pi-oracle 0.7.21 → 0.7.23

package/scripts/oracle-cookie-import.test.mjs

@@ -0,0 +1,204 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { createCipheriv, createHash, pbkdf2Sync } from "node:crypto";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
+import test from "node:test";
+
+// Independent standard Chromium v24 SQLite/v11 fixture; the real auth worker
+// reads/decrypts/filters it and replays into a fake browser, never a real one.
+test("Linux auth imports native Chromium with its own key and preserves Chrome/Brave", {
+  skip: process.platform !== "linux", timeout: 90_000,
+}, async (t) => {
+  const { DatabaseSync } = await import("node:sqlite");
+  const { detectDefaultLinuxCookieProfileSource } = await import("../extensions/oracle/shared/browser-profile-helpers.mjs");
+  const root = await mkdtemp(join(tmpdir(), "oracle-cookie-import-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const home = join(root, "home");
+  const configHome = join(home, ".config");
+  const bin = join(root, "bin");
+  const helperLog = join(root, "helpers.jsonl");
+  const browserLog = join(root, "browser.jsonl");
+  await mkdir(bin, { recursive: true });
+  const guard = `
+    import { appendFileSync, mkdirSync } from 'node:fs';
+    import { basename } from 'node:path';
+    for (const [name, value] of Object.entries(process.env)) {
+      if (name.startsWith('SWEET_COOKIE_') && name.endsWith('_PASSWORD') && value) {
+        throw Error('safe-storage password leaked to subprocess');
+      }
+    }
+    const args = process.argv.slice(2);
+  `;
+  const helper = `#!${process.execPath}
+    ${guard}
+    const command = basename(process.argv[1]);
+    appendFileSync(process.env.HELPER_LOG, JSON.stringify({ command, args }) + '\\n');
+    const mode = process.env.FIXTURE_MODE;
+    if (mode === 'timeout') { process.on('SIGTERM', () => {}); setInterval(() => {}, 1000); }
+    else if (mode === 'failure') { console.error('fixture-key-do-not-log'); process.exit(1); }
+    else if (command === 'dbus-send') {
+      if (mode === 'wallet-fallback') process.exit(1);
+      console.log('"fixture-wallet"');
+    } else if (command === 'kwallet-query') {
+      if (mode === 'wallet-empty') console.log('failed to read password');
+      else if (args.join('|') === '--read-password|Chromium Safe Storage|--folder|Chromium Keys|' + (mode === 'wallet-fallback' ? 'kdewallet' : 'fixture-wallet')) console.log('fixture-chromium-key');
+      else process.exit(1);
+    } else {
+      if (mode === 'application' && args.includes('service')) process.exit(1);
+      const browser = args.includes('Chromium') || args.includes('chromium') ? 'chromium'
+        : args.includes('Brave') || args.includes('brave') ? 'brave' : 'chrome';
+      console.log('fixture-' + browser + '-key');
+    }
+  `;
+  for (const command of ["secret-tool", "kwallet-query", "dbus-send"]) {
+    await writeFile(join(bin, command), helper, { mode: 0o700 });
+  }
+  await writeFile(join(bin, "agent-browser"), `#!${process.execPath}
+    ${guard}
+    appendFileSync(process.env.BROWSER_LOG, JSON.stringify(args) + '\\n');
+    if (args.includes('--profile')) mkdirSync(args[args.indexOf('--profile') + 1], { recursive: true });
+    if (args.includes('status')) console.log(JSON.stringify({ data: { connected: true } }));
+    else if (args.includes('snapshot')) console.log('- textbox "Chat with ChatGPT" [ref=e1]\\n- button "Add files and more" [ref=e2]');
+    else if (args.includes('eval')) { process.stdin.resume(); process.stdin.on('end', () => console.log(JSON.stringify({ ok: true, status: 200, bodyHasId: true, bodyHasEmail: true }))); }
+    else if (args.includes('url')) console.log('https://chatgpt.com/');
+  `, { mode: 0o700 });
+
+  const cases = [
+    { browser: "google-chrome", password: "fixture-chrome-key" },
+    { browser: "BraveSoftware/Brave-Browser", password: "fixture-brave-key" },
+    { browser: "chromium", password: "fixture-chromium-key" },
+    { browser: "chromium", password: "fixture-chromium-key", auto: true },
+    { browser: "chromium", password: "fixture-chromium-key", relative: true },
+    { browser: "chromium", password: "fixture-chromium-key", braveAncestor: true },
+    { browser: "chromium", password: "fixture-override-key", braveAncestor: true, override: true },
+    { browser: "chromium", password: "fixture-chromium-key", db: true, network: true },
+    { browser: "chromium-browser", password: "fixture-chromium-key", mode: "application" },
+    { browser: "chromium-browser", password: "fixture-chromium-key", db: true },
+    ...["6", "5", ""].map((kde) => ({ browser: "chromium", password: "fixture-chromium-key", backend: "kwallet", kde })),
+    { browser: "chromium", password: "fixture-chromium-key", backend: "kwallet", mode: "wallet-fallback" },
+    { browser: "chromium", password: "", backend: "kwallet", mode: "failure" },
+    { browser: "chromium", password: "", backend: "kwallet", mode: "wallet-empty" },
+    { browser: "chromium", password: "peanuts", backend: "basic", prefix: "v10" },
+    { browser: "chromium", password: "", backend: "basic" },
+    { browser: "chromium", password: "fixture-override-key", override: true },
+    { browser: "chromium", password: "fixture-chromium-key", backend: "invalid", desktop: "GNOME:KDE", kde: "6" },
+    { browser: "chromium", password: "", mode: "failure" },
+    { browser: "chromium", password: "", mode: "timeout" },
+    { browser: "google-chrome", password: "fixture-chrome-key", profileName: true },
+    { browser: "chromium", password: "fixture-override-key", braveAncestor: true, override: true, relative: true },
+    { browser: "chromium", password: "fixture-override-key", braveAncestor: true, override: true, tilde: true },
+    { browser: "chromium", password: "fixture-override-key", override: true, db: true, dotSegment: true },
+  ];
+  for (const [index, c] of cases.entries()) {
+    // Keep the release artifact scanner strict: fixture password values stay in
+    // this file, out of captured platform-smoke stdout (case flags stay unique).
+    const { password: _fixturePassword, ...label } = c;
+    await t.test(JSON.stringify(label), async () => {
+      const sourceHome = c.tilde ? join(root, "BraveSoftware", "home") : home;
+      const sourceConfigHome = c.tilde ? join(sourceHome, ".config")
+        : c.braveAncestor ? join(root, "BraveSoftware", "config")
+        : c.auto ? join(root, "xdg-native") : configHome;
+      const profile = join(sourceConfigHome, c.browser, "Default");
+      const dbPath = join(profile, ...(c.network ? ["Network"] : []), "Cookies");
+      await mkdir(join(profile, ...(c.network ? ["Network"] : [])), { recursive: true });
+      if (c.dotSegment) await mkdir(join(sourceConfigHome, "BraveSoftware"), { recursive: true });
+      const cookiePath = c.dotSegment ? `${sourceConfigHome}/BraveSoftware/../${c.browser}/Default/Cookies` : dbPath;
+      await rm(join(profile, "Cookies"), { force: true });
+      const db = new DatabaseSync(dbPath);
+      try {
+        db.exec(`CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT);
+          INSERT INTO meta VALUES ('version', '24');
+          CREATE TABLE cookies (name TEXT, value TEXT, host_key TEXT, path TEXT,
+            expires_utc INTEGER, samesite INTEGER, encrypted_value BLOB,
+            is_secure INTEGER, is_httponly INTEGER);`);
+        const cipher = createCipheriv("aes-128-cbc", pbkdf2Sync(c.password, "saltysalt", 1, 16, "sha1"), Buffer.alloc(16, 32));
+        const plaintext = Buffer.concat([createHash("sha256").update(".chatgpt.com").digest(), Buffer.from("fixture-session-token")]);
+        const encrypted = Buffer.concat([Buffer.from(c.prefix ?? "v11"), cipher.update(plaintext), cipher.final()]);
+        db.prepare("INSERT INTO cookies VALUES (?, '', '.chatgpt.com', '/', 0, 1, ?, 1, 1)")
+          .run("__Secure-next-auth.session-token", encrypted);
+      } finally { db.close(); }
+      await writeFile(helperLog, "");
+      await writeFile(browserLog, "");
+      const config = {
+        defaults: { provider: "chatgpt", preset: "instant" },
+        browser: { authSeedProfileDir: join(root, `seed-${index}`), sessionPrefix: "fixture", chatUrl: "https://chatgpt.com/" },
+        auth: { chromeProfile: c.auto ? detectDefaultLinuxCookieProfileSource({ homeDir: sourceHome, env: { XDG_CONFIG_HOME: sourceConfigHome } })
+          : c.profileName ? "Default" : c.relative ? "./Default" : c.tilde ? `~/${relative(sourceHome, profile)}` : profile,
+          ...(c.db ? { chromeCookiePath: cookiePath } : {}), bootstrapTimeoutMs: 1000, pollMs: 1 },
+      };
+      const env = { HOME: sourceHome, XDG_CONFIG_HOME: sourceConfigHome, PATH: bin, TMPDIR: root,
+          AGENT_BROWSER_PATH: join(bin, "agent-browser"), PI_ORACLE_STATE_DIR: join(root, "state"),
+          SWEET_COOKIE_LINUX_KEYRING: c.backend ?? "gnome", KDE_SESSION_VERSION: c.kde ?? "",
+          XDG_CURRENT_DESKTOP: c.desktop ?? "",
+          ...(c.override ? { SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD: c.password } : {}),
+          FIXTURE_MODE: c.mode ?? "", HELPER_LOG: helperLog, BROWSER_LOG: browserLog };
+      const output = execFileSync(process.execPath, [new URL("../extensions/oracle/worker/auth-bootstrap.mjs", import.meta.url).pathname, JSON.stringify(config)], {
+        encoding: "utf8", timeout: 15_000, stdio: ["ignore", "pipe", "pipe"], env,
+        ...(c.relative || c.profileName ? { cwd: join(sourceConfigHome, "chromium") } : {}),
+      });
+      assert.match(output, /Oracle auth synced/);
+      const replay = (await readFile(browserLog, "utf8")).trim().split("\n").map((line) => JSON.parse(line));
+      assert(replay.some((args) => args.includes("__Secure-next-auth.session-token") && args.includes("fixture-session-token")), "production import must decrypt and replay the known cookie");
+      const calls = (await readFile(helperLog, "utf8")).trim();
+      if (c.override || c.backend === "basic") assert.equal(calls, "");
+      else if (c.browser.startsWith("chromium")) {
+        assert.doesNotMatch(calls, /Chrome Safe Storage|application","chrome"/);
+        if (c.mode === "application") assert.match(calls, /application","chromium/);
+        if (c.backend === "kwallet") {
+          assert.match(calls, new RegExp(`org.kde.kwalletd${c.kde ?? ""}`));
+          assert.match(calls, /Chromium Keys/);
+          assert.match(calls, ["wallet-fallback", "failure"].includes(c.mode) ? /kdewallet/ : /fixture-wallet/);
+        }
+      }
+      const diagnostics = output.match(/Diagnostics:\n([^\n]+)/)[1];
+      const log = await readFile(join(diagnostics, "oracle-auth.log"), "utf8");
+      assert.doesNotMatch(log + output, /fixture-(?:chromium|override)-key|fixture-key-do-not-log/);
+      if (["failure", "timeout"].includes(c.mode)) assert.match(log, /Failed to read Linux keyring via (secret-tool|kwallet-query)/);
+      if (index === 2 || (c.braveAncestor && !c.override)) {
+        // A prior successful Chrome read must not cache the wrong key. The
+        // adapter's legitimate API must restore env on success AND rejection.
+        execFileSync(process.execPath, ["--input-type=module", "-e", `
+          import assert from 'node:assert/strict';
+          import { getCookies } from '@steipete/sweet-cookie';
+          import { getCookiesFromNativeLinuxChromium } from './extensions/oracle/worker/linux-chromium-cookie-source.mjs';
+          const options = {url:'https://chatgpt.com/',browsers:['chrome'],mode:'merge',chromeProfile:process.argv[1]};
+          assert.equal((await getCookies({...options,chromeProfile:process.argv[2]})).cookies[0].value,'fixture-session-token');
+          process.env.SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD = ' ';
+          process.env.SWEET_COOKIE_BRAVE_SAFE_STORAGE_PASSWORD = 'fixture-unused-brave-password';
+          const previous = {...process.env};
+          assert.equal((await getCookiesFromNativeLinuxChromium(options, getCookies)).cookies[0].value,'fixture-session-token');
+          assert.deepEqual({...process.env},previous);
+          await assert.rejects(getCookiesFromNativeLinuxChromium({...options,origins:[null]}, getCookies),TypeError);
+          assert.deepEqual({...process.env},previous);
+          process.env.FIXTURE_MODE = 'failure';
+          const failureEnv = {...process.env};
+          const failedKeyring = await getCookiesFromNativeLinuxChromium(options, getCookies);
+          assert.deepEqual(failedKeyring.cookies,[]);
+          assert.match(failedKeyring.warnings.join('|'),/Failed to read Linux keyring via secret-tool/);
+          assert.deepEqual({...process.env},failureEnv);
+          await assert.rejects(getCookiesFromNativeLinuxChromium({...options,origins:[null]}, getCookies),TypeError);
+          assert.deepEqual({...process.env},failureEnv);
+          process.env.SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD = ' fixture-chromium-key ';
+          const calibratedEnv = {...process.env};
+          assert.equal((await getCookiesFromNativeLinuxChromium(options, getCookies)).cookies[0].value,'fixture-session-token');
+          assert.deepEqual({...process.env},calibratedEnv);
+          await assert.rejects(getCookiesFromNativeLinuxChromium({...options,origins:[null]}, getCookies),TypeError);
+          assert.deepEqual({...process.env},calibratedEnv);
+          delete process.env.SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD;
+          process.env.SWEET_COOKIE_BRAVE_SAFE_STORAGE_PASSWORD = 'fixture-chromium-key';
+          process.env.SWEET_COOKIE_LINUX_KEYRING = 'basic';
+          const basicEnv = {...process.env};
+          assert.deepEqual((await getCookiesFromNativeLinuxChromium(options, getCookies)).cookies,[]);
+          assert.deepEqual({...process.env},basicEnv);
+          await assert.rejects(getCookiesFromNativeLinuxChromium({...options,origins:[null]}, getCookies),TypeError);
+          assert.deepEqual({...process.env},basicEnv);
+        `, profile, join(configHome, "google-chrome", "Default")], {
+          cwd: new URL("../", import.meta.url), encoding: "utf8", timeout: 10_000, env,
+        });
+      }
+      await rm(join(profile, "Network"), { recursive: true, force: true });
+    });
+  }
+});

package/scripts/oracle-model.test.mjs

@@ -15,20 +15,21 @@ const functions = names.flatMap((name) => {
   return `${worker.slice(start - 6, start) === "async " ? "async " : ""}${worker.slice(start, end)}`;
 }).join("\n");
 
-function harness({ initial = 3, max = "4", wrongLabel = false, stuck = false, mountingReads = 0 } = {}) {
+function harness({ initial = 3, max = "4", wrongLabel = false, stuck = false, mountingReads = 0, openerLabel } = {}) {
   const labels = ["Instant", "Medium", "High", "Extra High", "Pro"];
   let value = initial;
   let open = false;
   let verified = false;
+  let now = 0;
   const snapshot = () => open
     ? '- button "Thinking effort" [expanded=true, ref=e1]\n- menu "Thinking effort" [ref=e2]\n- menuitem "Select model" [ref=e3]\n- menuitem "Power" [ref=e4]'
-    : `- button "${value === 4 ? "6 Pro" : labels[value]}" [expanded=false, ref=e1]\n- textbox "Ask ChatGPT" [ref=e5]\n- button "Add files and more" [ref=e6]`;
+    : `- button "${openerLabel ?? (value === 4 ? "6 Pro" : labels[value])}" [expanded=false, ref=e1]\n- textbox "Ask ChatGPT" [ref=e5]\n- button "Add files and more" [ref=e6]`;
   const control = {
     closest: () => null,
     getAttribute: () => "description",
     querySelector: () => mountingReads-- > 0 ? null : ({ getAttribute: (name) => ({ "aria-valuemin": "0", "aria-valuemax": max, "aria-valuenow": String(value) })[name] }),
   };
-  const context = vm.createContext({ ...ui, parseSnapshotEntries, Date, Error, JSON, Number,
+  const context = vm.createContext({ ...ui, parseSnapshotEntries, Date: { now: () => now++ }, Error, JSON, Number,
     CHATGPT_LABELS: { configure: "Configure..." },
     MODEL_CONFIGURATION_OPEN_TIMEOUT_MS: 30, MODEL_CONFIGURATION_SETTLE_TIMEOUT_MS: 30,
     MODEL_CONFIGURATION_CLOSE_RETRY_MS: 1, MODEL_CONFIGURATION_SETTLE_POLL_MS: 0,
@@ -38,7 +39,11 @@ function harness({ initial = 3, max = "4", wrongLabel = false, stuck = false, mo
     composerControlsVisible: ui.snapshotHasUsableComposerControls,
     log: async (line) => { if (line.startsWith("Verified ChatGPT Power tier")) verified = true; },
     agentBrowser: async (_job, command, arg) => {
-      if (command === "focus") { assert(open); return; }
+      if (command === "focus") {
+        assert(open);
+        assert(mountingReads < 0, "wait for the Power slider to mount before focusing it");
+        return;
+      }
       if (command !== "press") return;
       if (arg === "Escape") open = false;
       else if (!stuck) value = Math.max(0, Math.min(4, value + (arg === "ArrowRight" ? 1 : -1)));
@@ -54,19 +59,21 @@ function harness({ initial = 3, max = "4", wrongLabel = false, stuck = false, mo
 }
 
 test("worker configures every preset through the current Power picker and closes it", async () => {
-  for (const [selection, expected] of [
-    [{ modelFamily: "instant", autoSwitchToThinking: false }, 0],
-    [{ modelFamily: "instant", autoSwitchToThinking: true }, 0],
-    [{ modelFamily: "thinking", effort: "light" }, 1],
-    [{ modelFamily: "thinking", effort: "standard" }, 1],
-    [{ modelFamily: "thinking", effort: "extended" }, 2],
-    [{ modelFamily: "thinking", effort: "heavy" }, 3],
-    [{ modelFamily: "pro", effort: "standard" }, 4],
-    [{ modelFamily: "pro", effort: "extended" }, 4],
-  ]) {
-    const h = harness({ initial: expected === 4 ? 0 : 4, mountingReads: 2 });
-    await h.configure(selection);
-    assert.deepEqual(h.state, { value: expected, open: false, verified: true });
+  for (const openerLabel of [undefined, "Select ChatGPT model"]) {
+    for (const [selection, expected] of [
+      [{ modelFamily: "instant", autoSwitchToThinking: false }, 0],
+      [{ modelFamily: "instant", autoSwitchToThinking: true }, 0],
+      [{ modelFamily: "thinking", effort: "light" }, 1],
+      [{ modelFamily: "thinking", effort: "standard" }, 1],
+      [{ modelFamily: "thinking", effort: "extended" }, 2],
+      [{ modelFamily: "thinking", effort: "heavy" }, 3],
+      [{ modelFamily: "pro", effort: "standard" }, 4],
+      [{ modelFamily: "pro", effort: "extended" }, 4],
+    ]) {
+      const h = harness({ initial: expected === 4 ? 0 : 4, mountingReads: 2, openerLabel });
+      await h.configure(selection);
+      assert.deepEqual(h.state, { value: expected, open: false, verified: true });
+    }
   }
 });
 

package/scripts/oracle-real-smoke.mjs

@@ -3,7 +3,8 @@
 // Default mode is packed-install release proof. Source mode is inner-loop/debug only.
 
 import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
@@ -25,6 +26,8 @@ Modes:
 Environment:
   PI_HOST_CLI                  selected Pi manifest bin entry, invoked with this Node executable (default: pi on PATH)
   PI_COMPAT_EXPECTED_VERSION   expected Pi version (default: package development baseline)
+  PI_ORACLE_RELEASE_TARBALL   retained tarball to install instead of the newly packed archive
+  PI_ORACLE_RELEASE_SHA256    expected retained tarball SHA-256, when supplied
   PI_ORACLE_REAL_TEST_PROVIDER   pi provider for the test agent (default: ${DEFAULT_PROVIDER})
   PI_ORACLE_REAL_TEST_MODEL      pi model for the test agent (default: ${DEFAULT_MODEL})
   PI_ORACLE_REAL_TEST_TIMEOUT_MS per-agent timeout in ms (default: ${DEFAULT_TIMEOUT_MS})
@@ -262,8 +265,16 @@ async function preparePackedProject({ runDir, provider, model, timeoutMs }) {
     timeoutMs: 120_000,
   });
   const tarballName = pack.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).at(-1);
-  const tarballPath = tarballName ? join(packDir, tarballName) : undefined;
+  let tarballPath = tarballName ? join(packDir, tarballName) : undefined;
   if (!tarballPath || !existsSync(tarballPath)) throw new Error(`npm pack did not produce a tarball in ${packDir}`);
+  if (env("PI_ORACLE_RELEASE_TARBALL")) {
+    tarballPath = join(packDir, "release-candidate.tgz");
+    copyFileSync(resolve(env("PI_ORACLE_RELEASE_TARBALL")), tarballPath);
+    const hash = createHash("sha256").update(readFileSync(tarballPath)).digest("hex");
+    const expected = env("PI_ORACLE_RELEASE_SHA256");
+    if (expected && hash !== expected) throw new Error("Retained release candidate checksum changed");
+    console.log(`ORACLE_RELEASE_CANDIDATE_SHA256=${hash}`);
+  }
   writeFileSync(join(installDir, "packed-tarball.txt"), `${tarballPath}\n`);
 
   await mustRun(installDir, "npm-init", npm, ["init", "-y"], { cwd: piProject, env: process.env, timeoutMs: 60_000 });
@@ -287,6 +298,11 @@ async function preparePackedProject({ runDir, provider, model, timeoutMs }) {
   writeFileSync(join(piProject, ".artifacts", "ignored", "artifact.txt"), "ignore me\n");
   mkdirSync(join(piProject, ".crabbox", "ignored"), { recursive: true });
   writeFileSync(join(piProject, ".crabbox", "ignored", "capture.txt"), "ignore me\n");
+  mkdirSync(join(piProject, ".pi"), { recursive: true });
+  writeFileSync(join(piProject, ".pi", "workspace-notes.txt"), "ignore me\n");
+  mkdirSync(join(piProject, ".oracle-context"), { recursive: true });
+  writeFileSync(join(piProject, ".oracle-context", "context.md"), "ignore me\n");
+  writeFileSync(join(piProject, ".scratchpad.md"), "ignore me\n");
 
   return { mode: "packed", cwd: piProject, installDir, provider, model, extensionPath: `./node_modules/${PACKAGE_NAME}` };
 }
@@ -369,11 +385,6 @@ async function run(mode = "packed") {
   const piVersion = await mustRun(runDir, "pi-version", piCommand(), ["--version"], { cwd: process.cwd(), env: process.env, timeoutMs: 30_000 });
   if (piVersion.stdout.trim() !== EXPECTED_PI_VERSION) throw new Error(`real smoke requires Pi ${EXPECTED_PI_VERSION}; found ${piVersion.stdout.trim() || "unknown"}`);
   const tmpRoot = mkdtempSync(join(tmpdir(), "pi-oracle-real-smoke-"));
-  const prepared = mode === "packed"
-    ? await preparePackedProject({ runDir, provider, model, timeoutMs })
-    : prepareSourceProject({ provider, model });
-  console.log(`Oracle real smoke mode=${prepared.mode} extension=${prepared.extensionPath}`);
-  writeFileSync(join(runDir, "run.json"), `${JSON.stringify({ runId, mode: prepared.mode, provider, model, extensionPath: prepared.extensionPath, timeoutMs, startedAt: new Date().toISOString() }, null, 2)}\n`);
 
   function assert(id, condition, message) {
     assertions.push({ id, ok: Boolean(condition), ...(condition ? {} : { error: message }) });
@@ -381,6 +392,12 @@ async function run(mode = "packed") {
   }
 
   try {
+    const prepared = mode === "packed"
+      ? await preparePackedProject({ runDir, provider, model, timeoutMs })
+      : prepareSourceProject({ provider, model });
+    console.log(`Oracle real smoke mode=${prepared.mode} extension=${prepared.extensionPath}`);
+    writeFileSync(join(runDir, "run.json"), `${JSON.stringify({ runId, mode: prepared.mode, provider, model, extensionPath: prepared.extensionPath, timeoutMs, startedAt: new Date().toISOString() }, null, 2)}\n`);
+
     const test1 = join(runDir, "whole-repo-submit");
     const agent1 = join(runDir, "agent1");
     const sessions1 = join(runDir, "sessions1");
@@ -423,7 +440,7 @@ async function run(mode = "packed") {
       const entries = await tarList(archivePath);
       writeFileSync(join(test1, "archive-list.txt"), `${entries.join("\n")}\n`);
       assert("archive-includes-readme", entryExists(entries, "README.md"), "archive should include README.md");
-      for (const excluded of [".pi", ".oracle-context", ".scratchpad.md", ".artifacts", ".crabbox", ".debug"]) {
+      for (const excluded of [".pi", ".oracle-context", ".scratchpad.md", ".artifacts", ".crabbox"]) {
         assert(`archive-excludes-${excluded.replace(/[^a-z0-9]+/gi, "-")}`, !entryExists(entries, excluded), `archive should exclude ${excluded}`);
       }
     } else {
@@ -466,7 +483,11 @@ async function run(mode = "packed") {
       const jobDir2 = latestJobDir(jobs2);
       writeFileSync(join(test2, "job-dir.txt"), `${jobDir2 ?? ""}\n`);
       const symlinkOutput = `${symlinkResult.stdout}\n${symlinkResult.stderr}`;
-      assert("symlink-rejected", /resolve inside|symlink|outside|escape|must be inside/i.test(symlinkOutput), "symlink escape test output did not show the expected rejection");
+      assert(
+        "symlink-rejected",
+        symlinkOutput.includes("archive_input_symlink_escape") || symlinkOutput.includes("Archive input must resolve inside the project cwd without symlink escapes"),
+        "symlink escape test output did not show the actual oracle_submit rejection evidence",
+      );
       assert("symlink-no-job-created", !jobDir2, "symlink escape rejection should not create an oracle job");
     }
 

package/scripts/platform-smoke/Dockerfile.ubuntu

@@ -1,8 +1,9 @@
-FROM cimg/node:24.16
+FROM cimg/node:24.21
 
 USER root
 RUN apt-get update \
   && apt-get install -y --no-install-recommends zstd rsync \
   && rm -rf /var/lib/apt/lists/*
-RUN npm install -g agent-browser@0.29.1
+RUN npm install -g npm \
+  && npm install -g --allow-scripts=agent-browser agent-browser
 USER circleci

package/scripts/platform-smoke/crabbox-runner.mjs

@@ -14,8 +14,7 @@ export function execCrabbox(args, opts = {}) {
   return new Promise((resolve) => {
     const child = spawn(CRABBOX_BIN, args, {
       stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, CRABBOX_SYNC_GIT_SEED: "false", ...opts.env },
-      ...opts.spawnOpts,
+      env: { ...process.env, CRABBOX_SYNC_GIT_SEED: "false" },
     });
     const stdoutChunks = [];
     const stderrChunks = [];
@@ -59,6 +58,7 @@ export function buildTargetBaseArgs(targetName, config = {}) {
   switch (targetName) {
     case "macos": {
       const host = env("PI_ORACLE_SMOKE_MAC_HOST") || env("PLATFORM_SMOKE_MAC_HOST") || "localhost";
+      const port = env("PI_ORACLE_SMOKE_MAC_PORT") || env("PLATFORM_SMOKE_MAC_PORT") || "22";
       const user = env("PI_ORACLE_SMOKE_MAC_USER") || env("PLATFORM_SMOKE_MAC_USER") || env("USER");
       const workRoot = env("PI_ORACLE_SMOKE_MAC_WORK_ROOT") || env("PLATFORM_SMOKE_MAC_WORK_ROOT") || `/Users/${env("USER")}/crabbox/${config.packageName ?? "pi-oracle"}`;
       return [
@@ -66,7 +66,7 @@ export function buildTargetBaseArgs(targetName, config = {}) {
         "--target", "macos",
         "--static-host", host,
         "--static-user", user,
-        "--static-port", "22",
+        "--static-port", port,
         "--static-work-root", workRoot,
       ];
     }
@@ -83,6 +83,19 @@ export function buildTargetBaseArgs(targetName, config = {}) {
       const snapshot = env("PI_ORACLE_SMOKE_WINDOWS_SNAPSHOT") || env("PLATFORM_SMOKE_WINDOWS_SNAPSHOT") || config.windowsParallels?.snapshot || "crabbox-ready";
       const user = env("PI_ORACLE_SMOKE_WINDOWS_USER") || env("PLATFORM_SMOKE_WINDOWS_USER") || env("USER");
       const workRoot = env("PI_ORACLE_SMOKE_WINDOWS_NATIVE_WORK_ROOT") || env("PLATFORM_SMOKE_WINDOWS_WORK_ROOT") || `C:\\crabbox\\${config.packageName ?? "pi-oracle"}`;
+      const host = env("PI_ORACLE_SMOKE_WINDOWS_HOST") || env("PLATFORM_SMOKE_WINDOWS_HOST");
+      if (host) {
+        const port = env("PI_ORACLE_SMOKE_WINDOWS_PORT") || env("PLATFORM_SMOKE_WINDOWS_PORT") || "22";
+        return [
+          "--provider", "ssh",
+          "--target", "windows",
+          "--windows-mode", "normal",
+          "--static-host", host,
+          "--static-user", user,
+          "--static-port", port,
+          "--static-work-root", workRoot,
+        ];
+      }
       return [
         "--provider", "parallels",
         "--target", "windows",
@@ -122,10 +135,9 @@ export async function runOnLease(config, targetName, leaseId, command, opts = {}
   for (const name of opts.allowEnvNames ?? []) args.push("--allow-env", name);
   if (opts.sync === false) args.push("--no-sync");
   else args.push("--fresh-sync");
-  if (opts.shell) args.push("--shell", command);
-  else args.push("--", ...(Array.isArray(command) ? command : command.split(" ")));
+  args.push("--shell", command);
   console.log(`  [crabbox] run ${targetName} ${opts.sync === false ? "--no-sync" : "--fresh-sync"} ...`);
-  return execCrabbox(args, { timeout: opts.timeout ?? 900_000, env: opts.env });
+  return execCrabbox(args, { timeout: opts.timeout ?? 900_000 });
 }
 
 export async function stopLease(config, targetName, leaseId) {

package/scripts/platform-smoke/doctor.mjs

@@ -1,8 +1,9 @@
 // Preflight checks for the pi-oracle Crabbox platform smoke gate.
 
 import { execFileSync, execSync } from "node:child_process";
-import { accessSync, constants, existsSync, mkdirSync, unlinkSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { accessSync, constants, mkdirSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { buildTargetBaseArgs } from "./crabbox-runner.mjs";
 
 let failures = 0;
 
@@ -63,24 +64,6 @@ function parseJson(text) {
   try { return JSON.parse(text); } catch { return undefined; }
 }
 
-function targetBaseArgs(targetName, config) {
-  if (targetName === "macos") {
-    const host = env("PI_ORACLE_SMOKE_MAC_HOST") || env("PLATFORM_SMOKE_MAC_HOST") || "localhost";
-    const user = env("PI_ORACLE_SMOKE_MAC_USER") || env("PLATFORM_SMOKE_MAC_USER") || env("USER");
-    const workRoot = env("PI_ORACLE_SMOKE_MAC_WORK_ROOT") || env("PLATFORM_SMOKE_MAC_WORK_ROOT") || `/Users/${env("USER")}/crabbox/${config.packageName}`;
-    return ["--provider", "ssh", "--target", "macos", "--static-host", host, "--static-user", user, "--static-port", "22", "--static-work-root", workRoot];
-  }
-  if (targetName === "ubuntu") {
-    const image = env("PI_ORACLE_SMOKE_UBUNTU_IMAGE") || env("PLATFORM_SMOKE_UBUNTU_IMAGE") || config.ubuntuContainerImage || "pi-oracle-platform-smoke:node24";
-    return ["--provider", "local-container", "--target", "linux", "--local-container-image", image];
-  }
-  const vm = windowsVmName(config);
-  const snapshot = windowsSnapshotName(config);
-  const user = env("PI_ORACLE_SMOKE_WINDOWS_USER") || env("PLATFORM_SMOKE_WINDOWS_USER") || env("USER");
-  const workRoot = env("PI_ORACLE_SMOKE_WINDOWS_NATIVE_WORK_ROOT") || env("PLATFORM_SMOKE_WINDOWS_WORK_ROOT") || `C:\\crabbox\\${config.packageName}`;
-  return ["--provider", "parallels", "--target", "windows", "--windows-mode", "normal", "--parallels-source", vm, "--parallels-source-snapshot", snapshot, "--parallels-user", user, "--parallels-work-root", workRoot];
-}
-
 function runCrabboxDoctor(cbox, label, args, timeout = 120_000) {
   const output = silent(cbox, ["doctor", ...args, "--json"], { env: { ...process.env, CRABBOX_SYNC_GIT_SEED: "false" }, timeout });
   if (!output) {
@@ -100,7 +83,7 @@ function runTargetToolProbe(cbox, targetName, config) {
   const command = targetName === "windows-native"
     ? `cmd.exe /c "where node && where npm && where git && where tar && where zstd && where agent-browser && zstd --version && agent-browser --version && echo tools-ok"`
     : `missing=""; for tool in ${required.join(" ")}; do command -v "$tool" >/dev/null 2>&1 || missing="$missing $tool"; done; if [ -n "$missing" ]; then echo "missing=$missing"; exit 1; fi; zstd --version >/dev/null && agent-browser --version >/dev/null && echo tools-ok`;
-  const baseArgs = targetBaseArgs(targetName, config);
+  const baseArgs = buildTargetBaseArgs(targetName, config);
   if (targetName === "macos") baseArgs.push("--reclaim");
   const result = silent(cbox, ["run", ...baseArgs, "--no-sync", "--shell", command], {
     env: { ...process.env, CRABBOX_SYNC_GIT_SEED: "false" },
@@ -137,37 +120,64 @@ function verifyPackageExclusions() {
   const forbiddenPatterns = [/^\.env(?:\.|$)/, /^\.artifacts(?:\/|$)/, /^\.crabbox(?:\/|$)/, /^\.debug(?:\/|$)/, /^\.platform-smoke-runs(?:\/|$)/, /\.tgz$/];
   const output = shell("npm pack --dry-run --json", { timeout: 120_000 });
   const parsed = parseJson(output);
-  if (!Array.isArray(parsed) || !parsed[0]?.files) {
+  // npm 11 returns an array; npm 12 keys the same records by package name.
+  const [pack] = parsed && typeof parsed === "object" ? Object.values(parsed) : [];
+  if (!pack?.files) {
     warn("could not inspect npm pack file list");
     return;
   }
-  const files = parsed[0].files.map((file) => file.path);
+  const files = pack.files.map((file) => file.path);
   const forbidden = files.filter((file) => forbiddenPatterns.some((pattern) => pattern.test(file)));
   forbidden.length ? fail(`forbidden files in package: ${forbidden.join(", ")}`) : ok("package excludes local env/artifact/debug state");
 }
 
+function findForbiddenFiles(dir, depth = 0) {
+  return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(dir, entry.name);
+    const matches = entry.name === ".env" || entry.name.startsWith(".env.") || entry.name.endsWith(".tgz");
+    return [
+      ...(matches ? [relative(process.cwd(), path)] : []),
+      ...(entry.isDirectory() && depth < 2 ? findForbiddenFiles(path, depth + 1) : []),
+    ];
+  });
+}
+
 function verifyRepoForbiddenFiles() {
-  const forbidden = shell("find . -maxdepth 3 \\( -name '.env' -o -name '.env.*' -o -name '*.tgz' \\) -print 2>/dev/null");
-  forbidden ? fail(`forbidden local secret/package artifact(s): ${forbidden}`) : ok("no .env/.env.* or package tarballs at repo root depth");
+  const forbidden = findForbiddenFiles(process.cwd());
+  forbidden.length ? fail(`forbidden local secret/package artifact(s): ${forbidden.join(", ")}`) : ok("no .env/.env.* or package tarballs at repo root depth");
   for (const dir of [".artifacts", ".crabbox", ".debug", ".platform-smoke-runs"]) {
-    const ignored = shell(`git check-ignore -q ${dir}/probe && echo ignored`);
+    const ignored = silent("git", ["check-ignore", "-q", `${dir}/probe`]) !== null;
     ignored ? ok(`${dir}/ is gitignored`) : fail(`${dir}/ must be gitignored`);
   }
-  const trackedForbidden = shell("git ls-files '.env*' '*.tgz' '.artifacts/*' '.crabbox/*' '.debug/*' '.platform-smoke-runs/*'");
+  const trackedForbidden = silent("git", ["ls-files", ".env*", "*.tgz", ".artifacts/*", ".crabbox/*", ".debug/*", ".platform-smoke-runs/*"]);
   trackedForbidden ? fail(`forbidden tracked local state: ${trackedForbidden}`) : ok("no forbidden local state is tracked");
   verifyPackageExclusions();
 }
 
 export async function runDoctor(config) {
   failures = 0;
+  const targets = config.requiredTargets ?? [];
+  const hasMac = targets.includes("macos");
+  const hasUbuntu = targets.includes("ubuntu");
+  const hasWindows = targets.includes("windows-native");
+  const windowsArgs = hasWindows ? buildTargetBaseArgs("windows-native", config) : [];
+  const windowsStatic = windowsArgs.includes("--static-host");
   console.log("\n── Environment ──");
   const cbox = env("PI_ORACLE_SMOKE_CRABBOX") || env("PLATFORM_SMOKE_CRABBOX") || "crabbox";
   ok(`Crabbox binary = ${resolveCommand(cbox) ?? cbox}${env("PI_ORACLE_SMOKE_CRABBOX") || env("PLATFORM_SMOKE_CRABBOX") ? " (env override)" : " (PATH)"}`);
-  ok(`PI_ORACLE_SMOKE_MAC_HOST = ${env("PI_ORACLE_SMOKE_MAC_HOST") || env("PLATFORM_SMOKE_MAC_HOST") || "localhost"}`);
-  ok(`PI_ORACLE_SMOKE_MAC_USER = ${env("PI_ORACLE_SMOKE_MAC_USER") || env("PLATFORM_SMOKE_MAC_USER") || env("USER")}`);
-  ok(`PI_ORACLE_SMOKE_UBUNTU_IMAGE = ${env("PI_ORACLE_SMOKE_UBUNTU_IMAGE") || env("PLATFORM_SMOKE_UBUNTU_IMAGE") || config.ubuntuContainerImage || "pi-oracle-platform-smoke:node24"}`);
-  ok(`PI_ORACLE_SMOKE_WINDOWS_VM = ${windowsVmName(config)}`);
-  ok(`PI_ORACLE_SMOKE_WINDOWS_SNAPSHOT = ${windowsSnapshotName(config)}`);
+  if (hasMac) {
+    ok(`PI_ORACLE_SMOKE_MAC_HOST = ${env("PI_ORACLE_SMOKE_MAC_HOST") || env("PLATFORM_SMOKE_MAC_HOST") || "localhost"}`);
+    ok(`PI_ORACLE_SMOKE_MAC_PORT = ${env("PI_ORACLE_SMOKE_MAC_PORT") || env("PLATFORM_SMOKE_MAC_PORT") || "22"}`);
+    ok(`PI_ORACLE_SMOKE_MAC_USER = ${env("PI_ORACLE_SMOKE_MAC_USER") || env("PLATFORM_SMOKE_MAC_USER") || env("USER")}`);
+  }
+  if (hasUbuntu) ok(`PI_ORACLE_SMOKE_UBUNTU_IMAGE = ${env("PI_ORACLE_SMOKE_UBUNTU_IMAGE") || env("PLATFORM_SMOKE_UBUNTU_IMAGE") || config.ubuntuContainerImage || "pi-oracle-platform-smoke:node24"}`);
+  if (hasWindows && windowsStatic) {
+    ok(`Windows SSH host = ${windowsArgs[windowsArgs.indexOf("--static-host") + 1]}`);
+    ok(`Windows SSH port = ${windowsArgs[windowsArgs.indexOf("--static-port") + 1]}`);
+  } else if (hasWindows) {
+    ok(`PI_ORACLE_SMOKE_WINDOWS_VM = ${windowsVmName(config)}`);
+    ok(`PI_ORACLE_SMOKE_WINDOWS_SNAPSHOT = ${windowsSnapshotName(config)}`);
+  }
 
   console.log("\n── Crabbox ──");
   const resolvedCbox = resolveCommand(cbox);
@@ -181,15 +191,22 @@ export async function runDoctor(config) {
     compareVersions(versionLine, requiredVersion) >= 0 ? ok(`required version: ${requiredVersion}+`) : fail(`Crabbox version mismatch: need ${requiredVersion}+, got ${versionLine}`);
   }
   const providers = silent(cbox, ["providers"], { timeout: 30_000 }) ?? "";
-  for (const provider of ["ssh", "local-container", "parallels"]) {
+  const neededProviders = new Set([
+    ...(hasMac || (hasWindows && windowsStatic) ? ["ssh"] : []),
+    ...(hasUbuntu ? ["local-container"] : []),
+    ...(hasWindows && !windowsStatic ? ["parallels"] : []),
+  ]);
+  for (const provider of neededProviders) {
     new RegExp(`^${provider}$`, "m").test(providers) ? ok(`provider available: ${provider}`) : fail(`crabbox providers missing ${provider}`);
   }
-  runCrabboxDoctor(cbox, "macOS static SSH", targetBaseArgs("macos", config), 120_000);
-  runCrabboxDoctor(cbox, "Windows native Parallels", targetBaseArgs("windows-native", config), 180_000);
-  runCrabboxDoctor(cbox, "local-container", targetBaseArgs("ubuntu", config), 120_000);
+  if (hasMac) runCrabboxDoctor(cbox, "macOS static SSH", buildTargetBaseArgs("macos", config), 120_000);
+  if (hasWindows) runCrabboxDoctor(cbox, windowsStatic ? "Windows native SSH" : "Windows native Parallels", windowsArgs, 180_000);
+  if (hasUbuntu) runCrabboxDoctor(cbox, "local-container", buildTargetBaseArgs("ubuntu", config), 120_000);
 
   console.log("\n── Host tools ──");
-  for (const [name, command] of [["Docker", "docker info --format '{{.ServerVersion}}'"], ["Node", "node --version"], ["npm", "npm --version"], ["git", "git --version"], ["tar", "tar --version"], ["rsync", "rsync --version"]]) {
+  const hostTools = [["Node", "node --version"], ["npm", "npm --version"], ["git", "git --version"], ["tar", "tar --version"], ["rsync", "rsync --version"]];
+  if (hasUbuntu) hostTools.unshift(["Docker", "docker info --format '{{.ServerVersion}}'"]);
+  for (const [name, command] of hostTools) {
     const output = shell(command);
     output ? ok(`${name}: ${output.split("\n")[0]}`) : fail(`${name} not found or unavailable`);
   }
@@ -198,7 +215,7 @@ export async function runDoctor(config) {
     const major = Number(nodeVersion.replace(/^v/, "").split(".")[0]);
     if (major < (config.nodeValidationMajor ?? 24)) fail(`Node ${nodeVersion}; need ${config.nodeValidationMajor ?? 24}+ for smoke validation`);
   }
-  verifyWindowsTemplate(config);
+  if (hasWindows && !windowsStatic) verifyWindowsTemplate(config);
 
   console.log("\n── Auth environment ──");
   const requiredAuth = requiredRealSmokeAuthEnv(config);
@@ -208,7 +225,7 @@ export async function runDoctor(config) {
   }
 
   console.log("\n── Target tools ──");
-  for (const target of config.requiredTargets ?? []) runTargetToolProbe(cbox, target, config);
+  for (const target of targets) runTargetToolProbe(cbox, target, config);
 
   console.log("\n── Artifact root ──");
   const artifactRoot = resolve(process.cwd(), config.artifactRoot ?? ".artifacts/platform-smoke");
@@ -232,8 +249,8 @@ export async function runDoctor(config) {
   console.log(`\n=== Results: ${failures} failure(s) ===`);
   if (failures > 0) {
     process.exitCode = 1;
-    console.log("Fix the failures above before running npm run smoke:platform:all.");
+    console.log("Fix the failures above before running the selected platform suites.");
   } else {
-    console.log("Ready for npm run smoke:platform:all.");
+    console.log(`Ready for platform suites on ${targets.join(", ")}.`);
   }
 }