devrites 3.2.27 → 4.0.0

package/engine/tests/parity_resolve_test.go

@@ -45,13 +45,13 @@ const resolveState = `- Status: awaiting_human
 `
 
 func TestParityResolve(t *testing.T) {
-	// setup writes fixtures under .devrites/features/feat and returns the
+	// setup writes fixtures under .devrites/work/feat and returns the
 	// workspace root.
 	setup := func(t *testing.T, questions, state string) (gwork string) {
 		t.Helper()
 		gwork = t.TempDir()
-		writeFile(t, gwork, filepath.Join(".devrites", "features", "feat", "questions.md"), questions)
-		writeFile(t, gwork, filepath.Join(".devrites", "features", "feat", "state.md"), state)
+		writeFile(t, gwork, filepath.Join(".devrites", "work", "feat", "questions.md"), questions)
+		writeFile(t, gwork, filepath.Join(".devrites", "work", "feat", "state.md"), state)
 		writeFile(t, gwork, filepath.Join(".devrites", "ACTIVE"), "feat\n")
 		return gwork
 	}
@@ -59,14 +59,14 @@ func TestParityResolve(t *testing.T) {
 	// current subtest's golden.
 	run := func(t *testing.T, gwork string, args ...string) {
 		t.Helper()
-		out, code := runArgv(t, gwork, libRootEnv(gwork), "", binPath, append([]string{"resolve"}, args...)...)
+		out, code := runArgv(t, gwork, libRootEnv(gwork), "", binPath, append([]string{"state", "resolve"}, args...)...)
 		assertGolden(t, out, code)
 	}
 	// assertFileGolden snapshots the masked content of a mutated file under a
 	// per-file golden key (t.Name()+"/"+name).
 	assertFileGolden := func(t *testing.T, gwork, name string) {
 		t.Helper()
-		b, err := os.ReadFile(filepath.Join(gwork, ".devrites", "features", "feat", name))
+		b, err := os.ReadFile(filepath.Join(gwork, ".devrites", "work", "feat", name))
 		if err != nil {
 			t.Fatalf("reading %s: %v", name, err)
 		}
@@ -128,18 +128,8 @@ answer: prior
 		// Pointing DEVRITES_ROOT at the nonexistent .devrites child would instead
 		// be an explicit unsafe-root refusal, which is a different contract.
 		gwork := t.TempDir()
-		out, code := runArgv(t, gwork, libEnv, "", binPath, "resolve", "q-1", "x")
+		out, code := runArgv(t, gwork, libEnv, "", binPath, "state", "resolve", "q-1", "x")
 		assertGolden(t, out, code)
 	})
 
-	t.Run("next-qid", func(t *testing.T) {
-		// DEVRITES_NOW fixes the date used by next-qid so the snapshot stays stable.
-		// See ADR-0006.
-		dir := t.TempDir()
-		writeFile(t, dir, "questions.md", "## q-2024-01-01-001\nstatus: open\n")
-		qpath := filepath.Join(dir, "questions.md")
-		env := append(append([]string{}, libEnv...), "DEVRITES_NOW=2026-07-07")
-		out, code := runArgv(t, dir, env, "", binPath, "resolve", "next-qid", qpath)
-		assertGolden(t, out, code)
-	})
 }

package/engine/tests/parity_test.go

@@ -18,22 +18,19 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+
+	"github.com/devrites/devrites/internal/testutil"
 )
 
-// parityCase describes one fixture run of the devrites-engine binary.
-type parityCase struct {
-	workdir string   // cwd the command runs in
-	env     []string // extra environment
-	stdin   string   // payload piped to stdin (hooks read stdin)
-	goArgs  []string // args to the built devrites-engine binary (binPath is prepended)
+var libEnv = []string{"LC_ALL=C", "DEVRITES_ROOT="}
+
+func libRootEnv(work string) []string {
+	return []string{"LC_ALL=C", "DEVRITES_ROOT=" + filepath.Join(work, ".devrites")}
 }
 
-// assertEqual runs the command and compares its stdout and exit code to the golden
-// snapshot for the current subtest.
-func (c parityCase) assertEqual(t *testing.T) {
+func writeFile(t *testing.T, workdir, rel, content string) {
 	t.Helper()
-	out, code := runArgv(t, c.workdir, c.env, c.stdin, binPath, c.goArgs...)
-	assertGolden(t, out, code)
+	testutil.WriteFile(t, filepath.Join(workdir, rel), content)
 }
 
 // assertGolden compares a command's output to the golden file for the current
@@ -87,294 +84,3 @@ func runArgv(t *testing.T, workdir string, env []string, stdin string, name stri
 	}
 	return out.String(), code
 }
-
-// TestParityReviewerReadonly checks `hook reviewer-readonly` against golden
-// snapshots for each payload: the silent no-ops, the full enforce-mode deny, the
-// observe-mode side effect (asserted only on its empty stdout+exit), and the
-// agent-required gate. The golden check compares stdout+exit, not files.
-func TestParityReviewerReadonly(t *testing.T) {
-	cases := []struct {
-		name  string
-		env   []string
-		stdin string
-	}{
-		{"non-tool-input", nil, "not even json"},
-		{"non-bash-tool", nil, `{"tool_name":"Read","tool_input":{"file_path":"x"}}`},
-		{"safe-bash-command", nil, `{"tool_name":"Bash","tool_input":{"command":"ls -la"}}`},
-		{"enforce-deny-mutating", []string{"DEVRITES_REVIEWER_RO=enforce"}, `{"tool_name":"Bash","tool_input":{"command":"rm -rf foo"}}`},
-		{"enforce-deny-git-commit", []string{"DEVRITES_REVIEWER_RO=enforce"}, `{"tool_name":"Bash","tool_input":{"command":"git commit -m x"}}`},
-		{"observe-mutating-silent", nil, `{"tool_name":"Bash","tool_input":{"command":"rm -rf foo"}}`},
-		// The agent-required gate reads only agent_type, matching the Bash hook's
-		// Node parser, so a subagent_type-only payload has no identity and is allowed.
-		{"agent-required-subagent-type-only-allows",
-			[]string{"DEVRITES_REVIEWER_RO=enforce", "DEVRITES_REVIEWER_AGENT_REQUIRED=1"},
-			`{"tool_name":"Bash","tool_input":{"command":"rm -rf foo"},"subagent_type":"devrites-code-reviewer"}`},
-		{"agent-required-devrites-agent-denies",
-			[]string{"DEVRITES_REVIEWER_RO=enforce", "DEVRITES_REVIEWER_AGENT_REQUIRED=1"},
-			`{"tool_name":"Bash","tool_input":{"command":"rm -rf foo"},"agent_type":"devrites-code-reviewer"}`},
-		{"agent-required-non-devrites-allows",
-			[]string{"DEVRITES_REVIEWER_RO=enforce", "DEVRITES_REVIEWER_AGENT_REQUIRED=1"},
-			`{"tool_name":"Bash","tool_input":{"command":"rm -rf foo"},"agent_type":"Explore"}`},
-	}
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			dir := t.TempDir()
-			c := parityCase{
-				workdir: dir,
-				env:     append([]string{"DEVRITES_ROOT="}, tc.env...),
-				stdin:   tc.stdin,
-				goArgs:  []string{"hook", "reviewer-readonly", "--harness=claude"},
-			}
-			c.assertEqual(t)
-		})
-	}
-}
-
-// TestParitySubagentOrient checks `hook subagent-orient` against golden snapshots
-// for each payload: a non-devrites agent (silent) and a devrites-* agent (the
-// fixed context envelope).
-func TestParitySubagentOrient(t *testing.T) {
-	cases := []struct {
-		name  string
-		stdin string
-	}{
-		{"garbage-input", "not json"},
-		{"non-devrites-agent", `{"agent_type":"Explore"}`},
-		{"devrites-agent", `{"agent_type":"devrites-code-reviewer"}`},
-		{"devrites-agent-subagent-type-key", `{"subagent_type":"devrites-security-auditor"}`},
-	}
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			dir := t.TempDir()
-			c := parityCase{
-				workdir: dir,
-				env:     []string{"DEVRITES_ROOT="},
-				stdin:   tc.stdin,
-				goArgs:  []string{"hook", "subagent-orient", "--harness=claude"},
-			}
-			c.assertEqual(t)
-		})
-	}
-}
-
-// TestParityCursor checks `hook cursor` against golden snapshots for each
-// active-feature state: the field reads, the open-questions count, the AFK line,
-// the RED warning, and the silent no-active path.
-func TestParityCursor(t *testing.T) {
-	work := t.TempDir()
-
-	writeFeatureFile(t, work, "full", "state.md",
-		"- Phase: build\n- Status: running\n- Next step: implement slice 3\n- AFK slices remaining: 2\n")
-	writeFeatureFile(t, work, "full", "questions.md",
-		"## q-1\nstatus: open\ngate: blocking\n\n## q-2\nstatus: open\ngate: advisory\n")
-	// present questions.md with ZERO open → the grep -c "0\n0" quirk.
-	writeFeatureFile(t, work, "zerogates", "state.md", "- Phase: spec\n- Status: running\n")
-	writeFeatureFile(t, work, "zerogates", "questions.md", "## q-1\nstatus: resolved\ngate: blocking\n")
-	// a RED workspace.
-	writeFeatureFile(t, work, "red", "state.md", "- Phase: prove\n- Status: running\n")
-	writeFeatureFile(t, work, "red", ".red", "npm test\n")
-	// a bare dir (no state.md / questions.md).
-	makeFeatureDir(t, work, "bare")
-
-	for _, tc := range []struct {
-		name, active string
-		afk          bool
-	}{
-		{"full-hitl", "full", false},
-		{"full-afk", "full", true},
-		{"zerogates", "zerogates", false},
-		{"red", "red", false},
-		{"bare", "bare", false},
-		{"no-active", "", false},
-	} {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			setActiveAFK(t, work, tc.active, tc.afk)
-			(parityCase{
-				workdir: work,
-				env:     libRootEnv(work),
-				goArgs:  []string{"hook", "cursor", "--harness=claude"},
-			}).assertEqual(t)
-		})
-	}
-}
-
-// TestParityStatusline checks `hook statusline` against golden snapshots for each
-// active-feature state.
-func TestParityStatusline(t *testing.T) {
-	work := t.TempDir()
-
-	writeFeatureFile(t, work, "full", "state.md", "- Phase: build\n- Status: running\n")
-	writeFeatureFile(t, work, "full", "questions.md",
-		"## q-1\nstatus: open\ngate: blocking\n\n## q-2\nstatus: open\ngate: advisory\n")
-	writeFeatureFile(t, work, "nophase", "state.md", "- Status: running\n") // phase → "?"
-	writeFeatureFile(t, work, "red", "state.md", "- Phase: prove\n")
-	writeFeatureFile(t, work, "red", ".red", "npm test\n")
-
-	for _, tc := range []struct {
-		name, active string
-		afk          bool
-	}{
-		{"full-hitl", "full", false},
-		{"full-afk", "full", true},
-		{"nophase", "nophase", false},
-		{"red", "red", false},
-		{"no-active", "", false},
-	} {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			setActiveAFK(t, work, tc.active, tc.afk)
-			(parityCase{
-				workdir: work,
-				env:     libRootEnv(work),
-				stdin:   `{"session":"x"}`, // statusline drains stdin
-				goArgs:  []string{"hook", "statusline", "--harness=claude"},
-			}).assertEqual(t)
-		})
-	}
-}
-
-// TestParityRedwatch checks `hook redwatch` against golden snapshots for each
-// payload: the test-command gate, the RED additionalContext, the green clear, and
-// the silent non-test / non-Bash paths. Each case uses its own slug so the .red
-// side effects don't cross-contaminate.
-func TestParityRedwatch(t *testing.T) {
-	work := t.TempDir()
-	for _, slug := range []string{"redf", "redp", "nont", "nonb"} {
-		makeFeatureDir(t, work, slug)
-	}
-
-	for _, tc := range []struct {
-		name, active, stdin string
-	}{
-		{"fail-writes-red", "redf", `{"tool_name":"Bash","tool_input":{"command":"npm test"},"tool_response":"Tests: 1 failed, 3 passed"}`},
-		{"pass-clears-red", "redp", `{"tool_name":"Bash","tool_input":{"command":"go test ./..."},"tool_response":"ok  all tests passed"}`},
-		{"non-test-command", "nont", `{"tool_name":"Bash","tool_input":{"command":"ls -la"},"tool_response":"file"}`},
-		{"non-bash-tool", "nonb", `{"tool_name":"Read","tool_input":{"file_path":"x"},"tool_response":"y"}`},
-	} {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			setActiveAFK(t, work, tc.active, false)
-			(parityCase{
-				workdir: work,
-				env:     libRootEnv(work),
-				stdin:   tc.stdin,
-				goArgs:  []string{"hook", "redwatch", "--harness=claude"},
-			}).assertEqual(t)
-		})
-	}
-}
-
-// TestParityA1Guard checks `hook a1-guard` against golden snapshots for each
-// payload. It blocks a main-thread source edit only when the build window is open
-// and enforce is on, and allows subagent edits, .devrites bookkeeping edits, and
-// a closed window.
-func TestParityA1Guard(t *testing.T) {
-	work := t.TempDir()
-	makeFeatureDir(t, work, "win")
-	writeFeatureFile(t, work, "win", ".reconcile-base", "snapshot\n")
-	makeFeatureDir(t, work, "nowin") // no .reconcile-base → window closed
-
-	enforce := []string{"DEVRITES_A1_HOOK=enforce"}
-	for _, tc := range []struct {
-		name, active string
-		env          []string
-		stdin        string
-	}{
-		{"source-edit-enforce-denies", "win", enforce, `{"tool_name":"Edit","tool_input":{"file_path":"src/app.js"}}`},
-		{"subagent-allowed", "win", enforce, `{"tool_name":"Edit","tool_input":{"file_path":"src/app.js"},"agent_id":"abc"}`},
-		{"devrites-edit-allowed", "win", enforce, `{"tool_name":"Edit","tool_input":{"file_path":".devrites/features/win/state.md"}}`},
-		{"non-edit-tool", "win", enforce, `{"tool_name":"Bash","tool_input":{"command":"ls"}}`},
-		{"observe-mode-silent", "win", nil, `{"tool_name":"Edit","tool_input":{"file_path":"src/app.js"}}`},
-		{"no-window-silent", "nowin", enforce, `{"tool_name":"Edit","tool_input":{"file_path":"src/app.js"}}`},
-	} {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			setActiveAFK(t, work, tc.active, false)
-			(parityCase{
-				workdir: work,
-				env:     append(libRootEnv(work), tc.env...),
-				stdin:   tc.stdin,
-				goArgs:  []string{"hook", "a1-guard", "--harness=claude"},
-			}).assertEqual(t)
-		})
-	}
-}
-
-// TestParityWrightScope checks `hook wright-scope` against golden snapshots for
-// each payload: an exact orchestrator-allowlisted path is allowed, one outside
-// it and every .devrites path are denied for an active wright, read-only tools
-// pass, and the agent-required gate skips a non-DevRites caller.
-func TestParityWrightScope(t *testing.T) {
-	work := t.TempDir()
-	writeFeatureFile(t, work, "ws", ".wright-allowlist", "src/app.js\n")
-
-	enforce := []string{"DEVRITES_WRIGHT_SCOPE=enforce"}
-	activeWright := []string{
-		"DEVRITES_AGENT_RUN=1",
-		"DEVRITES_ACTIVE_AGENT=devrites-slice-wright",
-	}
-	for _, tc := range []struct {
-		name  string
-		env   []string
-		stdin string
-	}{
-		{"in-scope-allowed", activeWright, `{"tool_name":"Edit","tool_input":{"file_path":"src/app.js"}}`},
-		{"out-of-scope-enforce-denies", activeWright, `{"tool_name":"Edit","tool_input":{"file_path":"src/other.js"}}`},
-		{"devrites-edit-denied", activeWright, `{"tool_name":"Edit","tool_input":{"file_path":".devrites/x/y.md"}}`},
-		{"non-edit-tool", activeWright, `{"tool_name":"Bash","tool_input":{"command":"ls"}}`},
-		{"out-of-scope-observe-silent", nil, `{"tool_name":"Edit","tool_input":{"file_path":"src/other.js"}}`},
-		{"agent-required-non-wright", append([]string{"DEVRITES_WRIGHT_AGENT_REQUIRED=1"}, enforce...),
-			`{"tool_name":"Edit","tool_input":{"file_path":"src/other.js"},"agent_type":"Explore"}`},
-	} {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			setActiveAFK(t, work, "ws", false)
-			(parityCase{
-				workdir: work,
-				env:     append(libRootEnv(work), tc.env...),
-				stdin:   tc.stdin,
-				goArgs:  []string{"hook", "wright-scope", "--harness=claude"},
-			}).assertEqual(t)
-		})
-	}
-}
-
-// setActiveAFK points .devrites/ACTIVE at slug (or removes it) and toggles the
-// .devrites/AFK sentinel: the two files bash (via CWD) and Go (via
-// <root>) both read from the same shared location.
-func setActiveAFK(t *testing.T, work, slug string, afk bool) {
-	t.Helper()
-	active := filepath.Join(work, ".devrites", "ACTIVE")
-	if slug == "" {
-		_ = os.Remove(active)
-	} else if err := os.WriteFile(active, []byte(slug+"\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	afkPath := filepath.Join(work, ".devrites", "AFK")
-	if afk {
-		if err := os.WriteFile(afkPath, []byte("max-slices: 2\n"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	} else {
-		_ = os.Remove(afkPath)
-	}
-}
-
-// TestParityOrientSilentPath checks `hook orient` against a golden snapshot for
-// the common session-start case: outside any DevRites workspace (a directory with
-// no .devrites), orient must stay silent: exit 0, no stdout.
-func TestParityOrientSilentPath(t *testing.T) {
-	dir := t.TempDir() // a directory with no .devrites
-
-	c := parityCase{
-		workdir: dir,
-		// Clear DEVRITES_ROOT so the Go side cannot resolve a real workspace. It
-		// must see "not a DevRites project".
-		env:    []string{"DEVRITES_ROOT="},
-		goArgs: []string{"hook", "orient", "--harness=claude"},
-	}
-	c.assertEqual(t)
-}

package/install.sh

@@ -4,14 +4,122 @@
 # the only sanctioned global write is the devrites-engine binary lifecycle.
 set -u
 
-SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd -P)" || SELF_DIR=""
+SELF_DIR=""
+SCRIPT_SOURCE="${BASH_SOURCE[0]:-}"
+if [ -n "$SCRIPT_SOURCE" ] && [ -f "$SCRIPT_SOURCE" ]; then
+  SELF_DIR="$(cd "$(dirname "$SCRIPT_SOURCE")" 2>/dev/null && pwd -P)" || SELF_DIR=""
+fi
 DEVRITES_REPO="${DEVRITES_REPO:-ViktorsBaikers/DevRites}"
 DEVRITES_REF="${DEVRITES_REF:-}"
 
+BOOTSTRAP_DIR=""
+BOOTSTRAP_MAX_METADATA=1048576
+BOOTSTRAP_MAX_SIDECAR=4096
+BOOTSTRAP_MAX_ARCHIVE=67108864
+BOOTSTRAP_MAX_UNCOMPRESSED=335544320
+BOOTSTRAP_MAX_EXPANDED=268435456
+
+valid_repo() {
+  printf '%s\n' "$1" | LC_ALL=C grep -Eq '^[A-Za-z0-9][A-Za-z0-9_.-]*/[A-Za-z0-9][A-Za-z0-9_.-]*$'
+}
+
+normalize_release_tag() {
+  version="${1#v}"
+  printf '%s\n' "$version" | LC_ALL=C grep -Eq '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$' || return 1
+  prerelease="${version%%+*}"
+  case "$prerelease" in
+    *-*) prerelease="${prerelease#*-}" ;;
+    *) prerelease="" ;;
+  esac
+  if [ -n "$prerelease" ]; then
+    printf '%s\n' "$prerelease" | awk -F. '{ for (i = 1; i <= NF; i++) if ($i ~ /^[0-9]+$/ && length($i) > 1 && substr($i, 1, 1) == "0") exit 1 }' || return 1
+  fi
+  printf 'v%s\n' "$version"
+}
+
+bounded_curl() {
+  url="$1"
+  out="$2"
+  limit="$3"
+  seconds="$4"
+  DOWNLOAD_FAILURE=""
+  rm -f "$out" "$out.part"
+  curl -fL --proto '=https' --proto-redir '=https' --tlsv1.2 --connect-timeout 10 --max-time "$seconds" \
+    "$url" 2>/dev/null | head -c "$((limit + 1))" > "$out.part"
+  pipeline_status=("${PIPESTATUS[@]}")
+  curl_status="${pipeline_status[0]}"
+  head_status="${pipeline_status[1]}"
+  bytes="$(wc -c < "$out.part" 2>/dev/null)" || {
+    DOWNLOAD_FAILURE="local write"
+    rm -f "$out.part"
+    return 1
+  }
+  if [ "$bytes" -gt "$limit" ]; then
+    DOWNLOAD_FAILURE="size limit"
+    rm -f "$out.part"
+    return 1
+  fi
+  if [ "$head_status" -ne 0 ]; then
+    DOWNLOAD_FAILURE="local write"
+    rm -f "$out.part"
+    return 1
+  fi
+  if [ "$curl_status" -ne 0 ]; then
+    case "$curl_status" in
+      22) DOWNLOAD_FAILURE="HTTP status" ;;
+      28) DOWNLOAD_FAILURE="timeout" ;;
+      47) DOWNLOAD_FAILURE="redirect" ;;
+      *) DOWNLOAD_FAILURE="download" ;;
+    esac
+    rm -f "$out.part"
+    return 1
+  fi
+  mv "$out.part" "$out" || { DOWNLOAD_FAILURE="local write"; rm -f "$out.part"; return 1; }
+}
+
+bounded_decompress() {
+  archive="$1"
+  out="$2"
+  limit="$3"
+  DECOMPRESS_FAILURE=""
+  rm -f "$out" "$out.part"
+  gzip -dc "$archive" 2>/dev/null | head -c "$((limit + 1))" > "$out.part"
+  pipeline_status=("${PIPESTATUS[@]}")
+  gzip_status="${pipeline_status[0]}"
+  head_status="${pipeline_status[1]}"
+  bytes="$(wc -c < "$out.part" 2>/dev/null)" || {
+    DECOMPRESS_FAILURE="could not write bounded archive"
+    rm -f "$out.part"
+    return 1
+  }
+  if [ "$bytes" -gt "$limit" ]; then
+    DECOMPRESS_FAILURE="decompressed archive exceeds $((limit / 1048576)) MiB limit"
+    rm -f "$out.part"
+    return 1
+  fi
+  if [ "$head_status" -ne 0 ]; then
+    DECOMPRESS_FAILURE="could not write bounded archive"
+    rm -f "$out.part"
+    return 1
+  fi
+  if [ "$gzip_status" -ne 0 ]; then
+    DECOMPRESS_FAILURE="gzip decompression failed"
+    rm -f "$out.part"
+    return 1
+  fi
+  mv "$out.part" "$out" || { DECOMPRESS_FAILURE="could not write bounded archive"; rm -f "$out.part"; return 1; }
+}
+
 verify_sha256() {
   file="$1"
   sumfile="$2"
-  want="$(awk '{print $1; exit}' "$sumfile" 2>/dev/null)"
+  asset="$3"
+  want="$(awk -v asset="$asset" '
+    NF == 0 { next }
+    { records++ }
+    NF == 2 && length($1) == 64 && $1 ~ /^[0-9A-Fa-f]+$/ && $2 == asset { valid++; hash=tolower($1) }
+    END { if (records == 1 && valid == 1) print hash; else exit 1 }
+  ' "$sumfile" 2>/dev/null)" || return 1
   if command -v shasum >/dev/null 2>&1; then
     got="$(shasum -a 256 "$file" | awk '{print $1}')"
   elif command -v sha256sum >/dev/null 2>&1; then
@@ -22,6 +130,46 @@ verify_sha256() {
   [ -n "$want" ] && [ -n "$got" ] && [ "$got" = "$want" ]
 }
 
+preflight_archive() {
+  archive_path="$1"
+  tag="$2"
+  prefix="devrites-$tag"
+
+  LC_ALL=C tar -tvf "$archive_path" 2>/dev/null | LC_ALL=C awk -v max="$BOOTSTRAP_MAX_EXPANDED" '
+    {
+      count++
+      if (count > 10000) exit 1
+      type=substr($1, 1, 1)
+      if (type != "-" && type != "d") exit 1
+      if (type == "-") {
+        size=($2 ~ /^[0-9]+$/ ? $5 : $3)
+        if (size !~ /^[0-9]+$/) exit 1
+        total += size
+        if (total > max) exit 1
+      }
+    }
+    END { if (count == 0) exit 1 }
+  '
+  metadata_status=("${PIPESTATUS[@]}")
+  [ "${metadata_status[0]}" -eq 0 ] && [ "${metadata_status[1]}" -eq 0 ] || return 1
+
+  LC_ALL=C tar -tf "$archive_path" 2>/dev/null | LC_ALL=C awk -v prefix="$prefix" '
+    length($0) > 4096 || $0 == "" || $0 ~ /^\// || $0 ~ /\\/ || $0 ~ /[[:cntrl:]]/ { exit 1 }
+    {
+      count++
+      if (count > 10000) exit 1
+      name=$0
+      while (length(name) > 1 && substr(name, length(name), 1) == "/") name=substr(name, 1, length(name)-1)
+      if (name == prefix) roots++
+      else if (index(name, prefix "/") != 1) exit 1
+      if (name ~ /(^|\/)\.{1,2}(\/|$)/ || name ~ /\/\// || seen[name]++) exit 1
+    }
+    END { if (roots != 1) exit 1 }
+  '
+  path_status=("${PIPESTATUS[@]}")
+  [ "${path_status[0]}" -eq 0 ] && [ "${path_status[1]}" -eq 0 ]
+}
+
 bootstrap_bundle() {
   script="install"
   case "${1:-}" in
@@ -35,41 +183,51 @@ bootstrap_bundle() {
     exit 1
   fi
   command -v curl >/dev/null 2>&1 || { echo "error: curl is required for the network installer." >&2; exit 1; }
+  command -v gzip >/dev/null 2>&1 || { echo "error: gzip is required for the network installer." >&2; exit 1; }
   command -v tar >/dev/null 2>&1 || { echo "error: tar is required for the network installer." >&2; exit 1; }
-  tmp="$(mktemp -d 2>/dev/null || echo "${TMPDIR:-/tmp}/devrites-bootstrap.$$")"
-  mkdir -p "$tmp"
+  valid_repo "$DEVRITES_REPO" || { echo "error: DEVRITES_REPO must be an owner/repository name." >&2; exit 1; }
+  old_umask="$(umask)"
+  umask 077
+  BOOTSTRAP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/devrites-bootstrap.XXXXXX" 2>/dev/null)" || {
+    umask "$old_umask"
+    echo "error: could not create a private bootstrap directory." >&2
+    exit 1
+  }
+  umask "$old_umask"
+  trap 'exit 1' HUP INT TERM
+  trap 'rm -rf "$BOOTSTRAP_DIR"' EXIT
   if [ -n "$DEVRITES_REF" ]; then
-    tag="$DEVRITES_REF"
+    tag="$(normalize_release_tag "$DEVRITES_REF")" || { echo "error: DEVRITES_REF must be an exact semantic version." >&2; exit 1; }
   else
-    tag="$(curl -fsSL "https://api.github.com/repos/$DEVRITES_REPO/releases/latest" 2>/dev/null | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)"
-  fi
-  got=0
-  if [ -n "$tag" ]; then
-    url="https://github.com/$DEVRITES_REPO/releases/download/$tag/devrites-$tag.tar.gz"
-    if curl -fsSL -o "$tmp/devrites.tar.gz" "$url" 2>/dev/null; then
-      if curl -fsSL -o "$tmp/devrites.tar.gz.sha256" "$url.sha256" 2>/dev/null && verify_sha256 "$tmp/devrites.tar.gz" "$tmp/devrites.tar.gz.sha256"; then
-        got=1
-      else
-        echo "warning: release artifact checksum verification failed for $url; falling back to source archive." >&2
-        rm -f "$tmp/devrites.tar.gz" "$tmp/devrites.tar.gz.sha256"
-      fi
-    fi
-    if [ "$got" -ne 1 ]; then
-      url="https://github.com/$DEVRITES_REPO/archive/refs/tags/$tag.tar.gz"
-      curl -fsSL -o "$tmp/devrites.tar.gz" "$url" 2>/dev/null && got=1
-    fi
-  fi
-  if [ "$got" -ne 1 ]; then
-    url="https://github.com/$DEVRITES_REPO/archive/refs/heads/main.tar.gz"
-    curl -fsSL -o "$tmp/devrites.tar.gz" "$url" || { echo "error: could not download DevRites from $url" >&2; exit 1; }
+    metadata="$BOOTSTRAP_DIR/latest.json"
+    bounded_curl "https://api.github.com/repos/$DEVRITES_REPO/releases/latest" "$metadata" "$BOOTSTRAP_MAX_METADATA" 30 || {
+      echo "error: latest release metadata for $DEVRITES_REPO: ${DOWNLOAD_FAILURE:-download} failed." >&2
+      exit 1
+    }
+    metadata_tag="$(sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$metadata" | head -n1)"
+    tag="$(normalize_release_tag "$metadata_tag")" || { echo "error: latest release did not provide an exact semantic version." >&2; exit 1; }
   fi
-  tar -C "$tmp" -xzf "$tmp/devrites.tar.gz" || { echo "error: could not extract DevRites tarball" >&2; exit 1; }
-  bundle="$(find "$tmp" -mindepth 1 -maxdepth 1 -type d | head -n1)"
-  [ -n "$bundle" ] && [ -f "$bundle/$script.sh" ] || { echo "error: extracted bundle is missing $script.sh" >&2; exit 1; }
+  asset="devrites-$tag.tar.gz"
+  archive="$BOOTSTRAP_DIR/$asset"
+  sidecar="$archive.sha256"
+  url="https://github.com/$DEVRITES_REPO/releases/download/$tag/$asset"
+  bounded_curl "$url" "$archive" "$BOOTSTRAP_MAX_ARCHIVE" 120 || { echo "error: release $tag asset $asset: ${DOWNLOAD_FAILURE:-download} failed." >&2; exit 1; }
+  bounded_curl "$url.sha256" "$sidecar" "$BOOTSTRAP_MAX_SIDECAR" 30 || { rm -f "$archive"; echo "error: release $tag asset $asset.sha256: ${DOWNLOAD_FAILURE:-download} failed." >&2; exit 1; }
+  verify_sha256 "$archive" "$sidecar" "$asset" || { rm -f "$archive" "$sidecar"; echo "error: release $tag asset $asset: checksum failed." >&2; exit 1; }
+  uncompressed="$BOOTSTRAP_DIR/devrites-$tag.tar"
+  bounded_decompress "$archive" "$uncompressed" "$BOOTSTRAP_MAX_UNCOMPRESSED" || { rm -f "$archive" "$sidecar"; echo "error: release $tag asset $asset: ${DECOMPRESS_FAILURE:-decompression failed}." >&2; exit 1; }
+  preflight_archive "$uncompressed" "$tag" || { rm -f "$archive" "$sidecar" "$uncompressed"; echo "error: release $tag asset $asset: archive preflight failed." >&2; exit 1; }
+  extract="$BOOTSTRAP_DIR/extract"
+  mkdir "$extract" || exit 1
+  tar -C "$extract" -xf "$uncompressed" || { rm -rf "$extract"; echo "error: could not extract bounded DevRites tarball" >&2; exit 1; }
+  bundle="$extract/devrites-$tag"
+  [ -f "$bundle/$script.sh" ] || { rm -rf "$extract"; echo "error: extracted bundle is missing $script.sh" >&2; exit 1; }
   chmod +x "$bundle/install.sh" "$bundle/uninstall.sh" "$bundle/update.sh" 2>/dev/null || true
-  echo "DevRites: bootstrapped from ${tag:-main} -> $bundle"
+  echo "DevRites: bootstrapped from $tag"
   export DEVRITES_BOOTSTRAPPED=1
-  exec bash "$bundle/$script.sh" "$@"
+  bash "$bundle/$script.sh" "$@"
+  rc="$?"
+  exit "$rc"
 }
 
 if [ -z "$SELF_DIR" ] || [ ! -d "$SELF_DIR/pack" ]; then
@@ -80,12 +238,21 @@ INSTALL_LIB="$SELF_DIR/scripts/install-lib.sh"
 [ -f "$INSTALL_LIB" ] || { echo "error: extracted bundle is missing scripts/install-lib.sh" >&2; exit 1; }
 . "$INSTALL_LIB"
 
-ENGINE="$(dr_acquire_engine "$SELF_DIR" install "$DEVRITES_REPO")" || { echo "error: could not acquire devrites-engine (no usable installed binary and no matching verified release binary)." >&2; exit 1; }
+DR_ENGINE_PATH=""; DR_ENGINE_TMP=""
+trap dr_cleanup_engine EXIT
+trap 'exit 1' HUP INT TERM
+dr_acquire_engine "$SELF_DIR" install "$DEVRITES_REPO" || { echo "error: could not acquire devrites-engine (no usable installed binary and no matching verified release binary${DR_ACQUIRE_FAILURE:+; $DR_ACQUIRE_FAILURE})." >&2; exit 1; }
+ENGINE="$DR_ENGINE_PATH"
 PAYLOAD="${DEVRITES_HOST_ARTIFACT_DIR:-$SELF_DIR/pack/generated}"
-if [ ! -d "$PAYLOAD/claude/skills" ] || [ ! -d "$PAYLOAD/codex/skills" ] || [ ! -f "$PAYLOAD/codex/hooks.json" ]; then
+if [ ! -d "$PAYLOAD/claude/skills" ] || [ ! -d "$PAYLOAD/codex/skills" ] \
+  || [ ! -f "$PAYLOAD/claude/skills/devrites-lib/reference/standards/agents.md" ] \
+  || [ ! -f "$PAYLOAD/codex/skills/devrites-lib/reference/standards/agents.md" ] \
+  || [ ! -f "$PAYLOAD/codex/config.toml" ]; then
   BUILDER="$SELF_DIR/scripts/build-host-artifacts.sh"
   [ -f "$BUILDER" ] || { echo "error: generated install payload missing at $PAYLOAD and builder missing at $BUILDER" >&2; exit 1; }
   DEVRITES_HOST_ARTIFACT_DIR="$PAYLOAD" bash "$BUILDER" >/dev/null || { echo "error: could not generate install payload at $PAYLOAD" >&2; exit 1; }
 fi
 export DEVRITES_ENGINE_CLI="$ENGINE"
-exec "$ENGINE" install --source-dir "$SELF_DIR" --payload-dir "$PAYLOAD" "$@"
+"$ENGINE" install --source-dir "$SELF_DIR" --payload-dir "$PAYLOAD" "$@"
+rc="$?"
+exit "$rc"