oh-my-opencode 4.10.0 → 4.11.0

package/packages/omo-codex/plugin/components/bootstrap/hooks/hooks.json

@@ -8,7 +8,7 @@
 						"command": "node \"${PLUGIN_ROOT}/components/bootstrap/dist/cli.js\" hook session-start",
 						"commandWindows": "powershell -NoProfile -ExecutionPolicy Bypass -File \"${PLUGIN_ROOT}\\components\\bootstrap\\scripts\\bootstrap.ps1\"",
 						"timeout": 30,
-						"statusMessage": "LazyCodex(4.10.0): Checking Bootstrap Provisioning"
+						"statusMessage": "LazyCodex(4.11.0): Checking Bootstrap Provisioning"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/bootstrap/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sisyphuslabs/codex-bootstrap",
-	"version": "4.10.0",
+	"version": "4.11.0",
 	"description": "Codex SessionStart bootstrap component that provisions LazyCodex runtime dependencies from a detached worker.",
 	"type": "module",
 	"private": true,

package/packages/omo-codex/plugin/components/bootstrap/scripts/generate-manifests.mjs

@@ -1,42 +1,28 @@
 #!/usr/bin/env node
-// Regenerates the committed, reviewed manifests at ../manifests/{ast-grep,node}.json.
+// Regenerates the committed, reviewed manifest at ../manifests/node.json.
 // This script is the ONLY network-touching code in the bootstrap component; runtime
 // downloads consume the pinned values, and unit tests inject fetch (never the network).
 //
-// Re-run procedure (after an @ast-grep/cli bump in packages/ast-grep-mcp/package.json,
-// or to move the pinned Node.js LTS):
-//   1. bun install (so node_modules/@ast-grep/cli matches the lockfile resolution)
-//   2. node packages/omo-codex/plugin/components/bootstrap/scripts/generate-manifests.mjs
-//      [--ast-grep-version <x.y.z>] [--node-version <x.y.z>]
-//   3. Review the manifest diff and commit it. Manifests are NEVER generated at build
+// Re-run procedure to move the pinned Node.js LTS:
+//   1. node packages/omo-codex/plugin/components/bootstrap/scripts/generate-manifests.mjs
+//      [--node-version <x.y.z>]
+//   2. Review the manifest diff and commit it. Manifests are NEVER generated at build
 //      time; builds must stay offline and deterministic.
 //
 // Sources:
-//   - sg:   https://github.com/ast-grep/ast-grep/releases (assets downloaded + hashed
-//           here because the release publishes no checksum files)
 //   - node: https://nodejs.org/dist (SHASUMS256.txt per release; win32-x64 zip only)
-import { createHash } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const scriptDirectory = dirname(fileURLToPath(import.meta.url));
 const componentRoot = dirname(scriptDirectory);
-const repoRoot = resolve(componentRoot, "..", "..", "..", "..", "..");
 const manifestsDirectory = join(componentRoot, "manifests");
 
-const SG_PLATFORM_ASSETS = {
-	"darwin-arm64": "app-aarch64-apple-darwin.zip",
-	"darwin-x64": "app-x86_64-apple-darwin.zip",
-	"linux-x64": "app-x86_64-unknown-linux-gnu.zip",
-	"win32-x64": "app-x86_64-pc-windows-msvc.zip",
-};
-
 function parseArgs(argv) {
 	const flags = {};
 	for (let index = 0; index < argv.length; index += 1) {
-		if (argv[index] === "--ast-grep-version") flags.astGrepVersion = argv[(index += 1)];
-		else if (argv[index] === "--node-version") flags.nodeVersion = argv[(index += 1)];
+		if (argv[index] === "--node-version") flags.nodeVersion = argv[(index += 1)];
 		else throw new Error(`unknown argument: ${argv[index]}`);
 	}
 	return flags;
@@ -53,34 +39,6 @@ async function fetchOk(url, accept) {
 	return response;
 }
 
-async function resolveInstalledAstGrepVersion() {
-	const declared = JSON.parse(await readFile(join(repoRoot, "packages", "ast-grep-mcp", "package.json"), "utf8"))
-		.dependencies["@ast-grep/cli"];
-	const installedPackageJsonPath = join(repoRoot, "node_modules", "@ast-grep", "cli", "package.json");
-	const installed = JSON.parse(await readFile(installedPackageJsonPath, "utf8")).version;
-	console.log(`ast-grep: declared ${declared} in packages/ast-grep-mcp, locked install ${installed}`);
-	return installed;
-}
-
-async function generateAstGrepManifest(version) {
-	const release = await (
-		await fetchOk(`https://api.github.com/repos/ast-grep/ast-grep/releases/tags/${version}`, "application/vnd.github+json")
-	).json();
-	const assetNames = new Set(release.assets.map((asset) => asset.name));
-	const platforms = {};
-	for (const [platformKey, assetName] of Object.entries(SG_PLATFORM_ASSETS)) {
-		if (!assetNames.has(assetName)) {
-			throw new Error(`release ${version} has no asset named ${assetName} (have: ${[...assetNames].join(", ")})`);
-		}
-		const url = `https://github.com/ast-grep/ast-grep/releases/download/${version}/${assetName}`;
-		const bytes = Buffer.from(await (await fetchOk(url)).arrayBuffer());
-		const sha256 = createHash("sha256").update(bytes).digest("hex");
-		platforms[platformKey] = { sha256, url };
-		console.log(`ast-grep ${platformKey}: ${assetName} ${bytes.length} bytes sha256=${sha256}`);
-	}
-	return { name: "ast-grep", platforms, version };
-}
-
 async function resolveLatestNodeLtsVersion() {
 	const releases = await (await fetchOk("https://nodejs.org/dist/index.json")).json();
 	const latestLts = releases.find((release) => release.lts !== false);
@@ -109,7 +67,5 @@ async function writeManifest(fileName, manifest) {
 }
 
 const flags = parseArgs(process.argv.slice(2));
-const astGrepVersion = flags.astGrepVersion ?? (await resolveInstalledAstGrepVersion());
 const nodeVersion = flags.nodeVersion ?? (await resolveLatestNodeLtsVersion());
-await writeManifest("ast-grep.json", await generateAstGrepManifest(astGrepVersion));
 await writeManifest("node.json", await generateNodeManifest(nodeVersion));

package/packages/omo-codex/plugin/components/bootstrap/src/provision.ts

@@ -1,21 +1,23 @@
 import { execFile } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
+import { rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { promisify } from "node:util";
-import { inflateRawSync } from "node:zlib";
 
-// Cross-package source import (bundled into dist/cli.js at build time) so the
-// preexisting-sg probe order can never drift from the MCP's own resolver.
-import { findSgCliPathSync } from "../../../../../ast-grep-mcp/src/sg-cli-path.ts";
-import { downloadChecksummedAsset, loadAssetManifest } from "./download.ts";
-import type { FetchLike } from "./download.ts";
+import {
+	findSgBinarySync,
+	provisionSgBinary,
+	runtimeSlug,
+	SG_PINNED_VERSION,
+	sgBinaryName,
+	type SgFetch,
+	type SgManifestAsset,
+	type SgRuntimeSlug,
+} from "../../../../../utils/src/ast-grep/index.ts";
 import { appendBootstrapLog, BOOTSTRAP_DOCTOR_HINT } from "./worker.ts";
 import type { BootstrapStepOutcome, BootstrapWorkerContext } from "./worker.ts";
 
 export const SG_PROVISION_COMPONENT = "ast_grep";
 export const SG_FORCE_PROVISION_ENV_KEY = "OMO_BOOTSTRAP_FORCE_PROVISION";
-const SG_MANIFEST_NAME = "ast-grep";
 
 export interface ResolvePreexistingSgOptions {
 	readonly arch: string;
@@ -26,14 +28,18 @@ export interface ResolvePreexistingSgOptions {
 
 export interface SgProvisionSeams {
 	readonly arch?: string;
-	readonly fetchImpl?: FetchLike;
+	readonly fetchImpl?: SgFetch;
+	readonly releaseAssets?: Partial<Record<SgRuntimeSlug, SgManifestAsset>>;
 	readonly resolvePreexistingSg?: (options: ResolvePreexistingSgOptions) => string | null;
 	readonly runVersionProbe?: (binaryPath: string) => Promise<string>;
 }
 
 export function sgProvisionDestination(context: BootstrapWorkerContext, arch: string): string {
-	const binaryName = context.platform === "win32" ? "sg.exe" : "sg";
-	return join(context.codexHome, "runtime", "ast-grep", `${context.platform}-${arch}`, binaryName);
+	return join(sgRuntimeDir(context.codexHome, context.platform, arch), sgBinaryName(context.platform));
+}
+
+function sgRuntimeDir(codexHome: string, platform: NodeJS.Platform, arch: string): string {
+	return join(codexHome, "runtime", "ast-grep", runtimeSlug(platform, arch));
 }
 
 export async function runSgProvision(
@@ -56,9 +62,8 @@ export async function runSgProvision(
 		}
 	}
 
-	const stagingDir = join(dirname(destination), `.staging-${randomUUID().slice(0, 8)}`);
 	try {
-		const version = await provisionFromManifest(context, seams, { arch, destination, stagingDir });
+		const version = await provisionFromSharedManifest(context, seams, { arch, destination });
 		await appendBootstrapLog(context.pluginData, context.now, "sg-provision", {
 			sg: `provisioned:${destination}`,
 			version,
@@ -68,42 +73,27 @@ export async function runSgProvision(
 		const reason = error instanceof Error ? error.message : String(error);
 		await appendBootstrapLog(context.pluginData, context.now, "sg-provision-failed", { reason });
 		return { degraded: [{ component: SG_PROVISION_COMPONENT, hint: BOOTSTRAP_DOCTOR_HINT, reason }] };
-	} finally {
-		await rm(stagingDir, { force: true, recursive: true });
 	}
 }
 
-async function provisionFromManifest(
+async function provisionFromSharedManifest(
 	context: BootstrapWorkerContext,
 	seams: SgProvisionSeams,
-	layout: { readonly arch: string; readonly destination: string; readonly stagingDir: string },
+	layout: { readonly arch: string; readonly destination: string },
 ): Promise<string> {
-	const manifest = await loadAssetManifest(SG_MANIFEST_NAME, context.flags.manifestDir);
-	const platformKey = `${context.platform}-${layout.arch}`;
-	const asset = manifest.platforms[platformKey];
-	if (asset === undefined) {
-		throw new Error(
-			`ast-grep ${manifest.version} has no asset for unsupported platform "${platformKey}" (available: ${Object.keys(manifest.platforms).join(", ")}).`,
-		);
-	}
-
-	await mkdir(layout.stagingDir, { recursive: true });
-	const archivePath = await downloadChecksummedAsset({
-		destination: join(layout.stagingDir, basename(new URL(asset.url).pathname)),
-		env: context.env as NodeJS.ProcessEnv,
-		sha256: asset.sha256,
-		url: asset.url,
+	const provisionedPath = await provisionSgBinary({
+		arch: layout.arch,
+		platform: context.platform,
+		targetDir: dirname(layout.destination),
 		...(seams.fetchImpl === undefined ? {} : { fetchImpl: seams.fetchImpl }),
+		...(seams.releaseAssets === undefined ? {} : { releaseAssets: seams.releaseAssets }),
 	});
-
-	const binaryBytes = extractStandaloneSgBinary(await readFile(archivePath), context.platform);
-	const stagedBinary = join(layout.stagingDir, basename(layout.destination));
-	await writeFile(stagedBinary, binaryBytes);
-	await chmod(stagedBinary, 0o755);
-	await rename(stagedBinary, layout.destination);
-
-	await verifyProvisionedVersion(layout.destination, manifest.version, seams);
-	return manifest.version;
+	if (provisionedPath !== layout.destination) {
+		await rm(provisionedPath, { force: true });
+		throw new Error(`provisioned sg at ${provisionedPath} but expected ${layout.destination}; removed the binary.`);
+	}
+	await verifyProvisionedVersion(layout.destination, SG_PINNED_VERSION, seams);
+	return SG_PINNED_VERSION;
 }
 
 async function verifyProvisionedVersion(
@@ -129,10 +119,11 @@ async function verifyProvisionedVersion(
 }
 
 function defaultResolvePreexistingSg(options: ResolvePreexistingSgOptions): string | null {
-	return findSgCliPathSync({
+	return findSgBinarySync({
 		arch: options.arch,
 		env: { ...options.env, CODEX_HOME: options.codexHome },
 		platform: options.platform,
+		runtimeDir: sgRuntimeDir(options.codexHome, options.platform, options.arch),
 	});
 }
 
@@ -142,102 +133,3 @@ async function defaultVersionProbe(binaryPath: string): Promise<string> {
 	const { stdout } = await execFileAsync(binaryPath, ["--version"]);
 	return String(stdout);
 }
-
-// Release zips (verified against 0.42.3) contain two entries: a tiny `sg`
-// alias shim that exec's `ast-grep` via PATH search ONLY (it fails standalone
-// even with a sibling ast-grep), and the standalone `ast-grep` binary. The
-// standalone entry is therefore installed under the destination name sg[.exe].
-function extractStandaloneSgBinary(zip: Buffer, platform: NodeJS.Platform): Buffer {
-	const suffix = platform === "win32" ? ".exe" : "";
-	const entries = listZipEntries(zip);
-	const preferredNames = [`ast-grep${suffix}`, `sg${suffix}`];
-	for (const preferred of preferredNames) {
-		const entry = entries.find((candidate) => zipEntryBaseName(candidate.name) === preferred);
-		if (entry !== undefined) return readZipEntryBytes(zip, entry);
-	}
-	throw new Error(
-		`ast-grep release zip has no ${preferredNames.join(" or ")} entry (found: ${entries.map((entry) => entry.name).join(", ")}).`,
-	);
-}
-
-function zipEntryBaseName(entryName: string): string {
-	const segments = entryName.split("/");
-	return segments[segments.length - 1] ?? entryName;
-}
-
-interface ZipCentralEntry {
-	readonly compressedSize: number;
-	readonly localHeaderOffset: number;
-	readonly method: number;
-	readonly name: string;
-	readonly uncompressedSize: number;
-}
-
-// Minimal zip reader (EOCD -> central directory -> local header) so extraction
-// stays pure-node and deterministic; offsets follow APPNOTE.TXT 4.3.
-const EOCD_SIGNATURE = 0x06054b50;
-const CENTRAL_SIGNATURE = 0x02014b50;
-const LOCAL_SIGNATURE = 0x04034b50;
-const ZIP64_SENTINEL = 0xffffffff;
-
-function listZipEntries(zip: Buffer): ZipCentralEntry[] {
-	const eocdOffset = findEndOfCentralDirectory(zip);
-	const entryCount = zip.readUInt16LE(eocdOffset + 10);
-	let cursor = zip.readUInt32LE(eocdOffset + 16);
-	const entries: ZipCentralEntry[] = [];
-	for (let index = 0; index < entryCount; index += 1) {
-		if (cursor + 46 > zip.length || zip.readUInt32LE(cursor) !== CENTRAL_SIGNATURE) {
-			throw new Error("zip central directory is corrupt (bad entry signature)");
-		}
-		const nameLength = zip.readUInt16LE(cursor + 28);
-		const extraLength = zip.readUInt16LE(cursor + 30);
-		const commentLength = zip.readUInt16LE(cursor + 32);
-		entries.push({
-			compressedSize: zip.readUInt32LE(cursor + 20),
-			localHeaderOffset: zip.readUInt32LE(cursor + 42),
-			method: zip.readUInt16LE(cursor + 10),
-			name: zip.subarray(cursor + 46, cursor + 46 + nameLength).toString("utf8"),
-			uncompressedSize: zip.readUInt32LE(cursor + 24),
-		});
-		cursor += 46 + nameLength + extraLength + commentLength;
-	}
-	return entries;
-}
-
-function findEndOfCentralDirectory(zip: Buffer): number {
-	const lowestOffset = Math.max(0, zip.length - 22 - 65_535);
-	for (let offset = zip.length - 22; offset >= lowestOffset; offset -= 1) {
-		if (zip.readUInt32LE(offset) === EOCD_SIGNATURE) return offset;
-	}
-	throw new Error("downloaded asset is not a zip archive (end-of-central-directory record missing)");
-}
-
-function readZipEntryBytes(zip: Buffer, entry: ZipCentralEntry): Buffer {
-	if (
-		entry.compressedSize === ZIP64_SENTINEL ||
-		entry.uncompressedSize === ZIP64_SENTINEL ||
-		entry.localHeaderOffset === ZIP64_SENTINEL
-	) {
-		throw new Error(`zip entry ${entry.name} uses unsupported zip64 extensions`);
-	}
-	if (zip.readUInt32LE(entry.localHeaderOffset) !== LOCAL_SIGNATURE) {
-		throw new Error(`zip entry ${entry.name} has a corrupt local header`);
-	}
-	const nameLength = zip.readUInt16LE(entry.localHeaderOffset + 26);
-	const extraLength = zip.readUInt16LE(entry.localHeaderOffset + 28);
-	const dataStart = entry.localHeaderOffset + 30 + nameLength + extraLength;
-	const raw = zip.subarray(dataStart, dataStart + entry.compressedSize);
-	const bytes = decompressZipEntry(raw, entry);
-	if (bytes.length !== entry.uncompressedSize) {
-		throw new Error(
-			`zip entry ${entry.name} inflated to ${bytes.length} bytes but the archive declares ${entry.uncompressedSize}`,
-		);
-	}
-	return bytes;
-}
-
-function decompressZipEntry(raw: Buffer, entry: ZipCentralEntry): Buffer {
-	if (entry.method === 0) return Buffer.from(raw);
-	if (entry.method === 8) return inflateRawSync(raw);
-	throw new Error(`zip entry ${entry.name} uses unsupported compression method ${entry.method}`);
-}

package/packages/omo-codex/plugin/components/bootstrap/src/setup.ts

@@ -4,21 +4,20 @@ import { join } from "node:path";
 import { promisify } from "node:util";
 
 // These relative imports resolve at BUILD time in the monorepo; esbuild
-// inlines the install modules into dist/cli.js so PLUGIN_ROOT ships nothing
-// beyond the bundle.
+// inlines the installer source modules into dist/cli.js so PLUGIN_ROOT ships
+// nothing beyond the bundle.
 import {
 	capturePreservedAgentReasoning,
 	capturePreservedAgentServiceTier,
 	linkCachedPluginAgents,
-} from "../../../../scripts/install/agents.mjs";
-import { resolveCodexInstallerBinDir } from "../../../../scripts/install/bin-dir.mjs";
-import { linkCachedPluginBins, linkRootRuntimeBin } from "../../../../scripts/install/bin-links.mjs";
-import { updateCodexConfig } from "../../../../scripts/install/config.mjs";
-import type { CodexAgentConfig } from "../../../../scripts/install/config.mjs";
-import { stampGitBashMcpEnv } from "../../../../scripts/install/git-bash-mcp-env.mjs";
-import { prepareGitBashForInstall } from "../../../../scripts/install/git-bash.mjs";
-import type { GitBashResolution } from "../../../../scripts/install/git-bash.mjs";
-import { trustedHookStatesForPlugin } from "../../../../scripts/install/hook-trust.mjs";
+} from "../../../../src/install/link-cached-plugin-agents.ts";
+import { linkCachedPluginBins, linkRootRuntimeBin } from "../../../../src/install/codex-cache-bins.ts";
+import { updateCodexConfig } from "../../../../src/install/codex-config-toml.ts";
+import { stampGitBashMcpEnv } from "../../../../src/install/codex-git-bash-mcp-env.ts";
+import { trustedHookStatesForPlugin } from "../../../../src/install/codex-hook-trust.ts";
+import { resolveCodexInstallerBinDir } from "../../../../src/install/codex-installer-bin-dir.ts";
+import { prepareGitBashForInstall } from "../../../../src/install/git-bash.ts";
+import type { CodexAgentConfig, GitBashResolution } from "../../../../src/install/types.ts";
 import { appendBootstrapLog, BOOTSTRAP_DOCTOR_HINT } from "./worker.ts";
 import type { BootstrapDegradedEntry, BootstrapStepOutcome } from "./worker.ts";
 
@@ -166,6 +165,7 @@ async function updateConfigStep(
 			configPath,
 			gitBashEnabled: inputs.gitBashEnabled,
 			marketplaceName: SETUP_MARKETPLACE_NAME,
+			marketplaceSource: { sourceType: "local", source: options.pluginRoot },
 			platform: options.platform,
 			pluginNames: [SETUP_PLUGIN_NAME],
 			preserveMarketplaceSource: true,

package/packages/omo-codex/plugin/components/bootstrap/test/environment.test.ts

@@ -355,7 +355,7 @@ async function writeSyncSourceFixture(sourceRoot: string): Promise<void> {
 	await writeJson(join(pluginSource, "components", "bootstrap", "hooks", "hooks.json"), bootstrapSessionStart);
 	await writeJson(join(pluginSource, ".mcp.json"), {
 		mcpServers: {
-			ast_grep: { args: ["../../ast-grep-mcp/dist/cli.js", "mcp"], command: "node", cwd: "." },
+			ast_grep: { args: ["./components/ast-grep-skill/dist/cli.js", "mcp"], command: "node", cwd: "." },
 			git_bash: { args: ["../../git-bash-mcp/dist/cli.js", "mcp"], command: "node", cwd: "." },
 			lsp: { args: ["../../lsp-daemon/dist/cli.js", "mcp"], command: "node", cwd: "." },
 		},
@@ -366,9 +366,10 @@ async function writeSyncSourceFixture(sourceRoot: string): Promise<void> {
 		"name: PR source guidance\n\non:\n  pull_request_target:\n",
 	);
 	await writeExecutableStub(join(pluginSource, "components", "bootstrap", "dist", "cli.js"));
+	await writeExecutableStub(join(pluginSource, "components", "ast-grep-skill", "dist", "cli.js"));
 	await mkdir(join(pluginSource, "components", "bootstrap", "scripts"), { recursive: true });
 	await writeFile(join(pluginSource, "components", "bootstrap", "scripts", "bootstrap.ps1"), "exit 0\n");
-	await writeExecutableStub(join(sourceRoot, "packages", "ast-grep-mcp", "dist", "cli.js"));
+	await writeExecutableStub(join(sourceRoot, "packages", ["ast", "grep", "mcp"].join("-"), "dist", "cli.js"));
 	await writeExecutableStub(join(sourceRoot, "packages", "git-bash-mcp", "dist", "cli.js"));
 	await writeExecutableStub(join(sourceRoot, "packages", "lsp-tools-mcp", "dist", "cli.js"));
 	await writeExecutableStub(join(sourceRoot, "packages", "lsp-daemon", "dist", "cli.js"));

package/packages/omo-codex/plugin/components/bootstrap/test/provision.test.ts

@@ -6,7 +6,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { deflateRawSync } from "node:zlib";
 
-import type { FetchLike } from "../src/download.ts";
+import { SG_PINNED_VERSION, type SgFetch, type SgManifestAsset, type SgRuntimeSlug } from "../../../../../utils/src/ast-grep/index.ts";
 import {
 	runSgProvision,
 	SG_FORCE_PROVISION_ENV_KEY,
@@ -113,26 +113,22 @@ const FIXTURE_ZIP = makeZip([
 	{ data: SHIM_BYTES, name: "sg" },
 	{ data: STANDALONE_BYTES, name: "ast-grep" },
 ]);
-const FIXTURE_VERSION = "9.9.9";
-
-async function writeAstGrepManifest(
-	manifestsDir: string,
-	options: { sha256?: string; platforms?: Record<string, { url: string; sha256: string }> } = {},
-): Promise<void> {
-	await mkdir(manifestsDir, { recursive: true });
-	const platforms = options.platforms ?? {
+const FIXTURE_VERSION = SG_PINNED_VERSION;
+
+function fixtureReleaseAssets(
+	options: { readonly sha256?: string; readonly platforms?: Partial<Record<SgRuntimeSlug, SgManifestAsset>> } = {},
+): Partial<Record<SgRuntimeSlug, SgManifestAsset>> {
+	return options.platforms ?? {
 		"linux-x64": {
 			sha256: options.sha256 ?? sha256Hex(FIXTURE_ZIP),
-			url: "https://example.invalid/releases/9.9.9/app-x86_64-unknown-linux-gnu.zip",
+			url: `https://example.invalid/releases/${FIXTURE_VERSION}/app-x86_64-unknown-linux-gnu.zip`,
 		},
 	};
-	const manifest = { name: "ast-grep", platforms, version: FIXTURE_VERSION };
-	await writeFile(join(manifestsDir, "ast-grep.json"), JSON.stringify(manifest, null, "\t"), "utf8");
 }
 
-function fetchReturning(bytes: Uint8Array): { fetchImpl: FetchLike; calls: string[] } {
+function fetchReturning(bytes: Uint8Array): { fetchImpl: SgFetch; calls: string[] } {
 	const calls: string[] = [];
-	const fetchImpl: FetchLike = async (url) => {
+	const fetchImpl: SgFetch = async (url) => {
 		calls.push(url);
 		return new Response(bytes, { status: 200 });
 	};
@@ -180,7 +176,6 @@ describe("runSgProvision", () => {
 		const root = createTemporaryDirectory("omo-bootstrap-provision-");
 		const codexHome = join(root, "codex-home");
 		const manifestDir = join(root, "manifests");
-		await writeAstGrepManifest(manifestDir);
 		const { calls, fetchImpl } = fetchReturning(FIXTURE_ZIP);
 		const probed: string[] = [];
 		const context = makeContext({ codexHome, manifestDir, pluginData: join(root, "data") });
@@ -189,6 +184,7 @@ describe("runSgProvision", () => {
 		const outcome = await runSgProvision(context, {
 			arch: "x64",
 			fetchImpl,
+			releaseAssets: fixtureReleaseAssets(),
 			resolvePreexistingSg: () => null,
 			runVersionProbe: async (binaryPath: string) => {
 				probed.push(binaryPath);
@@ -200,7 +196,7 @@ describe("runSgProvision", () => {
 		const destination = join(codexHome, "runtime", "ast-grep", "linux-x64", "sg");
 		expect(sgProvisionDestination(context, "x64")).toBe(destination);
 		expect(outcome.degraded).toEqual([]);
-		expect(calls).toEqual(["https://example.invalid/releases/9.9.9/app-x86_64-unknown-linux-gnu.zip"]);
+		expect(calls).toEqual([`https://example.invalid/releases/${FIXTURE_VERSION}/app-x86_64-unknown-linux-gnu.zip`]);
 		expect(probed).toEqual([destination]);
 		expect(new Uint8Array(await readFile(destination))).toEqual(STANDALONE_BYTES);
 		expect((await stat(destination)).mode & 0o777).toBe(0o755);
@@ -213,7 +209,6 @@ describe("runSgProvision", () => {
 		const root = createTemporaryDirectory("omo-bootstrap-provision-");
 		const codexHome = join(root, "codex-home");
 		const manifestDir = join(root, "manifests");
-		await writeAstGrepManifest(manifestDir);
 		const { calls, fetchImpl } = fetchReturning(FIXTURE_ZIP);
 		const context = makeContext({ codexHome, manifestDir, pluginData: join(root, "data") });
 
@@ -221,6 +216,7 @@ describe("runSgProvision", () => {
 		const outcome = await runSgProvision(context, {
 			arch: "x64",
 			fetchImpl,
+			releaseAssets: fixtureReleaseAssets(),
 			resolvePreexistingSg: () => "/opt/homebrew/bin/sg",
 			runVersionProbe: async () => {
 				throw new Error("must not probe on short-circuit");
@@ -239,7 +235,6 @@ describe("runSgProvision", () => {
 		const root = createTemporaryDirectory("omo-bootstrap-provision-");
 		const codexHome = join(root, "codex-home");
 		const manifestDir = join(root, "manifests");
-		await writeAstGrepManifest(manifestDir);
 		const { calls, fetchImpl } = fetchReturning(FIXTURE_ZIP);
 		const resolverCalls: string[] = [];
 		const context = makeContext({
@@ -253,6 +248,7 @@ describe("runSgProvision", () => {
 		const outcome = await runSgProvision(context, {
 			arch: "x64",
 			fetchImpl,
+			releaseAssets: fixtureReleaseAssets(),
 			resolvePreexistingSg: () => {
 				resolverCalls.push("resolved");
 				return "/opt/homebrew/bin/sg";
@@ -274,13 +270,13 @@ describe("runSgProvision", () => {
 		const root = createTemporaryDirectory("omo-bootstrap-provision-");
 		const codexHome = join(root, "codex-home");
 		const manifestDir = join(root, "manifests");
-		await writeAstGrepManifest(manifestDir, { sha256: sha256Hex(new TextEncoder().encode("tampered")) });
 		const context = makeContext({ codexHome, manifestDir, pluginData: join(root, "data") });
 
 		// when
 		const outcome = await runSgProvision(context, {
 			arch: "x64",
 			fetchImpl: fetchReturning(FIXTURE_ZIP).fetchImpl,
+			releaseAssets: fixtureReleaseAssets({ sha256: sha256Hex(new TextEncoder().encode("tampered")) }),
 			resolvePreexistingSg: () => null,
 			runVersionProbe: async () => `ast-grep ${FIXTURE_VERSION}`,
 		});
@@ -299,13 +295,13 @@ describe("runSgProvision", () => {
 		const root = createTemporaryDirectory("omo-bootstrap-provision-");
 		const codexHome = join(root, "codex-home");
 		const manifestDir = join(root, "manifests");
-		await writeAstGrepManifest(manifestDir);
 		const context = makeContext({ codexHome, manifestDir, pluginData: join(root, "data") });
 
 		// when
 		const outcome = await runSgProvision(context, {
 			arch: "x64",
 			fetchImpl: fetchReturning(FIXTURE_ZIP).fetchImpl,
+			releaseAssets: fixtureReleaseAssets(),
 			resolvePreexistingSg: () => null,
 			runVersionProbe: async () => "ast-grep 0.0.1",
 		});
@@ -320,19 +316,23 @@ describe("runSgProvision", () => {
 		expect(await listFilesRecursively(join(codexHome, "runtime"))).toEqual([]);
 	});
 
-	it("#given a platform absent from the manifest #when provisioning #then a degraded entry names the unsupported platform without fetching", async () => {
+	it("#given the shared provisioner download fails #when provisioning #then a degraded entry names the download failure and leaves runtime empty", async () => {
 		// given
 		const root = createTemporaryDirectory("omo-bootstrap-provision-");
 		const codexHome = join(root, "codex-home");
 		const manifestDir = join(root, "manifests");
-		await writeAstGrepManifest(manifestDir);
-		const { calls, fetchImpl } = fetchReturning(FIXTURE_ZIP);
+		const calls: string[] = [];
+		const fetchImpl: SgFetch = async (url) => {
+			calls.push(url);
+			return new Response("unavailable", { status: 503 });
+		};
 		const context = makeContext({ codexHome, manifestDir, pluginData: join(root, "data") });
 
 		// when
 		const outcome = await runSgProvision(context, {
-			arch: "riscv64",
+			arch: "x64",
 			fetchImpl,
+			releaseAssets: fixtureReleaseAssets(),
 			resolvePreexistingSg: () => null,
 			runVersionProbe: async () => `ast-grep ${FIXTURE_VERSION}`,
 		});
@@ -341,9 +341,9 @@ describe("runSgProvision", () => {
 		expect(outcome.degraded).toHaveLength(1);
 		const entry = outcome.degraded[0];
 		expect(entry?.component).toBe(SG_PROVISION_COMPONENT);
-		expect(entry?.reason).toMatch(/unsupported platform/i);
-		expect(entry?.reason).toContain("linux-riscv64");
-		expect(calls).toEqual([]);
+		expect(entry?.reason).toMatch(/failed to download/i);
+		expect(entry?.reason).toContain("HTTP 503");
+		expect(calls).toEqual([`https://example.invalid/releases/${FIXTURE_VERSION}/app-x86_64-unknown-linux-gnu.zip`]);
 		expect(await listFilesRecursively(join(codexHome, "runtime"))).toEqual([]);
 	});
 
@@ -356,14 +356,6 @@ describe("runSgProvision", () => {
 			{ data: SHIM_BYTES, name: "sg.exe" },
 			{ data: STANDALONE_BYTES, name: "ast-grep.exe" },
 		]);
-		await writeAstGrepManifest(manifestDir, {
-			platforms: {
-				"win32-x64": {
-					sha256: sha256Hex(windowsZip),
-					url: "https://example.invalid/releases/9.9.9/app-x86_64-pc-windows-msvc.zip",
-				},
-			},
-		});
 		const context: BootstrapWorkerContext = {
 			...makeContext({ codexHome, manifestDir, pluginData: join(root, "data") }),
 			platform: "win32",
@@ -373,6 +365,14 @@ describe("runSgProvision", () => {
 		const outcome = await runSgProvision(context, {
 			arch: "x64",
 			fetchImpl: fetchReturning(windowsZip).fetchImpl,
+			releaseAssets: fixtureReleaseAssets({
+				platforms: {
+					"win32-x64": {
+						sha256: sha256Hex(windowsZip),
+						url: `https://example.invalid/releases/${FIXTURE_VERSION}/app-x86_64-pc-windows-msvc.zip`,
+					},
+				},
+			}),
 			resolvePreexistingSg: () => null,
 			runVersionProbe: async () => `ast-grep ${FIXTURE_VERSION}`,
 		});
@@ -392,7 +392,6 @@ describe("worker sg step wiring", () => {
 		const manifestDir = join(root, "manifests");
 		const pluginData = join(root, "data");
 		const pluginRoot = join(root, "plugin-root");
-		await writeAstGrepManifest(manifestDir);
 		await mkdir(join(pluginRoot, ".codex-plugin"), { recursive: true });
 		await writeFile(join(pluginRoot, ".codex-plugin", "plugin.json"), JSON.stringify({ version: "1.2.3" }), "utf8");
 		const { calls, fetchImpl } = fetchReturning(FIXTURE_ZIP);
@@ -406,6 +405,7 @@ describe("worker sg step wiring", () => {
 				sg: {
 					arch: "x64",
 					fetchImpl,
+					releaseAssets: fixtureReleaseAssets(),
 					resolvePreexistingSg: () => null,
 					runVersionProbe: async () => `ast-grep ${FIXTURE_VERSION}`,
 				},
@@ -432,7 +432,6 @@ describe("worker sg step wiring", () => {
 		const manifestDir = join(root, "manifests");
 		const pluginData = join(root, "data");
 		const pluginRoot = join(root, "plugin-root");
-		await writeAstGrepManifest(manifestDir, { sha256: sha256Hex(new TextEncoder().encode("tampered")) });
 		await mkdir(join(pluginRoot, ".codex-plugin"), { recursive: true });
 		await writeFile(join(pluginRoot, ".codex-plugin", "plugin.json"), JSON.stringify({ version: "1.2.3" }), "utf8");
 
@@ -445,6 +444,7 @@ describe("worker sg step wiring", () => {
 				sg: {
 					arch: "x64",
 					fetchImpl: fetchReturning(FIXTURE_ZIP).fetchImpl,
+					releaseAssets: fixtureReleaseAssets({ sha256: sha256Hex(new TextEncoder().encode("tampered")) }),
 					resolvePreexistingSg: () => null,
 					runVersionProbe: async () => `ast-grep ${FIXTURE_VERSION}`,
 				},