@platless/axom-cli 0.5.9 → 0.6.36

package/dist/workstation/acp/builds/install/npm.js

@@ -4,11 +4,14 @@
  * that version, a copy of pristine is patched into `patched/<digest>/`. Launch then runs the package's
  * `bin` directly with the daemon's own Node — no npx, no network, nothing resolved at open time.
  */
+import { createHash } from 'node:crypto';
 import { execFile } from 'node:child_process';
 import { existsSync, statSync } from 'node:fs';
-import { open, readFile } from 'node:fs/promises';
+import { open, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { createPatchedTree, expectedPatchedFiles, patchDigest, selectPackagePatches, verifyPatchedFiles } from '../../managedPatches.js';
+import { installPolicyFor } from '../../patchAssets.js';
+import { assertRuntimeRequest, loadRuntimeRelease, runtimeRecipes, verifyRuntimeTree, verifyManagedRuntime } from '../../managedRuntime.js';
 import { assertSafePackageName, assertSafeVersion, buildIdFor, inside, npmPatchedDir, npmPristineDir, } from '../model.js';
 import { assertBuildRunsOn } from '../nodeGate.js';
 import { publishStaged } from '../store.js';
@@ -42,9 +45,9 @@ export function runNpmViewLatest(npmCommand, name, timeoutMs) {
     });
 }
 /** `npm install --prefix <prefix> --no-save --no-audit --no-fund <spec>`, argv only, never a shell. */
-export function runNpmInstall(npmCommand, prefix, spec, timeoutMs) {
+export function runNpmInstall(npmCommand, prefix, spec, timeoutMs, options = {}) {
     return new Promise((resolve) => {
-        execFile(npmCommand, ['install', '--prefix', prefix, '--no-save', '--no-audit', '--no-fund', spec], { timeout: timeoutMs, windowsHide: true, maxBuffer: 16 * 1024 * 1024 }, (error, _stdout, stderr) => {
+        execFile(npmCommand, ['install', '--prefix', prefix, '--no-save', '--no-audit', '--no-fund', ...(options.ignoreScripts ? ['--ignore-scripts'] : []), spec], { timeout: timeoutMs, windowsHide: true, maxBuffer: 16 * 1024 * 1024 }, (error, _stdout, stderr) => {
             if (!error) {
                 resolve({ ok: true });
                 return;
@@ -68,6 +71,36 @@ async function installedVersion(treeRoot, name) {
     const metadata = await readPackage(inside(path.join(treeRoot, 'node_modules'), name));
     return metadata?.name === name && typeof metadata.version === 'string' ? metadata.version : undefined;
 }
+/** Download server bytes, verifying npm's base64 sha512 before writing a local archive. */
+export async function fetchVerifiedTarball(options) {
+    const response = await fetch(options.url, { signal: AbortSignal.timeout(options.timeoutMs) });
+    if (!response.ok)
+        throw new Error(`download ${options.url} failed: HTTP ${response.status}`);
+    const body = Buffer.from(await response.arrayBuffer());
+    if (createHash('sha512').update(body).digest('base64') !== options.sha512)
+        throw new Error(`tarball sha512 mismatch for ${options.url}`);
+    const file = path.join(options.dir, 'adapter.tgz');
+    await writeFile(file, body);
+    return file;
+}
+/** Read actual installed top-level package identities, including scoped dependencies. */
+export async function installedDependencies(treeRoot) {
+    const modules = path.join(treeRoot, 'node_modules');
+    const dependencies = {};
+    for (const entry of await readdir(modules, { withFileTypes: true })) {
+        if (entry.name.startsWith('.'))
+            continue;
+        const names = entry.name.startsWith('@')
+            ? (await readdir(path.join(modules, entry.name))).map((name) => `${entry.name}/${name}`)
+            : [entry.name];
+        for (const name of names) {
+            const metadata = await readPackage(inside(modules, name));
+            if (metadata?.name === name && typeof metadata.version === 'string')
+                dependencies[name] = metadata.version;
+        }
+    }
+    return dependencies;
+}
 /**
  * Make sure `npm/<sha16(name)>/<version>/pristine` exists. `version` undefined = unpinned (npm's
  * `latest`, the install-time ETARGET fallback): the version is read back off what npm installed.
@@ -76,6 +109,14 @@ async function installedVersion(treeRoot, name) {
 export async function ensurePristine(options) {
     const { store, name } = options;
     assertSafePackageName(name);
+    if (options.policy) {
+        assertRuntimeRequest(options.policy, name, options.version);
+        const release = await loadRuntimeRelease(options.policy, options);
+        if (options.tarball && options.tarball.sha512 !== release.integrity.slice('sha512-'.length))
+            throw new Error('Managed runtime archive integrity differs from bundled release');
+    }
+    if (options.tarball && options.version === undefined)
+        throw new Error('Server adapter tarball requires a pinned version');
     if (options.version === undefined) {
         // Unpinned (the install-time ETARGET fallback): name the version first, so a `latest` that is
         // already installed costs one metadata request and no download.
@@ -95,13 +136,26 @@ export async function ensurePristine(options) {
     }
     if (options.version !== undefined) {
         const final = inside(store.root, npmPristineDir(name, options.version));
+        if (existsSync(final) && options.policy) {
+            await verifyRuntimeTree({ ...options, policy: options.policy, treeRoot: final, pristine: true });
+            return { ok: true, version: options.version, downloaded: false };
+        }
         if ((await installedVersion(final, name)) === options.version)
             return { ok: true, version: options.version, downloaded: false };
     }
     const staged = await store.stagingDir();
     try {
         const spec = options.version === undefined ? name : `${name}@${options.version}`;
-        const ran = await runNpmInstall(options.npmCommand, staged, spec, options.timeoutMs);
+        let tarball = options.tarball;
+        if (options.policy) {
+            const release = await loadRuntimeRelease(options.policy, options);
+            const sha512 = release.integrity.slice('sha512-'.length);
+            if (tarball && tarball.sha512 !== sha512)
+                throw new Error('Managed runtime archive integrity differs from bundled release');
+            tarball ??= await runtimeArchive(options.npmCommand, spec, release.integrity, options.timeoutMs);
+        }
+        const archive = tarball ? await fetchVerifiedTarball({ ...tarball, dir: staged, timeoutMs: options.timeoutMs }) : undefined;
+        const ran = await runNpmInstall(options.npmCommand, staged, archive ?? spec, options.timeoutMs, { ignoreScripts: options.policy?.ignore_scripts ?? installPolicyFor(name)?.ignore_scripts });
         if (!ran.ok)
             return ran;
         const version = await installedVersion(staged, name);
@@ -111,7 +165,14 @@ export async function ensurePristine(options) {
             return { ok: false, error: `npm installed ${name}@${version} when ${spec} was asked for`, stderr: '' };
         }
         assertSafeVersion(version);
+        if (options.policy)
+            await verifyRuntimeTree({ ...options, policy: options.policy, treeRoot: staged, pristine: true, prepareTools: true });
+        if (archive)
+            await rm(archive);
         const { published } = await publishStaged(staged, inside(store.root, npmPristineDir(name, version)));
+        // publishStaged may choose an existing winner: verify that actual tree, never just staging.
+        if (options.policy)
+            await verifyRuntimeTree({ ...options, policy: options.policy, treeRoot: inside(store.root, npmPristineDir(name, version)), pristine: true });
         // Not published = that version's pristine was already there (we only learned the version now).
         return { ok: true, version, downloaded: published };
     }
@@ -168,9 +229,12 @@ async function runtimeOf(file) {
  */
 export async function npmBuild(options) {
     const { store, name, version } = options;
+    if (options.policy)
+        assertRuntimeRequest(options.policy, name, version);
     const pristineRel = npmPristineDir(name, version);
     const pristine = inside(store.root, pristineRel);
-    const recipes = await selectPackagePatches(name, version, inside(path.join(pristine, 'node_modules'), name), options.recipes);
+    const release = options.policy ? await verifyRuntimeTree({ ...options, policy: options.policy, treeRoot: pristine, pristine: true }) : undefined;
+    const recipes = release && options.policy ? runtimeRecipes(options.policy, release, options.recipes) : await selectPackagePatches(name, version, inside(path.join(pristine, 'node_modules'), name), options.recipes, await installedDependencies(pristine));
     let dir = pristineRel;
     let patch = {};
     if (recipes.length) {
@@ -180,7 +244,7 @@ export async function npmBuild(options) {
         if (!existsSync(final)) {
             const staged = await store.stagingDir();
             try {
-                await createPatchedTree(pristine, staged, name, version, recipes);
+                await createPatchedTree(pristine, staged, name, version, recipes, options.assetRoot);
                 await publishStaged(staged, final);
             }
             finally {
@@ -189,22 +253,24 @@ export async function npmBuild(options) {
         }
         // Whoever published it, the tree's receipt must be for exactly this recipe set.
         const receipt = JSON.parse(await readFile(path.join(final, 'axom-patches.json'), 'utf8'));
+        if (receipt.patchedFilesBase !== undefined && receipt.patchedFilesBase !== 'node_modules')
+            throw new Error('Invalid Axom patched file base');
         if (receipt.digest !== digest)
             throw new Error('Axom adapter patch receipt does not match this CLI');
         // Expected hashes come from the shipped recipes, never from the writable receipt alone.
         const files = expectedPatchedFiles(recipes);
-        await verifyPatchedFiles(inside(path.join(final, 'node_modules'), name), files);
-        patch = { patchDigest: digest, patches: recipes.map((recipe) => recipe.id), patchedFiles: files };
+        await verifyPatchedFiles(path.join(final, 'node_modules'), files);
+        patch = { patchedFilesBase: 'node_modules', patchDigest: digest, patches: recipes.map((recipe) => recipe.id), patchedFiles: files };
     }
     const root = inside(store.root, dir);
     const packageRel = `node_modules/${name}`;
     const metadata = await readPackage(inside(root, packageRel));
     if (metadata?.name !== name || metadata.version !== version)
         throw new Error(`Adapter package identity changed under ${dir}`);
-    const explicit = [...new Set(recipes.map((recipe) => recipe.bin).filter((bin) => bin !== undefined))];
+    const explicit = [...new Set(recipes.filter((recipe) => recipe.package === name).map((recipe) => recipe.bin).filter((bin) => bin !== undefined))];
     if (explicit.length > 1)
         throw new Error('Axom patches disagree about the adapter executable');
-    const entryRel = path.posix.normalize(`${packageRel}/${selectBin(name, metadata.bin, explicit[0])}`);
+    const entryRel = path.posix.normalize(`${packageRel}/${selectBin(name, metadata.bin, release?.bin.name ?? explicit[0])}`);
     const entry = inside(root, entryRel);
     if (!entryRel.startsWith(`${packageRel}/`) || !statSync(entry).isFile())
         throw new Error(`Adapter executable is missing in ${dir}`);
@@ -217,6 +283,7 @@ export async function npmBuild(options) {
     };
     const build = {
         buildId: buildIdFor(version, patch.patchDigest),
+        ...(release ? { runtimeReleaseId: release.id } : {}),
         agentId: options.agentId,
         kind: patch.patchDigest ? 'npm-patched' : 'npm',
         version,
@@ -231,5 +298,27 @@ export async function npmBuild(options) {
     };
     // Never hand back (so never commit, never make current) a build its own Node gate refuses.
     await assertBuildRunsOn(build, store.root, options.nodePath);
+    if (options.policy)
+        await verifyManagedRuntime({ ...options, policy: options.policy, build, storeRoot: store.root, initialize: true });
     return build;
 }
+/** Registry metadata supplies only a location; its digest must equal the bundled immutable release. */
+async function runtimeArchive(npmCommand, spec, integrity, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        execFile(npmCommand, ['view', spec, 'dist', '--json'], { timeout: timeoutMs, windowsHide: true, maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => {
+            if (error) {
+                reject(new Error(`Managed runtime exact archive lookup failed: ${stderr.toString().slice(-2048) || error.message}`));
+                return;
+            }
+            try {
+                const dist = JSON.parse(stdout.toString());
+                if (dist.integrity !== integrity || typeof dist.tarball !== 'string' || !/^https?:\/\//.test(dist.tarball))
+                    throw new Error('Managed runtime archive metadata integrity mismatch');
+                resolve({ url: dist.tarball, sha512: integrity.slice('sha512-'.length) });
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+    });
+}

package/dist/workstation/acp/initializeResponse.js

@@ -13,7 +13,7 @@
  * `processor/initialize.test.ts` then guards the processor's *wiring* (the right line, the right
  * result), not a second copy of these rules.
  *
- * The Qoder runtime profile in `_meta` is deliberately not read here: it belongs to the connection's
+ * The runtime profile in `_meta` is deliberately not read here: it belongs to the connection's
  * runtime diagnostics, which the processor takes over in Task 17b/17c.
  */
 import { PROTOCOL_VERSION } from '@agentclientprotocol/sdk';
@@ -81,6 +81,7 @@ export function initializeRequestParams() {
                 // on another machine cannot do; the standard `authenticate` methods (device-code style) are
                 // unaffected and never needed this key.
                 'terminal-auth': true,
+                terminal_output_delta: true,
                 'subagent-transcript': true,
                 ...airCapabilityMeta(AIR_NATIVE_SUBAGENT_SESSIONS_CAPABILITY, AIR_ASYNC_TASKS_CAPABILITY),
             },
@@ -110,6 +111,9 @@ export function parseInitializeResult(initResponse) {
     if (initResponse.protocolVersion !== PROTOCOL_VERSION) {
         return { protocolSupported: false, protocolVersion: initResponse.protocolVersion };
     }
+    const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+    const axomMeta = isRecord(initResponse._meta) && isRecord(initResponse._meta.axom) ? initResponse._meta.axom : undefined;
+    const cachedReconnect = axomMeta?.cachedReconnect === 'resume' ? 'resume' : undefined;
     const sessionCapabilities = initResponse.agentCapabilities?.sessionCapabilities;
     const capabilities = {
         // Capability markers are empty objects (`{ _meta? }`); supplying `{}` means "supported", and
@@ -155,6 +159,7 @@ export function parseInitializeResult(initResponse) {
     }
     return {
         protocolSupported: true,
+        ...(cachedReconnect ? { cachedReconnect } : {}),
         capabilities,
         authMethods,
         droppedAuthMethods: advertisedAuthMethods.length - authMethods.length,

package/dist/workstation/acp/managedPatches.js

@@ -5,10 +5,11 @@
  */
 import { createHash } from 'node:crypto';
 import { constants } from 'node:fs';
-import { cp, readFile, writeFile } from 'node:fs/promises';
+import { cp, lstat, mkdir, open, realpath, writeFile } from 'node:fs/promises';
 import path from 'node:path';
-import { inside } from './builds/model.js';
-import { packagePatchMatch, packagePatches } from './patchAssets.js';
+import { fileURLToPath } from 'node:url';
+import { assertSafePackageName, inside } from './builds/model.js';
+import { packagePatchMatch, packagePatches, patchAssetRoot, validatePackagePatch, validatePatchPath } from './patchAssets.js';
 const sha = (content) => createHash('sha256').update(content).digest('hex');
 const warned = new Set();
 function warnOnce(key, message) {
@@ -18,30 +19,149 @@ function warnOnce(key, message) {
     console.warn(message);
 }
 function within(root, relative) {
+    validatePatchPath(relative);
     const target = path.resolve(root, relative);
     if (!target.startsWith(path.resolve(root) + path.sep))
         throw new Error('Axom patch path escapes its package');
     return target;
 }
+/**
+ * Check every component, including the supplied root and its ancestors, without following links.
+ * The one links crossed are root-owned system symlinks (`/var -> /private/var` on macOS): stock
+ * macOS hands out per-user tmp dirs behind one, and refusing it would reject every tmp-scoped
+ * tree. A root-owned link to a root-owned, non-group-writable directory is not plantable by the
+ * running user; every user-owned symlink is still refused.
+ */
+async function noSymlinks(filename, missing = false) {
+    const absolute = path.resolve(filename);
+    let current = path.parse(absolute).root;
+    const systemSymlink = async (uid) => {
+        if (uid !== 0 || process.getuid?.() === 0)
+            return false;
+        try {
+            const target = await realpath(current);
+            const stat = await lstat(target);
+            return stat.isDirectory() && stat.uid === 0 && (stat.mode & 0o022) === 0;
+        }
+        catch {
+            return false;
+        }
+    };
+    for (const part of absolute.slice(current.length).split(path.sep).filter(Boolean)) {
+        current = path.join(current, part);
+        try {
+            const info = await lstat(current);
+            if (info.isSymbolicLink() && !(await systemSymlink(info.uid)))
+                throw new Error(`Axom patch symlink is forbidden: ${current}`);
+        }
+        catch (error) {
+            if (missing && error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+    }
+}
+async function readOwnedFile(filename) {
+    await noSymlinks(filename);
+    const handle = await open(filename, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        if (!(await handle.stat()).isFile())
+            throw new Error(`Axom patch requires a regular file: ${filename}`);
+        return await handle.readFile();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function makeOwnedDirectories(directory) {
+    await noSymlinks(directory, true);
+    const parent = path.dirname(directory);
+    if (parent !== directory) {
+        try {
+            await lstat(directory);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            await makeOwnedDirectories(parent);
+            try {
+                await mkdir(directory);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+        }
+    }
+    await noSymlinks(directory);
+    if (!(await lstat(directory)).isDirectory())
+        throw new Error(`Axom patch parent is not a directory: ${directory}`);
+}
 /** A matching version and exact original bytes; already-patched or changed originals are rejected. */
-export async function applyPackagePatches(packageDir, recipes) {
+export async function applyPackagePatches(nodeModulesDir, recipes, assetRoot = patchAssetRoot) {
     const output = {};
+    // Validate the complete declaration and asset closure before any writes.
+    expectedPatchedFiles(recipes);
+    const assets = new Map();
     for (const recipe of recipes) {
-        const metadata = JSON.parse(await readFile(path.join(packageDir, 'package.json'), 'utf8'));
+        const packageDir = inside(nodeModulesDir, recipe.package);
+        const metadata = JSON.parse((await readOwnedFile(path.join(packageDir, 'package.json'))).toString('utf8'));
         if (metadata.name !== recipe.package || !packagePatchMatch(recipe, metadata.version)) {
             throw new Error(`Axom patch '${recipe.id}' does not support ${metadata.name}@${metadata.version}`);
         }
+        for (const edit of recipe.edits)
+            await noSymlinks(within(packageDir, edit.file));
+        for (const asset of recipe.assets ?? []) {
+            const filename = within(packageDir, asset.target);
+            await noSymlinks(filename, true);
+            try {
+                await lstat(filename);
+                throw new Error(`Axom patch asset collision: target already exists: ${asset.target}`);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+            const bytes = await readOwnedFile(within(assetRoot instanceof URL ? fileURLToPath(assetRoot) : assetRoot, asset.source));
+            if (sha(bytes) !== asset.sha256)
+                throw new Error(`Axom patch asset hash mismatch: ${asset.source}`);
+            assets.set(`${recipe.package}/${asset.target}`, bytes);
+        }
+    }
+    for (const recipe of recipes) {
+        const packageDir = inside(nodeModulesDir, recipe.package);
         for (const edit of recipe.edits) {
             const filename = within(packageDir, edit.file);
-            const original = await readFile(filename, 'utf8');
+            const original = (await readOwnedFile(filename)).toString('utf8');
             if (sha(original) !== edit.before_sha256 || !edit.before || original.split(edit.before).length !== 2) {
                 throw new Error(`Axom patch '${recipe.id}': original bytes changed in ${edit.file}`);
             }
             const patched = original.replace(edit.before, edit.after);
             if (sha(patched) !== edit.after_sha256)
                 throw new Error(`Axom patch '${recipe.id}': invalid expected output`);
-            await writeFile(filename, patched, 'utf8');
-            output[edit.file] = sha(patched);
+            await noSymlinks(filename);
+            const handle = await open(filename, constants.O_WRONLY | constants.O_NOFOLLOW);
+            try {
+                await handle.truncate(0);
+                await handle.writeFile(patched, 'utf8');
+            }
+            finally {
+                await handle.close();
+            }
+            output[`${recipe.package}/${edit.file}`] = sha(patched);
+        }
+        for (const asset of recipe.assets ?? []) {
+            const filename = within(packageDir, asset.target);
+            await makeOwnedDirectories(path.dirname(filename));
+            await noSymlinks(filename, true);
+            const handle = await open(filename, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o644);
+            try {
+                await handle.writeFile(assets.get(`${recipe.package}/${asset.target}`));
+            }
+            finally {
+                await handle.close();
+            }
+            output[`${recipe.package}/${asset.target}`] = asset.sha256;
         }
     }
     return output;
@@ -53,7 +173,7 @@ async function originalsFit(packageDir, recipe) {
         let content = files.get(edit.file);
         if (content === undefined) {
             try {
-                content = await readFile(within(packageDir, edit.file), 'utf8');
+                content = (await readOwnedFile(within(packageDir, edit.file))).toString('utf8');
             }
             catch {
                 return false;
@@ -71,22 +191,25 @@ async function originalsFit(packageDir, recipe) {
  * patch step loudly), range recipes only when the pristine bytes fit (otherwise upstream runs, with a
  * warning). An empty answer means the build is the pristine tree itself.
  */
-export async function selectPackagePatches(name, version, pristinePackageDir, recipes = packagePatches) {
-    const candidates = recipes.filter((patch) => patch.package === name);
+export async function selectPackagePatches(name, version, pristinePackageDir, recipes = packagePatches, dependencies = {}) {
+    const candidates = recipes.filter((patch) => patch.package === name || Object.hasOwn(dependencies, patch.package));
     const matched = candidates.flatMap((recipe) => {
-        const match = packagePatchMatch(recipe, version);
+        const match = packagePatchMatch(recipe, recipe.package === name ? version : dependencies[recipe.package]);
         return match ? [{ recipe, match }] : [];
     });
     if (matched.length && (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/i.test(name) || !/^[0-9a-z.+-]+$/i.test(version))) {
         throw new Error('Invalid package identity for Axom adapter patch');
     }
     const selected = [];
+    const nodeModulesDir = path.resolve(pristinePackageDir, ...name.split('/').map(() => '..'));
     for (const { recipe, match } of matched) {
+        assertSafePackageName(recipe.package);
+        const packageDir = recipe.package === name ? pristinePackageDir : inside(nodeModulesDir, recipe.package);
         if (match === 'exact') {
             selected.push(recipe);
             continue;
         }
-        if (await originalsFit(pristinePackageDir, recipe))
+        if (await originalsFit(packageDir, recipe))
             selected.push(recipe);
         else
             warnOnce(`${recipe.id}@${name}@${version}`, `[axom-patch] ${recipe.id} does not fit ${name}@${version}; using the upstream package. Review the patch inventory.`);
@@ -104,39 +227,80 @@ export function patchDigest(recipes) {
  * Copy the pristine `node_modules` (reflink where the filesystem supports it — `COPYFILE_FICLONE`
  * falls back to an ordinary copy by itself; relative symlinks such as `.bin/*` are kept relative so
  * the copy never points back into pristine) into `stagedRoot`, patch the copy, and write a receipt.
- * Returns the sha256 of every patched file, relative to the package directory.
+ * Returns the sha256 of every patched file, qualified by its package name under node_modules.
  */
-export async function createPatchedTree(pristineRoot, stagedRoot, name, version, recipes) {
+export async function createPatchedTree(pristineRoot, stagedRoot, name, version, recipes, assetRoot = patchAssetRoot) {
+    const original = path.resolve(pristineRoot, 'node_modules');
+    const copy = path.resolve(stagedRoot, 'node_modules');
+    if (original === copy || original.startsWith(copy + path.sep) || copy.startsWith(original + path.sep)) {
+        throw new Error('Axom patch staged tree must not overlap pristine');
+    }
+    await noSymlinks(original);
+    const receipt = path.join(stagedRoot, 'axom-patches.json');
+    for (const destination of [copy, receipt]) {
+        await noSymlinks(destination, true);
+        try {
+            await lstat(destination);
+            throw new Error(`Axom patch staged target already exists: ${destination}`);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
     await cp(path.join(pristineRoot, 'node_modules'), path.join(stagedRoot, 'node_modules'), {
         recursive: true, verbatimSymlinks: true, mode: constants.COPYFILE_FICLONE,
     });
-    const packageDir = inside(path.join(stagedRoot, 'node_modules'), name);
-    const files = await applyPackagePatches(packageDir, recipes);
+    const files = await applyPackagePatches(path.join(stagedRoot, 'node_modules'), recipes, assetRoot);
     const expected = expectedPatchedFiles(recipes);
     if (JSON.stringify(sortKeys(files)) !== JSON.stringify(sortKeys(expected)))
         throw new Error('Incomplete Axom adapter patch');
-    await writeFile(path.join(stagedRoot, 'axom-patches.json'), JSON.stringify({
-        digest: patchDigest(recipes), package: name, version, patches: recipes.map((recipe) => recipe.id), files,
-    }) + '\n');
+    await noSymlinks(receipt, true);
+    await writeFile(receipt, JSON.stringify({
+        patchedFilesBase: 'node_modules', digest: patchDigest(recipes), package: name, version, patches: recipes.map((recipe) => recipe.id), files,
+    }) + '\n', { flag: 'wx' });
     console.info(`[axom-patch] Applied ${recipes.map((recipe) => recipe.id).join(', ')} to ${name}@${version}`);
     return files;
 }
 /** The files a recipe set rewrites and their expected sha256, derived from the shipped recipes. */
 export function expectedPatchedFiles(recipes) {
-    return Object.fromEntries(recipes.flatMap((recipe) => recipe.edits.map((edit) => [edit.file, edit.after_sha256])));
+    const files = {};
+    const assetTargets = new Set();
+    const editTargets = new Set();
+    for (const recipe of recipes) {
+        assertSafePackageName(recipe.package);
+        validatePackagePatch(recipe);
+        for (const edit of recipe.edits) {
+            const key = `${recipe.package}/${edit.file}`;
+            editTargets.add(key);
+            files[key] = edit.after_sha256;
+        }
+    }
+    for (const recipe of recipes)
+        for (const asset of recipe.assets ?? []) {
+            const key = `${recipe.package}/${asset.target}`;
+            if ([...assetTargets, ...editTargets].some(other => other === key || other.startsWith(key + '/') || key.startsWith(other + '/'))) {
+                throw new Error(`Axom patch asset collision: ${key}`);
+            }
+            assetTargets.add(key);
+            files[key] = asset.sha256;
+        }
+    return files;
 }
 function sortKeys(record) {
     return Object.fromEntries(Object.entries(record).sort(([a], [b]) => a.localeCompare(b)));
 }
-/** The launch-time tamper check: every patched file still hashes to what was recorded at install. */
+/** Tamper check against an explicit base: node_modules for qualified keys, adapter package for legacy keys. */
 export async function verifyPatchedFiles(packageDir, files) {
     for (const [file, hash] of Object.entries(files)) {
         let content;
         try {
-            content = await readFile(within(packageDir, file));
+            content = await readOwnedFile(within(packageDir, file));
         }
-        catch {
-            throw new Error(`Axom patched adapter is missing ${file}`);
+        catch (error) {
+            if (error.code === 'ENOENT')
+                throw new Error(`Axom patched adapter is missing ${file}`);
+            throw new Error(`Axom patched adapter was modified: ${file} (${error.message})`);
         }
         if (sha(content) !== hash)
             throw new Error(`Axom patched adapter was modified: ${file}`);