carthagent 1.0.7 → 1.1.0-beta.1

package/tests/native-fixture-browser-cleanup.test.mjs

@@ -0,0 +1,65 @@
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import test from 'node:test';
+import { stopFixtureBrowser } from '../tools/native-fixture-browser-cleanup.mjs';
+
+test('fixture browser cleanup keeps narrow authority and bounded verification', () => {
+  assert.match(stopFixtureBrowser, /Same-Identity/);
+  assert.match(stopFixtureBrowser, /CreationDate -eq/);
+  assert.match(stopFixtureBrowser, /Contains\(\$env:CTG_NATIVE_FIXTURE_URL\)/);
+  assert.match(stopFixtureBrowser, /taskkill.exe \/PID \$root.ProcessId \/T \/F/);
+  assert.match(stopFixtureBrowser, /AddSeconds\(5\)/);
+  assert.doesNotMatch(stopFixtureBrowser, /catch\s*\{/);
+});
+
+// Execute the production PowerShell with synthetic CIM snapshots and a mocked
+// taskkill command. No browser is launched and no real process can be killed.
+async function scenario(mode) {
+  const harness = `
+    $env:CTG_NATIVE_FIXTURE_URL = 'http://127.0.0.1:1234/verify-test'
+    $script:reads = 0
+    $script:kills = 0
+    $root = [pscustomobject]@{ ProcessId = 10; ParentProcessId = 1; CreationDate = [datetime]'2026-01-01'; Name = 'msedge.exe'; CommandLine = $env:CTG_NATIVE_FIXTURE_URL }
+    $child = [pscustomobject]@{ ProcessId = 11; ParentProcessId = 10; CreationDate = [datetime]'2026-01-02'; Name = 'msedge.exe'; CommandLine = '--child' }
+    $grandchild = [pscustomobject]@{ ProcessId = 12; ParentProcessId = 11; CreationDate = [datetime]'2026-01-03'; Name = 'msedge.exe'; CommandLine = '--grandchild' }
+    function Get-CimInstance {
+      $script:reads++
+      if ($script:reads -eq 1) { return @($grandchild, $child, $root) }
+      if ('${mode}' -eq 'already-exited') { return @() }
+      if ('${mode}' -eq 'pid-reused') {
+        return [pscustomobject]@{ ProcessId = 10; ParentProcessId = 1; CreationDate = [datetime]'2026-02-01'; Name = 'msedge.exe'; CommandLine = $env:CTG_NATIVE_FIXTURE_URL }
+      }
+      if ($script:reads -eq 2) { return @($root, $child, $grandchild) }
+      if ('${mode}' -eq 'live-child') { return @($grandchild) }
+      return @()
+    }
+    function taskkill.exe {
+      if (($args -join ' ') -ne '/PID 10 /T /F') { throw 'Unexpected kill target' }
+      $script:kills++
+      $global:LASTEXITCODE = 1
+      'simulated unsupported child termination'
+    }
+    ${stopFixtureBrowser}
+    Write-Output "kills=$script:kills"
+  `;
+  return promisify(execFile)('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', harness], { timeout: 20_000, windowsHide: true });
+}
+
+const windows = { skip: process.platform !== 'win32' };
+test('partial taskkill error succeeds only after all captured identities disappear', windows, async () => {
+  assert.match((await scenario('all-gone')).stdout, /kills=1/);
+});
+test('partial taskkill error fails with diagnostics for a surviving transitive child', windows, async () => {
+  await assert.rejects(scenario('live-child'), error => {
+    assert.match(error.stderr, /identities still alive: 12/);
+    assert.match(error.stderr, /taskkill exit 1/);
+    assert.match(error.stderr, /simulated unsupported child termination/);
+    return true;
+  });
+});
+for (const mode of ['already-exited', 'pid-reused']) {
+  test(`${mode} snapshot root is never targeted`, windows, async () => {
+    assert.match((await scenario(mode)).stdout, /kills=0/);
+  });
+}

package/tests/native-fixture-runtime.test.mjs

@@ -0,0 +1,111 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { chmod, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { resolveFixtureRuntime } from '../tools/native-fixture.mjs';
+
+test('owned staging hash mismatch is rejected before product resolver can execute --version', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ctg-fixture-runtime-'));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const platform = `${process.platform === 'win32' ? 'windows' : process.platform}-${process.arch}`;
+  const ownedRoot = join(root, 'owned');
+  const binary = join(ownedRoot, `cli-${platform}`, 'bin', process.platform === 'win32' ? 'opencode.exe' : 'opencode');
+  const marker = join(root, 'version-executed');
+  await mkdir(join(ownedRoot, `cli-${platform}`, 'bin'), { recursive: true });
+  await writeFile(binary, `#!/bin/sh\nprintf 'opencode v0.0.0-ctg.2.0.32\\n'\nprintf ran > '${marker}'\n`);
+  if (process.platform !== 'win32') await chmod(binary, 0o755);
+  const digest = createHash('sha256').update(await (await import('node:fs/promises')).readFile(binary)).digest('hex');
+  const releasePath = join(root, 'lib/opencode/runtime-release.json');
+  await mkdir(join(root, 'lib/opencode'), { recursive: true });
+  await writeFile(releasePath, JSON.stringify({
+    version: 1,
+    releaseVersion: '1.2.3',
+    compatibilityVersion: '2.0.32',
+    runtimeVersion: '0.0.0-ctg.2.0.32',
+    sourceRevision: '843a6c514e606b436a7fe713422ace0a93ad3d61',
+    patchSha256: 'b'.repeat(64),
+    lockSha256: 'c'.repeat(64),
+    assets: { [platform]: {
+      name: `opencode-${platform}.tar.gz`, archiveSha256: 'd'.repeat(64),
+      executableSha256: digest === 'a'.repeat(64) ? 'b'.repeat(64) : 'a'.repeat(64),
+    } },
+  }));
+  let productResolverCalled = false;
+  await assert.rejects(resolveFixtureRuntime({
+    packageRoot: root,
+    env: { CTG_OWNED_OPENCODE_RUNTIME: ownedRoot },
+    productRuntime: {
+      async resolveOpenCode() { productResolverCalled = true; throw Error('resolver should not be reached'); },
+      async runtimeIdentity() { throw Error('identity should not be reached'); },
+    },
+  }), /binary SHA-256 mismatch/);
+  assert.equal(productResolverCalled, false);
+  await assert.rejects(import('node:fs/promises').then(fs => fs.access(marker)), { code: 'ENOENT' });
+});
+
+test('product runtime selection is reverified by the trusted helper and preserves separate versions', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ctg-fixture-runtime-selected-'));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const platform = `${process.platform === 'win32' ? 'windows' : process.platform}-${process.arch}`;
+  const ownedRoot = join(root, 'owned');
+  const binary = join(ownedRoot, `cli-${platform}`, 'bin', process.platform === 'win32' ? 'opencode.exe' : 'opencode');
+  await mkdir(join(ownedRoot, `cli-${platform}`, 'bin'), { recursive: true });
+  await writeFile(binary, 'already resolver-verified fixture bytes');
+  const expectedManifest = { trusted: true };
+  const releasePath = join(root, 'release.json');
+  await writeFile(releasePath, JSON.stringify(expectedManifest));
+  const options = { sentinel: Symbol('same-options-object') };
+  const calls = [];
+  const env = {
+    CTG_OWNED_OPENCODE_RUNTIME: ownedRoot,
+    CTG_TEST_RUNTIME_RELEASE_MANIFEST: releasePath,
+    CTG_TEST_RUNTIME_SHA256: 'e'.repeat(64),
+  };
+  const verified = {
+    binary,
+    compatibilityVersion: '2.0.32',
+    runtimeVersion: '0.0.0-ctg.2.0.32',
+    binarySha256: 'f'.repeat(64),
+    sourceRevision: '843a6c514e606b436a7fe713422ace0a93ad3d61',
+    patchSha256: 'b'.repeat(64),
+    lockSha256: 'c'.repeat(64),
+    platform,
+  };
+  let resolverCalled = false;
+  const result = await resolveFixtureRuntime({
+    packageRoot: root,
+    env,
+    options,
+    productRuntime: {
+      async resolveOpenCode(received) {
+        resolverCalled = true;
+        assert.equal(received, options);
+        return binary;
+      },
+      async runtimeIdentity(receivedBinary, received) {
+        assert.equal(receivedBinary, binary);
+        assert.equal(received, options);
+        return {
+          kind: 'ctg-owned', binaryPath: binary, binarySha256: verified.binarySha256,
+          version: verified.runtimeVersion, sourceRevision: verified.sourceRevision,
+          patchSha256: verified.patchSha256, lockSha256: verified.lockSha256,
+        };
+      },
+    },
+    testRuntimeLoader: async input => {
+      calls.push(input);
+      return verified;
+    },
+  });
+  assert.equal(resolverCalled, true);
+  assert.equal(calls.length, 2, 'preflight selected staging bytes and reverify selected product identity');
+  assert.equal(calls[0].env.CTG_TEST_RUNTIME_SHA256, 'e'.repeat(64));
+  assert.deepEqual(calls[0].expectedManifest, expectedManifest);
+  assert.equal(result.binary, binary);
+  assert.equal(result.runtimeIdentity.compatibilityVersion, '2.0.32');
+  assert.equal(result.runtimeIdentity.runtimeVersion, '0.0.0-ctg.2.0.32');
+  assert.equal(result.runtimeIdentity.binarySha256, verified.binarySha256);
+  assert.equal(result.runtimeIdentity.kind, 'ctg-owned');
+});

package/tests/native-fixture-stop-diagnostics.test.mjs

@@ -0,0 +1,67 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { fixtureStopDiagnostics, sanitizedNativeOutputTail } from '../tools/native-fixture-stop-diagnostics.mjs';
+
+const child = { pid: 21359, exitCode: null, signalCode: null, killed: false };
+const input = { child, output: 'INFO stopping\nERROR shutdown timeout', elapsedMs: 5001.4 };
+
+test('native output tail is bounded and emits only fixed metadata, never raw secrets', () => {
+  const secrets = ['0123456789abcdef', 'Basic b3BlbmNvZGU6c2VjcmV0', 'Bearer fixture.token.fixture', 'offline-refresh', 'verify-secret', 'unknown-unlabelled-secret'];
+  const output = `${'DEBUG old\n'.repeat(3000)}${secrets.map(secret => `ERROR shutdown authorization password=${secret}`).join('\n')}`;
+  const tail = sanitizedNativeOutputTail(output);
+  assert.equal(tail.length, 20);
+  const serialized = JSON.stringify(tail);
+  for (const secret of secrets) assert.ok(!serialized.includes(secret));
+  assert.deepEqual(tail.at(-1), { level: 'ERROR', markers: ['shutdown', 'error'] });
+  assert.ok(serialized.length < 4096);
+});
+
+test('failure evidence snapshots child state and queries only exact PID without argv or environment', async () => {
+  const evidence = await fixtureStopDiagnostics(input, { platform: 'darwin', run: async (command, args, options) => {
+    assert.equal(command, 'ps');
+    assert.deepEqual(args, ['-p', '21359', '-o', 'pid=,ppid=,stat=,etime=,time=']);
+    assert.deepEqual(options, { timeout: 2000, maxBuffer: 4096, windowsHide: true });
+    child.exitCode = 0;
+    return { stdout: ' 21359 123 Z+ 00:05 0:00.01\n' };
+  } });
+  child.exitCode = null;
+  assert.equal(evidence.elapsedMs, 5001);
+  assert.equal(evidence.child.exitCode, null);
+  assert.deepEqual(evidence.processState, { status: 'observed', state: '21359 123 Z+ 00:05 0:00.01' });
+});
+
+test('query errors and unexpected output cannot leak command output or secrets', async () => {
+  for (const run of [
+    async () => ({ stdout: 'password=secret' }),
+    async () => { throw Object.assign(new Error('secret'), { stderr: 'Bearer secret', code: 1 }); },
+    async () => { throw Object.assign(new Error('secret'), { code: 'ENOENT', killed: true }); },
+  ]) {
+    const evidence = await fixtureStopDiagnostics(input, { run });
+    assert.ok(!JSON.stringify(evidence).includes('secret'));
+    assert.ok(['unrecognized-output', 'query-failed'].includes(evidence.processState.status));
+  }
+});
+
+test('Windows queries exact PID and accepts only fixed boolean state', async () => {
+  const evidence = await fixtureStopDiagnostics(input, { platform: 'win32', run: async (command, args) => {
+    assert.equal(command, 'powershell.exe');
+    assert.match(args.at(-1), /Get-Process -Id 21359 /);
+    assert.doesNotMatch(args.at(-1), /CommandLine|Environment/);
+    return { stdout: 'pid=21359 responding=True\r\n' };
+  } });
+  assert.equal(evidence.processState.status, 'observed');
+});
+
+test('missing PID skips OS query, empty result records absence, exited child state is retained', async () => {
+  const missing = await fixtureStopDiagnostics({ ...input, child: { ...child, pid: undefined } }, { run: () => assert.fail('must not run') });
+  assert.equal(missing.processState.status, 'no-child-pid');
+  const exited = await fixtureStopDiagnostics({ ...input, child: { ...child, signalCode: 'SIGTERM' } }, { run: async () => ({ stdout: '' }) });
+  assert.equal(exited.child.signalCode, 'SIGTERM');
+  assert.equal(exited.processState.status, 'not-found');
+});
+
+test('real read-only process query observes this exact test process', async () => {
+  const evidence = await fixtureStopDiagnostics({ ...input, child: { ...child, pid: process.pid } });
+  assert.equal(evidence.processState.status, 'observed');
+  assert.match(evidence.processState.state, new RegExp(`^(?:pid=)?${process.pid}\\s`));
+});

package/tests/native-glyph-pty.test.mjs

@@ -0,0 +1,107 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { delimiter, dirname, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+const helpers = join(root, 'tools/native-glyph-helpers.py');
+const candidates = [
+  process.env.PYTHON,
+  join(root, '.venv', process.platform === 'win32' ? 'Scripts/python.exe' : 'bin/python'),
+  process.platform === 'win32' ? 'python.exe' : 'python3',
+  'python',
+].filter(Boolean);
+const resolveExecutable = candidate => {
+  if (existsSync(candidate)) return candidate;
+  for (const directory of (process.env.PATH || '').split(delimiter)) {
+    const path = join(directory, candidate);
+    if (existsSync(path)) return path;
+  }
+  return null;
+};
+const python = candidates.map(resolveExecutable).find(Boolean);
+const skipPython = python ? false : 'Python was not found; set PYTHON to an interpreter path';
+
+test('glyph child environment does not inherit the draft-runtime release token', { skip: skipPython }, () => {
+  const result = spawnSync(python, ['-c', `import importlib.util, pathlib
+spec=importlib.util.spec_from_file_location('helpers', ${JSON.stringify(helpers)})
+module=importlib.util.module_from_spec(spec); spec.loader.exec_module(module)
+root=pathlib.Path('/tmp/isolated')
+env=module.child_environment(root, root/'config', 'ascii', {'PATH':'/bin', 'CTG_RUNTIME_GITHUB_TOKEN':'sentinel'})
+assert 'CTG_RUNTIME_GITHUB_TOKEN' not in env
+assert env['CTG_TUI_GLYPHS']=='ascii'
+assert env['HOME']==str(root/'home')
+print('PASS')`], { encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /PASS/);
+});
+
+test('composer assertion requires the exact ordered Unicode payload on its rendered row', { skip: skipPython }, () => {
+  const result = spawnSync(python, ['-c', `import importlib.util
+spec=importlib.util.spec_from_file_location('helpers', ${JSON.stringify(helpers)})
+module=importlib.util.module_from_spec(spec); spec.loader.exec_module(module)
+expected=module.USER_TEXT
+assert module.assert_composer_payload('logo █▀▀ OpenCode\\n┃  '+expected+'\\n')
+mutants=[
+  'logo '+expected+'\\n┃  CTG_GLYPH_PAYLOAD 漢字 café → • −',
+  'logo '+expected+'\\n┃  '+expected.replace('漢','?'),
+  'logo '+expected+'\\n┃  '+expected.replace('→ •','• →'),
+  'logo '+expected+'\\n┃  '+expected.replace('café','cafe'),
+]
+for screen in mutants:
+  try: module.assert_composer_payload(screen)
+  except AssertionError: pass
+  else: raise AssertionError('mutated composer unexpectedly passed')
+print('PASS')`], { encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /PASS/);
+});
+
+test('glyph screen tracks CJK wide cells and combining marks without losing exact composer text', { skip: skipPython }, () => {
+  const result = spawnSync(python, ['-c', `import importlib.util
+spec=importlib.util.spec_from_file_location('helpers', ${JSON.stringify(helpers)})
+module=importlib.util.module_from_spec(spec); spec.loader.exec_module(module)
+screen=module.GlyphScreen(rows=3, columns=50)
+text=module.USER_TEXT
+screen.feed(('\\x1b[1;1H┃  '+text).encode())
+row=screen.visible().splitlines()[0]
+assert text in row, repr(row)
+assert screen.x == 3 + sum(module.GlyphScreen.char_width(ch) for ch in text)
+assert module.GlyphScreen.char_width('漢') == 2
+assert module.GlyphScreen.char_width('\\u0301') == 0
+print('PASS')`], { encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /PASS/);
+});
+
+test('native glyph PTY entrypoint imports its hyphenated sibling helper', {
+  skip: skipPython || (process.platform === 'win32' ? 'The PTY entrypoint depends on Unix fcntl; portable helper contracts are tested above' : false),
+}, () => {
+  const result = spawnSync(python, ['-c', `import importlib.util, pathlib
+entry=pathlib.Path(${JSON.stringify(join(root, 'tools/native-glyph-pty.py'))})
+spec=importlib.util.spec_from_file_location('native_glyph_pty_entry', entry)
+module=importlib.util.module_from_spec(spec); spec.loader.exec_module(module)
+assert module.USER_TEXT == 'CTG_GLYPH_PAYLOAD 漢字 café → • − …'
+assert module.GlyphScreen.char_width('漢') == 2
+assert callable(module.assert_composer_payload)
+print('PASS')`], { encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /PASS/);
+});
+
+
+test('glyph screen records fragmented OSC titles for final-binary branding assertions', { skip: skipPython }, () => {
+  const result = spawnSync(python, ['-c', `import importlib.util
+spec=importlib.util.spec_from_file_location('helpers', ${JSON.stringify(helpers)})
+module=importlib.util.module_from_spec(spec); spec.loader.exec_module(module)
+screen=module.GlyphScreen()
+for chunk in [b'\\x1b]2;Cart', b'hagent\\x07', b'\\x1b]0;CTG | Ship\\x1b', b'\\\\']:
+  screen.feed(chunk)
+assert screen.title_updates == ['Carthagent', 'CTG | Ship'], screen.title_updates
+assert screen.visible().strip() == ''
+print('PASS')`], { encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /PASS/);
+});

package/tests/native-manual-projects.test.mjs

@@ -0,0 +1,170 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { CTG_RUNTIME_SOURCE, CTG_RUNTIME_PATCH_SHA256, CTG_RUNTIME_LOCK_SHA256 } from '../lib/opencode/runtime.mjs';
+import { createManualProjects } from '../tools/native-manual-projects.mjs';
+import { readManualRuntimeManifest } from '../tools/manual-runtime-manifest.mjs';
+import { readRuntimeReleaseManifest } from '../lib/opencode/runtime.mjs';
+import { prepareManualKit } from '../tools/prepare-native-manual.mjs';
+
+test('manual fixtures have green baselines, red feature acceptance, clean git, and no dependencies', async (t) => {
+  const temp = await mkdtemp(join(tmpdir(), 'ctg-manual-projects-'));
+  t.after(() => rm(temp, { recursive: true, force: true }));
+  const result = await createManualProjects(join(temp, 'projects'), {
+    packages: 3,
+  });
+  const env = { ...process.env };
+  delete env.NODE_TEST_CONTEXT;
+  for (const name of ['tiny', 'product', 'scale']) {
+    const cwd = join(result.root, name);
+    const manifest = JSON.parse(
+      await readFile(join(cwd, 'package.json'), 'utf8'),
+    );
+    assert.equal(manifest.dependencies, undefined);
+    const baseline = spawnSync(
+      process.execPath,
+      ['--test', 'test/*.test.mjs'],
+      { cwd, env, encoding: 'utf8' },
+    );
+    assert.equal(baseline.status, 0, baseline.stdout + baseline.stderr);
+    const acceptance = spawnSync(
+      process.execPath,
+      ['--test', 'acceptance/*.test.mjs'],
+      { cwd, env, encoding: 'utf8' },
+    );
+    assert.equal(
+      acceptance.status,
+      1,
+      'new-feature acceptance must fail against the baseline',
+    );
+    const status = spawnSync('git', ['status', '--porcelain'], {
+      cwd,
+      encoding: 'utf8',
+    });
+    assert.equal(status.status, 0, status.stderr);
+    assert.equal(status.stdout, '');
+    assert.ok(result.projects[name].files > 3);
+  }
+  const sentinel = join(result.root, 'keep.txt');
+  await writeFile(sentinel, 'keep');
+  await assert.rejects(createManualProjects(result.root), { code: 'EEXIST' });
+  assert.equal(await readFile(sentinel, 'utf8'), 'keep');
+  await assert.rejects(
+    createManualProjects(join(temp, 'invalid'), { packages: 0 }),
+    /integer from 2 to 1024/,
+  );
+});
+
+test('manual kit preparation refuses existing directories and removes only its own failed staging', async (t) => {
+  const temp = await mkdtemp(join(tmpdir(), 'ctg-manual-kit-safety-'));
+  t.after(() => rm(temp, { recursive: true, force: true }));
+  const sentinel = join(temp, 'keep.txt');
+  await writeFile(sentinel, 'keep');
+  await assert.rejects(prepareManualKit(temp, { assetsDirectory: temp }), {
+    code: 'EEXIST',
+  });
+  assert.equal(await readFile(sentinel, 'utf8'), 'keep');
+  const runtimeManifest = join(temp, 'runtime-release.json');
+  const manifest = JSON.parse(await readFile(new URL('../lib/opencode/runtime-release.json', import.meta.url), 'utf8'));
+  manifest.releaseVersion = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8')).version;
+  Object.assign(manifest, { sourceRevision: CTG_RUNTIME_SOURCE, patchSha256: CTG_RUNTIME_PATCH_SHA256, lockSha256: CTG_RUNTIME_LOCK_SHA256 });
+  const target = `${process.platform === 'win32' ? 'windows' : process.platform}-${process.arch}`;
+  manifest.assets = { [target]: manifest.assets[target] };
+  const bytes = JSON.stringify(manifest);
+  await writeFile(runtimeManifest, bytes);
+  const manifestSha256 = createHash('sha256').update(bytes).digest('hex');
+  const missing = join(temp, 'failed-kit');
+  await assert.rejects(
+    prepareManualKit(missing, { assetsDirectory: temp, runtimeManifest, manifestSha256 }),
+    /Could not acquire/,
+  );
+  await assert.rejects(readFile(join(missing, 'manual-kit.json')), {
+    code: 'ENOENT',
+  });
+  assert.equal(await readFile(sentinel, 'utf8'), 'keep');
+  await assert.rejects(
+    prepareManualKit(join(temp, 'invalid'), { packages: 0 }),
+    /integer from 2 to 1024/,
+  );
+});
+
+
+test('packaged manual kits retain published pins after the development recipe advances', async () => {
+  const bytes = await readFile(new URL('../lib/opencode/runtime-release.json', import.meta.url));
+  const published = JSON.parse(bytes);
+  const current = await readManualRuntimeManifest();
+  assert.deepEqual(current.manifest, published);
+  assert.equal(current.manifest.patchSha256, CTG_RUNTIME_PATCH_SHA256);
+  assert.equal(current.manifestSha256, createHash('sha256').update(bytes).digest('hex'));
+  await assert.rejects(readManualRuntimeManifest({ manifestSha256: '0'.repeat(64) }), /checksum mismatch/i);
+});
+
+test('default manual preparation reaches verified acquisition without requiring development provenance', async t => {
+  const temp = await mkdtemp(join(tmpdir(), 'ctg-manual-published-'));
+  t.after(() => rm(temp, { recursive: true, force: true }));
+  const destination = join(temp, 'kit');
+  await assert.rejects(prepareManualKit(destination, { assetsDirectory: temp }), /Could not acquire/);
+  await assert.rejects(readFile(join(destination, 'manual-kit.json')), { code: 'ENOENT' });
+});
+
+test('explicit manual candidates cannot borrow the packaged-release recipe exception', async t => {
+  const temp = await mkdtemp(join(tmpdir(), 'ctg-manual-explicit-release-'));
+  t.after(() => rm(temp, { recursive: true, force: true }));
+  const runtimeManifest = join(temp, 'published-copy.json');
+  const manifest = JSON.parse(await readFile(new URL('../lib/opencode/runtime-release.json', import.meta.url), 'utf8'));
+  manifest.releaseVersion = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8')).version;
+  manifest.patchSha256 = '0'.repeat(64);
+  const bytes = JSON.stringify(manifest);
+  await writeFile(runtimeManifest, bytes);
+  await assert.rejects(readManualRuntimeManifest({ runtimeManifest, manifestSha256: createHash('sha256').update(bytes).digest('hex') }), /patchSha256.*build recipe/i);
+});
+
+test('manual candidate overrides require an independent digest and reject altered or incompatible manifests', async t => {
+  const temp = await mkdtemp(join(tmpdir(), 'ctg-manual-kit-trust-'));
+  t.after(() => rm(temp, { recursive: true, force: true }));
+  const runtimeManifest = join(temp, 'candidate.json');
+  const destination = join(temp, 'kit');
+  await writeFile(runtimeManifest, '{}');
+  await assert.rejects(prepareManualKit(destination, { runtimeManifest }), /manifest.*SHA-256|digest/i);
+  await assert.rejects(prepareManualKit(destination, { runtimeManifest, manifestSha256: '0'.repeat(64) }), /manifest.*SHA-256|checksum|digest/i);
+  const manifestSha256 = createHash('sha256').update('{}').digest('hex');
+  await assert.rejects(prepareManualKit(destination, { runtimeManifest, manifestSha256 }), /incompatible|invalid/i);
+  await assert.rejects(readFile(join(destination, 'manual-kit.json')), { code: 'ENOENT' });
+  await writeFile(runtimeManifest, '{"altered":true}');
+  await assert.rejects(prepareManualKit(destination, { runtimeManifest, manifestSha256 }), /manifest.*SHA-256|checksum|digest/i);
+  await assert.rejects(readFile(join(destination, 'manual-kit.json')), { code: 'ENOENT' });
+});
+
+test('single-platform manual candidates bind current recipe bytes without weakening complete release manifests', async t => {
+  const temp = await mkdtemp(join(tmpdir(), 'ctg-manual-candidate-'));
+  t.after(() => rm(temp, { recursive: true, force: true }));
+  const runtimeManifest = join(temp, 'candidate.json');
+  const manifest = JSON.parse(await readFile(new URL('../lib/opencode/runtime-release.json', import.meta.url), 'utf8'));
+  manifest.releaseVersion = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8')).version;
+  Object.assign(manifest, { sourceRevision: CTG_RUNTIME_SOURCE, patchSha256: CTG_RUNTIME_PATCH_SHA256, lockSha256: CTG_RUNTIME_LOCK_SHA256 });
+  const asset = manifest.assets['linux-x64'];
+  manifest.assets = { 'linux-x64': asset };
+  const save = async () => {
+    const bytes = JSON.stringify(manifest);
+    await writeFile(runtimeManifest, bytes);
+    return { runtimeManifest, manifestSha256: createHash('sha256').update(bytes).digest('hex') };
+  };
+  const current = await readManualRuntimeManifest(await save());
+  assert.deepEqual(Object.keys(current.manifest.assets), ['linux-x64']);
+  await assert.rejects(readRuntimeReleaseManifest(runtimeManifest), /incompatible|invalid/i);
+  for (const field of ['sourceRevision', 'patchSha256', 'lockSha256']) {
+    const original = manifest[field];
+    manifest[field] = '0'.repeat(original.length);
+    await assert.rejects(readManualRuntimeManifest(await save()), /build recipe/i);
+    manifest[field] = original;
+  }
+  const inherited = Object.fromEntries([['__proto__', { ...asset, name: undefined }]]);
+  for (const assets of [{}, { unknown: asset }, { 'linux-x64': { ...asset, executableSha256: 'invalid' } }, inherited]) {
+    manifest.assets = assets;
+    await assert.rejects(readManualRuntimeManifest(await save()), /invalid|incompatible/i);
+  }
+});

package/tests/native-model-command.test.mjs

@@ -0,0 +1,67 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { createJiti } = require('jiti');
+const jiti = createJiti(import.meta.url);
+const { runModelCommand } = await jiti.import('../plugins/carthagent/src/ui/model-command.ts');
+
+const ship = { providerID: 'experiential-labs', modelID: 'deepseek-v4.1-flash', id: 'deepseek-v4.1-flash', name: 'DeepSeek V4.1 Flash' };
+const other = { providerID: 'demo', modelID: 'alpha', id: 'alpha', name: 'Alpha' };
+
+function host(overrides = {}) {
+  const calls = { native: [], switched: [], selects: [], toasts: [], syncs: 0 };
+  return {
+    calls,
+    value: {
+      sync: async () => { calls.syncs++; },
+      list: () => [ship, other],
+      select: async (options) => { calls.selects.push(options.map((option) => option.title)); return options[0]?.value; },
+      switchModel: async (sessionID, model) => { calls.switched.push({ sessionID, model }); },
+      openNativePicker: (query) => { calls.native.push(query); },
+      providerName: (id) => (id === 'experiential-labs' ? 'Carthagent Ship' : id),
+      toast: (message, variant) => { calls.toasts.push({ message, variant }); },
+      ...overrides,
+    },
+  };
+}
+
+test('pre-session /model opens the native configured-model picker with its argument and never switches a session', async () => {
+  const bare = host();
+  await runModelCommand(bare.value, { arg: '' });
+  assert.deepEqual(bare.calls.native, ['']);
+  const named = host();
+  await runModelCommand(named.value, { arg: 'deepseek' });
+  assert.deepEqual(named.calls.native, ['deepseek']);
+  for (const run of [bare, named]) {
+    assert.deepEqual(run.calls.switched, []);
+    assert.deepEqual(run.calls.selects, []);
+    assert.equal(run.calls.toasts.some((toast) => /Open or create a session/.test(toast.message)), false);
+  }
+});
+
+test('existing-session /model keeps filtering by argument and commits the pick to that session only', async () => {
+  const run = host();
+  await runModelCommand(run.value, { sessionID: 'ses_existing', arg: 'deepseek' });
+  assert.equal(run.calls.syncs, 1);
+  assert.deepEqual(run.calls.selects, [['Carthagent Ship/deepseek-v4.1-flash']]);
+  assert.deepEqual(run.calls.switched, [{ sessionID: 'ses_existing', model: { providerID: 'experiential-labs', id: 'deepseek-v4.1-flash' } }]);
+  assert.deepEqual(run.calls.native, []);
+  assert.deepEqual(run.calls.toasts, [{ message: 'Selected Carthagent Ship/deepseek-v4.1-flash.', variant: 'success' }]);
+});
+
+test('cancelling the existing-session picker changes nothing', async () => {
+  const run = host({ select: async () => undefined });
+  await runModelCommand(run.value, { sessionID: 'ses_existing', arg: '' });
+  assert.deepEqual(run.calls.switched, []);
+  assert.deepEqual(run.calls.toasts, []);
+});
+
+test('plugin /model dispatch routes through the shared command and the native model.list command', async () => {
+  const tui = await readFile(new URL('../plugins/carthagent/src/tui.tsx', import.meta.url), 'utf8');
+  assert.match(tui, /runModelCommand\(/);
+  assert.match(tui, /keymap\.dispatch\("model\.list", query\)/);
+  assert.doesNotMatch(tui, /Open or create a session before selecting its model/);
+});