capix-code 2.2.3 → 2.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "capix-code",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "description": "Capix Code — decentralized AI coding agent with GPU marketplace",
   "license": "Apache-2.0",
   "type": "module",
@@ -9,7 +9,7 @@
   },
   "files": [
     "bin/",
-    "scripts/",
+    "scripts/postinstall.cjs",
     "dist/customer/config/",
     "README.md",
     "LICENSE"
@@ -22,12 +22,14 @@
     "lint": "eslint src/",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
+    "pretest": "node scripts/prepare-native-addons.mjs node_modules",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "manifest:validate": "node scripts/validate-manifest.mjs manifest/release-manifest.json",
     "manifest:build": "node scripts/build-manifest.mjs",
     "resolve-version": "node scripts/resolve-version.mjs",
+    "release:check": "node scripts/check-release-consistency.mjs",
     "prepack": "node scripts/prepare-npm-meta.mjs",
     "pack:npm-platform": "node scripts/prepare-npm-platform.mjs",
     "postinstall": "node scripts/postinstall.cjs"
@@ -35,12 +37,15 @@
   "devDependencies": {
     "@ai-sdk/provider": "3.0.8",
     "@capix/runtime-provider": "file:packages/runtime-provider",
+    "@capix/agent-runtime": "file:packages/agent-runtime",
     "@commitlint/config-conventional": "^21.2.0",
     "@eslint/js": "^9.0.0",
     "@opencode-ai/plugin": "1.17.18",
     "@opencode-ai/sdk": "1.17.18",
+    "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^22.0.0",
     "@vitest/coverage-v8": "^2.1.0",
+    "better-sqlite3": "^12.11.1",
     "bun": "^1.3.14",
     "commitlint": "^21.2.1",
     "eslint": "^9.0.0",

package/scripts/postinstall.cjs

@@ -1,63 +1,119 @@
 #!/usr/bin/env node
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const crypto = require('crypto');
-if (process.env.CI || process.env.GITHUB_ACTIONS) { process.exit(0); }
+if (process.env.CI || process.env.GITHUB_ACTIONS) {
+  process.exit(0);
+}
 const VERSION = require('../package.json').version;
 const plat = process.platform === 'win32' ? 'win32' : process.platform;
 const arch = process.arch === 'arm64' ? 'arm64' : 'x64';
 const ext = process.platform === 'win32' ? 'zip' : 'tar.gz';
 const NAME = `capix-code-${VERSION}-${plat}-${arch}-unsigned`;
-const URL = `https://github.com/CapIX-Protocol/Capix-Code/releases/download/v${VERSION}/${NAME}.${ext}`;
+const URL = `https://github.com/CapIX-Protocol/CapIX-Code/releases/download/v${VERSION}/${NAME}.${ext}`;
 const CHECKSUM_URL = `${URL}.sha256`;
 const ROOT = path.join(os.homedir(), '.capix-code');
-const TMP = path.join(os.tmpdir(), `capix-install-${VERSION}`);
+const TMP = path.join(os.tmpdir(), `capix-install-${VERSION}-${process.pid}`);
 const archivePath = path.join(TMP, `${NAME}.${ext}`);
-fs.mkdirSync(ROOT, { recursive: true });
+fs.rmSync(TMP, { recursive: true, force: true });
 fs.mkdirSync(TMP, { recursive: true });
 console.log(`Capix Code v${VERSION} (${plat}-${arch})`);
-execSync(`curl -fsSL -o "${archivePath}" "${URL}"`, { stdio: 'inherit' });
+execFileSync('curl', ['-fsSL', '-o', archivePath, URL], { stdio: 'inherit' });
 const checksumPath = path.join(TMP, 'checksum.sha256');
-execSync(`curl -fsSL -o "${checksumPath}" "${CHECKSUM_URL}"`, { stdio: 'inherit' });
+execFileSync('curl', ['-fsSL', '-o', checksumPath, CHECKSUM_URL], { stdio: 'inherit' });
 const expected = fs.readFileSync(checksumPath, 'utf8').trim().split(/\s+/)[0];
 const actual = crypto.createHash('sha256').update(fs.readFileSync(archivePath)).digest('hex');
-if (expected !== actual) { console.error(`Checksum mismatch!`); process.exit(1); }
-if (process.platform === 'win32') { execSync(`tar -xf "${archivePath}" -C "${TMP}"`, { stdio: 'inherit' }); }
-else { execSync(`tar -xzf "${archivePath}" -C "${TMP}"`, { stdio: 'inherit' }); }
+if (expected !== actual) {
+  console.error(`Checksum mismatch!`);
+  process.exit(1);
+}
+if (process.platform === 'win32') {
+  execFileSync('tar', ['-xf', archivePath, '-C', TMP], { stdio: 'inherit' });
+} else {
+  execFileSync('tar', ['-xzf', archivePath, '-C', TMP], { stdio: 'inherit' });
+}
 const src = path.join(TMP, 'customer');
-if (!fs.existsSync(src)) { console.error('Missing customer/'); process.exit(1); }
+if (!fs.existsSync(src)) {
+  console.error('Missing customer/');
+  process.exit(1);
+}
 const backup = ROOT + '.bak';
-if (fs.existsSync(backup)) fs.rmSync(backup, { recursive: true });
-if (fs.existsSync(ROOT)) fs.renameSync(ROOT, backup);
-fs.mkdirSync(ROOT, { recursive: true });
-for (const dir of ['bin', 'engine', 'runtime', 'config', 'mcp']) {
+const next = `${ROOT}.next-${process.pid}`;
+fs.rmSync(next, { recursive: true, force: true });
+fs.mkdirSync(next, { recursive: true });
+for (const dir of ['bin', 'engine', 'runtime', 'config', 'mcp', 'commands']) {
   const s = path.join(src, dir);
-  if (fs.existsSync(s)) execSync(`cp -a "${s}" "${path.join(ROOT, dir)}"`, { stdio: 'inherit' });
+  if (fs.existsSync(s)) fs.cpSync(s, path.join(next, dir), { recursive: true });
+}
+const executableSuffix = process.platform === 'win32' ? '.exe' : '';
+const nextLauncher = path.join(next, 'bin', `capix-code${executableSuffix}`);
+const nextEngine = path.join(next, 'engine', `capix-engine${executableSuffix}`);
+if (!fs.existsSync(nextLauncher) || !fs.existsSync(nextEngine)) {
+  console.error('The Capix Code release is missing its native launcher or engine.');
+  fs.rmSync(next, { recursive: true, force: true });
+  process.exit(1);
+}
+if (process.platform !== 'win32') {
+  fs.chmodSync(nextLauncher, 0o755);
+  fs.chmodSync(nextEngine, 0o755);
 }
-fs.chmodSync(path.join(ROOT, 'bin', 'capix-code'), 0o755);
-console.log('Installing runtime deps...');
-execSync('npm install --omit=dev --ignore-scripts', { cwd: path.join(ROOT, 'runtime'), stdio: 'inherit' });
-const mcpDir = path.join(ROOT, 'mcp');
+const mcpDir = path.join(next, 'mcp');
 if (!fs.existsSync(path.join(mcpDir, 'node_modules', '@modelcontextprotocol'))) {
-  console.log('Installing MCP deps...');
-  execSync('npm install capix-mcp@2.1.0', { cwd: mcpDir, stdio: 'inherit' });
-  fs.writeFileSync(path.join(mcpDir, 'capix-mcp.js'), '#!/usr/bin/env node\nconst{join}=require("node:path");const{homedir}=require("node:os");require(join(homedir(),".capix-code","mcp","node_modules","capix-mcp","dist","index.js"));\n');
-  fs.chmodSync(path.join(mcpDir, 'capix-mcp.js'), 0o755);
+  console.error('The Capix Code release is missing its bundled MCP runtime.');
+  fs.rmSync(next, { recursive: true, force: true });
+  process.exit(1);
 }
-const cfgDir = path.join(os.homedir(), '.config', 'opencode');
+fs.rmSync(backup, { recursive: true, force: true });
+if (fs.existsSync(ROOT)) fs.renameSync(ROOT, backup);
+try {
+  fs.renameSync(next, ROOT);
+} catch (error) {
+  if (fs.existsSync(backup) && !fs.existsSync(ROOT)) fs.renameSync(backup, ROOT);
+  throw error;
+}
+const launcher = path.join(ROOT, 'bin', `capix-code${executableSuffix}`);
+const engine = path.join(ROOT, 'engine', `capix-engine${executableSuffix}`);
+const cfgDir = path.join(os.homedir(), '.config', 'capix-code');
 fs.mkdirSync(cfgDir, { recursive: true });
 const rt = path.join(ROOT, 'runtime');
 const pu = `file://${rt}/packages/runtime-provider/src/index.ts`;
-fs.writeFileSync(path.join(cfgDir, 'capix-code.json'), JSON.stringify({
-  model: 'capix/auto', enabled_providers: ['capix'],
-  plugin: [path.join(rt, 'src', 'native-bridge.ts'), path.join(rt, 'src', 'plugin.ts')],
-  provider: { capix: { npm: pu, name: 'Capix', models: { auto: { name: 'Capix Auto', limit: { context: 128000, output: 64000 }, api: { url: 'https://www.capix.network/api/v1', npm: pu } } } } }
-}, null, 2));
+const configPath = path.join(cfgDir, 'capix-code.json');
+if (!fs.existsSync(configPath)) {
+  fs.writeFileSync(
+    configPath,
+    JSON.stringify(
+      {
+        model: 'capix/auto',
+        enabled_providers: ['capix'],
+        plugin: [path.join(rt, 'src', 'native-bridge.ts'), path.join(rt, 'src', 'plugin.ts')],
+        provider: {
+          capix: {
+            npm: pu,
+            name: 'Capix',
+            models: {
+              auto: {
+                name: 'Capix Auto',
+                limit: { context: 128000, output: 64000 },
+                api: { url: 'https://www.capix.network/api/v1', npm: pu },
+              },
+            },
+          },
+        },
+      },
+      null,
+      2
+    )
+  );
+}
 if (process.platform === 'darwin') {
-  try { execSync(`codesign --force --sign - "${path.join(ROOT, 'bin', 'capix-code')}"`, { stdio: 'ignore' }); } catch {}
-  try { execSync(`codesign --force --sign - "${path.join(ROOT, 'engine', 'capix-engine')}"`, { stdio: 'ignore' }); } catch {}
+  try {
+    execFileSync('codesign', ['--force', '--sign', '-', launcher], { stdio: 'ignore' });
+  } catch {}
+  try {
+    execFileSync('codesign', ['--force', '--sign', '-', engine], { stdio: 'ignore' });
+  } catch {}
 }
 fs.rmSync(TMP, { recursive: true, force: true });
 if (fs.existsSync(backup)) fs.rmSync(backup, { recursive: true });

package/scripts/assert-artifact.sh

@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-ROOT="${1:?artifact directory required}"
-SUFFIX=""
-test -f "$ROOT/bin/capix-code.exe" && SUFFIX=".exe"
-required=(
-  "bin/capix-code$SUFFIX"
-  "engine/capix-engine$SUFFIX"
-  runtime/src/plugin.ts
-  runtime/src/native-bridge.ts
-  runtime/src/broker.ts
-  runtime/src/sandbox.ts
-  runtime/src/capix-provider.ts
-  runtime/src/ai-sdk-provider.ts
-  runtime/packages/runtime-provider/package.json
-  runtime/node_modules/@capix/runtime-provider/package.json
-  config/capix-defaults.json
-  config/defaults.json
-  mcp/capix-mcp.js
-)
-for path in "${required[@]}"; do
-  test -e "$ROOT/$path" || { echo "✗ artifact missing $path"; exit 1; }
-done
-test -x "$ROOT/engine/capix-engine$SUFFIX" || { echo "✗ bundled engine is not executable"; exit 1; }
-test -x "$ROOT/bin/capix-code$SUFFIX" || { echo "✗ native launcher is not executable"; exit 1; }
-grep -q '"name": "@capix/runtime-provider"' "$ROOT/runtime/packages/runtime-provider/package.json"
-grep -q '"model": "{env:CAPIX_MODEL:capix/auto}"' "$ROOT/config/defaults.json"
-grep -q 'SuperGemma' "$ROOT/config/defaults.json"
-grep -q '/oauth/authorize' "$ROOT/runtime/src/broker.ts"
-grep -q '/oauth/token' "$ROOT/runtime/src/broker.ts"
-echo "✓ artifact contains pinned engine, plugin, broker, sandbox and runtime provider"

package/scripts/assert-customer-brand.sh

@@ -1,54 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-ROOT="${1:?artifact directory required}"
-FORBIDDEN='opencode|vast|hetzner|void|vscode'
-
-if find "$ROOT" -path "$ROOT/runtime/node_modules" -prune -o -type f -print | sed "s|$ROOT/||" | grep -Eiq "$FORBIDDEN"; then
-  echo "✗ customer artifact contains a forbidden filename"
-  exit 1
-fi
-
-for command in "--help" "--version" "doctor"; do
-  output="$($ROOT/bin/capix-code $command 2>&1)"
-  if printf '%s' "$output" | grep -Eiq "$FORBIDDEN"; then
-    echo "✗ forbidden customer-visible brand in: capix-code $command"
-    exit 1
-  fi
-done
-
-# The embedded engine is not invoked directly by customers, but every help
-# surface it can render through the launcher must still be Capix-only.
-for args in "--help" "run --help"; do
-  output="$($ROOT/engine/capix-engine $args 2>&1)"
-  if printf '%s' "$output" | grep -Eiq "$FORBIDDEN"; then
-    echo "✗ forbidden predecessor brand in embedded engine output: $args"
-    exit 1
-  fi
-done
-
-# Native account commands must never fall through to the bundled engine's
-# command parser. An unsigned CI artifact has no user keychain credential, so
-# the expected result is a clean Capix-only sign-in instruction.
-set +e
-status_output="$($ROOT/bin/capix-code status 2>&1)"
-status_code=$?
-set -e
-if [ "$status_code" -eq 0 ]; then
-  # A developer machine may already have a valid native keychain session.
-  printf '%s' "$status_output" | grep -Fq '"accountId"' || {
-    echo "✗ authenticated status did not return canonical Capix account data"; exit 1;
-  }
-else
-  printf '%s' "$status_output" | grep -Fq 'capix-code login' || {
-    echo "✗ status did not return the native Capix authentication instruction"; exit 1;
-  }
-fi
-if printf '%s' "$status_output" | grep -Eiq "$FORBIDDEN"; then
-  echo "✗ status leaked a forbidden inherited brand"; exit 1
-fi
-
-if grep -ERiq "$FORBIDDEN" "$ROOT/config"; then
-  echo "✗ forbidden customer-visible brand in configuration"
-  exit 1
-fi
-echo "✓ customer-visible artifact surfaces use Capix branding only"

package/scripts/assert-upstream-brand.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-ROOT="${1:?prepared engine source required}"
-# Internal import/package symbols intentionally retain their upstream ABI.
-# This expression targets customer-readable identity and command prose only.
-FORBIDDEN='OpenCode|OC \||run opencode|close opencode|Starting opencode|opencode -s|opencode (models|auth|does|version|server|with|to|upgrade|mcp|session)|Thank you[^\n]*opencode'
-SURFACES=(
-  packages/tui/src/logo.ts
-  packages/tui/src/app.tsx
-  packages/tui/src/util/presentation.ts
-  packages/capix-code/src/cli/ui.ts
-  packages/capix-code/src/index.ts
-  packages/capix-code/src/cli/error.ts
-  packages/capix-code/src/cli/cmd/run.ts
-  packages/capix-code/src/cli/cmd/run/splash.ts
-  packages/capix-code/src/cli/cmd/run/footer.permission.tsx
-  packages/capix-code/src/cli/cmd/run/footer.prompt.tsx
-  packages/capix-code/src/cli/cmd/run/permission.shared.ts
-  packages/capix-code/src/provider/error.ts
-  packages/capix-code/src/cli/cmd/attach.ts
-  packages/capix-code/src/cli/cmd/upgrade.ts
-  packages/capix-code/src/cli/cmd/uninstall.ts
-  packages/capix-code/src/cli/cmd/serve.ts
-  packages/capix-code/src/cli/cmd/web.ts
-  packages/capix-code/src/cli/cmd/pr.ts
-  packages/capix-code/src/cli/cmd/tui.ts
-  packages/capix-code/src/cli/network.ts
-)
-for file in "${SURFACES[@]}"; do
-  test -f "$ROOT/$file" || { echo "✗ missing customer presentation source: $file"; exit 1; }
-  if grep -Eq "$FORBIDDEN" "$ROOT/$file"; then
-    echo "✗ predecessor branding remains in customer presentation source: $file"
-    grep -En "$FORBIDDEN" "$ROOT/$file" | head -n 10
-    exit 1
-  fi
-done
-grep -Fq 'CAPIX CODE' "$ROOT/packages/capix-code/src/cli/ui.ts" || {
-  echo "✗ Capix Code startup wordmark is missing"
-  exit 1
-}
-grep -Fq 'export const identity' "$ROOT/packages/tui/src/logo.ts" &&
-  grep -Fq 'CAPIX CODE' "$ROOT/packages/tui/src/logo.ts" || {
-  echo "✗ Capix Code TUI identity is missing"
-  exit 1
-}
-echo "✓ prepared engine customer presentation sources are Capix-only"

package/scripts/bootstrap.sh

@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-# bootstrap.sh — clone upstream source and prepare capix-code.
-set -euo pipefail
-
-DIR="$(cd "$(dirname "$0")/.." && pwd)"
-CAPIX_CODE_DIR="${CAPIX_CODE_DIR:-$DIR/upstream}"
-
-# TODO: Update this SHA when upgrading upstream
-CAPIX_CODE_REF="${CAPIX_CODE_REF:-9976269ab1accfc9f9dc98a4a688c516934de422}"
-
-if [ -d "$CAPIX_CODE_DIR/.git" ]; then
-  echo "✓ $CAPIX_CODE_DIR already cloned."
-else
-  echo "▸ Cloning upstream source into $CAPIX_CODE_DIR (SHA: $CAPIX_CODE_REF)…"
-  git clone https://github.com/anomalyco/opencode.git "$CAPIX_CODE_DIR"
-  git -C "$CAPIX_CODE_DIR" checkout "$CAPIX_CODE_REF"
-fi
-
-ACTUAL_REF="$(git -C "$CAPIX_CODE_DIR" rev-parse HEAD)"
-if [ "$ACTUAL_REF" != "$CAPIX_CODE_REF" ]; then
-  echo "✗ Source checkout is at $ACTUAL_REF; expected pinned ref $CAPIX_CODE_REF"
-  echo "  Use a new CAPIX_CODE_DIR or restore the pinned checkout before continuing."
-  exit 1
-fi
-
-# A prepared checkout is intentionally changed by scripts/rebrand.sh. Treat the
-# expected renamed package as an idempotent success, while still rejecting an
-# unrelated dirty checkout before the first rebrand.
-if [ -d "$CAPIX_CODE_DIR/packages/capix-code" ]; then
-  echo "✓ Pinned Capix Code source already prepared: $ACTUAL_REF"
-  exit 0
-fi
-
-git -C "$CAPIX_CODE_DIR" diff --quiet || {
-  echo "✗ Source tree has unstaged changes before Capix preparation"
-  exit 1
-}
-echo "✓ Pinned source ready: $ACTUAL_REF"

package/scripts/build-manifest.mjs

@@ -1,219 +0,0 @@
-/**
- * Build (materialize) manifest/release-manifest.json from real per-platform
- * release entries produced by write-release-entry.mjs.
- *
- * A publishable manifest is assembled ONLY from real artifact metadata — it
- * never copies through TEMPLATE placeholders. If a required platform entry is
- * missing or carries invalid metadata, the build fails closed.
- *
- * Usage:
- *   node scripts/build-manifest.mjs \
- *     --entries release-artifacts \
- *     --base-url https://github.com/CapIX-Protocol/Capix-Code/releases/download \
- *     --stable-version v1.2.4 \
- *     --source-sha <40-hex> \
- *     --launcher-version 1.2.4 --opencode-version 1.17.18 \
- *     --plugin-version 1.2.4 --provider-version 1.2.4 \
- *     [--out manifest/release-manifest.json] [--require-all]
- *
- * The stable version is the single source of truth consumed by the installer's
- * `latest` resolver and by validate-manifest.
- */
-import { readdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { basename, join, resolve } from 'node:path';
-import { pathToFileURL } from 'node:url';
-
-const REQUIRED_PLATFORMS = ['darwin-arm64', 'darwin-x64', 'linux-arm64', 'linux-x64', 'win32-x64'];
-const SEMVER_TAG = /^v\d+\.\d+\.\d+$/;
-const SHA1 = /^[0-9a-f]{40}$/;
-const SHA256 = /^[0-9a-f]{64}$/;
-const SEMVER = /^\d+\.\d+\.\d+$/;
-
-function parseArgs(argv) {
-  const args = {
-    entries: 'release-artifacts',
-    out: 'manifest/release-manifest.json',
-    requireAll: false,
-  };
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    switch (a) {
-      case '--entries':
-        args.entries = argv[++i];
-        break;
-      case '--base-url':
-        args.baseUrl = argv[++i];
-        break;
-      case '--stable-version':
-        args.stableVersion = argv[++i];
-        break;
-      case '--source-sha':
-        args.sourceSha = argv[++i];
-        break;
-      case '--launcher-version':
-        args.launcherVersion = argv[++i];
-        break;
-      case '--opencode-version':
-        args.opencodeVersion = argv[++i];
-        break;
-      case '--plugin-version':
-        args.pluginVersion = argv[++i];
-        break;
-      case '--provider-version':
-        args.providerVersion = argv[++i];
-        break;
-      case '--out':
-        args.out = argv[++i];
-        break;
-      case '--require-all':
-        args.requireAll = true;
-        break;
-      default:
-        throw new Error(`unknown argument: ${a}`);
-    }
-  }
-  return args;
-}
-
-function requireArg(args, name) {
-  const v = args[name];
-  if (!v)
-    throw new Error(
-      `${name} is required (pass --${name.replace(/([A-Z])/g, '-$1').toLowerCase()})`
-    );
-  return v;
-}
-
-/** Read every capix-code-*-{platform}-{arch}.release.json in the entries dir. */
-export function readReleaseEntries(entriesDir) {
-  const files = readdirSync(entriesDir).filter((f) => /\.release\.json$/i.test(f));
-  const entries = new Map();
-  for (const f of files) {
-    let parsed;
-    try {
-      parsed = JSON.parse(readFileSync(join(entriesDir, f), 'utf8'));
-    } catch (err) {
-      throw new Error(`cannot parse ${f}: ${err.message}`);
-    }
-    if (parsed.product !== 'capix-code') throw new Error(`${f}: product is not capix-code`);
-    const platform = parsed.platform;
-    if (!platform || !REQUIRED_PLATFORMS.includes(platform)) {
-      throw new Error(`${f}: unrecognized platform "${platform}"`);
-    }
-    if (entries.has(platform))
-      throw new Error(`duplicate release entry for platform ${platform} (${f})`);
-    entries.set(platform, parsed);
-  }
-  return entries;
-}
-
-/**
- * Build the manifest object from a map of platform -> release entry.
- * Pure function — testable without touching the filesystem.
- */
-export function buildManifestFromEntries(entries, opts) {
-  const {
-    baseUrl,
-    stableVersion,
-    sourceSha,
-    launcherVersion,
-    opencodeVersion,
-    pluginVersion,
-    providerVersion,
-  } = opts;
-  const errors = [];
-  if (!SEMVER_TAG.test(stableVersion ?? ''))
-    errors.push('--stable-version must be vMAJOR.MINOR.PATCH');
-  if (!SHA1.test(sourceSha ?? ''))
-    errors.push('--source-sha must be a 40-character lowercase hex commit SHA');
-  for (const [name, v] of [
-    ['launcher', launcherVersion],
-    ['opencode', opencodeVersion],
-    ['plugin', pluginVersion],
-    ['provider', providerVersion],
-  ]) {
-    if (!SEMVER.test(v ?? '')) errors.push(`--${name}-version must be MAJOR.MINOR.PATCH`);
-  }
-  if (!baseUrl || !/^https:\/\//.test(baseUrl)) errors.push('--base-url must be an https URL');
-
-  const present = [...entries.keys()];
-  if (opts.requireAll) {
-    for (const p of REQUIRED_PLATFORMS)
-      if (!entries.has(p)) errors.push(`missing required platform entry: ${p}`);
-  }
-  if (errors.length) throw new Error(errors.join('; '));
-
-  const platforms = {};
-  for (const p of REQUIRED_PLATFORMS) {
-    const e = entries.get(p);
-    if (!e) continue; // when not --require-all, only publish what exists
-    if (!SHA256.test(e.sha256 ?? ''))
-      throw new Error(`${p}: release entry sha256 is not a valid 64-hex digest`);
-    if (typeof e.sizeBytes !== 'number' || e.sizeBytes <= 0)
-      throw new Error(`${p}: release entry sizeBytes must be positive`);
-    const tag = stableVersion;
-    platforms[p] = {
-      url: `${baseUrl}/${tag}/${e.artifact}`,
-      sha256: e.sha256,
-      // Unsigned artifacts ship a null signatureUrl; strict signing is a
-      // separate, later gate. Never TEMPLATE.
-      signatureUrl: e.signed ? `${baseUrl}/${tag}/${e.artifact}.sig` : null,
-      sizeBytes: e.sizeBytes,
-    };
-  }
-
-  const createdAt = process.env.SOURCE_DATE_EPOCH
-    ? new Date(Number(process.env.SOURCE_DATE_EPOCH) * 1000).toISOString()
-    : new Date().toISOString();
-
-  return {
-    id: `rel_capix_code_${stableVersion.slice(1).replace(/\./g, '_')}`,
-    schemaVersion: 1,
-    stableVersion,
-    createdAt,
-    createdBy: 'release-engineering',
-    immutable: true,
-    launcher: { sourceSha, version: launcherVersion },
-    opencode: { sourceSha, version: opencodeVersion },
-    plugin: { sourceSha, version: pluginVersion },
-    provider: { sourceSha, version: providerVersion },
-    acpVersion: '1',
-    ipcVersion: '1',
-    apiRange: { min: 'v1', max: 'v1' },
-    platforms,
-    sbomRef: `${baseUrl}/${stableVersion}/sbom.spdx.json`,
-    provenanceRef: `${baseUrl}/${stableVersion}/provenance.json`,
-    signatureRef: null,
-    thirdPartyNoticesRef: `${baseUrl}/${stableVersion}/NOTICE`,
-    rollbackConstraints: ['retain-n-1'],
-    publishedPlatforms: present,
-  };
-}
-
-function main() {
-  const args = parseArgs(process.argv.slice(2));
-  const entries = readReleaseEntries(args.entries);
-  const manifest = buildManifestFromEntries(entries, {
-    baseUrl: requireArg(args, 'baseUrl'),
-    stableVersion: requireArg(args, 'stableVersion'),
-    sourceSha: requireArg(args, 'sourceSha'),
-    launcherVersion: requireArg(args, 'launcherVersion'),
-    opencodeVersion: requireArg(args, 'opencodeVersion'),
-    pluginVersion: requireArg(args, 'pluginVersion'),
-    providerVersion: requireArg(args, 'providerVersion'),
-    requireAll: args.requireAll,
-  });
-  writeFileSync(args.out, `${JSON.stringify(manifest, null, 2)}\n`);
-  console.log(
-    `✓ wrote ${args.out} (stable=${manifest.stableVersion}, platforms=${Object.keys(manifest.platforms).join(',')})`
-  );
-}
-
-if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
-  try {
-    main();
-  } catch (err) {
-    console.error(`✗ ${err.message}`);
-    process.exit(1);
-  }
-}