";
 import type { OwnershipRecord } from "./ownership";
-import { INTEGRATION_CLIENTS, type IntegrationClientId } from "./registry";
+import { INTEGRATION_CLIENTS, resolveIntegrationPaths, type ResolvedIntegrationPaths, type IntegrationClientId } from "./registry";
 
 export interface IntegrationTarget {
   /** The file this operation reads, writes, journals and records ownership for. */
@@ -51,6 +51,8 @@ export interface IntegrationTarget {
    * to is as effective as it ever was.
    */
   readonly ineffective: IneffectiveWrite | null;
+  /** Active root unknown; the named config is only a historical removal target. */
+  readonly pathError?: string;
 }
 
 export interface IneffectiveWrite {
@@ -153,12 +155,44 @@ export function resolveIntegrationTarget(args: {
   record: OwnershipRecord | null;
   env?: NodeJS.ProcessEnv;
   home?: string;
+  resolvedPaths?: ResolvedIntegrationPaths;
 }): IntegrationTarget {
   const { clientId, configPath, io, record } = args;
   const declared = INTEGRATION_CLIENTS[clientId].currentStore;
   if (!declared) return configFileTarget(clientId, configPath, null);
-  const storePath = declared.path(args.env, args.home);
+  const paths = clientId === "zcode"
+    ? args.resolvedPaths ?? resolveIntegrationPaths(clientId, args.env, args.home, undefined, io)
+    : undefined;
+  const storePath = paths?.storePath ?? declared.path(args.env, args.home, io);
   const kind = io.statKind(storePath);
+  const owned = record !== null && record.clientId === clientId ? record : null;
+  const historicalStore = clientId === "zcode"
+    ? zcodeProviderStorePath({ ...(args.env ?? process.env), ZCODE_DATA_DIR: zcodeLegacyHomeDir(args.env, args.home) }, args.home, io)
+    : null;
+  if (clientId === "zcode" && owned && owned.configPath !== configPath && owned.configPath !== storePath
+    && owned.configPath !== historicalStore
+    && INTEGRATION_CLIENTS[clientId].bindsDriftedRecord?.(owned.configPath, args.env, args.home) !== true
+    && io.statKind(owned.configPath) !== "missing") {
+    throw new ClientPathError(`ZCode ownership remains at ${owned.configPath}. Its location cannot be bound to the current home or selectors; restore the original selectors and disable it before enabling a different data root. Ownership and recovery evidence are retained.`);
+  }
+  // An explicit provider-file selector can establish the active target even
+  // when the bootstrap is unreadable, but absence cannot justify a legacy write.
+  if (paths?.pathError && (!(args.env ?? process.env).ZCODE_PERSONAL_PROVIDER_CONFIG_FILE?.trim() || kind !== "file")) {
+    const removal = owned?.configPath === historicalStore
+      ? storeTarget(declared, historicalStore)
+      : configFileTarget(clientId, configPath, null);
+    return { ...removal, pathError: paths.pathError };
+  }
+  if (historicalStore && owned?.configPath === historicalStore && historicalStore !== storePath
+    && recordedBlockStillPresent(io, declared.format, historicalStore, owned)) {
+    return storeTarget(declared, historicalStore, { store: storePath, why: "owned-config-file" });
+  }
+  // Relocation must not orphan a block at the default historical path, even
+  // when the relocated store has not been created yet.
+  if (clientId === "zcode" && owned?.configPath === configPath && configPath !== paths?.configPath
+    && recordedBlockStillPresent(io, EXPORT_CLIENTS[clientId].format, configPath, owned)) {
+    return configFileTarget(clientId, configPath, { store: storePath, why: "owned-config-file" });
+  }
   if (kind === "missing") {
     const missing = declared.missingStore;
     return missing?.readsStore(storePath, path => io.statKind(path)) === true
@@ -182,7 +216,6 @@ export function resolveIntegrationTarget(args: {
    * file holds it. Disable has to remove what we wrote from where we wrote it,
    * and an apply must never leave a block in one file while writing another.
    */
-  const owned = record !== null && record.clientId === clientId ? record : null;
   if (owned?.configPath === storePath && recordedBlockStillPresent(io, declared.format, storePath, owned)) {
     return storeTarget(declared, storePath, established ? null : unestablished);
   }
@@ -214,6 +247,7 @@ export function declaredIntegrationTarget(args: {
   resolvedConfigPath: string;
   env?: NodeJS.ProcessEnv;
   home?: string;
+  io?: Pick<IntegrationIO, "readText">;
 }): IntegrationTarget | null {
   const { clientId, configPath, resolvedConfigPath } = args;
   if (configPath === resolvedConfigPath) return configFileTarget(clientId, configPath, null);
@@ -222,8 +256,11 @@ export function declaredIntegrationTarget(args: {
   }
   const declared = INTEGRATION_CLIENTS[clientId].currentStore;
   if (!declared) return null;
+  if (clientId === "zcode" && configPath === zcodeProviderStorePath(
+    { ...(args.env ?? process.env), ZCODE_DATA_DIR: zcodeLegacyHomeDir(args.env, args.home) }, args.home, args.io,
+  )) return storeTarget(declared, configPath);
   try {
-    if (declared.path(args.env, args.home) !== configPath) return null;
+    if (declared.path(args.env, args.home, args.io) !== configPath) return null;
   } catch (error) {
     // A store the operator relocated with a path we cannot resolve proves
     // nothing about the row, so the row is not a legal target.

package/src/integrations/writer.ts

@@ -18,7 +18,7 @@ import { shouldInjectApiAuthHeader } from "../codex/inject";
 import { detachedConfigSnapshot } from "../config/admitted-identity";
 import { copyPlainData } from "../lib/plain-data";
 import type { OcxConfig } from "../types";
-import { PARSE_FAILED, defaultIntegrationIO, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
+import { IntegrationWriteSizeError, PARSE_FAILED, defaultIntegrationIO, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
 import { inspectKiloCandidates } from "./kilo-candidates";
 import {
   fingerprint,
@@ -39,6 +39,7 @@ import {
   assertDroidPathsUnambiguous,
   isLoopbackOnly,
   resolveIntegrationPaths,
+  type ResolvedIntegrationPaths,
   restoreOwnershipCollision,
   type IntegrationClientId,
 } from "./registry";
@@ -161,6 +162,15 @@ function commit(args: CommitArgs): WriteOutcome {
     }
   } catch (error) {
     if (transactionStarted) return compensate(args, error, "could not write both Cline files");
+    if (error instanceof IntegrationWriteSizeError && args.snapshotPath) {
+      try {
+        args.store.discardUncommittedSnapshot(clientId, args.entry.opId);
+      } catch (cleanupError) {
+        return refuse(clientId, "write_failed", args.state,
+          `${messageOf(error)}; could not remove the unused backup: ${messageOf(cleanupError)}`, args.snapshotPath);
+      }
+      return refuse(clientId, "write_failed", args.state, messageOf(error));
+    }
     return refuse(clientId, "write_failed", args.state, messageOf(error), args.snapshotPath);
   }
   try {
@@ -643,8 +653,15 @@ export function restoreIntegration(input: IntegrationRestoreInput): WriteOutcome
   if (entry.clientId !== input.clientId) throw new Error("restore input names a different client than the operation");
 
   const clientId = entry.clientId;
-  const resolvedPath = input.resolvedPaths?.configPath
-    ?? INTEGRATION_CLIENTS[clientId].configPath(input.env, input.home);
+  let resolvedPath: string;
+  try {
+    resolvedPath = clientId === "zcode" || !input.resolvedPaths
+      ? resolveIntegrationPaths(clientId, input.env, input.home, undefined, io).configPath
+      : input.resolvedPaths.configPath;
+  } catch (error) {
+    if (!(error instanceof ClientPathError)) throw error;
+    return refuse(clientId, "unsafe", "unsafe", error.message);
+  }
   const configPath = entry.configPath;
   /*
    * Restore acts on the path the operation was journaled against. Resolving a
@@ -655,7 +672,7 @@ export function restoreIntegration(input: IntegrationRestoreInput): WriteOutcome
    * shape those bytes are in, which is what the state below is measured against.
    */
   const rowTarget = declaredIntegrationTarget({
-    clientId, configPath, resolvedConfigPath: resolvedPath, env: input.env, home: input.home,
+    clientId, configPath, resolvedConfigPath: resolvedPath, env: input.env, home: input.home, io,
   });
   if (rowTarget === null) {
     return refuse(clientId, "conflict", "conflict",
@@ -814,7 +831,7 @@ type FrozenIntegrationInput = IntegrationWriteInput & {
   io: IntegrationIO;
   env: NodeJS.ProcessEnv;
   home: string;
-  resolvedPaths: { configPath: string; detectDir: string };
+  resolvedPaths: ResolvedIntegrationPaths;
 };
 
 /**
@@ -854,7 +871,7 @@ function freezeIntegrationInput(input: IntegrationWriteInput): FrozenIntegration
    */
   const resolvedPaths = input.resolvedPaths
     ? { ...input.resolvedPaths }
-    : resolveIntegrationPaths(input.clientId, env, home, exportContextOf({ ...input, config, models: models.value }));
+    : resolveIntegrationPaths(input.clientId, env, home, exportContextOf({ ...input, config, models: models.value }), io);
   /*
    * The configuration and the roster are seams like the others, and they were the two still held
    * by reference. A coordinated write plans from this input, awaits the writer lock and a
@@ -899,7 +916,7 @@ function storeLockFile(frozen: FrozenIntegrationInput): string | null {
   if (!declared?.lockFile) return null;
   let storePath: string;
   try {
-    storePath = declared.path(frozen.env, frozen.home);
+    storePath = declared.path(frozen.env, frozen.home, frozen.io);
   } catch (error) {
     if (error instanceof ClientPathError) return null;
     throw error;

package/src/lib/advisor-activation.ts

@@ -0,0 +1,16 @@
+/** Host activation seam. Registration is synchronous; optional code loads only on use. */
+import type { OcxConfig } from "../types";
+import { setAdvisorPlanFactory } from "../server/responses/advisor-plan-slot";
+
+export function activateAdvisor(config: OcxConfig): void {
+  if (config.advisor?.enabled !== true || typeof config.advisor.model !== "string" || !config.advisor.model.trim()) {
+    setAdvisorPlanFactory(config, null);
+    return;
+  }
+  setAdvisorPlanFactory(config, async input => {
+    // A later settings write may disable the same live config before this request starts.
+    if (config.advisor?.enabled !== true || !config.advisor.model?.trim()) return null;
+    const { createAdvisorRuntimePlan } = await import("../advisor/runtime");
+    return createAdvisorRuntimePlan(input);
+  });
+}

package/src/lib/app-owned-memory-stores.ts

@@ -169,12 +169,16 @@ export const APP_OWNED_RETAINED_STORE_REGISTRATIONS = [
     category: "caches",
     snapshot: usageSummaryRetainedStoreSnapshot,
     evictOldest: evictOldestUsageSummaryForBudget,
+    // Deletes one in-memory summary entry.
+    passiveEvictable: true,
   },
   {
     id: "usage_snapshot",
     category: "caches",
     snapshot: usageSnapshotRetainedStoreSnapshot,
     evictOldest: evictOldestUsageSnapshot,
+    // Drops the retained ledger snapshot or one unpinned aggregate, both in memory.
+    passiveEvictable: true,
   },
   {
     id: "cursor_blobs",

package/src/lib/app-owned-memory.ts

@@ -1,3 +1,5 @@
+import { isPassiveRead } from "./passive-read";
+
 export type AppOwnedRetainedCategory = "logs" | "caches" | "blobs" | "continuation";
 export type AppOwnedObservedCategory = "translator" | "serialized_tails";
 
@@ -14,6 +16,11 @@ export interface RetainedStoreRegistration {
   category: AppOwnedRetainedCategory;
   snapshot(): RetainedStoreSnapshot;
   evictOldest(): number;
+  /**
+   * Eviction only releases memory: no spill, snapshot or other write. Only such stores are
+   * demoted inside a passive read (#6959); the rest wait for this process's own next enforcement.
+   */
+  passiveEvictable?: true;
 }
 
 export interface ObservedBufferRegistration {
@@ -168,11 +175,15 @@ function nextCandidate(
   snapshots: ReadonlyMap<string, RetainedStoreSnapshot>,
   ineligible: Set<string>,
 ): RetainedStoreRegistration | undefined {
+  // A passive read (a Remote Link Child's, #6959) demotes only stores whose eviction is memory-only:
+  // a continuation spills to disk and a replay cache rewrites its snapshot.
+  const passive = isPassiveRead();
   for (const category of CATEGORY_ORDER) {
     let candidate: RetainedStoreRegistration | undefined;
     let candidateAt = Number.POSITIVE_INFINITY;
     for (const registration of retainedStores.values()) {
       if (registration.category !== category || ineligible.has(registration.id)) continue;
+      if (passive && registration.passiveEvictable !== true) continue;
       const snapshot = snapshots.get(registration.id);
       if (!snapshot || snapshot.evictableBytes <= 0) continue;
       const oldestAt = snapshot.oldestAt;

package/src/lib/background-work.ts

@@ -0,0 +1,65 @@
+/**
+ * Fire-and-forget work the process started and nobody awaits.
+ *
+ * A lazy quota prime or a startup reconcile is deliberately left running behind a
+ * request so the request never waits on it. The work still owns files: the pool
+ * prime holds the native-main claim database open across ACL hardening and a WHAM
+ * read. Whoever later removes the directory those files live in has to wait for the
+ * owner. Without a handle on the work there was nothing to wait for: test teardown
+ * spun a synchronous retry loop, which blocks the very event loop the owner needs to
+ * reach its `finally` and close the file. On Windows every overlap became a 15 s EBUSY.
+ *
+ * Registering costs one Set entry per in-flight task and changes nothing about how
+ * the work runs. Settling is opt-in: test teardown calls it; requests never do.
+ */
+
+interface BackgroundWork {
+  readonly label: string;
+  readonly settled: Promise<void>;
+}
+
+const inFlight = new Set<BackgroundWork>();
+
+/** Record `work` until it settles and return it unchanged. Rejections stay the caller's. */
+export function trackBackgroundWork<T>(label: string, work: Promise<T>): Promise<T> {
+  const entry: BackgroundWork = {
+    label,
+    settled: work.then(() => { inFlight.delete(entry); }, () => { inFlight.delete(entry); }),
+  };
+  inFlight.add(entry);
+  return work;
+}
+
+/** Labels of work still running, for diagnostics. */
+export function pendingBackgroundWork(): string[] {
+  return [...inFlight].map(entry => entry.label);
+}
+
+export interface BackgroundWorkSettlement {
+  readonly settled: boolean;
+  readonly pending: string[];
+}
+
+/**
+ * Wait until no tracked work is in flight, including work started by work that was
+ * already running. A bounded wait reports what is still running instead of throwing,
+ * so the caller decides whether that is fatal.
+ */
+export async function settleBackgroundWork(options: { timeoutMs?: number } = {}): Promise<BackgroundWorkSettlement> {
+  const deadline = options.timeoutMs === undefined ? Infinity : Date.now() + options.timeoutMs;
+  while (inFlight.size > 0) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    const batch = Promise.all([...inFlight].map(entry => entry.settled)).then(() => false);
+    if (remaining === Infinity) {
+      await batch;
+      continue;
+    }
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const expired = new Promise<boolean>(resolve => { timer = setTimeout(() => resolve(true), remaining); });
+    const timedOut = await Promise.race([batch, expired]);
+    clearTimeout(timer);
+    if (timedOut) break;
+  }
+  return { settled: inFlight.size === 0, pending: pendingBackgroundWork() };
+}

package/src/lib/bounded-file-read.ts

@@ -0,0 +1,58 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
+
+const MAX_BOUNDED_READ_BYTES = 64 * 1024 * 1024;
+const READ_CHUNK_BYTES = 64 * 1024;
+
+function sameIdentity(
+  left: { dev: bigint; ino: bigint },
+  right: { dev: bigint; ino: bigint },
+): boolean {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+
+export function readBoundedRegularFileSync(path: string, limit: number): Buffer {
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_BOUNDED_READ_BYTES) {
+    throw new RangeError("invalid bounded file read limit");
+  }
+
+  const windows = process.platform === "win32";
+  const flags = constants.O_RDONLY | (windows ? 0 : constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  const entryBefore = windows ? lstatSync(path, { bigint: true }) : undefined;
+  if (entryBefore && (entryBefore.isSymbolicLink() || !entryBefore.isFile())) {
+    throw new Error("not a regular file");
+  }
+  const fd = openSync(path, flags);
+  try {
+    const opened = fstatSync(fd, { bigint: true });
+    if (!opened.isFile() || opened.size > BigInt(limit)) throw new Error("file is not bounded regular data");
+    if (entryBefore && (!sameIdentity(entryBefore, opened) || opened.ino === 0n)) {
+      throw new Error("file entry changed while opening");
+    }
+
+    // Start near the observed size, but keep probing up to limit + 1 if the file grows.
+    let bytes = Buffer.alloc(Number(opened.size) + 1);
+    let length = 0;
+    while (length < limit + 1) {
+      if (length === bytes.length) {
+        const capacity = Math.min(limit + 1, Math.max(bytes.length * 2, bytes.length + READ_CHUNK_BYTES));
+        const next = Buffer.alloc(capacity);
+        bytes.copy(next, 0, 0, length);
+        bytes = next;
+      }
+      const count = readSync(fd, bytes, length, Math.min(READ_CHUNK_BYTES, bytes.length - length), null);
+      if (count === 0) break;
+      length += count;
+    }
+    if (length > limit) throw new Error("file exceeds byte limit");
+
+    if (entryBefore) {
+      const entryAfter = lstatSync(path, { bigint: true });
+      if (entryAfter.isSymbolicLink() || !entryAfter.isFile() || !sameIdentity(opened, entryAfter)) {
+        throw new Error("file entry changed while reading");
+      }
+    }
+    return bytes.subarray(0, length);
+  } finally {
+    closeSync(fd);
+  }
+}

package/src/lib/bun-path-runtime.d.mts

@@ -5,7 +5,16 @@ export interface DesktopCliIo {
 export interface PathBunIo extends DesktopCliIo {
   now?: () => number;
   realpath?: (path: string) => string;
-  stat?: (path: string) => { isFile(): boolean; mode: number };
+  stat?: (path: string) => { isFile(): boolean; mode: number; uid?: number };
+  lstat?: (path: string) => {
+    isFile(): boolean;
+    isDirectory(): boolean;
+    isSymbolicLink(): boolean;
+    mode: number;
+    uid?: number;
+  };
+  readlink?: (path: string) => string;
+  geteuid?: () => number | undefined;
   isRealBunBinary?: (path: string) => boolean;
   spawnSync?: (path: string, args: string[], options: {
     env: NodeJS.ProcessEnv;

package/src/lib/bun-path-runtime.mjs

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { accessSync, constants, lstatSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { posix, win32 } from "node:path";
 import { performance } from "node:perf_hooks";
@@ -7,6 +7,7 @@ import { isRealBunBinary } from "./bun-binary-validator.mjs";
 
 const STABLE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 const MAX_VERSION_BYTES = 4096;
+const MAX_SYMLINK_EXPANSIONS = 40;
 const IDENTITY_PROBE = "process.stdout.write(String(typeof Bun==='object'&&Bun.version))";
 
 function stableVersion(value) {
@@ -17,6 +18,62 @@ function stableVersion(value) {
   return numbers.every(Number.isSafeInteger) ? numbers : null;
 }
 
+function trustedPosixCandidate(candidate, canonical, io) {
+  const lstat = io.lstat ?? lstatSync;
+  const readlink = io.readlink ?? readlinkSync;
+  const uid = io.geteuid?.() ?? process.geteuid?.();
+  if (!Number.isSafeInteger(uid) || uid < 0) return false;
+
+  const walk = path => {
+    let pending = path.slice(1).split("/");
+    let current = "/";
+    let expansions = 0;
+    while (pending.length) {
+      const [component, ...remaining] = pending;
+      pending = remaining;
+      if (!component || component === ".") continue;
+      if (component === "..") {
+        current = posix.dirname(current);
+        continue;
+      }
+      const entry = posix.join(current, component);
+      const info = lstat(entry);
+      if (!Number.isSafeInteger(info.uid) || (info.uid !== 0 && info.uid !== uid)) return null;
+      if (info.isSymbolicLink()) {
+        if (++expansions > MAX_SYMLINK_EXPANSIONS) return null;
+        const target = readlink(entry);
+        pending = target.startsWith("/")
+          ? [...target.slice(1).split("/"), ...pending]
+          : [
+            ...(current === "/" ? [] : current.slice(1).split("/")),
+            ...target.split("/"),
+            ...pending,
+          ];
+        current = "/";
+        continue;
+      }
+      if (remaining.length || pending.length) {
+        // No writable-ancestor exemption: a shared sticky directory passes its own
+        // ownership check but lets another user replace a child entry between the
+        // ancestry walk and the exec probe, substituting an unvalidated binary.
+        if (!info.isDirectory() || (info.mode & 0o022) !== 0) return null;
+      } else if (!info.isFile() || (info.mode & 0o022) !== 0) {
+        return null;
+      }
+      current = entry;
+    }
+    return current;
+  };
+
+  const resolved = walk(candidate);
+  if (!resolved || (io.realpath ?? realpathSync.native)(resolved) !== canonical) return false;
+  const parent = lstat(posix.dirname(canonical));
+  return parent.isDirectory()
+    && Number.isSafeInteger(parent.uid)
+    && (parent.uid === 0 || parent.uid === uid)
+    && (parent.mode & 0o022) === 0;
+}
+
 /** Discover the first absolute PATH Bun passing version-policy and identity checks. */
 export function findPathBun({
   env = process.env, platform = process.platform, pinnedVersion,
@@ -54,14 +111,16 @@ export function findPathBun({
     if (now() >= end) break;
     if (!directory || !absolute(directory)) continue;
     try {
-      const path = realpath(paths.join(directory, platform === "win32" ? "bun.exe" : "bun"));
+      const candidatePath = paths.join(directory, platform === "win32" ? "bun.exe" : "bun");
+      const path = realpath(candidatePath);
       if (!absolute(path)) continue;
+      if (platform !== "win32" && !trustedPosixCandidate(candidatePath, path, io)) continue;
       const identity = platform === "win32" ? path.toLowerCase() : path;
       if (seen.has(identity)) continue;
       seen.add(identity);
       const file = stat(path);
       if (!file.isFile()) continue;
-      if (platform !== "win32" && ((file.mode & 0o022) || (stat(paths.dirname(path)).mode & 0o022))) continue;
+      if (platform !== "win32" && (file.mode & 0o022)) continue;
       access(path, constants.X_OK);
       if (!validate(path)) continue;
       const version = probe(path, ["--version"]);

package/src/lib/desktop-proxy-route.ts

@@ -0,0 +1,30 @@
+import { configuredOutboundFetch, effectiveProxyFor, noProxyMatches, type ProxyEnvMap, type ProxyCapableRequestInit } from "./proxy-env";
+
+/** Bind both native desktop transports to one explicit route; never fall back after failure. */
+export function desktopProxyFor(url: URL, env: ProxyEnvMap = process.env): string | false {
+  if (noProxyMatches(url, env)) return false;
+  const key = url.protocol === "https:" ? "HTTPS_PROXY" : "HTTP_PROXY";
+  let selected = effectiveProxyFor(url, env);
+  // Unlike an implicit Bun route, this transport explicitly binds HTTP(S) CONNECT.
+  // A malformed scheme-specific setting still refuses instead of falling through.
+  if (!selected && url.protocol === "https:" && !(env[key]?.trim() || env[key.toLowerCase()]?.trim())) {
+    const all = env.ALL_PROXY?.trim() || env.all_proxy?.trim();
+    if (all) {
+      let parsed: URL; try { parsed = new URL(all); } catch { throw new Error("desktop_egress_proxy_invalid"); }
+      if (["http:", "https:"].includes(parsed.protocol)) selected = all;
+    }
+  }
+  if (selected) {
+    const proxy = new URL(selected);
+    if (!["http:", "https:", "socks5:", "socks5h:"].includes(proxy.protocol) || !proxy.hostname
+      || proxy.search || proxy.hash || proxy.pathname !== "" && proxy.pathname !== "/") throw new Error("desktop_egress_proxy_invalid");
+    return selected;
+  }
+  // An explicit but unsupported route must not quietly become direct desktop traffic.
+  if ([env[key], env[key.toLowerCase()], env.ALL_PROXY, env.all_proxy].some(value => value?.trim())) throw new Error("desktop_egress_proxy_invalid");
+  return false;
+}
+export function desktopOutboundFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
+  const url = new URL(input instanceof Request ? input.url : String(input));
+  return configuredOutboundFetch(input, { ...init, proxy: desktopProxyFor(url) } as ProxyCapableRequestInit);
+}

package/src/lib/desktop-upstream-tunnel.ts

@@ -0,0 +1,107 @@
+import { connect as tcpConnect, isIP, type Socket } from "node:net";
+import { checkServerIdentity, connect as tlsConnect, type TLSSocket } from "node:tls";
+import { desktopProxyFor } from "./desktop-proxy-route";
+import { socks5Credentials, socks5Handshake } from "./socks5-handshake";
+
+// Shares the SOCKS exchange extracted by lcxhh521 in PR #5947 (efdccdbfac3f).
+// Lifecycle here additionally bounds the entire dial and handles close/abort/header limits.
+export interface DesktopTunnelOptions {
+  proxy?: string | false;
+  signal?: AbortSignal;
+  timeoutMs?: number;
+  /** Isolated test peers; production always uses verified TLS to chatgpt.com:443. */
+  target?: { host: string; port: number };
+  ca?: string;
+  proxyCa?: string;
+}
+const fail = () => new Error("desktop_upstream_connection_failed");
+class HandshakeReader {
+  private buffer: Buffer<ArrayBufferLike> = Buffer.alloc(0);
+  private failure: Error | null = null;
+  private waiting: { ready: () => boolean; resolve: () => void; reject: (error: Error) => void } | null = null;
+  private onData = (chunk: Buffer) => {
+    if (this.buffer.length + chunk.length > 65536) { this.onFailure(); return; }
+    this.buffer = Buffer.concat([this.buffer, chunk]);
+    if (this.waiting?.ready()) { const current = this.waiting; this.waiting = null; current.resolve(); }
+  };
+  private onFailure = () => { this.failure = fail(); const current = this.waiting; this.waiting = null; current?.reject(this.failure); };
+  constructor(private socket: Socket, private signal: AbortSignal) {
+    socket.on("data", this.onData); socket.once("error", this.onFailure); socket.once("end", this.onFailure); socket.once("close", this.onFailure);
+    signal.addEventListener("abort", this.onFailure, { once: true }); if (signal.aborted) this.onFailure(); socket.resume();
+  }
+  write(bytes: Uint8Array | string): void { if (this.failure) throw this.failure; this.socket.write(bytes); }
+  private async until(ready: () => boolean): Promise<void> {
+    if (this.failure) throw this.failure;
+    if (ready()) return;
+    if (this.waiting) throw fail();
+    await new Promise<void>((resolve, reject) => { this.waiting = { ready, resolve, reject }; });
+  }
+  private take(length: number): Buffer { const out = this.buffer.subarray(0, length); this.buffer = this.buffer.subarray(length); return out; }
+  async readExact(length: number): Promise<Buffer> { await this.until(() => this.buffer.length >= length); return this.take(length); }
+  async readHead(): Promise<string> { await this.until(() => this.buffer.indexOf("\r\n\r\n") >= 0); return this.take(this.buffer.indexOf("\r\n\r\n") + 4).toString("latin1"); }
+  dispose(): void {
+    this.socket.pause(); this.socket.removeListener("data", this.onData); this.socket.removeListener("error", this.onFailure);
+    this.socket.removeListener("end", this.onFailure); this.socket.removeListener("close", this.onFailure);
+    this.signal.removeEventListener("abort", this.onFailure);
+    if (this.buffer.length) this.socket.unshift(this.buffer); this.buffer = Buffer.alloc(0); this.onFailure();
+  }
+}
+function waitConnected(socket: Socket, event: "connect" | "secureConnect", signal: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const dispose = () => { socket.off(event, done); socket.off("error", failure); socket.off("close", failure); signal.removeEventListener("abort", failure); };
+    const done = () => { dispose(); resolve(); };
+    const failure = () => { dispose(); reject(fail()); };
+    socket.once(event, done); socket.once("error", failure); socket.once("close", failure);
+    signal.addEventListener("abort", failure, { once: true }); if (signal.aborted) failure();
+  });
+}
+/** Fixed-destination TLS dial for native desktop upgraded sockets. No logs or direct fallback. */
+export async function dialDesktopUpstream(options: DesktopTunnelOptions = {}): Promise<TLSSocket> {
+  const timeout = options.timeoutMs ?? 10000;
+  if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30000) throw fail();
+  const cancel = new AbortController(), timer = setTimeout(() => cancel.abort(), timeout);
+  const signal = options.signal ? AbortSignal.any([options.signal, cancel.signal]) : cancel.signal;
+  const sockets = new Set<Socket>();
+  const own = <T extends Socket>(socket: T): T => { sockets.add(socket); socket.on("error", () => {}); return socket; };
+  const destroy = () => { for (const socket of sockets) socket.destroy(); };
+  signal.addEventListener("abort", destroy, { once: true });
+  try {
+    if (signal.aborted) throw fail();
+    const proxy = options.proxy === undefined ? desktopProxyFor(new URL("https://chatgpt.com")) : options.proxy;
+    const target = options.target ?? { host: "chatgpt.com", port: 443 };
+    let raw: Socket;
+    if (proxy === false) {
+      raw = own(tcpConnect(target)); await waitConnected(raw, "connect", signal);
+    } else {
+      const url = new URL(proxy), protocol = url.protocol;
+      if (!["http:", "https:", "socks5:", "socks5h:"].includes(protocol) || !url.hostname || url.search || url.hash || url.pathname !== "" && url.pathname !== "/") throw fail();
+      const host = url.hostname.replace(/^\[|\]$/g, ""), port = Number(url.port) || (protocol === "https:" ? 443 : protocol.startsWith("socks") ? 1080 : 80);
+      raw = own(tcpConnect({ host, port })); await waitConnected(raw, "connect", signal);
+      if (protocol === "https:") {
+        raw = own(tlsConnect({ socket: raw, servername: isIP(host) ? undefined : host, ca: options.proxyCa,
+          rejectUnauthorized: true, checkServerIdentity: (_name, certificate) => checkServerIdentity(host, certificate), ALPNProtocols: ["http/1.1"] }));
+        await waitConnected(raw, "secureConnect", signal);
+      }
+      const reader = new HandshakeReader(raw, signal);
+      try {
+        if (protocol.startsWith("socks")) await socks5Handshake(reader, target, socks5Credentials(url));
+        else {
+          const authority = `${target.host}:${target.port}`;
+          const lines = [`CONNECT ${authority} HTTP/1.1`, `Host: ${authority}`];
+          if (url.username || url.password) lines.push(`Proxy-Authorization: Basic ${Buffer.from(`${decodeURIComponent(url.username)}:${decodeURIComponent(url.password)}`).toString("base64")}`);
+          reader.write(lines.join("\r\n") + "\r\n\r\n");
+          if (!/^HTTP\/1\.[01] 2\d\d(?: |\r)/.test(await reader.readHead())) throw fail();
+        }
+      } finally { reader.dispose(); }
+    }
+    if (signal.aborted || raw.destroyed) throw fail();
+    const secured = own(tlsConnect({ socket: raw, servername: "chatgpt.com", ca: options.ca, rejectUnauthorized: true, ALPNProtocols: ["http/1.1"] }));
+    // The CONNECT reader paused its stream before handing buffered bytes back. Bun's
+    // TLS-over-TLS path needs the outer TLS stream explicitly resumed for the new handshake.
+    raw.resume();
+    await waitConnected(secured, "secureConnect", signal);
+    if (signal.aborted) throw fail();
+    return secured;
+  } catch { destroy(); throw fail(); }
+  finally { clearTimeout(timer); signal.removeEventListener("abort", destroy); }
+}