carthagent 1.0.7 → 1.1.0-beta.2

package/script/ctg/build-owned-runtime.sh

@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Reproducible native build for CTG's separately named OpenCode v2.0.32 runtime.
+# Run from a clean checkout of the locked source revision with Bun 1.4.2.
+ROOT="$(git rev-parse --show-toplevel)"
+EXPECTED_SOURCE="843a6c514e606b436a7fe713422ace0a93ad3d61"
+EXPECTED_LOCK="9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d"
+EXPECTED_PATCH="ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975"
+TARGET="${1:-opencode-linux-x64}"
+HOST_PLATFORM="$(node -p 'process.platform')"
+HOST_ARCH="$(node -p 'process.arch')"
+
+cd "$ROOT"
+if command -v sha256sum >/dev/null 2>&1; then
+  HASH_COMMAND=(sha256sum)
+elif command -v shasum >/dev/null 2>&1; then
+  HASH_COMMAND=(shasum -a 256)
+else
+  echo "Need sha256sum or shasum to verify pinned inputs" >&2
+  exit 1
+fi
+if [[ "$(git rev-parse HEAD)" != "$EXPECTED_SOURCE" ]]; then
+  echo "Expected pristine OpenCode source $EXPECTED_SOURCE; got $(git rev-parse HEAD)" >&2
+  exit 1
+fi
+# Reject staged edits and every tracked worktree edit other than a bun.lock
+# line-ending conversion before restoring anything. On Windows, validate that
+# normalizing CRLF to LF exactly reproduces the committed blob; this keeps
+# checkout conversion distinct from user edits and fails closed on content
+# changes. The blob itself must still match the pinned lock hash.
+if ! git diff --cached --quiet HEAD --; then
+  echo "Refusing to build with staged source changes" >&2
+  exit 1
+fi
+expected_inputs=(
+  "docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch"
+  "script/ctg/build-owned-runtime.sh"
+)
+actual_status="$(git status --porcelain --untracked-files=all)"
+unexpected=""
+while IFS= read -r entry; do
+  [[ -z "$entry" ]] && continue
+  path="${entry:3}"
+  allowed=false
+  for input in "${expected_inputs[@]}"; do
+    [[ "$path" == "$input" ]] && allowed=true
+  done
+  if [[ "$allowed" != true && "$path" != "bun.lock" ]]; then
+    unexpected+="${entry}"$'\n'
+  fi
+done <<< "$actual_status"
+if [[ -n "$unexpected" ]]; then
+  echo "Expected pristine tracked source and only the two reviewed CTG build inputs as untracked files" >&2
+  git status --short >&2
+  exit 1
+fi
+if ! git diff --quiet HEAD -- . ':(exclude)bun.lock'; then
+  echo "Refusing to build with modified tracked source files" >&2
+  git status --short >&2
+  exit 1
+fi
+node - "$EXPECTED_LOCK" <<'NODE'
+const { createHash } = require("node:crypto")
+const { execFileSync } = require("node:child_process")
+const { readFileSync } = require("node:fs")
+const expectedHash = process.argv[2]
+const committed = execFileSync("git", ["show", "HEAD:bun.lock"])
+const current = readFileSync("bun.lock")
+const normalized = Buffer.from(current.toString("utf8").replace(/\r\n/g, "\n"))
+const hash = createHash("sha256").update(committed).digest("hex")
+if (hash !== expectedHash || !normalized.equals(committed)) {
+  console.error("Refusing to restore bun.lock: tracked content differs from the pinned blob")
+  process.exit(1)
+}
+NODE
+# Only after the fail-closed pristine check, restore Windows checkout line
+# endings with conversion disabled so Bun sees the exact committed bytes.
+git -c core.autocrlf=false checkout-index --force -- bun.lock
+if [[ "$("${HASH_COMMAND[@]}" bun.lock | awk '{print $1}')" != "$EXPECTED_LOCK" ]]; then
+  echo "Pinned bun.lock checksum mismatch" >&2
+  exit 1
+fi
+if [[ "$(bun --version)" != "1.4.2" ]]; then
+  echo "Expected Bun 1.4.2; got $(bun --version)" >&2
+  exit 1
+fi
+
+patch_file="$ROOT/docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch"
+actual_patch="$("${HASH_COMMAND[@]}" "$patch_file" | awk '{print $1}')"
+if [[ "$actual_patch" != "$EXPECTED_PATCH" ]]; then
+  echo "Patch checksum mismatch: $actual_patch" >&2
+  exit 1
+fi
+git apply --check "$patch_file"
+git apply "$patch_file"
+
+echo "source=$(git rev-parse HEAD)"
+echo "patch_sha256=$actual_patch"
+echo "license=$(grep -m1 '"license"' packages/cli/package.json | cut -d '"' -f4)"
+
+bun install --frozen-lockfile
+bun run --cwd packages/core typecheck
+bun run --cwd packages/server typecheck
+bun run --cwd packages/plugin typecheck
+bun run --cwd packages/client typecheck
+bun run --cwd packages/tui typecheck
+bun test --cwd packages/core test/session-compaction.test.ts
+bun test --cwd packages/core test/shell-retention.test.ts
+bun test --cwd packages/server test/shell-provenance.test.ts
+bun test --cwd packages/tui test/plugin-source.test.ts
+bun test --cwd packages/tui test/clear-session.test.tsx
+bun test --cwd packages/tui --timeout 30000 test/navigation-rail.test.tsx --rerun-each 10
+bun test --cwd packages/tui --timeout 30000 test/component/seascape-render.test.tsx --rerun-each 10
+bun test --cwd packages/tui --timeout 30000 test/app-lifecycle.test.tsx test/session-panel.test.tsx
+bun test --cwd packages/tui test/util/renderer.test.ts
+bun test --cwd packages/tui test/component/plan-view.test.tsx test/component/transcript-scrollbox.test.ts test/component/seascape.test.ts test/component/session-tabs-rail.test.tsx test/component/session-tabs-marquee.test.ts test/component/session-tabs-mouse.test.tsx test/context/session-tabs-model.test.ts test/ui/layout.test.ts
+bun test --cwd packages/tui --timeout 60000 test/glyphs.test.ts test/plugin-keymap.test.tsx test/plugin-theme.test.tsx test/plugin-theme-provider.test.tsx
+
+cd packages/cli
+# A CTG build is intentionally detached from upstream updater channels and
+# receives an explicit non-upstream identity; it must never masquerade as 2.0.32.
+if [[ "$TARGET" == opencode-windows-* ]]; then
+  BUILD_OS=win32
+  MANIFEST_PLATFORM="windows-${TARGET#opencode-windows-}"
+  BINARY=opencode.exe
+elif [[ "$TARGET" == opencode-darwin-* ]]; then
+  BUILD_OS=darwin
+  MANIFEST_PLATFORM="darwin-${TARGET#opencode-darwin-}"
+  BINARY=opencode
+else
+  BUILD_OS=linux
+  MANIFEST_PLATFORM="linux-${TARGET#opencode-linux-}"
+  BINARY=opencode
+fi
+BUILD_ARCH="$(sed -E 's/^opencode-(linux|darwin|windows)-([^-]+).*$/\2/' <<< "$TARGET")"
+if [[ "$BUILD_OS" != "$HOST_PLATFORM" || "$BUILD_ARCH" != "$HOST_ARCH" ]]; then
+  echo "Cross-compiling target $TARGET is not supported by this recipe; run on matching native CI (host $HOST_PLATFORM-$HOST_ARCH)" >&2
+  exit 1
+fi
+OPENCODE_VERSION=0.0.0-ctg.2.0.32 OPENCODE_CHANNEL=ctg.2.0.32 \
+  bun run script/build.ts --single --target="$TARGET" --skip-web-ui --outdir="$ROOT/packages/cli/dist-ctg"
+
+cd "$ROOT"
+artifact="${TARGET#opencode-}"
+binary="$ROOT/packages/cli/dist-ctg/cli-$artifact/bin/$BINARY"
+test -x "$binary"
+"$binary" --version
+cp "$ROOT/LICENSE" "$ROOT/packages/cli/dist-ctg/LICENSE"
+relative_binary="cli-$artifact/bin/$BINARY"
+cd "$ROOT/packages/cli/dist-ctg"
+"${HASH_COMMAND[@]}" "$relative_binary" | tee SHA256SUMS
+cat > ctg-runtime.json <<EOF
+{
+  "owner": "Carthagent",
+  "sourceRepository": "https://github.com/anomalyco/opencode",
+  "sourceRevision": "$EXPECTED_SOURCE",
+  "lockSha256": "$EXPECTED_LOCK",
+  "patchSha256": "$EXPECTED_PATCH",
+  "compatibilityVersion": "2.0.32",
+  "runtimeVersion": "0.0.0-ctg.2.0.32",
+  "channel": "ctg.2.0.32",
+  "platform": "$MANIFEST_PLATFORM",
+  "webUI": false
+}
+EOF

package/tests/budget-engine.test.mjs

@@ -6,8 +6,9 @@ import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from 'nod
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { buildEngineArgs } from '../lib/engine.mjs';
 
-for (const mode of ['tools', 'seconds', 'repairs']) test(`actual engine stops ${mode}, restores budget and accepts explicit reset offline`, { timeout: 120000 }, async t => {
+for (const mode of ['tools', 'seconds', 'repairs']) test(`legacy engine boundary stops ${mode}, restores budget and accepts explicit reset offline`, { timeout: 120000 }, async t => {
   const cwd = mkdtempSync(join(tmpdir(), 'budget café '));
   t.after(() => rmSync(cwd, { recursive: true, force: true }));
   let calls = 0;
@@ -36,7 +37,7 @@ for (const mode of ['tools', 'seconds', 'repairs']) test(`actual engine stops ${
   writeFileSync(join(agent, 'models.json'), JSON.stringify({ providers: { localtest: { baseUrl: `http://127.0.0.1:${server.address().port}/v1`, api: 'openai-completions', apiKey: 'dummy', models: [{ id: 'fixture', contextWindow: 128000, maxTokens: 1024 }] } } }));
   writeFileSync(join(cwd, 'input.txt'), 'café ✓');
   const session = join(cwd, 'session.jsonl');
-  const cli = fileURLToPath(new URL('../bin/ctg.mjs', import.meta.url));
+  const cli = fileURLToPath(new URL('../vendor/agent/cli.js', import.meta.url));
   let beforeRestore = -1;
   let forcedKill = false;
   async function run(prompt, secondsLimit = mode === 'seconds' ? '5' : '10000', expectBudgetStop = false) {
@@ -44,7 +45,7 @@ for (const mode of ['tools', 'seconds', 'repairs']) test(`actual engine stops ${
     let priorEntryCount = 0;
     try { priorEntryCount = readFileSync(session, 'utf8').split('\n').filter(Boolean).length; } catch { /* Initial session has not been created yet. */ }
     let budgetStoppedAt = null;
-    const child = spawn(process.execPath, [cli, '-p', '--no-guide', '--provider', 'localtest', '--model', 'fixture', '--session', session, '--max-tools', mode === 'tools' ? '1' : '0', '--max-seconds', secondsLimit, '--max-repairs', mode === 'repairs' ? '1' : '0', prompt], { cwd, env: { ...process.env, PI_OFFLINE: '1', CARTHAGENT_CODING_AGENT_DIR: agent, PI_CODING_AGENT_DIR: agent } });
+    const child = spawn(process.execPath, [cli, '--offline', '-p', ...buildEngineArgs({ isolate: true, provider: 'localtest', model: 'fixture', session, maxTools: mode === 'tools' ? '1' : '0', maxSeconds: secondsLimit, maxRepairs: mode === 'repairs' ? '1' : '0' }), prompt], { cwd, env: { ...process.env, PI_OFFLINE: '1', CARTHAGENT_CODING_AGENT_DIR: agent, PI_CODING_AGENT_DIR: agent } });
     child.stdin.end();
     let output = ''; child.stdout.on('data', d => output += d); child.stderr.on('data', d => output += d);
     let timer;

package/tests/cli.test.mjs

@@ -1,8 +1,8 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync, writeFileSync, readFileSync, mkdirSync, chmodSync, copyFileSync } from 'node:fs';
+import { mkdtempSync, rmSync, writeFileSync, readFileSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { dirname, join, resolve, delimiter } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { spawnSync } from 'node:child_process';
 import { approveFixture } from './helpers/tested-design.mjs';
@@ -23,6 +23,31 @@ function run(cwd, ...args) {
   return spawnSync(process.execPath, [cli, ...args], { cwd, encoding: 'utf8' });
 }
 
+test('default CLI and its native alias always use the native console, even with the old opt-out variable', t => {
+  const cwd = fixture(t);
+  for (const prefix of [[], ['native']]) {
+    const result = spawnSync(process.execPath, [cli, ...prefix, '--help'], { cwd, encoding: 'utf8', env: { ...process.env, CTG_NATIVE: '0' } });
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /Launch the native Carthagent delivery console/);
+    assert.doesNotMatch(result.stdout, /split-terminal|opt-in native|live plan\.d2 side panel/);
+    assert.match(result.stdout, /ctg service stop/);
+  }
+});
+
+test('native runtime selection never falls back to a legacy engine override', t => {
+  const cwd = fixture(t);
+  const missing = join(cwd, 'missing-native-runtime');
+  const fallback = join(cwd, 'legacy.mjs');
+  const marker = join(cwd, 'legacy-started');
+  writeFileSync(fallback, `import { writeFileSync } from 'node:fs'; writeFileSync(${JSON.stringify(marker)}, 'unexpected');`);
+  const result = spawnSync(process.execPath, [cli, '-p', '--engine-cli', missing, '--no-delivery', '--max-tools', '1', 'Task'], {
+    cwd, encoding: 'utf8', timeout: 10000, env: { ...process.env, CTG_NATIVE: '0', CARTHAGENT_CLI: fallback },
+  });
+  assert.equal(result.status, 1, result.stderr);
+  assert.match(result.stderr, /missing-native-runtime/);
+  assert.throws(() => readFileSync(marker), { code: 'ENOENT' });
+});
+
 test('status reads the newest persisted extension report', t => {
   const cwd = fixture(t);
   createReport(cwd, {
@@ -86,13 +111,17 @@ test('guidance routing is not a user-facing command and Ship account commands ar
   assert.match(result.stdout, /logout-cloud/);
 });
 
-test('Cloud account commands fail closed when no browser session is stored', t => {
+test('native account commands fail closed instead of consuming legacy engine credentials', t => {
   const cwd = fixture(t);
-  const env = { ...process.env, CARTHAGENT_CODING_AGENT_DIR: join(cwd, 'agent'), PI_CODING_AGENT_DIR: join(cwd, 'agent') };
+  const agent = join(cwd, 'legacy-agent');
+  mkdirSync(agent);
+  writeFileSync(join(agent, 'auth.json'), JSON.stringify({ 'experiential-labs': { type: 'api_key', key: 'legacy-fixture-credential' } }));
+  const env = { ...process.env, CTG_OPENCODE_BIN: join(cwd, 'missing-native-runtime'), CARTHAGENT_CODING_AGENT_DIR: agent, PI_CODING_AGENT_DIR: agent };
   for (const args of [['account'], ['billing'], ['logout-cloud']]) {
     const result = spawnSync(process.execPath, [cli, ...args], { cwd, env, encoding: 'utf8' });
     assert.equal(result.status, 1, result.stderr);
-    assert.match(result.stderr, /not signed in/);
+    assert.match(result.stderr, /missing-native-runtime/);
+    assert.doesNotMatch(result.stdout + result.stderr, /legacy-fixture-credential/);
   }
 });
 
@@ -107,69 +136,12 @@ test('review shows and persists the self-review default', t => {
   assert.equal(runEnv('review', 'bogus').status, 2);
 });
 
-/** Fake `gh` + fake engine CLI so `ctg review <pr>` runs end-to-end offline. */
-function reviewFixture(t, verdictLine) {
+test('native review rejects invalid targets and bounds before resolving a host', t => {
   const cwd = fixture(t);
-  const bin = join(cwd, 'bin');
-  mkdirSync(join(cwd, 'bin'), { recursive: true });
-  const gh = join(bin, 'gh');
-  writeFileSync(gh, `#!/bin/sh
-if [ "$1" = "pr" ] && [ "$2" = "view" ]; then echo '{"title":"Fixture PR","url":"https://example.test/pr/14","headRefName":"feat","baseRefName":"main","headRefOid":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}'; exit 0; fi
-exit 0
-`);
-  chmodSync(gh, 0o755);
-  // Native executable fixture: Windows cannot execute a POSIX shebang shim.
-  if (process.platform === 'win32') {
-    copyFileSync(process.execPath, join(bin, 'gh.exe'));
-    writeFileSync(join(cwd, 'gh-preload.cjs'), `if (require('node:path').basename(process.execPath).toLowerCase() === 'gh.exe') { console.log(JSON.stringify({title:'Fixture PR',url:'https://example.test/pr/14',headRefName:'feat',baseRefName:'main',headRefOid:'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'})); process.exit(0); }`);
-  }
-  const reviewer = join(cwd, 'reviewer.mjs');
-  writeFileSync(reviewer, `const prompt = process.argv.at(-1); const snapshot = /snapshot:"([a-f0-9]+)"/.exec(prompt)?.[1]; const head = /head:"([a-f0-9]+)"/.exec(prompt)?.[1]; console.log('fixture findings'); console.log('REVIEW_JSON: ' + JSON.stringify({version:1,snapshot,head,findings:${JSON.stringify(verdictLine.includes('CHANGES-REQUESTED') ? [{file:'app.mjs',line:1,severity:'blocking',issue:'fixture issue',fix:'fixture fix'}] : [])}})); console.log('${verdictLine}');\n`);
-  const env = { ...process.env, CARTHAGENT_CONFIG: join(cwd, 'config.json'), CARTHAGENT_CLI: reviewer, PATH: `${bin}${delimiter}${process.env.PATH}` };
-  if (process.platform === 'win32') env.NODE_OPTIONS = `${env.NODE_OPTIONS || ''} --require ${JSON.stringify(join(cwd, 'gh-preload.cjs'))}`;
-  return { cwd, env };
-}
-
-test('ctg review <pr> exits 0 when the fresh reviewer approves', t => {
-  const { cwd, env } = reviewFixture(t, 'VERDICT: APPROVE');
-  const result = spawnSync(process.execPath, [cli, 'review', '14'], { cwd, env, encoding: 'utf8' });
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /fixture findings/);
-  assert.match(result.stdout, /VERDICT: APPROVE/);
-});
-
-test('ctg review <pr> exits 1 on requested changes and 2 without a verdict', t => {
-  const { cwd, env } = reviewFixture(t, 'VERDICT: CHANGES-REQUESTED');
-  const result = spawnSync(process.execPath, [cli, 'review', '14'], { cwd, env, encoding: 'utf8' });
-  assert.equal(result.status, 1, result.stderr);
-  const silent = reviewFixture(t, 'analysis but no verdict line');
-  const bad = spawnSync(process.execPath, [cli, 'review', '14'], { cwd: silent.cwd, env: silent.env, encoding: 'utf8' });
-  assert.equal(bad.status, 2);
-  assert.match(bad.stderr, /no VERDICT/);
-});
-
-test('review persists admission limits across fresh CLI processes', t => {
-  const { cwd, env } = reviewFixture(t, 'VERDICT: CHANGES-REQUESTED');
-  for (let i = 0; i < 3; i++) {
-    const result = spawnSync(process.execPath, [cli, 'review', '14'], { cwd, env, encoding: 'utf8' });
-    assert.equal(result.status, 1, result.stderr);
-  }
-  const exhausted = spawnSync(process.execPath, [cli, 'review', '14'], { cwd, env, encoding: 'utf8' });
-  assert.equal(exhausted.status, 2);
-  assert.match(exhausted.stderr, /round limit/);
-  assert.doesNotMatch(exhausted.stdout, /fixture findings/);
-});
-
-test('review rejects source mutation and invalid execution bounds', t => {
-  const { cwd, env } = reviewFixture(t, 'VERDICT: APPROVE');
-  writeFileSync(join(cwd, 'reviewer.mjs'), `import {writeFileSync} from 'node:fs'; writeFileSync('changed.txt', 'café'); console.log('VERDICT: APPROVE');`);
-  const changed = spawnSync(process.execPath, [cli, 'review', '14'], { cwd, env, encoding: 'utf8' });
-  assert.equal(changed.status, 2);
-  assert.match(changed.stderr, /snapshot changed/);
-  for (const value of ['0', '301', 'Infinity', 'invalid']) {
-    const invalid = spawnSync(process.execPath, [cli, 'review', '14', '--timeout', value], { cwd, env, encoding: 'utf8' });
-    assert.equal(invalid.status, 2);
-    assert.match(invalid.stderr, /integer from 1 to 300/);
+  for (const args of [['review', 'bogus'], ['review', '14', '--timeout', '0'], ['review', '14', '--timeout', '301'], ['review', '14', '--timeout', 'Infinity'], ['review', '14', '--timeout', 'invalid']]) {
+    const result = run(cwd, ...args);
+    assert.equal(result.status, 2, result.stderr);
+    assert.match(result.stderr, /Invalid review target|integer from 1 to 300/);
   }
 });
 
@@ -194,33 +166,17 @@ test('review modes launch the real bundled engine without unknown flags', t => {
   }
 });
 
-test('ctg --list-models renders stored identity-only Cloud metadata as unknown', t => {
+test('native model listing cannot silently fall back to legacy cached model metadata', t => {
   const cwd = fixture(t);
-  const agentDir = join(cwd, 'agent');
-  mkdirSync(agentDir, { recursive: true });
-  writeFileSync(join(agentDir, 'auth.json'), JSON.stringify({
-    'experiential-labs': { type: 'api_key', key: 'fixture-credential' },
-  }));
-  writeFileSync(join(agentDir, 'models-store.json'), JSON.stringify({
-    'experiential-labs': {
-      models: [{ id: 'carthagent-code', name: 'carthagent-code' }],
-      checkedAt: 1,
-    },
-  }));
-  const result = spawnSync(process.execPath, [cli, '--list-models', 'Carthagent Ship'], {
-    cwd,
-    encoding: 'utf8',
-    env: {
-      ...process.env,
-      PI_OFFLINE: '1',
-      CARTHAGENT_CODING_AGENT_DIR: agentDir,
-      PI_CODING_AGENT_DIR: agentDir,
-    },
-  });
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /Carthagent Ship\s+carthagent-code\s+\?\s+\?\s+\?\s+\?/);
-  assert.doesNotMatch(result.stdout, /experiential/i);
-  assert.doesNotMatch(result.stderr, /Cannot read properties|Failed to load extension/);
+  const agent = join(cwd, 'legacy-agent');
+  mkdirSync(agent);
+  writeFileSync(join(agent, 'models-store.json'), JSON.stringify({ 'experiential-labs': { models: [{ id: 'legacy-only-model' }], checkedAt: 1 } }));
+  const result = spawnSync(process.execPath, [cli, '--list-models'], { cwd, encoding: 'utf8', env: {
+    ...process.env, CTG_OPENCODE_BIN: join(cwd, 'missing-native-runtime'), CARTHAGENT_CODING_AGENT_DIR: agent, PI_CODING_AGENT_DIR: agent,
+  } });
+  assert.equal(result.status, 1, result.stderr);
+  assert.match(result.stderr, /missing-native-runtime/);
+  assert.doesNotMatch(result.stdout, /legacy-only-model/);
 });
 
 test('vendored agent engine is bundled and loads ModelRuntime cleanly', async () => {
@@ -235,11 +191,11 @@ test('vendored agent engine is bundled and loads ModelRuntime cleanly', async ()
   assert.ok(providers.size >= 35);
 });
 
-test('CLI rejects invalid, missing and disabled-extension budget options', t => {
+test('native CLI rejects invalid and missing budget options', t => {
   const cwd = fixture(t);
-  for (const args of [['--max-tools'], ['--max-seconds', 'NaN', 'task'], ['--no-delivery', '--max-tools', '1', 'task']]) {
+  for (const args of [['--max-tools'], ['--max-seconds', 'NaN', 'task'], ['--no-delivery', '--max-tools', '-1', 'task']]) {
     const result = spawnSync(process.execPath, [cli, '-p', ...args], { cwd, encoding: 'utf8', timeout: 10000 });
     assert.equal(result.status, 1, result.stderr);
-    assert.match(result.stderr, /Missing value|must be an integer|require the delivery/);
+    assert.match(result.stderr, /Missing value|must be an integer|non-negative/);
   }
 });

package/tests/cloud-client.test.mjs

@@ -90,7 +90,7 @@ test('Cloud client sends account, billing, and session requests with bearer auth
 
 test('OAuth and account formatters keep token expiration and account UX deterministic', () => {
   assert.deepEqual(oauthCredentials({ accessToken: 'a', refreshToken: 'r', expiresIn: 900 }, 1_000), { access: 'a', refresh: 'r', expires: 901_000 });
-  assert.match(formatCloudAccount({ accountId: 'acct', balance: { availableNanoUsd: 1_000_000_000 }, subscription: { status: 'none' }, sessions: [{}, { revoked_at: 'x' }] }), /Credit: \$1\.00 available[\s\S]*Plan: Free[\s\S]*1 active, 1 revoked/);
+  assert.match(formatCloudAccount({ accountId: 'acct', balance: { availableNanoUsd: 1_000_000_000 }, subscription: { status: 'none' }, sessions: [{}, { revoked_at: 'x' }] }), /Credit: \$1\.00 available[\s\S]*Plan: No paid plan[\s\S]*1 active, 1 revoked/);
   const managed = formatCloudAccount({
     accountId: 'paid', balance: { availableNanoUsd: 8_000_000_000 },
     subscription: { status: 'active', current_period_end: 1_800_000_000 },
@@ -123,7 +123,7 @@ test('OAuth and account formatters keep token expiration and account UX determin
 test('managed usage recovery distinguishes daily, monthly, subscription, and credit paths', () => {
   assert.match(cloudManagedUsageRecovery('daily_limit_reached'), /00:00 UTC/);
   assert.match(cloudManagedUsageRecovery('monthly_allowance_exhausted'), /billing portal/);
-  assert.match(cloudManagedUsageRecovery({ code: 'subscription_inactive' }), /subscription is inactive/);
+  assert.match(cloudManagedUsageRecovery({ code: 'subscription_inactive' }), /awaiting payment or activation/);
   assert.match(cloudManagedUsageRecovery('insufficient_quota'), /billing checkout/);
   assert.equal(cloudManagedUsageRecovery('upstream timeout'), null);
 });

package/tests/daily-evidence.test.mjs

@@ -0,0 +1,62 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { canonicalDailyEvidence, dailyRequest } from '../plugins/carthagent/src/daily-evidence.mjs';
+
+const ID = 'ABCDEF01-2345-6789-ABCD-EF0123456789';
+const REV = 'A'.repeat(40);
+const evidence = () => ({ projectId: ID, outcomeId: ID, runId: ID, revision: REV, goal: '  A goal\r\nline  ', change: 'A change', checks: [{ name: 'test', before: 'failed', after: 'passed', revision: REV, result: 'Observed passing check' }], findings: [{ issue: 'Issue', evidence: 'Observation', resolution: 'Resolved' }] });
+const invalid = value => assert.throws(() => canonicalDailyEvidence(value), { message: 'invalid_daily_evidence' });
+test('canonical evidence has backend field ordering, lowercase identifiers, LF and trim; preserves astral pairs', () => {
+  const e = evidence(); e.change = '\r valid \u{1f680} \r';
+  const c = canonicalDailyEvidence(e);
+  assert.equal(c.goal, 'A goal\nline'); assert.equal(c.change, 'valid \u{1f680}');
+  assert.equal(c.projectId, ID.toLowerCase()); assert.equal(c.revision, REV.toLowerCase());
+  assert.deepEqual(Object.keys(c), ['projectId', 'outcomeId', 'runId', 'revision', 'goal', 'change', 'checks', 'findings']);
+  assert.deepEqual(canonicalDailyEvidence(c), c);
+  assert.deepEqual(dailyRequest(ID, e), { id: ID.toLowerCase(), consent: true, evidence: c });
+  assert.throws(() => dailyRequest('bad-id', e), { message: 'invalid_daily_evidence' });
+});
+test('exact fields, plain data records, dense arrays, limits and enums fail closed', () => {
+  for (const mutate of [
+    e => { e.extra = true; }, e => { delete e.runId; }, e => { e.checks[0].extra = true; }, e => { delete e.findings[0].issue; },
+    e => { e.projectId = 'not-a-uuid'; }, e => { e.revision = 'a'.repeat(41); }, e => { e.checks[0].after = 'ok'; },
+    e => { e.checks[0].before = 'passed'; }, e => { e.checks[0].revision = 'b'.repeat(40); },
+    e => { e.checks = Array(1); }, e => { e.findings = Array(1); }, e => { e.checks.extra = true; },
+    e => { e.checks = Array.from({ length: 13 }, () => e.checks[0]); }, e => { e.findings = Array.from({ length: 6 }, () => e.findings[0]); },
+    e => { Object.defineProperty(e, 'goal', { get() { throw new Error('must not read getter'); }, enumerable: true }); },
+    e => { e.checks = [Object.create(e.checks[0])]; }, e => { e[Symbol('extra')] = true; },
+  ]) { const e = evidence(); mutate(e); invalid(e); }
+  const e = evidence(); e.checks[0].after = 'failed'; e.checks[0].revision = 'b'.repeat(64);
+  assert.equal(canonicalDailyEvidence(e).checks[0].revision.length, 64);
+});
+test('rejects controls and lone surrogates before normalization and bounds UTF8, not character count', () => {
+  for (const value of ['\u0000', '\u000b', '\u001f', '\u007f', '\u0085', '\ud800', '\udfff', 'x\ud800y']) {
+    const e = evidence(); e.goal = value; invalid(e);
+  }
+  for (const [field, limit] of [['goal', 1024], ['change', 3072]]) {
+    const e = evidence(); e[field] = ' '.repeat(limit + 1); invalid(e);
+    e[field] = 'é'.repeat(limit / 2); assert.equal(canonicalDailyEvidence(e)[field], e[field]);
+    e[field] += 'a'; invalid(e);
+  }
+  for (const [collection, index, field, limit] of [['checks', 0, 'name', 160], ['checks', 0, 'result', 1024], ['findings', 0, 'issue', 768], ['findings', 0, 'evidence', 1536], ['findings', 0, 'resolution', 1024]]) {
+    const e = evidence(); e[collection][index][field] = ' '.repeat(limit + 1); invalid(e);
+  }
+});
+test('canonical aggregate evidence limit is exact, includes escaping, request is bounded', () => {
+  const e = evidence(); e.goal = 'g'.repeat(1024); e.change = 'c'.repeat(3072);
+  e.checks = Array.from({ length: 7 }, () => ({ name: 'n', before: 'failed', after: 'passed', revision: REV, result: 'r'.repeat(1024) }));
+  e.findings = [];
+  while (Buffer.byteLength(JSON.stringify(canonicalDailyEvidence({ ...e, checks: e.checks.slice(0, -1) }))) > 12288) e.checks.pop();
+  const base = { ...e, checks: e.checks.slice(0, -1) };
+  let last = canonicalDailyEvidence(base);
+  // Fill another bounded field to find the precise canonical edge.
+  base.findings = [{ issue: '', evidence: '', resolution: '' }];
+  for (let n = 0; n <= 1536; n++) {
+    base.findings[0].evidence = 'x'.repeat(n);
+    try { last = canonicalDailyEvidence(base); } catch {
+      assert.equal(Buffer.byteLength(JSON.stringify(last)), 12288); invalid(base);
+      assert.ok(Buffer.byteLength(JSON.stringify(dailyRequest(ID, last))) <= 16384); return;
+    }
+  }
+  assert.fail('fixture must reach evidence byte boundary');
+});

package/tests/delivery-review.test.mjs

@@ -115,7 +115,7 @@ test('review rejects modified receipts, stale coverage, and cancellation', async
   await assert.rejects(captureDeliveryReview(state, cwd, dir, AbortSignal.abort()), /cancelled/);
 });
 
-test('review accepts filesystem aliases of the Git root but rejects ancestor repositories', async t => {
+test('review accepts filesystem aliases of the Git root and nested workspaces', async t => {
   const { cwd, state } = fixture(t);
   const parent = mkdtempSync(join(tmpdir(), 'review-alias-'));
   t.after(() => rmSync(parent, { recursive: true, force: true }));
@@ -126,7 +126,51 @@ test('review accepts filesystem aliases of the Git root but rejects ancestor rep
   assert.match(capture.diff, /diff --git/);
   const child = join(cwd, 'nested');
   mkdirSync(child);
-  await assert.rejects(captureDeliveryReview(state, child, join(child, '.harness')), /workspace Git root/);
+  writeFileSync(join(child, 'new.txt'), 'nested source');
+  const nested = await captureDeliveryReview(state, child, join(child, '.harness'));
+  assert.match(nested.diff, /nested source/);
+  assert.doesNotMatch(nested.diff, /export const amount|export const result/);
+});
+
+test('nested review scopes tracked, staged, deleted and new files and retains freshness', async t => {
+  const { cwd: root, state, params } = fixture(t);
+  const cwd = join(root, 'app café [one]');
+  mkdirSync(cwd);
+  const git = args => execFileSync('git', args, { cwd: root, stdio: 'pipe' });
+  for (const name of ['changed.txt', 'deleted.txt', 'moved.txt']) writeFileSync(join(cwd, name), 'baseline\n');
+  git(['add', '.']);
+  git(['-c', 'user.name=Test', '-c', 'user.email=test@localhost', 'commit', '-qm', 'Nested baseline']);
+  writeFileSync(join(root, 'app.mjs'), 'OUTSIDE_TRACKED_SECRET');
+  writeFileSync(join(root, 'outside.txt'), 'OUTSIDE_NEW_SECRET');
+  writeFileSync(join(cwd, 'changed.txt'), 'inside staged change\n');
+  git(['add', '.']);
+  git(['mv', 'app café [one]/moved.txt', 'outside-moved.txt']);
+  rmSync(join(cwd, 'deleted.txt'));
+  writeFileSync(join(cwd, 'new café.txt'), 'inside new source');
+  for (const name of ['node_modules', '.harness', 'artifacts']) {
+    mkdirSync(join(cwd, name), { recursive: true });
+    writeFileSync(join(cwd, name, 'noise.txt'), 'EXCLUDED_SECRET');
+  }
+  const capture = await captureDeliveryReview(state, cwd, join(cwd, '.harness', 'review'));
+  assert.match(capture.diff, /inside staged change/);
+  assert.match(capture.diff, /deleted file mode/);
+  assert.match(capture.diff, /inside new source/);
+  assert.match(capture.diff, /a\/moved.txt/);
+  assert.doesNotMatch(capture.diff, /OUTSIDE_|outside-moved|EXCLUDED_SECRET/);
+  state.evidence.unit.fingerprint = fingerprint(cwd, ['.']);
+  recordDeliveryReview(state, cwd, params(capture.id));
+  writeFileSync(join(root, 'outside.txt'), 'outside changes do not stale app review');
+  recordDeliveryReview(state, cwd, params(capture.id));
+  writeFileSync(join(cwd, 'new café.txt'), 'changed after review');
+  assert.throws(() => recordDeliveryReview(state, cwd, params(capture.id)), /stale/);
+});
+
+test('nested review rejects untracked symlinks escaping the workspace', async t => {
+  const { cwd: root, state } = fixture(t);
+  const cwd = join(root, 'nested');
+  mkdirSync(cwd);
+  symlinkSync(join(root, 'app.mjs'), join(cwd, 'escape.mjs'));
+  await assert.rejects(captureDeliveryReview(state, cwd, join(cwd, '.harness')), /outside|escape|symlink/i);
 });
 
 test('large diffs retain full receipt instead of silently using output tail', async t => {
@@ -137,3 +181,14 @@ test('large diffs retain full receipt instead of silently using output tail', as
   assert.ok(readFileSync(capture.path, 'utf8').length > 12000);
   assert.match(capture.diff, /diff --git/);
 });
+
+test('review accepts assertion aliases and names missing requirements', async t => {
+  const { cwd, state, params, dir } = fixture(t);
+  const capture = await captureDeliveryReview(state, cwd, dir);
+  assert.throws(() => recordDeliveryReview(state, cwd, { ...params(capture.id), coverage: [{ requirement: 'Other', assertions: 'x' }] }), /Missing: \["Correct amount"\]/);
+  recordDeliveryReview(state, cwd, { ...params(capture.id), coverage: [{ requirement: 'Correct amount', assertion: 'app amount equals 2' }] });
+  assert.equal(state.reviewEvidence.coverage[0].assertions, 'app amount equals 2');
+  const again = await captureDeliveryReview(state, cwd, dir);
+  recordDeliveryReview(state, cwd, { ...params(again.id), coverage: [{ requirement: 'Correct amount', assertions: ['amount is 2', 'new result is 2'] }] });
+  assert.equal(state.reviewEvidence.coverage[0].assertions, 'amount is 2; new result is 2');
+});

package/tests/delivery.test.mjs

@@ -79,6 +79,28 @@ test('argv execution captures output without shell expansion, including spaces',
   assert.equal(result.code, 0); assert.match(result.output, /literal \$HOME ; echo bad/);
   assert.match(readFileSync(logPath, 'utf8'), /literal/);
 });
+test('runCommand strips runtime transport tokens case-insensitively without mutating parent env', async t => {
+  const cwd = fixture(t);
+  const tokenKeys = ['CTG_RUNTIME_GITHUB_TOKEN', 'ctg_runtime_github_token', 'CtG_RuNtImE_GiThUb_ToKeN'];
+  const original = new Map(tokenKeys.map(key => [key, process.env[key]]));
+  const preservedOriginal = process.env.DELIVERY_ENV_PRESERVED;
+  process.env.DELIVERY_ENV_PRESERVED = 'yes';
+  for (const key of tokenKeys) process.env[key] = 'test-only-marker';
+  t.after(() => {
+    if (preservedOriginal === undefined) delete process.env.DELIVERY_ENV_PRESERVED;
+    else process.env.DELIVERY_ENV_PRESERVED = preservedOriginal;
+    for (const [key, value] of original) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  });
+
+  const script = `const keys = Object.keys(process.env); console.log(JSON.stringify({ tokensAbsent: !keys.some(key => key.toUpperCase() === 'CTG_RUNTIME_GITHUB_TOKEN'), preserved: process.env.DELIVERY_ENV_PRESERVED === 'yes' }));`;
+  const result = await runCommand([process.execPath, '-e', script], { cwd });
+  assert.equal(result.code, 0);
+  assert.deepEqual(JSON.parse(result.output.trim()), { tokensAbsent: true, preserved: true });
+  assert.deepEqual(tokenKeys.map(key => process.env[key]), tokenKeys.map(key => 'test-only-marker'));
+});
 test('nonzero exit and missing executable cannot be successful', async t => {
   const cwd = fixture(t);
   const fail = await runCommand([process.execPath, '-e', 'process.exit(7)'], { cwd, logPath: join(cwd, 'fail.log') });
@@ -340,4 +362,3 @@ test('guidance, prompt template and README document the classification', () => {
   assert.match(readme, /Informational vs delivery asks/);
   assert.match(readme, /advisory/);
 });
-

package/tests/experiential-extension.test.mjs

@@ -31,7 +31,7 @@ test('Cloud extension gives limit-specific recovery without hiding BYOK', () =>
   assert.equal(notices.length, 3);
   assert.match(notices[0][0], /00:00 UTC/);
   assert.match(notices[1][0], /billing portal/);
-  assert.match(notices[2][0], /subscription is inactive/);
+  assert.match(notices[2][0], /awaiting payment or activation/);
   assert.ok(notices.every(([, tone]) => tone === 'warning'));
-  assert.ok(notices.every(([message]) => /\/login for BYOK/.test(message)));
+  assert.ok(notices.every(([message]) => /\/login/.test(message) && /BYOK|your own provider/.test(message)));
 });

package/tests/experiential.test.mjs

@@ -272,7 +272,7 @@ test('registerExperientialProvider registers one shared provider definition', ()
   assert.equal(registerExperientialProvider(runtime), runtime);
   assert.equal(calls.length, 1);
   assert.equal(calls[0].id, 'experiential-labs');
-  assert.equal(calls[0].config.name, 'Carthagent Ship');
+  assert.equal(calls[0].config.name, 'Carthagent Cloud');
 });
 
 test('ModelRuntime resolves EXPLABS_API_KEY without copying it into provider config', async () => {

package/tests/fixtures/native-discovery-plugin/server.ts

@@ -0,0 +1,15 @@
+import { Plugin } from '@opencode/plugin';
+
+export default Plugin.define({
+  id: 'ctg-project-discovery-fixture',
+  setup: async ctx => {
+    const registration = await ctx.command.transform(editor => {
+      editor.add({
+        name: 'fixture-project-plugin-marker',
+        description: 'Proves project-local plugin discovery is active.',
+        execute: async () => { throw new Error('fixture marker command is not intended to execute'); },
+      });
+    });
+    return () => registration.dispose();
+  },
+});