create-agdf 0.13.5 → 0.13.7

package/lib/installers/local-marketplace.js

@@ -1,48 +1,60 @@
-import { createHash } from "node:crypto";
 import {
   cpSync,
   existsSync,
   mkdirSync,
   readFileSync,
-  readdirSync,
-  renameSync,
   rmSync,
-  statSync,
   writeFileSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import process from "node:process";
 import { generatedRoot, packageRoot, pluginDefinition } from "../cli/runtime-context.js";
+import { renameSyncWithRetry } from "../fs-swap.js";
+import {
+  INSTALLATION_PROVENANCE_FILE,
+  LEGACY_LOCAL_INSTALL_FILE,
+  digestDirectory,
+  digestNormalizedPluginSource,
+  inspectInstallationProvenance,
+  validateDistributionProfiles,
+} from "../runtime/plugin-provenance.js";
 
 const MARKETPLACE_ID = "agdf";
 const OWNERSHIP_FILE = ".agdf-owned.json";
 const LEGACY_REPOSITORY = "arndtgold/ai-native-governance-delivery-framework";
+export const CODEX_REGISTRATION_REVISION = 1;
 
 function pathInside(root, candidate) {
   const rel = relative(root, candidate);
   return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
 }
 
-function digestDirectory(root) {
-  const files = [];
-  function visit(directory) {
-    for (const name of readdirSync(directory).sort()) {
-      const path = join(directory, name);
-      const stats = statSync(path);
-      if (stats.isDirectory()) visit(path);
-      else if (stats.isFile()) files.push(path);
-    }
-  }
-  visit(root);
-  const hash = createHash("sha256");
-  for (const path of files) {
-    hash.update(relative(root, path).replaceAll("\\", "/"));
-    hash.update("\0");
-    hash.update(readFileSync(path));
-    hash.update("\0");
-  }
-  return hash.digest("hex");
+export function digestPluginSource(root, canonicalVersion = pluginDefinition.version) {
+  return digestNormalizedPluginSource(root, canonicalVersion);
+}
+
+export { digestDirectory };
+
+function semverBase(version) {
+  return version.split("+")[0];
+}
+
+function isSemanticVersion(version) {
+  return typeof version === "string"
+    && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(version);
+}
+
+export function codexLocalInstallVersion(version, sourceDigest) {
+  if (!/^[a-f0-9]{64}$/.test(sourceDigest)) throw new Error("AGDF local source digest must be a deterministic SHA-256 value.");
+  return `${semverBase(version)}+codex.local-${sourceDigest.slice(0, 12)}`;
+}
+
+export function isCodexLocalInstallVersion(version, candidate, sourceDigest = "") {
+  if (typeof candidate !== "string") return false;
+  if (sourceDigest) return candidate === codexLocalInstallVersion(version, sourceDigest);
+  const escaped = semverBase(version).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`^${escaped}\\+codex\\.local-[a-f0-9]{12}$`).test(candidate);
 }
 
 function readJson(path, label) {
@@ -53,15 +65,20 @@ function readJson(path, label) {
   }
 }
 
+function pathForPlatform(platform = process.platform) {
+  return platform === "win32" ? win32 : posix;
+}
+
 export function defaultAgdfDataRoot({ env = process.env, platform = process.platform, home = homedir() } = {}) {
-  if (env.AGDF_DATA_DIR) return resolve(env.AGDF_DATA_DIR);
-  if (platform === "darwin") return join(home, "Library", "Application Support", "agdf");
-  if (platform === "win32") return join(env.LOCALAPPDATA || env.APPDATA || join(home, "AppData", "Local"), "agdf");
-  return join(env.XDG_DATA_HOME || join(home, ".local", "share"), "agdf");
+  const targetPath = pathForPlatform(platform);
+  if (env.AGDF_DATA_DIR) return targetPath.resolve(env.AGDF_DATA_DIR);
+  if (platform === "darwin") return targetPath.join(home, "Library", "Application Support", "agdf");
+  if (platform === "win32") return targetPath.join(env.LOCALAPPDATA || env.APPDATA || targetPath.join(home, "AppData", "Local"), "agdf");
+  return targetPath.join(env.XDG_DATA_HOME || targetPath.join(home, ".local", "share"), "agdf");
 }
 
 export function localMarketplaceRoot(options = {}) {
-  return join(defaultAgdfDataRoot(options), "marketplaces", MARKETPLACE_ID);
+  return pathForPlatform(options.platform).join(defaultAgdfDataRoot(options), "marketplaces", MARKETPLACE_ID);
 }
 
 function ownership(root, { allowBuilding = false } = {}) {
@@ -93,7 +110,7 @@ function writeJson(path, value) {
 function codexMarketplace(definition = pluginDefinition) {
   return {
     name: MARKETPLACE_ID,
-    interface: { displayName: definition.displayName },
+    interface: { displayName: definition.publicDistribution.publicDisplayName },
     plugins: [{
       name: definition.id,
       source: { source: "local", path: "./plugins/agdf" },
@@ -103,6 +120,13 @@ function codexMarketplace(definition = pluginDefinition) {
   };
 }
 
+function legacyCodexMarketplace(definition = pluginDefinition) {
+  return {
+    ...codexMarketplace(definition),
+    interface: { displayName: definition.displayName },
+  };
+}
+
 function claudeMarketplace(definition = pluginDefinition) {
   return {
     name: MARKETPLACE_ID,
@@ -117,9 +141,15 @@ function claudeMarketplace(definition = pluginDefinition) {
   };
 }
 
-function validateBuiltPlugin(pluginRoot, expectedVersion) {
+function validateBuiltPlugin(pluginRoot, expectedVersion, expectedCodexInstallVersion = expectedVersion, sourceDigest = "", {
+  requireInstallationProvenance = false,
+  allowLegacyProvenanceForMigration = false,
+  allowPreProvenanceShape = false,
+} = {}) {
   const definition = readJson(join(pluginRoot, "meta", "agdf-plugin.definition.json"), "built plugin definition");
   const runtime = readJson(join(pluginRoot, "runtime", "runtime-manifest.json"), "built runtime manifest");
+  const codex = readJson(join(pluginRoot, ".codex-plugin", "plugin.json"), "built Codex plugin manifest");
+  const claude = readJson(join(pluginRoot, ".claude-plugin", "plugin.json"), "built Claude plugin manifest");
   for (const required of [
     join(pluginRoot, ".codex-plugin", "plugin.json"),
     join(pluginRoot, ".claude-plugin", "plugin.json"),
@@ -131,22 +161,112 @@ function validateBuiltPlugin(pluginRoot, expectedVersion) {
   if (definition.version !== expectedVersion || runtime.version !== expectedVersion) {
     throw new Error(`Built plugin version mismatch: expected ${expectedVersion}, definition ${definition.version}, runtime ${runtime.version}`);
   }
+  const profile = validateDistributionProfiles(definition);
+  const isPreProvenanceShape = allowPreProvenanceShape
+    && !Object.hasOwn(definition, "distributionProfiles");
+  let provenance = null;
+  if (profile.status !== "matched"
+      && requireInstallationProvenance
+      && allowLegacyProvenanceForMigration) {
+    provenance = inspectInstallationProvenance(pluginRoot, {
+      definition,
+      runtimeManifest: runtime,
+      pluginVersion: expectedCodexInstallVersion,
+      allowLegacy: true,
+    });
+  }
+  if (profile.status !== "matched" && provenance?.status !== "legacy" && !isPreProvenanceShape) {
+    throw new Error("Built plugin distribution profile contract is invalid.");
+  }
+  if (codex.version !== expectedCodexInstallVersion) {
+    throw new Error(`Built Codex plugin version mismatch: expected ${expectedCodexInstallVersion}, observed ${codex.version}`);
+  }
+  if (claude.version !== expectedVersion) {
+    throw new Error(`Built Claude plugin version mismatch: expected ${expectedVersion}, observed ${claude.version}`);
+  }
+  if (expectedCodexInstallVersion !== expectedVersion) {
+    if (!isCodexLocalInstallVersion(expectedVersion, expectedCodexInstallVersion, sourceDigest)) {
+      throw new Error(`Invalid AGDF Codex local install version: ${expectedCodexInstallVersion}`);
+    }
+  }
   if (!/^[a-f0-9]{64}$/.test(runtime.digest ?? "")) throw new Error("Built plugin runtime digest is invalid.");
   if (digestDirectory(join(pluginRoot, "runtime", "create-agdf")) !== runtime.digest) {
     throw new Error("Built plugin runtime digest does not match its payload.");
   }
+  if (requireInstallationProvenance) {
+    provenance ??= inspectInstallationProvenance(pluginRoot, {
+      definition,
+      runtimeManifest: runtime,
+      pluginVersion: expectedCodexInstallVersion,
+      allowLegacy: allowLegacyProvenanceForMigration,
+    });
+    if (provenance.status !== "matched"
+        && !(allowLegacyProvenanceForMigration && provenance.status === "legacy")) {
+      throw new Error(`Invalid AGDF installation provenance (${provenance.reason}): ${pluginRoot}`);
+    }
+  }
   return definition;
 }
 
 function validateMarketplaceRoot(root, definition = pluginDefinition) {
   const codex = readJson(join(root, ".agents", "plugins", "marketplace.json"), "Codex local marketplace manifest");
   const claude = readJson(join(root, ".claude-plugin", "marketplace.json"), "Claude local marketplace manifest");
-  if (JSON.stringify(codex) !== JSON.stringify(codexMarketplace(definition))) {
+  const serializedCodex = JSON.stringify(codex);
+  const codexShape = serializedCodex === JSON.stringify(codexMarketplace(definition))
+    ? "current"
+    : serializedCodex === JSON.stringify(legacyCodexMarketplace(definition))
+      ? "legacy_full_product_label"
+      : "invalid";
+  if (codexShape === "invalid") {
     throw new Error(`Codex local marketplace manifest is not owned by ${MARKETPLACE_ID}: ${root}`);
   }
   if (JSON.stringify(claude) !== JSON.stringify(claudeMarketplace(definition))) {
     throw new Error(`Claude local marketplace manifest is not owned by ${MARKETPLACE_ID}: ${root}`);
   }
+  return Object.freeze({ codexShape });
+}
+
+function classifyExistingMarketplace(stableRoot, marker) {
+  const existingPluginRoot = join(stableRoot, "plugins", MARKETPLACE_ID);
+  const existingCodexInstallVersion = marker.codex_install_version ?? marker.version;
+  if (!isSemanticVersion(marker.version)
+      || !/^[a-f0-9]{64}$/.test(marker.plugin_digest ?? "")) {
+    throw new Error(`Refusing invalid AGDF marketplace ownership evidence: ${stableRoot}`);
+  }
+  const definition = readJson(
+    join(existingPluginRoot, "meta", "agdf-plugin.definition.json"),
+    "built plugin definition",
+  );
+  const hasCurrentProvenance = existsSync(join(existingPluginRoot, INSTALLATION_PROVENANCE_FILE));
+  const hasLegacyProvenance = existsSync(join(existingPluginRoot, LEGACY_LOCAL_INSTALL_FILE));
+  const preProvenanceCandidate = !hasCurrentProvenance
+    && !hasLegacyProvenance
+    && !Object.hasOwn(definition, "distributionProfiles");
+  const existingDefinition = validateBuiltPlugin(
+    existingPluginRoot,
+    marker.version,
+    existingCodexInstallVersion,
+    marker.source_digest ?? "",
+    preProvenanceCandidate
+      ? { allowPreProvenanceShape: true }
+      : { requireInstallationProvenance: true, allowLegacyProvenanceForMigration: true },
+  );
+  const marketplace = validateMarketplaceRoot(stableRoot, existingDefinition);
+  if (digestDirectory(existingPluginRoot) !== marker.plugin_digest) {
+    throw new Error(`Refusing tampered AGDF marketplace root: ${stableRoot}`);
+  }
+  return Object.freeze({
+    classification: preProvenanceCandidate
+      ? "owned_pre_provenance_rebuild"
+      : "current_or_marker_migration",
+    definition: existingDefinition,
+    marketplace,
+  });
+}
+
+function invalidExistingMarketplace(error) {
+  error.existingClassification = "invalid_or_unowned";
+  return error;
 }
 
 function recoverInterruptedTransaction(stableRoot, stageRoot, backupRoot, failedRoot) {
@@ -156,9 +276,9 @@ function recoverInterruptedTransaction(stableRoot, stageRoot, backupRoot, failed
     if (existsSync(failedRoot)) removeOwnedRoot(failedRoot, parent);
     if (existsSync(stableRoot)) {
       ownership(stableRoot);
-      renameSync(stableRoot, failedRoot);
+      renameSyncWithRetry(stableRoot, failedRoot);
     }
-    renameSync(backupRoot, stableRoot);
+    renameSyncWithRetry(backupRoot, stableRoot);
     if (existsSync(failedRoot)) removeOwnedRoot(failedRoot, parent);
   }
   if (existsSync(stageRoot)) removeOwnedRoot(stageRoot, parent, { allowBuilding: true });
@@ -169,6 +289,8 @@ export function prepareLocalMarketplace({
   dataRoot = defaultAgdfDataRoot(),
   builtPluginRoot = join(generatedRoot, "plugins", "agdf"),
   expectedVersion = pluginDefinition.version,
+  codexInstallVersion = expectedVersion,
+  codexRegistrationRevision = null,
 } = {}) {
   dataRoot = resolve(dataRoot);
   builtPluginRoot = resolve(builtPluginRoot);
@@ -178,18 +300,37 @@ export function prepareLocalMarketplace({
   const backupRoot = `${stableRoot}.backup`;
   const failedRoot = `${stableRoot}.failed`;
   if (!pathInside(dataRoot, stableRoot) || dirname(stableRoot) !== parent) throw new Error(`Unsafe AGDF marketplace root: ${stableRoot}`);
+  const sourceDigest = digestPluginSource(builtPluginRoot, expectedVersion);
+  if (codexInstallVersion !== expectedVersion
+      && !isCodexLocalInstallVersion(expectedVersion, codexInstallVersion, sourceDigest)) {
+    throw new Error(`Invalid AGDF Codex local install version: ${codexInstallVersion}`);
+  }
   const targetDefinition = validateBuiltPlugin(builtPluginRoot, expectedVersion);
   mkdirSync(parent, { recursive: true });
   recoverInterruptedTransaction(stableRoot, stageRoot, backupRoot, failedRoot);
 
-  const existing = existsSync(stableRoot) ? ownership(stableRoot) : null;
+  let existing = null;
+  if (existsSync(stableRoot)) {
+    try {
+      existing = ownership(stableRoot);
+    } catch (error) {
+      throw invalidExistingMarketplace(error);
+    }
+  }
+  const targetCodexRegistrationRevision = codexRegistrationRevision
+    ?? existing?.codex_registration_revision
+    ?? 0;
+  let existingMarketplace = null;
+  let existingClassification = "none";
   if (existing) {
-    const existingPluginRoot = join(stableRoot, "plugins", MARKETPLACE_ID);
-    const existingDefinition = validateBuiltPlugin(existingPluginRoot, existing.version);
-    validateMarketplaceRoot(stableRoot, existingDefinition);
-    if (digestDirectory(existingPluginRoot) !== existing.plugin_digest) {
-      throw new Error(`Refusing tampered AGDF marketplace root: ${stableRoot}`);
+    let classified;
+    try {
+      classified = classifyExistingMarketplace(stableRoot, existing);
+    } catch (error) {
+      throw invalidExistingMarketplace(error);
     }
+    existingClassification = classified.classification;
+    existingMarketplace = classified.marketplace;
   }
   mkdirSync(stageRoot, { recursive: false });
   try {
@@ -197,7 +338,10 @@ export function prepareLocalMarketplace({
       schema_version: 1,
       owner: "create-agdf",
       marketplace_id: MARKETPLACE_ID,
+      codex_registration_revision: targetCodexRegistrationRevision,
       version: expectedVersion,
+      codex_install_version: codexInstallVersion,
+      source_digest: sourceDigest,
       plugin_digest: null,
       source_package_version: readJson(join(packageRoot, "package.json"), "create-agdf package manifest").version,
       staging_state: "building",
@@ -205,6 +349,25 @@ export function prepareLocalMarketplace({
     const stagedPluginRoot = join(stageRoot, "plugins", MARKETPLACE_ID);
     cpSync(builtPluginRoot, stagedPluginRoot, { recursive: true });
     validateBuiltPlugin(stagedPluginRoot, expectedVersion);
+    if (codexInstallVersion !== expectedVersion) {
+      const codexManifestPath = join(stagedPluginRoot, ".codex-plugin", "plugin.json");
+      writeJson(codexManifestPath, { ...readJson(codexManifestPath, "built Codex plugin manifest"), version: codexInstallVersion });
+    }
+    const runtimeManifest = readJson(join(stagedPluginRoot, "runtime", "runtime-manifest.json"), "built runtime manifest");
+    writeJson(join(stagedPluginRoot, INSTALLATION_PROVENANCE_FILE), {
+      schema_version: 1,
+      owner: "create-agdf",
+      profile_id: "runtime-plugin",
+      marketplace_id: MARKETPLACE_ID,
+      canonical_version: expectedVersion,
+      codex_install_version: codexInstallVersion,
+      source_digest: sourceDigest,
+      runtime_digest: runtimeManifest.digest,
+    });
+    if (existsSync(join(stagedPluginRoot, LEGACY_LOCAL_INSTALL_FILE))) {
+      rmSync(join(stagedPluginRoot, LEGACY_LOCAL_INSTALL_FILE));
+    }
+    validateBuiltPlugin(stagedPluginRoot, expectedVersion, codexInstallVersion, sourceDigest, { requireInstallationProvenance: true });
     writeJson(join(stageRoot, ".agents", "plugins", "marketplace.json"), codexMarketplace(targetDefinition));
     writeJson(join(stageRoot, ".claude-plugin", "marketplace.json"), claudeMarketplace(targetDefinition));
     validateMarketplaceRoot(stageRoot, targetDefinition);
@@ -213,31 +376,40 @@ export function prepareLocalMarketplace({
       schema_version: 1,
       owner: "create-agdf",
       marketplace_id: MARKETPLACE_ID,
+      codex_registration_revision: targetCodexRegistrationRevision,
       version: expectedVersion,
+      codex_install_version: codexInstallVersion,
+      source_digest: sourceDigest,
       plugin_digest: pluginDigest,
       source_package_version: readJson(join(packageRoot, "package.json"), "create-agdf package manifest").version,
       staging_state: "ready",
     };
     writeJson(join(stageRoot, OWNERSHIP_FILE), marker);
 
-    if (existing?.version === expectedVersion && existing?.plugin_digest === pluginDigest) {
+    if (existing?.version === expectedVersion
+        && existing?.plugin_digest === pluginDigest
+        && existing?.codex_registration_revision === targetCodexRegistrationRevision
+        && existingMarketplace?.codexShape === "current") {
       removeOwnedRoot(stageRoot, parent);
       return Object.freeze({
         root: stableRoot,
         pluginRoot: join(stableRoot, "plugins", MARKETPLACE_ID),
         version: expectedVersion,
+        codexInstallVersion,
+        sourceDigest,
         digest: pluginDigest,
+        existingClassification,
         changed: false,
         commit() {},
         rollback() {},
       });
     }
 
-    if (existsSync(stableRoot)) renameSync(stableRoot, backupRoot);
+    if (existsSync(stableRoot)) renameSyncWithRetry(stableRoot, backupRoot);
     try {
-      renameSync(stageRoot, stableRoot);
+      renameSyncWithRetry(stageRoot, stableRoot);
     } catch (error) {
-      if (existsSync(backupRoot) && !existsSync(stableRoot)) renameSync(backupRoot, stableRoot);
+      if (existsSync(backupRoot) && !existsSync(stableRoot)) renameSyncWithRetry(backupRoot, stableRoot);
       throw error;
     }
     let closed = false;
@@ -245,7 +417,10 @@ export function prepareLocalMarketplace({
       root: stableRoot,
       pluginRoot: join(stableRoot, "plugins", MARKETPLACE_ID),
       version: expectedVersion,
+      codexInstallVersion,
+      sourceDigest,
       digest: pluginDigest,
+      existingClassification,
       changed: true,
       commit() {
         if (closed) return;
@@ -256,8 +431,8 @@ export function prepareLocalMarketplace({
         if (closed) return;
         if (existsSync(backupRoot)) {
           if (existsSync(failedRoot)) removeOwnedRoot(failedRoot, parent);
-          if (existsSync(stableRoot)) renameSync(stableRoot, failedRoot);
-          renameSync(backupRoot, stableRoot);
+          if (existsSync(stableRoot)) renameSyncWithRetry(stableRoot, failedRoot);
+          renameSyncWithRetry(backupRoot, stableRoot);
           if (existsSync(failedRoot)) removeOwnedRoot(failedRoot, parent);
         } else if (existsSync(stableRoot)) {
           removeOwnedRoot(stableRoot, parent);
@@ -271,6 +446,36 @@ export function prepareLocalMarketplace({
   }
 }
 
+export function inspectLocalMarketplaceProjection({
+  dataRoot = defaultAgdfDataRoot(),
+  expectedVersion = pluginDefinition.version,
+} = {}) {
+  const root = join(resolve(dataRoot), "marketplaces", MARKETPLACE_ID);
+  if (!existsSync(root)) return null;
+  const marker = ownership(root);
+  const codexInstallVersion = marker.codex_install_version ?? marker.version;
+  const pluginRoot = join(root, "plugins", MARKETPLACE_ID);
+  const definition = validateBuiltPlugin(
+    pluginRoot,
+    marker.version,
+    codexInstallVersion,
+    marker.source_digest ?? "",
+    { requireInstallationProvenance: true },
+  );
+  validateMarketplaceRoot(root, definition);
+  if (marker.version !== expectedVersion || digestDirectory(pluginRoot) !== marker.plugin_digest) {
+    throw new Error(`Refusing stale or tampered AGDF marketplace projection: ${root}`);
+  }
+  return Object.freeze({
+    root,
+    pluginRoot,
+    version: marker.version,
+    codexInstallVersion,
+    sourceDigest: marker.source_digest ?? "",
+    digest: marker.plugin_digest,
+  });
+}
+
 function normalizedLegacySource(value) {
   if (typeof value !== "string") return "";
   return value.trim().toLowerCase()
@@ -319,5 +524,7 @@ export function classifyMarketplaceList(surface, output, stableRoot) {
 export const localMarketplaceConstants = Object.freeze({
   id: MARKETPLACE_ID,
   ownershipFile: OWNERSHIP_FILE,
+  installationProvenanceFile: INSTALLATION_PROVENANCE_FILE,
+  legacyLocalInstallFile: LEGACY_LOCAL_INSTALL_FILE,
   legacyRepository: LEGACY_REPOSITORY,
 });

package/lib/installers/opencode.js

@@ -6,6 +6,7 @@ import process from "node:process";
 import { generatedRoot, pluginDefinition } from "../cli/runtime-context.js";
 import { evaluateOpenCodeRepositoryActivation } from "./opencode-activation.js";
 import { resolveLocalValidator } from "../runtime/local-validator.js";
+import { validateLocalOpenCodePackageSource } from "./local-development.js";
 
 const contractModules = ["gate-transition.md", "interaction.md", "modes.md", "quality.md", "context-graph.md", "control-scaffold.md", "closeout.md"];
 const openCodeSkillNames = pluginDefinition.skillSet.map((skill) => pluginDefinition.opencode.skillPrefix + skill.slug);
@@ -36,7 +37,15 @@ export function defaultOpenCodeConfigDir() {
   return process.env.OPENCODE_CONFIG_DIR || join(homedir(), ".config", "opencode");
 }
 
-export function installOpenCodeGlobalPlugin(configDir) {
+export function resolveOpenCodeInstallPackageSource(packageSource) {
+  const local = packageSource ? validateLocalOpenCodePackageSource(packageSource) : null;
+  return Object.freeze({
+    local,
+    specifier: local?.specifier ?? `${pluginDefinition.opencode.npmPackage}@${pluginDefinition.version}`,
+  });
+}
+
+export function installOpenCodeGlobalPlugin(configDir, dependencies = {}) {
   try {
     assertGlobalOpenCodeSurfaceWritable(configDir);
   } catch (error) {
@@ -97,8 +106,11 @@ export function installOpenCodeGlobalPlugin(configDir) {
   }
 
   mkdirSync(configDir, { recursive: true });
+  let localPackageSource = null;
   try {
-    const packageSpecifier = `${pluginDefinition.opencode.npmPackage}@${pluginDefinition.version}`;
+    const packageSource = resolveOpenCodeInstallPackageSource(dependencies.packageSource);
+    localPackageSource = packageSource.local;
+    const packageSpecifier = packageSource.specifier;
     const invocation = openCodeNpmInvocation(["install", "--silent", "--save-prod", "--save-exact", packageSpecifier]);
     execFileSync(invocation.executable, invocation.args, {
       cwd: configDir,
@@ -123,6 +135,9 @@ export function installOpenCodeGlobalPlugin(configDir) {
     added: !alreadyInstalled,
     transition: openCodePackageTransition(previousPackage, installedPackage),
     sdk_alignment: sdkAlignment,
+    package_source: localPackageSource
+      ? { kind: "local_checkout", path: localPackageSource.tarball, digest: localPackageSource.digest, version: localPackageSource.version }
+      : { kind: "registry", path: "", digest: "", version: pluginDefinition.version },
   };
 }