carthagent 1.0.7 → 1.1.0-preview.12

package/tools/test-native-terminal-readiness.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Bounded, non-timed real integration readiness check. This starts only the
+# disposable loopback fixture and a single PTY TUI; it does not run samples.
+if [[ $# -ne 6 || ( "$6" != baseline && "$6" != ctg ) ]]; then
+  printf 'Usage: %s SOURCE_CHECKOUT EXECUTION_SNAPSHOT_TAR HARNESS_WORKTREE BINARY MANIFEST baseline|ctg\n' "$0" >&2
+  exit 2
+fi
+source_checkout="$(cd "$1" && pwd)"
+execution_snapshot="$(realpath "$2")"
+harness_worktree="$(cd "$3" && pwd)"
+binary="$(realpath "$4")"
+manifest="$(realpath "$5")"
+mode="$6"
+owned_root="${CTG_OWNED_OPENCODE_RUNTIME:-}"
+if [[ -z "$owned_root" ]]; then owned_root="$(dirname "$(dirname "$(dirname "$binary")")")"; fi
+release_manifest="${CTG_TEST_RUNTIME_RELEASE_MANIFEST:-$harness_worktree/lib/opencode/runtime-release.json}"
+source "$harness_worktree/tools/native-owned-runtime-env.sh"
+configure_native_owned_runtime "$binary" "$owned_root" "$release_manifest"
+source_commit="$(node -e 'process.stdout.write(JSON.parse(require("node:fs").readFileSync(process.argv[1],"utf8")).sourceCommit)' "$manifest")"
+snapshot_sha="$(node -e 'process.stdout.write(JSON.parse(require("node:fs").readFileSync(process.argv[1],"utf8")).sourceSnapshotSha256)' "$manifest")"
+execution_sha="$(node -e 'process.stdout.write(JSON.parse(require("node:fs").readFileSync(process.argv[1],"utf8")).executionSnapshotSha256)' "$manifest")"
+actual_snapshot_sha="$(sha256sum "$execution_snapshot" | awk '{print $1}')"
+if [[ "$actual_snapshot_sha" != "$execution_sha" ]]; then
+  printf 'Execution snapshot hash does not match retained manifest\n' >&2
+  exit 1
+fi
+work="$(mktemp -d /tmp/ctg-native-readiness.XXXXXX)"
+chmod 700 "$work"
+ready="$work/ready"
+seeder_log="$work/seeder.log"
+server_pid=''
+fixture=''
+cleanup() {
+  if [[ -n "$server_pid" ]]; then
+    kill -TERM "$server_pid" 2>/dev/null || true
+    for _ in $(seq 1 50); do kill -0 "$server_pid" 2>/dev/null || break; sleep 0.1; done
+    kill -KILL "$server_pid" 2>/dev/null || true
+    wait "$server_pid" 2>/dev/null || true
+  fi
+  if [[ -n "$fixture" && -f "$fixture" ]]; then
+    temp="$(node -e 'process.stdout.write(JSON.parse(require("node:fs").readFileSync(process.argv[1],"utf8")).temp)' "$fixture")"
+    if [[ "$temp" == /tmp/ctg-native-fixture-* && "$temp" != *..* ]]; then rm -rf -- "$temp"; fi
+  fi
+  if [[ "$work" == /tmp/ctg-native-readiness.* && "$work" != *..* ]]; then rm -rf -- "$work"; fi
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+source_root="$work/source"
+mkdir -p "$source_root"
+tar -xf "$execution_snapshot" -C "$source_root"
+deps="$(realpath "$source_checkout/node_modules")"
+cp "$harness_worktree/tools/native-fixture.mjs" "$harness_worktree/tools/seed-native-switch-fixture.mjs" \
+  "$harness_worktree/tools/native-paired-guards.mjs" "$harness_worktree/tools/native-runtime-identity.mjs" \
+  "$harness_worktree/tools/native-owned-runtime-env.sh" \
+  "$harness_worktree/tools/test-native-terminal-performance.py" \
+  "$source_root/tools/"
+ln -s "$deps" "$source_root/node_modules"
+mkdir -p "$source_root/plugins/carthagent/node_modules/@opencode"
+ln -s "$deps/@opencode/plugin" "$source_root/plugins/carthagent/node_modules/@opencode/plugin"
+seed=("$source_root/tools/seed-native-switch-fixture.mjs" "$source_root/plugins/carthagent" --serve "--ready-file=$ready")
+expected=active
+if [[ "$mode" == baseline ]]; then seed+=(--no-plugin); expected=absent; fi
+CTG_PERF_MANIFEST="$manifest" NODE_PATH="$deps" node "${seed[@]}" >"$seeder_log" 2>&1 &
+server_pid=$!
+for _ in $(seq 1 900); do
+  if [[ -s "$ready" ]]; then break; fi
+  if ! kill -0 "$server_pid" 2>/dev/null; then
+    printf '%s readiness fixture seeder exited before ready (private log retained only until cleanup)\n' "$mode" >&2
+    exit 1
+  fi
+  sleep 0.1
+done
+if [[ ! -s "$ready" ]]; then
+  printf '%s readiness fixture timed out before ready\n' "$mode" >&2
+  exit 1
+fi
+fixture="$(cat "$ready")"
+CTG_PERF_EXPECT_PLUGIN="$expected" CTG_PERF_SOURCE_COMMIT="$source_commit" \
+CTG_PERF_SOURCE_SNAPSHOT_SHA256="$snapshot_sha" NODE_PATH="$(realpath "$source_root/node_modules")" \
+CTG_OPENCODE_BIN="$binary" python3 "$source_root/tools/test-native-terminal-performance.py" \
+  --binary "$binary" --switch-fixture "$fixture" --samples 1 --readiness-only
+printf 'Readiness passed for %s; no timed samples were run.\n' "$mode"

package/tools/test-native-terminal-semantics-installed.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+/** Run controlled-terminal semantics against the installed package's default owned runtime. */
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { resolveOpenCode, runtimeIdentity } from '../lib/opencode/runtime.mjs';
+import { loadNativeTestRuntime } from './native-runtime-identity.mjs';
+import { withoutRuntimeGithubToken } from './runtime-token-env.mjs';
+import { assertTerminalSemanticsProof, resolveInstalledRuntime } from './installed-runtime-contract.mjs';
+
+assert.equal(process.platform, 'linux', 'installed terminal-semantics acceptance is currently a Linux controlled-PTY claim');
+for (const key of Object.keys(process.env)) {
+  assert.ok(!/^CTG_(?:OPENCODE_BIN|OWNED_OPENCODE_RUNTIME|TEST_RUNTIME_)/i.test(key),
+    `${key} must not override installed default runtime acceptance`);
+}
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const manifestPath = join(root, 'lib/opencode/runtime-release.json');
+const manifest = JSON.parse(await (await import('node:fs/promises')).readFile(manifestPath, 'utf8'));
+const { binary, identity } = await resolveInstalledRuntime(resolveOpenCode, runtimeIdentity, manifestPath);
+assert.equal(identity.kind, 'ctg-owned', 'terminal semantics acceptance requires default installed CTG-owned runtime');
+const verified = await loadNativeTestRuntime({
+  binary, ownedRoot: dirname(dirname(dirname(binary))), expectedManifest: manifest,
+});
+assert.equal(verified.binary, binary);
+assert.equal(verified.binarySha256, identity.binarySha256);
+
+const python = process.env.PYTHON ?? (process.platform === 'win32' ? 'python' : 'python3');
+const env = withoutRuntimeGithubToken(process.env);
+const result = spawnSync(python, [join(root, 'tools/native-terminal-semantics.py'), '--binary', binary], {
+  cwd: root, encoding: 'utf8', timeout: 180_000, env,
+});
+if (result.error) throw result.error;
+if (result.stdout) process.stdout.write(result.stdout);
+if (result.stderr) process.stderr.write(result.stderr);
+assert.equal(result.status, 0, `controlled terminal semantics failed with status ${result.status}`);
+const proof = JSON.parse(result.stdout);
+assertTerminalSemanticsProof(proof, { binary: resolve(binary), identity, manifest });

package/tools/test-native-visual-clear-installed.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/** Run approved visual-clear PTY proof with the installed package default owned runtime. */
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { resolveOpenCode, runtimeIdentity } from '../lib/opencode/runtime.mjs';
+import { loadNativeTestRuntime } from './native-runtime-identity.mjs';
+import { withoutRuntimeGithubToken } from './runtime-token-env.mjs';
+import { resolveInstalledRuntime } from './installed-runtime-contract.mjs';
+
+assert.equal(process.platform, 'linux', 'installed visual-clear acceptance is a Linux POSIX PTY claim');
+for (const key of Object.keys(process.env)) {
+  assert.ok(!/^CTG_(?:OPENCODE_BIN|OWNED_OPENCODE_RUNTIME|TEST_RUNTIME_)/i.test(key),
+    `${key} must not override installed default runtime acceptance`);
+}
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const manifestPath = join(root, 'lib/opencode/runtime-release.json');
+const manifest = JSON.parse(await (await import('node:fs/promises')).readFile(manifestPath, 'utf8'));
+const { binary, identity } = await resolveInstalledRuntime(resolveOpenCode, runtimeIdentity, manifestPath);
+assert.equal(identity.kind, 'ctg-owned', 'installed visual-clear acceptance requires default CTG-owned runtime selection');
+const ownedRoot = dirname(dirname(dirname(binary)));
+const verified = await loadNativeTestRuntime({ binary, ownedRoot, expectedManifest: manifest });
+assert.equal(verified.binarySha256, identity.binarySha256, 'independent verifier must match default-resolved runtime bytes');
+
+const python = process.env.PYTHON ?? 'python3';
+const artifact = join(root, `.ctg-visual-clear-${process.pid}.json`);
+try {
+  const result = spawnSync(python, [join(root, 'tools/test-owned-visual-clear.py'),
+    '--binary', binary, '--owned-root', ownedRoot, '--release-manifest', manifestPath,
+    '--artifact', artifact], {
+    cwd: root, encoding: 'utf8', timeout: 240_000,
+    // The clear runner uses its own strict allowlists and does not need the
+    // acquisition token; keep it away from Python, fixture, host, and PTY.
+    env: withoutRuntimeGithubToken(process.env),
+  });
+  if (result.error) throw result.error;
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  assert.equal(result.status, 0, `visual-clear PTY proof failed with status ${result.status}`);
+  const proof = JSON.parse(await (await import('node:fs/promises')).readFile(artifact, 'utf8'));
+  assert.equal(proof.status, 'PASS');
+  assert.equal(proof.binarySha256, identity.binarySha256, 'visual-clear proof must identify the installed default-resolved executable bytes');
+  assert.equal(proof.runtimeIdentity?.runtimeVersion, manifest.runtimeVersion);
+  assert.equal(proof.scope, 'Linux POSIX PTY; explicit trusted-preflighted owned staging artifact; offline loopback provider');
+} finally {
+  await (await import('node:fs/promises')).rm(artifact, { force: true });
+}

package/tools/test-owned-host-controls.mjs

@@ -0,0 +1,238 @@
+#!/usr/bin/env node
+/** Behavioral session/restart, auto-compaction, clear, and shell-origin proof on the owned host. */
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+import { mkdtemp, mkdir, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { spawn } from 'node:child_process';
+import { once } from 'node:events';
+import { fileURLToPath } from 'node:url';
+import { OpenCode } from '@opencode/client';
+import { preflightNativeTestRuntimeArtifact } from './native-runtime-identity.mjs';
+import { resolveOpenCode, runtimeIdentity, provisionRuntime, runtimeEnvironment } from '../lib/opencode/runtime.mjs';
+
+if (process.platform !== 'linux') throw new Error('This native shell provenance probe currently targets Linux; it is not a cross-platform acceptance claim.');
+const installedDefault = process.argv.includes('--installed-default');
+if (process.env.CTG_OPENCODE_BIN) throw new Error('Do not set CTG_OPENCODE_BIN for owned acceptance.');
+if (process.env.CTG_TEST_RUNTIME_SHA256) throw new Error('Do not override the trusted release-manifest executable hash.');
+if (installedDefault && (process.env.CTG_OWNED_OPENCODE_RUNTIME || process.env.CTG_TEST_RUNTIME_RELEASE_MANIFEST)) {
+  throw new Error('Installed acceptance must use the packaged manifest and default runtime resolver without test overrides.');
+}
+const ownedRoot = installedDefault ? undefined : process.env.CTG_OWNED_OPENCODE_RUNTIME;
+const trustedManifestPath = installedDefault
+  ? fileURLToPath(new URL('../lib/opencode/runtime-release.json', import.meta.url))
+  : process.env.CTG_TEST_RUNTIME_RELEASE_MANIFEST;
+if (!installedDefault && !ownedRoot) throw new Error('Set CTG_OWNED_OPENCODE_RUNTIME to the owned runtime artifact root under test.');
+if (!trustedManifestPath) throw new Error('A trusted release manifest is required for owned acceptance.');
+const preflight = ownedRoot ? await preflightNativeTestRuntimeArtifact({ ownedRoot, expectedManifestPath: trustedManifestPath }) : null;
+const runtimeOptions = { ...(ownedRoot ? { ownedRuntime: ownedRoot } : {}), runtimeReleaseManifestPath: trustedManifestPath };
+const binary = await resolveOpenCode(runtimeOptions);
+const identity = await runtimeIdentity(binary, runtimeOptions);
+assert.equal(identity.kind, 'ctg-owned');
+if (preflight) {
+  assert.equal(identity.binaryPath, preflight.identity.binary, 'product resolver selected the preflighted artifact');
+  assert.equal(identity.binarySha256, preflight.identity.binarySha256, 'product identity matches trusted pre-execution byte verification');
+  assert.equal(identity.version, preflight.identity.runtimeVersion);
+} else {
+  assert.equal(identity.kind, 'ctg-owned', 'installed acceptance requires the production default resolver to select CTG-owned runtime');
+  const { loadNativeTestRuntime } = await import('./native-runtime-identity.mjs');
+  const expectedManifest = JSON.parse(await readFile(trustedManifestPath, 'utf8'));
+  const verified = await loadNativeTestRuntime({ binary, ownedRoot: dirname(dirname(dirname(binary))), expectedManifest });
+  assert.equal(verified.binary, binary);
+  assert.equal(verified.binarySha256, identity.binarySha256);
+}
+
+const temp = await mkdtemp(join(tmpdir(), 'ctg-owned-controls-'));
+const cwd = join(temp, 'project');
+const root = join(temp, 'runtime');
+const captureFile = join(temp, 'shell-hooks.jsonl');
+const requests = [];
+let rejectOverflow = true;
+const provider = createServer(async (req, res) => {
+  let raw = '';
+  for await (const chunk of req) raw += chunk;
+  const body = JSON.parse(raw || '{}');
+  requests.push(body);
+  const serialized = JSON.stringify(body.messages ?? []);
+  if (serialized.includes('You MUST use this format for your response')) return stream(res, '## Objective\n- preserve the fixture context');
+  if (serialized.includes('OWNED_OVERFLOW') && rejectOverflow) {
+    rejectOverflow = false;
+    res.writeHead(400, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ error: { message: 'Your input exceeds the context window', code: 'context_length_exceeded', type: 'invalid_request_error' } }));
+    return;
+  }
+  const user = [...(body.messages ?? [])].reverse().find(message => message.role === 'user');
+  if (serialized.includes('owned-identical-shell') && !body.messages.some(message => message.role === 'tool')) {
+    const calls = (body.tools ?? []).filter(tool => tool.function?.name === 'shell');
+    assert.ok(calls.length, 'owned runtime must advertise native shell in the two provenance sessions');
+    const callID = `identical-${requests.length}`;
+    const userText = String([...body.messages].reverse().find(message => message.role === 'user')?.content ?? '');
+    const marker = userText.includes('OWNED_SHELL_SESSION_A') ? 'A' : userText.includes('OWNED_SHELL_SESSION_B') ? 'B' : null;
+    assert.ok(marker, `shell tool call has no known originating prompt marker: ${userText}`);
+    providerToolCalls.set(marker, callID);
+    const chunk = (delta, finish_reason = null) => `data: ${JSON.stringify({ id: `same-command-${requests.length}`, object: 'chat.completion.chunk', created: 1, model: 'fixture', choices: [{ index: 0, delta, finish_reason }] })}\n\n`;
+    res.writeHead(200, { 'content-type': 'text/event-stream' });
+    res.end(`${chunk({ role: 'assistant', tool_calls: [{ index: 0, id: callID, type: 'function', function: { name: 'shell', arguments: JSON.stringify({ command: 'printf owned-identical-shell' }) } }] })}${chunk({}, 'tool_calls')}data: [DONE]\n\n`);
+    return;
+  }
+  stream(res, `reply:${String(user?.content ?? '').slice(0, 60)}`);
+});
+
+let child;
+let client;
+let providerListening = false;
+const providerToolCalls = new Map();
+const password = `owned-${process.pid}-${Date.now()}`;
+const request = () => ({ signal: AbortSignal.timeout(30_000) });
+const start = async () => {
+  const env = runtimeEnvironment({ root });
+  env.OPENCODE_SERVER_PASSWORD = password;
+  env.CTG_OWNED_SHELL_CAPTURE = captureFile;
+  child = spawn(binary, ['serve', '--hostname', '127.0.0.1', '--port', '0'], { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
+  let output = '';
+  const baseUrl = await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(Error(`owned server startup timeout: ${output}`)), 30_000);
+    const collect = chunk => {
+      output = (output + chunk.toString()).slice(-8000);
+      const url = output.match(/http:\/\/127\.0\.0\.1:\d+/)?.[0];
+      if (url) { clearTimeout(timer); resolve(url); }
+    };
+    child.stdout.on('data', collect);
+    child.stderr.on('data', collect);
+    child.once('error', error => { clearTimeout(timer); reject(error); });
+    child.once('exit', code => { clearTimeout(timer); reject(Error(`owned server exited ${code}: ${output}`)); });
+  });
+  client = OpenCode.make({ baseUrl, headers: { authorization: `Basic ${Buffer.from(`opencode:${password}`).toString('base64')}` } });
+  const info = await client.server.info(request());
+  assert.equal(info.version, identity.version);
+  assert.equal(info.capabilities?.shellOrigin, true);
+  return client;
+};
+const stop = async () => {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return;
+  let exited = once(child, 'exit');
+  child.kill('SIGTERM');
+  let timer;
+  const graceful = await Promise.race([exited.then(() => true), new Promise(resolve => { timer = setTimeout(() => resolve(false), 5000); })]);
+  clearTimeout(timer);
+  if (graceful) return;
+  child.kill('SIGKILL');
+  let forceTimer;
+  try {
+    await Promise.race([exited, new Promise((_, reject) => { forceTimer = setTimeout(() => reject(new Error('Owned host did not exit after SIGKILL')), 5000); })]);
+  } finally { clearTimeout(forceTimer); }
+};
+
+try {
+  await mkdir(cwd, { recursive: true });
+  await new Promise((resolve, reject) => {
+    provider.once('error', reject);
+    provider.listen(0, '127.0.0.1', resolve);
+  });
+  providerListening = true;
+  const providerUrl = `http://127.0.0.1:${provider.address().port}/v1`;
+  const profile = {
+    plugins: [{ package: join(import.meta.dirname, 'owned-shell-observer'), options: { captureFile } }],
+    update: 'disable',
+    model: 'ctg-fixture/fixture',
+    default_agent: 'build',
+    providers: { 'ctg-fixture': {
+      package: '@opencode/ai/providers/openai-compatible',
+      settings: { baseURL: providerUrl, apiKey: 'offline-fixture' },
+      models: { fixture: { limit: { context: 32_000, output: 1024 }, cost: { input: 1, output: 2, cacheRead: 0, cacheWrite: 0 } } },
+    } },
+  };
+  await provisionRuntime({ root, profile });
+  client = await start();
+  const location = { directory: cwd };
+  const model = { providerID: 'ctg-fixture', id: 'fixture' };
+  const first = await client.session.create({ location, model, title: 'Owned restart policy A' }, request());
+  const second = await client.session.create({ location, model, title: 'Owned restart policy B' }, request());
+  await client.session.update({ sessionID: first.id, metadata: { 'ctg.autoCompaction': false } }, request());
+  await client.session.update({ sessionID: second.id, metadata: { 'ctg.autoCompaction': true } }, request());
+  await client.session.prompt({ sessionID: first.id, text: 'OWNED_AUTOCOMPACT_OFF initial' }, request());
+  await client.session.prompt({ sessionID: second.id, text: 'OWNED_AUTOCOMPACT_ON initial' }, request());
+  await Promise.all([client.session.wait({ sessionID: first.id }, request()), client.session.wait({ sessionID: second.id }, request())]);
+  const beforeRestartA = await client.message.list({ sessionID: first.id }, request());
+  const beforeRestartB = await client.message.list({ sessionID: second.id }, request());
+  assert.ok(beforeRestartA.data.some(message => JSON.stringify(message).includes('OWNED_AUTOCOMPACT_OFF')));
+  assert.ok(beforeRestartB.data.some(message => JSON.stringify(message).includes('OWNED_AUTOCOMPACT_ON')));
+
+  await stop();
+  const restarted = await start();
+  assert.equal((await restarted.session.get({ sessionID: first.id }, request())).metadata['ctg.autoCompaction'], false);
+  assert.equal((await restarted.session.get({ sessionID: second.id }, request())).metadata['ctg.autoCompaction'], true);
+
+  requests.length = 0;
+  rejectOverflow = true;
+  await restarted.session.prompt({ sessionID: first.id, text: 'OWNED_OVERFLOW sessionA' }, request());
+  await restarted.session.wait({ sessionID: first.id }, request());
+  assert.equal(requests.length, 1, 'auto-compaction-off overflow must produce no summary or retry request');
+  assert.equal((await restarted.session.get({ sessionID: first.id }, request())).outcome, 'failed');
+
+  requests.length = 0;
+  rejectOverflow = true;
+  await restarted.session.prompt({ sessionID: second.id, text: 'OWNED_OVERFLOW sessionB' }, request());
+  await restarted.session.wait({ sessionID: second.id }, request());
+  const summaryIndex = requests.findIndex(body => JSON.stringify(body.messages).includes('You MUST use this format for your response'));
+  const initialOverflowIndex = requests.findIndex(body => JSON.stringify(body.messages).includes('OWNED_OVERFLOW sessionB'));
+  const retryIndex = requests.findIndex((body, index) => index > summaryIndex && JSON.stringify(body.messages).includes('OWNED_OVERFLOW sessionB'));
+  assert.ok(initialOverflowIndex >= 0 && summaryIndex > initialOverflowIndex && retryIndex > summaryIndex,
+    `expected overflow → summary → retry provider requests, got ${JSON.stringify(requests.map(body => body.messages))}`);
+  assert.equal((await restarted.session.get({ sessionID: second.id }, request())).outcome, 'succeeded');
+
+  const same1 = await restarted.session.create({ location, model, title: 'Concurrent identical shell A', metadata: { 'ctg.autoCompaction': false } }, request());
+  const same2 = await restarted.session.create({ location, model, title: 'Concurrent identical shell B', metadata: { 'ctg.autoCompaction': false } }, request());
+  const prompts = [
+    { session: same1, marker: 'A' },
+    { session: same2, marker: 'B' },
+  ];
+  const pluginList = await restarted.plugin.list({ location }, request());
+  assert.ok(pluginList.data.some(plugin => plugin.id === 'ctg.owned-shell-observer' && plugin.state.status === 'active'), JSON.stringify(pluginList.data));
+  await Promise.all([
+    restarted.session.prompt({ sessionID: same1.id, text: 'OWNED_SHELL_SESSION_A Run shell command: node -e "process.stdout.write(\'owned-identical-shell\')"' }, request()),
+    restarted.session.prompt({ sessionID: same2.id, text: 'OWNED_SHELL_SESSION_B Run shell command: node -e "process.stdout.write(\'owned-identical-shell\')"' }, request()),
+  ]);
+  await Promise.all([restarted.session.wait({ sessionID: same1.id }, request()), restarted.session.wait({ sessionID: same2.id }, request())]);
+  for (const { session } of prompts) assert.equal((await restarted.session.get({ sessionID: session.id }, request())).outcome, 'succeeded');
+  let capturedText;
+  try { capturedText = await readFile(captureFile, 'utf8'); }
+  catch (error) { throw new Error(`shell observer did not record a hook event; provider requests=${JSON.stringify(requests.map(body => body.messages?.slice(-2)))}; session tools=${JSON.stringify(await Promise.all([same1, same2].map(session => restarted.message.list({ sessionID: session.id }, request()))))}`, { cause: error }); }
+  const shellEvents = capturedText.trim().split('\n').filter(Boolean).map(JSON.parse);
+  const attributed = shellEvents.filter(event => event.command.includes('owned-identical-shell'));
+  assert.equal(attributed.length, 2, JSON.stringify(shellEvents));
+  const observations = new Map(attributed.map(event => [event.sessionID, event]));
+  for (const { session, marker } of prompts) {
+    const observed = observations.get(session.id);
+    assert.ok(observed, `missing shell hook event for ${session.id}: ${JSON.stringify(attributed)}`);
+    assert.equal(observed.origin, 'tool');
+    assert.equal(observed.callID, providerToolCalls.get(marker), `hook call ID matches the native provider call ID for marker ${marker}`);
+    const history = await restarted.message.list({ sessionID: session.id }, request());
+    const toolParts = history.data.flatMap(message => message.parts ?? message.content ?? []).filter(part => part.type === 'tool' && part.id === providerToolCalls.get(marker));
+    assert.equal(toolParts.length, 1, `durable tool transcript correlates to provider call for session ${session.id}: ${JSON.stringify(history.data)}`);
+    assert.equal(toolParts[0].state.status, 'completed', JSON.stringify(toolParts[0]));
+    assert.equal(toolParts[0].state.input.command, observed.command);
+    assert.ok(toolParts[0].state.content.some(part => part.type === 'text' && part.text.includes('owned-identical-shell')));
+  }
+
+  console.log(JSON.stringify({
+    host: { compatibilityVersion: preflight?.identity.compatibilityVersion ?? identity.compatibilityVersion, runtimeVersion: identity.version, binarySha256: identity.binarySha256 },
+    runtimeSelection: installedDefault ? 'installed package default resolver; trusted manifest verified' : 'explicit, trusted-preflighted CTG_OWNED_OPENCODE_RUNTIME staging artifact',
+    sameDatabaseServiceRestart: 'passed',
+    autoCompaction: { off: 'overflow failed with one provider attempt and no compaction', on: 'compaction request and successful retry observed' },
+    concurrentIdenticalShell: 'real runtime events correlated to distinct sessionID/origin/callID',
+    loopbackProviderRequests: requests.length,
+  }));
+} finally {
+  await stop();
+  provider.closeAllConnections();
+  if (providerListening) await new Promise(resolve => provider.close(resolve));
+  await rm(temp, { recursive: true, force: true });
+}
+
+function stream(res, text) {
+  const chunk = (delta, finish_reason = null, usage) => `data: ${JSON.stringify({ id: `owned-${requests.length}`, object: 'chat.completion.chunk', created: 1, model: 'fixture', choices: [{ index: 0, delta, finish_reason }], ...(usage ? { usage } : {}) })}\n\n`;
+  res.writeHead(200, { 'content-type': 'text/event-stream' });
+  res.end(`${chunk({ role: 'assistant', content: text })}${chunk({}, 'stop', { prompt_tokens: 30, completion_tokens: 10, total_tokens: 40 })}data: [DONE]\n\n`);
+}

package/tools/test-owned-opencode-runtime.mjs

@@ -0,0 +1,35 @@
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { resolveOwnedOpenCode } from '../lib/opencode/runtime.mjs';
+
+const directory = process.env.CTG_OWNED_OPENCODE_RUNTIME;
+if (!directory) throw new Error('Set CTG_OWNED_OPENCODE_RUNTIME to an extracted, hash-verified CTG runtime artifact.');
+
+const binary = await resolveOwnedOpenCode(directory);
+const root = await mkdtemp(path.join(tmpdir(), 'ctg-owned-opencode-smoke-'));
+const child = await import('node:child_process');
+const { runtimeEnvironment } = await import('../lib/opencode/runtime.mjs');
+const env = runtimeEnvironment({ root });
+try {
+  const version = await new Promise((resolve, reject) => {
+    const process = child.spawn(binary, ['--version'], { env, stdio: ['ignore', 'pipe', 'pipe'] });
+    let output = '';
+    process.stdout.setEncoding('utf8').on('data', chunk => { output += chunk; });
+    process.once('error', reject);
+    process.once('close', code => code === 0 ? resolve(output.trim()) : reject(new Error(`owned CLI exited ${code}`)));
+  });
+  if (version !== 'opencode v0.0.0-ctg.2.0.32') throw new Error(`Unexpected owned CLI identity: ${version}`);
+  const files = await import('node:fs/promises');
+  for (const key of ['HOME', 'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_STATE_HOME', 'XDG_CACHE_HOME', 'OPENCODE_DB']) {
+    const value = env[key];
+    if (!value || !path.resolve(value).startsWith(`${path.resolve(root)}${path.sep}`)) throw new Error(`${key} escaped disposable runtime root: ${value}`);
+  }
+  await files.mkdir(env.OPENCODE_CONFIG_DIR, { recursive: true, mode: 0o700 });
+  await writeFile(path.join(env.OPENCODE_CONFIG_DIR, 'fixture-marker'), 'isolated');
+  console.log(JSON.stringify({ binary, version, profileRoot: root, result: 'PASS' }, null, 2));
+} finally {
+  const persisted = await readFile(path.join(root, 'config', 'opencode', 'fixture-marker'), 'utf8').catch(() => undefined);
+  if (persisted !== 'isolated') throw new Error('Temporary profile fixture did not persist inside the isolated root.');
+  await rm(root, { recursive: true, force: true });
+}

package/tools/test-owned-visual-clear-env.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+"""Unit tests for the visual-clear probe's subprocess environment boundary."""
+import importlib.util
+from pathlib import Path
+import unittest
+
+MODULE = Path(__file__).with_name('owned-visual-clear-env.py')
+SPEC = importlib.util.spec_from_file_location('owned_visual_clear_env', MODULE)
+ENV = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(ENV)
+MODEL_PATH = Path(__file__).with_name('owned-visual-clear-model.py')
+MODEL_SPEC = importlib.util.spec_from_file_location('owned_visual_clear_model', MODEL_PATH)
+MODEL = importlib.util.module_from_spec(MODEL_SPEC)
+MODEL_SPEC.loader.exec_module(MODEL)
+
+
+class ChildEnvironmentTests(unittest.TestCase):
+    def test_latest_message_uses_newest_first_api_order_including_idle_events(self):
+        latest = {'id': 'msg_idle', 'type': 'idle'}
+        older = {'id': 'msg_user', 'type': 'user', 'text': 'prompt'}
+        self.assertEqual(MODEL.latest_message({'data': [latest, older]}), latest)
+        with self.assertRaisesRegex(ValueError, 'no messages'):
+            MODEL.latest_message({'data': []})
+
+    def test_canonical_conversation_matches_newest_first_data_and_detects_mutation(self):
+        oldest = {
+            'id': 'msg_old', 'type': 'user', 'text': 'first exact prompt',
+            'time': {'created': 1},
+        }
+        newest = {
+            'id': 'msg_new', 'type': 'assistant', 'text': 'second exact reply',
+            'time': {'created': 2},
+        }
+        after_followup = [oldest, newest]
+        # The API's newest-first ordering must compare equal to the same durable
+        # transcript captured in a different order, retaining exact message data.
+        newest_first_api = [newest, oldest]
+        self.assertEqual(MODEL.canonical_conversation(newest_first_api),
+                         MODEL.canonical_conversation(after_followup))
+        self.assertEqual(MODEL.canonical_conversation(newest_first_api),
+                         MODEL.canonical_conversation([oldest, newest]))
+
+        mutated_api = [newest, {**oldest, 'text': 'changed prompt'}]
+        self.assertNotEqual(MODEL.canonical_conversation(mutated_api),
+                            MODEL.canonical_conversation(after_followup))
+        changed_id_api = [newest, {**oldest, 'id': 'msg_replaced'}]
+        self.assertNotEqual(MODEL.canonical_conversation(changed_id_api),
+                            MODEL.canonical_conversation(after_followup))
+
+    def test_fixture_environment_only_inherits_explicit_platform_basics(self):
+        ambient = {
+            'PATH': '/trusted/test/path',
+            'LANG': 'C.UTF-8',
+            'LC_ALL': 'C',
+            'HOME': '/real/user/home',
+            'AWS_SECRET_ACCESS_KEY': 'FAKE_AWS_SECRET_FOR_TEST',
+            'GITHUB_TOKEN': 'FAKE_GITHUB_TOKEN_FOR_TEST',
+            'CTG_RUNTIME_GITHUB_TOKEN': 'FAKE_RUNTIME_TOKEN_FOR_TEST',
+            'NODE_OPTIONS': '--require=/credential-stealing.js',
+            'OPENCODE_CONFIG': '/real/user/profile.json',
+        }
+        result = ENV.fixture_environment(
+            ambient, '/tmp/clear-test-home', '/tmp/owned-root', '/tmp/release.json')
+        self.assertEqual(result['PATH'], ambient['PATH'])
+        self.assertEqual(result['LANG'], ambient['LANG'])
+        self.assertEqual(result['LC_ALL'], ambient['LC_ALL'])
+        self.assertEqual(result['HOME'], '/tmp/clear-test-home')
+        self.assertEqual(result['CTG_OWNED_OPENCODE_RUNTIME'], '/tmp/owned-root')
+        self.assertEqual(result['CTG_TEST_RUNTIME_RELEASE_MANIFEST'], '/tmp/release.json')
+        self.assertFalse({'AWS_SECRET_ACCESS_KEY', 'GITHUB_TOKEN',
+                          'CTG_RUNTIME_GITHUB_TOKEN', 'NODE_OPTIONS',
+                          'OPENCODE_CONFIG'} & result.keys())
+
+    def test_tui_allowlist_rejects_unknown_and_case_variant_reserved_credentials(self):
+        clean = ENV.fixture_environment(
+            {'PATH': '/usr/bin', 'LANG': 'C.UTF-8'},
+            '/tmp/clear-test-home', '/tmp/owned-root', '/tmp/release.json')
+        clean = {key: value for key, value in clean.items() if key in ENV.TUI_ENV_KEYS}
+        clean.update({'TERM': 'xterm-256color', 'OPENCODE_PASSWORD': 'FAKE_FIXTURE_PASSWORD'})
+        ENV.assert_clean_child_environment(clean)
+
+        with self.assertRaisesRegex(AssertionError, 'non-allowlisted'):
+            ENV.assert_clean_child_environment({**clean, 'AWS_SECRET_ACCESS_KEY': 'FAKE'})
+        with self.assertRaisesRegex(AssertionError, 'reserved runtime download'):
+            ENV.assert_clean_child_environment({**clean, 'ctg_runtime_github_token': 'FAKE'})
+
+    def test_node_helper_environment_does_not_forward_parent_credentials(self):
+        fake_parent = {
+            'PATH': '/usr/bin',
+            'LANG': 'C.UTF-8',
+            'AWS_SECRET_ACCESS_KEY': 'FAKE_AWS_SECRET_FOR_TEST',
+            'SSH_AUTH_SOCK': '/fake/agent.sock',
+            'NPM_TOKEN': 'FAKE_NPM_TOKEN_FOR_TEST',
+            'GH_TOKEN': 'FAKE_GH_TOKEN_FOR_TEST',
+        }
+        child = ENV.fixture_environment(
+            fake_parent, '/tmp/isolated-home', '/tmp/owned', '/tmp/manifest.json')
+        self.assertEqual(set(child) - set(ENV.SAFE_PARENT_ENV) - {
+            'HOME', 'USERPROFILE', 'CTG_OWNED_OPENCODE_RUNTIME',
+            'CTG_TEST_RUNTIME_RELEASE_MANIFEST', 'XDG_CONFIG_HOME', 'XDG_DATA_HOME',
+            'XDG_STATE_HOME', 'XDG_CACHE_HOME'}, set())
+
+    def test_preflight_receives_no_ambient_secrets_or_runtime_download_token(self):
+        ambient = {
+            'PATH': '/usr/bin', 'LANG': 'C.UTF-8',
+            'CTG_RUNTIME_GITHUB_TOKEN': 'FAKE_RUNTIME_GITHUB_TOKEN',
+            'GITHUB_TOKEN': 'FAKE_GITHUB_TOKEN',
+            'AWS_ACCESS_KEY_ID': 'FAKE_AWS_ACCESS_KEY',
+            'NODE_OPTIONS': '--require=fake-preload.js',
+        }
+        child = ENV.fixture_environment(
+            ambient, '/tmp/isolated-home', '/tmp/owned', '/tmp/manifest.json')
+        ENV.assert_clean_child_environment(child, ENV.FIXTURE_ENV_KEYS)
+        self.assertFalse(any(name.casefold() == 'ctg_runtime_github_token' for name in child))
+        self.assertFalse({'GITHUB_TOKEN', 'AWS_ACCESS_KEY_ID', 'NODE_OPTIONS'} & child.keys())
+
+
+
+if __name__ == '__main__':
+    unittest.main()