codiedev 0.10.0-beta.4 → 0.10.0-beta.5

package/dist/codieBrandInstall.js

@@ -1,13 +1,4 @@
 "use strict";
-// Stages the Codiedev TUI plugin into the engine's config directory.
-//
-// TUI plugins load only from tui.json in the OpenCode config dir, so the
-// packaged template is copied there and referenced by a relative spec. The
-// copy also carries the status line, which needs an absolute path back into
-// this package — the plugin sits outside it and cannot reach it any other way.
-//
-// Every step is best-effort: a developer who cannot write this directory still
-// gets a working harness, just the stock logo and no status line.
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -50,15 +41,8 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const codieLauncher_1 = require("./codieLauncher");
 function assetPath(name) {
-    // dist/codieBrandInstall.js → ../assets/<name>; src/… → ../assets/<name>.
     return path.join(__dirname, "..", "assets", name);
 }
-/**
- * The usage module this install should load. The shipped package has the
- * compiled file; a source checkout (and the test run) has the TypeScript one.
- * Naming a path that does not exist would cost the status line silently, so a
- * miss raises instead and the caller falls back to the plain plugin.
- */
 function usageModulePath() {
     const candidates = [
         path.join(__dirname, "codieUsage.js"),
@@ -69,8 +53,6 @@ function usageModulePath() {
         throw new Error("this install has no Codiedev usage module");
     return found;
 }
-/** The engine resolves its config dir per the XDG spec, so a customized
- * XDG_CONFIG_HOME must be honored or tui.json lands where it never reads. */
 function openCodeConfigDir() {
     return path.join(process.env.XDG_CONFIG_HOME?.trim() || path.join(os.homedir(), ".config"), "opencode");
 }

package/dist/codieLauncher.js

@@ -1,13 +1,4 @@
 "use strict";
-// Pure launcher logic for the Codie harness.
-//
-// Ported from codiedev-gateway-cli/npm/lib/launcher.js when the harness folded
-// into this package so `npm i -g codiedev` is the only install a developer
-// needs — Claude Code, Codex, Cursor, and Codie all come from one package and
-// share the one token `codiedev connect` stored.
-//
-// Everything here is pure (no fs/network side effects beyond an injected
-// fetch) so the governance rules can be tested without a live gateway.
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -58,6 +49,7 @@ exports.parseCodieArgs = parseCodieArgs;
 exports.validateCodieArgs = validateCodieArgs;
 const path = __importStar(require("path"));
 const url_1 = require("url");
+const harnessDirs_1 = require("./harnessDirs");
 const DEFAULT_NAMES = {
     "openai/gpt-5.6-luna": "GPT-5.6 Luna",
     "openai/gpt-5.3-codex": "GPT-5.3 Codex",
@@ -67,9 +59,6 @@ const DEFAULT_NAMES = {
     "z-ai/glm-5.2": "GLM 5.2 · Fireworks ZDR",
     "moonshotai/kimi-k2.7-code": "Kimi K2.7 Code · Fireworks ZDR",
 };
-/** A rate card is usable only when both sides are real, finite and not
- * negative. Half a card prices a session wrong in a way nobody can see, so a
- * partial one is dropped and the model stays unpriced. */
 function usableModelCost(value) {
     if (!value || typeof value !== "object")
         return undefined;
@@ -82,10 +71,6 @@ function usableModelCost(value) {
         return undefined;
     return { input, output };
 }
-/** A context/output window is usable only when both sides are real, finite and
- * positive. A partial window makes the engine's "% of context used" read wrong
- * in a way nobody can see, so a partial one is dropped and the model keeps the
- * engine's default. */
 function usableModelLimit(value) {
     if (!value || typeof value !== "object")
         return undefined;
@@ -99,9 +84,6 @@ function usableModelLimit(value) {
     return { context, output };
 }
 exports.CODIE_SECURITY_BLOCK_MARKER = "__CODIEDEV_SECURITY_BLOCK__";
-/** Extract the private adapter marker used to carry a local block reason
- * across OpenCode's generic 500 boundary. The marker never contains prompt or
- * tool input — only the deterministic policy reason. */
 function extractCodieSecurityBlock(stderr) {
     for (const line of stderr.split(/\r?\n/)) {
         const markerIndex = line.indexOf(exports.CODIE_SECURITY_BLOCK_MARKER);
@@ -113,17 +95,10 @@ function extractCodieSecurityBlock(stderr) {
                 return parsed.reason.trim();
         }
         catch {
-            // Ignore malformed or foreign stderr and preserve the original runtime error.
         }
     }
     return undefined;
 }
-/**
- * Pin non-interactive runs to the directory where `codie` was launched.
- * OpenCode can reuse a previously-known project instance; without an explicit
- * --dir, a real smoke run launched in a throwaway repo resumed the caller's
- * main checkout and executed there. TUI mode already owns its cwd directly.
- */
 function withCodieWorkingDirectory(args, cwd) {
     if (args[0] !== "run")
         return args;
@@ -145,8 +120,6 @@ function governedModel(value, approved, fallback, label) {
     return `codiedev/${model}`;
 }
 function economicalModel(catalog, primary) {
-    // Catalog ids arrive already normalized through bareModel(), so the
-    // gateway's `codiedev/fast` alias appears here as plain "fast".
     const preferred = ["openai/gpt-5.1-codex-mini", "fast", "z-ai/glm-5.2"];
     return preferred.find((id) => catalog.some((model) => model.id === id)) || primary;
 }
@@ -178,11 +151,6 @@ function buildCodieConfig({ existing = {}, catalog, env = {}, plugin, plugins =
     const existingPlugins = Array.isArray(existing.plugin) ? existing.plugin : [];
     const requiredPlugins = [...plugins, plugin].filter(Boolean);
     const models = Object.fromEntries(catalog.map((model) => {
-        // The engine prices a session from this rate card. Without it every
-        // model reads $0.00, which is how the harness came to show no spend at
-        // all. The gateway publishes prompt and completion prices only, so
-        // cached tokens are priced at zero here and the engine's session figure
-        // stays an estimate — the budget line from /me/usage is the true spend.
         const cost = usableModelCost(model.cost);
         const limit = usableModelLimit(model.limit);
         return [
@@ -222,14 +190,6 @@ function buildCodieConfig({ existing = {}, catalog, env = {}, plugin, plugins =
     };
 }
 exports.USAGE_MODULE_PLACEHOLDER = "__CODIEDEV_USAGE_MODULE__";
-/**
- * Point the staged TUI plugin at this install's usage module.
- *
- * The plugin is copied into the engine's own config directory, so it cannot
- * reach the package by a relative path — the absolute path is baked in at
- * stage time. It goes in as a JSON literal so a Windows path keeps its
- * backslashes instead of turning into escape sequences.
- */
 function stageUsageModule(source, modulePath) {
     if (!source.includes(exports.USAGE_MODULE_PLACEHOLDER)) {
         throw new Error(`plugin template is missing the ${exports.USAGE_MODULE_PLACEHOLDER} placeholder`);
@@ -237,8 +197,6 @@ function stageUsageModule(source, modulePath) {
     return source.split(exports.USAGE_MODULE_PLACEHOLDER).join(JSON.stringify(modulePath));
 }
 exports.BRAND_PLUGIN_SPEC = "./plugins/codiedev-brand.tsx";
-// Pure merge for ~/.config/opencode/tui.json: TUI plugins load from tui.json,
-// not the opencode.json we inject via OPENCODE_CONFIG_CONTENT.
 function withBrandPlugin(existing) {
     const config = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
     const plugins = Array.isArray(config.plugin) ? config.plugin : [];
@@ -247,13 +205,6 @@ function withBrandPlugin(existing) {
         return { config, changed: false };
     return { config: { ...config, plugin: [...plugins, exports.BRAND_PLUGIN_SPEC] }, changed: true };
 }
-// ── Engine wordmark suppression ─────────────────────────────────────────
-// The OpenCode engine prints a block-letter "opencode" wordmark to terminal
-// scrollback around each session (the boot/exit banner). A four-row terminal
-// raster cannot reproduce the real Codiedev wordmark cleanly, so leave that
-// surface blank and keep the proper brand mark on the plugin-driven home
-// screen. The bundled JS table is replaced byte-for-byte so binary offsets do
-// not move.
 function escapeJsSource(row) {
     let out = "";
     for (const ch of row) {
@@ -266,7 +217,6 @@ function wordmarkRegion(left, right, { escapeUnicode = true } = {}) {
     const rows = (list) => list.map((row) => `"${escapeUnicode ? escapeJsSource(row) : row}"`).join(",");
     return `var vn={left:[${rows(left)}],right:[${rows(right)}]};`;
 }
-// o p e n | c o d e — must match the engine's bundle byte-for-byte.
 exports.STOCK_WORDMARK = wordmarkRegion([
     "                   ",
     "█▀▀█ █▀▀█ █▀▀█ █▀▀▄",
@@ -278,12 +228,6 @@ exports.STOCK_WORDMARK = wordmarkRegion([
     "█___ █__█ █__█ █^^^",
     "▀▀▀▀ ▀▀▀▀ ▀▀▀▀ ▀▀▀▀",
 ]);
-// c o d i | e d e v, rasterized from public/codiedevlogo.svg at eight vertical
-// pixels and packed into four terminal rows with half-block characters. This
-// preserves the real mark's round lowercase bowls, linked c/o, ascenders, and
-// compact v instead of approximating the letters with OpenCode's square font.
-// The engine inserts one column between left and right, so the blank source
-// column at the codi/edev boundary is intentionally omitted.
 const CODIE_LEFT = [
     "                   ▄ ▄",
     "  ▄▄█▄▄ ▄▄█▄▄  ▄████ █",
@@ -296,9 +240,6 @@ const CODIE_RIGHT = [
     "██▀▀█ █   █ ██▄▀█ ▀█▄█   ",
     "▀▀█▀▀ ▀▀▀▀▀  ▀▀▀▀  ▀▀    ",
 ];
-// Migration source for the first hand-drawn banner shipped during development.
-// Recognizing it lets an existing install upgrade in place instead of keeping
-// the old square letterforms until OpenCode happens to reinstall its binary.
 const LEGACY_CODIE_LEFT = [
     "             ▄  ▄  ",
     "█▀▀▀ █▀▀█ █▀▀█  █  ",
@@ -320,9 +261,6 @@ exports.LEGACY_CODIEDEV_WORDMARK = (() => {
     return wordmarkRegion(LEGACY_CODIE_LEFT, padded);
 })();
 exports.CODIEDEV_WORDMARK = (() => {
-    // Raw Unicode is valid JavaScript and costs fewer source bytes than \uXXXX.
-    // Put the remaining byte padding outside the strings so it cannot widen the
-    // rendered banner or shift its centering.
     const unpadded = wordmarkRegion(CODIE_LEFT, CODIE_RIGHT, { escapeUnicode: false });
     const deficit = Buffer.byteLength(exports.STOCK_WORDMARK) - Buffer.byteLength(unpadded);
     if (deficit < 0)
@@ -344,9 +282,6 @@ exports.HIDDEN_WORDMARK = (() => {
     }
     return region;
 })();
-// Pure: locate the stock or an earlier Codiedev wordmark in an engine binary.
-// Refuses to touch the file unless exactly one known region appears; an
-// already-hidden or reshaped upstream bundle is left alone.
 function patchBrandWordmark(binary) {
     const stock = Buffer.from(exports.STOCK_WORDMARK);
     const candidates = [stock, Buffer.from(exports.LEGACY_CODIEDEV_WORDMARK), Buffer.from(exports.CODIEDEV_WORDMARK)];
@@ -364,7 +299,7 @@ function patchBrandWordmark(binary) {
     return { changed: true, offset: matches[0], stock, replacement: Buffer.from(exports.HIDDEN_WORDMARK) };
 }
 function resolveCapturePlugin({ homeDir, existsSync, }) {
-    const capturePath = path.join(homeDir, ".config", "opencode", "plugins", "codiedev.js");
+    const capturePath = path.join((0, harnessDirs_1.openCodeConfigDir)(process.env, homeDir), "plugins", "codiedev.js");
     if (!existsSync(capturePath)) {
         throw new Error("Codiedev session capture is not installed. Run `codiedev connect` first");
     }
@@ -378,9 +313,6 @@ async function fetchApprovedCatalog({ baseUrl, key, fetchImpl = fetch, }) {
             headers: { Authorization: `Bearer ${key}` },
             signal: controller.signal,
         });
-        // The `codie` bin ships to every connected machine, including companies
-        // whose gateway is still switched off. Those developers must get an
-        // answer, not an HTTP status.
         if (response.status === 403) {
             throw new Error("The Codie harness is not enabled for your company yet. Ask your Codiedev admin to turn it on — " +
                 "your session capture keeps working in the meantime.");

package/dist/codieRuntime.js

@@ -1,14 +1,4 @@
 "use strict";
-// Where the Codie harness gets its engine.
-//
-// The engine (`opencode-ai`) is a ~132MB platform binary. It is deliberately
-// NOT a dependency of this package: the overwhelming majority of installs are
-// capture-only (Claude Code, Codex, Cursor) and must not pay for a harness
-// they never launch. So `npm i -g codiedev` stays small, and the first `codie`
-// run downloads the engine into the Codiedev state dir.
-//
-// Resolution is pure and injectable so the precedence can be tested without
-// touching the network or a real 132MB install.
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -43,20 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CODIE_MIN_NODE_MAJOR = exports.OPENCODE_RUNTIME_VERSION = exports.OPENCODE_RUNTIME_SPEC = void 0;
+exports.ENGINE_MIN_BYTES = exports.CODIE_MIN_NODE_MAJOR = exports.OPENCODE_RUNTIME_VERSION = exports.OPENCODE_RUNTIME_SPEC = void 0;
 exports.codieRuntimeDir = codieRuntimeDir;
+exports.isEngineSize = isEngineSize;
 exports.installedRuntimePackageJson = installedRuntimePackageJson;
 exports.resolveCodieRuntime = resolveCodieRuntime;
 exports.assertCodieNodeVersion = assertCodieNodeVersion;
 const path = __importStar(require("path"));
-// Pinned exactly, not a range. patchBrandWordmark() only rewrites bundles it
-// recognizes byte-for-byte, so a floating version would silently regress the
-// terminal branding whenever OpenCode ships a new build.
 exports.OPENCODE_RUNTIME_SPEC = "opencode-ai@1.18.4";
 exports.OPENCODE_RUNTIME_VERSION = exports.OPENCODE_RUNTIME_SPEC.slice(exports.OPENCODE_RUNTIME_SPEC.lastIndexOf("@") + 1);
-// The harness needs 20; capture does not. package.json `engines` stays >=18 so
-// `codiedev connect` still installs for Node 18 users — this floor is enforced
-// at `codie` launch instead.
 exports.CODIE_MIN_NODE_MAJOR = 20;
 function codieRuntimeDir(stateDir) {
     return path.join(stateDir, "runtime");
@@ -64,11 +49,14 @@ function codieRuntimeDir(stateDir) {
 function installedBinary(stateDir) {
     return path.join(codieRuntimeDir(stateDir), "node_modules", "opencode-ai", "bin", "opencode.exe");
 }
+exports.ENGINE_MIN_BYTES = 1_000_000;
+function isEngineSize(bytes) {
+    return bytes >= exports.ENGINE_MIN_BYTES;
+}
 function installedRuntimePackageJson(stateDir) {
     return path.join(codieRuntimeDir(stateDir), "node_modules", "opencode-ai", "package.json");
 }
-function resolveCodieRuntime({ env, stateDir, existsSync, readInstalledVersion, resolveBundled, }) {
-    // 1. Explicit override — the air-gapped / pre-provisioned escape hatch.
+function resolveCodieRuntime({ env, stateDir, existsSync, readInstalledVersion, resolveBundled, isEngine = () => true, }) {
     const override = env.CODIEDEV_OPENCODE_BINARY?.trim();
     if (override) {
         if (!existsSync(override)) {
@@ -76,15 +64,21 @@ function resolveCodieRuntime({ env, stateDir, existsSync, readInstalledVersion,
         }
         return { kind: "ready", binary: override };
     }
-    // 2. A bundled engine, if this package was installed with one (dev checkout,
-    //    or a future vendored distribution).
     const bundled = resolveBundled();
-    if (bundled)
+    if (bundled && isEngine(bundled))
         return { kind: "ready", binary: bundled };
-    // 3. The lazily installed engine.
     const binary = installedBinary(stateDir);
     if (existsSync(binary)) {
         const currentVersion = readInstalledVersion?.(installedRuntimePackageJson(stateDir)) ?? null;
+        if (!isEngine(binary) && (!currentVersion || currentVersion === exports.OPENCODE_RUNTIME_VERSION)) {
+            return {
+                kind: "unlinked",
+                installDir: codieRuntimeDir(stateDir),
+                binary,
+                spec: exports.OPENCODE_RUNTIME_SPEC,
+                packageDir: path.dirname(installedRuntimePackageJson(stateDir)),
+            };
+        }
         if (currentVersion && currentVersion !== exports.OPENCODE_RUNTIME_VERSION) {
             return {
                 kind: "outdated",
@@ -93,6 +87,8 @@ function resolveCodieRuntime({ env, stateDir, existsSync, readInstalledVersion,
                 spec: exports.OPENCODE_RUNTIME_SPEC,
                 currentVersion,
                 expectedVersion: exports.OPENCODE_RUNTIME_VERSION,
+                linked: isEngine(binary),
+                packageDir: path.dirname(installedRuntimePackageJson(stateDir)),
             };
         }
         return { kind: "ready", binary };

package/dist/codieRuntimeInstall.js

@@ -1,10 +1,4 @@
 "use strict";
-// First-run install of the OpenCode engine for the Codie harness.
-//
-// Staged then renamed: npm writes into a sibling staging directory and only an
-// install that actually produced the engine binary gets promoted to the real
-// runtime path. An interrupted or half-finished download therefore never
-// leaves a directory that resolveCodieRuntime() would report as "ready".
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -39,9 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.IGNORE_SCRIPTS = void 0;
 exports.buildRuntimeInstallArgs = buildRuntimeInstallArgs;
 exports.installCodieRuntime = installCodieRuntime;
 exports.ensureCodieRuntimeBinary = ensureCodieRuntimeBinary;
+exports.linkFailure = linkFailure;
+exports.windowsCommand = windowsCommand;
+exports.isEngineOnDisk = isEngineOnDisk;
+exports.npmIgnoresScripts = npmIgnoresScripts;
+exports.linkEngineOnDisk = linkEngineOnDisk;
 exports.installCodieRuntimeOnDisk = installCodieRuntimeOnDisk;
 exports.defaultStagingRoot = defaultStagingRoot;
 const fs = __importStar(require("fs"));
@@ -50,8 +50,6 @@ const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const codieRuntime_1 = require("./codieRuntime");
 function buildRuntimeInstallArgs(stagingDir, spec) {
-    // No --registry / --proxy: inherit whatever npm config the developer's
-    // machine already has so an internal mirror keeps working.
     return [
         "install",
         "--prefix",
@@ -64,7 +62,7 @@ function buildRuntimeInstallArgs(stagingDir, spec) {
     ];
 }
 function installCodieRuntime(deps) {
-    const { runtime, makeStagingDir, run, exists, rename, remove, log } = deps;
+    const { runtime, makeStagingDir, run, exists, rename, remove, log, isEngine = () => true, linkEngine } = deps;
     const staging = makeStagingDir();
     log(`Installing the Codie engine (${runtime.spec}). This runs once, and only for \`codie\`.`);
     let result;
@@ -79,56 +77,141 @@ function installCodieRuntime(deps) {
         remove(staging);
         throw installFailure(result.stderr?.trim() || `npm exited with ${result.status}`);
     }
-    // Trust the artifact, not the exit code — a misconfigured mirror can succeed
-    // with nothing useful in the tarball.
     const stagedBinary = path.join(staging, "node_modules", "opencode-ai", "bin", "opencode.exe");
     if (!exists(stagedBinary)) {
         remove(staging);
         throw new Error(`The Codie engine install did not produce a runtime binary. ` +
             `Check that ${runtime.spec} is available from your npm registry.`);
     }
+    if (!isEngine(stagedBinary)) {
+        let linked = { ok: false };
+        try {
+            linked = linkEngine?.(path.dirname(path.dirname(stagedBinary))) ?? { ok: false };
+        }
+        catch (error) {
+            linked = { ok: false, detail: error instanceof Error ? error.message : String(error) };
+        }
+        if (!linked.ok || !isEngine(stagedBinary)) {
+            if (linked.detail === exports.IGNORE_SCRIPTS) {
+                try {
+                    rename(staging, runtime.installDir);
+                }
+                finally {
+                    remove(staging);
+                }
+            }
+            else {
+                remove(staging);
+            }
+            throw new Error(linkFailure(linked, path.join(runtime.installDir, "node_modules", "opencode-ai")));
+        }
+    }
     try {
         rename(staging, runtime.installDir);
     }
     finally {
-        // No-op after a successful promote (rmSync is force: true); after a failed
-        // one it keeps a ~132MB staging dir from being orphaned — mkdtemp mints a
-        // fresh sibling every attempt, so leaks would accumulate.
         remove(staging);
     }
 }
-// Resolve the engine, downloading it once if this is the first `codie` run.
-async function ensureCodieRuntimeBinary({ resolve, install, confirmUpdate = async () => false, }) {
+async function ensureCodieRuntimeBinary({ resolve, install, confirmUpdate = async () => false, repair, }) {
     const runtime = resolve();
     if (runtime.kind === "ready")
         return runtime.binary;
-    if (runtime.kind === "outdated" && !(await confirmUpdate(runtime)))
+    if (runtime.kind === "outdated" && !(await confirmUpdate(runtime))) {
+        if (runtime.linked !== false || !repair || !runtime.packageDir)
+            return runtime.binary;
+        if (repair({ kind: "unlinked", installDir: runtime.installDir, binary: runtime.binary, spec: runtime.spec, packageDir: runtime.packageDir })) {
+            return runtime.binary;
+        }
+        install(runtime);
         return runtime.binary;
+    }
+    if (runtime.kind === "unlinked" && repair?.(runtime)) {
+        const after = resolve();
+        if (after.kind === "ready")
+            return after.binary;
+    }
     install(runtime);
     return runtime.binary;
 }
+function linkFailure(linked, packageDir) {
+    if (linked.detail === exports.IGNORE_SCRIPTS) {
+        const script = packageDir ? `"${path.join(packageDir, "postinstall.mjs")}"` : "postinstall.mjs in the opencode-ai package";
+        return (`The Codie engine installed, but npm is set to ignore install scripts (ignore-scripts=true), ` +
+            `so codie won't run opencode-ai's setup step. Run \`node ${script}\` yourself, ` +
+            `or set CODIEDEV_OPENCODE_BINARY to an opencode binary.`);
+    }
+    return (`The Codie engine installed, but its setup step (opencode-ai's postinstall) failed, so there is no runnable engine` +
+        (linked.detail ? `: ${linked.detail}` : ".") +
+        ` Set CODIEDEV_OPENCODE_BINARY to an opencode binary to use a pre-provisioned engine.`);
+}
+exports.IGNORE_SCRIPTS = "ignore-scripts";
 function installFailure(detail) {
     return new Error(`Could not download the Codie engine: ${detail}\n` +
         `If you are behind a proxy or an internal registry, make sure npm can reach it. ` +
         `To use a pre-provisioned engine instead, set CODIEDEV_OPENCODE_BINARY to its path.`);
 }
-// ── Real-world wiring ───────────────────────────────────────────────────
-// Kept separate from the pure logic above so tests never shell out to npm.
+function windowsCommand(command, args) {
+    const quote = (a) => (/[\s"&|<>^()%!]/.test(a) ? `"${a.replace(/"/g, '""')}"` : a);
+    return [command, ...args.map(quote)].join(" ");
+}
+function isEngineOnDisk(candidate) {
+    try {
+        return (0, codieRuntime_1.isEngineSize)(fs.statSync(candidate).size);
+    }
+    catch {
+        return false;
+    }
+}
+function npmIgnoresScripts(env = process.env) {
+    const fromEnv = env.npm_config_ignore_scripts ?? env.NPM_CONFIG_IGNORE_SCRIPTS;
+    if (fromEnv !== undefined)
+        return !["", "false", "0", "null", "no"].includes(fromEnv.trim().toLowerCase());
+    const opts = { encoding: "utf8", timeout: 10_000, windowsHide: true };
+    const result = process.platform === "win32"
+        ? (0, child_process_1.spawnSync)("npm.cmd config get ignore-scripts", { ...opts, shell: true })
+        : (0, child_process_1.spawnSync)("npm", ["config", "get", "ignore-scripts"], opts);
+    return result.status === 0 && (result.stdout || "").trim() === "true";
+}
+const LINK_TIMEOUT_MS = 120_000;
+function linkEngineOnDisk(packageDir, { ignoreScripts = npmIgnoresScripts } = {}) {
+    const script = path.join(packageDir, "postinstall.mjs");
+    if (!fs.existsSync(script))
+        return { ok: false, detail: "opencode-ai has no postinstall.mjs" };
+    if (ignoreScripts())
+        return { ok: false, detail: exports.IGNORE_SCRIPTS };
+    const result = (0, child_process_1.spawnSync)(process.execPath, [script], {
+        cwd: packageDir,
+        encoding: "utf8",
+        stdio: ["ignore", "ignore", "pipe"],
+        timeout: LINK_TIMEOUT_MS,
+        windowsHide: true,
+    });
+    if (result.error || result.signal) {
+        return { ok: false, detail: result.error ? result.error.message : `timed out after ${LINK_TIMEOUT_MS / 1000}s` };
+    }
+    if (result.status !== 0)
+        return { ok: false, detail: (result.stderr || "").trim().split("\n").slice(-3).join(" ") || `exit ${result.status}` };
+    return isEngineOnDisk(path.join(packageDir, "bin", "opencode.exe"))
+        ? { ok: true }
+        : { ok: false, detail: "postinstall ran but left no engine" };
+}
 function installCodieRuntimeOnDisk(runtime, stateDir) {
     installCodieRuntime({
         runtime,
         makeStagingDir: () => {
-            // Sibling of the final dir so the promote is a same-filesystem rename.
             fs.mkdirSync(path.dirname((0, codieRuntime_1.codieRuntimeDir)(stateDir)), { recursive: true });
             return fs.mkdtempSync(path.join(path.dirname((0, codieRuntime_1.codieRuntimeDir)(stateDir)), ".runtime-staging-"));
         },
         run: (args) => {
-            const npm = process.platform === "win32" ? "npm.cmd" : "npm";
-            const result = (0, child_process_1.spawnSync)(npm, args, {
+            const opts = {
                 encoding: "utf8",
                 stdio: ["ignore", "inherit", "pipe"],
                 env: { ...process.env, npm_config_yes: "true" },
-            });
+            };
+            const result = process.platform === "win32"
+                ? (0, child_process_1.spawnSync)(windowsCommand("npm.cmd", args), { ...opts, shell: true, windowsHide: true })
+                : (0, child_process_1.spawnSync)("npm", args, opts);
             if (result.error)
                 throw result.error;
             return { status: result.status, stderr: result.stderr || "" };
@@ -140,6 +223,8 @@ function installCodieRuntimeOnDisk(runtime, stateDir) {
         },
         remove: (target) => fs.rmSync(target, { recursive: true, force: true }),
         log: (message) => console.error(message),
+        isEngine: isEngineOnDisk,
+        linkEngine: linkEngineOnDisk,
     });
 }
 function defaultStagingRoot() {

package/dist/codieStartup.js

@@ -3,9 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.refreshCodieSecurityPolicy = refreshCodieSecurityPolicy;
 const securityFeature_1 = require("./securityFeature");
 const securityPolicy_1 = require("./securityPolicy");
-/** Refresh the endpoint policy before Codie hands the terminal to OpenCode.
- * Enforcement remains available offline because hooks keep using the last
- * verified company-scoped policy when this best-effort refresh cannot land. */
 async function refreshCodieSecurityPolicy(config, syncPolicy = securityPolicy_1.syncEndpointSecurityPolicy) {
     if (!(0, securityFeature_1.isAgentSecurityEnabled)(config))
         return { status: "disabled" };