carthagent 1.0.7 → 1.1.0-preview.12

package/docs/release-notes-native-draft.md

@@ -0,0 +1,73 @@
+# Draft release notes: native OpenCode migration
+
+> **UNRELEASED — draft only.** Planned version: **1.1.0**. No tag or release
+> has been published.
+> This document is not a release announcement and does not imply that the
+> native default switch or full product acceptance is complete. The packaged
+> five-platform runtime manifest is a reviewed candidate; publishing assets
+> and passing release gates are still pending.
+
+## Proposed highlights (subject to acceptance)
+
+- Native OpenCode project, task, worktree, and session workflow with Carthagent
+  delivery status and workspace context.
+- Carthagent-owned OpenCode runtime and profile, isolated from the user's normal
+  OpenCode configuration, service, credentials, data, and sessions.
+- Headless execution with text output or selected-session JSONL lifecycle
+  events, plus workspace delivery status in JSON.
+- Read-only access to legacy Pi transcripts through archive list, search, read,
+  and export commands. No transcript import or continuation is provided.
+- Existing command names and aliases retained where supported by the native
+  CLI compatibility layer.
+
+## Migration and compatibility notes
+
+- In this candidate, native execution remains opt-in with `CTG_NATIVE=1`.
+  Without the variable, the existing CLI remains the default. Making native
+  execution the default is pending UI tests and the remaining migration and
+  release acceptance gates; do not set the variable persistently unless that
+  routing is intentional.
+- The native runtime uses the package-owned OpenCode 2.0.32 executable and CTG's
+  isolated profile. It does not update or reuse regular OpenCode installations
+  or credentials.
+- Legacy Pi session files are read-only archives; they cannot be resumed,
+  continued, or imported as native OpenCode sessions.
+- Unsupported options fail closed. In the current adapter, `--bash-cap` and
+  `--isolate` are unsupported, and budget or policy options require advertised
+  enforcement capabilities.
+- Acceptance is not complete. See the [migration ledger](opencode-migration.md),
+  [compatibility matrix](native-compatibility.md), and
+  [terminal evidence status](native-terminal-semantics.md#evidence-status-pr-162)
+  for unresolved gates. Do not describe this migration as generally available
+  until release ownership confirms those gates and the installed product.
+
+## Install/update (for a future published release only)
+
+After the planned release passes acceptance and is published, the
+documented exact-tag npm installation form is:
+
+```sh
+npm install -g --install-links=true github:B-icy/Carthagent#vX.Y.Z
+```
+
+Replace the placeholder only with the real published release tag. Version
+`1.1.0` is planned, but no final tag has been created. This candidate packages
+the reviewed immutable owned-runtime manifest for five platforms, pinned to
+OpenCode source revision `843a6c514e606b436a7fe713422ace0a93ad3d61` and runtime
+identity `0.0.0-ctg.2.0.32`. The assets still need to accompany a draft release
+and pass final release verification and installed acceptance. The composed
+preview resolves upstream `@opencode/cli@2.0.32` through Node's package resolver,
+including npm-hoisted layouts; that preview dependency is distinct from CTG's
+owned runtime identity. Performance, UI tests, native-default acceptance, and
+full installed acceptance remain open in the
+[migration ledger](opencode-migration.md#delivery-ledger).
+The shared native update operation supports npm-installed packages and clean
+source clones: for a clone it fetches the selected origin tag into a private ref
+before checking out its resolved commit, and refuses dirty clones. Do not infer
+that every native command surface is wired to this operation. `ctg update`
+updates Carthagent, not a user's regular OpenCode installation, and does not
+change the native opt-in default. See the
+[upgrade guide](native-upgrade.md#release-installation-and-update) for the
+current command-path distinction. Native migration acceptance remains open; do
+not infer completion of unrelated CLI, UI, or transport follow-ups not yet
+composed here.

package/docs/release-notes-preview.10.md

@@ -0,0 +1,121 @@
+# 1.1.0-preview.10 release candidate
+
+> **NOT YET PUBLISHED — candidate guidance, not a release announcement.**
+> Published preview.9 remains immutable. This candidate still needs its final
+> tag, draft/assets, exact-tag installed default-resolver acceptance, public
+> release, and anonymous public default-resolver acceptance. No stable release
+> or stable control-plane update is part of this candidate.
+
+## What changes
+
+Native remains the default `ctg` interface; `ctg native` is a compatibility
+alias. Ship retains approval, checks, review, repair, recovery and resume; Lite
+remains direct execution. Stable 1.0.7 retains the legacy console, and legacy
+Pi transcripts remain read-only archives. The owned native profile remains
+separate from other coding-tool credentials and sessions.
+
+**Native daily coding quests (PR #227)** are available through `/voyages` →
+**Daily coding quests**, using normal Carthagent Ship device sign-in:
+
+- Select a server assignment and individual evidence from an owned session's
+  exact active Ship report, or supply a clearly labeled manual claim. Nothing
+  is selected by default. Edit/redact sensitive text yourself; there is no
+  automatic secret-scrubbing guarantee or whole-project/transcript upload.
+- Inspect the complete canonical outbound JSON. Editing invalidates that exact
+  preview. Submission requires fresh, explicit consent for this request and
+  disclosure of external **JEV** processing. Login or completing local delivery
+  is not consent; cancel does not send. Identity/connection/location invalidation
+  clears the draft/consent and returns the action selection to **Refresh**.
+- The exact request and stable submission ID are durably journaled before send.
+  Recover an uncertain send by **GET/status first**; read-only refresh/poll never
+  replays. Any explicit replay uses the saved ID and exact body, not a new ID.
+  Journal failure fails closed; accepted IDs remain usable across restart.
+- Acceptance is not completion. Local raw payloads are erased on known
+  acceptance; unknown-send payloads expire after up to 24 hours on journal
+  access, not a background timer. Explicit local erasure retains polling IDs
+  and cannot withdraw evidence already sent. Backend raw evidence is erased
+  on terminal processing (pending up to 24 hours; outages can delay cleanup);
+  metadata retention is 90 days. Immediate provider/backup deletion is not promised.
+- Graded decisions assess submitted evidence, **not independent verification**.
+  Scores are not calibrated confidence. There are **no coins, XP, distance,
+  inventory or other rewards**; personal quests remain separate.
+
+See [native daily quest guidance](native-daily-quests.md) for schema, privacy,
+retention, consent and recovery details.
+
+## Candidate provenance
+
+| Input | Exact value |
+| --- | --- |
+| Package candidate | `1.1.0-preview.10` |
+| Feature source head | `5e759c4c4d21b1df10ecdcd130ad59cd377bcc15` |
+| Original prebuild source | `7a9d49fe7e2dcc8358a4c28e3539479df5be55a1` |
+| Prebuild workflow run | `40950483282` |
+| Full manifest SHA-256 | `2d4adee543f5dec37abf8a67c677cecfc5de294031a1c37d23fea43bc90fe757` |
+| Upstream revision | `843a6c514e606b436a7fe713422ace0a93ad3d61` |
+| CTG patch SHA-256 | `b4238d77827d7ccf8f87fb0326551eaa62268d9387cd89e29bd0cf12bd6dafaa` |
+| Lock SHA-256 | `9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d` |
+| Runtime / compatibility | `0.0.0-ctg.2.0.32` / `2.0.32` |
+
+All five prebuilds succeeded: Linux x64/arm64, macOS x64/arm64 and Windows x64.
+The original **13-file bundle** was independently verified through the
+production acquirer, with byte-identical manifest regeneration. Runtime,
+upstream, patch and lock identities are unchanged, but this manifest pins the
+**fresh five-platform archive and executable hashes**, not preview.9 hashes.
+Prebuild provenance is not final package identity or installed acceptance.
+
+## Recorded evidence and limits
+
+These are supplied source/development-runtime results, not tests rerun by this
+version/docs preparation and not exact-candidate installed acceptance.
+
+- **Source quality at `5e759c4`: 1,069 passed, 0 failed, 5 skipped.** The first
+  historical quality run had 1,068 passed, 1 failed, 5 skipped: a legacy
+  dashboard 401-versus-403 assertion of unknown cause. Isolated and serial runs
+  passed; that does not establish a causal fix. Feature-head normal
+  [PR CI40951839410](https://github.com/B-icy/Carthagent/actions/runs/40951839410)
+  and [push CI40951831992](https://github.com/B-icy/Carthagent/actions/runs/40951831992)
+  both passed all eight jobs. Release-candidate CI remains a separate gate.
+- **Actual native daily flow:** one authorized provider attempt reached graded
+  `needs_evidence`, not quest completion or rewards. Raw-payload erasure and
+  read-only polling after an actual client restart passed. Genuine background
+  cancellation notice, reset to Refresh, and delayed Enter behavior passed.
+  Unknown network-send replay was not forced live; that coverage is offline only.
+- **Actual native wallet flow:** fresh normal device approval; cancel made no
+  purchase and left 50 coins. One explicitly authorized 40-coin `bottoms:shorts`
+  purchase left 10 coins, owned items 9 → 10 and profile version v1 → v2.
+  Actual client restart preserved it; equipment was unchanged. This is not a
+  daily-quest reward or proof of live unknown-response purchase replay.
+- **Website browser E2E blocked:** Chrome was missing and one install attempt
+  failed because Linux ARM64 was unavailable. Public Voyages HTTP 200 is not
+  signed-in browser proof.
+- **Native-host CI caveat:** the initial `7a9d49f` PR macOS Node 24 service-stop
+  5,000 ms timeout is not causally fixed. New failure-only diagnostics leave
+  deadlines and assertions unchanged; review returned no findings (`[]`) and
+  Linux native-host passed. Both later feature-head CI runs passed, including
+  macOS Node 22/24; that is gate evidence, not a causal shutdown fix or full
+  cross-platform interactive UI proof.
+
+## Trying it and remaining gates
+
+Before publication, use only reviewed artifacts with the
+[explicit manual-kit method](native-manual-testing.md); do not weaken hashes or
+expect the public default resolver to find unpublished assets. No claim is made
+that this exact candidate has passed installed-package acceptance.
+
+Only **after publication** of the final tag and reviewed assets:
+
+```sh
+npm install -g --install-links=true github:B-icy/Carthagent#v1.1.0-preview.10
+# Or select published experimental releases (possibly a later preview):
+ctg update --channel experimental --check
+ctg update --channel experimental
+```
+
+Drafts are not updates. Experimental releases never advance the stable pointer.
+Final package/manifest review, final CI, tag/draft/assets, exact-tag installed
+acceptance with the normal resolver, publication and anonymous public installed
+acceptance remain release gates. See the [upgrade guide](native-upgrade.md) for
+profile preservation and stable-channel recovery. Historical
+[preview.9 notes](release-notes-preview.9.md) are retained unchanged, not current
+candidate status or evidence that immutable preview.9 gains these changes.

package/docs/release-notes-preview.11.md

@@ -0,0 +1,76 @@
+# 1.1.0-preview.11 experimental release
+
+Experimental preview. Install it explicitly with the experimental channel;
+stable 1.0.7 is unchanged and published preview.10 remains immutable.
+
+## What changes
+
+**Projects / Voyages left pane (PR #230).** On a wide enough terminal the left
+rail has two modes, **Projects** (the existing session list) and **Voyages**.
+
+- Switching modes keeps the current page. It does not create, interrupt, or
+  close a coding session, and it does not change the session or draft.
+- The Voyages navigator shows read-only profile and daily assignment
+  summaries. Select an entry explicitly to open its detail page. Opening a
+  quest does not compose evidence or grant consent. **Return to coding** opens
+  the selected session, or Home when no session is selected.
+- Each mode keeps its own selection and scroll position, and the chosen mode
+  is restored after a normal restart (without reopening a detail page).
+- **Focus pane** (or the configured shortcut) moves keyboard focus into the
+  pane; `Escape` returns focus to the page. Clicking a page control while the
+  pane is focused keeps focus on that control.
+- The compact rail uses `Q` (quests), `P` (profile), `E` (equipment),
+  `R` (refresh), `S` (sign in) and `B` (return to coding); numbered rows are
+  actual assignments. When the terminal is too narrow for the rail, use the
+  command palette, `/voyages`, or `/quests`.
+- Badges and friends have no native views yet. The pane never invents links or
+  data the server did not return.
+
+**Dialog resize fix.** Select dialogs no longer register one terminal-resize
+listener per row, which produced `MaxListenersExceededWarning` in large lists.
+
+Daily coding quests, Ship, Lite and the native default `ctg` interface behave
+as in preview.10. Assessments still award no coins, XP, or other rewards.
+
+## Provenance
+
+| Input | Exact value |
+| --- | --- |
+| Package | `1.1.0-preview.11` |
+| Prebuild source | `47fe2a6d52492f5f614a704605486ec6e8ed9f79` |
+| Prebuild workflow run | [41145521256](https://github.com/B-icy/Carthagent/actions/runs/41145521256) |
+| Full manifest SHA-256 | `6afe56eff1d2d08e798c7e329e817a980f7184a47bbb771c2a3e231eb3687862` |
+| Upstream revision | `843a6c514e606b436a7fe713422ace0a93ad3d61` |
+| CTG patch (combined-v4) SHA-256 | `1f2309bb3a31dfb8e8a0827a6a1144a1f76a005abff58f6f48857639ec02478a` |
+| Lock SHA-256 | `9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d` |
+| Runtime / compatibility | `0.0.0-ctg.2.0.32` / `2.0.32` |
+
+All five native prebuilds (Linux x64/arm64, macOS x64/arm64, Windows x64)
+passed the full runtime typecheck and the build recipe's test list in one run.
+
+Two tests that are timing-sensitive on CI were hardened. Neither change touches
+product code:
+
+- `navigation-rail`: waits for the pane's status text to refresh on the next
+  render pass instead of reading it immediately after a click.
+- `plugin-source` (real watchers): confirms the helper watch is live before
+  the atomic save. On the current `macos-15-arm64` runner image, a macOS file
+  watcher can miss a write made immediately after it starts.
+
+## Trying it
+
+```sh
+ctg update --channel experimental --check
+ctg update --channel experimental
+ctg --version   # 1.1.0-preview.11
+```
+
+Or install the exact tag:
+
+```sh
+npm install -g --install-links=true github:B-icy/Carthagent#v1.1.0-preview.11
+```
+
+`ctg update --channel stable` returns to stable 1.0.7 without `--force`. See
+the [upgrade guide](native-upgrade.md) for profile preservation. Historical
+[preview.10 notes](release-notes-preview.10.md) are retained unchanged.

package/docs/release-notes-preview.12.md

@@ -0,0 +1,55 @@
+# 1.1.0-preview.12 experimental release
+
+Experimental preview. Install it explicitly with the experimental channel;
+stable 1.0.7 is unchanged and published preview.11 remains immutable.
+
+## What changes
+
+**npm package keeps the `ctg` command.** Preview.11 declared its command as
+`./bin/ctg.mjs`. npm 11 treats that path as invalid and removes it during
+`npm publish`, so a registry copy of preview.11 would have installed without a
+`ctg` command. Preview.11 was therefore published on GitHub only. Preview.12
+declares `bin/ctg.mjs` and normalizes the repository URL, so `npm publish` makes
+no corrections to the manifest.
+
+**Release check.** `tools/verify-release-version.mjs` (run by the release
+workflow before anything is uploaded) now runs `npm publish --dry-run` and
+fails if npm would auto-correct or remove any field, if `bin.ctg` is not a
+plain relative path, or if the packed package lacks an executable
+`bin/ctg.mjs`.
+
+Product behaviour, the Projects / Voyages left pane, the native runtime source,
+and the CTG patch are identical to
+[preview.11](release-notes-preview.11.md). The runtime is rebuilt only because
+each runtime manifest is bound to its exact package version.
+
+## Provenance
+
+| Input | Exact value |
+| --- | --- |
+| Package | `1.1.0-preview.12` |
+| Prebuild source | `5c2c8730e140435a5a4f003ff30089efec006453` |
+| Prebuild workflow run | [41156564357](https://github.com/B-icy/Carthagent/actions/runs/41156564357) |
+| Full manifest SHA-256 | `b29fb261d88d052593421a42d4100d515b6b48454ca687ebdeceef9b32743742` |
+| Upstream revision | `843a6c514e606b436a7fe713422ace0a93ad3d61` |
+| CTG patch (combined-v4) SHA-256 | `1f2309bb3a31dfb8e8a0827a6a1144a1f76a005abff58f6f48857639ec02478a` |
+| Lock SHA-256 | `9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d` |
+| Runtime / compatibility | `0.0.0-ctg.2.0.32` / `2.0.32` |
+
+## Trying it
+
+```sh
+ctg update --channel experimental --check
+ctg update --channel experimental
+ctg --version   # 1.1.0-preview.12
+```
+
+Or install the exact version from npm or the exact tag:
+
+```sh
+npm install -g carthagent@1.1.0-preview.12
+npm install -g --install-links=true github:B-icy/Carthagent#v1.1.0-preview.12
+```
+
+`ctg update --channel stable` returns to stable 1.0.7 without `--force`. See
+the [upgrade guide](native-upgrade.md) for profile preservation.

package/docs/release-notes-preview.9.md

@@ -0,0 +1,130 @@
+# 1.1.0-preview.9 release candidate
+
+> **UNPUBLISHED — candidate guidance, not a release announcement.** No tag,
+> draft creation, asset upload, or publication is part of candidate preparation.
+> Published-channel updates cannot install this prebuild. Final-tag acceptance
+> and release-owner approval remain required before publication.
+
+## What this candidate contains
+
+- **Native by default**, inherited from preview.8. `ctg native` remains a
+  compatibility alias; `CTG_NATIVE` no longer selects another console. Stable
+  1.0.7 remains the legacy release. The owned runtime and private CTG profile
+  remain separate from regular OpenCode installations and credentials. Legacy
+  Pi sessions remain read-only archives, not resumable native sessions.
+- **Ship versus Lite:** Ship retains approval, checks, review, repair, recovery,
+  and resume delivery workflow; Lite is direct execution. This is not a claim of
+  complete behavioral parity across all interfaces or platforms.
+- **Native Voyages (PR #225):** `/voyages` exposes profile customization, wallet,
+  equipment and shop. Normal `/login` browser device approval binds the CLI to
+  the approving user's existing web player, which remains authoritative. There
+  is no separate CLI wallet, cookie import, paid-model requirement, or coding
+  coin award. Older account-only credentials may need a new device sign-in.
+- **Explicit mutations:** customization and equipment changes require
+  confirmation. A paid purchase requires a server quote with price and expiry,
+  followed by explicit confirmation. Cancel does not purchase. Ownership,
+  funds, eligibility and profile version are checked by the server; refresh on
+  conflicts rather than overwriting another client. Equip separately after
+  purchase. An uncertain purchase retains its pending request across restart:
+  recover using the same quote and request key, not a new purchase or deleted
+  profile state. Signed-out/unavailable data is not a saved balance.
+- **Credential refresh identity and coordination fixes** preserve account
+  identity boundaries and coordinate refreshed credentials rather than treating
+  unrelated identity or stale state as a successful refresh.
+- **PTY and Windows cleanup fixes** preserve full-duplex terminal input and
+  coherent paint snapshots, and verify fixture browser cleanup against captured
+  process identities. Passing source tests is not proof
+  of every physical terminal or operating-system UI interaction.
+
+## Candidate provenance
+
+| Input | Exact value |
+| --- | --- |
+| Package candidate | `1.1.0-preview.9` |
+| Prebuild source | `c51c5ae11293e63b658df297abc732db88d9109a` |
+| Prebuild workflow run | `40151970983` |
+| Candidate manifest SHA-256 | `aa5de65b633219423d21b1cc645945028a2d5565714b71760cbcc18badc5f4e5` |
+| Upstream revision | `843a6c514e606b436a7fe713422ace0a93ad3d61` |
+| CTG patch SHA-256 | `b4238d77827d7ccf8f87fb0326551eaa62268d9387cd89e29bd0cf12bd6dafaa` |
+| Lock SHA-256 | `9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d` |
+| Detached runtime version | `0.0.0-ctg.2.0.32` (compatibility `2.0.32`) |
+
+All five native builds (Linux x64/arm64, macOS x64/arm64, Windows x64) and
+assembly succeeded. The **original 13-file prebuild bundle** was independently
+verified through the production acquirer; manifest regeneration was
+byte-identical. Upstream, patch, lock, and detached runtime identity are
+unchanged from preview.8. The prebuild source above is not the final release
+package commit: package/lock, complete generated manifest, and candidate docs
+must be reviewed together before any final tag is selected.
+
+Archive/provenance verification is not execution acceptance. The new Linux
+ARM64 bytes passed isolated staged native-host and Ship-model probes, including
+plugin/RPC contracts, device-flow start/cancel, model discovery, service stop,
+and fixture cleanup. These use an explicit reviewed-artifact selector, not the
+installed package's default resolver. Independent execution on the other four
+targets and full final-tag installed acceptance remain pending. Earlier preview.8
+source and artifact evidence remains historical and is not blanket acceptance
+for preview.8 or preview.9.
+
+## Recorded acceptance and its limits
+
+The following supplied source/development-runtime results precede final-tag
+release acceptance; they are not a claim that candidate-document edits reran CI.
+
+| Scope | Recorded outcome |
+| --- | --- |
+| Final source quality, Linux | 934 tests: 929 passed, 5 skipped |
+| Windows-only cases | Four of the Linux-skipped cases actually passed Windows CI |
+| Python | 28 passed |
+| Local ARM full required-owned/default-resolver gate | 28 probes, 0 failures, 0 skips |
+| Exact source PR CI and main CI | All eight checks passed in each |
+
+The local ARM result does not establish independent execution of the new
+preview.9 prebuild bundle or its future final-tag public assets.
+
+Live **actual TUI development-runtime** testing covered browser device approval,
+name cancellation and save, owned Beanie equip, restart, web persistence,
+expiry recovery, and revocation. The web player was authoritative. The user's
+wallet contained **10 coins**, with no affordable paid quote: **no live paid
+debit or paid-request replay was proven**. Do not turn pending-recovery test
+coverage into a claim of a real paid purchase.
+
+Actual **60x12** terminal navigation was functional, not model-based visual
+approval. Physical clipboard behavior is not proven. Full cross-OS UI and
+controlled paired performance remain unknown. There is no full behavior-parity,
+lower-token/cost, or paid-model benchmark claim.
+
+## Trying the candidate and remaining release gates
+
+Before publication, use the matching prebuild archives and independently pinned
+candidate manifest through the [explicit manual-kit artifact method](native-manual-testing.md).
+Do not replace trust hashes to accept other bytes or expect the public default
+resolver to find unpublished assets. Provider-free fixtures are scripted, not
+model-quality evidence; live provider use requires deliberate credential and
+spending authorization.
+
+Only **after** `v1.1.0-preview.9` and its reviewed runtime assets are published:
+
+```sh
+npm install -g --install-links=true github:B-icy/Carthagent#v1.1.0-preview.9
+# Or, from an installation supporting channels:
+ctg update --channel experimental --check
+ctg update --channel experimental
+```
+
+Experimental selection follows published semantic versions and may select a
+later release; use the exact tag when reproducing preview.9. Drafts are never
+updates, and prereleases do not advance the stable control-plane pointer.
+See the [upgrade guide](native-upgrade.md) for non-destructive source checkout,
+profile preservation, and stable-channel recovery.
+
+Still pending: independently execute the other four platform outputs; review the final
+package and manifest; obtain separate approval for the tag/draft/upload steps;
+run full final-tag required-owned installed acceptance against the draft using
+the normal resolver; obtain publication approval; then prove anonymous public
+default-resolver installed acceptance. No backend edits or publication actions
+are included in this version/pins/documentation candidate update.
+
+The [older native migration draft](release-notes-native-draft.md) is preserved
+unchanged as historical planning material, including its old opt-in routing and
+unreleased-version assumptions. It is not current candidate installation guidance.

package/evaluate.mjs

@@ -23,7 +23,33 @@ const { values: args } = parseArgs({ options: {
   timeout: { type: 'string', default: '600' }, 'max-turns': { type: 'string', default: '100' }, 'max-cost': { type: 'string', default: '3' },
   python: { type: 'string' }, 'seed-from': { type: 'string' }, 'allow-live': { type: 'boolean', default: false },
   'dry-run': { type: 'boolean', default: false },
+  help: { type: 'boolean', short: 'h', default: false },
 } });
+if (args.help) {
+  console.log(`Usage: ctg eval [options]
+
+Opt-in live A/B evaluation of baseline vs custom configurations against a
+scenario manifest under scenarios/<name>/. Live calls spend API credit and
+generated code runs with your permissions, so a run must be explicit.
+
+Options:
+  --mode baseline|custom|both   What to evaluate (default both)
+  --task <name>                  Scenario short name (default cli)
+  --scenario <name>              Scenario directory (overrides --task)
+  --model <id>                   Model id
+  --provider <name>              Provider name; needs <PROVIDER>_API_KEY
+  --thinking <level>             Thinking level (default medium)
+  --timeout <seconds>            Per-run timeout, max 3600 (default 600)
+  --max-turns <n>                Turn budget, max 1000 (default 100)
+  --max-cost <usd>               Cost budget (default 3)
+  --python <path>                Python executable for scenarios that need it
+  --seed-from <dir>              Continue from a previous candidate directory
+  --allow-live                   Confirm live provider calls
+  --dry-run                      Assemble and preview without calling a provider
+  --help, -h                     Show this help
+`);
+  process.exit(0);
+}
 if (!args['allow-live'] && !args['dry-run']) throw Error('Live calls spend API credit and generated code runs with your permissions. Use --allow-live explicitly (or --dry-run to preview the assembled run without calling a provider).');
 if (!['baseline', 'custom', 'both'].includes(args.mode)) throw Error('Use --mode baseline|custom|both');
 for (const key of ['timeout', 'max-turns', 'max-cost']) if (!(Number(args[key]) > 0 && Number.isFinite(Number(args[key])))) throw Error(`Invalid ${key}`);
@@ -197,7 +223,8 @@ for (const mode of args.mode === 'both' ? ['baseline', 'custom'] : [args.mode])
     cwd,
     evidenceSchema: 2,
     runtime: NATIVE_EVALUATION_RUNTIME,
-    runtimeVersion: result.opencodeVersion,
+    compatibilityVersion: result.compatibilityVersion,
+    runtimeVersion: result.runtimeVersion,
     exitCode: result.exitCode,
     timedOut: result.timedOut,
     budgetReason: result.budgetReason,

package/lib/budget.mjs

@@ -22,7 +22,7 @@ export function budgetReason(budget, action, now = Date.now()) {
 
 export function validateBudgetOptions(opts, { allowWithoutDelivery = false } = {}) {
   const keys = ['maxTools', 'maxSeconds', 'maxRepairs'];
-  if (!allowWithoutDelivery && opts.delivery === false && keys.some(key => opts[key] !== undefined)) {
+if (!allowWithoutDelivery && opts.delivery === false && keys.some(key => opts[key] !== undefined)) {
     throw Error('Budget options require the delivery extension');
   }
   budgetLimits(flag => opts[{ 'delivery-max-tools': 'maxTools', 'delivery-max-seconds': 'maxSeconds', 'delivery-max-repairs': 'maxRepairs' }[flag]]);

package/lib/codegraph.mjs

@@ -153,7 +153,7 @@ const parsers = new Map(); // lang -> dedicated parser (setLanguage once; concur
 async function parserFor(lang) {
   if (!runtimePromise) {
     runtimePromise = (async () => {
-      const Parser = require_('web-tree-sitter');
+      const Parser = require_('web-tree-sitter-legacy');
       await Parser.init();
       const wasmDir = require_.resolve('tree-sitter-wasms/package.json').replace(/package\.json$/, 'out');
       const languages = new Map();

package/lib/delivery.mjs

@@ -4,6 +4,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync, readFileSync, mkdirSync, writeFileSync, renameSync, openSync, writeSync, closeSync } from 'node:fs';
 import { resolve, relative, isAbsolute, join, dirname, basename } from 'node:path';
 import { spawn } from 'node:child_process';
+import { withoutRuntimeGithubToken } from './environment.mjs';
 
 // Generic dependency/cache/output directories excluded from the source fingerprint.
 // Scenarios or projects can add more via the manifest; these are the common defaults.
@@ -425,7 +426,7 @@ export function atomicJson(path, data) {
 export function killTree(child) {
   if (!child.pid) return;
   if (process.platform === 'win32') {
-    const killer = spawn('taskkill.exe', ['/pid', String(child.pid), '/t', '/f'], { windowsHide: true, stdio: 'ignore' });
+    const killer = spawn('taskkill.exe', ['/pid', String(child.pid), '/t', '/f'], { windowsHide: true, stdio: 'ignore', env: withoutRuntimeGithubToken() });
     killer.on('error', () => child.kill());
   } else {
     try { process.kill(-child.pid, 'SIGKILL'); } catch { child.kill('SIGKILL'); }
@@ -443,7 +444,7 @@ export async function runCommand(argv, { cwd, timeoutSeconds = 60, signal, logPa
   const started = Date.now();
   return new Promise(resolveResult => {
     let tail = '', written = 0, timedOut = false, cancelled = false, outputLimit = false;
-    const child = spawn(argv[0], argv.slice(1), { cwd, shell: false, windowsHide: true, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'] });
+    const child = spawn(argv[0], argv.slice(1), { cwd, env: withoutRuntimeGithubToken(), shell: false, windowsHide: true, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'] });
     const stop = () => killTree(child);
     const abort = () => { cancelled = true; stop(); };
     const timer = setTimeout(() => { timedOut = true; stop(); }, timeoutSeconds * 1000);

package/lib/environment.mjs

@@ -0,0 +1,8 @@
+/** Return a copy of an environment without the optional runtime transport token. */
+export function withoutRuntimeGithubToken(env = process.env) {
+  const clean = { ...env };
+  for (const key of Object.keys(clean)) {
+    if (key.toUpperCase() === 'CTG_RUNTIME_GITHUB_TOKEN') delete clean[key];
+  }
+  return clean;
+}

package/lib/guidance.mjs

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { unframe } from './tui/framing.mjs';
+import { unframe } from '../plugins/carthagent/src/server/framing.mjs';
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 export const DEFAULT_PROFILE_DIR = join(root, 'guidance', 'profiles');