opencode-secrets-obfuscation 0.1.0 → 0.1.1

package/docs/history/16-sanitizer-implementation.md

@@ -1,65 +0,0 @@
-# 16 — Pure sanitizer implementation
-
-Status: implemented pure MVP components; host qualification deferred. R19 residual sanitizer blockers remediated.
-
-## Scope
-
-`src/sanitize/index.ts` provides a dependency-free, internally derived representation inventory,
-whole-snapshot admission predicate, finite UUID/reserved-output conflict checks,
-transitive interval unions, one-pass replacement with final boundary validation,
-canonical newline-joined text sinks, and bounded canonical projections of plain
-structured data. Ambiguous unions use redaction-only output. Construction checks
-finite default output, traversal depth, node, and match bounds and withholds rather
-than returning partial data. Pattern count, text, representation, index, and
-temporary construction limits are checked before expansion. Interval materialization
-is capped before each hit is allocated; active object identities are rejected. Dotenv inventory uses the parser's
-double/single quote, escape, and multiline lexical forms. Caller representation
-metadata is not trusted.
-
-All public pure boundaries validate plain data descriptors and catch foreign proxy,
-accessor, malformed-pattern, budget, and serialization failures, returning only the
-fixed admission denial or `null` (or an empty interval result). The implementation
-does not claim universal encoding coverage, noninterference,
-or protection against arbitrary host serializers. It rejects getters, non-plain
-prototypes, arrays, binary data, and unqualified host projections; it does not invoke
-`toJSON`.
-
-## Test-first evidence
-
-The initial `tests/unit/sanitize.test.ts` run was red because
-`src/sanitize/index.ts` did not exist. After implementation:
-
-```text
-node --test tests/unit/sanitize.test.ts
-12 passed, 0 failed
-```
-
-The focused suite covers transitive `abc`/`bcdef` overlap, ambiguous replacement
-and idempotence, UUID/reserved admission (`e`, `true`, `!`), canonical cross-part
-joining, scalar/key handling, and construction limits.
-
-`npm run typecheck` remains blocked by the unrelated pre-existing malformed
-`src/budgets/index.ts` placeholder. The repository-wide unit command also has
-unrelated missing config/source/store modules and Windows private-directory
-harness failures. No host or OpenCode process was launched.
-
-Residual aggregate-work findings are closed: public transforms reserve shared finite
-pattern, index, identity, and temporary-work capacity before construction and release
-it on every return path.
-
-## R21 budget ceiling remediation
-
-The four caller-controlled operation budgets have fixed hard ceilings equal to their
-defaults: 2 MiB output, depth 32, 50,000 nodes, and 50,000 matches. An explicit
-nonnegative safe integer above any ceiling is rejected (not clamped), so no public
-sanitizer path can opt into unbounded interval, traversal, or output work. Rejected
-operations reserve no partial output and all successful reservations remain released
-on every return path.
-
-## R22 boundary and key-work remediation
-
-Canonical text-sink inspection and reservation calculation are contained by one
-fail-closed `try`/`finally`, including hostile array proxies. Plain projection collects
-enumerable keys incrementally under the finite node/object-key ceiling before sorting;
-it does not call an unbounded `Object.keys(...).sort()` operation. Denials return no
-partial projection and reservations remain reusable.

package/docs/history/17-store-policy-implementation.md

@@ -1,36 +0,0 @@
-# 17 — Pure store, policy, and budget implementation
-
-Status: implemented as unit-tested pure components; host qualification remains deferred.
-
-The MVP components are activation-local and memory-only. `ActivationStore` creates
-cryptographically random `secret-<UUIDv4>` references, keeps redaction references distinct
-from capability references, requires explicit session/agent enrollment, checks
-generation and canonical Location on every use, and clears all state on teardown.
-Raw values are only passed to a caller-owned callback after a successful policy
-proof; they are not included in errors or public records.
-
-`createPolicy` supports only explicit `plugin-preauthorized` authorization with
-`hostPermissions: not-integrated`. It intersects session, agent, Location,
-generation, capability, operation, and resource, and rejects malformed records
-without echoing input. Host-mediated authorization is intentionally unavailable.
-
-`BudgetLedger` performs atomic reservation-before-work accounting across source,
-index, payload, traversal, session/handle/call, and working-memory dimensions.
-Admission is denied at capacity and checked additions cannot exceed safe integers;
-reservations are idempotently released only by
-explicit disposal and no eviction or waiting queue exists. `ActivationStore` accepts
-an injected ledger, reserves session/handle/secret/index/working capacity before
-mutating its maps, bounds UUID collision retries, and disposes all reservations on
-teardown. Session handle quotas apply to handles explicitly enrolled to that session.
-Malformed budget records and requests are denied without propagating foreign errors.
-The ledger is activation-local and does not establish the process-wide quota
-arbiter required by the production profile.
-
-Evidence: `tests/unit/store-policy.test.ts` and `tests/unit/budgets.test.ts` are
-red before implementation and pass after implementation. These tests do not
-qualify OpenCode host hooks, process-wide quota sharing, or movement epochs.
-The Windows Job Object/real-host harness remains deferred per `docs/spec/plan.md`.
-
-The store now always uses a validated bounded ledger, including safe defaults when no
-ledger is supplied, and charges UTF-8 byte lengths for secret, index, and working
-reservations.

package/docs/history/18-pure-mvp-review.md

@@ -1,182 +0,0 @@
-# 18 — Adversarial review of pure MVP components
-
-Status: review only. No source changes were made. The focused pure tests pass
-(19/19), and `npm run typecheck` passes. The ACL/host harness was not run; this
-review makes no host or OpenCode qualification claim.
-
-## Findings
-
-### High — Store references do not implement the specified handle language
-
-`src/store/index.ts:7,50-57` accepts and generates arbitrary 64-hex strings.
-The design requires independently generated `secret-<UUIDv4>` references
-(`docs/spec/design.md:288-293, 316-322`). The current handles are therefore
-not compatible with the public grammar or its admission oracle, and the
-store's `isHandle` check admits values that are not valid MVP references.
-
-**Required fix:** generate lowercase CSPRNG UUIDv4 handles with the exact
-`secret-` prefix, validate that finite grammar (including version/variant), and
-make redaction-only and capability handles use the same versioned public
-language without deriving either from a secret.
-
-### High — Raw-secret callback authorization is forgeable and operation-free
-
-`src/store/index.ts:43-47` treats any structurally supplied
-`{ok: true, capability: ref}` as a valid proof. `AuthorizationProof` is an
-unbranded public interface (`src/policy/index.ts:7`), so a caller can forge it
-without invoking `createPolicy`. The store also accepts no operation/resource
-at the callback boundary; `_operation` is ignored after `grant`
-(`src/store/index.ts:36-40`). This violates the private resolver boundary and
-the requirement that policy, operation, resource, session, generation and
-Location all be intersected immediately before resolution
-(`docs/spec/design.md:162, 393`).
-
-**Required fix:** use a non-forgeable/internal policy decision or have the
-store perform the policy check itself with an issuer-owned opaque proof bound
-to the complete request (including operation and resource). Do not expose a
-plain object that is sufficient to release the raw value. Add tests that forge
-every proof field and that change operation/resource after authorization.
-
-### High — Sanitizer can recurse unboundedly on cyclic structured data
-
-`src/sanitize/index.ts:183-214` has node/depth limits only when callers supply
-them and has no visited-set. A cyclic plain object with the default budget
-recurses until a `RangeError`; the error is neither a fixed omission nor a
-bounded denial. This conflicts with the explicit cycle/inspectability and
-bounded traversal requirements (`docs/spec/design.md:339-340`; `plan.md:126-129`).
-
-**Required fix:** track object identity on the active traversal path (or reject
-all repeated identities), enforce finite default limits before descending, and
-convert all malformed/cyclic/foreign-object cases to `null` without exposing
-the thrown error or retaining partial output.
-
-### High — Dotenv lexical representation inventory misses actual parser spellings
-
-`src/sanitize/index.ts:53-55` returns dotenv content without the surrounding
-quotes, while `src/sources/dotenv.ts:17-23` records quoted lexical values with
-those quotes. It also omits the `\\t` spelling even though
-`src/sources/dotenv.ts:31-33` decodes it. Consequently a semantic value can
-remain in a supported dotenv lexical representation while the matcher scans
-only the semantic/content spelling. The stated requirement is to preserve and
-protect relevant lexical representations (`docs/spec/design.md:251-253, 314`).
-
-**Required fix:** define the grammar's exact lexical forms in one place and
-generate every accepted form, including quote delimiters, escaped quote,
-backslash, `n/r/t`, multiline spelling, and any accepted unquoted form. Add
-accepted-snapshot tests that assert each lexical byte sequence is absent.
-
-### High — Dotenv parser mishandles escaped quote grammar
-
-`src/sources/dotenv.ts:19-22` finds the first quote with `indexOf`, without
-recognizing escaped quotes. A valid value such as `KEY="a\\"b"` is closed at
-the escaped quote and is rejected or misparsed. This contradicts the claimed
-documented quoting support (`docs/spec/design.md:249-253`) and makes the
-parser's lexical contract inconsistent with its decoder.
-
-**Required fix:** scan quoted bodies with escape state, distinguish escaped
-quotes from terminators, and test escaped quote/backslash/control spellings
-under CRLF and multiline input. Reject unsupported escapes explicitly rather
-than silently changing their bytes.
-
-### Medium — Sanitizer construction is not fully bounded during allocation
-
-`src/sanitize/index.ts:142-158` checks output only after `output +=` has already
-constructed each fragment, and appends the final unsanitized suffix before the
-final budget check (`145-156`). `collectIntervals` also materializes every
-match without a node/match bound (`110-134`). This does not satisfy
-`outputBytes`-while-constructing and bounded matching requirements
-(`docs/spec/design.md:171-174, 329`).
-
-**Required fix:** reserve/count input, match storage and each output fragment
-before allocation; reject when a reservation would exceed the configured
-limit. Bound pattern count, match count and interval-cache/identity storage,
-and return only a complete validated result.
-
-### Medium — Admission depends on caller-supplied, incomplete pattern metadata
-
-`src/sanitize/index.ts:61-63,99-107` trusts `Pattern.representations` and does
-not derive or verify the complete representation set. A caller can pass only
-`text` and receive `ok: true` even when an omitted supported encoding is unsafe.
-The source/parser integration may intend to call `representationsFor`, but the
-pure admission API itself does not enforce the all-pattern contract.
-
-**Required fix:** admit a canonical secret value/source entry and derive the
-versioned representation set internally, or validate that supplied
-representations exactly match the inventory. Reject malformed/accessor pattern
-objects with fixed diagnostics.
-
-### Medium — Policy malformed inputs can throw instead of fixed denial
-
-`src/policy/index.ts:34-39` indexes `options.sessions[request.sessionId]` after
-only shallow record checks. A request with a key such as `toString` or
-`__proto__` can select an inherited non-array value and then throw when
-`.includes` is called, rather than returning `denied()`. Proxy/accessor inputs
-can likewise throw from `Object.getOwnPropertyDescriptors` or property access
-(`18-21,27-38`). The contract requires malformed inputs to fail closed with
-safe, fixed behavior.
-
-**Required fix:** normalize sessions into null-prototype maps during validated
-construction, validate request field types before lookup, use own-property
-checks, and catch/reject uninspectable objects without propagating foreign
-errors. Add prototype-key, proxy, accessor and cyclic tests.
-
-### Medium — Config accepts unsafe/semantically invalid resource and path forms
-
-`src/config/options.ts:67-70,80` rejects only slash traversal and a drive
-prefix. A rooted Windows path beginning with `\\`, NUL-containing paths, and
-`.`/`..` resource identifiers can pass. Resource identifiers also have no
-explicit 100-byte limit, while the operation contract requires rejecting
-`.`/`..`, ambiguous spellings and values over 100 bytes
-(`docs/spec/design.md:377`). Capabilities are not checked against an actual
-key in their source, so a typo can create an accepted but unusable grant.
-
-**Required fix:** validate canonical relative path syntax including NUL and
-Windows rooted/UNC forms, enforce the exact resource grammar and byte limits,
-reject `.`/`..`, and require every capability source/key pair to exist in the
-validated source schema or fail the whole configuration.
-
-### Medium — Budget ledger can lose atomic accounting at safe-integer overflow
-
-`src/budgets/index.ts:15-25` validates each reservation value but not
-`used + value`. Repeated reservations near `Number.MAX_SAFE_INTEGER` can lose
-precision, allowing counters to diverge from actual reservations. The ledger
-also remains activation-local; it cannot establish the process-wide quota
-required by `docs/spec/design.md:177`.
-
-**Required fix:** reject additions that exceed `Number.MAX_SAFE_INTEGER` (or
-use checked bigint accounting), and keep process-wide sharing/dedicated-service
-restriction as an explicit integration gate rather than implying this ledger
-proves aggregate quotas.
-
-## Sound choices
-
-- Configuration errors, source parse errors, policy denial, and budget denial
-  use fixed messages and do not intentionally echo input values
-  (`options.ts:19-23`, `dotenv.ts:3`, `policy.ts:16`, `budgets.ts:17`).
-- `checked` rejects non-plain objects, accessors and cycles before ordinary
-  option traversal (`src/config/options.ts:35-45`), and options reject unknown
-  fields and raised limits (`53-84`). This remains useful after proxy/error
-  hardening.
-- Dotenv parsing is non-executing, does not consult `process.env`, rejects
-  duplicate keys, and returns an immutable snapshot (`src/sources/dotenv.ts:9-29`).
-- Sanitization correctly computes transitive overlap unions, performs one
-  replacement, scans the final output, joins text sink parts before matching,
-  and emits one text part (`src/sanitize/index.ts:110-159,163-174`).
-- Plain projection rejects non-plain objects/accessors and independently
-  handles scalar JSON spellings rather than invoking `toJSON` or prototypes
-  (`src/sanitize/index.ts:176-214`). It still needs cycle and allocation fixes.
-- Store teardown clears maps and checks active state, session/agent enrollment,
-  generation and Location before callback invocation (`src/store/index.ts:43-49`).
-- Budget reservations are checked before commit and disposal is idempotent
-  (`src/budgets/index.ts:15-25`).
-
-## MVP disposition
-
-The pure tests are useful regression coverage but do not close the above
-findings. The handle-language, callback-proof, cycle, lexical-representation,
-and escaped-quote findings must be fixed before MVP-owned tools are built on
-these APIs. The policy/config hardening and checked accounting are also needed
-before treating malformed inputs or resource limits as fail-closed. These
-results are limited to pure code; source-opening ACLs, host hooks, publication
-ordering, aggregate quota ownership, and transport behavior remain unverified
-per `docs/spec/plan.md`.

package/docs/history/19-pure-mvp-re-review.md

@@ -1,142 +0,0 @@
-# 19 — Fresh adversarial re-review of pure MVP after R18
-
-Status: store/budget blockers remediated in the pure MVP; host qualification remains
-deferred. The ACL/source-opening harness, OpenCode, real transport, and host
-qualification were not run.
-
-## Verdict
-
-**Not ready for MVP-owned tools or an MVP qualification claim.** R18 resolves
-the previously reported handle grammar, authorization-proof binding, cycle and
-default traversal bounds, dotenv escaped-quote parsing, derived
-representation inventory, malformed policy/config handling, and safe-integer
-budget-overflow findings. The pure components remain useful, but the findings
-below are residual blockers, and the host/source gates remain entirely open.
-
-## R18 findings verified resolved
-
-- Store-generated and accepted references use lowercase `secret-<UUIDv4>` with
-  version and variant validation.
-- Policy proofs are issuer-held `WeakMap` capabilities and bind session,
-  agent, Location, generation, capability, operation, and resource. Forged
-  objects and changed operation/resource are rejected by the store boundary.
-- Structured projection has finite default depth/node limits and rejects active
-  cycles.
-- Dotenv quoted scanning is escape-aware; the focused tests cover escaped
-  quotes, backslashes, control escapes, CRLF, and multiline values.
-- Admission derives the finite representation inventory instead of trusting
-  caller-supplied `Pattern.representations`; UUID-language and reserved-output
-  conflicts reject the whole set.
-- Config checks relative paths, resource grammar/byte limits, declared source
-  keys, malformed proxy/cyclic/accessor inputs, and fixed safe errors.
-- Budget reservation checks `current + value` against the safe-integer range.
-
-## Residual findings
-
-### High — Sanitizer malformed inputs can escape as foreign exceptions
-
-`src/sanitize/index.ts` does not put all public pure entry points behind a
-fail-closed exception boundary. `projectPlain` calls `Object.getPrototypeOf`,
-`Object.keys`, and descriptors on untrusted objects; proxy traps can throw. The
-pattern path similarly calls `patternRepresentations` and `representationsFor`
-without validating/catching malformed patterns, accessors, or non-string
-`text`. `admitPatterns`, `sanitizeText`, and `projectPlain` can therefore
-propagate a caller-controlled error instead of returning the fixed denial/null
-required for malformed or uninspectable data.
-
-This was reproduced without source modification with proxies whose
-`getPrototypeOf`, `ownKeys`, or pattern property access throws. The exception
-message was observable (`x`).
-
-**Required gate:** validate immutable, plain pattern records and budgets at the
-boundary; catch all object/proxy/serialization failures and return the fixed
-admission failure or `null`. Add tests for throwing traps on every sanitizer
-entry point and ensure no error/cause is returned or logged.
-
-### High — Pure sanitizer allocation accounting is still incomplete
-
-`collectIntervalsBounded` bounds matches, but there is no bound on pattern count,
-pattern text/representation size, derived representation construction, or
-pattern metadata storage before those allocations occur. `admitPatterns` has no
-budget at all. `sanitizeText` does preflight fragment byte counts, but still
-constructs intermediate concatenations and repeatedly derives representations;
-the pure API does not reserve the configured working/index memory required by
-the design. A bounded input alone therefore does not establish bounded total
-allocation for adversarial pattern arrays.
-
-**Required gate:** impose explicit pattern/representation/index limits and
-reserve before construction, including temporary copies and interval identity
-storage; reject the complete operation before partial output. Test oversized
-pattern arrays, oversized pattern values, and representation-expansion limits.
-
-### Medium — Store handle/map growth and collision retry are unbounded
-
-**Remediated:** `ActivationStore` now accepts an activation-local `BudgetLedger`,
-reserves capacity before map mutation, enforces active-session and explicit
-per-session handle quotas, bounds UUID collision attempts, and releases all
-reservations on teardown. Deterministic collision exhaustion is fixed denial.
-
-`src/store/index.ts` has no handle/session/map quota and `newHandle()` retries
-forever on collisions. A supplied or failing deterministic random source can
-make registration hang, and repeated registration/grant calls can grow the
-activation maps without the configured `handlesPerSession`, `secretCount`, or
-working/index reservations. The R18 UUID formatting fix does not close the
-resource-accounting contract.
-
-**Required gate:** inject the budget ledger and enforce admission before map or
-handle allocation, with a finite collision-attempt bound and fixed denial.
-Cover per-session and activation exhaustion, collision exhaustion, teardown,
-and reservation release.
-
-### Medium — Budget ledger malformed-object paths are not fail-closed
-
-**Remediated:** limits and requests are descriptor-validated, symbol/unknown and
-accessor/proxy/cyclic shapes are rejected, and request failures return `{ ok: false }`.
-
-`src/budgets/index.ts` directly uses `Object.entries` and later property reads
-on caller-supplied limits/requests. Throwing proxies or accessors can escape
-from the constructor or `reserve` rather than producing the fixed invalid
-constructor error or `{ ok: false }`. Checked arithmetic is fixed, but malformed
-input handling is not equivalent to the hardened config/policy boundaries.
-
-**Required gate:** normalize/validate own data descriptors or catch foreign
-exceptions at both ledger boundaries; add proxy, accessor, symbol/unknown-field,
-and cyclic request tests with safe denial and no diagnostic echo.
-
-## Exact residual release gates
-
-The following are still open and are not closed by the 29 pure tests:
-
-1. **P0/R8 source gate:** opened-handle, canonical containment, symlink/reparse,
-   hard-link, ancestor replacement, filesystem identity, owner/ACL, and
-   tracked-file tests on each advertised OS/filesystem; no insecure fallback.
-2. **P0 quota/deployment gate:** prove shared process-wide accounting or adopt
-   the explicitly restricted supervised single-instance/Location envelope;
-   measure actual RSS under the process memory ceiling.
-3. **P1/P2 integration:** package/config loading through the pinned V2 runtime,
-   activation-closure ownership, source loading, immutable generations,
-   lifecycle cleanup, and source rotation semantics.
-4. **P3 residual pure gate:** the sanitizer malformed-input and allocation
-   findings above, plus independent property tests for all declared sink
-   representations and final-boundary validation.
-5. **P4/P5 host/tool gate:** native Effect entrypoint, enrollment and private
-   credential executor, fixed status-only HTTPS operation, DNS/address/peer
-   policy, cancellation/body withholding, and actual sink/network evidence.
-6. **P0/P5 active-only limitations:** readiness/unload/fallback rollback,
-   captured executors, late overlays, queued/resumed work, A→B→A moves,
-   sessionless generation, provider-hosted tools, WebSocket/SDK routes,
-   shell/progress/spill paths, and host permission deny/ask remain unverified or
-   expected gaps exactly as the specification says.
-7. **P6+ production gates:** independent mandatory readiness/revision control,
-   host-mediated authorization, final model-egress/publication gates, and
-   isolated broker/sandbox enforcement are absent; no enforced-profile claim is
-   permitted.
-
-## Evidence
-
-- `npm run typecheck` — pass.
-- `node --test tests/unit/config.test.ts tests/unit/dotenv.test.ts
-  tests/unit/sanitize.test.ts tests/unit/store-policy.test.ts
-  tests/unit/budgets.test.ts` — **29 passed, 0 failed**.
-- No source, ACL, OpenCode, smoke, integration, or host process was launched or
-  modified for this review.

package/docs/history/2-p0-runtime-prerequisites.md

@@ -1,163 +0,0 @@
-# P0-A: published runtime and startup-isolation research
-
-Research date: 2026-10-13. This is source research only; no OpenCode executable
-was run, and no shared service, user configuration, or credentials were accessed.
-The separately identified source checkout was inspected read-only.
-
-## Result
-
-**The published artifact/source pin is now established; runtime qualification
-remains unqualified.** The extracted Windows executables are real PE
-byte PE executable, not a stub: it has `MZ`/`PE` headers and contains compiled
-V2 CLI/server code, the `serve` command, `--standalone`, `OPENCODE_CONFIG_DIR`,
-the embedded version `2.0.28`, and the compiled source path logic described
-below. The npm package description is therefore not evidence that the binary
-cannot run. Registry metadata has no `gitHead`, but that is not required here:
-the official Git tag `v2.0.28` resolves through GitHub's ref API to commit
-`026b106bc5d41b679ffc413264229c340871e4d3`, and the tag source has the exact
-host/plugin/AI versions and Effect pin recorded below.
-
-The source snapshot does materially improve isolation. It exposes enough
-documented-by-source environment controls to construct a sterile launch, but
-those controls still require a real-host proof before use. The exact source
-commit and binary checksum remain recorded as candidate evidence, not as a
-qualification claim.
-
-## Published artifact evidence
-
-Registry metadata was queried from `https://registry.npmjs.org/` and package
-archives were downloaded only into an ACL-restricted directory under
-`C:\Users\jfomh\AppData\Local\Temp\opencode\p0-runtime-20261013`. The
-Windows archive was inspected, not executed.
-
-| Role | Published version | Evidence / integrity |
-|---|---:|---|
-| Host bootstrap `@opencode/cli` | 2.0.28 | tarball `https://registry.npmjs.org/@opencode/cli/-/cli-2.0.28.tgz`; SHA-256 `088D38127C529232164381213718F91652450BAF3F65CFD380A4E84FD1A79245`; npm integrity `sha512-nKStJJVG6to58gSPv5AuzNQZhYtou6b1jfI5EIckshWT9w8teesSLgP3gH/iSA/madUhvkNqsFjUFuD3NRne9Q==` |
-| Windows x64 host binary | 2.0.28 | `@opencode/cli-windows-x64`; tarball SHA-256 `A5A212125E497726A95D6F9C3CDCFE6F1FA35CA61F3F263E6575D557747FEAE2`; SHA-512 `D7FA7230C8BAD511EC44E3C96CB52C3BC53684850CC33350BD81FF5D4945E488315EF21577DA0D23C931999703EF6AED6B7B35EDDA0A00407E30A76C9E6785C5`; npm integrity `sha512-1/pyMMi61RHsROPJbLUsO8U2hIUMwzNQvY/XUlF5IgxXvIVd9oNI8kxmZcD72rta3s17doKAEB+MKdsnmeFxQ==` |
-| Windows ARM64 host binary | 2.0.28 | `@opencode/cli-windows-arm64`; tarball SHA-256 `5DD7944A1EE879E7D9794263D945386B706F404F3EEE885CB599E81ABC5E59EF`; executable member SHA-256 `65F0E7ACCC7D5FD77CA7380FDE87E3289D0CF27687851E5240BBDE6CAA7BDB66`; npm integrity `sha512-9HXcqjQa2ghY6tgqjRqaVCZfBuP10b55ffo2QdgHESzsItTwL0yKWaorzj91q96dqmQJ6MOvpl31PdhJnhuJ4g==` |
-| Plugin API | 2.0.28 | `@opencode/plugin`; npm shasum `2afadd0ef92eb7cbd7ecad515cadd9e39522d56b`; npm integrity `sha512-YqcpULwPXLX70ICm/EPeFacnWsYtBmaCwVgO67HCuyFDiBNnQtY8DMhHzBgUtAAI0djYLGPbwEHvHp0ZTyrnHw==` |
-| Host Effect runtime dependency | 4.0.1 required by plugin | `@opencode/plugin@2.0.28` declares exact dependency `effect: 4.0.1`; registry latest independently is 4.0.4, which must **not** replace the host copy without qualification. |
-| AI/provider runtime | 2.0.28 | `@opencode/ai@2.0.28`; plugin declares this exact host family. |
-| Candidate provider | 2.0.28 | `@opencode/ai/providers/openai-compatible`; V2 provider docs identify this package and its OpenAI-compatible HTTP protocol. The exact model/endpoint is still a fixture decision, not a qualified provider. |
-
-The platform archive contains `package/bin/opencode.exe` and its package JSON
-points to the OpenCode repository. Static inspection of the executable found
-the exact source-derived strings `nH="2.0.28"`, `ju="latest"`, the command
-descriptions, and minified implementations of `Global.layerWith`, XDG roots,
-`OPENCODE_CONFIG_DIR`, `OPENCODE_CONFIG_CONTENT`, and the standalone server.
-This establishes that the “bootstrap” label is stale for this archive. It does
-not establish a reproducible-build proof; the candidate relies on the official
-same-version tag association rather than claiming byte-for-byte source
-reproduction.
-
-Read-only source comparison:
-
-* The official Git ref `refs/tags/v2.0.28` resolves to
-  `026b106bc5d41b679ffc413264229c340871e4d3`. Tag source files report root,
-  `packages/cli`, `packages/plugin`, and `packages/ai` version `2.0.28`; the
-  root catalog pins `effect` and Effect platform packages to `4.0.1`.
-* The local checkout is the separate research snapshot
-  `e9def88a7790efc6abace15b67f3625ff4d66237`; it was useful for initial
-  inspection only and is not the release source pin.
-* The executable’s embedded version/channel strings and minified code match
-  those source files. This is a **candidate source mapping**, not a signed
-  build attestation. This source association meets the repository plan's
-  published-release/source-commit pin requirement. It does **not** claim a
-  reproducible-build equality between the tag and the npm archive; that is a
-  stronger supply-chain property and is outside this P0 pin gate.
-
-The V2 docs do establish the intended native interfaces: `@opencode/plugin/effect`
-with `Plugin.define({ id, effect })`, host-provided `@opencode/plugin` and
-`effect`, and externalized public Effect subpaths. They explicitly require
-testing against the installed package and compatible host release.
-
-## Official distribution path
-
-The official V2 landing page documents `npm install -g @opencode/cli` and
-direct Windows downloads from the update service, including
-`https://opencode.ai/update/api/latest/cli/opencode/opencode-windows-x64.zip`
-and its baseline variant. It explicitly says Windows package managers are not
-supported. The pinned source's updater constructs the same endpoint as
-`https://opencode.ai/update/api/{channel}/{artifact}/{distribution}`; its
-publish workflow builds platform binaries and signs Windows binaries. This
-confirms that `@opencode/cli@2.0.28` and the update-service binary are official
-V2 distribution paths, rather than an arbitrary guessed executable.
-
-The update endpoint does not publish a reproducible-build attestation in the
-metadata inspected. That does not defeat the source pin: the published npm
-version, official same-version Git tag, exact archive integrity, and private
-binary checksum are recorded as the candidate identity. Reproducibility is
-not asserted.
-
-## Verified isolation facts and implications
-
-Evidence: [V2 CLI](https://opencode.ai/v2/docs/cli), [commands](https://opencode.ai/v2/docs/cli/commands),
-[config](https://opencode.ai/v2/docs/config), and
-[troubleshooting](https://opencode.ai/v2/docs/troubleshooting).
-
-* The default client discovers/starts one per-user shared background service.
-  `--standalone` is the documented private-server mode; `--server URL` targets
-  an explicit server. `serve` starts a foreground API server.
-* Config is loaded from Windows `%ProgramData%\opencode`, the global config
-  root, and current directory through filesystem ancestors. Plugin/config
-  entries accumulate by precedence; ancestor config is not excluded by
-  choosing a private working directory.
-* Documented persistent locations include service registration
-  `~/.local/state/opencode/service.json`, service config
-  `~/.config/opencode/service.json`, database
-  `~/.local/share/opencode/opencode.db`, and logs
-  `~/.local/share/opencode/log/opencode.log`. `OPENCODE_DB` changes only the
-  database location.
-* Source inspection adds these exact controls for a sterile process:
-  `XDG_DATA_HOME`, `XDG_CACHE_HOME`, `XDG_CONFIG_HOME`, and `XDG_STATE_HOME`
-  root the four persistent OpenCode trees; `TEMP`/`TMP` control the native
-  temporary root; `ProgramData` controls Windows system-config discovery;
-  `OPENCODE_CONFIG_DIR` overrides the effective global config directory;
-  `OPENCODE_CONFIG_PROJECT_DISABLE=1` disables the ancestor/project walk;
-  `OPENCODE_CONFIG_CONTENT` supplies virtual config; and `OPENCODE_DB` or
-  `:memory:` selects the database. These names are source-verified in
-  `packages/util/src/global-roots.ts`, `packages/util/src/global.ts`,
-  `packages/core/src/config/discovery.ts`, `packages/cli/src/server-process.ts`,
-  and `packages/cli/src/database-path.ts` at the pinned commit. The harness
-  must set all of them in an allowlisted environment and use a fixture-owned
-  cwd; setting only `OPENCODE_CONFIG_DIR` is insufficient because system config
-  is otherwise still read.
-* `service set disabled true` disables the shared service but edits the user's
-  service configuration and stops the shared service. It is not an acceptable
-  harness isolation mechanism.
-* `snapshots: false` and `warming: false` are configuration controls, not
-  relocation or service-isolation controls.
-
-`--standalone` source starts a child `serve --stdio --port 0` with a random
-password and no service-registration path, so it is preferable to the shared
-service. Its child inherits the parent environment (`extendEnv: true`), making
-the allowlist mandatory. A foreground `serve` is also source-supported. The
-remaining isolation work is executable proof: verify all filesystem reads and
-network endpoints with synthetic markers, and verify no service discovery or
-shared process connection. Do not run the user's installed CLI or use
-`service` commands.
-
-## Required next evidence
-
-1. Treat the exact candidate pins in
-   [`../tests/smoke/runtime-candidate.json`](../../tests/smoke/runtime-candidate.json)
-   as the selected P0 artifact identity. Record additional platform archives
-   and exact protocol/model routes as they are selected; do not substitute an
-   unpinned channel artifact.
-2. In a fresh ACL-protected fixture, set the source-verified XDG/ProgramData/
-   config/project/database/temp controls and prove startup isolation before any plugin
-   or synthetic provider runs: no shared service connection, no inherited API
-   keys, no user/system/ancestor config, and all DB/state/cache/log/temp files
-   under owned paths. Probe using only synthetic values and safe path markers.
-3. Then run the repository's planned `P0-BOOT` identity check. Until those
-   proofs exist, `runtime-candidate.json` remains explicitly `unqualified` and
-    no host smoke/qualification result may be labeled passed.
-
-## Parent verification correction
-
-Direct `Get-FileHash -Algorithm SHA256` on the extracted `package/bin/opencode.exe`
-returned `9C59FCD39AA9C611AEDA04711BAB9D668CE3145FA5CDE9868F69C31ADCCFD3E3`.
-The original candidate accidentally used the **tarball** SHA-256 for the executable.
-`runtime-candidate.json` now distinguishes both hashes and records the archive
-member instead of a machine-specific executable path. A future runner must verify
-the extracted binary hash, not compare it against the compressed archive hash.