carthagent 1.0.7 → 1.1.0-beta.1

package/tools/manual-runtime-manifest.mjs

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { OPENCODE_VERSION, CTG_RUNTIME_VERSION, readRuntimeReleaseManifest } from '../lib/opencode/runtime.mjs';
+import { REQUIRED_RUNTIME_TARGETS, validateRuntimeBuildInputs } from './verify-owned-runtime-release.mjs';
+
+const root = resolve(import.meta.dirname, '..');
+
+export async function readManualRuntimeManifest({ runtimeManifest, manifestSha256: expectedDigest } = {}) {
+  if (runtimeManifest && !/^[a-f0-9]{64}$/.test(expectedDigest ?? ''))
+    throw Error('An explicit runtime manifest requires its independently supplied SHA-256 digest');
+  const manifestPath = runtimeManifest ? resolve(runtimeManifest) : join(root, 'lib/opencode/runtime-release.json');
+  const bytes = await readFile(manifestPath);
+  const manifestSha256 = createHash('sha256').update(bytes).digest('hex');
+  if (expectedDigest && manifestSha256 !== expectedDigest)
+    throw Error('Runtime manifest SHA-256 checksum mismatch');
+  let manifest;
+  if (!runtimeManifest) manifest = await readRuntimeReleaseManifest(manifestPath);
+  else {
+    manifest = JSON.parse(bytes);
+    const { version } = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
+    if (manifest?.version !== 1 || manifest.releaseVersion !== version
+      || manifest.compatibilityVersion !== OPENCODE_VERSION || manifest.runtimeVersion !== CTG_RUNTIME_VERSION
+      || !manifest.assets || typeof manifest.assets !== 'object' || Array.isArray(manifest.assets)
+      || !Object.keys(manifest.assets).length)
+      throw Error('Invalid or incompatible manual candidate manifest');
+    // Explicit candidates can contain only platforms actually built, never invented release digests.
+    for (const [target, asset] of Object.entries(manifest.assets)) {
+      if (!Object.hasOwn(REQUIRED_RUNTIME_TARGETS, target) || asset?.name !== REQUIRED_RUNTIME_TARGETS[target][2]
+        || !/^[a-f0-9]{64}$/.test(asset.archiveSha256 ?? '') || !/^[a-f0-9]{64}$/.test(asset.executableSha256 ?? ''))
+        throw Error(`Invalid manual candidate asset: ${target}`);
+    }
+  }
+  if (!manifest) throw Error('Runtime release manifest is missing');
+  // Published kits keep their immutable release trust root when development
+  // advances the recipe. Explicit candidates must still match that recipe.
+  if (runtimeManifest) await validateRuntimeBuildInputs(manifest, root);
+  return { manifest, manifestPath, manifestSha256 };
+}

package/tools/native-fixture-browser-cleanup.mjs

@@ -0,0 +1,59 @@
+// Only the randomized fixture URL grants authority to stop a browser tree.
+export const stopFixtureBrowser = String.raw`
+  $ErrorActionPreference = 'Stop'
+  if ([string]::IsNullOrEmpty($env:CTG_NATIVE_FIXTURE_URL)) { throw 'Missing fixture browser URL' }
+  function Same-Identity($a, $b) {
+    return $a.ProcessId -eq $b.ProcessId -and $null -ne $a.CreationDate -and $a.CreationDate -eq $b.CreationDate
+  }
+  function Is-FixtureRoot($p) {
+    return $p.Name -ieq 'msedge.exe' -and $p.CommandLine -and $p.CommandLine.Contains($env:CTG_NATIVE_FIXTURE_URL)
+  }
+  $snapshot = @(Get-CimInstance Win32_Process)
+  $roots = @($snapshot | Where-Object { Is-FixtureRoot $_ })
+  $captured = @{}
+  foreach ($root in $roots) {
+    if ($null -eq $root.CreationDate) { throw "Missing creation identity for fixture browser PID $($root.ProcessId)" }
+    $captured[$root.ProcessId] = $root
+  }
+  # Capture every transitive descendant, including those without the URL.
+  do {
+    $added = $false
+    foreach ($p in $snapshot) {
+      if (!$captured.ContainsKey($p.ProcessId) -and $captured.ContainsKey($p.ParentProcessId)) {
+        $parent = $captured[$p.ParentProcessId]
+        if ($null -eq $p.CreationDate) { throw "Missing creation identity for descendant PID $($p.ProcessId)" }
+        # An older process cannot be a child of this incarnation of its parent PID.
+        if ($p.CreationDate -ge $parent.CreationDate) {
+          $captured[$p.ProcessId] = $p
+          $added = $true
+        }
+      }
+    }
+  } while ($added)
+  $diagnostics = @()
+  foreach ($root in $roots) {
+    $current = @(Get-CimInstance Win32_Process | Where-Object { Same-Identity $_ $root })
+    if ($current.Count -eq 0) { continue }
+    if (!(Is-FixtureRoot $current[0])) { throw "Fixture browser URL changed for PID $($root.ProcessId)" }
+    # Capture native stderr as diagnostics, not a PowerShell terminating error.
+    $savedPreference = $ErrorActionPreference
+    $ErrorActionPreference = 'Continue'
+    $output = @(& taskkill.exe /PID $root.ProcessId /T /F 2>&1)
+    $exitCode = $LASTEXITCODE
+    $ErrorActionPreference = $savedPreference
+    $diagnostics += "PID $($root.ProcessId), taskkill exit $exitCode : $($output -join '; ')"
+  }
+  # Exit status alone is insufficient: taskkill can report a child error after
+  # stopping the root. Conversely, root disappearance does not prove child exit.
+  $deadline = [DateTime]::UtcNow.AddSeconds(5)
+  do {
+    $alive = @(Get-CimInstance Win32_Process | Where-Object {
+      $captured.ContainsKey($_.ProcessId) -and (Same-Identity $_ $captured[$_.ProcessId])
+    })
+    if ($alive.Count -eq 0) { break }
+    if ([DateTime]::UtcNow -ge $deadline) {
+      throw "Fixture browser identities still alive: $($alive.ProcessId -join ', '); $($diagnostics -join ' | ')"
+    }
+    Start-Sleep -Milliseconds 100
+  } while ($true)
+`;

package/tools/native-fixture-stop-diagnostics.mjs

@@ -0,0 +1,43 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+// Never emit free-form log text: even an otherwise harmless line can contain
+// credentials, headers, or a partial secret at the bounded buffer's edge.
+export function sanitizedNativeOutputTail(output) {
+  return String(output).slice(-16384).split(/\r?\n/).slice(-20).map(line => ({
+    level: line.match(/\b(INFO|WARN|ERROR|DEBUG|TRACE)\b/)?.[1] ?? 'unknown',
+    markers: ['shutdown', 'stopping', 'stopped', 'closed', 'exit', 'signal', 'timeout', 'error', 'dispose', 'disposing']
+      .filter(marker => new RegExp(`\\b${marker}\\b`, 'i').test(line)),
+  }));
+}
+
+export async function fixtureStopDiagnostics({ child, output, elapsedMs }, { run = promisify(execFile), platform = process.platform } = {}) {
+  // Snapshot before the read-only OS query; the child may exit during it.
+  const evidence = {
+    elapsedMs: Math.round(elapsedMs),
+    child: { pid: child.pid, exitCode: child.exitCode, signalCode: child.signalCode, killed: child.killed },
+    outputTail: sanitizedNativeOutputTail(output),
+  };
+  if (!Number.isSafeInteger(child.pid) || child.pid <= 0) {
+    evidence.processState = { status: 'no-child-pid' };
+    return evidence;
+  }
+  const windows = platform === 'win32';
+  const command = windows ? 'powershell.exe' : 'ps';
+  const args = windows
+    ? ['-NoProfile', '-NonInteractive', '-Command', `$p = Get-Process -Id ${child.pid} -ErrorAction SilentlyContinue; if ($null -ne $p) { Write-Output ("pid={0} responding={1}" -f $p.Id, $p.Responding) }`]
+    : ['-p', String(child.pid), '-o', 'pid=,ppid=,stat=,etime=,time='];
+  try {
+    const { stdout } = await run(command, args, { timeout: 2000, maxBuffer: 4096, windowsHide: true });
+    const state = stdout.trim();
+    // Only numeric process metadata and fixed state codes; never argv, names,
+    // environment, stderr, database contents, or OS command error messages.
+    const valid = windows
+      ? new RegExp(`^pid=${child.pid} responding=(True|False)$`).test(state)
+      : new RegExp(`^${child.pid}\\s+\\d+\\s+[A-Za-z<+Ns]+\\s+[\\d:.-]+\\s+[\\d:.]+$`).test(state);
+    evidence.processState = { status: !state ? 'not-found' : valid ? 'observed' : 'unrecognized-output', ...(valid ? { state } : {}) };
+  } catch (error) {
+    evidence.processState = { status: 'query-failed', exitCode: Number.isInteger(error.code) ? error.code : null, timedOut: error.killed === true };
+  }
+  return evidence;
+}

package/tools/native-fixture.mjs

@@ -1,13 +1,13 @@
-/** Offline OpenAI-compatible SSE fixture used by the real OpenCode host test. */
+/** Disposable real native host and loopback provider for acceptance probes. */
 import { createServer } from 'node:http';
-import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
+import { mkdtemp, mkdir, writeFile, rm, readFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
 import { once } from 'node:events';
-import { randomBytes } from 'node:crypto';
-import { OpenCode } from '@opencode/client';
-import { resolveOpenCode } from '../lib/opencode/runtime.mjs';
+import { createHash, randomBytes } from 'node:crypto';
+import { assertCompletePluginSource, assertPluginCondition, resolveFixtureSourceRoot, verifySnapshotIdentity } from './native-paired-guards.mjs';
+import { loadNativeTestRuntime, NATIVE_TEST_COMPATIBILITY_VERSION } from './native-runtime-identity.mjs';
 
 const root = resolve(import.meta.dirname, '..');
 
@@ -59,16 +59,104 @@ export function assistantText(response, text) {
   })}\n\n`);
 }
 
-/** Disposable native OpenCode host and loopback provider for acceptance probes. */
-export async function nativeFixture({ plugin = join(root, 'plugins/carthagent'), plugins: additionalPlugins = [], extraPlugins = [], respond = (_body, res) => streamText(res), env: extraEnv = {} } = {}) {
-  const pluginPaths = [plugin, ...additionalPlugins, ...extraPlugins].filter(Boolean).map(path => resolve(path));
+export function streamText(res, text = 'Fixture response complete.') {
+  res.writeHead(200, { 'content-type': 'text/event-stream' });
+  const chunk = (delta, finish_reason = null) => `data: ${JSON.stringify({
+    id: 'fixture', object: 'chat.completion.chunk', created: 1, model: 'fixture',
+    choices: [{ index: 0, delta, finish_reason }],
+    ...(finish_reason ? { usage: { prompt_tokens: 20, completion_tokens: 5, total_tokens: 25 } } : {}),
+  })}\n\n`;
+  res.write(chunk({ role: 'assistant', content: text }));
+  res.end(`${chunk({}, 'stop')}data: [DONE]\n\n`);
+}
+
+export async function resolveFixtureRuntime({ productRuntime, options = {}, env = process.env, packageRoot = root, testRuntimeLoader = loadNativeTestRuntime } = {}) {
+  const ownedRoot = env.CTG_OWNED_OPENCODE_RUNTIME;
+  const trustedManifestPath = env.CTG_TEST_RUNTIME_RELEASE_MANIFEST ?? join(packageRoot, 'lib/opencode/runtime-release.json');
+
+  // A developer-selected staging directory is checked by bytes and trusted
+  // release metadata before the product resolver can execute --version.
+  if (ownedRoot) {
+    const expectedManifest = JSON.parse(await readFile(trustedManifestPath, 'utf8'));
+    const executableName = process.platform === 'win32' ? 'opencode.exe' : 'opencode';
+    const explicitBinary = env.CTG_OPENCODE_BIN ?? join(resolve(ownedRoot), `cli-${process.platform === 'win32' ? 'windows' : process.platform}-${process.arch}`, 'bin', executableName);
+    await testRuntimeLoader({ binary: explicitBinary, ownedRoot, expectedManifest, env });
+  }
+
+  if (typeof productRuntime?.resolveOpenCode === 'function' && typeof productRuntime?.runtimeIdentity === 'function') {
+    const binary = await productRuntime.resolveOpenCode(options);
+    const selected = await productRuntime.runtimeIdentity(binary, options);
+    const selectedRoot = ownedRoot ?? inferOwnedRoot(binary);
+    if (selected.kind === 'ctg-owned' && !selectedRoot) {
+      throw new Error('Product selected an owned runtime without exposing its owned artifact root to the test identity verifier');
+    }
+    if (selected.kind === 'upstream-compatible' && (selected.version !== NATIVE_TEST_COMPATIBILITY_VERSION || env.CTG_TEST_RUNTIME_SHA256)) {
+      throw new Error('Upstream-compatible native test runtime must be exactly 2.0.32 and cannot use CTG_TEST_RUNTIME_SHA256');
+    }
+    const expectedManifest = selectedRoot ? JSON.parse(await readFile(trustedManifestPath, 'utf8')) : undefined;
+    const verified = await testRuntimeLoader({ binary, ownedRoot: selectedRoot, expectedManifest, env });
+    const productIdentity = {
+      binary: selected.binaryPath,
+      binarySha256: selected.binarySha256,
+      runtimeVersion: selected.version,
+      sourceRevision: selected.sourceRevision,
+      patchSha256: selected.patchSha256,
+      lockSha256: selected.lockSha256,
+    };
+    for (const [key, actual] of Object.entries(productIdentity)) {
+      const expected = key === 'sourceRevision' ? verified.sourceRevision
+        : key === 'patchSha256' ? verified.patchSha256
+          : key === 'lockSha256' ? verified.lockSha256 : verified[key];
+      if (expected !== undefined && actual !== expected) {
+        throw new Error(`Product runtime identity ${key} disagrees with trusted native-test identity: ${actual} != ${expected}`);
+      }
+    }
+    return { binary, runtimeIdentity: Object.freeze({
+      ...verified,
+      kind: selected.kind,
+      compatibilityVersion: NATIVE_TEST_COMPATIBILITY_VERSION,
+      runtimeVersion: selected.version,
+      binarySha256: verified.binarySha256 ?? selected.binarySha256 ?? createHash('sha256').update(await readFile(binary)).digest('hex'),
+      ...(selected.capabilities ? { capabilities: selected.capabilities } : {}),
+    }) };
+  }
+
+  const binary = env.CTG_OPENCODE_BIN ?? (ownedRoot
+    ? join(resolve(ownedRoot), `cli-${process.platform === 'win32' ? 'windows' : process.platform}-${process.arch}`, 'bin', process.platform === 'win32' ? 'opencode.exe' : 'opencode')
+    : join(packageRoot, 'node_modules/@opencode/cli/bin/opencode.exe'));
+  const expectedManifest = ownedRoot ? JSON.parse(await readFile(trustedManifestPath, 'utf8')) : undefined;
+  const identity = await testRuntimeLoader({ binary, ownedRoot, expectedManifest, env });
+  return { binary: identity.binary, runtimeIdentity: Object.freeze({
+    ...identity,
+    compatibilityVersion: identity.compatibilityVersion,
+    runtimeVersion: identity.runtimeVersion,
+    kind: ownedRoot ? 'ctg-owned' : 'upstream-compatible',
+  }) };
+}
+
+export async function nativeFixture({ plugin = join(root, 'plugins/carthagent'), pluginOptions, plugins: additionalPlugins = [], pluginExpected = plugin ? 'active' : 'absent', verifyInventory = false, provenance, respond = (_body, res) => streamText(res), env: extraEnv = {}, preserveTemp = false } = {}) {
+  const { OpenCode } = await import('@opencode/client');
+  const pluginEntries = [
+    ...(plugin ? [pluginOptions ? { package: resolve(plugin), options: pluginOptions } : resolve(plugin)] : []),
+    ...additionalPlugins.map(entry => typeof entry === 'string' ? resolve(entry) : { ...entry, package: resolve(entry.package) }),
+  ];
+  const productRuntime = await import('../lib/opencode/runtime.mjs');
+  const { binary: runtimeBinary, runtimeIdentity } = await resolveFixtureRuntime({ productRuntime });
   const temp = await mkdtemp(join(tmpdir(), 'ctg-native-fixture-'));
   const cwd = join(temp, 'project');
+  const pluginProbeCwd = verifyInventory ? join(temp, 'project-alpha') : cwd;
   const config = join(temp, 'config/opencode');
   const requests = [];
   const providerErrors = [];
+  const hostErrors = [];
   let child;
+  let childDetached = false;
   let client;
+  let baseUrl;
+  let password;
+  let pluginObservation;
+  let pluginInventory;
+  let pluginHealth;
   let output = '';
   const provider = createServer((req, res) => {
     void (async () => {
@@ -83,19 +171,27 @@ export async function nativeFixture({ plugin = join(root, 'plugins/carthagent'),
       res.end('Fixture provider failed');
     });
   });
-  const password = randomBytes(24).toString('hex');
+  password = randomBytes(24).toString('hex');
   const stop = async () => {
     if (!child || child.exitCode !== null || child.signalCode !== null) return;
     const exited = once(child, 'exit');
-    child.kill('SIGTERM');
-    const timer = setTimeout(() => child.kill('SIGKILL'), 5000);
+    try {
+      if (childDetached) process.kill(-child.pid, 'SIGTERM');
+      else child.kill('SIGTERM');
+    } catch { child.kill('SIGTERM'); }
+    const timer = setTimeout(() => {
+      try {
+        if (childDetached) process.kill(-child.pid, 'SIGKILL');
+        else child.kill('SIGKILL');
+      } catch { child.kill('SIGKILL'); }
+    }, 5000);
     try { await exited; } finally { clearTimeout(timer); }
   };
-  const close = async () => {
+  const close = async ({ preserveTemp: keepTemp = preserveTemp } = {}) => {
     await stop();
     provider.closeAllConnections();
     if (provider.listening) await new Promise(done => provider.close(done));
-    await rm(temp, { recursive: true, force: true });
+    if (!keepTemp) await rm(temp, { recursive: true, force: true });
   };
   const request = (milliseconds = 30_000) => ({ signal: AbortSignal.timeout(milliseconds) });
   const start = async () => {
@@ -103,16 +199,26 @@ export async function nativeFixture({ plugin = join(root, 'plugins/carthagent'),
     output = '';
     const env = Object.fromEntries(['PATH', 'SystemRoot', 'WINDIR', 'COMSPEC', 'PATHEXT', 'LANG', 'LC_ALL']
       .filter(key => process.env[key]).map(key => [key, process.env[key]]));
+    if (process.env.NODE_OPTIONS) env.NODE_OPTIONS = process.env.NODE_OPTIONS;
     Object.assign(env, {
-      HOME: join(temp, 'home'), USERPROFILE: join(temp, 'home'), APPDATA: join(temp, 'appdata'), LOCALAPPDATA: join(temp, 'localappdata'),
+      ...extraEnv,
+      HOME: join(temp, 'home'), USERPROFILE: join(temp, 'home'),
+      CARTHAGENT_CODING_AGENT_DIR: join(temp, 'home/.carthagent/agent'),
+      PI_CODING_AGENT_DIR: join(temp, 'home/.carthagent/agent'),
+      APPDATA: join(temp, 'appdata'), LOCALAPPDATA: join(temp, 'localappdata'),
       XDG_CONFIG_HOME: join(temp, 'config'), XDG_DATA_HOME: join(temp, 'data'),
       XDG_CACHE_HOME: join(temp, 'cache'), XDG_STATE_HOME: join(temp, 'state'),
       OPENCODE_DB: join(temp, 'database.sqlite'), OPENCODE_SERVER_PASSWORD: password,
-      ...extraEnv,
+      OPENCODE_CONFIG_PROJECT_DISABLE: 'true',
     });
-    child = spawn(await resolveOpenCode(),
-      ['serve', '--hostname', '127.0.0.1', '--port', '0', '--print-logs', '--log-level', 'debug'], { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
-    const baseUrl = await new Promise((done, reject) => {
+    if (verifyInventory) {
+      env.NODE_PATH = join(root, 'node_modules');
+    }
+    childDetached = !verifyInventory;
+    child = spawn(runtimeBinary, ['serve', '--hostname', '127.0.0.1', '--port', '0',
+      ...(extraEnv.CTG_NATIVE_DEBUG === '1' ? ['--print-logs', '--log-level', 'debug'] : [])],
+      { cwd, env, stdio: ['ignore', 'pipe', 'pipe'], detached: childDetached });
+    baseUrl = await new Promise((done, reject) => {
       const timer = setTimeout(() => reject(Error(`Host startup timeout: ${output}`)), 30_000);
       const collect = chunk => {
         output = (output + chunk).slice(-16384);
@@ -122,20 +228,77 @@ export async function nativeFixture({ plugin = join(root, 'plugins/carthagent'),
       child.stdout.on('data', collect);
       child.stderr.on('data', collect);
       child.once('error', error => { clearTimeout(timer); reject(error); });
-      child.once('exit', code => { clearTimeout(timer); reject(Error(`Host exited ${code}: ${output}`)); });
+      child.once('exit', (code, signal) => {
+        if (code !== 0) hostErrors.push({ code, signal, output });
+        clearTimeout(timer);
+        reject(Error(`Host exited ${code ?? signal}: ${output}`));
+      });
     });
     client = OpenCode.make({ baseUrl, headers: { authorization: `Basic ${Buffer.from(`opencode:${password}`).toString('base64')}` } });
     const version = (await client.server.info(request())).version;
-    if (version !== '2.0.32') throw Error(`Expected pinned host 2.0.32, got ${version}`);
+    if (version !== runtimeIdentity.runtimeVersion) {
+      throw Error(`Native fixture runtime identity mismatch: expected ${runtimeIdentity.runtimeVersion}, got ${version}`);
+    }
+    const location = { directory: pluginProbeCwd };
+    if (verifyInventory) {
+      await client.session.create({ location, model: { providerID: 'ctg-fixture', id: 'fixture' }, title: 'native plugin activation probe' }, request());
+      if (pluginExpected === 'active') {
+        assertCompletePluginSource(root);
+        const { assertWorkspacePluginResolution } = await import('./native-paired-guards.mjs');
+        assertWorkspacePluginResolution(root);
+      }
+      const deadline = Date.now() + 15_000;
+      let inventory;
+      while (Date.now() < deadline) {
+        inventory = await client.plugin.list({ location }, request());
+        pluginInventory = inventory.data;
+        try {
+          pluginObservation = assertPluginCondition(inventory.data, pluginExpected === 'active');
+          break;
+        } catch (error) {
+          if (inventory.data.some(item => (item?.id === 'carthagent' ||
+              (typeof item?.id === 'string' && item.id.startsWith('carthagent.'))) && item.state?.status === 'error') ||
+              pluginExpected === 'absent' || Date.now() + 100 >= deadline) throw error;
+          await new Promise(resolve => setTimeout(resolve, 100));
+        }
+      }
+      if (!pluginObservation) throw new Error('Timed out waiting for native plugin inventory condition');
+      if (pluginExpected === 'active') {
+        const probe = await client.rpc.call({ rpcID: 'carthagent', method: 'health', input: {}, location }, request());
+        if (probe.output?.hostVersion !== runtimeIdentity.runtimeVersion || probe.output?.protocol !== 1) {
+          throw Error(`Native Carthagent health probe failed: ${JSON.stringify(probe.output)}`);
+        }
+        pluginHealth = { protocol: probe.output.protocol, hostVersion: probe.output.hostVersion, directoryMatches: probe.output.directory === pluginProbeCwd };
+        if (!pluginHealth.directoryMatches) throw Error('Native Carthagent health RPC reported an unexpected fixture directory');
+      }
+      if (provenance) {
+        const { assertDependencyPackageIdentity, hashDependencyInstall, hashDependencyPackages } = await import('./native-paired-guards.mjs');
+        verifySnapshotIdentity(provenance, provenance, { verifyArtifactFiles: false });
+        const binary = runtimeIdentity.binary;
+        if (provenance.binarySha256 !== createHash('sha256').update(await readFile(binary)).digest('hex')) {
+          throw new Error('Native fixture binary hash does not match selected executable');
+        }
+        // Baseline fixtures intentionally pass plugin=null; resolve dependency
+        // provenance from this immutable execution snapshot in that condition.
+        const sourceRoot = resolveFixtureSourceRoot(plugin, root);
+        const dependencyRoot = provenance.dependencyNodeModulesRealpath;
+        const dependencies = hashDependencyPackages(dependencyRoot, join(sourceRoot, 'package.json'), sourceRoot);
+        if (JSON.stringify(dependencies) !== JSON.stringify(provenance.dependencyPackages)) throw new Error('Native fixture dependency package identity mismatch');
+        const installIdentity = hashDependencyInstall(dependencyRoot);
+        assertDependencyPackageIdentity({ realpath: provenance.dependencyInstallRealpath, treeSha256: provenance.dependencyInstallSha256 }, installIdentity);
+      }
+    }
     return client;
   };
   try {
-    await Promise.all(['project', 'home', 'config/opencode', 'data', 'state', 'cache', 'appdata', 'localappdata']
+    await Promise.all(['project', 'project-alpha', 'home', 'config/opencode', 'data', 'state', 'cache', 'appdata', 'localappdata']
       .map(directory => mkdir(join(temp, directory), { recursive: true })));
     provider.listen(0, '127.0.0.1');
     await once(provider, 'listening');
     await writeFile(join(config, 'opencode.json'), JSON.stringify({
-      ...(pluginPaths.length ? { plugins: pluginPaths } : {}), update: 'disable', model: 'ctg-fixture/fixture', default_agent: 'build',
+      plugins: pluginEntries,
+      update: 'disable', model: 'ctg-fixture/fixture',
+      default_agent: 'build',
       providers: { 'ctg-fixture': {
         package: '@opencode/ai/providers/openai-compatible',
         settings: { baseURL: `http://127.0.0.1:${provider.address().port}/v1`, apiKey: 'offline-fixture' },
@@ -144,11 +307,13 @@ export async function nativeFixture({ plugin = join(root, 'plugins/carthagent'),
     }));
     await start();
   } catch (error) {
-    await close();
+    await close({ preserveTemp: false });
     throw error;
   }
   return {
-    temp, cwd, requests, providerErrors, request, start, stop, close,
+    temp, cwd, baseUrl, password, requests, providerErrors, hostErrors, request, start, stop, close,
+    serverPid: () => child?.pid ?? null,
+    pluginObservation, pluginInventory, pluginHealth, provenance, runtimeIdentity,
     model: { providerID: 'ctg-fixture', id: 'fixture' },
     location: { directory: cwd },
     get client() { return client; },
@@ -156,6 +321,7 @@ export async function nativeFixture({ plugin = join(root, 'plugins/carthagent'),
     async outcome(sessionID) {
       await client.session.wait({ sessionID }, request());
       const deadline = Date.now() + 5000;
+      // wait resolves before the durable session projection always catches up.
       while (true) {
         const session = await client.session.get({ sessionID }, request());
         if (session.outcome) return session.outcome;
@@ -163,18 +329,16 @@ export async function nativeFixture({ plugin = join(root, 'plugins/carthagent'),
         await new Promise(done => setTimeout(done, 20));
       }
     },
-    async active(pluginID = 'carthagent', location = { directory: cwd }) {
-      if (pluginID && typeof pluginID === 'object') {
-        location = pluginID;
-        pluginID = 'carthagent';
-      }
-      await client.session.create({ location, model:{providerID:'ctg-fixture',id:'fixture'}, title:`${pluginID} activation probe` }, request());
+    async active(pluginOrLocation = { directory: cwd }, at = { directory: cwd }) {
+      const pluginID = typeof pluginOrLocation === 'string' ? pluginOrLocation : 'carthagent';
+      const location = typeof pluginOrLocation === 'string' ? at : pluginOrLocation;
+      if (pluginID !== 'carthagent') await client.session.create({ location, model:{providerID:'ctg-fixture',id:'fixture'}, title:`${pluginID} activation probe` }, request());
       const deadline = Date.now() + 15_000;
       while (true) {
         const inventory = await client.plugin.list({ location }, request());
         const plugin = inventory.data.find(item => item.id === pluginID);
         if (plugin?.state.status === 'active') return;
-        if (plugin?.state.status === 'failed') throw Error(`Native fixture plugin failed: ${JSON.stringify(plugin)}\n${output}`);
+        if (plugin?.state.status === 'error') throw Error(`Native fixture plugin failed: ${JSON.stringify(plugin)}\n${output}`);
         if (Date.now() >= deadline) throw Error(`Native plugin ${pluginID} activation timed out: ${JSON.stringify(plugin)}\n${output}`);
         await new Promise(done => setTimeout(done, 50));
       }
@@ -182,13 +346,8 @@ export async function nativeFixture({ plugin = join(root, 'plugins/carthagent'),
   };
 }
 
-export function streamText(response, text = 'Fixture response complete.') {
-  response.writeHead(200, { 'content-type': 'text/event-stream' });
-  const chunk = (delta, finish_reason = null) => `data: ${JSON.stringify({
-    id: 'fixture', object: 'chat.completion.chunk', created: 1, model: 'fixture',
-    choices: [{ index: 0, delta, finish_reason }],
-    ...(finish_reason ? { usage: { prompt_tokens: 20, completion_tokens: 5, total_tokens: 25 } } : {}),
-  })}\n\n`;
-  response.write(chunk({ role: 'assistant', content: text }));
-  response.end(`${chunk({}, 'stop')}data: [DONE]\n\n`);
+function inferOwnedRoot(binary) {
+  const resolved = resolve(binary);
+  const match = resolved.match(/^(.*)[\\/]cli-[a-z]+-[a-z0-9]+[\\/]bin[\\/]opencode(?:\.exe)?$/i);
+  return match?.[1];
 }

package/tools/native-glyph-helpers.py

@@ -0,0 +1,127 @@
+"""Portable glyph PTY screen and assertion helpers; no OS PTY dependencies."""
+import codecs
+import os
+import re
+import unicodedata
+from pathlib import Path
+
+
+USER_MARKER = 'CTG_GLYPH_PAYLOAD'
+USER_TEXT = USER_MARKER + ' 漢字 café → • − …'
+CHROME_PAIRS = [('▄▀▀▀ ▄▀▀▄', 'C A R T H')]
+
+
+class GlyphScreen:
+    """Small VT screen used by glyph acceptance, with Unicode cell widths."""
+
+    def __init__(self, rows=32, columns=100):
+        self.rows, self.columns = rows, columns
+        self.cells = [[' '] * columns for _ in range(rows)]
+        self.x = self.y = 0
+        self.mode = 'text'
+        self.csi = ''
+        self.osc = ''
+        self.osc_escape = False
+        self.title_updates = []
+        self.decoder = codecs.getincrementaldecoder('utf8')('replace')
+        self.wrapCount = 0
+
+    @staticmethod
+    def char_width(char):
+        if unicodedata.combining(char):
+            return 0
+        return 2 if unicodedata.east_asian_width(char) in ('W', 'F') else 1
+
+    def feed(self, data):
+        for char in self.decoder.decode(data):
+            if self.mode == 'osc':
+                if char == '\x07' or (self.osc_escape and char == '\\'):
+                    command, _, title = self.osc.partition(';')
+                    if command in ('0', '2'):
+                        self.title_updates.append(title)
+                    self.osc = ''
+                    self.mode = 'text'
+                elif char != '\x1b':
+                    self.osc += char
+                self.osc_escape = char == '\x1b'
+                continue
+            if self.mode == 'csi':
+                if '@' <= char <= '~':
+                    self._csi(char, self.csi)
+                    self.mode, self.csi = 'text', ''
+                else:
+                    self.csi += char
+                continue
+            if self.mode == 'esc':
+                if char == '[':
+                    self.mode, self.csi = 'csi', ''
+                elif char == ']':
+                    self.mode = 'osc'
+                else:
+                    self.mode = 'text'
+                continue
+            if char == '\x1b':
+                self.mode = 'esc'
+            elif char == '\r':
+                self.x = 0
+            elif char == '\n':
+                self.y = min(self.y + 1, self.rows - 1)
+            elif char == '\b':
+                self.x = max(0, self.x - 1)
+            elif char >= ' ':
+                width = self.char_width(char)
+                if width == 0:
+                    if self.x > 0:
+                        previous = min(self.columns - 1, self.x - 1)
+                        while previous > 0 and self.cells[self.y][previous] == '':
+                            previous -= 1
+                        self.cells[self.y][previous] += char
+                    continue
+                if self.x + width > self.columns:
+                    self.wrapCount += 1
+                    self.x, self.y = 0, min(self.y + 1, self.rows - 1)
+                self.cells[self.y][self.x] = char
+                if width == 2 and self.x + 1 < self.columns:
+                    self.cells[self.y][self.x + 1] = ''
+                self.x += width
+
+    def _csi(self, final, params):
+        values = [int(value) if value.isdigit() else 0 for value in params.lstrip('?').split(';')]
+        n = values[0] if values and values[0] else 1
+        if final in ('H', 'f'):
+            self.y = max(0, min(self.rows - 1, (values[0] if values and values[0] else 1) - 1))
+            self.x = max(0, min(self.columns - 1, (values[1] if len(values) > 1 and values[1] else 1) - 1))
+        elif final == 'A': self.y = max(0, self.y - n)
+        elif final == 'B': self.y = min(self.rows - 1, self.y + n)
+        elif final == 'C': self.x = min(self.columns - 1, self.x + n)
+        elif final == 'D': self.x = max(0, self.x - n)
+        elif final == 'K': self.cells[self.y][self.x:] = [' '] * (self.columns - self.x)
+        elif final == 'J' and values and values[0] == 2:
+            self.cells = [[' '] * self.columns for _ in range(self.rows)]
+            self.x = self.y = 0
+
+    def visible(self):
+        return '\n'.join(''.join(row).rstrip() for row in self.cells)
+
+
+def assert_composer_payload(screen_text, expected=USER_TEXT):
+    """Require the complete ordered payload on a rendered prompt row."""
+    pattern = re.compile(r'^\s*[┃|]\s*' + re.escape(expected) + r'\s*$')
+    rows = [row for row in screen_text.splitlines() if pattern.fullmatch(row)]
+    if not rows:
+        raise AssertionError('exact staged user payload is not preserved in the rendered composer row')
+    return rows[0]
+
+
+def child_environment(root, config, mode, source=None):
+    """Build a portable allowlisted child environment, excluding release secrets."""
+    source = source if source is not None else os.environ
+    root, config = Path(root), Path(config)
+    env = {key: source[key] for key in ('PATH', 'LANG', 'LC_ALL') if key in source}
+    env.update({'HOME': str(root / 'home'), 'TERM': 'xterm-256color', 'COLORTERM': 'truecolor',
+                'XDG_CONFIG_HOME': str(root / 'config'), 'XDG_DATA_HOME': str(root / 'data'),
+                'XDG_STATE_HOME': str(root / 'state'), 'XDG_CACHE_HOME': str(root / 'cache'),
+                'OPENCODE_DB': str(root / 'db.sqlite'), 'OPENCODE_CONFIG_DIR': str(config),
+                'OPENCODE_CONFIG': str(config / 'opencode.json'),
+                'OPENCODE_CONFIG_PROJECT_DISABLE': 'true', 'CTG_TUI_GLYPHS': mode})
+    return env