@nemoobc/opencode-termux 1.19.1 → 1.20.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 nemoobc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -4,6 +4,7 @@
 
 [![npm](https://img.shields.io/npm/v/@nemoobc/opencode-termux?color=cb3837&logo=npm)](https://www.npmjs.com/package/@nemoobc/opencode-termux)
 [![release](https://img.shields.io/github/v/release/nemoobc/opencode-termux?color=3B82F6)](https://github.com/nemoobc/opencode-termux/releases)
+[![CI](https://img.shields.io/github/actions/workflow/status/nemo-base-eth/opencode-termux/test.yml?label=test&color=22C55E)](.github/workflows/test.yml)
 [![platform](https://img.shields.io/badge/platform-Android%20%7C%20Termux-3DDC84)](#)
 [![arch](https://img.shields.io/badge/arch-arm64-blue)](#)
 [![sync upstream](https://img.shields.io/badge/sync-upstream%20otomatis-C9A227)](.github/workflows/sync-upstream.yml)
@@ -58,10 +59,17 @@ opencode-termux (shim Node)
 ## 🚀 Install
 
 ```bash
-pkg update && pkg install nodejs-lts
+pkg update && pkg install nodejs-lts tar
 npm i -g @nemoobc/opencode-termux
 ```
 
+> 📖 **Panduan lengkap** — persyaratan, verifikasi, update/uninstall,
+> troubleshooting, FAQ: [docs/INSTALASI.md](docs/INSTALASI.md)
+
+> 📦 **Tanpa Node / offline?** Ambil `opencode-termux-installer.sh` +
+> bundle `.tar.gz` dari [Releases](https://github.com/nemo-base-eth/opencode-termux/releases) —
+> installer murni POSIX sh, auto-detect arm64/x64, sha256 diverifikasi.
+
 > Jika muncul warning `install-scripts`, izinkan sekali:
 > ```bash
 > npm config set allow-scripts=@nemoobc/opencode-termux --location=user
@@ -74,15 +82,44 @@ npm i -g @nemoobc/opencode-termux
 opencode-termux --version
 ```
 
-Alias biar terasa asli:
+### 🛠 Perintah bawaan CLI
+
+| Perintah | Fungsi |
+|---|---|
+| `opencode-termux` | Jalankan CLI opencode (argumen diteruskan) |
+| `opencode-termux update` | Perbarui binary ke upstream terbaru |
+| `opencode-termux doctor` | Diagnosis lingkungan & bundle (exit code jujur) |
+| `opencode-termux version` | Info versi paket + binary |
+
+> Identitas perintah konsisten satu nama: **`opencode-termux`** — tanpa alias,
+> tanpa nama lain, di semua dokumentasi, log, dan script internal.
+
+## 🧪 Tes
 
 ```bash
-ln -sf $PREFIX/bin/opencode-termux $PREFIX/bin/opencode
+npm test              # struktur + unit (cepat, tanpa unduhan besar)
+npm run test:e2e      # e2e penuh: install bundle + smoke test + subcommand
 ```
 
+CI GitHub menjalankan tes struktur di setiap push, plus **e2e arm64 sungguhan**
+(emulasi QEMU — loader musl prebuilt Termux benar-benar dieksekusi).
+
+## 🔒 Keamanan
+
+- Tarball binary diverifikasi **sha512** terhadap metadata resmi registry npm.
+- Unduhan memakai retry + backoff eksponensial (tahan jaringan gemetar).
+
 ## 📦 Versi
 
-Tiga versi terakhir selalu tersedia — [lihat semua](https://www.npmjs.com/package/@nemoobc/opencode-termux?activeTab=versions).
+Semua versi npm: [npmjs.com/@nemoobc/opencode-termux](https://www.npmjs.com/package/@nemoobc/opencode-termux?activeTab=versions) ·
+Rilis & changelog: [GitHub Releases](https://github.com/nemo-base-eth/opencode-termux/releases)
+
+## 🌐 Ekosistem
+
+| Proyek | Fungsi |
+|---|---|
+| **[opencode-termux](https://github.com/nemo-base-eth/opencode-termux)** | CLI opencode native di Termux — repo ini |
+| **[opencode-android](https://github.com/nemo-base-eth/opencode-android)** | opencode sebagai aplikasi Android native ([unduh APK v1.5.0](https://github.com/nemoobc/opencode-android/releases/download/v1.5.0/OpenCode-v1.5.0.apk)) |
 
 ## 📄 Lisensi
 

package/bin/opencode-termux.js

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+const { spawnSync } = require("child_process")
+const fs = require("fs")
+const path = require("path")
+const root = path.join(__dirname, "..")
+const vendor = path.join(root, "vendor")
+const loader = path.join(vendor, "ld-musl.so")
+const bin = path.join(vendor, "opencode")
+const PKG = require(path.join(root, "package.json"))
+const PREFIX = process.env.TERMUX_PREFIX || "/data/data/com.termux/files/usr"
+
+function ready() {
+  return fs.existsSync(loader) && fs.existsSync(bin)
+}
+
+// Auto-heal: kalau postinstall terlewat (mis. --ignore-scripts), pasang sekarang.
+function heal() {
+  if (ready()) return true
+  console.log("[opencode-termux] vendor belum ada — menjalankan installer…")
+  const r = spawnSync(process.execPath, [path.join(root, "install.mjs")], {
+    stdio: "inherit",
+    env: process.env,
+  })
+  if (r.status !== 0 || !ready()) {
+    console.error("[opencode-termux] instalasi bundle gagal. Coba manual:")
+    console.error("  npm rebuild @nemoobc/opencode-termux")
+    return false
+  }
+  return true
+}
+
+// DNS fix: musl hasil build kita membaca config dari prefix Termux —
+// pastikan filenya ada (bisa ditulis tanpa root).
+function ensureDns() {
+  try {
+    const etc = path.join(PREFIX, "etc")
+    fs.mkdirSync(etc, { recursive: true })
+    const rc = path.join(etc, "resolv.conf")
+    if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n")
+    const hh = path.join(etc, "hosts")
+    if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n")
+  } catch {}
+}
+
+function runBinary(args) {
+  // LD_PRELOAD bawaan Termux (libtermux-exec) dibuat untuk Bionic dan akan
+  // gagal relokasi jika ikut dimuat ke proses musl — jadi selalu dibersihkan.
+  const { LD_PRELOAD, LD_PRELOAD_32BIT, ...cleanEnv } = process.env
+  ensureDns()
+  const r = spawnSync(loader, [bin, ...args], {
+    stdio: "inherit",
+    env: { ...cleanEnv, LD_LIBRARY_PATH: vendor },
+  })
+  if (r.error) {
+    console.error("[opencode-termux] gagal menjalankan binary:", r.error.message)
+    return 1
+  }
+  const sigExit = { SIGINT: 130, SIGQUIT: 131, SIGTERM: 143 }
+  return r.status ?? sigExit[r.signal] ?? 1
+}
+
+async function cmdUpdate() {
+  console.log(`[opencode-termux] memperbarui bundle (paket v${PKG.version})…`)
+  const env = { ...process.env }
+  delete env.LD_PRELOAD
+  delete env.LD_PRELOAD_32BIT
+  const r = spawnSync(process.execPath, [path.join(root, "install.mjs")], {
+    stdio: "inherit",
+    env: env,
+  })
+  if (r.status !== 0) {
+    console.error("[opencode-termux] ❌ update gagal.")
+    return 1
+  }
+  // sinkronkan pin di package.json modul agar auto-heal berikutnya konsisten
+  try {
+    const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json()
+    if (latest.version && latest.version !== PKG.opencodeUpstream) {
+      PKG.opencodeUpstream = latest.version
+      fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n")
+    }
+  } catch {}
+  console.log("[opencode-termux] ✅ update selesai.")
+  return 0
+}
+
+function cmdDoctor() {
+  let critical = 0
+  const cek = (name, fn, { crit = true } = {}) => {
+    try {
+      const info = fn()
+      console.log(`✅ ${name}${info ? ` — ${info}` : ""}`)
+    } catch (e) {
+      if (crit) critical++
+      console.log(`${crit ? "❌" : "⚠️ "} ${name} — ${e.message}`)
+    }
+  }
+
+  console.log(`[opencode-termux] doctor v${PKG.version} (upstream ${PKG.opencodeUpstream})`)
+  cek("platform", () => {
+    if (process.platform !== "android") throw new Error(`process.platform=${process.platform} (bukan android)`)
+    return "android"
+  }, { crit: false })
+  cek("arsitektur", () => {
+    if (process.arch !== "arm64" && process.arch !== "x64") throw new Error(`${process.arch} tidak didukung`)
+    return process.arch
+  })
+  cek("node >= 18", () => {
+    const [M] = process.versions.node.split(".").map(Number)
+    if (M < 18) throw new Error(`node ${process.versions.node}`)
+    return process.versions.node
+  })
+  cek("tar tersedia", () => {
+    const r = spawnSync("tar", ["--version"], { stdio: "ignore" })
+    if (r.error || r.status !== 0) throw new Error("tidak ditemukan — pkg install tar")
+  })
+  cek("vendor lengkap", () => {
+    if (!ready()) throw new Error("vendor/ tidak lengkap — jalankan 'opencode-termux update'")
+    return `${fs.readdirSync(vendor).length} file`
+  })
+  cek("DNS resolv.conf", () => {
+    const rc = path.join(PREFIX, "etc", "resolv.conf")
+    if (!fs.existsSync(rc)) throw new Error(`${rc} hilang`)
+    return "ada"
+  }, { crit: false })
+  cek("jaringan registry npm", () => {
+    const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {
+      timeout: 10000,
+    })
+    if (r.status !== 0) throw new Error("registry tak terjangkau")
+  })
+  cek("binary opencode", () => {
+    if (!ready()) throw new Error("binary belum terpasang")
+    const { LD_PRELOAD, LD_PRELOAD_32BIT, ...cleanEnv } = process.env
+    const out = spawnSync(loader, [bin, "--version"], {
+      encoding: "utf8",
+      env: { ...cleanEnv, LD_LIBRARY_PATH: vendor },
+    })
+    if (out.status !== 0) throw new Error("gagal dieksekusi")
+    return `v${out.stdout.trim()}`
+  })
+
+  console.log(critical === 0 ? "[opencode-termux] ✅ semua komponen kritis sehat" : `[opencode-termux] ❌ ${critical} masalah kritis`)
+  return critical === 0 ? 0 : 1
+}
+
+function cmdVersion() {
+  let binVer = "(belum terpasang)"
+  if (ready()) {
+    const { LD_PRELOAD, LD_PRELOAD_32BIT, ...cleanEnv } = process.env
+    const out = spawnSync(loader, [bin, "--version"], {
+      encoding: "utf8",
+      env: { ...cleanEnv, LD_LIBRARY_PATH: vendor },
+    })
+    if (out.status === 0 && out.stdout.trim()) binVer = out.stdout.trim()
+  }
+  console.log(`opencode-termux v${PKG.version} (upstream opencode ${PKG.opencodeUpstream}, binary ${binVer})`)
+  return 0
+}
+
+async function main() {
+  const arg = process.argv[2]
+  if (arg === "update") return cmdUpdate()
+  if (arg === "doctor") return cmdDoctor()
+  if (arg === "version") return cmdVersion()
+  if (arg === "help" || arg === "--help" || arg === "-h") {
+    console.log(`opencode-termux v${PKG.version}
+pakai:
+  opencode-termux                 jalankan CLI opencode (argumen diteruskan)
+  opencode-termux update          perbarui binary ke upstream terbaru
+  opencode-termux doctor          diagnosis lingkungan & bundle
+  opencode-termux version         info versi paket + binary`)
+    return 0
+  }
+  if (!heal()) return 1
+  return runBinary(process.argv.slice(2))
+}
+
+main().then(code => process.exit(code)).catch(e => {
+  console.error("[opencode-termux]", e.message)
+  process.exit(1)
+})

package/install.mjs

@@ -11,33 +11,35 @@ import { execFileSync } from "child_process"
 import { Readable } from "stream"
 import { pipeline } from "stream/promises"
 import { fileURLToPath } from "url"
+import { alpinePkg } from "./lib/alpine.mjs"
+import { fetchWithRetry } from "./lib/net.mjs"
+import { expectedFromRegistry, verifySha512 } from "./lib/integrity.mjs"
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const pkgJson = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf8"))
 const ARCH = process.env.OCX_ARCH || "arm64"
 const FORCE = !!process.env.OCX_FORCE
 const IS_ANDROID = process.platform === "android"
+const T0 = Date.now()
+const log = m => console.log(`[opencode-termux] ${m}`)
 
 // Versi upstream: env > package.json > otomatis ambil terbaru dari registry
 let V = process.env.OCX_UPSTREAM || pkgJson.opencodeUpstream
 if (!V) {
   const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json()
   V = latest.version
-  console.log(`[opencode-termux] upstream opencode-ai terbaru: ${V}`)
+  log(`upstream opencode-ai terbaru: ${V}`)
 }
-const GLOBAL_HINT =
-  process.platform === "win32" ? "" : ""
-
 if (!IS_ANDROID && !FORCE) {
-  console.log("[opencode-termux] Bukan Termux/Android — instalasi dilewati (pakai opencode-ai resmi).")
+  log("Bukan Termux/Android — instalasi dilewati (pakai opencode-ai resmi).")
   process.exit(0)
 }
 
 const A = ARCH === "x64" ? "x86_64" : "aarch64"
 
 async function dl(url, dest) {
-  console.log(`[opencode-termux] download ${url.split("/").pop()}`)
-  const res = await fetch(url)
+  log(`download ${url.split("/").pop()}`)
+  const res = await fetchWithRetry(fetch, url, {}, 3, m => log(m))
   if (!res.ok) throw new Error(`HTTP ${res.status} — ${url}`)
   await pipeline(Readable.fromWeb(res.body), fs.createWriteStream(dest))
 }
@@ -54,87 +56,108 @@ const untar = (tgz, dest, members = []) => {
 const work = path.join(__dirname, ".build")
 fs.rmSync(work, { recursive: true, force: true })
 fs.mkdirSync(work, { recursive: true })
-const AV = "v3.21", AL = "3.21.3"
 
-// 1) binary opencode (musl) dari npm resmi
-await dl(`https://registry.npmjs.org/opencode-linux-${ARCH}-musl/-/opencode-linux-${ARCH}-musl-${V}.tgz`, `${work}/oc.tgz`)
-untar(`${work}/oc.tgz`, `${work}/oc`)
+try {
+  const AV = "v3.21", AL = "3.21.3"
 
-// 2) libgcc + libstdc++
-const apkDir = `${work}/apk`; fs.mkdirSync(apkDir, { recursive: true })
-for (const f of [`libgcc-14.2.0-r4.apk`, `libstdc%2B%2B-14.2.0-r4.apk`]) {
-  await dl(`https://dl-cdn.alpinelinux.org/alpine/${AV}/main/${A}/${f}`, `${apkDir}/${f}`)
-  untar(`${apkDir}/${f}`, apkDir)
-}
+  // Resolusi dinamis paket Alpine dari CDN (lihat lib/alpine.mjs)
+  const pkg = name => alpinePkg(fetch, `https://dl-cdn.alpinelinux.org/alpine/${AV}/main/${A}`, name)
 
-// 3) rakit vendor/
-const vendor = path.join(__dirname, "vendor")
-fs.rmSync(vendor, { recursive: true, force: true }); fs.mkdirSync(vendor)
-const cp = (dir, name) => fs.copyFileSync(path.join(dir, name), path.join(vendor, name))
-if (A === "aarch64") {
-  // loader hasil build khusus: resolv.conf & hosts menunjuk ke prefix Termux
-  cp(path.join(__dirname, "prebuilt"), "ld-musl-aarch64-termux.so")
-  fs.renameSync(path.join(vendor, "ld-musl-aarch64-termux.so"), path.join(vendor, "ld-musl.so"))
-} else {
-  const mini = `${work}/ap`; await dl(
-    `https://dl-cdn.alpinelinux.org/alpine/${AV}/releases/${A}/alpine-minirootfs-${AL}-${A}.tar.gz`, `${work}/ap.tgz`)
-  untar(`${work}/ap.tgz`, mini, ["lib"])
-  cp(`${mini}/lib`, `ld-musl-${A}.so.1`); fs.renameSync(path.join(vendor, `ld-musl-${A}.so.1`), path.join(vendor, "ld-musl.so"))
-}
-cp(`${work}/oc/package/bin`, "opencode")
-cp(`${apkDir}/usr/lib`, "libstdc++.so.6"); cp(`${apkDir}/usr/lib`, "libstdc++.so.6.0.33"); cp(`${apkDir}/usr/lib`, "libgcc_s.so.1")
-for (const f of fs.readdirSync(vendor)) fs.chmodSync(path.join(vendor, f), 0o755)
+  // 1) binary opencode (musl) dari npm resmi — diverifikasi sha512 registry
+  const ocTgz = `opencode-linux-${ARCH}-musl-${V}.tgz`
+  await dl(`https://registry.npmjs.org/opencode-linux-${ARCH}-musl/-/${ocTgz}`, `${work}/oc.tgz`)
+  log("verifikasi integritas sha512…")
+  const pk = await (await fetchWithRetry(fetch, `https://registry.npmjs.org/opencode-linux-${ARCH}-musl`, {}, 3)).json()
+  verifySha512(`${work}/oc.tgz`, expectedFromRegistry(pk, V))
+  untar(`${work}/oc.tgz`, `${work}/oc`)
 
-// 4) siapkan DNS config di prefix Termux (bisa ditulis TANPA root)
-function ensureEtc() {
-  try {
-    const PREFIX = process.env.TERMUX_PREFIX || "/data/data/com.termux/files/usr"
-    const etc = path.join(PREFIX, "etc")
-    fs.mkdirSync(etc, { recursive: true })
-    const rc = path.join(etc, "resolv.conf")
-    if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n")
-    const hh = path.join(etc, "hosts")
-    if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n")
-  } catch (e) {
-    if (!FORCE && IS_ANDROID) throw e
+  // 2) libgcc + libstdc++ (versi terbaru yang tersedia di CDN)
+  const apkDir = `${work}/apk`; fs.mkdirSync(apkDir, { recursive: true })
+  for (const name of ["libgcc", "libstdc%2B%2B"]) {
+    const f = await pkg(name)
+    await dl(`https://dl-cdn.alpinelinux.org/alpine/${AV}/main/${A}/${f}`, `${apkDir}/${f}`)
+    untar(`${apkDir}/${f}`, apkDir)
   }
-}
-ensureEtc()
 
-// 5) smoke test (LD_PRELOAD termux-exec dibuang: tidak kompatibel dengan musl)
-console.log("[opencode-termux] smoke test…")
-const { LD_PRELOAD, LD_PRELOAD_32BIT, ...cleanEnv } = process.env
-execFileSync(path.join(vendor, "ld-musl.so"),
-  [path.join(vendor, "opencode"), "--version"],
-  { stdio: "inherit", env: { ...cleanEnv, LD_LIBRARY_PATH: vendor } })
+  // 3) rakit vendor/
+  const vendor = path.join(__dirname, "vendor")
+  fs.rmSync(vendor, { recursive: true, force: true }); fs.mkdirSync(vendor)
+  const cp = (dir, name) => fs.copyFileSync(path.join(dir, name), path.join(vendor, name))
+  if (A === "aarch64") {
+    // loader hasil build khusus: resolv.conf & hosts menunjuk ke prefix Termux
+    cp(path.join(__dirname, "prebuilt"), "ld-musl-aarch64-termux.so")
+    fs.renameSync(path.join(vendor, "ld-musl-aarch64-termux.so"), path.join(vendor, "ld-musl.so"))
+  } else {
+    const mini = `${work}/ap`; await dl(
+      `https://dl-cdn.alpinelinux.org/alpine/${AV}/releases/${A}/alpine-minirootfs-${AL}-${A}.tar.gz`, `${work}/ap.tgz`)
+    untar(`${work}/ap.tgz`, mini, ["lib"])
+    cp(`${mini}/lib`, `ld-musl-${A}.so.1`); fs.renameSync(path.join(vendor, `ld-musl-${A}.so.1`), path.join(vendor, "ld-musl.so"))
+  }
+  cp(`${work}/oc/package/bin`, "opencode")
+  cp(`${apkDir}/usr/lib`, "libstdc++.so.6"); cp(`${apkDir}/usr/lib`, "libstdc++.so.6.0.33"); cp(`${apkDir}/usr/lib`, "libgcc_s.so.1")
+  for (const f of fs.readdirSync(vendor)) fs.chmodSync(path.join(vendor, f), 0o755)
 
-// 6) auto-install agents, commands & config opencode (tanpa menimpa milik user)
-try {
-  const HOME = process.env.HOME || "/data/data/com.termux/files/home"
-  const OC = path.join(HOME, ".config", "opencode")
-  for (const [srcDir, dstName] of [["agents", "agent"], ["commands", "command"]]) {
-    const src = path.join(__dirname, srcDir)
-    if (!fs.existsSync(src)) continue
-    const dst = path.join(OC, dstName)
-    fs.mkdirSync(dst, { recursive: true })
-    for (const f of fs.readdirSync(src)) {
-      fs.copyFileSync(path.join(src, f), path.join(dst, f))
-      console.log(`[opencode-termux] ✅ terpasang: ${dstName}/${f}`)
+  // 4) siapkan DNS config di prefix Termux (bisa ditulis TANPA root)
+  function ensureEtc() {
+    try {
+      const PREFIX = process.env.TERMUX_PREFIX || "/data/data/com.termux/files/usr"
+      const etc = path.join(PREFIX, "etc")
+      fs.mkdirSync(etc, { recursive: true })
+      const rc = path.join(etc, "resolv.conf")
+      if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n")
+      const hh = path.join(etc, "hosts")
+      if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n")
+    } catch (e) {
+      if (!FORCE && IS_ANDROID) throw e
+      log("peringatan: setup resolv.conf dilewati (" + e.message.split("\n")[0] + ")")
     }
   }
-  const cfgSrc = path.join(__dirname, "config", "opencode.json")
-  const cfgDst = path.join(OC, "opencode.json")
-  if (!fs.existsSync(cfgDst)) {
-    fs.copyFileSync(cfgSrc, cfgDst)
-    console.log("[opencode-termux] ✅ config default terpasang (model gratis)")
+  ensureEtc()
+
+  // 5) smoke test (LD_PRELOAD termux-exec dibuang: tidak kompatibel dengan musl)
+  if (process.env.OCX_SKIP_SMOKE === "1") {
+    log("smoke test dilewati (OCX_SKIP_SMOKE=1 — mode cross-build)")
   } else {
-    console.log("[opencode-termux] config user sudah ada — tidak disentuh")
+    log("smoke test…")
+    const { LD_PRELOAD, LD_PRELOAD_32BIT, ...cleanEnv } = process.env
+    execFileSync(path.join(vendor, "ld-musl.so"),
+      [path.join(vendor, "opencode"), "--version"],
+      { stdio: "inherit", env: { ...cleanEnv, LD_LIBRARY_PATH: vendor } })
+  }
+
+  // 6) auto-install agents, commands & config opencode (tanpa menimpa milik user)
+  try {
+    const HOME = process.env.HOME || "/data/data/com.termux/files/home"
+    const OC = path.join(HOME, ".config", "opencode")
+    for (const [srcDir, dstName] of [["agents", "agent"], ["commands", "command"]]) {
+      const src = path.join(__dirname, srcDir)
+      if (!fs.existsSync(src)) continue
+      const dst = path.join(OC, dstName)
+      fs.mkdirSync(dst, { recursive: true })
+      for (const f of fs.readdirSync(src)) {
+        fs.copyFileSync(path.join(src, f), path.join(dst, f))
+        log(`✅ terpasang: ${dstName}/${f}`)
+      }
+    }
+    const cfgSrc = path.join(__dirname, "config", "opencode.json")
+    const cfgDst = path.join(OC, "opencode.json")
+    if (!fs.existsSync(cfgDst)) {
+      fs.copyFileSync(cfgSrc, cfgDst)
+      log("✅ config default terpasang (model gratis)")
+    } else {
+      log("config user sudah ada — tidak disentuh")
+    }
+  } catch (e) {
+    log("auto-install agent dilewati:", e.message)
   }
 } catch (e) {
-  console.log("[opencode-termux] auto-install agent dilewati:", e.message)
+  console.error("[opencode-termux] ❌ instalasi gagal:", e.message)
+  process.exitCode = 1
+  throw e
+} finally {
+  fs.rmSync(work, { recursive: true, force: true })
 }
 
-fs.rmSync(work, { recursive: true, force: true })
-console.log(`[opencode-termux] ✅ siap!
+console.log(`[opencode-termux] ✅ siap dalam ${((Date.now() - T0) / 1000).toFixed(1)}s
 • global : jalankan 'opencode-termux'
 • lokal  : 'npx opencode-termux' dari folder project ini`)

package/lib/alpine.mjs

@@ -0,0 +1,30 @@
+/**
+ * Resolver paket Alpine dari CDN — anti-404 saat Alpine memperbarui paket
+ * dalam satu branch. Fallback ke versi terakhir yang diketahui hidup.
+ */
+export const cmpVer = (a, b) => {
+  const pa = a.split(/[.\-r]/).filter(Boolean).map(Number)
+  const pb = b.split(/[.\-r]/).filter(Boolean).map(Number)
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    if ((pa[i] || 0) !== (pb[i] || 0)) return (pa[i] || 0) - (pb[i] || 0)
+  }
+  return 0
+}
+
+export async function alpinePkg(fetchFn, cdnBase, nameEncoded, fallback = "14.2.0-r4") {
+  let latest = null
+  try {
+    const res = await fetchFn(`${cdnBase}/`)
+    const idx = await res.text()
+    const re = new RegExp(`${nameEncoded}-([0-9][0-9a-zA-Z.+]*)-r([0-9]+)\\.apk`, "g")
+    for (const m of idx.matchAll(re)) {
+      const v = `${m[1]}-r${m[2]}`
+      if (!latest || cmpVer(v, latest.v) > 0) latest = { file: m[0], v }
+    }
+  } catch {}
+  if (!latest) {
+    console.warn(`[opencode-termux] listing CDN gagal — fallback ${nameEncoded}-${fallback}.apk`)
+    latest = { file: `${nameEncoded}-${fallback}.apk`, v: fallback }
+  }
+  return latest.file
+}

package/lib/integrity.mjs

@@ -0,0 +1,24 @@
+/**
+ * Verifikasi integritas file terhadap hash sha512 format registry npm
+ * ("sha512-<base64>"). Mencegah tarball korup/termanipulasi saat transit.
+ */
+import crypto from "crypto"
+import fs from "fs"
+
+export const expectedFromRegistry = (packument, version) => {
+  const dist = packument?.versions?.[version]?.dist
+  return dist?.integrity?.startsWith("sha512-") ? dist.integrity.slice(7) : null
+}
+
+export function verifySha512(filePath, expectedB64) {
+  if (!expectedB64) throw new Error("tidak ada hash acuan (integrity) dari registry")
+  const h = crypto.createHash("sha512")
+  h.update(fs.readFileSync(filePath))
+  const got = h.digest("base64")
+  const a = Buffer.from(got)
+  const b = Buffer.from(expectedB64)
+  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
+    throw new Error(`integritas gagal: file ≠ sha512 registry (${filePath})`)
+  }
+  return true
+}

package/lib/net.mjs

@@ -0,0 +1,24 @@
+/**
+ * Utilitas jaringan: fetch dengan retry + backoff eksponensial.
+ * fetchFn dapat disuntik untuk unit test.
+ */
+export async function fetchWithRetry(fetchFn, url, opts = {}, retries = 3, log = () => {}) {
+  let lastErr
+  for (let attempt = 1; attempt <= retries; attempt++) {
+    try {
+      const res = await fetchFn(url, opts)
+      // 429/5xx → layak dicoba ulang; 4xx lain → gagal permanen
+      if (!res.ok && res.status < 500 && res.status !== 429) return res
+      if (res.ok) return res
+      lastErr = new Error(`HTTP ${res.status} — ${url}`)
+    } catch (e) {
+      lastErr = e
+    }
+    if (attempt < retries) {
+      const wait = Math.min(1000 * 2 ** (attempt - 1), 8000)
+      log(`gagal (${attempt}/${retries}) — ulang dalam ${wait}ms`)
+      await new Promise(r => setTimeout(r, wait))
+    }
+  }
+  throw lastErr
+}

package/package.json

@@ -1,12 +1,14 @@
 {
   "name": "@nemoobc/opencode-termux",
-  "version": "1.19.1",
+  "version": "1.20.1",
   "description": "opencode CLI native untuk Termux/Android tanpa proot — membundel loader musl + binary opencode resmi (upstream opencode-ai)",
   "bin": {
-    "opencode-termux": "./bin/opencode.js"
+    "opencode-termux": "./bin/opencode-termux.js"
   },
   "scripts": {
-    "postinstall": "node install.mjs"
+    "postinstall": "node install.mjs",
+    "test": "node test/run.mjs",
+    "test:e2e": "node test/run.mjs --e2e"
   },
   "keywords": [
     "opencode",
@@ -22,13 +24,15 @@
   "files": [
     "bin",
     "install.mjs",
+    "lib",
     "prebuilt",
+    "LICENSE",
     "README.md",
     "agents",
     "commands",
     "config"
   ],
-  "opencodeUpstream": "1.18.21",
+  "opencodeUpstream": "1.18.22",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nemoobc/opencode-termux.git"

package/bin/opencode.js

@@ -1,48 +0,0 @@
-#!/usr/bin/env node
-const { spawnSync } = require("child_process")
-const fs = require("fs")
-const path = require("path")
-const vendor = path.join(__dirname, "..", "vendor")
-const loader = path.join(vendor, "ld-musl.so")
-const bin = path.join(vendor, "opencode")
-
-function ready() {
-  return fs.existsSync(loader) && fs.existsSync(bin)
-}
-
-// Auto-heal: kalau postinstall terlewat (mis. --ignore-scripts), pasang sekarang.
-if (!ready()) {
-  console.log("[opencode-termux] vendor belum ada — menjalankan installer…")
-  const r = spawnSync(process.execPath, [path.join(__dirname, "..", "install.mjs")], {
-    stdio: "inherit",
-    env: process.env,
-  })
-  if (r.status !== 0 || !ready()) {
-    console.error("[opencode-termux] instalasi bundle gagal. Coba manual:")
-    console.error("  npm rebuild @nemoobc/opencode-termux")
-    process.exit(1)
-  }
-}
-
-if (!ready()) process.exit(1)
-
-// DNS fix: musl hasil build kita membaca config dari prefix Termux —
-// pastikan filenya ada (bisa ditulis tanpa root).
-try {
-  const PREFIX = process.env.TERMUX_PREFIX || "/data/data/com.termux/files/usr"
-  const etc = path.join(PREFIX, "etc")
-  fs.mkdirSync(etc, { recursive: true })
-  const rc = path.join(etc, "resolv.conf")
-  if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n")
-  const hh = path.join(etc, "hosts")
-  if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n")
-} catch {}
-
-// LD_PRELOAD bawaan Termux (libtermux-exec) dibuat untuk Bionic dan akan
-// gagal relokasi jika ikut dimuat ke proses musl — jadi selalu dibersihkan.
-const { LD_PRELOAD, LD_PRELOAD_32BIT, ...cleanEnv } = process.env
-const r = spawnSync(loader, [bin, ...process.argv.slice(2)], {
-  stdio: "inherit",
-  env: { ...cleanEnv, LD_LIBRARY_PATH: vendor },
-})
-process.exit(r.status ?? 1)