@textcortex/zenocode 0.1.13 → 0.1.15

package/scripts/build-branded-opencode.mjs

@@ -1,24 +1,31 @@
 #!/usr/bin/env node
-import { spawn } from "node:child_process";
-import { realpathSync } from "node:fs";
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import process from "node:process";
-import { fileURLToPath } from "node:url";
-import { patchZenocodeBinaryText } from "./branding-patch.mjs";
-import { openCodeRef, openCodeVersion } from "./opencode-version.mjs";
+import { spawn } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import {
+  openCodeRef,
+  openCodeVersion,
+  zenocodeRuntimeVersion,
+} from './opencode-version.mjs';
+import { applyZenocodeSourceBranding } from './source-branding.mjs';
 
 const currentFilePath = realpathSync(fileURLToPath(import.meta.url));
 const __dirname = path.dirname(currentFilePath);
-const appRoot = path.resolve(__dirname, "..");
-const defaultOutputDir = path.join(appRoot, ".zenocode", "brand-build");
-export const defaultOpenCodeForkUrl = "https://github.com/sst/opencode";
+const appRoot = path.resolve(__dirname, '..');
+const defaultOutputDir = path.join(appRoot, '.zenocode', 'brand-build');
+export const defaultOpenCodeForkUrl = 'https://github.com/sst/opencode';
 export const defaultOpenCodeRef = openCodeRef;
 export const defaultOpenCodeVersion = openCodeVersion;
-export const defaultOpenCodeBuildArgs = ["--skip-install"];
-const displayNameOnlyBrandingRefs = new Set([defaultOpenCodeRef]);
-
+export { zenocodeRuntimeVersion };
+export const defaultOpenCodeBuildArgs = [];
+export const trustedPublishingRepository = {
+  type: 'git',
+  url: 'git+https://github.com/textcortex/platform.git',
+};
 const forkUrl =
   process.env.ZENOCODE_OPENCODE_FORK_URL ||
   process.env.CODECORTEX_OPENCODE_FORK_URL ||
@@ -35,63 +42,70 @@ const outputDir =
 const wrapperPackageName =
   process.env.ZENOCODE_BRANDED_PACKAGE ||
   process.env.CODECORTEX_BRANDED_PACKAGE ||
-  "@textcortex/zenocode-ai";
+  '@textcortex/zenocode-ai';
 const wrapperBinName =
   process.env.ZENOCODE_BRANDED_BIN_NAME ||
   process.env.CODECORTEX_BRANDED_BIN_NAME ||
-  "zenocode";
+  'zenocode';
 const publishEnabled =
-  (process.env.ZENOCODE_PUBLISH || process.env.CODECORTEX_PUBLISH) === "1";
+  (process.env.ZENOCODE_PUBLISH || process.env.CODECORTEX_PUBLISH) === '1';
 const publishTag =
   process.env.ZENOCODE_PUBLISH_TAG ||
   process.env.CODECORTEX_PUBLISH_TAG ||
-  "latest";
+  'latest';
+const publishProvenance =
+  (process.env.ZENOCODE_NPM_PROVENANCE ||
+    process.env.CODECORTEX_NPM_PROVENANCE) === '1';
 const configuredBuildArgs = (
   process.env.ZENOCODE_OPENCODE_BUILD_ARGS ||
   process.env.CODECORTEX_OPENCODE_BUILD_ARGS ||
-  ""
+  ''
 ).trim();
 const buildArgs = configuredBuildArgs
   ? configuredBuildArgs.split(/\s+/).filter(Boolean)
   : defaultOpenCodeBuildArgs;
 const cliArgs = process.argv.slice(2);
 
-export function deriveOpenCodeVersionFromRef(ref, fallbackVersion = defaultOpenCodeVersion) {
+export function deriveOpenCodeVersionFromRef(
+  ref,
+  fallbackVersion = defaultOpenCodeVersion
+) {
   const match = ref.match(/^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)(?:\+.*)?$/);
   return match?.[1] || fallbackVersion;
 }
 
-export function allowsDisplayNameOnlyBranding(ref) {
-  return displayNameOnlyBrandingRefs.has(ref);
-}
-
 function _command(name) {
-  if (process.platform === "win32" && ["npm", "pnpm", "npx"].includes(name)) {
+  if (process.platform === 'win32' && ['npm', 'pnpm', 'npx'].includes(name)) {
     return `${name}.cmd`;
   }
   return name;
 }
 
 function _packageParts(packageName) {
-  if (packageName.startsWith("@")) {
-    const [scope, baseName] = packageName.split("/");
+  if (packageName.startsWith('@')) {
+    const [scope, baseName] = packageName.split('/');
     return { scope, baseName };
   }
-  return { scope: "", baseName: packageName };
+  return { scope: '', baseName: packageName };
 }
 
 function _runtimeBinaryPrefix(packageName) {
   const { baseName } = _packageParts(packageName);
-  return baseName.replace(/-ai$/, "");
+  return baseName.replace(/-ai$/, '');
 }
 
-export function mapBrandedBinaryPackageName(originalPackageName, runtimePackageName = wrapperPackageName) {
-  if (!originalPackageName.startsWith("opencode-")) {
-    throw new Error(`Unsupported OpenCode binary package name: ${originalPackageName}`);
+export function mapBrandedBinaryPackageName(
+  originalPackageName,
+  runtimePackageName = wrapperPackageName
+) {
+  if (!originalPackageName.startsWith('opencode-')) {
+    throw new Error(
+      `Unsupported OpenCode binary package name: ${originalPackageName}`
+    );
   }
   const { scope } = _packageParts(runtimePackageName);
   const prefix = _runtimeBinaryPrefix(runtimePackageName);
-  const suffix = originalPackageName.slice("opencode".length);
+  const suffix = originalPackageName.slice('opencode'.length);
   const unscopedName = `${prefix}${suffix}`;
   return scope ? `${scope}/${unscopedName}` : unscopedName;
 }
@@ -99,18 +113,20 @@ export function mapBrandedBinaryPackageName(originalPackageName, runtimePackageN
 export function buildWrapperBinMap(packageName, binName) {
   const { baseName } = _packageParts(packageName);
   const binMap = {
-    [baseName]: "./bin/opencode",
-    opencode: "./bin/opencode",
+    [baseName]: './bin/opencode',
+    opencode: './bin/opencode',
   };
   if (binName && !(binName in binMap)) {
-    binMap[binName] = "./bin/opencode";
+    binMap[binName] = './bin/opencode';
   }
   return binMap;
 }
 
 function compareSemver(left, right) {
   const parse = (value) => {
-    const match = value.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+.*)?$/);
+    const match = value.match(
+      /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+.*)?$/
+    );
     if (!match) return null;
     return {
       major: Number(match[1]),
@@ -126,7 +142,7 @@ function compareSemver(left, right) {
     throw new Error(`Invalid semver comparison: ${left} vs ${right}`);
   }
 
-  for (const key of ["major", "minor", "patch"]) {
+  for (const key of ['major', 'minor', 'patch']) {
     if (lhs[key] > rhs[key]) return 1;
     if (lhs[key] < rhs[key]) return -1;
   }
@@ -135,8 +151,8 @@ function compareSemver(left, right) {
   if (lhs.prerelease === null) return 1;
   if (rhs.prerelease === null) return -1;
 
-  const leftParts = lhs.prerelease.split(".");
-  const rightParts = rhs.prerelease.split(".");
+  const leftParts = lhs.prerelease.split('.');
+  const rightParts = rhs.prerelease.split('.');
   const length = Math.max(leftParts.length, rightParts.length);
   for (let index = 0; index < length; index += 1) {
     const leftPart = leftParts[index];
@@ -163,17 +179,21 @@ function compareSemver(left, right) {
 async function run(command, args, options = {}) {
   return new Promise((resolve, reject) => {
     const child = spawn(command, args, {
-      stdio: "inherit",
+      stdio: 'inherit',
       ...options,
     });
 
-    child.on("error", reject);
-    child.on("exit", (code) => {
+    child.on('error', reject);
+    child.on('exit', (code) => {
       if (code === 0) {
         resolve();
         return;
       }
-      reject(new Error(`${command} ${args.join(" ")} failed with exit code ${String(code ?? 1)}`));
+      reject(
+        new Error(
+          `${command} ${args.join(' ')} failed with exit code ${String(code ?? 1)}`
+        )
+      );
     });
   });
 }
@@ -181,25 +201,27 @@ async function run(command, args, options = {}) {
 async function runAndCapture(command, args, options = {}) {
   return new Promise((resolve, reject) => {
     const child = spawn(command, args, {
-      stdio: ["ignore", "pipe", "pipe"],
+      stdio: ['ignore', 'pipe', 'pipe'],
       ...options,
     });
 
-    let stdout = "";
-    let stderr = "";
-    child.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString("utf-8");
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => {
+      stdout += chunk.toString('utf-8');
     });
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString("utf-8");
+    child.stderr?.on('data', (chunk) => {
+      stderr += chunk.toString('utf-8');
     });
-    child.on("error", reject);
-    child.on("exit", (code) => {
+    child.on('error', reject);
+    child.on('exit', (code) => {
       if (code === 0) {
         resolve({ stdout, stderr });
         return;
       }
-      const error = new Error(`${command} ${args.join(" ")} failed with exit code ${String(code ?? 1)}`);
+      const error = new Error(
+        `${command} ${args.join(' ')} failed with exit code ${String(code ?? 1)}`
+      );
       error.stdout = stdout;
       error.stderr = stderr;
       reject(error);
@@ -207,11 +229,11 @@ async function runAndCapture(command, args, options = {}) {
   });
 }
 
-async function requireCommand(command, args = ["--version"]) {
+async function requireCommand(command, args = ['--version']) {
   try {
-    await run(command, args, { stdio: "ignore" });
+    await run(command, args, { stdio: 'ignore' });
   } catch (error) {
-    if (error?.code === "ENOENT") {
+    if (error?.code === 'ENOENT') {
       throw new Error(`Missing required command: ${command}`);
     }
     throw error;
@@ -219,27 +241,57 @@ async function requireCommand(command, args = ["--version"]) {
 }
 
 async function readJson(filePath) {
-  return JSON.parse(await fs.readFile(filePath, "utf-8"));
+  return JSON.parse(await fs.readFile(filePath, 'utf-8'));
 }
 
 async function writeJson(filePath, payload) {
-  await fs.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
+  await fs.writeFile(
+    filePath,
+    `${JSON.stringify(payload, null, 2)}\n`,
+    'utf-8'
+  );
+}
+
+export function selectLatestTarball(entries) {
+  const tarballs = entries
+    .filter((entry) => entry.endsWith('.tgz'))
+    .sort((left, right) => {
+      const leftVersion = left.match(
+        /-(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)(?:\+.*)?\.tgz$/
+      )?.[1];
+      const rightVersion = right.match(
+        /-(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)(?:\+.*)?\.tgz$/
+      )?.[1];
+      if (leftVersion && rightVersion) {
+        return compareSemver(leftVersion, rightVersion);
+      }
+      if (leftVersion) return 1;
+      if (rightVersion) return -1;
+      return left.localeCompare(right);
+    });
+  return tarballs[tarballs.length - 1] || null;
 }
 
 async function maybePublishedVersion(packageName) {
-  const npmCommand = _command("npm");
+  const npmCommand = _command('npm');
   try {
     const result = await runAndCapture(
       npmCommand,
-      ["view", packageName, "version", "--json"],
-      { env: { ...process.env, NODE_AUTH_TOKEN: process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN || "" } },
+      ['view', packageName, 'version', '--json'],
+      {
+        env: {
+          ...process.env,
+          NODE_AUTH_TOKEN:
+            process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN || '',
+        },
+      }
     );
-    const value = JSON.parse(result.stdout.trim() || "null");
-    if (typeof value === "string" && value) return value;
+    const value = JSON.parse(result.stdout.trim() || 'null');
+    if (typeof value === 'string' && value) return value;
     return null;
   } catch (error) {
-    const stderr = String(error?.stderr || "");
-    if (stderr.includes("E404") || stderr.includes("404")) {
+    const stderr = String(error?.stderr || '');
+    if (stderr.includes('E404') || stderr.includes('404')) {
       return null;
     }
     throw error;
@@ -247,19 +299,25 @@ async function maybePublishedVersion(packageName) {
 }
 
 async function packPackage(packageDir) {
-  const npmCommand = _command("npm");
-  await run(npmCommand, ["pack"], { cwd: packageDir });
-  const tarballs = (await fs.readdir(packageDir)).filter((entry) => entry.endsWith(".tgz")).sort();
-  if (!tarballs.length) {
+  const npmCommand = _command('npm');
+  await run(npmCommand, ['pack'], { cwd: packageDir });
+  const tarball = selectLatestTarball(await fs.readdir(packageDir));
+  if (!tarball) {
     throw new Error(`npm pack did not produce a tarball in ${packageDir}`);
   }
-  return path.join(packageDir, tarballs[tarballs.length - 1]);
+  return path.join(packageDir, tarball);
 }
 
-export function buildPublishCommandArgs(tarballPath, { tag } = {}) {
-  const args = ["publish", tarballPath, "--access", "public"];
+export function buildPublishCommandArgs(
+  tarballPath,
+  { tag, provenance = false } = {}
+) {
+  const args = ['publish', tarballPath, '--access', 'public'];
+  if (provenance) {
+    args.push('--provenance');
+  }
   if (tag) {
-    args.push("--tag", tag);
+    args.push('--tag', tag);
   }
   return args;
 }
@@ -272,7 +330,7 @@ async function publishTarballIfNeeded(packageName, version, tarballPath, cwd) {
     const comparison = compareSemver(version, publishedVersion);
     if (comparison < 0) {
       throw new Error(
-        `Refusing to publish ${packageName}@${version}; npm already has newer version ${publishedVersion}.`,
+        `Refusing to publish ${packageName}@${version}; npm already has newer version ${publishedVersion}.`
       );
     }
     if (comparison === 0) {
@@ -280,51 +338,87 @@ async function publishTarballIfNeeded(packageName, version, tarballPath, cwd) {
     }
   }
 
-  const npmCommand = _command("npm");
-  await run(npmCommand, buildPublishCommandArgs(tarballPath, { tag: publishTag }), { cwd });
+  const npmCommand = _command('npm');
+  await run(
+    npmCommand,
+    buildPublishCommandArgs(tarballPath, {
+      tag: publishTag,
+      provenance: publishProvenance,
+    }),
+    { cwd }
+  );
   return { published: true, skipped: false };
 }
 
-function _binaryFilename() {
-  return process.platform === "win32" ? "opencode.exe" : "opencode";
+async function readPublishTarget(packageDir) {
+  const pkg = await readJson(path.join(packageDir, 'package.json'));
+  if (typeof pkg?.name !== 'string' || typeof pkg?.version !== 'string') {
+    throw new Error(`Invalid package metadata in ${packageDir}`);
+  }
+  const tarball = selectLatestTarball(await fs.readdir(packageDir));
+  if (!tarball) {
+    throw new Error(`Missing npm tarball in ${packageDir}`);
+  }
+  return {
+    packageName: pkg.name,
+    version: pkg.version,
+    tarballPath: path.join(packageDir, tarball),
+    cwd: packageDir,
+  };
 }
 
-async function adHocSignBinary(binaryPath) {
-  if (process.platform !== "darwin") return;
-  await run("codesign", ["--force", "--sign", "-", binaryPath], {
-    stdio: "ignore",
-  });
-}
+async function publishExistingPackages(artifactDir) {
+  const packageRoot = path.join(artifactDir, 'npm-binaries');
+  const entries = await fs.readdir(packageRoot, { withFileTypes: true });
+  const binaryPackageDirs = entries
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => path.join(packageRoot, entry.name))
+    .sort();
+  if (!binaryPackageDirs.length) {
+    throw new Error(`No existing binary packages found under ${packageRoot}`);
+  }
 
-async function patchBinaryAtPath(binaryPath) {
-  const buffer = await fs.readFile(binaryPath);
-  const originalLength = buffer.length;
-  const patch = patchZenocodeBinaryText(buffer.toString("latin1"));
-  if (!patch.patched) {
-    throw new Error(`Branding patch did not match binary ${binaryPath}`);
+  const targets = [];
+  for (const packageDir of binaryPackageDirs) {
+    targets.push(await readPublishTarget(packageDir));
   }
-  const patchedMandatoryBranding = patch.patches.logo || patch.patches.footer;
-  if (!patchedMandatoryBranding && !allowsDisplayNameOnlyBranding(forkRef)) {
-    throw new Error(
-      `Branding patch only matched display names for ${binaryPath}; update the logo/footer patch signatures before building ${forkRef}.`,
+  targets.push(await readPublishTarget(path.join(artifactDir, 'npm-package')));
+
+  const published = [];
+  const skipped = [];
+  for (const target of targets) {
+    const result = await publishTarballIfNeeded(
+      target.packageName,
+      target.version,
+      target.tarballPath,
+      target.cwd
     );
+    if (result.published) {
+      published.push(target.packageName);
+    } else if (result.skipped) {
+      skipped.push(target.packageName);
+    }
   }
-  const nextBuffer = Buffer.from(patch.text, "latin1");
-  if (nextBuffer.length !== originalLength) {
-    throw new Error(`Branding patch changed binary length for ${binaryPath}`);
+
+  if (published.length) {
+    console.log(`Published packages: ${published.join(', ')}`);
   }
-  await fs.writeFile(binaryPath, nextBuffer);
-  if (process.platform !== "win32") {
-    await fs.chmod(binaryPath, 0o755);
+  if (skipped.length) {
+    console.log(`Skipped already-published packages: ${skipped.join(', ')}`);
   }
-  await adHocSignBinary(binaryPath);
 }
 
-function _buildWrapperExecutable({ runtimePackageName, binName }) {
+export function binaryFilenameForPackage(packageName) {
+  return packageName.includes('-windows-') ? 'opencode.exe' : 'opencode';
+}
+
+/** Build the npm dispatcher that selects only a Zenocode-owned platform binary. */
+export function buildWrapperExecutable({ runtimePackageName }) {
   const { scope, baseName } = _packageParts(runtimePackageName);
   const scopeLiteral = JSON.stringify(scope);
-  const packagePrefixLiteral = JSON.stringify(_runtimeBinaryPrefix(runtimePackageName));
-  const binNameLiteral = JSON.stringify(binName || "");
+  const packagePrefixLiteral = JSON.stringify(
+    _runtimeBinaryPrefix(runtimePackageName)
+  );
   const packageBaseLiteral = JSON.stringify(baseName);
 
   return `#!/usr/bin/env node
@@ -346,17 +440,11 @@ function run(target) {
   process.exit(code)
 }
 
-const envPath = process.env.OPENCODE_BIN_PATH
-if (envPath) {
-  run(envPath)
-}
-
 const scriptPath = fs.realpathSync(__filename)
 const scriptDir = path.dirname(scriptPath)
 const packageScope = ${scopeLiteral}
 const packagePrefix = ${packagePrefixLiteral}
 const packageBaseName = ${packageBaseLiteral}
-const brandedBinName = ${binNameLiteral}
 
 const platformMap = {
   darwin: "darwin",
@@ -475,8 +563,7 @@ const names = (() => {
 
 function candidatePackageNames(name) {
   const scopedName = packageScope ? packageScope + "/" + name : name
-  const legacyName = name.replace(new RegExp("^" + packagePrefix), "opencode")
-  return packageScope ? [scopedName, legacyName] : [scopedName]
+  return [scopedName]
 }
 
 function resolveFromPackage(packageName) {
@@ -525,43 +612,51 @@ async function buildWrapperPackage({
   version,
   binaryPackages,
 }) {
-  const wrapperDir = path.join(artifactDir, "npm-package");
+  const wrapperDir = path.join(artifactDir, 'npm-package');
   await fs.rm(wrapperDir, { recursive: true, force: true });
-  await fs.mkdir(path.join(wrapperDir, "bin"), { recursive: true });
+  await fs.mkdir(path.join(wrapperDir, 'bin'), { recursive: true });
 
   const wrapperPkg = {
     name: packageName,
     version,
-    license: "MIT",
-    type: "commonjs",
+    license: 'MIT',
+    type: 'commonjs',
+    repository: trustedPublishingRepository,
     bin: buildWrapperBinMap(packageName, binName),
     optionalDependencies: Object.fromEntries(
-      binaryPackages.map((pkg) => [pkg.brandedName, pkg.version]),
+      binaryPackages.map((pkg) => [pkg.brandedName, pkg.version])
     ),
-    files: [
-      "bin",
-      "LICENSE",
-    ],
+    files: ['bin', 'LICENSE'],
   };
 
-  await fs.copyFile(licensePath, path.join(wrapperDir, "LICENSE"));
+  await fs.copyFile(licensePath, path.join(wrapperDir, 'LICENSE'));
   await fs.writeFile(
-    path.join(wrapperDir, "bin", "opencode"),
-    _buildWrapperExecutable({ runtimePackageName: packageName, binName }),
-    { encoding: "utf-8", mode: 0o755 },
+    path.join(wrapperDir, 'bin', 'opencode'),
+    buildWrapperExecutable({ runtimePackageName: packageName }),
+    { encoding: 'utf-8', mode: 0o755 }
   );
-  if (process.platform !== "win32") {
-    await fs.chmod(path.join(wrapperDir, "bin", "opencode"), 0o755);
+  if (process.platform !== 'win32') {
+    await fs.chmod(path.join(wrapperDir, 'bin', 'opencode'), 0o755);
   }
-  await writeJson(path.join(wrapperDir, "package.json"), wrapperPkg);
+  await writeJson(path.join(wrapperDir, 'package.json'), wrapperPkg);
 
   const tarballPath = await packPackage(wrapperDir);
-  const publishResult = await publishTarballIfNeeded(packageName, version, tarballPath, wrapperDir);
+  const publishResult = await publishTarballIfNeeded(
+    packageName,
+    version,
+    tarballPath,
+    wrapperDir
+  );
   return { tarballPath, publishResult };
 }
 
-async function prepareBinaryPackages({ distDir, artifactDir, runtimePackageName }) {
-  const packageRoot = path.join(artifactDir, "npm-binaries");
+async function prepareBinaryPackages({
+  distDir,
+  artifactDir,
+  runtimePackageName,
+  runtimeVersion,
+}) {
+  const packageRoot = path.join(artifactDir, 'npm-binaries');
   await fs.rm(packageRoot, { recursive: true, force: true });
   await fs.mkdir(packageRoot, { recursive: true });
 
@@ -570,29 +665,46 @@ async function prepareBinaryPackages({ distDir, artifactDir, runtimePackageName
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     const sourceDir = path.join(distDir, entry.name);
-    const packageJsonPath = path.join(sourceDir, "package.json");
+    const packageJsonPath = path.join(sourceDir, 'package.json');
     let pkg;
     try {
       pkg = await readJson(packageJsonPath);
     } catch {
       continue;
     }
-    if (typeof pkg?.name !== "string" || typeof pkg?.version !== "string") {
+    if (typeof pkg?.name !== 'string' || typeof pkg?.version !== 'string') {
       continue;
     }
-    if (!pkg.name.startsWith("opencode-")) {
+    if (!pkg.name.startsWith('opencode-')) {
       continue;
     }
 
-    const brandedName = mapBrandedBinaryPackageName(pkg.name, runtimePackageName);
-    const targetDir = path.join(packageRoot, brandedName.replace("/", "__"));
+    const brandedName = mapBrandedBinaryPackageName(
+      pkg.name,
+      runtimePackageName
+    );
+    const targetDir = path.join(packageRoot, brandedName.replace('/', '__'));
     await fs.cp(sourceDir, targetDir, { recursive: true });
     pkg.name = brandedName;
-    await writeJson(path.join(targetDir, "package.json"), pkg);
-    await patchBinaryAtPath(path.join(targetDir, "bin", _binaryFilename()));
+    pkg.version = runtimeVersion;
+    pkg.repository = trustedPublishingRepository;
+    await writeJson(path.join(targetDir, 'package.json'), pkg);
+    const binaryPath = path.join(
+      targetDir,
+      'bin',
+      binaryFilenameForPackage(pkg.name)
+    );
+    if (process.platform !== 'win32') {
+      await fs.chmod(binaryPath, 0o755);
+    }
 
     const tarballPath = await packPackage(targetDir);
-    const publishResult = await publishTarballIfNeeded(brandedName, pkg.version, tarballPath, targetDir);
+    const publishResult = await publishTarballIfNeeded(
+      brandedName,
+      pkg.version,
+      tarballPath,
+      targetDir
+    );
     packages.push({
       dirName: entry.name,
       originalName: entry.name,
@@ -608,12 +720,14 @@ async function prepareBinaryPackages({ distDir, artifactDir, runtimePackageName
     throw new Error(`No OpenCode binary packages found under ${distDir}`);
   }
 
-  return packages.sort((left, right) => left.originalName.localeCompare(right.originalName));
+  return packages.sort((left, right) =>
+    left.originalName.localeCompare(right.originalName)
+  );
 }
 
 function pickCurrentPlatformBinary(distPackages) {
-  const platformMap = { darwin: "darwin", linux: "linux", win32: "windows" };
-  const archMap = { x64: "x64", arm64: "arm64" };
+  const platformMap = { darwin: 'darwin', linux: 'linux', win32: 'windows' };
+  const archMap = { x64: 'x64', arm64: 'arm64' };
   const expectedPlatform = platformMap[process.platform] || process.platform;
   const expectedArch = archMap[process.arch] || process.arch;
   const prefix = _runtimeBinaryPrefix(wrapperPackageName);
@@ -629,56 +743,85 @@ function pickCurrentPlatformBinary(distPackages) {
 }
 
 async function main() {
-  if (cliArgs.includes("-h") || cliArgs.includes("--help")) {
-    console.log("Build branded Zenocode OpenCode runtime packages from upstream.");
-    console.log("");
-    console.log("Environment variables:");
-    console.log(`  ZENOCODE_OPENCODE_FORK_URL    Fork URL (default: ${forkUrl})`);
-    console.log("  ZENOCODE_OPENCODE_REF         Branch/tag/commit to build");
-    console.log(`  ZENOCODE_BRANDED_OUTPUT_DIR   Output directory (default: ${outputDir})`);
-    console.log(`  ZENOCODE_BRANDED_PACKAGE      Wrapper package name (default: ${wrapperPackageName})`);
-    console.log(`  ZENOCODE_BRANDED_BIN_NAME     Extra bin name in wrapper (default: ${wrapperBinName})`);
-    console.log("  ZENOCODE_OPENCODE_BUILD_ARGS  Additional args for upstream build script");
-    console.log("  ZENOCODE_PUBLISH=1            Publish packages to npm");
-    console.log(`  ZENOCODE_PUBLISH_TAG          npm tag (default: ${publishTag})`);
-    console.log("  Legacy CODECORTEX_* env names are still accepted for compatibility.");
+  if (cliArgs.includes('-h') || cliArgs.includes('--help')) {
+    console.log(
+      'Build branded Zenocode OpenCode runtime packages from upstream.'
+    );
+    console.log('');
+    console.log('Environment variables:');
+    console.log(
+      `  ZENOCODE_OPENCODE_FORK_URL    Fork URL (default: ${forkUrl})`
+    );
+    console.log('  ZENOCODE_OPENCODE_REF         Branch/tag/commit to build');
+    console.log(
+      `  ZENOCODE_BRANDED_OUTPUT_DIR   Output directory (default: ${outputDir})`
+    );
+    console.log(
+      `  ZENOCODE_BRANDED_PACKAGE      Wrapper package name (default: ${wrapperPackageName})`
+    );
+    console.log(
+      `  ZENOCODE_BRANDED_BIN_NAME     Extra bin name in wrapper (default: ${wrapperBinName})`
+    );
+    console.log(
+      '  ZENOCODE_OPENCODE_BUILD_ARGS  Additional args for upstream build script'
+    );
+    console.log('  ZENOCODE_PUBLISH=1            Publish packages to npm');
+    console.log(
+      `  ZENOCODE_PUBLISH_TAG          npm tag (default: ${publishTag})`
+    );
+    console.log(
+      '  --publish-existing            Publish tarballs from the output directory without rebuilding'
+    );
+    console.log(
+      '  Legacy CODECORTEX_* env names are still accepted for compatibility.'
+    );
     return;
   }
 
-  const gitCommand = _command("git");
-  const bunCommand = _command("bun");
-  const npmCommand = _command("npm");
-  await requireCommand(gitCommand);
-  await requireCommand(bunCommand);
+  const npmCommand = _command('npm');
   await requireCommand(npmCommand);
 
-  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "zenocode-opencode-"));
-  const checkoutDir = path.join(tempRoot, "opencode");
-  const distDir = path.join(checkoutDir, "packages", "opencode", "dist");
   const artifactDir = path.resolve(outputDir);
 
+  if (cliArgs.includes('--publish-existing')) {
+    await publishExistingPackages(artifactDir);
+    return;
+  }
+
+  const gitCommand = _command('git');
+  const bunCommand = _command('bun');
+  await requireCommand(gitCommand);
+  await requireCommand(bunCommand);
+
+  const tempRoot = await fs.mkdtemp(
+    path.join(os.tmpdir(), 'zenocode-opencode-')
+  );
+  const checkoutDir = path.join(tempRoot, 'opencode');
+  const distDir = path.join(checkoutDir, 'packages', 'opencode', 'dist');
+
   try {
-    const cloneArgs = ["clone", "--depth=1"];
+    const cloneArgs = ['clone', '--depth=1'];
     if (forkRef) {
-      cloneArgs.push("--branch", forkRef);
+      cloneArgs.push('--branch', forkRef);
     }
     cloneArgs.push(forkUrl, checkoutDir);
     await run(gitCommand, cloneArgs);
 
-    await run(bunCommand, ["install"], { cwd: checkoutDir });
+    await applyZenocodeSourceBranding(checkoutDir);
+    await run(bunCommand, ['install'], { cwd: checkoutDir });
     await run(
       bunCommand,
-      ["./packages/opencode/script/build.ts", "--single", ...buildArgs],
+      ['./packages/opencode/script/build.ts', ...buildArgs],
       {
         cwd: checkoutDir,
         env: {
           ...process.env,
-          OPENCODE_CHANNEL: process.env.OPENCODE_CHANNEL || "latest",
+          OPENCODE_CHANNEL: process.env.OPENCODE_CHANNEL || 'latest',
           OPENCODE_VERSION:
             process.env.OPENCODE_VERSION ||
             deriveOpenCodeVersionFromRef(forkRef, defaultOpenCodeVersion),
         },
-      },
+      }
     );
 
     await fs.mkdir(artifactDir, { recursive: true });
@@ -686,16 +829,17 @@ async function main() {
       distDir,
       artifactDir,
       runtimePackageName: wrapperPackageName,
+      runtimeVersion: zenocodeRuntimeVersion,
     });
 
     const version = binaryPackages[0]?.version;
     if (!version) {
-      throw new Error("Unable to determine branded runtime version");
+      throw new Error('Unable to determine branded runtime version');
     }
 
     const wrapperResult = await buildWrapperPackage({
       artifactDir,
-      licensePath: path.join(checkoutDir, "LICENSE"),
+      licensePath: path.join(checkoutDir, 'LICENSE'),
       packageName: wrapperPackageName,
       binName: wrapperBinName,
       version,
@@ -703,42 +847,63 @@ async function main() {
     });
 
     const selectedPackage = pickCurrentPlatformBinary(
-      binaryPackages.map((pkg) => pkg.brandedName.split("/").at(-1)),
+      binaryPackages.map((pkg) => pkg.brandedName.split('/').at(-1))
     );
-    const localBinaryPackage = binaryPackages.find((pkg) => pkg.brandedName.endsWith(`/${selectedPackage}`))
-      || binaryPackages[0];
-    const localBinaryDir = path.join(artifactDir, "bin");
-    const localBinaryName = process.platform === "win32" ? "zenocode-opencode.exe" : "zenocode-opencode";
+    const localBinaryPackage =
+      binaryPackages.find((pkg) =>
+        pkg.brandedName.endsWith(`/${selectedPackage}`)
+      ) || binaryPackages[0];
+    const localBinaryDir = path.join(artifactDir, 'bin');
+    const localBinaryName =
+      process.platform === 'win32'
+        ? 'zenocode-opencode.exe'
+        : 'zenocode-opencode';
     const localBinaryPath = path.join(localBinaryDir, localBinaryName);
 
     await fs.mkdir(localBinaryDir, { recursive: true });
     await fs.copyFile(
-      path.join(localBinaryPackage.packageDir, "bin", _binaryFilename()),
-      localBinaryPath,
+      path.join(
+        localBinaryPackage.packageDir,
+        'bin',
+        binaryFilenameForPackage(localBinaryPackage.originalName)
+      ),
+      localBinaryPath
     );
-    if (process.platform !== "win32") {
+    if (process.platform !== 'win32') {
       await fs.chmod(localBinaryPath, 0o755);
     }
 
-    console.log("\nZenocode branded build complete.");
+    console.log('\nZenocode branded build complete.');
     console.log(`Branded binary: ${localBinaryPath}`);
     console.log(`Wrapper package tarball: ${wrapperResult.tarballPath}`);
     for (const pkg of binaryPackages) {
       console.log(`Binary package tarball: ${pkg.tarballPath}`);
     }
     if (publishEnabled) {
-      const publishedBinaries = binaryPackages.filter((pkg) => pkg.publishResult.published).map((pkg) => pkg.brandedName);
-      const skippedBinaries = binaryPackages.filter((pkg) => pkg.publishResult.skipped).map((pkg) => pkg.brandedName);
+      const publishedBinaries = binaryPackages
+        .filter((pkg) => pkg.publishResult.published)
+        .map((pkg) => pkg.brandedName);
+      const skippedBinaries = binaryPackages
+        .filter((pkg) => pkg.publishResult.skipped)
+        .map((pkg) => pkg.brandedName);
       if (publishedBinaries.length) {
-        console.log(`Published binary packages: ${publishedBinaries.join(", ")}`);
+        console.log(
+          `Published binary packages: ${publishedBinaries.join(', ')}`
+        );
       }
       if (skippedBinaries.length) {
-        console.log(`Skipped already-published binary packages: ${skippedBinaries.join(", ")}`);
+        console.log(
+          `Skipped already-published binary packages: ${skippedBinaries.join(', ')}`
+        );
       }
       if (wrapperResult.publishResult.published) {
-        console.log(`Published wrapper package: ${wrapperPackageName} (tag: ${publishTag}).`);
+        console.log(
+          `Published wrapper package: ${wrapperPackageName} (tag: ${publishTag}).`
+        );
       } else if (wrapperResult.publishResult.skipped) {
-        console.log(`Skipped already-published wrapper package: ${wrapperPackageName}.`);
+        console.log(
+          `Skipped already-published wrapper package: ${wrapperPackageName}.`
+        );
       }
     }
     console.log(`\nRun with local binary:`);
@@ -758,7 +923,10 @@ function resolveExecutablePath(value) {
   }
 }
 
-if (process.argv[1] && resolveExecutablePath(process.argv[1]) === currentFilePath) {
+if (
+  process.argv[1] &&
+  resolveExecutablePath(process.argv[1]) === currentFilePath
+) {
   main().catch((error) => {
     console.error(error instanceof Error ? error.message : String(error));
     process.exit(1);