pi-oracle 0.7.20 → 0.7.22

package/scripts/oracle-cookie-import.test.mjs

@@ -0,0 +1,204 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { createCipheriv, createHash, pbkdf2Sync } from "node:crypto";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
+import test from "node:test";
+
+// Independent standard Chromium v24 SQLite/v11 fixture; the real auth worker
+// reads/decrypts/filters it and replays into a fake browser, never a real one.
+test("Linux auth imports native Chromium with its own key and preserves Chrome/Brave", {
+  skip: process.platform !== "linux", timeout: 90_000,
+}, async (t) => {
+  const { DatabaseSync } = await import("node:sqlite");
+  const { detectDefaultLinuxCookieProfileSource } = await import("../extensions/oracle/shared/browser-profile-helpers.mjs");
+  const root = await mkdtemp(join(tmpdir(), "oracle-cookie-import-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const home = join(root, "home");
+  const configHome = join(home, ".config");
+  const bin = join(root, "bin");
+  const helperLog = join(root, "helpers.jsonl");
+  const browserLog = join(root, "browser.jsonl");
+  await mkdir(bin, { recursive: true });
+  const guard = `
+    import { appendFileSync, mkdirSync } from 'node:fs';
+    import { basename } from 'node:path';
+    for (const [name, value] of Object.entries(process.env)) {
+      if (name.startsWith('SWEET_COOKIE_') && name.endsWith('_PASSWORD') && value) {
+        throw Error('safe-storage password leaked to subprocess');
+      }
+    }
+    const args = process.argv.slice(2);
+  `;
+  const helper = `#!${process.execPath}
+    ${guard}
+    const command = basename(process.argv[1]);
+    appendFileSync(process.env.HELPER_LOG, JSON.stringify({ command, args }) + '\\n');
+    const mode = process.env.FIXTURE_MODE;
+    if (mode === 'timeout') { process.on('SIGTERM', () => {}); setInterval(() => {}, 1000); }
+    else if (mode === 'failure') { console.error('fixture-key-do-not-log'); process.exit(1); }
+    else if (command === 'dbus-send') {
+      if (mode === 'wallet-fallback') process.exit(1);
+      console.log('"fixture-wallet"');
+    } else if (command === 'kwallet-query') {
+      if (mode === 'wallet-empty') console.log('failed to read password');
+      else if (args.join('|') === '--read-password|Chromium Safe Storage|--folder|Chromium Keys|' + (mode === 'wallet-fallback' ? 'kdewallet' : 'fixture-wallet')) console.log('fixture-chromium-key');
+      else process.exit(1);
+    } else {
+      if (mode === 'application' && args.includes('service')) process.exit(1);
+      const browser = args.includes('Chromium') || args.includes('chromium') ? 'chromium'
+        : args.includes('Brave') || args.includes('brave') ? 'brave' : 'chrome';
+      console.log('fixture-' + browser + '-key');
+    }
+  `;
+  for (const command of ["secret-tool", "kwallet-query", "dbus-send"]) {
+    await writeFile(join(bin, command), helper, { mode: 0o700 });
+  }
+  await writeFile(join(bin, "agent-browser"), `#!${process.execPath}
+    ${guard}
+    appendFileSync(process.env.BROWSER_LOG, JSON.stringify(args) + '\\n');
+    if (args.includes('--profile')) mkdirSync(args[args.indexOf('--profile') + 1], { recursive: true });
+    if (args.includes('status')) console.log(JSON.stringify({ data: { connected: true } }));
+    else if (args.includes('snapshot')) console.log('- textbox "Chat with ChatGPT" [ref=e1]\\n- button "Add files and more" [ref=e2]');
+    else if (args.includes('eval')) { process.stdin.resume(); process.stdin.on('end', () => console.log(JSON.stringify({ ok: true, status: 200, bodyHasId: true, bodyHasEmail: true }))); }
+    else if (args.includes('url')) console.log('https://chatgpt.com/');
+  `, { mode: 0o700 });
+
+  const cases = [
+    { browser: "google-chrome", password: "fixture-chrome-key" },
+    { browser: "BraveSoftware/Brave-Browser", password: "fixture-brave-key" },
+    { browser: "chromium", password: "fixture-chromium-key" },
+    { browser: "chromium", password: "fixture-chromium-key", auto: true },
+    { browser: "chromium", password: "fixture-chromium-key", relative: true },
+    { browser: "chromium", password: "fixture-chromium-key", braveAncestor: true },
+    { browser: "chromium", password: "fixture-override-key", braveAncestor: true, override: true },
+    { browser: "chromium", password: "fixture-chromium-key", db: true, network: true },
+    { browser: "chromium-browser", password: "fixture-chromium-key", mode: "application" },
+    { browser: "chromium-browser", password: "fixture-chromium-key", db: true },
+    ...["6", "5", ""].map((kde) => ({ browser: "chromium", password: "fixture-chromium-key", backend: "kwallet", kde })),
+    { browser: "chromium", password: "fixture-chromium-key", backend: "kwallet", mode: "wallet-fallback" },
+    { browser: "chromium", password: "", backend: "kwallet", mode: "failure" },
+    { browser: "chromium", password: "", backend: "kwallet", mode: "wallet-empty" },
+    { browser: "chromium", password: "peanuts", backend: "basic", prefix: "v10" },
+    { browser: "chromium", password: "", backend: "basic" },
+    { browser: "chromium", password: "fixture-override-key", override: true },
+    { browser: "chromium", password: "fixture-chromium-key", backend: "invalid", desktop: "GNOME:KDE", kde: "6" },
+    { browser: "chromium", password: "", mode: "failure" },
+    { browser: "chromium", password: "", mode: "timeout" },
+    { browser: "google-chrome", password: "fixture-chrome-key", profileName: true },
+    { browser: "chromium", password: "fixture-override-key", braveAncestor: true, override: true, relative: true },
+    { browser: "chromium", password: "fixture-override-key", braveAncestor: true, override: true, tilde: true },
+    { browser: "chromium", password: "fixture-override-key", override: true, db: true, dotSegment: true },
+  ];
+  for (const [index, c] of cases.entries()) {
+    // Keep the release artifact scanner strict: fixture password values stay in
+    // this file, out of captured platform-smoke stdout (case flags stay unique).
+    const { password: _fixturePassword, ...label } = c;
+    await t.test(JSON.stringify(label), async () => {
+      const sourceHome = c.tilde ? join(root, "BraveSoftware", "home") : home;
+      const sourceConfigHome = c.tilde ? join(sourceHome, ".config")
+        : c.braveAncestor ? join(root, "BraveSoftware", "config")
+        : c.auto ? join(root, "xdg-native") : configHome;
+      const profile = join(sourceConfigHome, c.browser, "Default");
+      const dbPath = join(profile, ...(c.network ? ["Network"] : []), "Cookies");
+      await mkdir(join(profile, ...(c.network ? ["Network"] : [])), { recursive: true });
+      if (c.dotSegment) await mkdir(join(sourceConfigHome, "BraveSoftware"), { recursive: true });
+      const cookiePath = c.dotSegment ? `${sourceConfigHome}/BraveSoftware/../${c.browser}/Default/Cookies` : dbPath;
+      await rm(join(profile, "Cookies"), { force: true });
+      const db = new DatabaseSync(dbPath);
+      try {
+        db.exec(`CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT);
+          INSERT INTO meta VALUES ('version', '24');
+          CREATE TABLE cookies (name TEXT, value TEXT, host_key TEXT, path TEXT,
+            expires_utc INTEGER, samesite INTEGER, encrypted_value BLOB,
+            is_secure INTEGER, is_httponly INTEGER);`);
+        const cipher = createCipheriv("aes-128-cbc", pbkdf2Sync(c.password, "saltysalt", 1, 16, "sha1"), Buffer.alloc(16, 32));
+        const plaintext = Buffer.concat([createHash("sha256").update(".chatgpt.com").digest(), Buffer.from("fixture-session-token")]);
+        const encrypted = Buffer.concat([Buffer.from(c.prefix ?? "v11"), cipher.update(plaintext), cipher.final()]);
+        db.prepare("INSERT INTO cookies VALUES (?, '', '.chatgpt.com', '/', 0, 1, ?, 1, 1)")
+          .run("__Secure-next-auth.session-token", encrypted);
+      } finally { db.close(); }
+      await writeFile(helperLog, "");
+      await writeFile(browserLog, "");
+      const config = {
+        defaults: { provider: "chatgpt", preset: "instant" },
+        browser: { authSeedProfileDir: join(root, `seed-${index}`), sessionPrefix: "fixture", chatUrl: "https://chatgpt.com/" },
+        auth: { chromeProfile: c.auto ? detectDefaultLinuxCookieProfileSource({ homeDir: sourceHome, env: { XDG_CONFIG_HOME: sourceConfigHome } })
+          : c.profileName ? "Default" : c.relative ? "./Default" : c.tilde ? `~/${relative(sourceHome, profile)}` : profile,
+          ...(c.db ? { chromeCookiePath: cookiePath } : {}), bootstrapTimeoutMs: 1000, pollMs: 1 },
+      };
+      const env = { HOME: sourceHome, XDG_CONFIG_HOME: sourceConfigHome, PATH: bin, TMPDIR: root,
+          AGENT_BROWSER_PATH: join(bin, "agent-browser"), PI_ORACLE_STATE_DIR: join(root, "state"),
+          SWEET_COOKIE_LINUX_KEYRING: c.backend ?? "gnome", KDE_SESSION_VERSION: c.kde ?? "",
+          XDG_CURRENT_DESKTOP: c.desktop ?? "",
+          ...(c.override ? { SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD: c.password } : {}),
+          FIXTURE_MODE: c.mode ?? "", HELPER_LOG: helperLog, BROWSER_LOG: browserLog };
+      const output = execFileSync(process.execPath, [new URL("../extensions/oracle/worker/auth-bootstrap.mjs", import.meta.url).pathname, JSON.stringify(config)], {
+        encoding: "utf8", timeout: 15_000, stdio: ["ignore", "pipe", "pipe"], env,
+        ...(c.relative || c.profileName ? { cwd: join(sourceConfigHome, "chromium") } : {}),
+      });
+      assert.match(output, /Oracle auth synced/);
+      const replay = (await readFile(browserLog, "utf8")).trim().split("\n").map((line) => JSON.parse(line));
+      assert(replay.some((args) => args.includes("__Secure-next-auth.session-token") && args.includes("fixture-session-token")), "production import must decrypt and replay the known cookie");
+      const calls = (await readFile(helperLog, "utf8")).trim();
+      if (c.override || c.backend === "basic") assert.equal(calls, "");
+      else if (c.browser.startsWith("chromium")) {
+        assert.doesNotMatch(calls, /Chrome Safe Storage|application","chrome"/);
+        if (c.mode === "application") assert.match(calls, /application","chromium/);
+        if (c.backend === "kwallet") {
+          assert.match(calls, new RegExp(`org.kde.kwalletd${c.kde ?? ""}`));
+          assert.match(calls, /Chromium Keys/);
+          assert.match(calls, ["wallet-fallback", "failure"].includes(c.mode) ? /kdewallet/ : /fixture-wallet/);
+        }
+      }
+      const diagnostics = output.match(/Diagnostics:\n([^\n]+)/)[1];
+      const log = await readFile(join(diagnostics, "oracle-auth.log"), "utf8");
+      assert.doesNotMatch(log + output, /fixture-(?:chromium|override)-key|fixture-key-do-not-log/);
+      if (["failure", "timeout"].includes(c.mode)) assert.match(log, /Failed to read Linux keyring via (secret-tool|kwallet-query)/);
+      if (index === 2 || (c.braveAncestor && !c.override)) {
+        // A prior successful Chrome read must not cache the wrong key. The
+        // adapter's legitimate API must restore env on success AND rejection.
+        execFileSync(process.execPath, ["--input-type=module", "-e", `
+          import assert from 'node:assert/strict';
+          import { getCookies } from '@steipete/sweet-cookie';
+          import { getCookiesFromNativeLinuxChromium } from './extensions/oracle/worker/linux-chromium-cookie-source.mjs';
+          const options = {url:'https://chatgpt.com/',browsers:['chrome'],mode:'merge',chromeProfile:process.argv[1]};
+          assert.equal((await getCookies({...options,chromeProfile:process.argv[2]})).cookies[0].value,'fixture-session-token');
+          process.env.SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD = ' ';
+          process.env.SWEET_COOKIE_BRAVE_SAFE_STORAGE_PASSWORD = 'fixture-unused-brave-password';
+          const previous = {...process.env};
+          assert.equal((await getCookiesFromNativeLinuxChromium(options, getCookies)).cookies[0].value,'fixture-session-token');
+          assert.deepEqual({...process.env},previous);
+          await assert.rejects(getCookiesFromNativeLinuxChromium({...options,origins:[null]}, getCookies),TypeError);
+          assert.deepEqual({...process.env},previous);
+          process.env.FIXTURE_MODE = 'failure';
+          const failureEnv = {...process.env};
+          const failedKeyring = await getCookiesFromNativeLinuxChromium(options, getCookies);
+          assert.deepEqual(failedKeyring.cookies,[]);
+          assert.match(failedKeyring.warnings.join('|'),/Failed to read Linux keyring via secret-tool/);
+          assert.deepEqual({...process.env},failureEnv);
+          await assert.rejects(getCookiesFromNativeLinuxChromium({...options,origins:[null]}, getCookies),TypeError);
+          assert.deepEqual({...process.env},failureEnv);
+          process.env.SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD = ' fixture-chromium-key ';
+          const calibratedEnv = {...process.env};
+          assert.equal((await getCookiesFromNativeLinuxChromium(options, getCookies)).cookies[0].value,'fixture-session-token');
+          assert.deepEqual({...process.env},calibratedEnv);
+          await assert.rejects(getCookiesFromNativeLinuxChromium({...options,origins:[null]}, getCookies),TypeError);
+          assert.deepEqual({...process.env},calibratedEnv);
+          delete process.env.SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD;
+          process.env.SWEET_COOKIE_BRAVE_SAFE_STORAGE_PASSWORD = 'fixture-chromium-key';
+          process.env.SWEET_COOKIE_LINUX_KEYRING = 'basic';
+          const basicEnv = {...process.env};
+          assert.deepEqual((await getCookiesFromNativeLinuxChromium(options, getCookies)).cookies,[]);
+          assert.deepEqual({...process.env},basicEnv);
+          await assert.rejects(getCookiesFromNativeLinuxChromium({...options,origins:[null]}, getCookies),TypeError);
+          assert.deepEqual({...process.env},basicEnv);
+        `, profile, join(configHome, "google-chrome", "Default")], {
+          cwd: new URL("../", import.meta.url), encoding: "utf8", timeout: 10_000, env,
+        });
+      }
+      await rm(join(profile, "Network"), { recursive: true, force: true });
+    });
+  }
+});

package/scripts/oracle-model.test.mjs

@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import vm from "node:vm";
+import test from "node:test";
+import * as ui from "../extensions/oracle/worker/chatgpt-ui-helpers.mjs";
+import { parseSnapshotEntries } from "../extensions/oracle/worker/artifact-heuristics.mjs";
+
+const worker = await readFile(new URL("../extensions/oracle/worker/run-job.mjs", import.meta.url), "utf8");
+const names = ["findEntry", "matchesModelConfigurationOpener", "canUseOpenModelMenuForSelection",
+  "openModelConfiguration", "configurePowerSlider", "configureModel", "waitForModelConfigurationToSettle", "toJsonScript"];
+const functions = names.flatMap((name) => {
+  const start = worker.indexOf(`function ${name}(`);
+  if (start < 0) return []; // Allows the same regression to run against the pre-slider worker.
+  const end = worker.indexOf("\n}", start) + 2;
+  return `${worker.slice(start - 6, start) === "async " ? "async " : ""}${worker.slice(start, end)}`;
+}).join("\n");
+
+function harness({ initial = 3, max = "4", wrongLabel = false, stuck = false, mountingReads = 0 } = {}) {
+  const labels = ["Instant", "Medium", "High", "Extra High", "Pro"];
+  let value = initial;
+  let open = false;
+  let verified = false;
+  const snapshot = () => open
+    ? '- button "Thinking effort" [expanded=true, ref=e1]\n- menu "Thinking effort" [ref=e2]\n- menuitem "Select model" [ref=e3]\n- menuitem "Power" [ref=e4]'
+    : `- button "${value === 4 ? "6 Pro" : labels[value]}" [expanded=false, ref=e1]\n- textbox "Ask ChatGPT" [ref=e5]\n- button "Add files and more" [ref=e6]`;
+  const control = {
+    closest: () => null,
+    getAttribute: () => "description",
+    querySelector: () => mountingReads-- > 0 ? null : ({ getAttribute: (name) => ({ "aria-valuemin": "0", "aria-valuemax": max, "aria-valuenow": String(value) })[name] }),
+  };
+  const context = vm.createContext({ ...ui, parseSnapshotEntries, Date, Error, JSON, Number,
+    CHATGPT_LABELS: { configure: "Configure..." },
+    MODEL_CONFIGURATION_OPEN_TIMEOUT_MS: 30, MODEL_CONFIGURATION_SETTLE_TIMEOUT_MS: 30,
+    MODEL_CONFIGURATION_CLOSE_RETRY_MS: 1, MODEL_CONFIGURATION_SETTLE_POLL_MS: 0,
+    isGrokJob: () => false, snapshotText: async () => snapshot(),
+    throwIfProviderTransientError: () => {}, dismissProFeedbackModal: async () => false,
+    clickRef: async () => { open = !open; }, sleep: async () => {},
+    composerControlsVisible: ui.snapshotHasUsableComposerControls,
+    log: async (line) => { if (line.startsWith("Verified ChatGPT Power tier")) verified = true; },
+    agentBrowser: async (_job, command, arg) => {
+      if (command === "focus") {
+        assert(open);
+        assert(mountingReads < 0, "wait for the Power slider to mount before focusing it");
+        return;
+      }
+      if (command !== "press") return;
+      if (arg === "Escape") open = false;
+      else if (!stuck) value = Math.max(0, Math.min(4, value + (arg === "ArrowRight" ? 1 : -1)));
+    },
+    evalPage: async (_job, script) => JSON.parse(vm.runInNewContext(script, { document: {
+      querySelector: () => open ? control : null,
+      getElementById: () => ({ textContent: `${wrongLabel ? "Unknown" : labels[value]}, ${value + 1} of 5.` }),
+    } })),
+  });
+  vm.runInContext(functions, context);
+  return { configure: (selection) => context.configureModel({ selection }),
+    get state() { return { value, open, verified }; } };
+}
+
+test("worker configures every preset through the current Power picker and closes it", async () => {
+  for (const [selection, expected] of [
+    [{ modelFamily: "instant", autoSwitchToThinking: false }, 0],
+    [{ modelFamily: "instant", autoSwitchToThinking: true }, 0],
+    [{ modelFamily: "thinking", effort: "light" }, 1],
+    [{ modelFamily: "thinking", effort: "standard" }, 1],
+    [{ modelFamily: "thinking", effort: "extended" }, 2],
+    [{ modelFamily: "thinking", effort: "heavy" }, 3],
+    [{ modelFamily: "pro", effort: "standard" }, 4],
+    [{ modelFamily: "pro", effort: "extended" }, 4],
+  ]) {
+    const h = harness({ initial: expected === 4 ? 0 : 4, mountingReads: 2 });
+    await h.configure(selection);
+    assert.deepEqual(h.state, { value: expected, open: false, verified: true });
+  }
+});
+
+test("worker refuses unknown, mislabelled, or unresponsive Power controls", async () => {
+  for (const [options, error] of [
+    [{ max: "5" }, /unrecognized range/],
+    [{ wrongLabel: true }, /Could not verify ChatGPT Power tier/],
+    [{ stuck: true }, /did not reach requested tier/],
+  ]) {
+    const h = harness(options);
+    await assert.rejects(h.configure({ modelFamily: "instant", autoSwitchToThinking: false }), error);
+    assert.equal(h.state.verified, false);
+  }
+});

package/scripts/oracle-real-smoke.mjs

@@ -11,7 +11,8 @@ import { basename, dirname, join, resolve } from "node:path";
 const DEFAULT_PROVIDER = "zai";
 const DEFAULT_MODEL = "glm-5.2";
 const DEFAULT_TIMEOUT_MS = 180_000;
-const EXPECTED_PI_VERSION = "0.80.9";
+const EXPECTED_PI_VERSION = process.env.PI_COMPAT_EXPECTED_VERSION
+  ?? JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).devDependencies["@earendil-works/pi-coding-agent"];
 const PACKAGE_NAME = "pi-oracle";
 
 function usage() {
@@ -22,6 +23,8 @@ Modes:
   source  Inner-loop/debug only. Loads this checkout with pi --no-extensions -e extensions/oracle/index.ts.
 
 Environment:
+  PI_HOST_CLI                  selected Pi manifest bin entry, invoked with this Node executable (default: pi on PATH)
+  PI_COMPAT_EXPECTED_VERSION   expected Pi version (default: package development baseline)
   PI_ORACLE_REAL_TEST_PROVIDER   pi provider for the test agent (default: ${DEFAULT_PROVIDER})
   PI_ORACLE_REAL_TEST_MODEL      pi model for the test agent (default: ${DEFAULT_MODEL})
   PI_ORACLE_REAL_TEST_TIMEOUT_MS per-agent timeout in ms (default: ${DEFAULT_TIMEOUT_MS})
@@ -65,7 +68,10 @@ function positiveTimeoutMs(value, label) {
 
 function commandExists(command, args = ["--version"]) {
   return new Promise((resolvePromise) => {
-    const child = spawn(command, args, { stdio: "ignore", shell: process.platform === "win32" });
+    const selectedCli = command === piCommand() && env("PI_HOST_CLI");
+    const child = spawn(selectedCli ? process.execPath : command, selectedCli ? [selectedCli, ...args] : args, {
+      stdio: "ignore", shell: !selectedCli && process.platform === "win32",
+    });
     child.on("error", () => resolvePromise(false));
     child.on("exit", (code) => resolvePromise(code === 0 || code === 1));
   });
@@ -104,7 +110,7 @@ async function doctor() {
   const failures = [];
   const warnings = [];
   const requiredCommands = [
-    [process.platform === "win32" ? "pi.cmd" : "pi", ["--version"], "pi CLI"],
+    [piCommand(), ["--version"], "pi CLI"],
     [process.platform === "win32" ? "tar.exe" : "tar", ["--version"], "tar"],
     ["zstd", ["--version"], "zstd"],
     [process.platform === "win32" ? "agent-browser.cmd" : "agent-browser", ["--version"], "agent-browser"],
@@ -134,10 +140,11 @@ async function doctor() {
 function runCommand(command, args, options) {
   const timeoutMs = positiveTimeoutMs(options.timeoutMs, "command timeout");
   return new Promise((resolvePromise) => {
-    const child = spawn(command, args, {
+    const selectedCli = command === piCommand() && env("PI_HOST_CLI");
+    const child = spawn(selectedCli ? process.execPath : command, selectedCli ? [selectedCli, ...args] : args, {
       cwd: options.cwd,
       env: options.env,
-      shell: process.platform === "win32",
+      shell: !selectedCli && process.platform === "win32",
       stdio: ["ignore", "pipe", "pipe"],
     });
     let stdout = "";
@@ -234,7 +241,7 @@ function entryExists(entries, path) {
 }
 
 function piCommand() {
-  return process.platform === "win32" ? "pi.cmd" : "pi";
+  return env("PI_HOST_CLI") ?? (process.platform === "win32" ? "pi.cmd" : "pi");
 }
 
 function npmCommand() {
@@ -280,6 +287,11 @@ async function preparePackedProject({ runDir, provider, model, timeoutMs }) {
   writeFileSync(join(piProject, ".artifacts", "ignored", "artifact.txt"), "ignore me\n");
   mkdirSync(join(piProject, ".crabbox", "ignored"), { recursive: true });
   writeFileSync(join(piProject, ".crabbox", "ignored", "capture.txt"), "ignore me\n");
+  mkdirSync(join(piProject, ".pi"), { recursive: true });
+  writeFileSync(join(piProject, ".pi", "workspace-notes.txt"), "ignore me\n");
+  mkdirSync(join(piProject, ".oracle-context"), { recursive: true });
+  writeFileSync(join(piProject, ".oracle-context", "context.md"), "ignore me\n");
+  writeFileSync(join(piProject, ".scratchpad.md"), "ignore me\n");
 
   return { mode: "packed", cwd: piProject, installDir, provider, model, extensionPath: `./node_modules/${PACKAGE_NAME}` };
 }
@@ -362,11 +374,6 @@ async function run(mode = "packed") {
   const piVersion = await mustRun(runDir, "pi-version", piCommand(), ["--version"], { cwd: process.cwd(), env: process.env, timeoutMs: 30_000 });
   if (piVersion.stdout.trim() !== EXPECTED_PI_VERSION) throw new Error(`real smoke requires Pi ${EXPECTED_PI_VERSION}; found ${piVersion.stdout.trim() || "unknown"}`);
   const tmpRoot = mkdtempSync(join(tmpdir(), "pi-oracle-real-smoke-"));
-  const prepared = mode === "packed"
-    ? await preparePackedProject({ runDir, provider, model, timeoutMs })
-    : prepareSourceProject({ provider, model });
-  console.log(`Oracle real smoke mode=${prepared.mode} extension=${prepared.extensionPath}`);
-  writeFileSync(join(runDir, "run.json"), `${JSON.stringify({ runId, mode: prepared.mode, provider, model, extensionPath: prepared.extensionPath, timeoutMs, startedAt: new Date().toISOString() }, null, 2)}\n`);
 
   function assert(id, condition, message) {
     assertions.push({ id, ok: Boolean(condition), ...(condition ? {} : { error: message }) });
@@ -374,6 +381,12 @@ async function run(mode = "packed") {
   }
 
   try {
+    const prepared = mode === "packed"
+      ? await preparePackedProject({ runDir, provider, model, timeoutMs })
+      : prepareSourceProject({ provider, model });
+    console.log(`Oracle real smoke mode=${prepared.mode} extension=${prepared.extensionPath}`);
+    writeFileSync(join(runDir, "run.json"), `${JSON.stringify({ runId, mode: prepared.mode, provider, model, extensionPath: prepared.extensionPath, timeoutMs, startedAt: new Date().toISOString() }, null, 2)}\n`);
+
     const test1 = join(runDir, "whole-repo-submit");
     const agent1 = join(runDir, "agent1");
     const sessions1 = join(runDir, "sessions1");
@@ -416,7 +429,7 @@ async function run(mode = "packed") {
       const entries = await tarList(archivePath);
       writeFileSync(join(test1, "archive-list.txt"), `${entries.join("\n")}\n`);
       assert("archive-includes-readme", entryExists(entries, "README.md"), "archive should include README.md");
-      for (const excluded of [".pi", ".oracle-context", ".scratchpad.md", ".artifacts", ".crabbox", ".debug"]) {
+      for (const excluded of [".pi", ".oracle-context", ".scratchpad.md", ".artifacts", ".crabbox"]) {
         assert(`archive-excludes-${excluded.replace(/[^a-z0-9]+/gi, "-")}`, !entryExists(entries, excluded), `archive should exclude ${excluded}`);
       }
     } else {
@@ -459,7 +472,11 @@ async function run(mode = "packed") {
       const jobDir2 = latestJobDir(jobs2);
       writeFileSync(join(test2, "job-dir.txt"), `${jobDir2 ?? ""}\n`);
       const symlinkOutput = `${symlinkResult.stdout}\n${symlinkResult.stderr}`;
-      assert("symlink-rejected", /resolve inside|symlink|outside|escape|must be inside/i.test(symlinkOutput), "symlink escape test output did not show the expected rejection");
+      assert(
+        "symlink-rejected",
+        symlinkOutput.includes("archive_input_symlink_escape") || symlinkOutput.includes("Archive input must resolve inside the project cwd without symlink escapes"),
+        "symlink escape test output did not show the actual oracle_submit rejection evidence",
+      );
       assert("symlink-no-job-created", !jobDir2, "symlink escape rejection should not create an oracle job");
     }
 

package/scripts/platform-smoke/Dockerfile.ubuntu

@@ -1,8 +1,9 @@
-FROM cimg/node:24.16
+FROM cimg/node:24.21
 
 USER root
 RUN apt-get update \
   && apt-get install -y --no-install-recommends zstd rsync \
   && rm -rf /var/lib/apt/lists/*
-RUN npm install -g agent-browser@0.29.1
+RUN npm install -g npm@11.21.0 \
+  && npm install -g agent-browser@0.29.1
 USER circleci

package/scripts/platform-smoke/crabbox-runner.mjs

@@ -14,8 +14,7 @@ export function execCrabbox(args, opts = {}) {
   return new Promise((resolve) => {
     const child = spawn(CRABBOX_BIN, args, {
       stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, CRABBOX_SYNC_GIT_SEED: "false", ...opts.env },
-      ...opts.spawnOpts,
+      env: { ...process.env, CRABBOX_SYNC_GIT_SEED: "false" },
     });
     const stdoutChunks = [];
     const stderrChunks = [];
@@ -122,10 +121,9 @@ export async function runOnLease(config, targetName, leaseId, command, opts = {}
   for (const name of opts.allowEnvNames ?? []) args.push("--allow-env", name);
   if (opts.sync === false) args.push("--no-sync");
   else args.push("--fresh-sync");
-  if (opts.shell) args.push("--shell", command);
-  else args.push("--", ...(Array.isArray(command) ? command : command.split(" ")));
+  args.push("--shell", command);
   console.log(`  [crabbox] run ${targetName} ${opts.sync === false ? "--no-sync" : "--fresh-sync"} ...`);
-  return execCrabbox(args, { timeout: opts.timeout ?? 900_000, env: opts.env });
+  return execCrabbox(args, { timeout: opts.timeout ?? 900_000 });
 }
 
 export async function stopLease(config, targetName, leaseId) {

package/scripts/platform-smoke/doctor.mjs

@@ -3,6 +3,7 @@
 import { execFileSync, execSync } from "node:child_process";
 import { accessSync, constants, existsSync, mkdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { buildTargetBaseArgs } from "./crabbox-runner.mjs";
 
 let failures = 0;
 
@@ -63,24 +64,6 @@ function parseJson(text) {
   try { return JSON.parse(text); } catch { return undefined; }
 }
 
-function targetBaseArgs(targetName, config) {
-  if (targetName === "macos") {
-    const host = env("PI_ORACLE_SMOKE_MAC_HOST") || env("PLATFORM_SMOKE_MAC_HOST") || "localhost";
-    const user = env("PI_ORACLE_SMOKE_MAC_USER") || env("PLATFORM_SMOKE_MAC_USER") || env("USER");
-    const workRoot = env("PI_ORACLE_SMOKE_MAC_WORK_ROOT") || env("PLATFORM_SMOKE_MAC_WORK_ROOT") || `/Users/${env("USER")}/crabbox/${config.packageName}`;
-    return ["--provider", "ssh", "--target", "macos", "--static-host", host, "--static-user", user, "--static-port", "22", "--static-work-root", workRoot];
-  }
-  if (targetName === "ubuntu") {
-    const image = env("PI_ORACLE_SMOKE_UBUNTU_IMAGE") || env("PLATFORM_SMOKE_UBUNTU_IMAGE") || config.ubuntuContainerImage || "pi-oracle-platform-smoke:node24";
-    return ["--provider", "local-container", "--target", "linux", "--local-container-image", image];
-  }
-  const vm = windowsVmName(config);
-  const snapshot = windowsSnapshotName(config);
-  const user = env("PI_ORACLE_SMOKE_WINDOWS_USER") || env("PLATFORM_SMOKE_WINDOWS_USER") || env("USER");
-  const workRoot = env("PI_ORACLE_SMOKE_WINDOWS_NATIVE_WORK_ROOT") || env("PLATFORM_SMOKE_WINDOWS_WORK_ROOT") || `C:\\crabbox\\${config.packageName}`;
-  return ["--provider", "parallels", "--target", "windows", "--windows-mode", "normal", "--parallels-source", vm, "--parallels-source-snapshot", snapshot, "--parallels-user", user, "--parallels-work-root", workRoot];
-}
-
 function runCrabboxDoctor(cbox, label, args, timeout = 120_000) {
   const output = silent(cbox, ["doctor", ...args, "--json"], { env: { ...process.env, CRABBOX_SYNC_GIT_SEED: "false" }, timeout });
   if (!output) {
@@ -100,7 +83,7 @@ function runTargetToolProbe(cbox, targetName, config) {
   const command = targetName === "windows-native"
     ? `cmd.exe /c "where node && where npm && where git && where tar && where zstd && where agent-browser && zstd --version && agent-browser --version && echo tools-ok"`
     : `missing=""; for tool in ${required.join(" ")}; do command -v "$tool" >/dev/null 2>&1 || missing="$missing $tool"; done; if [ -n "$missing" ]; then echo "missing=$missing"; exit 1; fi; zstd --version >/dev/null && agent-browser --version >/dev/null && echo tools-ok`;
-  const baseArgs = targetBaseArgs(targetName, config);
+  const baseArgs = buildTargetBaseArgs(targetName, config);
   if (targetName === "macos") baseArgs.push("--reclaim");
   const result = silent(cbox, ["run", ...baseArgs, "--no-sync", "--shell", command], {
     env: { ...process.env, CRABBOX_SYNC_GIT_SEED: "false" },
@@ -137,11 +120,13 @@ function verifyPackageExclusions() {
   const forbiddenPatterns = [/^\.env(?:\.|$)/, /^\.artifacts(?:\/|$)/, /^\.crabbox(?:\/|$)/, /^\.debug(?:\/|$)/, /^\.platform-smoke-runs(?:\/|$)/, /\.tgz$/];
   const output = shell("npm pack --dry-run --json", { timeout: 120_000 });
   const parsed = parseJson(output);
-  if (!Array.isArray(parsed) || !parsed[0]?.files) {
+  // npm 11 returns an array; npm 12 keys the same records by package name.
+  const [pack] = parsed && typeof parsed === "object" ? Object.values(parsed) : [];
+  if (!pack?.files) {
     warn("could not inspect npm pack file list");
     return;
   }
-  const files = parsed[0].files.map((file) => file.path);
+  const files = pack.files.map((file) => file.path);
   const forbidden = files.filter((file) => forbiddenPatterns.some((pattern) => pattern.test(file)));
   forbidden.length ? fail(`forbidden files in package: ${forbidden.join(", ")}`) : ok("package excludes local env/artifact/debug state");
 }
@@ -184,9 +169,9 @@ export async function runDoctor(config) {
   for (const provider of ["ssh", "local-container", "parallels"]) {
     new RegExp(`^${provider}$`, "m").test(providers) ? ok(`provider available: ${provider}`) : fail(`crabbox providers missing ${provider}`);
   }
-  runCrabboxDoctor(cbox, "macOS static SSH", targetBaseArgs("macos", config), 120_000);
-  runCrabboxDoctor(cbox, "Windows native Parallels", targetBaseArgs("windows-native", config), 180_000);
-  runCrabboxDoctor(cbox, "local-container", targetBaseArgs("ubuntu", config), 120_000);
+  runCrabboxDoctor(cbox, "macOS static SSH", buildTargetBaseArgs("macos", config), 120_000);
+  runCrabboxDoctor(cbox, "Windows native Parallels", buildTargetBaseArgs("windows-native", config), 180_000);
+  runCrabboxDoctor(cbox, "local-container", buildTargetBaseArgs("ubuntu", config), 120_000);
 
   console.log("\n── Host tools ──");
   for (const [name, command] of [["Docker", "docker info --format '{{.ServerVersion}}'"], ["Node", "node --version"], ["npm", "npm --version"], ["git", "git --version"], ["tar", "tar --version"], ["rsync", "rsync --version"]]) {