carthagent 1.0.7 → 1.1.0-beta.2

package/tests/runtime-artifact.test.mjs

@@ -0,0 +1,269 @@
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { createServer } from 'node:http';
+import { mkdtemp, mkdir, readFile, readdir, rm, writeFile, chmod } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { once } from 'node:events';
+import { promisify } from 'node:util';
+import { gunzipSync, gzipSync } from 'node:zlib';
+import { after, before, test } from 'node:test';
+import { acquireOwnedRuntime } from '../lib/opencode/runtime-artifact.mjs';
+
+const sourceRevision = '0123456789abcdef0123456789abcdef01234567';
+const patchSha256 = 'a'.repeat(64);
+const lockSha256 = 'b'.repeat(64);
+const version = '9.8.7';
+const targetKey = 'linux-x64';
+const executableRelative = `cli-${targetKey}/bin/opencode`;
+const executableBytes = Buffer.from('#!/bin/sh\necho opencode 9.8.7\n');
+const execFileAsync = promisify(execFile);
+let temp;
+let server;
+let baseUrl;
+let assets = new Map();
+let gets = 0;
+let truncateResponse = false;
+
+before(async () => {
+  temp = await mkdtemp(path.join(os.tmpdir(), 'ctg-runtime-artifact-test-'));
+  server = createServer((request, response) => {
+    gets++;
+    if (request.url === `/releases/${version}/redirect/opencode-${targetKey}.tar.gz`) { response.writeHead(302, { location: `/releases/${version}/opencode-${targetKey}.tar.gz` }).end(); return; }
+    const asset = assets.get(new URL(request.url, 'http://localhost').pathname);
+    if (!asset) { response.writeHead(404).end('not found'); return; }
+    response.writeHead(200, { 'content-length': asset.length });
+    if (truncateResponse) { response.write(asset.subarray(0, Math.floor(asset.length / 2))); response.socket.destroy(); return; }
+    response.end(asset);
+  });
+  server.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+  baseUrl = `http://127.0.0.1:${server.address().port}/releases/${version}`;
+});
+after(async () => {
+  server?.close();
+  await rm(temp, { recursive: true, force: true });
+});
+
+function sha(bytes) { return createHash('sha256').update(bytes).digest('hex'); }
+function octal(value, width) { return Buffer.from(`${value.toString(8).padStart(width - 1, '0')}\0`); }
+function tarEntry(name, data, type = '0', mode = 0o644) {
+  const header = Buffer.alloc(512);
+  header.write(name, 0, 100);
+  octal(mode, 8).copy(header, 100);
+  octal(0, 8).copy(header, 108); octal(0, 8).copy(header, 116);
+  octal(data.length, 12).copy(header, 124); octal(0, 12).copy(header, 136);
+  header.fill(32, 148, 156); header[156] = type.charCodeAt(0);
+  header.write('ustar\0', 257, 6); header.write('00', 263, 2);
+  let checksum = 0; for (const byte of header) checksum += byte;
+  octal(checksum, 8).copy(header, 148);
+  const padding = Buffer.alloc((512 - (data.length % 512)) % 512);
+  return Buffer.concat([header, data, padding]);
+}
+function makeArchive(entries = [], { key = targetKey, platform = 'linux-x64', executableMode = 0o755 } = {}) {
+  const manifest = Buffer.from(JSON.stringify({
+    owner: 'Carthagent', sourceRepository: 'https://github.com/anomalyco/opencode',
+    sourceRevision, lockSha256, patchSha256,
+    compatibilityVersion: '2.0.32', runtimeVersion: '0.0.0-ctg.2.0.32',
+    channel: 'ctg.2.0.32', platform, webUI: false,
+  }));
+  const executablePath = `cli-${key}/bin/${key.startsWith('windows-') ? 'opencode.exe' : 'opencode'}`;
+  const sums = Buffer.from(`${sha(executableBytes)}  ${executablePath}\n`);
+  const all = [
+    tarEntry('./', Buffer.alloc(0), '5'),
+    tarEntry(`./cli-${key}/`, Buffer.alloc(0), '5'),
+    tarEntry(`./cli-${key}/bin/`, Buffer.alloc(0), '5'),
+    tarEntry(`./${executablePath}`, executableBytes, '0', executableMode),
+    tarEntry('SHA256SUMS', sums),
+    tarEntry('ctg-runtime.json', manifest),
+    ...entries,
+    Buffer.alloc(1024),
+  ];
+  return gzipSync(Buffer.concat(all));
+}
+function setArchive(archive) {
+  assets = new Map([[`/releases/${version}/opencode-${targetKey}.tar.gz`, archive]]);
+}
+async function makeSystemTarArchive() {
+  const fixture = path.join(temp, 'system-tar-fixture');
+  const executable = path.join(fixture, executableRelative);
+  await mkdir(path.dirname(executable), { recursive: true });
+  await writeFile(executable, executableBytes);
+  await chmod(executable, 0o755);
+  await writeFile(path.join(fixture, 'SHA256SUMS'), `${sha(executableBytes)}  ${executableRelative}\n`);
+  await writeFile(path.join(fixture, 'ctg-runtime.json'), JSON.stringify({
+    owner: 'Carthagent', sourceRepository: 'https://github.com/anomalyco/opencode',
+    sourceRevision, lockSha256, patchSha256,
+    compatibilityVersion: '2.0.32', runtimeVersion: '0.0.0-ctg.2.0.32',
+    channel: 'ctg.2.0.32', platform: 'linux-x64', webUI: false,
+  }));
+  const archivePath = path.join(temp, 'system-ustar.tar.gz');
+  await execFileAsync('tar', ['-czf', archivePath, '--format=ustar', '-C', fixture, '.']);
+  // Windows tar implementations cannot preserve POSIX source-file mode. Set
+  // the declared USTAR mode on this Unix-target fixture directly so the test
+  // always covers a valid release header, independent of the host filesystem.
+  const tar = gunzipSync(await readFile(archivePath));
+  for (let offset = 0; offset + 512 <= tar.length; offset += 512) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0)) break;
+    const name = header.subarray(0, 100).toString('utf8').replace(/\0.*$/, '');
+    const prefix = header.subarray(345, 500).toString('utf8').replace(/\0.*$/, '');
+    if (`${prefix ? `${prefix}/` : ''}${name}`.replace(/^\.\//, '') !== executableRelative) {
+      const size = Number.parseInt(header.subarray(124, 136).toString('ascii').replace(/\0.*$/, '').trim(), 8) || 0;
+      offset += Math.ceil(size / 512) * 512;
+      continue;
+    }
+    octal(0o755, 8).copy(header, 100);
+    header.fill(32, 148, 156);
+    let checksum = 0; for (const byte of header) checksum += byte;
+    octal(checksum, 8).copy(header, 148);
+    break;
+  }
+  return gzipSync(tar);
+}
+function args(extra = {}) {
+  const key = extra.platform === 'windows' ? `windows-${extra.arch ?? 'x64'}` : targetKey;
+  return {
+    releaseVersion: version, platform: 'linux', arch: 'x64', expectedArchiveSha256: assets.size ? sha(assets.values().next().value) : 'd'.repeat(64),
+    expectedSourceRevision: sourceRevision, expectedPatchSha256: patchSha256,
+    expectedLockSha256: lockSha256, expectedCompatibilityVersion: '2.0.32',
+    expectedRuntimeVersion: '0.0.0-ctg.2.0.32', expectedChannel: 'ctg.2.0.32',
+    expectedExecutableSha256: sha(executableBytes),
+    ...(key !== targetKey ? { platform: 'windows', arch: 'x64', assetName: `opencode-${key}.tar.gz` } : {}),
+    baseUrl, cacheRoot: path.join(temp, 'cache'), ...extra,
+  };
+}
+
+test('downloads, verifies and installs the pinned archive, then uses the revalidated offline cache', async () => {
+  const archive = makeArchive(); setArchive(archive); gets = 0;
+  const destination = await acquireOwnedRuntime(args());
+  assert.equal(path.basename(destination), targetKey);
+  assert.deepEqual(await readFile(path.join(destination, 'cli-linux-x64', 'bin', 'opencode')), executableBytes);
+  assert.deepEqual((await readdir(destination)).sort(), ['SHA256SUMS', 'cli-linux-x64', 'ctg-runtime.json']);
+  assert.equal(gets, 1);
+  assets.clear();
+  assert.equal(await acquireOwnedRuntime(args()), destination);
+  assert.equal(gets, 1);
+});
+
+test('follows a normal release-asset redirect while retaining the pinned digest check', async () => {
+  setArchive(makeArchive());
+  const redirectedUrl = `${baseUrl}/redirect`;
+  const destination = await acquireOwnedRuntime(args({ baseUrl: redirectedUrl, cacheRoot: path.join(temp, 'redirect-cache') }));
+  assert.equal(await readFile(path.join(destination, 'SHA256SUMS'), 'utf8'), `${sha(executableBytes)}  ${executableRelative}\n`);
+});
+
+test('extracts a system tar USTAR artifact in the resolver-compatible root layout', async (t) => {
+  let archive;
+  try { archive = await makeSystemTarArchive(); }
+  catch (error) {
+    if (error.code === 'ENOENT') return t.skip('system tar executable is unavailable');
+    throw error;
+  }
+  setArchive(archive);
+  const destination = await acquireOwnedRuntime(args({ cacheRoot: path.join(temp, 'system-tar-cache') }));
+  assert.deepEqual(await readFile(path.join(destination, 'cli-linux-x64', 'bin', 'opencode')), executableBytes);
+  assert.deepEqual((await readdir(destination)).sort(), ['SHA256SUMS', 'cli-linux-x64', 'ctg-runtime.json']);
+});
+
+test('rejects PAX extensions because release assets are required to use USTAR format', async () => {
+  setArchive(makeArchive([tarEntry('PaxHeaders/entry', Buffer.from('path=cli-linux-x64/bin/opencode\n'), 'x')]));
+  await assert.rejects(acquireOwnedRuntime(args({ cacheRoot: path.join(temp, 'pax-cache') })), /must use USTAR format/);
+});
+
+test('rejects a Unix executable without its USTAR execute bit, regardless of extraction host', async () => {
+  setArchive(makeArchive([], { executableMode: 0o644 }));
+  const platform = Object.getOwnPropertyDescriptor(process, 'platform');
+  try {
+    Object.defineProperty(process, 'platform', { ...platform, value: 'win32' });
+    await assert.rejects(acquireOwnedRuntime(args({ cacheRoot: path.join(temp, 'non-executable-cache') })), /not marked executable/);
+    assert.deepEqual(await readdir(path.join(temp, 'non-executable-cache', '.staging')), []);
+  } finally {
+    Object.defineProperty(process, 'platform', platform);
+  }
+});
+
+test('does not require a POSIX execute bit for a Windows-target executable', async () => {
+  const archive = makeArchive([], { key: 'windows-x64', platform: 'windows-x64', executableMode: 0o644 });
+  assets = new Map([[`/releases/${version}/opencode-windows-x64.tar.gz`, archive]]);
+  const destination = await acquireOwnedRuntime(args({ platform: 'windows', arch: 'x64', cacheRoot: path.join(temp, 'windows-target-cache') }));
+  assert.deepEqual(await readFile(path.join(destination, 'cli-windows-x64', 'bin', 'opencode.exe')), executableBytes);
+});
+
+test('revalidates Unix cached executable mode only on hosts with POSIX file modes', async () => {
+  const archive = makeArchive(); setArchive(archive);
+  const cacheRoot = path.join(temp, 'host-mode-cache');
+  const destination = await acquireOwnedRuntime(args({ cacheRoot }));
+  const executable = path.join(destination, executableRelative);
+  await chmod(executable, 0o600);
+  assets.clear();
+  const platform = Object.getOwnPropertyDescriptor(process, 'platform');
+  try {
+    Object.defineProperty(process, 'platform', { ...platform, value: 'win32' });
+    assert.equal(await acquireOwnedRuntime(args({ cacheRoot })), destination);
+  } finally {
+    Object.defineProperty(process, 'platform', platform);
+  }
+});
+
+test('rejects tampered cached executables and archive digest mismatches without publishing', async () => {
+  const archive = makeArchive(); setArchive(archive);
+  const destination = await acquireOwnedRuntime(args());
+  await writeFile(path.join(destination, 'cli-linux-x64', 'bin', 'opencode'), 'altered');
+  await writeFile(path.join(destination, 'SHA256SUMS'), `${sha(Buffer.from('altered'))}  ${executableRelative}\n`);
+  assets.clear();
+  await assert.rejects(acquireOwnedRuntime(args()), /no system Carthagent runtime fallback was attempted/);
+  setArchive(archive);
+  await assert.rejects(acquireOwnedRuntime(args({ expectedArchiveSha256: 'c'.repeat(64), cacheRoot: path.join(temp, 'bad-digest-cache') })), /SHA-256 mismatch/);
+  await acquireOwnedRuntime(args());
+  assert.deepEqual(await readFile(path.join(destination, 'cli-linux-x64', 'bin', 'opencode')), executableBytes);
+  assert.deepEqual(await readdir(path.join(temp, 'cache', '.staging')), []);
+});
+
+test('rejects traversal and symlink archive entries and cleans staging', async (t) => {
+  for (const [label, badEntry] of [
+    ['traversal', tarEntry('../escape', Buffer.from('escape'))],
+    ['symlink', tarEntry('cli-linux-x64/bin/evil', Buffer.from('../escape'), '2')],
+  ]) {
+    await t.test(label, async () => {
+      setArchive(makeArchive([badEntry]));
+      await assert.rejects(acquireOwnedRuntime(args({ cacheRoot: path.join(temp, `${label}-cache`) })), /unsafe archive path|unsupported link or special entry/);
+      assert.deepEqual(await readdir(path.join(temp, `${label}-cache`, '.staging')), []);
+    });
+  }
+});
+
+test('rejects malformed release coordinates before requesting any asset', async () => {
+  gets = 0;
+  await assert.rejects(acquireOwnedRuntime(args({ releaseVersion: '../latest' })), /exact semantic version/);
+  await assert.rejects(acquireOwnedRuntime(args({ platform: 'plan9' })), /Unsupported/);
+  assert.equal(gets, 0);
+});
+
+test('serializes concurrent acquisition and publishes a single verified cache entry', async () => {
+  setArchive(makeArchive()); gets = 0;
+  const sharedCache = path.join(temp, 'parallel-cache');
+  const [first, second] = await Promise.all([
+    acquireOwnedRuntime(args({ cacheRoot: sharedCache })),
+    acquireOwnedRuntime(args({ cacheRoot: sharedCache })),
+  ]);
+  assert.equal(first, second);
+  assert.equal(gets, 1);
+  assert.deepEqual((await readdir(path.join(sharedCache, version, targetKey))).sort(), ['SHA256SUMS', 'cli-linux-x64', 'ctg-runtime.json']);
+});
+
+test('cleans staging after a failed HTTP request and reports no fallback', async () => {
+  assets.clear();
+  await assert.rejects(acquireOwnedRuntime(args({ cacheRoot: path.join(temp, 'http-fail-cache') })), /no system Carthagent runtime fallback was attempted/);
+  assert.deepEqual(await readdir(path.join(temp, 'http-fail-cache', '.staging')), []);
+});
+
+test('cleans staging after a truncated transfer', async () => {
+  setArchive(makeArchive());
+  truncateResponse = true;
+  try {
+    await assert.rejects(acquireOwnedRuntime(args({ cacheRoot: path.join(temp, 'truncated-cache') })), /no system Carthagent runtime fallback was attempted/);
+    assert.deepEqual(await readdir(path.join(temp, 'truncated-cache', '.staging')), []);
+  } finally { truncateResponse = false; }
+});

package/tests/runtime-development-trust.test.mjs

@@ -0,0 +1,231 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { PassThrough } from 'node:stream';
+import { pathToFileURL } from 'node:url';
+import test from 'node:test';
+import { CTG_RUNTIME_PATCH_SHA256, readRuntimeReleaseManifest } from '../lib/opencode/runtime.mjs';
+import { preflightNativeTestRuntimeArtifact } from '../tools/native-runtime-identity.mjs';
+
+const developmentPatch = 'd'.repeat(64);
+const target = `${process.platform === 'win32' ? 'windows' : process.platform}-${process.arch}`;
+const executableName = process.platform === 'win32' ? 'opencode.exe' : 'opencode';
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+
+// Rewrite just the development pin in a private package copy. Release and
+// development are intentionally distinct even while the checked-in pins match.
+// No process environment or built-in module mocks affect other test suites.
+async function fixture(t, patchSha256 = developmentPatch) {
+  const root = await mkdtemp(path.join(tmpdir(), 'ctg-development-trust-'));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const packageRoot = path.join(root, 'package');
+  const moduleRoot = path.join(packageRoot, 'lib/opencode');
+  await mkdir(moduleRoot, { recursive: true });
+  for (const name of ['runtime.mjs', 'runtime-artifact.mjs', 'runtime-github-transport.mjs']) {
+    let source = await readFile(new URL(`../lib/opencode/${name}`, import.meta.url), 'utf8');
+    if (name === 'runtime.mjs') {
+      const declaration = /export const CTG_DEVELOPMENT_RUNTIME_PATCH_SHA256 = '[a-f0-9]{64}';/g;
+      assert.equal([...source.matchAll(declaration)].length, 1);
+      source = source.replace(declaration, `export const CTG_DEVELOPMENT_RUNTIME_PATCH_SHA256 = '${developmentPatch}';`);
+    }
+    await writeFile(path.join(moduleRoot, name), source);
+  }
+  await writeFile(path.join(packageRoot, 'package.json'), await readFile(new URL('../package.json', import.meta.url)));
+  const runtime = await import(pathToFileURL(path.join(moduleRoot, 'runtime.mjs')).href);
+  assert.notEqual(runtime.CTG_DEVELOPMENT_RUNTIME_PATCH_SHA256, runtime.CTG_RUNTIME_PATCH_SHA256);
+  const ownedRoot = path.join(root, 'owned');
+  const relativeExecutable = `cli-${target}/bin/${executableName}`;
+  const binary = path.join(ownedRoot, relativeExecutable);
+  const payload = Buffer.from('independently hashed runtime fixture');
+  const digest = sha256(payload);
+  const manifest = {
+    owner: 'Carthagent', sourceRepository: 'https://github.com/anomalyco/opencode',
+    sourceRevision: runtime.CTG_RUNTIME_SOURCE, lockSha256: runtime.CTG_RUNTIME_LOCK_SHA256,
+    patchSha256, compatibilityVersion: runtime.OPENCODE_VERSION,
+    runtimeVersion: runtime.CTG_RUNTIME_VERSION, channel: `ctg.${runtime.OPENCODE_VERSION}`,
+    platform: target, webUI: false,
+  };
+  await mkdir(path.dirname(binary), { recursive: true });
+  await writeFile(binary, payload, { mode: 0o755 });
+  const writeManifest = value => writeFile(path.join(ownedRoot, 'ctg-runtime.json'), JSON.stringify(value));
+  const writeSums = (hash = digest, name = relativeExecutable) => writeFile(path.join(ownedRoot, 'SHA256SUMS'), `${hash}  ${name}\n`);
+  await writeManifest(manifest);
+  await writeSums();
+  const release = JSON.parse(await readFile(new URL('../lib/opencode/runtime-release.json', import.meta.url), 'utf8'));
+  for (const asset of Object.values(release.assets)) asset.executableSha256 = digest;
+  const releasePath = path.join(moduleRoot, 'runtime-release.json');
+  await writeFile(releasePath, JSON.stringify(release));
+  const calls = [];
+  const spawns = [];
+  const spawnVersion = version => (command, args, options) => {
+    spawns.push({ command, args, options });
+    const child = new EventEmitter();
+    child.stdout = new PassThrough();
+    child.stderr = new PassThrough();
+    child.kill = () => {};
+    queueMicrotask(() => {
+      child.stdout.end(`${version}\n`);
+      child.stderr.end();
+      child.emit('close', 0);
+    });
+    return child;
+  };
+  const spawnImpl = spawnVersion(`opencode v${runtime.CTG_RUNTIME_VERSION}`);
+  const publicOptions = {
+    spawnImpl,
+    acquireOwnedRuntime: async input => { calls.push(input); return ownedRoot; },
+  };
+  return { root, runtime, ownedRoot, binary, payload, digest, relativeExecutable, manifest, release, releasePath,
+    writeManifest, writeSums, calls, spawns, spawnVersion, spawnImpl, publicOptions };
+}
+
+test('packaged release trust stays valid independently of the development patch pin', async t => {
+  assert.equal(CTG_RUNTIME_PATCH_SHA256, 'ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975');
+  const published = await readRuntimeReleaseManifest();
+  const packageJson = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
+  assert.equal(published.releaseVersion, packageJson.version);
+  const f = await fixture(t, CTG_RUNTIME_PATCH_SHA256);
+  assert.deepEqual(await f.runtime.readRuntimeReleaseManifest(f.releasePath), f.release);
+  assert.equal(await f.runtime.resolveOpenCode(f.publicOptions), f.binary);
+  const [acquisition] = f.calls;
+  assert.equal(acquisition.expectedPatchSha256, CTG_RUNTIME_PATCH_SHA256);
+  assert.equal(acquisition.expectedSourceRevision, f.runtime.CTG_RUNTIME_SOURCE);
+  assert.equal(acquisition.expectedLockSha256, f.runtime.CTG_RUNTIME_LOCK_SHA256);
+  assert.equal(acquisition.expectedArchiveSha256, f.release.assets[target].archiveSha256);
+  assert.equal(acquisition.expectedExecutableSha256, f.digest);
+  assert.equal(acquisition.expectedCompatibilityVersion, f.runtime.OPENCODE_VERSION);
+  assert.equal(acquisition.expectedRuntimeVersion, f.runtime.CTG_RUNTIME_VERSION);
+  assert.equal(acquisition.expectedChannel, f.manifest.channel);
+  assert.equal(acquisition.baseUrl, `https://github.com/B-icy/Carthagent/releases/download/v${packageJson.version}`);
+  const identity = await f.runtime.runtimeIdentity(f.binary, f.publicOptions);
+  assert.equal(identity.kind, 'ctg-owned');
+  assert.equal(identity.patchSha256, CTG_RUNTIME_PATCH_SHA256);
+  assert.equal(f.publicOptions.ownedRuntime, undefined);
+});
+
+test('default acquisition rejects development provenance even with matching pinned executable bytes', async t => {
+  const f = await fixture(t);
+  await assert.rejects(f.runtime.resolveOpenCode(f.publicOptions), /not compatible with the pinned/);
+  assert.equal(f.calls[0].expectedPatchSha256, CTG_RUNTIME_PATCH_SHA256);
+  assert.equal(f.spawns.length, 0, 'development provenance is rejected before executing --version');
+});
+
+test('public release manifest cannot promote the development pin or unpinned provenance', async t => {
+  const f = await fixture(t);
+  for (const changes of [
+    { patchSha256: developmentPatch }, { sourceRevision: 'e'.repeat(40) },
+    { lockSha256: 'e'.repeat(64) }, { runtimeVersion: '0.0.0-ctg.2.0.33' },
+    { compatibilityVersion: '2.0.33' }, { releaseVersion: '1.1.0-preview.14' },
+  ]) {
+    await writeFile(f.releasePath, JSON.stringify({ ...f.release, ...changes }));
+    await assert.rejects(f.runtime.resolveOpenCode(f.publicOptions), /Invalid or incompatible.*release manifest/);
+  }
+  assert.equal(f.calls.length, 0, 'invalid release metadata never reaches acquisition');
+  assert.equal(f.spawns.length, 0);
+});
+
+test('default resolution rechecks the release executable pin, not a rewritten adjacent SHA256SUMS', async t => {
+  const f = await fixture(t, CTG_RUNTIME_PATCH_SHA256);
+  assert.equal(await f.runtime.resolveOpenCode(f.publicOptions), f.binary);
+  await writeFile(f.binary, 'development executable bytes');
+  await f.writeSums(sha256('development executable bytes'));
+  await assert.rejects(f.runtime.resolveOpenCode(f.publicOptions), /pinned executable SHA-256 mismatch/);
+  assert.equal(f.calls.length, 2);
+  assert.equal(f.spawns.length, 1, 'changed bytes rejected before a second version execution');
+  assert.equal(f.publicOptions.ownedRuntime, undefined);
+});
+
+test('explicit roots accept release and development provenance without consulting public release metadata', async t => {
+  for (const patchSha256 of [CTG_RUNTIME_PATCH_SHA256, developmentPatch]) {
+    const f = await fixture(t, patchSha256);
+    // An explicit root does not turn this adjacent test record into a pin.
+    await writeFile(f.releasePath, JSON.stringify({ patchSha256: 'f'.repeat(64) }));
+    const options = { ...f.publicOptions, ownedRuntime: f.ownedRoot };
+    assert.equal(await f.runtime.resolveOpenCode(options), f.binary);
+    assert.equal(await f.runtime.resolveOwnedOpenCode(f.ownedRoot, { spawnImpl: f.spawnImpl }), f.binary);
+    const identity = await f.runtime.runtimeIdentity(f.binary, options);
+    assert.equal(identity.patchSha256, patchSha256);
+    assert.equal(identity.binarySha256, f.digest);
+    assert.equal(identity.kind, 'ctg-owned');
+    assert.equal(f.calls.length, 0);
+  }
+});
+
+test('explicit development roots retain every pinned provenance and host-platform check', async t => {
+  const f = await fixture(t);
+  for (const [field, value, error] of [
+    ['owner', 'Other', /not compatible/],
+    ['sourceRepository', 'https://example.test/opencode', /not compatible/],
+    ['sourceRevision', 'f'.repeat(40), /not compatible/],
+    ['patchSha256', 'f'.repeat(64), /not compatible/],
+    ['lockSha256', 'f'.repeat(64), /not compatible/],
+    ['compatibilityVersion', '2.0.33', /not compatible/],
+    ['runtimeVersion', '0.0.0-ctg.2.0.33', /not compatible/],
+    ['channel', 'latest', /not compatible/],
+    ['webUI', true, /not compatible/],
+    ['platform', 'other-platform', /does not match this host/],
+  ]) {
+    await f.writeManifest({ ...f.manifest, [field]: value });
+    // A matching adjacent "trusted" record must not bless arbitrary metadata.
+    await writeFile(f.releasePath, JSON.stringify({ ...f.release, [field]: value }));
+    await assert.rejects(f.runtime.resolveOwnedOpenCode(f.ownedRoot, { spawnImpl: f.spawnImpl }), error, field);
+  }
+  assert.equal(f.spawns.length, 0);
+});
+
+test('explicit development roots require exact executable layout, actual hash, checksum entry, and version', async t => {
+  const f = await fixture(t);
+  const options = { ownedRuntime: f.ownedRoot, spawnImpl: f.spawnImpl };
+  await writeFile(f.binary, 'tampered bytes');
+  await assert.rejects(f.runtime.resolveOpenCode(options), /executable SHA-256 mismatch/);
+  await writeFile(f.binary, f.payload);
+  await f.writeSums(f.digest, `cli-${target}/bin/not-opencode`);
+  await assert.rejects(f.runtime.resolveOpenCode(options), /checksum does not list/);
+  await rm(path.join(f.ownedRoot, 'SHA256SUMS'));
+  await assert.rejects(f.runtime.resolveOpenCode(options), /checksums are missing/);
+  await f.writeSums();
+  await writeFile(path.join(path.dirname(f.binary), 'not-opencode'), f.payload);
+  await rm(f.binary);
+  await assert.rejects(f.runtime.resolveOpenCode(options), /executable is missing/);
+  assert.equal(f.spawns.length, 0);
+  await writeFile(f.binary, f.payload);
+  for (const version of ['opencode v2.0.32', 'opencode v9.0.0-ctg.2.0.32', `opencode v${f.runtime.CTG_RUNTIME_VERSION} extra`]) {
+    await assert.rejects(f.runtime.resolveOpenCode({ ...options, spawnImpl: f.spawnVersion(version) }), /identity mismatch/);
+  }
+});
+
+test('explicit binary remains upstream-compatible and takes precedence over an owned root', async t => {
+  const f = await fixture(t);
+  await f.writeManifest({ ...f.manifest, patchSha256: 'f'.repeat(64) });
+  const options = { binary: f.binary, ownedRuntime: f.ownedRoot,
+    spawnImpl: f.spawnVersion(`opencode v${f.runtime.OPENCODE_VERSION}`) };
+  assert.equal(await f.runtime.resolveOpenCode(options), f.binary);
+  const identity = await f.runtime.runtimeIdentity(f.binary, options);
+  assert.equal(identity.kind, 'upstream-compatible');
+  assert.equal(identity.version, f.runtime.OPENCODE_VERSION);
+});
+
+test('native preflight requires independently supplied development provenance and bytes, not released metadata', async t => {
+  const f = await fixture(t);
+  const testManifestPath = path.join(f.root, 'trusted-development-test.json');
+  const options = { ownedRoot: f.ownedRoot, expectedManifestPath: testManifestPath, env: {}, spawnImpl: f.spawnImpl };
+  await writeFile(testManifestPath, JSON.stringify(f.release));
+  await assert.rejects(preflightNativeTestRuntimeArtifact(options), /patchSha256 mismatch/);
+  assert.equal(f.spawns.length, 0);
+  const developmentManifest = { ...f.release, patchSha256: developmentPatch };
+  await writeFile(testManifestPath, JSON.stringify(developmentManifest));
+  const result = await preflightNativeTestRuntimeArtifact(options);
+  assert.deepEqual(result.expectedManifest, developmentManifest);
+  assert.equal(result.identity.patchSha256, developmentPatch);
+  assert.equal(result.identity.binarySha256, f.digest);
+  assert.equal(await f.runtime.resolveOpenCode({ ownedRuntime: f.ownedRoot, spawnImpl: f.spawnImpl }), f.binary);
+  await writeFile(testManifestPath, JSON.stringify({ ...developmentManifest, patchSha256: 'f'.repeat(64) }));
+  await assert.rejects(preflightNativeTestRuntimeArtifact({ ...options, env: { CTG_TEST_RUNTIME_SHA256: f.digest } }), /patchSha256 mismatch/);
+  await writeFile(testManifestPath, JSON.stringify(developmentManifest));
+  await writeFile(f.binary, 'unreviewed rebuild');
+  await assert.rejects(preflightNativeTestRuntimeArtifact(options), /binary SHA-256 mismatch/);
+  assert.equal((await readRuntimeReleaseManifest()).patchSha256, CTG_RUNTIME_PATCH_SHA256);
+});

package/tests/runtime-github-transport.test.mjs

@@ -0,0 +1,132 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createRuntimeGithubFetch } from '../lib/opencode/runtime-github-transport.mjs';
+
+const token = 'fixture-token-never-real';
+const base = 'https://github.com/B-icy/Carthagent/releases/download/v9.8.7';
+const api = 'https://api.github.com/repos/B-icy/Carthagent';
+const runtimeAsset = 'opencode-linux-x64.tar.gz';
+
+test('draft transport uses bounded paginated exact-tag and exact-asset API GETs', async () => {
+  const requests = [];
+  const fetchImpl = async (input, init) => {
+    const url = new URL(input);
+    requests.push({ url, init });
+    if (url.pathname === '/repos/B-icy/Carthagent/releases') {
+      if (url.searchParams.get('page') === '1') return Response.json(Array.from({ length: 100 }, (_, index) => ({ id: index + 1, tag_name: `v0.0.${index}` })));
+      return Response.json([{ id: 88, tag_name: 'v9.8.7' }]);
+    }
+    if (url.pathname === '/repos/B-icy/Carthagent/releases/88/assets') {
+      if (url.searchParams.get('page') === '1') return Response.json(Array.from({ length: 100 }, (_, index) => ({ id: index + 200, name: `other-${index}` })));
+      return Response.json([{ id: 777, name: runtimeAsset, state: 'uploaded', size: 5, url: `${api}/releases/assets/777` }]);
+    }
+    if (url.pathname === '/repos/B-icy/Carthagent/releases/assets/777') return new Response('bytes');
+    assert.fail(`Unexpected URL ${url.href}`);
+  };
+  const fetch = createRuntimeGithubFetch({ token, fetchImpl });
+  const response = await fetch(`${base}/${runtimeAsset}`, { redirect: 'manual' });
+  assert.equal(await response.text(), 'bytes');
+  assert.equal(requests.length, 5);
+  assert.deepEqual(requests.map(({ url }) => url.searchParams.get('page')), ['1', '2', '1', '2', null]);
+  for (const { init } of requests) {
+    assert.equal(init.method, 'GET');
+    assert.equal(init.headers.authorization, `Bearer ${token}`);
+    assert.equal(init.redirect, 'manual');
+  }
+});
+
+test('asset redirect is fetched without forwarding GitHub authorization', async () => {
+  const requests = [];
+  const fetchImpl = async (input, init) => {
+    const url = new URL(input);
+    requests.push({ url, init });
+    if (url.pathname === '/repos/B-icy/Carthagent/releases') return Response.json([{ id: 88, tag_name: 'v9.8.7' }]);
+    if (url.pathname === '/repos/B-icy/Carthagent/releases/88/assets') return Response.json([{ id: 777, name: runtimeAsset, state: 'uploaded', size: 5, url: `${api}/releases/assets/777` }]);
+    if (url.pathname === '/repos/B-icy/Carthagent/releases/assets/777') return new Response(null, { status: 302, headers: { location: 'https://cdn.example.test/signed?id=1' } });
+    if (url.origin === 'https://cdn.example.test') return new Response('bytes');
+    assert.fail(`Unexpected URL ${url.href}`);
+  };
+  const fetch = createRuntimeGithubFetch({ token, fetchImpl });
+  const first = await fetch(`${base}/${runtimeAsset}`, { redirect: 'manual' });
+  assert.equal(first.status, 302);
+  const redirected = await fetch(first.headers.get('location'), { redirect: 'manual' });
+  assert.equal(await redirected.text(), 'bytes');
+  assert.equal(requests.length, 4);
+  assert.ok(requests.slice(0, 3).every(({ init }) => init.headers.authorization === `Bearer ${token}`));
+  assert.equal(requests[3].init.headers?.authorization, undefined);
+});
+
+test('explicit transport fails closed for absent, duplicate, malformed, or unavailable exact release', async () => {
+  const cases = [
+    { releases: [], message: /release was not found/ },
+    { releases: [{ id: 1, tag_name: 'v9.8.7' }, { id: 2, tag_name: 'v9.8.7' }], message: /duplicate exact-version/ },
+    { releases: [{ id: '88', tag_name: 'v9.8.7' }], message: /invalid exact-version/ },
+    { failure: true, message: /failed before a response/ },
+  ];
+  for (const item of cases) {
+    const fetch = createRuntimeGithubFetch({ token, fetchImpl: async () => {
+      if (item.failure) throw new Error(`request leaked ${token}`);
+      return Response.json(item.releases);
+    } });
+    await assert.rejects(fetch(`${base}/${runtimeAsset}`), (error) => {
+      assert.match(error.message, item.message);
+      assert.equal(error.message.includes(token), false);
+      return true;
+    });
+  }
+});
+
+test('rejects unexpected and duplicate exact assets without downloading bytes', async () => {
+  for (const [assets, message] of [
+    [[], /asset .* was not found/],
+    [[777, 778].map((id) => ({ id, name: runtimeAsset, state: 'uploaded', size: 5, url: `${api}/releases/assets/${id}` })), /duplicate .* assets/],
+  ]) {
+    const fetch = createRuntimeGithubFetch({ token, fetchImpl: async (input) => {
+      const url = new URL(input);
+      if (url.pathname === '/repos/B-icy/Carthagent/releases') return Response.json([{ id: 88, tag_name: 'v9.8.7' }]);
+      if (url.pathname === '/repos/B-icy/Carthagent/releases/88/assets') return Response.json(assets);
+      assert.fail('asset body must not be requested for invalid metadata');
+    } });
+    await assert.rejects(fetch(`${base}/${runtimeAsset}`), message);
+  }
+});
+
+test('rejects malformed asset id, URL, state, and size before requesting the asset body', async () => {
+  for (const asset of [
+    { id: 0, url: `${api}/releases/assets/0`, state: 'uploaded', size: 5 },
+    { id: 777, url: 'https://attacker.example/asset', state: 'uploaded', size: 5 },
+    { id: 777, url: `${api}/releases/assets/777`, state: 'starter', size: 5 },
+    { id: 777, url: `${api}/releases/assets/777`, state: 'uploaded', size: -1 },
+  ]) {
+    const fetch = createRuntimeGithubFetch({ token, fetchImpl: async (input) => {
+      const url = new URL(input);
+      if (url.pathname === '/repos/B-icy/Carthagent/releases') return Response.json([{ id: 88, tag_name: 'v9.8.7' }]);
+      if (url.pathname === '/repos/B-icy/Carthagent/releases/88/assets') return Response.json([{ ...asset, name: runtimeAsset }]);
+      assert.fail('malformed asset metadata must block the binary request');
+    } });
+    await assert.rejects(fetch(`${base}/${runtimeAsset}`), /invalid metadata/);
+  }
+});
+
+test('rejects API metadata redirects without following or forwarding authorization', async () => {
+  const calls = [];
+  const fetch = createRuntimeGithubFetch({ token, fetchImpl: async (input, init) => {
+    calls.push({ url: String(input), init });
+    return new Response(null, { status: 302, headers: { location: 'https://api.github.com/elsewhere' } });
+  } });
+  await assert.rejects(fetch(`${base}/${runtimeAsset}`), /unexpectedly redirected/);
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].init.headers.authorization, `Bearer ${token}`);
+});
+
+test('only canonical fixed-repository runtime asset URLs enter authenticated transport', async () => {
+  const calls = [];
+  const fetch = createRuntimeGithubFetch({ token, fetchImpl: async (url, init) => {
+    calls.push({ url: String(url), init });
+    return new Response('ordinary');
+  } });
+  await fetch('https://example.test/asset');
+  await fetch(`${base}/untrusted.tar.gz`);
+  assert.equal(calls.length, 2);
+  assert.ok(calls.every(({ init }) => init.headers?.authorization === undefined));
+});

package/tests/runtime-token-env.test.mjs

@@ -0,0 +1,23 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { withoutRuntimeGithubToken } from '../tools/runtime-token-env.mjs';
+
+test('npm child environment removes runtime download token case-insensitively and preserves PATH', () => {
+  const original = {
+    PATH: '/fixture/path',
+    Path: '/fixture/windows-path',
+    LANG: 'C.UTF-8',
+    CTG_RUNTIME_GITHUB_TOKEN: 'fake-uppercase-token',
+    ctg_runtime_github_token: 'fake-lowercase-token',
+    Ctg_Runtime_Github_Token: 'fake-mixedcase-token',
+    CTG_RUNTIME_OTHER: 'unrelated-runtime-value',
+  };
+  const result = withoutRuntimeGithubToken(original);
+  assert.deepEqual(result, {
+    PATH: '/fixture/path',
+    Path: '/fixture/windows-path',
+    LANG: 'C.UTF-8',
+    CTG_RUNTIME_OTHER: 'unrelated-runtime-value',
+  });
+  assert.equal(original.ctg_runtime_github_token, 'fake-lowercase-token', 'sanitizer must not mutate the caller environment');
+});