akm-cli 0.10.261014-beta → 0.10.261016-beta

package/dist/core/config/config-walker.js

@@ -27,7 +27,7 @@ import { hasRegistryUrlCredentials, REGISTRY_CREDENTIALS_UNSUPPORTED } from "../
 import { warnOnce } from "../warn.js";
 import { AkmConfigBaseSchema, listTopLevelConfigKeys } from "./config-schema.js";
 import { deepMergeConfig } from "./deep-merge.js";
-import { isEnvReference } from "./schema/primitives.js";
+import { isEnvReference, OpaqueFieldSchema } from "./schema/primitives.js";
 /**
  * Parse a dotted path into segments. Empty segments are rejected. Bracket
  * notation (e.g. `sources[0]`) is NOT supported — arrays are set as JSON.
@@ -46,33 +46,39 @@ function parsePath(dotted) {
 function unwrap(schema) {
     let current = schema;
     while (true) {
-        if (current instanceof z.ZodOptional) {
-            current = current._def.innerType;
-        }
-        else if (current instanceof z.ZodDefault) {
-            current = current._def.innerType;
-        }
-        else if (current instanceof z.ZodNullable) {
-            current = current._def.innerType;
-        }
-        else if (current instanceof z.ZodCatch) {
+        if (current instanceof z.ZodOptional ||
+            current instanceof z.ZodDefault ||
+            current instanceof z.ZodNullable ||
             // `.catch(...)` wraps an inner schema with a fallback value.
-            current = current._def.innerType;
+            current instanceof z.ZodCatch ||
+            current instanceof z.ZodReadonly) {
+            current = current.def.innerType;
         }
-        else if (current instanceof z.ZodEffects) {
-            // `.refine()` / `.superRefine()` / `.transform()` / `.preprocess()` —
-            // descend into the inner schema (`schema` for refine/transform, `out`
-            // for preprocess — both are exposed at `_def.schema`).
-            current = current._def.schema;
-        }
-        else if (current instanceof z.ZodReadonly) {
-            current = current._def.innerType;
+        else if (current instanceof z.ZodPipe) {
+            // `.transform()` pipes the schema into a transform and `z.preprocess()` pipes a transform into it:
+            // descend into the side that is a schema. (`.refine()` and `.superRefine()` wrap nothing.)
+            const { in: input, out } = current.def;
+            current = (input instanceof z.ZodTransform ? out : input);
         }
         else {
             return current;
         }
     }
 }
+/**
+ * The schema of the keys an object takes without naming them (`index.<passName>`,
+ * a connection's request fields), or `undefined` when its extra keys are not
+ * ones akm defines. `.passthrough()` gives an object an `unknown` catchall, so
+ * only `OpaqueFieldSchema` itself says "any key, contents left to the endpoint".
+ */
+function namedCatchall(object) {
+    const catchall = object.def.catchall;
+    if (catchall === undefined || catchall instanceof z.ZodNever)
+        return undefined;
+    if (catchall instanceof z.ZodUnknown && catchall !== OpaqueFieldSchema)
+        return undefined;
+    return catchall;
+}
 /** True for a schema that accepts any value (`z.unknown()`): its contents are not keys akm defines. */
 export function isOpaqueSchema(schema) {
     return unwrap(schema) instanceof z.ZodUnknown;
@@ -91,13 +97,10 @@ export function resolveSchemaAt(path, config, raw) {
             const next = schema.shape[segment];
             if (!next) {
                 // Catchall (e.g. index.<passName>) — descend into the catchall schema.
-                const catchall = schema._def.catchall;
-                if (catchall && !(catchall instanceof z.ZodNever)) {
-                    schema = catchall;
-                }
-                else {
+                const catchall = namedCatchall(schema);
+                if (!catchall)
                     return undefined;
-                }
+                schema = catchall;
             }
             else {
                 schema = next;
@@ -106,13 +109,13 @@ export function resolveSchemaAt(path, config, raw) {
         else if (schema instanceof z.ZodRecord) {
             // Named records (connections, harnesses, improve.strategies, sources, etc.)
             // accept any string key — descend into the value schema.
-            schema = schema._def.valueType;
+            schema = schema.def.valueType;
         }
         else if (schema instanceof z.ZodUnion) {
-            const option = selectUnionObjectOption(schema._def.options, segment, existing, index === path.length - 1 ? raw : undefined);
+            const option = selectUnionObjectOption(schema.options, segment, existing, index === path.length - 1 ? raw : undefined);
             if (!option)
                 return undefined;
-            schema = (option.shape[segment] ?? option._def.catchall);
+            schema = (option.shape[segment] ?? namedCatchall(option));
         }
         else {
             // Cannot descend into a non-object schema.
@@ -145,7 +148,7 @@ function selectUnionObjectOption(candidates, segment, existing, raw) {
     }
     return (options.find((option) => segment in option.shape) ??
         // A model entry such as `{ model, reasoning_effort }` holds request fields the object does not name.
-        options.find((option) => !(option._def.catchall instanceof z.ZodNever)));
+        options.find((option) => namedCatchall(option) !== undefined));
 }
 /**
  * Get the value at the dotted path from a config-shaped object. Returns
@@ -350,7 +353,7 @@ function coerceForSchema(schema, raw, key) {
         return raw;
     }
     if (target instanceof z.ZodLiteral) {
-        return typeof target._def.value === "string" ? raw : target._def.value;
+        return typeof target.value === "string" ? raw : target.value;
     }
     if (target instanceof z.ZodArray || target instanceof z.ZodObject || target instanceof z.ZodRecord) {
         if (raw === "" || raw === "null")
@@ -366,7 +369,7 @@ function coerceForSchema(schema, raw, key) {
     if (target instanceof z.ZodUnion) {
         // Try each option in order. Use the first that the schema accepts after
         // coercion. Falls through to JSON parsing if all fail.
-        const options = target._def.options;
+        const options = target.options;
         let lastErr;
         for (const opt of options) {
             try {

package/dist/core/config/schema/connections.js

@@ -12,7 +12,7 @@
  */
 import { z } from "zod";
 import { WORKFLOW_MAX_TIMEOUT_MS } from "../../../workflows/resource-limits.js";
-import { connectionEndpoint, engineName, envReferenceApiKey, nonEmptyString, positiveInt, retiredApiKeyFile, } from "./primitives.js";
+import { connectionEndpoint, engineName, envReferenceApiKey, nonEmptyString, OpaqueFieldSchema, positiveInt, retiredApiKeyFile, } from "./primitives.js";
 /**
  * Timeouts share the workflow ceiling: a larger value would pass config
  * validation and then fail every run with an unlocated "invocation is invalid".
@@ -24,7 +24,10 @@ export const timeoutMsField = z.union([positiveInt.max(WORKFLOW_MAX_TIMEOUT_MS),
  * request fields of its own. The object is listed first so a JSON value given to
  * `akm config set` is read as one.
  */
-export const ModelEntrySchema = z.union([z.object({ model: nonEmptyString }).catchall(z.unknown()), nonEmptyString]);
+export const ModelEntrySchema = z.union([
+    z.object({ model: nonEmptyString }).catchall(OpaqueFieldSchema),
+    nonEmptyString,
+]);
 /** Alias (`fast`, `balanced`, `reasoning`, or any the user adds) to the model it names. */
 export const ModelAliasesSchema = z.record(nonEmptyString, ModelEntrySchema);
 export const ConnectionSchema = z
@@ -37,5 +40,5 @@ export const ConnectionSchema = z
     timeoutMs: timeoutMsField,
     concurrency: positiveInt.optional(),
 })
-    .catchall(z.unknown());
+    .catchall(OpaqueFieldSchema);
 export const ConnectionsSchema = z.record(engineName, ConnectionSchema);

package/dist/core/config/schema/harnesses.js

@@ -13,7 +13,14 @@ import { ModelAliasesSchema, timeoutMsField } from "./connections.js";
 import { engineName, nonEmptyString } from "./primitives.js";
 export const HarnessSchema = z
     .object({
-    platform: z.enum(HARNESS_CONFIG_PLATFORMS).optional(),
+    // Zod 4's message for a value outside an enum no longer quotes the value; the warning for a dropped harness should.
+    platform: z
+        .enum(HARNESS_CONFIG_PLATFORMS, {
+        error: (issue) => issue.code === "invalid_value"
+            ? `${JSON.stringify(issue.input)} is not one of ${HARNESS_CONFIG_PLATFORMS.join(", ")}`
+            : undefined,
+    })
+        .optional(),
     bin: nonEmptyString.optional(),
     args: z.array(z.string()).optional(),
     workspace: nonEmptyString.optional(),

package/dist/core/config/schema/primitives.js

@@ -12,11 +12,22 @@ import { redactUrlCredentials } from "../../redaction.js";
 import { isSecretRefToken } from "../../ref-token.js";
 import { warnOnce } from "../../warn.js";
 import { ENGINE_NAME_PATTERN_SOURCE } from "../engine-semantics.js";
+// Zod 4 reports a map key its key schema rejects as "Invalid key in record" and keeps that schema's own message
+// (the naming rule, the slug rule) inside the issue; config errors and warnings print only the outer message.
+z.config({
+    customError: (issue) => issue.code === "invalid_key" ? issue.issues.map((inner) => inner.message).join("; ") : undefined,
+});
 /** Persisted config schema version. Package prerelease/patch versions do not change this value. */
 export const CURRENT_CONFIG_VERSION = "0.9.0";
 // ── Reusable atomic schemas ─────────────────────────────────────────────────
 /** Positive integer (used for tokens, timeouts, batch sizes). */
 export const positiveInt = z.number().int().positive();
+/**
+ * The catchall of an object whose extra keys are the endpoint's to define (a connection's request fields):
+ * any key, contents left alone. The config walker knows it by identity: a `.passthrough()` object also has an
+ * `unknown` catchall, and its extra keys are ones akm does not define.
+ */
+export const OpaqueFieldSchema = z.unknown();
 /** Non-negative finite number (used for scores, weights, days). */
 export const nonNegativeNumber = z.number().finite().min(0);
 /** Non-empty string (rejects "" and whitespace-only). */
@@ -92,7 +103,7 @@ export const connectionEndpoint = z.string().superRefine((value, ctx) => {
         warnOnce(`connectionEndpoint:userinfo:${shown}`, `Config endpoint "${shown}" embeds a username/password; move the credential out of the URL (apiKey: "$VAR", or credentials.json).`);
     }
 });
-export const ExtraParamsSchema = z.record(z.unknown()).superRefine((value, ctx) => {
+export const ExtraParamsSchema = z.record(z.string(), z.unknown()).superRefine((value, ctx) => {
     for (const issue of validateExtraParams(value)) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, path: issue.path, message: issue.message });
     }

package/dist/core/config/schema/sources-bundles.js

@@ -16,7 +16,7 @@ import { isBundleSlug } from "../../asset/asset-ref.js";
 import { httpUrl, isApiKeyReference, nonEmptyString, positiveInt } from "./primitives.js";
 const VALID_ADAPTER_IDS_SET = new Set(VALID_ADAPTER_IDS);
 // ── Sources / registries / installed ────────────────────────────────────────
-const SourceConfigEntryOptionsSchema = z.record(z.unknown());
+const SourceConfigEntryOptionsSchema = z.record(z.string(), z.unknown());
 export const SourceConfigEntrySchema = z
     .object({
     type: nonEmptyString,
@@ -74,7 +74,7 @@ export const RegistryConfigEntrySchema = z
     name: z.string().min(1).optional(),
     enabled: z.boolean().optional(),
     provider: z.string().min(1).optional(),
-    options: z.record(z.unknown()).optional(),
+    options: z.record(z.string(), z.unknown()).optional(),
 })
     .passthrough();
 // ── Bundles ─────────────────────────────────────────────────────────────────

package/dist/core/npm-package.js

@@ -0,0 +1,124 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Files out of a package on the npm registry, fetched without installing the
+ * package. akm's own agent runtime (an OpenCode binary) and the local
+ * embedder's runtime (onnxruntime-node's binding and library) come this way:
+ * installing either package would bring what akm does not use, every platform's
+ * binary in one case and an install script that downloads CUDA providers in the
+ * other.
+ */
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { sleep, writeResponseToFileCapped } from "../runtime.js";
+import { fetchWithRetry, isRecord } from "./common.js";
+import { releaseLock } from "./file-lock.js";
+import { formatLockHolderPid, tryAcquireRunLock } from "./run-lock.js";
+import { extractTarGzMembers } from "./tar.js";
+export const NPM_REGISTRY = "https://registry.npmjs.org";
+/** The `sha512-<base64>` integrity npm records for a tarball. */
+function sha512Integrity(file) {
+    return new Promise((resolve, reject) => {
+        const hash = createHash("sha512");
+        fs.createReadStream(file)
+            .on("data", (chunk) => hash.update(chunk))
+            .on("error", reject)
+            .on("end", () => resolve(`sha512-${hash.digest("base64")}`));
+    });
+}
+/** Throws unless the tarball at `file` has the integrity the registry lists for it. */
+export async function verifyIntegrity(file, expected) {
+    const listed = expected.split(/\s+/).filter((integrity) => integrity.startsWith("sha512-"));
+    if (listed.length === 0)
+        throw new Error(`the registry lists no sha512 integrity for it (${expected || "none"})`);
+    const actual = await sha512Integrity(file);
+    if (!listed.includes(actual))
+        throw new Error(`its sha512 integrity is ${actual}, not the ${listed.join(" or ")} the registry lists`);
+}
+async function registryDocument(url) {
+    const response = await fetchWithRetry(url, { headers: { accept: "application/json" } }, { timeout: 30_000 });
+    if (!response.ok) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new Error(`the registry answered HTTP ${response.status}`);
+    }
+    const dist = (await response.json()).dist;
+    if (!isRecord(dist) || typeof dist.tarball !== "string" || typeof dist.integrity !== "string") {
+        throw new Error("the registry document has no dist.tarball and dist.integrity");
+    }
+    return { tarball: dist.tarball, integrity: dist.integrity };
+}
+/** How long a fetch waits for another process's fetch into the same directory: a large tarball on a slow link takes minutes. */
+const FETCH_LOCK_TIMEOUT_MS = 600_000;
+/**
+ * Keep members of `name@version`'s tarball in `directory`, each as `file`. One fetch runs per directory at a time: the
+ * processes fetching there, this one included, wait on a lock file in it, and a dead holder's lock is reclaimed.
+ */
+export async function fetchNpmPackageFiles(name, version, directory, files) {
+    fs.mkdirSync(directory, { recursive: true });
+    const lock = path.join(directory, "fetch.lock");
+    const deadline = Date.now() + FETCH_LOCK_TIMEOUT_MS;
+    for (;;) {
+        const attempt = tryAcquireRunLock(lock, { label: "fetch" });
+        if (attempt.state === "acquired") {
+            try {
+                return await fetchHoldingLock(name, version, directory, files);
+            }
+            finally {
+                releaseLock(attempt.ownership);
+            }
+        }
+        if (Date.now() >= deadline) {
+            throw new Error(`another akm process (pid ${formatLockHolderPid(attempt.holder)}) is still fetching into ${directory} (lock ${lock})`);
+        }
+        await sleep(100);
+    }
+}
+/** Whether `file` is in place whole: files only ever arrive by rename, so an executable regular file is complete. */
+function isExecutableFile(file) {
+    try {
+        fs.accessSync(file, fs.constants.X_OK);
+        return fs.statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The registry document of that one version, its tarball, the check against the sha512 integrity the registry lists
+ * before anything is extracted, then each member by temp file and rename (mode 0755), in the order given. A fetch that
+ * finds every file in place downloads nothing, and a file in place at the size the tarball holds is never renamed over.
+ */
+async function fetchHoldingLock(name, version, directory, files) {
+    if (files.every(({ file }) => isExecutableFile(path.join(directory, file))))
+        return;
+    const download = path.join(directory, `.download-${process.pid}.tgz`);
+    const partial = (file) => path.join(directory, `.${file}-${process.pid}.tmp`);
+    try {
+        const { tarball, integrity } = await registryDocument(`${NPM_REGISTRY}/${name}/${version}`);
+        const response = await fetchWithRetry(tarball, undefined, { timeout: 60_000 });
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new Error(`${tarball} answered HTTP ${response.status}`);
+        }
+        // No overall deadline for a large tarball on a slow link: only 60 s without bytes fails it.
+        await writeResponseToFileCapped(download, response, { stallTimeoutMs: 60_000 });
+        await verifyIntegrity(download, integrity);
+        const sizes = await extractTarGzMembers(download, new Map(files.map(({ member, file }) => [member, partial(file)])));
+        for (const { member, file } of files) {
+            const target = path.join(directory, file);
+            // A whole file in place (an akm without this lock may have made it) stands: a rename would unlink a binary that
+            // may be running on Linux and fails on Windows.
+            if (isExecutableFile(target) && fs.statSync(target).size === sizes.get(member))
+                continue;
+            fs.chmodSync(partial(file), 0o755);
+            fs.renameSync(partial(file), target);
+        }
+    }
+    finally {
+        fs.rmSync(download, { force: true });
+        for (const { file } of files)
+            fs.rmSync(partial(file), { force: true });
+    }
+}

package/dist/{integrations/harnesses/opencode/runtime → core}/tar.js

@@ -2,10 +2,10 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * One member of a gzip-compressed tar archive, streamed to a file. This is all
- * akm needs of tar: the OpenCode binary is a single regular file of about 240 MB
- * inside its package tarball, so it is never held in memory and no tar library
- * is a dependency.
+ * Named members of a gzip-compressed tar archive, streamed to files. This is all
+ * akm needs of tar: a few regular files out of an npm package tarball (the
+ * OpenCode binary, about 240 MB; onnxruntime-node's binding and library), so
+ * nothing is held in memory and no tar library is a dependency.
  */
 import fs from "node:fs";
 import { pipeline } from "node:stream";
@@ -57,35 +57,41 @@ const field = (header, start, end) => {
     return bytes.subarray(0, stop < 0 ? bytes.length : stop).toString("utf8");
 };
 /**
- * Write the regular file `member` of the `.tgz` at `archive` to `destination` (mode 0755) and return its size. Entries
- * are matched by the header's name field alone, which holds up to 100 bytes; a longer name, which tar keeps in the
- * ustar prefix field or a PAX `path` record, is not read, so such a member is never found. The one member akm reads,
- * `package/bin/opencode`, is short. Extended headers are skipped like any other entry that is not the member.
+ * Write each regular file of the `.tgz` at `archive` that `members` names (archive path → destination, mode 0755) and
+ * return each one's size, in one pass that stops once the last is written. Entries are matched by the header's name
+ * field alone, which holds up to 100 bytes; a longer name, which tar keeps in the ustar prefix field or a PAX `path`
+ * record, is not read, so such a member is never found. The members akm reads (`package/bin/opencode`,
+ * `package/bin/napi-v6/<platform>/<arch>/<file>`) are short. Extended headers are skipped like any other entry that is
+ * not a member.
  */
-export async function extractTarGzMember(archive, member, destination) {
+export async function extractTarGzMembers(archive, members) {
     const gunzip = zlib.createGunzip();
     pipeline(fs.createReadStream(archive), gunzip, () => { });
     const reader = new ByteReader(gunzip);
     try {
-        return await extractFrom(reader, archive, member, destination);
+        return await extractFrom(reader, archive, members);
     }
     finally {
         // The rest of the archive is not read: close it now rather than when the stream is collected.
         gunzip.destroy();
     }
 }
-async function extractFrom(reader, archive, member, destination) {
+async function extractFrom(reader, archive, members) {
+    const sizes = new Map();
     for (;;) {
         const header = await reader.exact(BLOCK_BYTES);
-        if (header.every((byte) => byte === 0))
-            throw new Error(`${archive} has no ${member}`);
+        if (header.every((byte) => byte === 0)) {
+            const missing = [...members.keys()].filter((member) => !sizes.has(member));
+            throw new Error(`${archive} has no ${missing.join(", ")}`);
+        }
         const name = field(header, 0, 100).replace(/^\.\//, "");
         const typeflag = String.fromCharCode(header[156] ?? 0);
         const size = Number.parseInt(field(header, 124, 136).trim() || "0", 8);
         if (!Number.isSafeInteger(size))
             throw new Error(`${archive} is not a tar archive this reader understands`);
         const padding = (BLOCK_BYTES - (size % BLOCK_BYTES)) % BLOCK_BYTES;
-        if (name !== member || (typeflag !== "0" && typeflag !== "\0")) {
+        const destination = members.get(name);
+        if (destination === undefined || sizes.has(name) || (typeflag !== "0" && typeflag !== "\0")) {
             await reader.skip(size + padding);
             continue;
         }
@@ -94,7 +100,7 @@ async function extractFrom(reader, archive, member, destination) {
             for (let left = size; left > 0;) {
                 const part = await reader.read(left);
                 if (!part)
-                    throw new Error(`${archive} ends inside ${member}`);
+                    throw new Error(`${archive} ends inside ${name}`);
                 await out.writeFile(part);
                 left -= part.length;
             }
@@ -102,6 +108,9 @@ async function extractFrom(reader, archive, member, destination) {
         finally {
             await out.close();
         }
-        return size;
+        sizes.set(name, size);
+        if (sizes.size === members.size)
+            return sizes;
+        await reader.skip(padding);
     }
 }

package/dist/integrations/harnesses/opencode/runtime/binary.js

@@ -15,14 +15,12 @@
  * `postinstall.mjs` of `@opencode/cli`.
  */
 import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { fetchWithRetry, isRecord, toErrorMessage } from "../../../../core/common.js";
+import { toErrorMessage } from "../../../../core/common.js";
+import { fetchNpmPackageFiles, NPM_REGISTRY } from "../../../../core/npm-package.js";
 import { getCacheDir } from "../../../../core/paths.js";
 import { info } from "../../../../core/warn.js";
-import { writeResponseToFileCapped } from "../../../../runtime.js";
-import { extractTarGzMember } from "./tar.js";
 /**
  * The OpenCode release akm's own runtime runs. It is pinned because the runtime depends on things no OpenCode release
  * promises: the inline config's shape, the `--standalone` flag, the plugin API, the text `run` prints, and the
@@ -31,7 +29,6 @@ import { extractTarGzMember } from "./tar.js";
  * binary (it fetches it) and read `docs/reference/configuration.md` ("Without a harness") for what the version changes.
  */
 export const OPENCODE_RUNTIME_VERSION = "2.1.4";
-const REGISTRY = "https://registry.npmjs.org";
 /** The platform packages of `@opencode/cli` at {@link OPENCODE_RUNTIME_VERSION}. */
 const PACKAGES = new Set([
     "@opencode/cli-linux-x64",
@@ -109,84 +106,20 @@ export function detectHost(env = process.env, operatingSystem = process.platform
 export function runtimeBinaryPath(platform = process.platform) {
     return path.join(getCacheDir(), "opencode", OPENCODE_RUNTIME_VERSION, platform === "win32" ? "opencode.exe" : "opencode");
 }
-/** The `sha512-<base64>` integrity npm records for a tarball. */
-function sha512Integrity(file) {
-    return new Promise((resolve, reject) => {
-        const hash = createHash("sha512");
-        fs.createReadStream(file)
-            .on("data", (chunk) => hash.update(chunk))
-            .on("error", reject)
-            .on("end", () => resolve(`sha512-${hash.digest("base64")}`));
-    });
-}
-/** Throws unless the tarball at `file` has the integrity the registry lists for it. */
-export async function verifyIntegrity(file, expected) {
-    const listed = expected.split(/\s+/).filter((integrity) => integrity.startsWith("sha512-"));
-    if (listed.length === 0)
-        throw new Error(`the registry lists no sha512 integrity for it (${expected || "none"})`);
-    const actual = await sha512Integrity(file);
-    if (!listed.includes(actual))
-        throw new Error(`its sha512 integrity is ${actual}, not the ${listed.join(" or ")} the registry lists`);
-}
-async function registryDocument(url) {
-    const response = await fetchWithRetry(url, { headers: { accept: "application/json" } }, { timeout: 30_000 });
-    if (!response.ok) {
-        await response.body?.cancel().catch(() => undefined);
-        throw new Error(`the registry answered HTTP ${response.status}`);
-    }
-    const dist = (await response.json()).dist;
-    if (!isRecord(dist) || typeof dist.tarball !== "string" || typeof dist.integrity !== "string") {
-        throw new Error("the registry document has no dist.tarball and dist.integrity");
-    }
-    return { tarball: dist.tarball, integrity: dist.integrity };
-}
-/**
- * Fetch the binary of the package `name` into `binary`: the registry document of that one package, its tarball, the
- * integrity check before anything is extracted, then the executable by temp file and rename. Two akm processes fetching
- * at once both finish: a rename that loses to the other leaves the file the other made.
- */
-async function fetchBinary(name, binary) {
-    const directory = path.dirname(binary);
-    fs.mkdirSync(directory, { recursive: true });
-    const download = path.join(directory, `.download-${process.pid}.tgz`);
-    const partial = path.join(directory, `.opencode-${process.pid}.tmp`);
-    try {
-        const { tarball, integrity } = await registryDocument(`${REGISTRY}/${name}/${OPENCODE_RUNTIME_VERSION}`);
-        info(`Fetching OpenCode ${OPENCODE_RUNTIME_VERSION} for akm's own agent runtime (about 114 MB, once) into ${directory}.`);
-        const response = await fetchWithRetry(tarball, undefined, { timeout: 60_000 });
-        if (!response.ok) {
-            await response.body?.cancel().catch(() => undefined);
-            throw new Error(`${tarball} answered HTTP ${response.status}`);
-        }
-        // No overall deadline for a 114 MB file on a slow link: only 60 s without bytes fails it.
-        await writeResponseToFileCapped(download, response, { stallTimeoutMs: 60_000 });
-        await verifyIntegrity(download, integrity);
-        const size = await extractTarGzMember(download, `package/bin/${path.basename(binary)}`, partial);
-        fs.chmodSync(partial, 0o755);
-        try {
-            fs.renameSync(partial, binary);
-        }
-        catch (error) {
-            // Where an open executable cannot be replaced, the other process's file stands.
-            if (!fs.existsSync(binary) || fs.statSync(binary).size !== size)
-                throw error;
-        }
-    }
-    finally {
-        fs.rmSync(download, { force: true });
-        fs.rmSync(partial, { force: true });
-    }
-}
 /** Fetch the binary for this machine, naming the package, its URL and the cache path when it cannot. */
 async function fetchForThisMachine(binary) {
     let name = "an @opencode/cli platform package";
     try {
         name = opencodePackage(detectHost());
-        await fetchBinary(name, binary);
+        info(`Fetching OpenCode ${OPENCODE_RUNTIME_VERSION} for akm's own agent runtime (about 114 MB, once) into ${path.dirname(binary)}.`);
+        const file = path.basename(binary);
+        await fetchNpmPackageFiles(name, OPENCODE_RUNTIME_VERSION, path.dirname(binary), [
+            { member: `package/bin/${file}`, file },
+        ]);
         return binary;
     }
     catch (error) {
-        throw new Error(`Could not fetch OpenCode ${OPENCODE_RUNTIME_VERSION}, which akm's own agent runtime runs: package ${name} from ${REGISTRY}/${name}/${OPENCODE_RUNTIME_VERSION} into ${path.dirname(binary)}: ${toErrorMessage(error)}. ` +
+        throw new Error(`Could not fetch OpenCode ${OPENCODE_RUNTIME_VERSION}, which akm's own agent runtime runs: package ${name} from ${NPM_REGISTRY}/${name}/${OPENCODE_RUNTIME_VERSION} into ${path.dirname(binary)}: ${toErrorMessage(error)}. ` +
             "Without network access for this step, enable the opencode harness with an installed OpenCode 2 instead (see docs/reference/configuration.md).");
     }
 }

package/dist/integrations/harnesses/opencode/runtime/index.js

@@ -24,7 +24,7 @@ import { resolveAkmInvocation } from "../../../../tasks/resolve-akm-bin.js";
 import { buildChildEnv, runBuiltCommand, } from "../../../agent/spawn.js";
 import { akmOpencodeDatabasePath, akmRuntimeDir } from "../roots.js";
 import { v2SessionTokens } from "../session-log-v2.js";
-import { ensureRuntimeBinary, OPENCODE_RUNTIME_VERSION } from "./binary.js";
+import { ensureRuntimeBinary, OPENCODE_RUNTIME_VERSION, runtimeBinaryPath } from "./binary.js";
 import { runtimeArgv, runtimeConfig, runtimeEnv, runtimePrepareArgv } from "./command.js";
 /**
  * What a request is lowered for when it runs here. The persona goes in the prompt, as for the opencode harness
@@ -126,6 +126,10 @@ function sessionRecord(sessionId) {
 }
 export const opencodeRuntime = {
     lowering: runtimeLowerer,
+    pendingFetch: () => fs.existsSync(runtimeBinaryPath()) ? undefined : `OpenCode ${OPENCODE_RUNTIME_VERSION} (about 114 MB, once)`,
+    async fetch() {
+        await ensureRuntimeBinary();
+    },
     async run(profile, opts, connection) {
         const label = `akm's runtime on connection "${profile.name}"`;
         const dispatch = opts.dispatch;