carthagent 1.1.0-beta.3 → 1.1.0-beta.4

package/docs/release-notes-beta.4.md

@@ -0,0 +1,18 @@
+# Carthagent 1.1.0-beta.4
+
+## Cloud-first onboarding
+
+- Fresh home shows **Continue with Carthagent Cloud** and explains sign-in and eligible starter credit.
+- `/login` opens Cloud authorization directly. `/connect` opens the provider picker with Cloud first under Recommended.
+- Terminal `ctg login` accepts Enter to choose its recommended Cloud default.
+
+## Continuing useful tasks
+
+- An explicit model selection when resuming a headless session now changes that session's model before continuing.
+- Headless observation allows at least 30 minutes instead of interrupting tasks after two minutes. Persistent execution budgets still apply, and `--reset-budget` remains an explicit authorization.
+
+## Validation scope
+
+The onboarding candidate was exercised in real narrow and wide terminals, with email authorization and actual model calls. A real Cloud ledger and Stripe test-mode payment verified quota rejection, payment activation, and explicit paid continuation of the same session. Payment alone did not restart the task or modify its files.
+
+Independent review rejected the generated expense-reporting task as unfinished and incorrect; this release does not claim successful completion of that task or production inference acceptance. See [the acceptance record](cloud-fresh-install-acceptance.md) for details and the local-profile backup incident.

package/lib/opencode/cli-runtime.mjs

@@ -644,6 +644,11 @@ export async function createOpenCodeCliRuntime({ cwd = process.cwd(), io = conso
       let result;
       let headlessError;
       const requestedSession = options.session;
+      if (requestedSession && explicitModelSelection && model && !signal.controller.signal.aborted) {
+        const resumed = await client.session.get({ sessionID: requestedSession }, { signal: signal.controller.signal });
+        assertSessionWorkspace(resumed, cwd);
+        await client.session.switchModel({ sessionID: requestedSession, model }, { location: { directory: cwd }, signal: signal.controller.signal });
+      }
       if (requestedSession && Object.keys(sessionSettings).length && !signal.controller.signal.aborted) {
         await persistSessionOptions(client, requestedSession, metadata, sessionSettings, { signal: signal.controller.signal, directory: cwd });
       }
@@ -658,6 +663,9 @@ export async function createOpenCodeCliRuntime({ cwd = process.cwd(), io = conso
       }
       try {
         result = await headlessApi.runHeadless(service, cwd, framedPrompt || prompt || '', {
+          // The transport observer must allow useful coding tasks to finish.
+          // Persistent execution budgets remain enforced by the host plugin.
+          timeout: Math.max(30 * 60_000, (Number(sessionSettings.maxSeconds) || 0) * 1000 + 5000),
           sessionID: options.session,
           session: {
             title: promptText.slice(0, 80), ...(model ? { model } : {}), metadata,
@@ -781,9 +789,10 @@ export async function createOpenCodeCliRuntime({ cwd = process.cwd(), io = conso
       : interactive.find(item => item.id === 'experiential-labs') || interactive[0];
     if (!target && interactive.length > 1) {
       const prompt = readlineFactory({ input: stdin, output: stdout });
-      const choices = interactive.map((item, index) => `${index + 1}) ${item.name}`).join('\n');
-      const selected = await questionWithAbort(prompt, `Select provider:\n${choices}\nProvider number: `, controller.signal);
-      const index = Number(selected) - 1;
+      const defaultIndex = interactive.indexOf(integration);
+      const choices = interactive.map((item, index) => `${index + 1}) ${item.name}${item.id === 'experiential-labs' ? ' (recommended)' : ''}`).join('\n');
+      const selected = await questionWithAbort(prompt, `Select provider:\n${choices}\nProvider number [${defaultIndex + 1}]: `, controller.signal);
+      const index = selected.trim() === '' ? defaultIndex : Number(selected) - 1;
       if (!Number.isInteger(index) || index < 0 || index >= interactive.length) throw new Error('Select a listed provider number.');
       integration = interactive[index];
     }

package/lib/opencode/runtime-release.json

@@ -1,36 +1,36 @@
 {
   "version": 1,
-  "releaseVersion": "1.1.0-beta.3",
+  "releaseVersion": "1.1.0-beta.4",
   "compatibilityVersion": "2.0.32",
   "runtimeVersion": "0.0.0-ctg.2.0.32",
   "sourceRevision": "843a6c514e606b436a7fe713422ace0a93ad3d61",
-  "patchSha256": "ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975",
+  "patchSha256": "31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631",
   "lockSha256": "9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d",
   "assets": {
     "linux-x64": {
       "name": "opencode-linux-x64.tar.gz",
-      "archiveSha256": "ab95bd99fc2bf52f867927a817dde1d3882122b80f85ef85cf416733afa62483",
-      "executableSha256": "f9ad13d8aad76bf1d16334712f0060b886757f5cdabddacce42f9805d4482c1c"
+      "archiveSha256": "abdecf765542afe7e843059e73ecdd35d189ae8d02a7d41524cd7c28f02fce99",
+      "executableSha256": "9f998cb2d23e2c18258a5bcb9a9588228e6fef9f089b13bb2f74b80d8ee8d7f6"
     },
     "linux-arm64": {
       "name": "opencode-linux-arm64.tar.gz",
-      "archiveSha256": "3869dd9398693afffe9f438192fbb12061b66a211993018379fb6870d2012bd2",
-      "executableSha256": "0c302d55bba608d83c42f54b769ec3994421d3dcb16ea5d2a9455dcd91f884a1"
+      "archiveSha256": "d5e2315f3df07cb79c50c6b5221e1f5bb5ce029997ff30eaba5c71834d95d467",
+      "executableSha256": "38d4707b301966145cd6cc1dbf23c656a52f42d536c5ae219507f0473ebae97d"
     },
     "darwin-x64": {
       "name": "opencode-darwin-x64.tar.gz",
-      "archiveSha256": "b20111d8fd2368ac9bde7f90b12835a465b8c92da3db1f3a35671860a325eb27",
-      "executableSha256": "23f7a845e75592efa11dff407e147287584eae7f63fca1a9c4ccbe9558656bc3"
+      "archiveSha256": "568b1e3a5103421f0a08627b985b53becd727097644c1e5e6f5d5be393ecaea3",
+      "executableSha256": "4f69cbae17e1c83149cf1066adc117b0e35173158315fe8e841606510f34f770"
     },
     "darwin-arm64": {
       "name": "opencode-darwin-arm64.tar.gz",
-      "archiveSha256": "eb65c635c8cf19f0830b56b2d8087387148edaf44cf821c881b72388c9c185fd",
-      "executableSha256": "d10a7b549748a131c578ed8cd041aeb652f1ae9c79c5f3912a731f2a69218736"
+      "archiveSha256": "1b164b4bcec032d7bc8276a6e585d7a469625a22408c3499f210bea562c96075",
+      "executableSha256": "42733a9a95257373f62ed9663ffbed2478456c537ee7f0d3f3bbdf91418de697"
     },
     "windows-x64": {
       "name": "opencode-windows-x64.tar.gz",
-      "archiveSha256": "a0309761781f57b5ea9f329d41f2e977391949addc9baaca6b85025780249d3c",
-      "executableSha256": "91eac290633313c7fce4a426ef265f193e995b285746df6a2a6010f4727fe813"
+      "archiveSha256": "535ecb051cf4f43f2acf3c18bec599a6739d7ff6565e32852e041addcc868806",
+      "executableSha256": "64b3052060df8ed07406c4b42b3a1d56e3500a7e2cd732756d615d443d9c0f33"
     }
   }
 }

package/lib/opencode/runtime.mjs

@@ -13,12 +13,12 @@ export const OPENCODE_VERSION = '2.0.32';
 export const CTG_RUNTIME_VERSION = '0.0.0-ctg.2.0.32';
 export const CTG_RUNTIME_SOURCE = '843a6c514e606b436a7fe713422ace0a93ad3d61';
 export const CTG_RUNTIME_LOCK_SHA256 = '9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d';
-export const CTG_RUNTIME_PATCH_SHA256 = 'ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975';
+export const CTG_RUNTIME_PATCH_SHA256 = '31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631';
 // Update only this development pin after reviewing a new checked-in patch and
 // script/ctg/prepare-development-runtime.sh. The published release pin above,
 // its build recipe, and the release manifest stay immutable until a separately
 // verified runtime release is promoted.
-export const CTG_DEVELOPMENT_RUNTIME_PATCH_SHA256 = 'ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975';
+export const CTG_DEVELOPMENT_RUNTIME_PATCH_SHA256 = '31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631';
 const DEFAULT_ROOT = path.join(homedir(), '.carthagent', 'opencode');
 const require = createRequire(import.meta.url);
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "carthagent",
-  "version": "1.1.0-beta.3",
+  "version": "1.1.0-beta.4",
   "workspaces": [
     "plugins/carthagent"
   ],

package/plugins/carthagent/src/tui.tsx

@@ -3,7 +3,7 @@ import { Plugin } from "@opencode/plugin/tui";
 import { Show } from "solid-js";
 import { writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
-import { nativeProviderName } from "../../../lib/opencode/provider-policy.mjs";
+import { nativeLoginProvider, nativeProviderName } from "../../../lib/opencode/provider-policy.mjs";
 import { framePrompt } from "../../../lib/tui/framing.mjs";
 import { carthagentConfigPath, loadCarthagentConfig, resolveReviewMode, reviewKickoff, saveCarthagentConfig } from "../../../lib/review.mjs";
 import { COMMANDS, NATIVE_COMMAND_COLLISIONS } from "./ui/commands.js";
@@ -114,7 +114,7 @@ export default Plugin.define({
           context.ui.router.navigate({ type: "plugin", name: "daily-quests", data: { ...(sessionID ? { sessionID } : {}) } });
           return;
         case "login":
-          context.keymap.dispatch("provider.connect");
+          context.keymap.dispatch("provider.connect", arg ? nativeLoginProvider(arg)?.id ?? arg : "experiential-labs");
           return;
         case "help": case "ctg-help":
           await context.ui.dialog.alert({ title: "Carthagent commands", message: COMMANDS.map((command) => `/${command.name}${command.args ? ` ${command.args}` : ""}${command.aliases?.length ? ` (${command.aliases.map((alias) => `/${alias}`).join(", ")})` : ""} — ${command.description}`).join("\n") + "\n\nCtrl+R sessions · Ctrl+T settings · Ctrl+N new session are native Carthagent actions." });

package/script/ctg/build-owned-runtime.sh

@@ -6,7 +6,7 @@ set -euo pipefail
 ROOT="$(git rev-parse --show-toplevel)"
 EXPECTED_SOURCE="843a6c514e606b436a7fe713422ace0a93ad3d61"
 EXPECTED_LOCK="9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d"
-EXPECTED_PATCH="ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975"
+EXPECTED_PATCH="31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631"
 TARGET="${1:-opencode-linux-x64}"
 HOST_PLATFORM="$(node -p 'process.platform')"
 HOST_ARCH="$(node -p 'process.arch')"
@@ -34,7 +34,7 @@ if ! git diff --cached --quiet HEAD --; then
   exit 1
 fi
 expected_inputs=(
-  "docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch"
+  "docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch"
   "script/ctg/build-owned-runtime.sh"
 )
 actual_status="$(git status --porcelain --untracked-files=all)"
@@ -86,7 +86,7 @@ if [[ "$(bun --version)" != "1.4.2" ]]; then
   exit 1
 fi
 
-patch_file="$ROOT/docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch"
+patch_file="$ROOT/docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch"
 actual_patch="$("${HASH_COMMAND[@]}" "$patch_file" | awk '{print $1}')"
 if [[ "$actual_patch" != "$EXPECTED_PATCH" ]]; then
   echo "Patch checksum mismatch: $actual_patch" >&2

package/tests/native-ship-plan.test.mjs

@@ -10,7 +10,7 @@ import ts from 'typescript';
 import { parseOpenCodeArgs } from '../lib/opencode/cli.mjs';
 import { normalizeSessionOptions } from '../lib/opencode/session-options.mjs';
 
-const patch = readFileSync(new URL('../docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch', import.meta.url), 'utf8');
+const patch = readFileSync(new URL('../docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch', import.meta.url), 'utf8');
 const path = 'packages/tui/src/routes/session/plan-items.ts';
 const section = patch.split(`diff --git a/${path} b/${path}\n`)[1]?.split('\ndiff --git ')[0];
 assert.ok(section, 'the plan graph parser is part of the reproducible runtime patch');
@@ -72,14 +72,19 @@ test('development runtime source and preparation recipe pin the actual Ship grap
   assert.equal(CTG_DEVELOPMENT_RUNTIME_PATCH_SHA256, digest);
   const prepare = readFileSync(new URL('../script/ctg/prepare-development-runtime.sh', import.meta.url), 'utf8');
   assert.ok(prepare.includes(`EXPECTED_PATCH="${digest}"`));
-  assert.ok(prepare.includes('docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch'));
+  assert.ok(prepare.includes('docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch'));
   assert.doesNotMatch(prepare, /bun (install|run|build)|gh release|npm publish/);
 });
 
-test('the shared release build recipe stays on the published patch', () => {
-  const published = readFileSync(new URL('../docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch', import.meta.url));
+test('the published runtime pin stays on its immutable release patch', () => {
+  const published = readFileSync(new URL('../docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch', import.meta.url));
   const digest = createHash('sha256').update(published).digest('hex');
   assert.equal(CTG_RUNTIME_PATCH_SHA256, digest);
+});
+
+test('the candidate build recipe pins the reviewed onboarding patch', () => {
+  const digest = createHash('sha256').update(patch).digest('hex');
   const build = readFileSync(new URL('../script/ctg/build-owned-runtime.sh', import.meta.url), 'utf8');
   assert.ok(build.includes(`EXPECTED_PATCH="${digest}"`));
+  assert.ok(build.includes('docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch'));
 });

package/tests/opencode-cli.test.mjs

@@ -552,6 +552,27 @@ test('no-prompt interactive explicit model and thinking selection applies to fre
   }
 });
 
+test('headless continuation switches an explicitly requested model before submitting to the same session', async () => {
+  const calls = [];
+  const runtime = await createOpenCodeCliRuntime({ cwd: '/project', stdout: { write() {} }, native: {
+    runtime: {}, service: { ensureService: async () => ({ url: 'http://127.0.0.1:1', headers: {} }) },
+    headless: { runHeadless: async (_service, _cwd, _prompt, options) => {
+      calls.push(['run', options.sessionID]);
+      assert.equal(options.timeout, 30 * 60_000);
+      return { session: { id: options.sessionID }, outcome: 'failed', terminal: true, messages: [] };
+    } },
+    clientFactory: async () => ({ session: {
+      get: async () => ({ id: 'ses_existing', location: { directory: '/project' }, metadata: {} }),
+      switchModel: async input => calls.push(['switch', input]),
+    } }),
+  } });
+  await runtime.run({ mode: 'headless', options: { session: 'ses_existing', provider: 'fixture', model: 'cheaper-model' }, prompt: 'continue' });
+  assert.deepEqual(calls, [
+    ['switch', { sessionID: 'ses_existing', model: { providerID: 'fixture', id: 'cheaper-model' } }],
+    ['run', 'ses_existing'],
+  ]);
+});
+
 test('resumed interactive model selection verifies workspace ownership before any session mutation or launch', async t => {
   const { mkdtempSync, rmSync } = await import('node:fs');
   const { tmpdir } = await import('node:os');
@@ -576,6 +597,11 @@ test('resumed interactive model selection verifies workspace ownership before an
     mode: 'interactive', options: { session: 'ses_foreign', model: 'fixture/explicit-model', maxTools: '3' }, prompt: '',
   }), /another workspace/);
   assert.deepEqual(calls, [['get', 'ses_foreign']], 'ownership is checked before switching models, updating metadata, or launching TUI');
+  calls.length = 0;
+  await assert.rejects(runtime.run({
+    mode: 'headless', options: { session: 'ses_foreign', model: 'fixture/explicit-model' }, prompt: 'continue',
+  }), /another workspace/);
+  assert.deepEqual(calls, [['get', 'ses_foreign']], 'headless model switches enforce the same workspace boundary');
 });
 
 test('interactive provider or thinking flags without a model fail instead of being silently ignored', async () => {
@@ -786,18 +812,19 @@ test('resumed native sessions merge explicit launcher options into their own wor
   assert.deepEqual(framingOverrides, [{ sessionID: 'ses_existing', enabled: false }]);
 });
 
-test('native login uses OpenCode integration OAuth status and completion lifecycle', async () => {
+test('native login defaults to Cloud on Enter and completes the host OAuth lifecycle', async () => {
   const calls = [];
   const opened = [];
+  const prompts = [];
   const service = { url: 'http://127.0.0.1:1', headers: {} };
   const integration = {
     id: 'experiential-labs', name: 'Carthagent Ship',
     methods: [{ id: 'carthagent-device', type: 'oauth', label: 'Sign in with Carthagent Ship' }],
   };
-  const runtime = await createOpenCodeCliRuntime({ cwd: '/project', io: ioCapture().io, stdin: { isTTY: true }, stdout: { isTTY: true }, openBrowserImpl: async url => { opened.push(url); return true; }, native: {
+  const runtime = await createOpenCodeCliRuntime({ cwd: '/project', io: ioCapture().io, stdin: { isTTY: true }, stdout: { isTTY: true }, readlineFactory: () => ({ close() {}, question: async text => { prompts.push(text); return ''; } }), openBrowserImpl: async url => { opened.push(url); return true; }, native: {
     runtime: {}, service: { ensureService: async () => service }, headless: {},
     clientFactory: async () => ({ integration: {
-      list: async input => { calls.push(['list', input]); return { data: [integration] }; },
+      list: async input => { calls.push(['list', input]); return { data: [{ id: 'openai', name: 'OpenAI', methods: [{ type: 'key' }] }, integration] }; },
       oauth: {
         connect: async input => { calls.push(['connect', input]); return { data: {
           attemptID: 'attempt-1', url: 'https://auth.example/device', instructions: 'Approve access', mode: 'auto',
@@ -809,6 +836,9 @@ test('native login uses OpenCode integration OAuth status and completion lifecyc
     } }),
   } });
   assert.equal(await runtime.login(), 0);
+  assert.match(prompts[0], /1\) Carthagent Cloud \(recommended\)/);
+  assert.match(prompts[0], /Provider number \[1\]:/);
+  assert.equal(calls[1][1].integrationID, 'experiential-labs');
   assert.deepEqual(opened, ['https://auth.example/device']);
   assert.deepEqual(calls.map(([name]) => name), ['list', 'connect', 'status']);
   assert.equal(calls[1][1].methodID, 'carthagent-device');

package/tests/owned-runtime-publish-workflow.test.mjs

@@ -106,7 +106,7 @@ function workflowJob(name) {
   return lines.slice(start, end).join('\n');
 }
 
-const combinedPatchPath = 'docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch';
+const combinedPatchPath = 'docs/patches/opencode-v2.0.32-session-ui-combined-v6.patch';
 
 function sha256(bytes) {
   return createHash('sha256').update(bytes).digest('hex');
@@ -181,7 +181,13 @@ async function fixture(t) {
   execFileSync('git', ['init', '-q'], { cwd: ctg });
   execFileSync('git', ['-c', 'user.name=Workflow Fixture', '-c', 'user.email=fixture@example.invalid', 'add', combinedPatchPath, 'script/ctg/build-owned-runtime.sh'], { cwd: ctg });
   execFileSync('git', ['-c', 'user.name=Workflow Fixture', '-c', 'user.email=fixture@example.invalid', 'commit', '-qm', 'fixture candidate patch'], { cwd: ctg });
-  await copyFile(path.join(root, 'lib/opencode/runtime.mjs'), path.join(ctg, 'lib/opencode/runtime.mjs'));
+  // Publication uses a final package whose trust pin has been promoted after
+  // prebuild; the working tree may still retain the previous public release.
+  const runtimeSource = await readFile(path.join(root, 'lib/opencode/runtime.mjs'), 'utf8');
+  await writeFile(path.join(ctg, 'lib/opencode/runtime.mjs'), runtimeSource.replace(
+    /CTG_RUNTIME_PATCH_SHA256 = '[a-f0-9]{64}'/,
+    `CTG_RUNTIME_PATCH_SHA256 = '${patchSha256}'`,
+  ));
 
   const manifest = {
     version: 1,
@@ -403,9 +409,9 @@ test('draft metadata validation has scoped write capability; artifact mutation s
   assert.doesNotMatch(assembly, /contents: write/);
   assert.match(publish, /contents: write/);
   assert.match(uploadBlock, /gh release upload/);
-  assert.match(workflow, /git -C ctg show HEAD:docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v5\.patch > opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v5\.patch/);
-  assert.match(workflow, /patch_sha256="\$\(hash_file opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v5\.patch\)"/);
-  assert.equal((workflow.match(/git -C ctg show HEAD:docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v5\.patch > ctg\/docs\/patches\/opencode-v2\.0\.32-session-ui\.patch/g) ?? []).length, 1,
+  assert.match(workflow, /git -C ctg show HEAD:docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v6\.patch > opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v6\.patch/);
+  assert.match(workflow, /patch_sha256="\$\(hash_file opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v6\.patch\)"/);
+  assert.equal((workflow.match(/git -C ctg show HEAD:docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v6\.patch > ctg\/docs\/patches\/opencode-v2\.0\.32-session-ui\.patch/g) ?? []).length, 1,
     'candidate assembly must extract exact committed bytes at the pinned historical path');
   assert.match(verifyBlock, /git -C ctg show HEAD:script\/ctg\/build-owned-runtime\.sh/);
   assert.match(verifyBlock, /git -C ctg show "HEAD:\$patch_file" > ctg\/docs\/patches\/opencode-v2\.0\.32-session-ui\.patch/);
@@ -413,7 +419,7 @@ test('draft metadata validation has scoped write capability; artifact mutation s
   assert.match(workflow, /chmod \+x opencode\/script\/ctg\/build-owned-runtime\.sh/);
   assert.match(workflow, /GIT_CONFIG_KEY_0:\s*core\.autocrlf[\s\S]*?GIT_CONFIG_VALUE_0:\s*'false'/);
   assert.match(workflow, /git -C opencode config --local core\.autocrlf false/);
-  assert.match(workflow, /patch_sha256="\$\(hash_file opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v5\.patch\)"/);
+  assert.match(workflow, /patch_sha256="\$\(hash_file opencode\/docs\/patches\/opencode-v2\.0\.32-session-ui-combined-v6\.patch\)"/);
 });
 
 test('review-branch prebuild source is exact dispatch SHA; publish validation is default-branch-only', { skip: requiresUbuntuWorkflowShell, timeout: 60000 }, async (t) => {

package/tests/runtime-development-trust.test.mjs

@@ -83,7 +83,7 @@ async function fixture(t, patchSha256 = developmentPatch) {
 }
 
 test('packaged release trust stays valid independently of the development patch pin', async t => {
-  assert.equal(CTG_RUNTIME_PATCH_SHA256, 'ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975');
+  assert.equal(CTG_RUNTIME_PATCH_SHA256, '31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631');
   const published = await readRuntimeReleaseManifest();
   const packageJson = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
   assert.equal(published.releaseVersion, packageJson.version);