superpowers-manager 0.6.0 → 0.7.0

package/dist/harnesses/opencode/install.js

@@ -0,0 +1,601 @@
+import { createHash, randomBytes } from "node:crypto";
+import { cp, lstat, mkdir, open, readFile, readdir, rm, rmdir, unlink, } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { findNodeAtLocation } from "jsonc-parser";
+import { failureResult, successResult, } from "../../adapter-result.js";
+import { digestArtifactTree } from "../../artifact-tree.js";
+import { atomicWriteFile, beginDirectoryPublication, } from "../../atomic.js";
+import { assertNoFollowType, canonicalizeProspectivePath, classifyPathNoFollow, } from "../../safe-path.js";
+import { removeObservedOpenCodeEntry } from "./config.js";
+import { inspectOpenCodeDiscovery, OPEN_CODE_PURE_MODE_INPUT, } from "./discovery.js";
+import { normalizeSnapshotRuntimeVersion } from "../../harness-command-result.js";
+import { runOpenCode } from "./native.js";
+import { readOpenCodePackageAssessment, readOpenCodeReceipt, } from "./package.js";
+import { assertOpenCodePreparationSeparate, openCodePaths, } from "./paths.js";
+import { inspectOpenCodeControl, inspectOpenCodeOwnership, } from "./state.js";
+import { displayPath } from "../../validator.js";
+const DEFAULTS = {
+    run: runOpenCode,
+    beginPublication: beginDirectoryPublication,
+};
+// The journal can contain data from two independently bounded 1 MiB receipts
+// plus one bounded 1 MiB config. Six bytes of JSON output per input byte covers
+// control escaping; counting the registration spec independently brings that
+// conservative subtotal to 24 MiB. The remaining 8 MiB bounds the actual
+// filesystem paths and fixed hashes/metadata without admitting an unbounded
+// recovery record.
+const MAX_JOURNAL_BYTES = 32 * 1024 * 1024;
+function fail(code, message) {
+    return failureResult("opencode-lifecycle", code, displayPath(message), [], []);
+}
+function accepted(result) {
+    if (result.status !== 0 || !result.outcome.ok)
+        throw new Error("OpenCode operation did not succeed");
+    return result.outcome.result;
+}
+function sameIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+async function identity(path) {
+    await assertNoFollowType(path, ["directory"]);
+    return await lstat(path);
+}
+async function requireIdentity(path, expected) {
+    if (!sameIdentity(await identity(path), expected))
+        throw new Error("OpenCode directory changed");
+}
+function journalPath(pending) {
+    return join(pending.paths.recoveryRoot, "transaction.json");
+}
+function journalBytes(journal) {
+    const bytes = Buffer.from(`${JSON.stringify(journal)}\n`);
+    if (bytes.length > MAX_JOURNAL_BYTES)
+        throw new Error("OpenCode recovery journal exceeds its byte limit");
+    return bytes;
+}
+async function validatePaths(paths) {
+    await assertOpenCodePreparationSeparate(paths);
+    await assertNoFollowType(paths.configRoot, ["directory", "missing"]);
+    await assertNoFollowType(paths.managerRoot, ["directory", "missing"]);
+    await assertNoFollowType(paths.installedRoot, ["directory", "missing"]);
+    return await canonicalizeProspectivePath(paths.installedRoot);
+}
+async function requireNoRecovery(paths) {
+    await assertNoFollowType(paths.recoveryRoot, ["missing"]);
+}
+async function hasRecovery(paths) {
+    try {
+        return (await classifyPathNoFollow(paths.recoveryRoot)) !== "missing";
+    }
+    catch {
+        return true;
+    }
+}
+async function syncDirectoryStrict(path) {
+    const directory = await open(path, "r");
+    try {
+        await directory.sync();
+    }
+    finally {
+        await directory.close();
+    }
+}
+function artifactSame(left, right) {
+    return left === null
+        ? right === null
+        : right !== null &&
+            left.binding === right.binding &&
+            left.digest === right.digest &&
+            left.commit === right.commit &&
+            left.source === right.source;
+}
+function snapshotEvidence(receipt) {
+    return receipt === null
+        ? null
+        : {
+            binding: receipt.binding,
+            digest: receipt.digest,
+            commit: receipt.commit,
+            source: receipt.source,
+        };
+}
+async function snapshot(root) {
+    if ((await assertNoFollowType(root, ["directory", "missing"])) === "missing")
+        return null;
+    const receipt = await readOpenCodeReceipt(root);
+    if (receipt.digest !== (await digestArtifactTree(root)))
+        throw new Error("OpenCode snapshot changed");
+    return receipt;
+}
+async function requireSnapshot(root, expected) {
+    if (!artifactSame(await snapshot(root), expected))
+        throw new Error("OpenCode artifact changed");
+}
+async function discovery(paths, ctx) {
+    const observed = await inspectOpenCodeDiscovery(paths, ctx.env ?? {}, process.cwd());
+    if (observed.managedEntries.length > 1)
+        throw new Error("ambiguous OpenCode Manager registration");
+    return observed;
+}
+function registrationRecord(registration) {
+    if (registration === undefined)
+        return null;
+    const observation = registration.observation;
+    const node = findNodeAtLocation(observation.document.root, [
+        "plugin",
+        registration.entry.index,
+    ]);
+    if (node === undefined)
+        throw new Error("OpenCode registration syntax changed");
+    return {
+        configPath: observation.document.path,
+        entryIndex: registration.entry.index,
+        spec: registration.entry.spec,
+        optionsDigest: createHash("sha256")
+            .update(JSON.stringify(registration.entry.options))
+            .digest("hex"),
+        observedBytesDigest: createHash("sha256")
+            .update(observation.bytes)
+            .digest("hex"),
+        observedDev: observation.identity.dev,
+        observedIno: observation.identity.ino,
+        observedMode: observation.identity.mode,
+        rawEntry: observation.document.text.slice(node.offset, node.offset + node.length),
+    };
+}
+function sameRegistration(registration, expected) {
+    return expected === null
+        ? registration === undefined
+        : registration !== undefined &&
+            registration.observation.document.path === expected.configPath &&
+            registration.entry.spec === expected.spec &&
+            createHash("sha256")
+                .update(JSON.stringify(registration.entry.options))
+                .digest("hex") === expected.optionsDigest;
+}
+function registrationInputSame(input, current) {
+    return input === null
+        ? current === null
+        : current !== null &&
+            input.entryIndex === current.entryIndex &&
+            input.spec === current.spec &&
+            input.observation.document.path === current.observation.document.path &&
+            input.observation.identity.dev === current.observation.identity.dev &&
+            input.observation.identity.ino === current.observation.identity.ino &&
+            input.observation.identity.mode === current.observation.identity.mode &&
+            input.observation.bytes.equals(current.observation.bytes);
+}
+function requireSafeActivationDiscovery(observed) {
+    if (observed.conflicts.length > 0 || observed.blockedInputs.length > 0)
+        throw new Error("OpenCode configuration changed");
+}
+async function requireStableActivationRegistration(paths, ctx, expected) {
+    const observed = await discovery(paths, ctx);
+    requireSafeActivationDiscovery(observed);
+    if (!sameRegistration(observed.managedEntries[0], expected))
+        throw new Error("OpenCode registration changed");
+    return observed;
+}
+function requireSafeRemovalDiscovery(observed) {
+    const unresolvedSkillInput = observed.blockedInputs.some((input) => input !== OPEN_CODE_PURE_MODE_INPUT);
+    if (observed.registrationUncertain ||
+        observed.ownedActivationAliases.length !== 0 ||
+        unresolvedSkillInput)
+        throw new Error("OpenCode registration removal is uncertain");
+}
+function requireNoOwnedActivation(observed) {
+    requireSafeRemovalDiscovery(observed);
+    if (observed.managedEntries.length !== 0)
+        throw new Error("OpenCode registration removal is uncertain");
+}
+async function requireActivationEligibility(ctx) {
+    const ownership = accepted(await inspectOpenCodeOwnership(ctx));
+    const control = accepted(await inspectOpenCodeControl(ctx));
+    if (ownership.installEligibility.kind !== "allowed" ||
+        control.mutationEligibility.kind !== "allowed")
+        throw new Error("OpenCode ownership or control blocked");
+}
+async function requireJournal(pending) {
+    if ((await validatePaths(pending.paths)) !== pending.canonicalRoot ||
+        pending.journal.installedRoot !== pending.canonicalRoot ||
+        !/^[a-f0-9]{32}$/u.test(pending.journal.token))
+        throw new Error("OpenCode recovery root changed");
+    await requireIdentity(pending.paths.recoveryRoot, pending.recoveryIdentity);
+    const path = journalPath(pending);
+    await assertNoFollowType(path, ["regular-file"]);
+    const observed = await lstat(path);
+    if (!sameIdentity(observed, pending.journalIdentity) ||
+        observed.size > MAX_JOURNAL_BYTES ||
+        !(await readFile(path)).equals(journalBytes(pending.journal)))
+        throw new Error("OpenCode recovery journal changed");
+    if (pending.backup !==
+        join(dirname(pending.canonicalRoot), `.${basename(pending.canonicalRoot)}.bak.${pending.journal.token}`) ||
+        pending.stage !==
+            join(dirname(pending.canonicalRoot), `.${basename(pending.canonicalRoot)}.stage.${pending.journal.token}`))
+        throw new Error("OpenCode recovery paths changed");
+}
+async function phase(pending, next, changes = {}) {
+    await requireJournal(pending);
+    const journal = { ...pending.journal, ...changes, phase: next };
+    const bytes = journalBytes(journal);
+    await atomicWriteFile(journalPath(pending), bytes, {
+        validate: async (temporary) => {
+            if (!(await readFile(temporary)).equals(bytes))
+                throw new Error("OpenCode journal write changed");
+        },
+    });
+    await syncDirectoryStrict(pending.paths.recoveryRoot);
+    pending.journal = journal;
+    pending.journalIdentity = await lstat(journalPath(pending));
+}
+async function beginJournal(paths, oldArtifact, newArtifact, priorRegistration, ctx) {
+    const canonicalRoot = await validatePaths(paths);
+    await requireNoRecovery(paths);
+    const token = randomBytes(16).toString("hex");
+    const journal = {
+        schema: 1,
+        token,
+        phase: newArtifact === null ? "removing" : "staging",
+        installedRoot: canonicalRoot,
+        oldArtifact: snapshotEvidence(oldArtifact),
+        newArtifact: snapshotEvidence(newArtifact),
+        priorRegistration,
+        createdRegistration: null,
+    };
+    // Serialization and its byte bound are validated before this function
+    // creates any Manager or recovery path.
+    const bytes = journalBytes(journal);
+    await mkdir(paths.managerRoot, { recursive: true });
+    await mkdir(paths.recoveryRoot, { mode: 0o700 });
+    const recoveryIdentity = await identity(paths.recoveryRoot);
+    const path = join(paths.recoveryRoot, "transaction.json");
+    const handle = await open(path, "wx", 0o600);
+    try {
+        await handle.writeFile(bytes);
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    await syncDirectoryStrict(paths.recoveryRoot);
+    return {
+        paths,
+        canonicalRoot,
+        recoveryIdentity,
+        backup: join(dirname(canonicalRoot), `.${basename(canonicalRoot)}.bak.${token}`),
+        stage: join(dirname(canonicalRoot), `.${basename(canonicalRoot)}.stage.${token}`),
+        ctx,
+        journal,
+        journalIdentity: await lstat(path),
+        settled: false,
+    };
+}
+async function retireJournal(pending) {
+    await requireJournal(pending);
+    if ((await readdir(pending.paths.recoveryRoot)).some((name) => name !== "transaction.json"))
+        throw new Error("unknown OpenCode recovery material");
+    await unlink(journalPath(pending));
+    await requireIdentity(pending.paths.recoveryRoot, pending.recoveryIdentity);
+    await rmdir(pending.paths.recoveryRoot);
+}
+async function recoveryGuidance(pending) {
+    try {
+        const kind = await classifyPathNoFollow(pending.paths.recoveryRoot);
+        if (kind === "missing")
+            return `recovery directory ${pending.paths.recoveryRoot} is absent; verify installed state before further mutation`;
+        if (kind !== "directory")
+            return `recovery path ${pending.paths.recoveryRoot} changed; preserve it for manual inspection`;
+        await requireIdentity(pending.paths.recoveryRoot, pending.recoveryIdentity);
+        const entries = await readdir(pending.paths.recoveryRoot);
+        return entries.some((name) => name !== "transaction.json")
+            ? `recovery directory ${pending.paths.recoveryRoot} contains unexpected material; preserve it for manual inspection`
+            : `preserve the recovery journal at ${journalPath(pending)} for manual inspection`;
+    }
+    catch {
+        return `preserve recovery state at ${pending.paths.recoveryRoot} for manual inspection`;
+    }
+}
+async function requirePublication(pending) {
+    await requireJournal(pending);
+    if (pending.publishedIdentity === undefined)
+        throw new Error("OpenCode publication missing");
+    await requireIdentity(pending.canonicalRoot, pending.publishedIdentity);
+    await requireSnapshot(pending.canonicalRoot, pending.journal.newArtifact);
+    if (pending.journal.oldArtifact === null)
+        await assertNoFollowType(pending.backup, ["missing"]);
+    else
+        await requireSnapshot(pending.backup, pending.journal.oldArtifact);
+}
+async function finalizeOpenCodePublication(pending, publication) {
+    if (pending.settled)
+        return fail("already-settled", "OpenCode installation transaction has already been settled");
+    pending.settled = true;
+    let publicationCleanupCompleted = false;
+    try {
+        await requirePublication(pending);
+        const expected = pending.journal.priorRegistration ?? pending.journal.createdRegistration;
+        await requireStableActivationRegistration(pending.paths, pending.ctx, expected);
+        const assessment = await readOpenCodePackageAssessment(pending.canonicalRoot);
+        if (assessment.compatibility.kind !== "supported" &&
+            assessment.compatibility.kind !== "experimental")
+            throw new Error("OpenCode compatibility changed");
+        await phase(pending, "finalizing");
+        await publication.finalize();
+        publicationCleanupCompleted = true;
+        await retireJournal(pending);
+        return successResult("finalize-opencode", null, []);
+    }
+    catch {
+        return fail("recovery-required", publicationCleanupCompleted
+            ? `OpenCode activation was verified and backup cleanup completed, but journal retirement failed; ${await recoveryGuidance(pending)}`
+            : `OpenCode activation or cleanup could not be verified; preserve recovery material at ${pending.paths.recoveryRoot} and ${pending.backup}`);
+    }
+}
+async function rollbackOpenCodePublication(pending, publication) {
+    if (pending.settled)
+        return fail("already-settled", "OpenCode installation transaction has already been settled");
+    pending.settled = true;
+    let restored = false;
+    try {
+        await requirePublication(pending);
+        let observed = await discovery(pending.paths, pending.ctx);
+        const expected = pending.journal.priorRegistration ?? pending.journal.createdRegistration;
+        if (!sameRegistration(observed.managedEntries[0], expected))
+            throw new Error("OpenCode registration changed");
+        await phase(pending, "rolling-back");
+        if (pending.journal.priorRegistration === null &&
+            pending.journal.createdRegistration !== null) {
+            const current = observed.managedEntries[0];
+            if (current === undefined)
+                throw new Error("OpenCode created registration missing");
+            await removeObservedOpenCodeEntry(current.observation, current.entry.index);
+            observed = await discovery(pending.paths, pending.ctx);
+            requireNoOwnedActivation(observed);
+        }
+        await requirePublication(pending);
+        await publication.rollback();
+        await requireSnapshot(pending.canonicalRoot, pending.journal.oldArtifact);
+        const after = await discovery(pending.paths, pending.ctx);
+        if (!sameRegistration(after.managedEntries[0], pending.journal.priorRegistration))
+            throw new Error("OpenCode registration restoration unverified");
+        if (pending.journal.priorRegistration === null)
+            requireNoOwnedActivation(after);
+        await phase(pending, "restored");
+        restored = true;
+        await retireJournal(pending);
+        return successResult("rollback-opencode", null, []);
+    }
+    catch {
+        return fail("recovery-required", restored
+            ? `OpenCode restoration was verified, but journal retirement failed; ${await recoveryGuidance(pending)}`
+            : `OpenCode restoration could not be verified; preserve the installed snapshot and recovery material at ${pending.paths.recoveryRoot} and ${pending.backup}`);
+    }
+}
+async function recoverBeforePublication(pending) {
+    try {
+        await requireJournal(pending);
+        await requireSnapshot(pending.canonicalRoot, pending.journal.oldArtifact);
+        await assertNoFollowType(pending.backup, ["missing"]);
+        const observed = await discovery(pending.paths, pending.ctx);
+        if (!sameRegistration(observed.managedEntries[0], pending.journal.priorRegistration))
+            return false;
+        if ((await assertNoFollowType(pending.stage, ["directory", "missing"])) !==
+            "missing") {
+            if (pending.stageIdentity === undefined)
+                return false;
+            await requireIdentity(pending.stage, pending.stageIdentity);
+            await phase(pending, "restored");
+            await rm(pending.stage, { recursive: true });
+        }
+        await retireJournal(pending);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function installOpenCode(artifact, ctx, deps = DEFAULTS) {
+    const paths = openCodePaths(ctx.env ?? {}, process.cwd());
+    let pending;
+    let publication;
+    try {
+        await validatePaths(paths);
+        await requireNoRecovery(paths);
+        if (artifact.root !== paths.preparedRoot)
+            throw new Error("unexpected OpenCode prepared root");
+        const assessment = await readOpenCodePackageAssessment(artifact.root);
+        if (assessment.receipt.digest !== artifact.identity ||
+            assessment.receipt.commit !== artifact.commit ||
+            (assessment.compatibility.kind !== "supported" &&
+                assessment.compatibility.kind !== "experimental"))
+            throw new Error("OpenCode prepared artifact changed");
+        await requireActivationEligibility(ctx);
+        const previous = await snapshot(paths.installedRoot);
+        let observed = await discovery(paths, ctx);
+        requireSafeActivationDiscovery(observed);
+        let priorRegistration = registrationRecord(observed.managedEntries[0]);
+        if (previous === null && priorRegistration !== null)
+            throw new Error("unowned OpenCode registration");
+        accepted(normalizeSnapshotRuntimeVersion("OpenCode", await deps.run(["--version"], paths, ctx)));
+        await requireSnapshot(paths.installedRoot, previous);
+        observed = await requireStableActivationRegistration(paths, ctx, priorRegistration);
+        priorRegistration = registrationRecord(observed.managedEntries[0]);
+        pending = await beginJournal(paths, previous, assessment.receipt, priorRegistration, ctx);
+        await mkdir(pending.stage);
+        pending.stageIdentity = await identity(pending.stage);
+        await cp(artifact.root, pending.stage, {
+            recursive: true,
+            verbatimSymlinks: true,
+            force: false,
+        });
+        const staged = await readOpenCodePackageAssessment(pending.stage);
+        if (!artifactSame(staged.receipt, assessment.receipt) ||
+            (staged.compatibility.kind !== "supported" &&
+                staged.compatibility.kind !== "experimental"))
+            throw new Error("OpenCode staged artifact changed");
+        await phase(pending, "publishing");
+        await requireIdentity(pending.stage, pending.stageIdentity);
+        await requireSnapshot(paths.installedRoot, previous);
+        observed = await requireStableActivationRegistration(paths, ctx, priorRegistration);
+        publication = await deps.beginPublication(pending.stage, pending.canonicalRoot, { backupPath: pending.backup });
+        pending.publishedIdentity = pending.stageIdentity;
+        await phase(pending, "published");
+        if (priorRegistration === null) {
+            await phase(pending, "registering");
+            observed = await requireStableActivationRegistration(paths, ctx, null);
+            const native = await deps
+                .run(["plugin", pending.canonicalRoot, "--global"], paths, ctx)
+                .catch(() => fail("native-failed", "OpenCode native installation failed"));
+            observed = await discovery(paths, ctx);
+            requireSafeActivationDiscovery(observed);
+            const created = registrationRecord(observed.managedEntries[0]);
+            if (created === null || created.spec !== pending.canonicalRoot)
+                throw new Error("OpenCode activation unverified");
+            await phase(pending, "registered", { createdRegistration: created });
+            accepted(native);
+        }
+        await requirePublication(pending);
+        observed = await discovery(paths, ctx);
+        requireSafeActivationDiscovery(observed);
+        const expected = priorRegistration ?? pending.journal.createdRegistration;
+        if (!sameRegistration(observed.managedEntries[0], expected))
+            throw new Error("OpenCode activation unverified");
+        await phase(pending, "ready");
+        const owned = pending;
+        const published = publication;
+        return successResult("install-opencode", {
+            missingVerificationOutput: {
+                stdout: [],
+                stderr: [
+                    "error: installed OpenCode snapshot is not detectable after activation",
+                ],
+            },
+            mismatchVerificationOutput: {
+                stdout: [],
+                stderr: [
+                    "error: installed OpenCode snapshot or registration does not match the prepared artifact",
+                ],
+            },
+            transaction: {
+                finalize: () => finalizeOpenCodePublication(owned, published),
+                rollback: () => rollbackOpenCodePublication(owned, published),
+            },
+        }, []);
+    }
+    catch {
+        if (pending !== undefined) {
+            const restored = publication === undefined
+                ? await recoverBeforePublication(pending)
+                : (await rollbackOpenCodePublication(pending, publication)).outcome
+                    .ok;
+            if (restored)
+                return fail("activation-failed", "OpenCode activation failed; the previous snapshot and registration were restored");
+        }
+        if ((await hasRecovery(paths)) || pending !== undefined)
+            return fail("recovery-required", `OpenCode mutation requires manual recovery; preserve material at ${paths.recoveryRoot} and any installed snapshot or sibling backup`);
+        return fail("activation-refused", `cannot activate OpenCode artifact ${artifact.root}; verify prepared content, runtime, ownership, and configuration under ${paths.configRoot}`);
+    }
+}
+export async function removeOpenCode(input, ctx, deps = DEFAULTS) {
+    const paths = openCodePaths(ctx.env ?? {}, process.cwd());
+    let pending;
+    let deregistered = false;
+    let backupVerified = false;
+    let removalVerified = false;
+    try {
+        await validatePaths(paths);
+        await requireNoRecovery(paths);
+        const current = accepted(await inspectOpenCodeOwnership(ctx)).removalInput;
+        if (input.installedRoot !== paths.installedRoot ||
+            input.receiptDigest !== current.receiptDigest ||
+            !registrationInputSame(input.registration, current.registration))
+            throw new Error("stale OpenCode removal input");
+        const previous = await snapshot(paths.installedRoot);
+        let observed = await discovery(paths, ctx);
+        const registered = observed.managedEntries[0];
+        if (previous === null) {
+            if (registered !== undefined || observed.registrationUncertain)
+                throw new Error("unverified OpenCode registration");
+            return successResult("remove-opencode", null, []);
+        }
+        if (input.receiptDigest === null ||
+            previous.digest !== input.receiptDigest ||
+            !registrationInputSame(input.registration, registered === undefined
+                ? null
+                : {
+                    observation: registered.observation,
+                    entryIndex: registered.entry.index,
+                    spec: registered.entry.spec,
+                }))
+            throw new Error("OpenCode ownership changed");
+        requireSafeRemovalDiscovery(observed);
+        pending = await beginJournal(paths, previous, null, registrationRecord(registered), ctx);
+        const installedIdentity = await identity(paths.installedRoot);
+        await assertNoFollowType(pending.backup, ["missing"]);
+        await cp(paths.installedRoot, pending.backup, {
+            recursive: true,
+            verbatimSymlinks: true,
+            force: false,
+            errorOnExist: true,
+        });
+        pending.removalBackupIdentity = await identity(pending.backup);
+        await requireSnapshot(pending.backup, previous);
+        backupVerified = true;
+        observed = await discovery(paths, ctx);
+        requireSafeRemovalDiscovery(observed);
+        if (!sameRegistration(observed.managedEntries[0], pending.journal.priorRegistration))
+            throw new Error("OpenCode registration changed");
+        if (registered !== undefined) {
+            await removeObservedOpenCodeEntry(registered.observation, registered.entry.index);
+            observed = await discovery(paths, ctx);
+            requireNoOwnedActivation(observed);
+            deregistered = true;
+        }
+        else {
+            requireNoOwnedActivation(observed);
+        }
+        await phase(pending, "deregistered");
+        await requireIdentity(paths.installedRoot, installedIdentity);
+        await requireSnapshot(paths.installedRoot, previous);
+        await requireIdentity(pending.backup, pending.removalBackupIdentity);
+        await requireSnapshot(pending.backup, previous);
+        observed = await discovery(paths, ctx);
+        requireNoOwnedActivation(observed);
+        await (deps.rm ?? rm)(paths.installedRoot, { recursive: true });
+        await requireSnapshot(paths.installedRoot, null);
+        const verification = accepted(await inspectOpenCodeOwnership(ctx));
+        if (verification.removalVerification.kind !== "allowed")
+            throw new Error("OpenCode desired removal state could not be verified");
+        removalVerified = true;
+        await requireIdentity(pending.backup, pending.removalBackupIdentity);
+        await requireSnapshot(pending.backup, previous);
+        await (deps.rm ?? rm)(pending.backup, { recursive: true });
+        await requireSnapshot(pending.backup, null);
+        await retireJournal(pending);
+        return successResult("remove-opencode", null, []);
+    }
+    catch {
+        let intactBackup = false;
+        if (pending !== undefined &&
+            backupVerified &&
+            pending.removalBackupIdentity !== undefined) {
+            try {
+                await requireIdentity(pending.backup, pending.removalBackupIdentity);
+                await requireSnapshot(pending.backup, pending.journal.oldArtifact);
+                intactBackup = true;
+            }
+            catch {
+                // The controlled failure below never claims unverified recovery bytes.
+            }
+        }
+        if (removalVerified)
+            return fail("cleanup-required", `OpenCode removal was verified, but backup or journal cleanup remains at ${paths.managerRoot}`);
+        return fail(pending !== undefined || (await hasRecovery(paths))
+            ? "recovery-required"
+            : "removal-refused", intactBackup
+            ? `OpenCode removal did not complete; preserve the verified prior snapshot backup at ${pending.backup} and recovery journal at ${paths.recoveryRoot}`
+            : deregistered
+                ? `OpenCode registration was removed but snapshot cleanup failed; preserve recovery material at ${paths.recoveryRoot}`
+                : `cannot verify OpenCode removal at ${paths.installedRoot}; preserve the snapshot and any recovery material at ${paths.recoveryRoot}`);
+    }
+}

package/dist/harnesses/opencode/native.js

@@ -0,0 +1,57 @@
+import { tmpdir } from "node:os";
+import { dirname, isAbsolute, resolve, sep } from "node:path";
+import { mkdir } from "node:fs/promises";
+import { failureResult, } from "../../adapter-result.js";
+import { nativeCommandResult, } from "../../harness-command-result.js";
+import { BOUNDED_EXECUTABLE, runValidator as runBoundedCommand, } from "../../validator.js";
+import { withWorkspace } from "../../workspace.js";
+const OPEN_CODE_EXECUTABLE = {
+    ...BOUNDED_EXECUTABLE,
+    inheritEnvironment: false,
+};
+function selectedExecutable(env, invocationCwd) {
+    const configured = env.SUPERPOWERS_OPENCODE || "opencode";
+    return configured.includes(sep) && !isAbsolute(configured)
+        ? resolve(invocationCwd, configured)
+        : configured;
+}
+export async function runOpenCode(args, paths, ctx, execute = runBoundedCommand) {
+    const operation = "opencode-command";
+    const env = ctx.env ?? {};
+    const executable = selectedExecutable(env, process.cwd());
+    let entered = false;
+    try {
+        return await withWorkspace(env.TMPDIR ?? tmpdir(), "superpowers-manager.opencode.", async (workspace) => {
+            entered = true;
+            const home = resolve(workspace, "home");
+            const data = resolve(workspace, "data");
+            const cache = resolve(workspace, "cache");
+            const state = resolve(workspace, "state");
+            const temporary = resolve(workspace, "tmp");
+            const managed = resolve(workspace, "managed");
+            await Promise.all([home, data, cache, state, temporary, managed].map((path) => mkdir(path)));
+            const result = await execute([executable, ...args], OPEN_CODE_EXECUTABLE, {
+                PATH: env.PATH,
+                HOME: home,
+                XDG_CONFIG_HOME: dirname(paths.configRoot),
+                XDG_DATA_HOME: data,
+                XDG_CACHE_HOME: cache,
+                XDG_STATE_HOME: state,
+                TMPDIR: temporary,
+                OPENCODE_DISABLE_AUTOUPDATE: "1",
+                OPENCODE_DISABLE_MODELS_FETCH: "1",
+                OPENCODE_DISABLE_PROJECT_CONFIG: "1",
+                OPENCODE_PURE: "1",
+                OPENCODE_TEST_MANAGED_CONFIG_DIR: managed,
+                GIT_CONFIG_GLOBAL: "/dev/null",
+                GIT_CONFIG_NOSYSTEM: "1",
+            }, temporary, workspace);
+            return nativeCommandResult("OpenCode", result);
+        });
+    }
+    catch {
+        return failureResult(operation, "workspace-failed", entered
+            ? "cannot complete OpenCode command in its isolated workspace"
+            : "cannot create an isolated OpenCode command workspace", [], []);
+    }
+}