orynacode-ai 1.16.2

package/test/git/git.test.ts

@@ -0,0 +1,178 @@
+import { $ } from "bun"
+import { describe, expect } from "bun:test"
+import fs from "fs/promises"
+import path from "path"
+import { Effect } from "effect"
+import { Git } from "../../src/git"
+import { tmpdir } from "../fixture/fixture"
+import { testEffect } from "../lib/effect"
+
+const weird = process.platform === "win32" ? "space file.txt" : "tab\tfile.txt"
+const it = testEffect(Git.defaultLayer)
+
+const scopedTmpdir = (options?: Parameters<typeof tmpdir>[0]) =>
+  Effect.acquireRelease(
+    Effect.promise(() => tmpdir(options)),
+    (tmp) => Effect.promise(() => tmp[Symbol.asyncDispose]()),
+  )
+
+describe("Git", () => {
+  it.live("branch() returns current branch name", () =>
+    Effect.gen(function* () {
+      const tmp = yield* scopedTmpdir({ git: true })
+      const git = yield* Git.Service
+      const branch = yield* git.branch(tmp.path)
+      expect(branch).toBeDefined()
+      expect(typeof branch).toBe("string")
+    }),
+  )
+
+  it.live("branch() returns undefined for non-git directories", () =>
+    Effect.gen(function* () {
+      const tmp = yield* scopedTmpdir()
+      const git = yield* Git.Service
+      const branch = yield* git.branch(tmp.path)
+      expect(branch).toBeUndefined()
+    }),
+  )
+
+  it.live("branch() returns undefined for detached HEAD", () =>
+    Effect.gen(function* () {
+      const tmp = yield* scopedTmpdir({ git: true })
+      const hash = (yield* Effect.promise(() => $`git rev-parse HEAD`.cwd(tmp.path).quiet().text())).trim()
+      yield* Effect.promise(() => $`git checkout --detach ${hash}`.cwd(tmp.path).quiet())
+      const git = yield* Git.Service
+      const branch = yield* git.branch(tmp.path)
+      expect(branch).toBeUndefined()
+    }),
+  )
+
+  it.live("defaultBranch() uses init.defaultBranch when available", () =>
+    Effect.gen(function* () {
+      const tmp = yield* scopedTmpdir({ git: true })
+      yield* Effect.promise(() => $`git branch -M trunk`.cwd(tmp.path).quiet())
+      yield* Effect.promise(() => $`git config init.defaultBranch trunk`.cwd(tmp.path).quiet())
+      const git = yield* Git.Service
+      const branch = yield* git.defaultBranch(tmp.path)
+      expect(branch?.name).toBe("trunk")
+      expect(branch?.ref).toBe("trunk")
+    }),
+  )
+
+  it.live("status() handles special filenames", () =>
+    Effect.gen(function* () {
+      const tmp = yield* scopedTmpdir({ git: true })
+      yield* Effect.promise(() => fs.writeFile(path.join(tmp.path, weird), "hello\n", "utf-8"))
+      const git = yield* Git.Service
+      const status = yield* git.status(tmp.path)
+      expect(status).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            file: weird,
+            status: "added",
+          }),
+        ]),
+      )
+    }),
+  )
+
+  it.live("diff(), stats(), and mergeBase() parse tracked changes", () =>
+    Effect.gen(function* () {
+      const tmp = yield* scopedTmpdir({ git: true })
+      yield* Effect.promise(() => $`git branch -M main`.cwd(tmp.path).quiet())
+      yield* Effect.promise(() => fs.writeFile(path.join(tmp.path, weird), "before\n", "utf-8"))
+      yield* Effect.promise(() => $`git add .`.cwd(tmp.path).quiet())
+      yield* Effect.promise(() => $`git commit --no-gpg-sign -m "add file"`.cwd(tmp.path).quiet())
+      yield* Effect.promise(() => $`git checkout -b feature/test`.cwd(tmp.path).quiet())
+      yield* Effect.promise(() => fs.writeFile(path.join(tmp.path, weird), "after\n", "utf-8"))
+
+      const git = yield* Git.Service
+      const [base, diff, stats] = yield* Effect.all([
+        git.mergeBase(tmp.path, "main"),
+        git.diff(tmp.path, "HEAD"),
+        git.stats(tmp.path, "HEAD"),
+      ])
+
+      expect(base).toBeTruthy()
+      expect(diff).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            file: weird,
+            status: "modified",
+          }),
+        ]),
+      )
+      expect(stats).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            file: weird,
+            additions: 1,
+            deletions: 1,
+          }),
+        ]),
+      )
+    }),
+  )
+
+  it.live("patch() returns capped native patch output", () =>
+    Effect.gen(function* () {
+      const tmp = yield* scopedTmpdir({ git: true })
+      yield* Effect.promise(() => fs.writeFile(path.join(tmp.path, weird), "before\n", "utf-8"))
+      yield* Effect.promise(() => fs.writeFile(path.join(tmp.path, "other.txt"), "old\n", "utf-8"))
+      yield* Effect.promise(() => $`git add .`.cwd(tmp.path).quiet())
+      yield* Effect.promise(() => $`git commit --no-gpg-sign -m "add file"`.cwd(tmp.path).quiet())
+      yield* Effect.promise(() => fs.writeFile(path.join(tmp.path, weird), "after\n", "utf-8"))
+      yield* Effect.promise(() => fs.writeFile(path.join(tmp.path, "other.txt"), "new\n", "utf-8"))
+
+      const git = yield* Git.Service
+      const [patch, all, capped] = yield* Effect.all([
+        git.patch(tmp.path, "HEAD", weird, { context: 2_147_483_647 }),
+        git.patchAll(tmp.path, "HEAD", { context: 2_147_483_647 }),
+        git.patch(tmp.path, "HEAD", weird, { maxOutputBytes: 1 }),
+      ])
+
+      expect(patch.truncated).toBe(false)
+      expect(patch.text).toContain("diff --git")
+      expect(patch.text).toContain("-before")
+      expect(patch.text).toContain("+after")
+      expect(all.truncated).toBe(false)
+      expect(all.text).toContain("diff --git")
+      expect(all.text).toContain("other.txt")
+      expect(all.text).toContain("+new")
+      expect(capped.truncated).toBe(true)
+      expect(capped.text).toBe("")
+    }),
+  )
+
+  it.live("patchUntracked() and statUntracked() handle added files", () =>
+    Effect.gen(function* () {
+      const tmp = yield* scopedTmpdir({ git: true })
+      yield* Effect.promise(() => fs.writeFile(path.join(tmp.path, weird), "one\ntwo\n", "utf-8"))
+
+      const git = yield* Git.Service
+      const [patch, stat] = yield* Effect.all([
+        git.patchUntracked(tmp.path, weird, { context: 2_147_483_647 }),
+        git.statUntracked(tmp.path, weird),
+      ])
+
+      expect(patch.truncated).toBe(false)
+      expect(patch.text).toContain("diff --git")
+      expect(patch.text).toContain("+one")
+      expect(patch.text).toContain("+two")
+      expect(stat).toEqual(expect.objectContaining({ file: weird, additions: 2, deletions: 0 }))
+    }),
+  )
+
+  it.live("show() returns empty text for binary blobs", () =>
+    Effect.gen(function* () {
+      const tmp = yield* scopedTmpdir({ git: true })
+      yield* Effect.promise(() => fs.writeFile(path.join(tmp.path, "bin.dat"), new Uint8Array([0, 1, 2, 3])))
+      yield* Effect.promise(() => $`git add .`.cwd(tmp.path).quiet())
+      yield* Effect.promise(() => $`git commit --no-gpg-sign -m "add binary"`.cwd(tmp.path).quiet())
+
+      const git = yield* Git.Service
+      const text = yield* git.show(tmp.path, "HEAD", "bin.dat")
+      expect(text).toBe("")
+    }),
+  )
+})

package/test/ide/ide.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, test, afterEach } from "bun:test"
+import { Ide } from "../../src/ide"
+
+describe("ide", () => {
+  const original = { ...process.env }
+
+  afterEach(() => {
+    Object.keys(process.env).forEach((key) => {
+      delete process.env[key]
+    })
+    Object.assign(process.env, original)
+  })
+
+  test("should detect Visual Studio Code", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] = "/path/to/Visual Studio Code.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("Visual Studio Code")
+  })
+
+  test("should detect Visual Studio Code Insiders", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] =
+      "/Applications/Visual Studio Code - Insiders.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("Visual Studio Code - Insiders")
+  })
+
+  test("should detect Cursor", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] = "/path/to/Cursor.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("Cursor")
+  })
+
+  test("should detect VSCodium", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] = "/path/to/VSCodium.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("VSCodium")
+  })
+
+  test("should detect Windsurf", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] = "/path/to/Windsurf.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("Windsurf")
+  })
+
+  test("should return unknown when TERM_PROGRAM is not vscode", () => {
+    process.env["TERM_PROGRAM"] = "iTerm2"
+    process.env["GIT_ASKPASS"] =
+      "/Applications/Visual Studio Code - Insiders.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("unknown")
+  })
+
+  test("should return unknown when GIT_ASKPASS does not contain IDE name", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] = "/path/to/unknown/askpass.sh"
+
+    expect(Ide.ide()).toBe("unknown")
+  })
+
+  test("should recognize vscode-insiders OPENCODE_CALLER", () => {
+    process.env["OPENCODE_CALLER"] = "vscode-insiders"
+
+    expect(Ide.alreadyInstalled()).toBe(true)
+  })
+
+  test("should recognize vscode OPENCODE_CALLER", () => {
+    process.env["OPENCODE_CALLER"] = "vscode"
+
+    expect(Ide.alreadyInstalled()).toBe(true)
+  })
+
+  test("should return false for unknown OPENCODE_CALLER", () => {
+    process.env["OPENCODE_CALLER"] = "unknown"
+
+    expect(Ide.alreadyInstalled()).toBe(false)
+  })
+})

package/test/image/image.test.ts

@@ -0,0 +1,123 @@
+import { describe, expect } from "bun:test"
+import { Cause, Effect, Exit, Layer } from "effect"
+import { Image } from "@/image/image"
+import { MessageID, PartID, SessionID } from "@/session/schema"
+import path from "node:path"
+import { TestConfig } from "../fixture/config"
+import { testEffect } from "../lib/effect"
+
+const it = testEffect(Layer.mergeAll(Image.layer.pipe(Layer.provide(TestConfig.layer()))))
+const tiny = testEffect(
+  Layer.mergeAll(
+    Image.layer.pipe(
+      Layer.provide(
+        TestConfig.layer({ get: () => Effect.succeed({ attachment: { image: { max_base64_bytes: 1 } } }) }),
+      ),
+    ),
+  ),
+)
+
+function part(mime: string, data: string) {
+  return {
+    id: PartID.ascending(),
+    messageID: MessageID.ascending(),
+    sessionID: SessionID.make("ses_test"),
+    type: "file" as const,
+    mime,
+    url: `data:${mime};base64,${data}`,
+  }
+}
+
+describe("Image", () => {
+  it.effect("normalizes generated png and jpeg attachments", () =>
+    Effect.gen(function* () {
+      const photon = yield* Effect.promise(() => import("@silvia-odwyer/photon-node"))
+      const source = new photon.PhotonImage(
+        new Uint8Array(Array.from({ length: 64 * 64 * 4 }, (_, index) => (index % 4 === 3 ? 255 : index % 251))),
+        64,
+        64,
+      )
+      const image = yield* Image.Service
+      const results = yield* Effect.all([
+        image.normalize(part("image/png", Buffer.from(source.get_bytes()).toString("base64"))),
+        image.normalize(part("image/jpeg", Buffer.from(source.get_bytes_jpeg(90)).toString("base64"))),
+      ])
+
+      source.free()
+      expect(results.map((result) => result.url.startsWith(`data:${result.mime};base64,`))).toEqual([true, true])
+      expect(results.every((result) => result.mime === "image/png" || result.mime === "image/jpeg")).toBe(true)
+    }),
+  )
+
+  it.effect("accepts webp attachments that are already within limits", () =>
+    Effect.gen(function* () {
+      const image = yield* Image.Service
+      const input = part("image/webp", "UklGRiIAAABXRUJQVlA4IBYAAAAwAQCdASoBAAEADsD+JaQAA3AAAAAA")
+
+      expect(yield* image.normalize(input)).toEqual(input)
+    }),
+  )
+
+  it.effect("resizes images that fit the byte limit but exceed dimension limits", () =>
+    Effect.gen(function* () {
+      const photon = yield* Effect.promise(() => import("@silvia-odwyer/photon-node"))
+      const source = new photon.PhotonImage(new Uint8Array(Array.from({ length: 9_000 * 4 }, () => 255)), 9_000, 1)
+      const image = yield* Image.Service
+      const result = yield* image.normalize(part("image/png", Buffer.from(source.get_bytes()).toString("base64")))
+      const resized = photon.PhotonImage.new_from_byteslice(
+        Buffer.from(result.url.slice(result.url.indexOf(";base64,") + ";base64,".length), "base64"),
+      )
+
+      source.free()
+      expect(resized.get_width()).toBeLessThanOrEqual(2_000)
+      expect(resized.get_height()).toBeLessThanOrEqual(2_000)
+      resized.free()
+    }),
+  )
+
+  it.effect("resizes the 5MB base64 picture fixture", () =>
+    Effect.gen(function* () {
+      const photon = yield* Effect.promise(() => import("@silvia-odwyer/photon-node"))
+      const data = Buffer.from(
+        yield* Effect.promise(() =>
+          Bun.file(path.join(import.meta.dir, "fixtures", "picture-5mb-base64.png")).arrayBuffer(),
+        ),
+      )
+      const input = part("image/png", data.toString("base64"))
+      const image = yield* Image.Service
+      const result = yield* image.normalize(input)
+      const base64 = result.url.slice(result.url.indexOf(";base64,") + ";base64,".length)
+      const resized = photon.PhotonImage.new_from_byteslice(Buffer.from(base64, "base64"))
+
+      expect(input.url.slice(input.url.indexOf(";base64,") + ";base64,".length).length).toBe(5 * 1024 * 1024)
+      expect(result.url).not.toBe(input.url)
+      expect(base64.length).toBeLessThan(5 * 1024 * 1024)
+      expect(resized.get_width()).toBeLessThanOrEqual(2_000)
+      expect(resized.get_height()).toBeLessThanOrEqual(2_000)
+      resized.free()
+    }),
+  )
+
+  tiny.effect("fails with a typed size error when no resized candidate fits", () =>
+    Effect.gen(function* () {
+      const photon = yield* Effect.promise(() => import("@silvia-odwyer/photon-node"))
+      const source = new photon.PhotonImage(new Uint8Array(Array.from({ length: 4 }, () => 255)), 1, 1)
+      const image = yield* Image.Service
+      const exit = yield* image
+        .normalize(part("image/png", Buffer.from(source.get_bytes()).toString("base64")))
+        .pipe(Effect.exit)
+
+      source.free()
+      expect(Exit.isFailure(exit)).toBe(true)
+      if (Exit.isFailure(exit)) {
+        const error = Cause.squash(exit.cause)
+        expect(error).toBeInstanceOf(Image.SizeError)
+        if (error instanceof Image.SizeError) {
+          expect(error.width).toBe(1)
+          expect(error.height).toBe(1)
+          expect(error.max).toBe(1)
+        }
+      }
+    }),
+  )
+})

package/test/installation/installation.test.ts

@@ -0,0 +1,230 @@
+import { describe, expect } from "bun:test"
+import { Effect, Layer, Stream } from "effect"
+import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http"
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process"
+import { Installation } from "../../src/installation"
+import { InstallationChannel } from "@opencode-ai/core/installation/version"
+import { AppProcess } from "@opencode-ai/core/process"
+import { testEffect } from "../lib/effect"
+
+const encoder = new TextEncoder()
+
+function mockHttpClient(handler: (request: HttpClientRequest.HttpClientRequest) => Response) {
+  const client = HttpClient.make((request) => Effect.succeed(HttpClientResponse.fromWeb(request, handler(request))))
+  return Layer.succeed(HttpClient.HttpClient, client)
+}
+
+function mockSpawner(
+  handler: (cmd: string, args: readonly string[]) => string | { code: number; stdout?: string; stderr?: string } = () =>
+    "",
+) {
+  const spawner = ChildProcessSpawner.make((command) => {
+    const std = ChildProcess.isStandardCommand(command) ? command : undefined
+    const result = handler(std?.command ?? "", std?.args ?? [])
+    const output = typeof result === "string" ? { code: 0, stdout: result, stderr: "" } : result
+    return Effect.succeed(
+      ChildProcessSpawner.makeHandle({
+        pid: ChildProcessSpawner.ProcessId(0),
+        exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(output.code)),
+        isRunning: Effect.succeed(false),
+        kill: () => Effect.void,
+        stdin: { [Symbol.for("effect/Sink/TypeId")]: Symbol.for("effect/Sink/TypeId") } as any,
+        stdout: output.stdout ? Stream.make(encoder.encode(output.stdout)) : Stream.empty,
+        stderr: output.stderr ? Stream.make(encoder.encode(output.stderr)) : Stream.empty,
+        all: Stream.empty,
+        getInputFd: () => ({ [Symbol.for("effect/Sink/TypeId")]: Symbol.for("effect/Sink/TypeId") }) as any,
+        getOutputFd: () => Stream.empty,
+        unref: Effect.succeed(Effect.void),
+      }),
+    )
+  })
+  return Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, spawner)
+}
+
+function jsonResponse(body: unknown) {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  })
+}
+
+function testLayer(
+  httpHandler: (request: HttpClientRequest.HttpClientRequest) => Response,
+  spawnHandler?: (cmd: string, args: readonly string[]) => string | { code: number; stdout?: string; stderr?: string },
+) {
+  const appProcess = AppProcess.layer.pipe(Layer.provide(mockSpawner(spawnHandler)))
+  return Installation.layer.pipe(Layer.provide(mockHttpClient(httpHandler)), Layer.provide(appProcess))
+}
+
+describe("installation", () => {
+  describe("latest", () => {
+    testEffect(testLayer(() => jsonResponse({ tag_name: "v1.2.3" }))).effect(
+      "reads release version from GitHub releases",
+      () =>
+        Effect.gen(function* () {
+          const result = yield* Installation.use.latest("unknown")
+          expect(result).toBe("1.2.3")
+        }),
+    )
+
+    testEffect(testLayer(() => jsonResponse({ tag_name: "v4.0.0-beta.1" }))).effect(
+      "strips v prefix from GitHub release tag",
+      () =>
+        Effect.gen(function* () {
+          const result = yield* Installation.use.latest("curl")
+          expect(result).toBe("4.0.0-beta.1")
+        }),
+    )
+
+    const npmCalls: string[] = []
+    testEffect(
+      testLayer((request) => {
+        npmCalls.push(request.url)
+        return jsonResponse({ version: "1.5.0" })
+      }),
+    ).effect("reads npm versions via registry", () =>
+      Effect.gen(function* () {
+        const result = yield* Installation.use.latest("npm")
+        expect(result).toBe("1.5.0")
+        expect(npmCalls).toContain(`https://registry.npmjs.org/opencode-ai/${InstallationChannel}`)
+      }),
+    )
+
+    const bunCalls: string[] = []
+    testEffect(
+      testLayer((request) => {
+        bunCalls.push(request.url)
+        return jsonResponse({ version: "1.6.0" })
+      }),
+    ).effect("reads bun versions via registry", () =>
+      Effect.gen(function* () {
+        const result = yield* Installation.use.latest("bun")
+        expect(result).toBe("1.6.0")
+        expect(bunCalls).toContain(`https://registry.npmjs.org/opencode-ai/${InstallationChannel}`)
+      }),
+    )
+
+    const pnpmCalls: string[] = []
+    testEffect(
+      testLayer((request) => {
+        pnpmCalls.push(request.url)
+        return jsonResponse({ version: "1.7.0" })
+      }),
+    ).effect("reads pnpm versions via registry", () =>
+      Effect.gen(function* () {
+        const result = yield* Installation.use.latest("pnpm")
+        expect(result).toBe("1.7.0")
+        expect(pnpmCalls).toContain(`https://registry.npmjs.org/opencode-ai/${InstallationChannel}`)
+      }),
+    )
+
+    testEffect(testLayer(() => jsonResponse({ version: "2.3.4" }))).effect("reads scoop manifest versions", () =>
+      Effect.gen(function* () {
+        const result = yield* Installation.use.latest("scoop")
+        expect(result).toBe("2.3.4")
+      }),
+    )
+
+    testEffect(testLayer(() => jsonResponse({ d: { results: [{ Version: "3.4.5" }] } }))).effect(
+      "reads chocolatey feed versions",
+      () =>
+        Effect.gen(function* () {
+          const result = yield* Installation.use.latest("choco")
+          expect(result).toBe("3.4.5")
+        }),
+    )
+
+    testEffect(
+      testLayer(
+        () => jsonResponse({ versions: { stable: "2.0.0" } }),
+        (cmd, args) => {
+          // getBrewFormula: return core formula (no tap)
+          if (cmd === "brew" && args.includes("--formula") && args.includes("anomalyco/tap/opencode")) return ""
+          if (cmd === "brew" && args.includes("--formula") && args.includes("opencode")) return "opencode"
+          return ""
+        },
+      ),
+    ).effect("reads brew formulae API versions", () =>
+      Effect.gen(function* () {
+        const result = yield* Installation.use.latest("brew")
+        expect(result).toBe("2.0.0")
+      }),
+    )
+
+    const brewInfoJson = JSON.stringify({
+      formulae: [{ versions: { stable: "2.1.0" } }],
+    })
+    testEffect(
+      testLayer(
+        () => jsonResponse({}), // HTTP not used for tap formula
+        (cmd, args) => {
+          if (cmd === "brew" && args.includes("anomalyco/tap/opencode") && args.includes("--formula")) return "opencode"
+          if (cmd === "brew" && args.includes("--json=v2")) return brewInfoJson
+          return ""
+        },
+      ),
+    ).effect("reads brew tap info JSON via CLI", () =>
+      Effect.gen(function* () {
+        const result = yield* Installation.use.latest("brew")
+        expect(result).toBe("2.1.0")
+      }),
+    )
+  })
+
+  describe("upgrade", () => {
+    testEffect(
+      testLayer(
+        () => jsonResponse({}),
+        (cmd) => {
+          if (cmd === "npm") return { code: 1, stderr: "token=secret command output" }
+          return ""
+        },
+      ),
+    ).effect("returns sanitized typed errors for failed package upgrades", () =>
+      Effect.gen(function* () {
+        const error = yield* Effect.flip(Installation.use.upgrade("npm", "9.9.9"))
+        expect(error).toBeInstanceOf(Installation.UpgradeFailedError)
+        expect(error.stderr).toBe("Upgrade failed for npm (exit code 1).")
+        expect(error.message).toBe(error.stderr)
+        expect(error.stderr).not.toContain("secret")
+        expect(error.stderr).not.toContain("command output")
+      }),
+    )
+
+    testEffect(
+      testLayer(
+        () => new Response("install script with token=secret", { status: 200 }),
+        (cmd, args) => {
+          if (cmd === "bash" && args[0] === "--version") return "GNU bash"
+          if (cmd === "bash" || cmd === "sh") return { code: 1, stderr: "script output with token=secret" }
+          return ""
+        },
+      ),
+    ).effect("returns sanitized typed errors when the curl install script fails", () =>
+      Effect.gen(function* () {
+        const error = yield* Effect.flip(Installation.use.upgrade("curl", "9.9.9"))
+        expect(error).toBeInstanceOf(Installation.UpgradeFailedError)
+        expect(error.stderr).toBe("Upgrade failed for curl (exit code 1).")
+        expect(error.message).toBe(error.stderr)
+        expect(error.stderr).not.toContain("secret")
+        expect(error.stderr).not.toContain("script output")
+      }),
+    )
+
+    testEffect(
+      testLayer(
+        () => new Response("install script", { status: 200 }),
+        (cmd, args) => {
+          if (cmd === "bash" && args[0] === "--version") return { code: 1, stderr: "missing" }
+          if (cmd === "bash") return { code: 1, stderr: "should not execute installer with bash" }
+          if (cmd === "sh") return "ok"
+          return ""
+        },
+      ),
+    ).effect("falls back to sh when bash is unavailable during curl upgrade", () =>
+      Effect.gen(function* () {
+        yield* Installation.use.upgrade("curl", "9.9.9")
+      }),
+    )
+  })
+})