carthagent 1.0.7 → 1.1.0-beta.1

package/tools/native-pty-runtime.mjs

@@ -0,0 +1,83 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadNativeTestRuntime, preflightNativeTestRuntimeArtifact } from './native-runtime-identity.mjs';
+
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+/** Select the production runtime, binding every owned path to trusted release metadata. */
+export async function selectNativePtyRuntime({ runtime, env = process.env, root = PACKAGE_ROOT, identityTools = { loadNativeTestRuntime, preflightNativeTestRuntimeArtifact } }) {
+  if (env.CTG_TEST_RUNTIME_ARTIFACT_ROOT && (env.CTG_OPENCODE_BIN || env.OPENCODE_BIN)) {
+    throw new Error('Do not combine an injected owned artifact root with an explicit binary override.');
+  }
+
+  let options = {};
+  let expectedManifest;
+  let ownedRoot;
+  if (env.CTG_TEST_RUNTIME_ARTIFACT_ROOT) {
+    ownedRoot = resolve(env.CTG_TEST_RUNTIME_ARTIFACT_ROOT);
+    const expectedManifestPath = env.CTG_TEST_RUNTIME_RELEASE_MANIFEST;
+    // This verifies pinned source/patch/lock/platform provenance and the
+    // executable digest before resolveOpenCode is allowed to execute it.
+    const preflight = await identityTools.preflightNativeTestRuntimeArtifact({
+      ownedRoot,
+      expectedManifestPath,
+      env,
+    });
+    expectedManifest = preflight.expectedManifest;
+    options = { ownedRuntime: ownedRoot };
+  } else if (env.CTG_OWNED_OPENCODE_RUNTIME) {
+    throw new Error('CTG_OWNED_OPENCODE_RUNTIME is a developer selector, not an acceptance trust root; use CTG_TEST_RUNTIME_ARTIFACT_ROOT and CTG_TEST_RUNTIME_RELEASE_MANIFEST.');
+  } else if (env.CTG_OPENCODE_BIN || env.OPENCODE_BIN) {
+    const binary = env.CTG_OPENCODE_BIN ?? env.OPENCODE_BIN;
+    if (!binary.includes('/') && !binary.includes('\\')) throw new Error('Explicit native PTY binary must be a filesystem path.');
+    const expectedHash = env.CTG_NATIVE_PTY_EXPECTED_SHA256;
+    if (!/^[a-f0-9]{64}$/i.test(expectedHash ?? '')) throw new Error('Explicit native PTY binary requires CTG_NATIVE_PTY_EXPECTED_SHA256.');
+    const actualHash = createHash('sha256').update(await readFile(resolve(binary))).digest('hex');
+    if (actualHash !== expectedHash.toLowerCase()) throw new Error(`Explicit native PTY binary SHA-256 mismatch before runtime selection: ${actualHash}`);
+    options = { binary };
+  }
+
+  if (typeof runtime.resolveOpenCode !== 'function' || typeof runtime.runtimeIdentity !== 'function') {
+    throw new Error('Native PTY acceptance requires resolveOpenCode(options) and runtimeIdentity(binary, options) from the production runtime selector.');
+  }
+  const binary = await runtime.resolveOpenCode(options);
+  const identity = await runtime.runtimeIdentity(binary, options);
+  if (!identity.binaryPath || resolve(identity.binaryPath) !== resolve(binary)) {
+    throw new Error(`Runtime identity does not bind the selected executable: selected ${binary}, identity ${identity.binaryPath ?? 'missing'}.`);
+  }
+
+  if (identity.kind === 'ctg-owned') {
+    if (!ownedRoot) {
+      const executableName = process.platform === 'win32' ? 'opencode.exe' : 'opencode';
+      ownedRoot = resolve(dirname(dirname(dirname(binary))));
+      const expectedBinary = resolve(ownedRoot, `cli-${identity.platform}`, 'bin', executableName);
+      if (resolve(binary) !== expectedBinary) throw new Error(`Selected owned runtime is outside its canonical artifact layout: ${binary}`);
+      const manifestPath = resolve(root, 'lib/opencode/runtime-release.json');
+      try { expectedManifest = JSON.parse(await readFile(manifestPath, 'utf8')); }
+      catch (error) { throw new Error(`Default owned runtime has no independently pinned package release manifest at ${manifestPath}: ${error.message}`); }
+    }
+    const verified = await identityTools.loadNativeTestRuntime({ binary, ownedRoot, expectedManifest, env });
+    if (verified.binarySha256 !== identity.binarySha256
+      || verified.sourceRevision !== identity.sourceRevision
+      || verified.patchSha256 !== identity.patchSha256
+      || verified.lockSha256 !== identity.lockSha256) {
+      throw new Error('Independent owned runtime verification does not match the production runtime identity.');
+    }
+    return Object.freeze({ binary, identity, verified, binarySha256: verified.binarySha256 });
+  }
+
+  if (identity.kind !== 'upstream-compatible') throw new Error(`Unrecognized selected native runtime kind: ${identity.kind}`);
+  if (env.CTG_TEST_RUNTIME_ARTIFACT_ROOT) throw new Error('Injected owned artifact resolved as upstream-compatible; refusing the selected runtime.');
+  const verified = await identityTools.loadNativeTestRuntime({ binary, env });
+  if (verified.runtimeVersion !== identity.version || verified.runtimeVersion !== '2.0.32') {
+    throw new Error('Selected upstream-compatible runtime does not match the pinned compatibility version.');
+  }
+  const actual = createHash('sha256').update(await readFile(binary)).digest('hex');
+  if (actual !== identity.binarySha256) throw new Error(`Selected upstream-compatible runtime changed during runtime selection: ${actual}`);
+  const expectedHash = env.CTG_NATIVE_PTY_EXPECTED_SHA256;
+  if (expectedHash && actual !== expectedHash.toLowerCase()) throw new Error(`Explicit native PTY binary SHA-256 mismatch: ${actual}`);
+  const binarySha256 = actual;
+  return Object.freeze({ binary, identity, verified, binarySha256 });
+}

package/tools/native-pty-smoke.py

@@ -2,6 +2,7 @@
 """Exercise a native CTG plugin command in a disposable real terminal host."""
 import argparse
 import fcntl
+import hashlib
 import json
 import os
 import pathlib
@@ -17,32 +18,80 @@ import termios
 import time
 
 
+def resolve_binary(value):
+    """Resolve explicit developer paths; default binary selection belongs to the JS runtime gate."""
+    if value and (os.path.isabs(value) or os.sep in value or (os.altsep and os.altsep in value)):
+        candidate = pathlib.Path(value).expanduser().resolve()
+        return str(candidate) if candidate.is_file() else None
+    if value:
+        found = shutil.which(value)
+        if found:
+            return str(pathlib.Path(found).resolve())
+    return None
+
+
 def main():
     parser = argparse.ArgumentParser()
-    parser.add_argument('--binary', default=shutil.which('opencode'))
-    parser.add_argument('--plugin', default=str(pathlib.Path(__file__).resolve().parents[1] / 'plugins/carthagent/test-plugin'))
-    parser.add_argument('--delivery-plugin', default=str(pathlib.Path(__file__).resolve().parents[1] / 'plugins/carthagent/test-plugin'))
+    parser.add_argument('--binary', required=True, help='Binary selected and validated by the production runtime resolver')
+    parser.add_argument('--expected-sha256', required=True, help='Independently verified binary identity supplied by the JS acceptance gate')
+    parser.add_argument('--plugin', default=str(pathlib.Path(__file__).resolve().parents[1] / 'plugins/carthagent'))
     parser.add_argument('--command', default='/ctg-status')
-    parser.add_argument('--expect', default=None)
-    parser.add_argument('--completion', default='Carthagent runtime status')
+    parser.add_argument('--after-command', action='append', help='Submit another command after expected output; may be repeated')
+    parser.add_argument('--after-expect', action='append', help='Expected output for each additional command')
+    parser.add_argument('--expect', default='Carthagent 2.0.32')
+    parser.add_argument('--capture', help='Save the full raw PTY transcript for diagnosis')
+    parser.add_argument('--expect-color', help='Require a truecolor ANSI RGB sequence after the command, e.g. 230,196,128')
+    parser.add_argument('--initial-theme', help='Select a provisioned native theme before launching the TUI')
+    parser.add_argument('--expect-theme', help='Verify the persisted native theme after command dispatch')
+    parser.add_argument('--ready', help='Wait for this marker before typing')
+    parser.add_argument('--confirm', action='store_true', help='Wait for command submission and confirmation handling to settle')
+    parser.add_argument('--second-enter', action='store_true', help='Wait for command submission and confirmation handling to settle')
+    parser.add_argument('--dismiss-completion', action='store_true', help='Dismiss slash suggestions before submitting the explicitly typed command')
+    parser.add_argument('--post-submit-marker', help='Require an additional unique marker after submission')
     args = parser.parse_args()
+    args.binary = resolve_binary(args.binary)
     if not args.binary:
-        parser.error('OpenCode binary is required')
-    args.binary = str(pathlib.Path(args.binary).resolve())
-    with tempfile.TemporaryDirectory(prefix='ctg-pty-') as temp:
+        parser.error('The selected OpenCode binary is missing; select and validate it through the production runtime resolver first')
+    if not re.fullmatch(r'[a-f0-9]{64}', args.expected_sha256):
+        parser.error('--expected-sha256 must be a lowercase SHA-256 digest')
+    actual = hashlib.sha256(pathlib.Path(args.binary).read_bytes()).hexdigest()
+    if actual != args.expected_sha256:
+        parser.error(f'Selected OpenCode binary SHA-256 changed before PTY execution: {actual}')
+    preferred_temp = pathlib.Path('/tmp/opencode')
+    with tempfile.TemporaryDirectory(prefix='ctg-pty-', dir=preferred_temp if preferred_temp.is_dir() else None) as temp:
         root = pathlib.Path(temp)
         for name in ['home', 'project', 'config/opencode', 'data', 'state', 'cache']:
             (root / name).mkdir(parents=True, exist_ok=True)
         (root / 'config/opencode/opencode.json').write_text(json.dumps({
-            'plugins': list(dict.fromkeys([str(pathlib.Path(args.plugin).resolve()), str(pathlib.Path(args.delivery_plugin).resolve())])), 'update': 'disable',
+            'plugins': [str(pathlib.Path(args.plugin).resolve())], 'update': 'disable',
+            'model': 'ctg-pty/fixture',
+            'providers': {'ctg-pty': {
+                'package': '@opencode/ai/providers/openai-compatible',
+                'settings': {'baseURL': 'http://127.0.0.1:1/v1', 'apiKey': 'offline-fixture'},
+                'models': {'fixture': {'limit': {'context': 32000, 'output': 1024}}},
+            }},
         }))
-        expected = args.expect or 'OpenCode 2.0.32 ·'
+        # Mirror the launcher contract: custom themes are installed before the
+        # native TUI scans its profile. Installing from inside the running TUI
+        # cannot make a newly-created theme selectable in that same process.
+        provisioner = pathlib.Path(args.plugin).resolve() / 'src/ui/theme-provision.mjs'
+        subprocess.run([
+            'node', '--input-type=module', '-e',
+            "const { provisionDefaultNativeTheme } = await import(process.argv[1]); await provisionDefaultNativeTheme(process.argv[2]);",
+            str(provisioner), str(root / 'config/opencode'),
+        ], check=True)
+        if args.initial_theme:
+            (root / 'config/opencode/cli.json').write_text(json.dumps({'theme': {'name': args.initial_theme}}))
         env = {key: os.environ[key] for key in ['PATH', 'LANG', 'LC_ALL'] if key in os.environ}
         env.update({
             'HOME': str(root / 'home'), 'TERM': 'xterm-256color', 'COLORTERM': 'truecolor',
             'XDG_CONFIG_HOME': str(root / 'config'), 'XDG_DATA_HOME': str(root / 'data'),
             'XDG_STATE_HOME': str(root / 'state'), 'XDG_CACHE_HOME': str(root / 'cache'),
+            'OPENCODE_CONFIG_DIR': str(root / 'config/opencode'),
             'OPENCODE_DB': str(root / 'database.sqlite'),
+            'OPENCODE_CONFIG_PROJECT_DISABLE': 'true',
+            'OPENCODE_DISABLE_MODELS_FETCH': 'true',
+            'OPENCODE_DISABLE_AUTOUPDATE': 'true',
         })
         master, slave = pty.openpty()
         fcntl.ioctl(slave, termios.TIOCSWINSZ, struct.pack('HHHH', 36, 120, 0, 0))
@@ -50,10 +99,18 @@ def main():
                                  stdin=slave, stdout=slave, stderr=slave, start_new_session=True)
         os.close(slave)
         output = bytearray()
+        transcript = bytearray()
         started = time.monotonic()
         sent = False
-        completion_accepted = False
+        sent_at = None
         submitted = False
+        confirmation_complete = False
+        completion_dismissed = False
+        submission_at = None
+        enter_count = 0
+        after_index = 0
+        after_typed_at = None
+        after_completion_dismissed = False
         try:
             while time.monotonic() - started < 30:
                 if child.poll() is not None:
@@ -61,29 +118,93 @@ def main():
                 if select.select([master], [], [], 0.1)[0]:
                     chunk = os.read(master, 65536)
                     output.extend(chunk)
+                    transcript.extend(chunk)
                     # Terminal capability requests need replies on a headless PTY.
                     if b'\x1b[6n' in chunk:
                         os.write(master, b'\x1b[1;1R')
                     if b'\x1b[c' in chunk:
                         os.write(master, b'\x1b[?1;2c')
-                if not sent and time.monotonic() - started > 8:
+                ready = args.ready.encode() in transcript if args.ready else time.monotonic() - started > 8
+                if not sent and ready:
+                    output.clear()
+                    sent_at = time.monotonic()
                     os.write(master, args.command.encode())
                     sent = True
-                # The completion row is evidence that the TUI plugin has
-                # registered its command. Enter submits the highlighted slash
-                # command; inspect only output produced after that submission.
-                if sent and not completion_accepted and args.completion.encode() in output:
-                    completion_accepted = True
+                if sent and args.dismiss_completion and not completion_dismissed and time.monotonic() - sent_at > 1:
+                    output.clear()
+                    os.write(master, b'\x1b')
+                    completion_dismissed = True
+                    sent_at = time.monotonic()
+                if sent and not submitted and after_index == 0 and time.monotonic() - sent_at > (0.5 if args.dismiss_completion and completion_dismissed else 1):
+                    # Typed slash text has usually populated autocomplete now.
+                    # Discard that frame before accepting the completion so it
+                    # cannot satisfy the post-command assertion.
+                    output.clear()
+                    os.write(master, b'\r')
+                    enter_count += 1
+                    submitted = True
+                    submission_at = time.monotonic()
+                confirmation_prompt = re.search(rb'(?i)(?:are you sure|confirm\?|\[y/n\]|\(y/n\)|press enter to confirm)', output)
+                if submitted and submission_at is not None and not confirmation_complete:
+                    if confirmation_prompt:
+                        # A second Enter must never be speculative. Keep the
+                        # test blocked until an explicit confirmation UI is
+                        # handled by a purpose-built confirmation action.
+                        raise RuntimeError('Command opened a confirmation prompt; no explicit confirmation handler is configured')
+                    if time.monotonic() - submission_at > 2:
+                        confirmation_complete = True
+                after_commands = args.after_command or []
+                after_expects = args.after_expect or []
+                if len(after_commands) != len(after_expects):
+                    raise ValueError('--after-command and --after-expect must be supplied in matching counts')
+                expected_output = args.expect if after_index == 0 else after_expects[after_index - 1]
+                if submitted and expected_output.encode() in output and after_index < len(after_commands):
+                    output.clear()
+                    os.write(master, after_commands[after_index].encode())
+                    after_typed_at = time.monotonic()
+                    after_completion_dismissed = False
+                    after_index += 1
+                    submitted = False
+                    confirmation_complete = False
+                    submission_at = None
+                    continue
+                if after_index and not submitted and not after_completion_dismissed and time.monotonic() - after_typed_at > 1:
+                    # Follow-up commands must use the same explicit submit path
+                    # as the top-level probe. In particular, the theme command
+                    # may leave the host's slash completion active; the first
+                    # Enter could select a completion instead of submitting.
+                    output.clear()
+                    os.write(master, b'\x1b')
+                    after_completion_dismissed = True
+                    after_typed_at = time.monotonic()
+                if after_index and not submitted and after_completion_dismissed and time.monotonic() - after_typed_at > 0.5:
                     os.write(master, b'\r')
                     submitted = True
+                    sent_at = time.monotonic()
+                    submission_at = sent_at
                     output.clear()
-                plain_output = re.sub(rb'\x1b\[[0-?]*[ -/]*[@-~]', b'', bytes(output))
-                if submitted and expected.encode() in plain_output:
-                    if b'runtime unavailable' in plain_output or args.completion.encode() in plain_output:
+                command_submitted = submitted and (confirmation_complete or not (args.confirm or args.second_enter))
+                result_output = command_submitted and expected_output.encode() in output and (not args.post_submit_marker or args.post_submit_marker.encode() in output)
+                if result_output:
+                    if args.expect_theme:
+                        theme_config = json.loads((root / 'config/opencode/cli.json').read_text())
+                        assert theme_config['theme']['name'] == args.expect_theme, theme_config
+                    if b'runtime unavailable' in output or b'No matching commands' in output:
                         raise RuntimeError('Command was unavailable or its RPC failed')
-                    print(json.dumps({'command': args.command, 'observed': expected,
-                                      'completionAccepted': completion_accepted,
-                                      'commandSubmitted': submitted,
+                    if args.expect_color and args.initial_theme:
+                        theme_config = json.loads((root / 'config/opencode/cli.json').read_text())
+                        assert theme_config['theme']['name'] == args.initial_theme, theme_config
+                        channels = [part.strip() for part in args.expect_color.split(',')]
+                        if len(channels) != 3 or any(not part.isdigit() or int(part) > 255 for part in channels):
+                            raise ValueError('--expect-color must be an RGB triple such as 242,198,109')
+                        ansi = f"\x1b[38;2;{';'.join(channels)}m".encode()
+                        if ansi not in transcript:
+                            print(f'Expected rendered foreground color {ansi!r} was not observed; recent raw PTY bytes: {output[-12000:]!r}')
+                            raise AssertionError('Rendered accent color did not match the selected native theme')
+                    print(json.dumps({'command': args.command, 'observed': expected_output,
+                                      'postSubmission': True, 'enterCount': enter_count,
+                                       'theme': args.initial_theme if args.expect_color else None,
+                                      'ansiColor': args.expect_color,
                                       'elapsedMs': round((time.monotonic() - started) * 1000),
                                       'terminalBytes': len(output)}))
                     return
@@ -92,8 +213,10 @@ def main():
                 lines = [line for line in log.read_text(errors='replace').splitlines()
                          if 'plugin' in line.lower() or 'error' in line.lower()]
                 print('\n'.join(lines[-30:]))
-            raise RuntimeError(f'Expected post-command response {expected!r} not rendered (sent={sent}, completionAccepted={completion_accepted}, submitted={submitted}): {plain[-8000:].decode(errors="replace")}')
+            raise RuntimeError(f'Expected {args.expect!r} not rendered: {plain[-8000:].decode(errors="replace")}')
         finally:
+            if args.capture:
+                pathlib.Path(args.capture).write_bytes(transcript)
             if child.poll() is None:
                 os.killpg(child.pid, signal.SIGTERM)
                 try:

package/tools/native-public-repo-shell-result.mjs

@@ -0,0 +1,13 @@
+import assert from 'node:assert/strict';
+
+/** Validate the explicit status trailer emitted by a wrapped native shell call. */
+export function assertNativeShellResult(output, { status, passingTests } = {}) {
+  const match = /(?:^|\n)CTG_NATIVE_EXIT_STATUS=(\d+)\s*(?:\nExited with code \d+\s*)?$/.exec(output);
+  assert.ok(match, 'native shell result must end with its explicit CTG_NATIVE_EXIT_STATUS trailer');
+  assert.equal(Number(match[1]), status, `native shell exit status must be ${status}`);
+  if (passingTests !== undefined) {
+    assert.match(output, new RegExp(`(?:^|\\n)\\s*${passingTests} passing(?:\\s|\\()`, 'i'), `Mocha output must report ${passingTests} passing tests`);
+    assert.doesNotMatch(output, /(?:^|\n)\s*[1-9]\d* failing(?:\s|\()/i, 'Mocha output must not report any failing tests');
+  }
+  return Number(match[1]);
+}

package/tools/native-public-repo-shell-result.test.mjs

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { assertNativeShellResult } from './native-public-repo-shell-result.mjs';
+
+test('accepts exact zero-status Mocha result with expected passing count', () => {
+  assert.equal(assertNativeShellResult('  111 passing (10ms)\nCTG_NATIVE_EXIT_STATUS=0', { status: 0, passingTests: 111 }), 0);
+});
+
+test('rejects Mocha output reporting passing tests and any failing tests despite a zero-status trailer', () => {
+  assert.throws(
+    () => assertNativeShellResult('  111 passing (10ms)\n  1 failing\nCTG_NATIVE_EXIT_STATUS=0', { status: 0, passingTests: 111 }),
+    /must not report any failing tests/,
+  );
+});
+
+test('rejects nonzero native status even when output claims all package tests passed', () => {
+  assert.throws(
+    () => assertNativeShellResult('  111 passing (10ms)\n  1 failing\nCTG_NATIVE_EXIT_STATUS=1\nExited with code 1', { status: 0, passingTests: 111 }),
+    /exit status must be 0/,
+  );
+});
+
+test('fails closed when native result has no explicit status trailer', () => {
+  assert.throws(
+    () => assertNativeShellResult('  111 passing (10ms)', { status: 0, passingTests: 111 }),
+    /must end with its explicit/,
+  );
+});

package/tools/native-runtime-identity.mjs

@@ -0,0 +1,201 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import { resolve, join } from 'node:path';
+
+export const NATIVE_TEST_COMPATIBILITY_VERSION = '2.0.32';
+
+const SHA256 = /^[a-f0-9]{64}$/;
+const REVISION = /^[a-f0-9]{40,64}$/;
+const RELEASE_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+/**
+ * Resolve and verify the executable used by native acceptance tests.
+ *
+ * `expectedManifest` is the caller's trusted, package-pinned runtime-release
+ * record (not the adjacent ctg-runtime.json). Its `assets[platform]` entry
+ * pins the executable digest. Developers may override that digest with
+ * CTG_TEST_RUNTIME_SHA256 while retaining the expected source, patch, lock,
+ * compatibility, and runtime identity from the trusted release record.
+ *
+ * Upstream runtimes are accepted only when --version is exactly
+ * `opencode v2.0.32`. The owned CTG build is accepted only when its exact
+ * runtime version, provenance manifest, platform path, and independently
+ * expected binary digest all match. Provenance and bytes are checked before
+ * executing the binary. No version normalization or substring matching is
+ * used.
+ */
+export async function loadNativeTestRuntime({
+  binary = process.env.CTG_OPENCODE_BIN,
+  ownedRoot,
+  expectedManifest,
+  platform = nativePlatform(),
+  env = process.env,
+  spawnImpl = spawn,
+} = {}) {
+  if (typeof binary !== 'string' || !binary.trim()) {
+    throw new Error('Pass the native test executable as `binary` or CTG_OPENCODE_BIN');
+  }
+  const executable = resolve(binary);
+  if (!ownedRoot) {
+    const versionOutput = await captureVersion(executable, spawnImpl, env);
+    if (versionOutput !== `opencode v${NATIVE_TEST_COMPATIBILITY_VERSION}`) {
+      throw new Error(`Unsupported native test runtime version: ${JSON.stringify(versionOutput)}`);
+    }
+    return Object.freeze({
+      binary: executable,
+      compatibilityVersion: NATIVE_TEST_COMPATIBILITY_VERSION,
+      runtimeVersion: NATIVE_TEST_COMPATIBILITY_VERSION,
+    });
+  }
+
+  if (typeof ownedRoot !== 'string' || !ownedRoot.trim()) throw new Error('ownedRoot must be a non-empty path');
+  const root = resolve(ownedRoot);
+  const trusted = validateTrustedRelease(expectedManifest, platform);
+  const target = trusted.assets[platform];
+  const executableName = platform.startsWith('windows-') ? 'opencode.exe' : 'opencode';
+  const expectedBinary = resolve(root, `cli-${platform}`, 'bin', executableName);
+  if (executable !== expectedBinary) throw new Error(`Owned runtime executable must be ${expectedBinary}`);
+
+  const actualSha256 = createHash('sha256').update(await readFile(executable)).digest('hex');
+  const expectedSha256 = env.CTG_TEST_RUNTIME_SHA256 ?? target.executableSha256;
+  if (!SHA256.test(expectedSha256)) throw new Error('Expected owned runtime executable SHA-256 is invalid');
+  if (actualSha256 !== expectedSha256) {
+    throw new Error(`Owned runtime binary SHA-256 mismatch: expected ${expectedSha256}, got ${actualSha256}`);
+  }
+
+  const manifestPath = join(root, 'ctg-runtime.json');
+  let manifest;
+  try {
+    manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+  } catch (error) {
+    throw new Error(`Could not read owned runtime manifest at ${manifestPath}: ${error.message}`, { cause: error });
+  }
+  const expectedInner = {
+    owner: 'Carthagent',
+    sourceRepository: 'https://github.com/anomalyco/opencode',
+    sourceRevision: trusted.sourceRevision,
+    patchSha256: trusted.patchSha256,
+    lockSha256: trusted.lockSha256,
+    compatibilityVersion: trusted.compatibilityVersion,
+    runtimeVersion: trusted.runtimeVersion,
+    channel: `ctg.${trusted.compatibilityVersion}`,
+    platform,
+    webUI: false,
+  };
+  for (const [key, expected] of Object.entries(expectedInner)) {
+    if (manifest?.[key] !== expected) throw new Error(`Owned runtime ${key} mismatch: expected ${String(expected)}, got ${String(manifest?.[key])}`);
+  }
+
+  const versionOutput = await captureVersion(executable, spawnImpl, env);
+  if (versionOutput !== `opencode v${trusted.runtimeVersion}`) {
+    throw new Error(`Unsupported owned native test runtime version: expected opencode v${trusted.runtimeVersion}, got ${JSON.stringify(versionOutput)}`);
+  }
+  return Object.freeze({
+    binary: executable,
+    compatibilityVersion: trusted.compatibilityVersion,
+    runtimeVersion: trusted.runtimeVersion,
+    binarySha256: actualSha256,
+    sourceRevision: manifest.sourceRevision,
+    patchSha256: manifest.patchSha256,
+    lockSha256: manifest.lockSha256,
+    platform,
+  });
+}
+
+/** Verify a test-supplied artifact against explicit trusted metadata before a resolver can execute it. */
+export async function preflightNativeTestRuntimeArtifact({
+  ownedRoot,
+  expectedManifestPath,
+  env = process.env,
+  platform = nativePlatform(),
+  spawnImpl = spawn,
+} = {}) {
+  if (typeof ownedRoot !== 'string' || !ownedRoot.trim()) throw new Error('ownedRoot must be a non-empty test artifact path');
+  if (typeof expectedManifestPath !== 'string' || !expectedManifestPath.trim()) {
+    throw new Error('A trusted CTG_TEST_RUNTIME_RELEASE_MANIFEST is required with CTG_TEST_RUNTIME_ARTIFACT_ROOT');
+  }
+  let expectedManifest;
+  try {
+    expectedManifest = JSON.parse(await readFile(expectedManifestPath, 'utf8'));
+  } catch (error) {
+    throw new Error(`Could not read trusted native runtime release manifest at ${expectedManifestPath}: ${error.message}`, { cause: error });
+  }
+  const executableName = platform.startsWith('windows-') ? 'opencode.exe' : 'opencode';
+  const binary = join(resolve(ownedRoot), `cli-${platform}`, 'bin', executableName);
+  const identity = await loadNativeTestRuntime({ binary, ownedRoot, expectedManifest, env, platform, spawnImpl });
+  return Object.freeze({ identity, expectedManifest });
+}
+
+function validateTrustedRelease(release, platform) {
+  const invalid = reason => { throw new Error(`Invalid trusted native runtime release manifest: ${reason}`); };
+  if (!release || release.version !== 1 || !RELEASE_VERSION.test(release.releaseVersion ?? '')
+    || release.compatibilityVersion !== NATIVE_TEST_COMPATIBILITY_VERSION
+    || typeof release.runtimeVersion !== 'string' || !release.runtimeVersion.startsWith('0.0.0-ctg.')
+    || !REVISION.test(release.sourceRevision ?? '')
+    || !SHA256.test(release.patchSha256 ?? '') || !SHA256.test(release.lockSha256 ?? '')
+    || !release.assets || typeof release.assets !== 'object' || Array.isArray(release.assets)) invalid('required pinned identity fields are missing or invalid');
+  const asset = release.assets[platform];
+  if (!asset || asset.name !== `opencode-${platform}.tar.gz` || !SHA256.test(asset.executableSha256 ?? '') || !SHA256.test(asset.archiveSha256 ?? '')) {
+    invalid(`no exact asset digest is pinned for ${platform}`);
+  }
+  return release;
+}
+
+function nativePlatform() {
+  const os = process.platform === 'win32' ? 'windows' : process.platform;
+  return `${os}-${process.arch}`;
+}
+
+function captureVersion(binary, spawnImpl, env) {
+  return new Promise((resolveOutput, reject) => {
+    let child;
+    try {
+      const childEnv = { ...env };
+      for (const key of Object.keys(childEnv)) {
+        if (key.toUpperCase() === 'CTG_RUNTIME_GITHUB_TOKEN') delete childEnv[key];
+      }
+      child = spawnImpl(binary, ['--version'], { env: childEnv, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+    } catch (error) {
+      reject(error);
+      return;
+    }
+    let stdout = '';
+    let stderr = '';
+    let settled = false;
+    const finish = callback => value => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      callback(value);
+    };
+    const onOutput = (target, chunk) => {
+      if (settled) return;
+      target.value += chunk;
+      if (target.value.length > 64 * 1024) {
+        child.kill?.('SIGKILL');
+        finish(reject)(new Error('Native test runtime --version output exceeded 64 KiB'));
+      }
+    };
+    const stdoutBuffer = { value: stdout };
+    const stderrBuffer = { value: stderr };
+    const timer = setTimeout(() => {
+      child.kill?.('SIGKILL');
+      finish(reject)(new Error('Native test runtime --version timed out after 5 seconds'));
+    }, 5000);
+    child.stdout?.setEncoding?.('utf8');
+    child.stderr?.setEncoding?.('utf8');
+    child.stdout?.on('data', chunk => onOutput(stdoutBuffer, chunk));
+    child.stderr?.on('data', chunk => onOutput(stderrBuffer, chunk));
+    child.once('error', finish(reject));
+    child.once('close', code => {
+      stdout = stdoutBuffer.value;
+      stderr = stderrBuffer.value;
+      if (code !== 0) {
+        finish(reject)(new Error(`Native test runtime --version exited ${code}: ${stderr.trim()}`));
+        return;
+      }
+      finish(resolveOutput)(stdout.trim());
+    });
+  });
+}

package/tools/native-slash-acceptance-env.py

@@ -0,0 +1,38 @@
+"""Strict child-environment allowlists for the native slash acceptance probe."""
+from pathlib import Path
+
+SAFE_PARENT_ENV = ('PATH', 'LANG', 'LC_ALL')
+SAFE_WINDOWS_ENV = ('SystemRoot', 'WINDIR', 'COMSPEC', 'PATHEXT')
+TUI_ENV_KEYS = frozenset((*SAFE_PARENT_ENV, *SAFE_WINDOWS_ENV, 'HOME', 'USERPROFILE',
+    'APPDATA', 'LOCALAPPDATA', 'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_STATE_HOME',
+    'XDG_CACHE_HOME', 'OPENCODE_CONFIG_PROJECT_DISABLE', 'OPENCODE_PASSWORD',
+    'OPENCODE_SERVER_PASSWORD', 'OPENCODE_SERVER_USERNAME', 'TERM', 'COLORTERM'))
+FIXTURE_ENV_KEYS = TUI_ENV_KEYS | frozenset((
+    'CTG_OWNED_OPENCODE_RUNTIME', 'CTG_TEST_RUNTIME_RELEASE_MANIFEST'))
+
+
+def fixture_environment(source, home, owned_root, release_manifest):
+    result = {key: source[key] for key in (*SAFE_PARENT_ENV, *SAFE_WINDOWS_ENV)
+              if key in source}
+    result['PATH'] = result.get('PATH', '/usr/bin:/bin')
+    result['LANG'] = result.get('LANG', 'C.UTF-8')
+    result.update({
+        'HOME': str(home), 'USERPROFILE': str(home),
+        'CTG_OWNED_OPENCODE_RUNTIME': str(owned_root),
+        'CTG_TEST_RUNTIME_RELEASE_MANIFEST': str(release_manifest),
+        'XDG_CONFIG_HOME': str(Path(home) / 'config'),
+        'XDG_DATA_HOME': str(Path(home) / 'data'),
+        'XDG_STATE_HOME': str(Path(home) / 'state'),
+        'XDG_CACHE_HOME': str(Path(home) / 'cache'),
+    })
+    return result
+
+
+def assert_clean_child_environment(env, allowed=TUI_ENV_KEYS):
+    forbidden = {'ctg_runtime_github_token', 'anthropic_api_key', 'openai_api_key',
+                 'openrouter_api_key', 'opencode_api_key'}
+    if any(key.casefold() in forbidden for key in env):
+        raise AssertionError('child environment contains a provider/runtime credential')
+    unexpected = sorted(set(env) - allowed)
+    if unexpected:
+        raise AssertionError(f'child environment contains non-allowlisted names: {unexpected}')