PaperClipAI/scripts/acpx-patch-packaging.test.mjs

import assert from "node:assert/strict";
import { execFileSync } from "node:child_process";
import {
  existsSync,
  cpSync,
  lstatSync,
  mkdirSync,
  mkdtempSync,
  readFileSync,
  realpathSync,
  rmSync,
  symlinkSync,
  writeFileSync,
} from "node:fs";
import { readFile } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import test from "node:test";
import { createRequire } from "node:module";

import cliEsbuildConfig from "../cli/esbuild.config.mjs";
import { bundledCliNpmDependencies } from "./cli-bundled-npm-dependencies.mjs";
import {
  createBundledInstallManifest,
  configureBundledProviderOverrides,
  materializePublishManifest,
  selectBundledDependencyPatches,
  stageBundledEsbuildOptionalDependencies,
  stageBundledProviderOptionalDependencies,
} from "./prepare-bundled-package.mjs";

const rootPackage = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"));
const profileData = JSON.parse(await readFile(new URL("../packages/paperclip-runner/acpx-profiles.json", import.meta.url), "utf8"));
const nativeTargets = ["linux-x64", "darwin-arm64", "darwin-x64"];
function esbuildFixture(t) {
  const directory = realpathSync(mkdtempSync(join(tmpdir(), "paperclip-bundled-esbuild-")));
  t.after(() => rmSync(directory, { recursive: true, force: true }));
  const graph = join(directory, "node_modules");
  const writePackage = (location, metadata) => {
    mkdirSync(location, { recursive: true });
    writeFileSync(join(location, "package.json"), JSON.stringify(metadata));
    return location;
  };
  const acpx = writePackage(join(graph, "acpx"), { name: "acpx", version: "0.22.0" });
  const esbuild = writePackage(join(acpx, "node_modules/esbuild"), {
    name: "esbuild", version: "0.28.2", scripts: { postinstall: "node install.js" },
    optionalDependencies: Object.fromEntries([...nativeTargets, "win32-x64"].map(target => [`@esbuild/${target}`, "0.28.2"])),
  });
  const producerBinary = writePackage(join(graph, "@esbuild/linux-x64"), {
    name: "@esbuild/linux-x64", version: "0.28.2", os: ["linux"], cpu: ["x64"],
  });
  writePackage(join(graph, "unrelated-linux-x64"), { name: "unrelated-linux-x64", version: "1.0.0" });
  const publish = { name: "@paperclipai/adapter-utils", version: "0.3.1", bundleDependencies: ["acpx"],
    dependencies: { acpx: "0.22.0" }, optionalDependencies: { unrelated: "1.0.0" } };
  return { directory, graph, esbuild, producerBinary, publish, writePackage };
}
const codexTargets = ["linux-x64", "linux-arm64", "darwin-x64", "darwin-arm64", "win32-x64", "win32-arm64"];
const codexOptional = Object.fromEntries(codexTargets.map(target => [`@openai/codex-${target}`, `npm:@openai/codex@0.160.0-${target}`]));
const claudeTargets = [...codexTargets, "linux-x64-musl", "linux-arm64-musl"];
const claudeOptional = Object.fromEntries(claudeTargets.map(target => [`@anthropic-ai/claude-agent-sdk-${target}`, "0.3.286"]));
function claudeFixture(t) {
  const directory = realpathSync(mkdtempSync(join(tmpdir(), "paperclip-bundled-claude-")));
  t.after(() => rmSync(directory, { recursive: true, force: true }));
  const graph = join(directory, "node_modules");
  const writePackage = (location, metadata) => {
    mkdirSync(location, { recursive: true });
    writeFileSync(join(location, "package.json"), JSON.stringify(metadata));
    return location;
  };
  const bridge = writePackage(join(graph, "@agentclientprotocol/claude-agent-acp"), {
    name: "@agentclientprotocol/claude-agent-acp", version: "0.73.0", dependencies: { "@anthropic-ai/claude-agent-sdk": "0.3.286" },
  });
  writeFileSync(join(bridge, "index.js"), "export {};\n");
  const runtime = writePackage(join(graph, "@anthropic-ai/claude-agent-sdk"), {
    name: "@anthropic-ai/claude-agent-sdk", version: "0.3.286", exports: { ".": "./sdk.mjs" }, optionalDependencies: claudeOptional,
  });
  writeFileSync(join(runtime, "sdk.mjs"), "// official JavaScript fixture, never executed\n");
  const producer = writePackage(join(graph, "@anthropic-ai/claude-agent-sdk-linux-x64"), {
    name: "@anthropic-ai/claude-agent-sdk-linux-x64", version: "0.3.286", os: ["linux"], cpu: ["x64"],
  });
  writeFileSync(join(producer, "claude"), "producer native fixture, never executed");
  const profiles = [{ agent: "claude", ...profileData.profiles.claude }];
  const publish = { name: "paperclip-claude-pack-fixture", version: "1.0.0", dependencies: { "@agentclientprotocol/claude-agent-acp": "0.73.0" }, bundleDependencies: ["@agentclientprotocol/claude-agent-acp"] };
  return { directory, graph, bridge, runtime, producer, profiles, publish, writePackage };
}
function codexFixture(t) {
  const directory = realpathSync(mkdtempSync(join(tmpdir(), "paperclip-bundled-codex-")));
  t.after(() => rmSync(directory, { recursive: true, force: true }));
  const graph = join(directory, "node_modules");
  const writePackage = (location, metadata) => {
    mkdirSync(location, { recursive: true }); writeFileSync(join(location, "package.json"), JSON.stringify(metadata)); return location;
  };
  const bridge = writePackage(join(graph, "@agentclientprotocol/codex-acp"), { name: "@agentclientprotocol/codex-acp", version: "1.6.2", dependencies: { "@openai/codex": "0.160.0" } });
  writeFileSync(join(bridge, "index.js"), "export {};\n");
  const runtime = writePackage(join(graph, "@openai/codex"), { name: "@openai/codex", version: "0.160.0", bin: { codex: "bin/codex.js" }, optionalDependencies: codexOptional });
  mkdirSync(join(runtime, "bin")); writeFileSync(join(runtime, "bin/codex.js"), "// official JavaScript fixture, never executed\n");
  mkdirSync(join(runtime, "vendor")); writeFileSync(join(runtime, "vendor/codex"), "producer fallback binary fixture, never executed");
  const producer = writePackage(join(graph, "@openai/codex-linux-x64"), { name: "@openai/codex", version: "0.160.0-linux-x64", os: ["linux"], cpu: ["x64"] });
  mkdirSync(join(producer, "vendor")); writeFileSync(join(producer, "vendor/codex"), "producer optional binary fixture, never executed");
  const nested = writePackage(join(bridge, "node_modules/@openai/codex-darwin-arm64"), { name: "@openai/codex", version: "0.160.0-darwin-arm64", os: ["darwin"], cpu: ["arm64"] });
  writePackage(join(graph, "unrelated-linux-x64"), { name: "unrelated-linux-x64", version: "1.0.0" });
  const profiles = [{ agent: "codex", ...profileData.profiles.codex }];
  const publish = { name: "paperclip-codex-pack-fixture", version: "1.0.0", dependencies: { "@agentclientprotocol/codex-acp": "1.6.2" }, bundleDependencies: ["@agentclientprotocol/codex-acp"] };
  return { directory, graph, bridge, runtime, producer, nested, profiles, publish, writePackage };
}
const adapterUtilsPackage = JSON.parse(
  await readFile(new URL("../packages/adapter-utils/package.json", import.meta.url), "utf8"),
);
const runnerPackage = JSON.parse(
  await readFile(new URL("../packages/paperclip-runner/package.json", import.meta.url), "utf8"),
);
const serverPackage = JSON.parse(
  await readFile(new URL("../server/package.json", import.meta.url), "utf8"),
);
const dbPackage = JSON.parse(
  await readFile(new URL("../packages/db/package.json", import.meta.url), "utf8"),
);
const releaseScript = await readFile(new URL("./release.sh", import.meta.url), "utf8");
const releaseLib = await readFile(new URL("./release-lib.sh", import.meta.url), "utf8");
const buildNpmScript = await readFile(new URL("./build-npm.sh", import.meta.url), "utf8");

const acpxRuntimePatch = await readFile(
  new URL("../patches/acpx@0.22.0.patch", import.meta.url),
  "utf8",
);
const claudeAcpPatch = await readFile(
  new URL("../patches/@agentclientprotocol__claude-agent-acp@0.73.0.patch", import.meta.url),
  "utf8",
);

for (const version of ["0.22.0"]) {
  test(`ACPX ${version} release patch uses portable generated unified hunks`, async () => {
    const patch = await readFile(
      new URL(`../patches/acpx@${version}.patch`, import.meta.url),
      "utf8",
    );
    const lines = patch.split("\n");
    let hunkCount = 0;
    for (let index = 0; index < lines.length; index += 1) {
      const header = lines[index].match(
        /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/,
      );
      if (!header) continue;
      hunkCount += 1;
      const body = [];
      let oldLines = 0;
      let newLines = 0;
      while (index + 1 < lines.length && (oldLines < Number(header[2] ?? 1) || newLines < Number(header[4] ?? 1))) {
        const line = lines[++index];
        // Unified diff's EOF marker is metadata, not a source/destination
        // line, and may occur between the removed and added final lines.
        if (line === "\\ No newline at end of file") continue;
        // Git accepts an empty context line with its optional space omitted.
        assert.ok(line === "" || /^[ +\-]/.test(line), `invalid unified hunk line: ${line}`);
        const normalized = line === "" ? " " : line;
        body.push(normalized);
        if (!normalized.startsWith("+")) oldLines += 1;
        if (!normalized.startsWith("-")) newLines += 1;
      }
      assert.equal(
        body.filter((line) => !line.startsWith("+")).length,
        Number(header[2] ?? 1),
      );
      assert.equal(
        body.filter((line) => !line.startsWith("-")).length,
        Number(header[4] ?? 1),
      );
      const prefix = body.findIndex((line) => !line.startsWith(" "));
      const suffix = body
        .slice()
        .reverse()
        .findIndex((line) => !line.startsWith(" "));
      // pnpm patch-commit emits three context lines. Hand-added asymmetric
      // context can force GNU patch's locate_hunk() to require EOF even when
      // BSD patch and git apply accept the same source and hunk.
      assert.ok(
        prefix >= 0 && prefix <= 3,
        `regenerate ${version} hunk at old line ${header[1]} with pnpm patch-commit (prefix ${prefix})`,
      );
      assert.ok(
        suffix >= 0 && suffix <= 3,
        `regenerate ${version} hunk at old line ${header[1]} with pnpm patch-commit (suffix ${suffix})`,
      );
    }
    assert.ok(hunkCount > 0);
  });
}

test("published packages preserve the patched ACPX runtime", () => {
  assert.equal(
    rootPackage.pnpm.patchedDependencies["acpx@0.22.0"],
    "patches/acpx@0.22.0.patch",
  );
  assert.equal(adapterUtilsPackage.dependencies.acpx, "0.22.0");
  assert.deepEqual(adapterUtilsPackage.bundleDependencies, ["acpx"]);
  assert.equal(serverPackage.dependencies.acpx, "0.22.0");
  assert.ok(serverPackage.bundleDependencies.includes("acpx"));
  assert.equal(bundledCliNpmDependencies.has("acpx"), true);
  assert.equal(cliEsbuildConfig.external.includes("acpx"), false);
});

test("published Claude bridge pins its qualified SDK and provider dependency closure", () => {
  const published = materializePublishManifest(serverPackage);
  const { installManifest } = configureBundledProviderOverrides(
    createBundledInstallManifest(published, serverPackage.bundleDependencies),
    serverPackage.bundleDependencies, rootPackage, profileData,
  );
  assert.deepEqual(installManifest.overrides["@agentclientprotocol/claude-agent-acp@0.73.0"], {
    "@anthropic-ai/claude-agent-sdk": "0.3.286",
    "@agentclientprotocol/sdk": "1.4.0",
    zod: "4.4.3",
  });
});

test("published Codex bridge uses its qualified producer closure without consumer overrides", () => {
  const published = materializePublishManifest(serverPackage);
  const { installManifest, profiles } = configureBundledProviderOverrides(
    createBundledInstallManifest(published, serverPackage.bundleDependencies),
    serverPackage.bundleDependencies, rootPackage, profileData,
  );
  assert.deepEqual(profiles.map(profile => profile.agent), ["codex", "claude"]);
  for (const profile of profiles) {
    assert.equal(published.dependencies[profile.agentServerPackage], profile.agentServerVersion);
    assert.ok(published.bundleDependencies.includes(profile.agentServerPackage));
    assert.equal(installManifest.overrides[`${profile.agentServerPackage}@${profile.agentServerVersion}`][profile.agentRuntimePackage], profile.agentRuntimeVersion);
  }
  assert.equal(published.overrides, undefined);
  assert.equal(installManifest.overrides.rollup, undefined);
  const bad = structuredClone(rootPackage);
  bad.pnpm.overrides["@agentclientprotocol/codex-acp@1.6.2>@openai/codex"] = "0.156.1";
  assert.throws(() => configureBundledProviderOverrides(installManifest, serverPackage.bundleDependencies, bad, profileData), /runtime override must match/);
  const unpinned = createBundledInstallManifest(published, serverPackage.bundleDependencies);
  unpinned.dependencies["@agentclientprotocol/codex-acp"] = "^1.6.2";
  assert.throws(() => configureBundledProviderOverrides(unpinned, serverPackage.bundleDependencies, rootPackage, profileData), /exact qualified profile/);
  const conflict = createBundledInstallManifest(published, serverPackage.bundleDependencies);
  conflict.overrides = { "@agentclientprotocol/codex-acp@1.6.2": { "@openai/codex": "0.156.1" } };
  assert.throws(() => configureBundledProviderOverrides(conflict, serverPackage.bundleDependencies, rootPackage, profileData), /conflicting producer override/);
});

test("Linux-produced Claude bundles retain the SDK and install native packages for the consumer platform", (t) => {
  const { directory, bridge, runtime, producer, profiles, publish } = claudeFixture(t);
  const bridgeBefore = readFileSync(join(bridge, "package.json"), "utf8");
  const staged = stageBundledProviderOptionalDependencies(directory, publish, profiles);
  assert.deepEqual(staged.optionalDependencies, claudeOptional);
  assert.equal(existsSync(producer), false);
  assert.equal(JSON.parse(readFileSync(join(runtime, "package.json"), "utf8")).optionalDependencies, undefined);
  assert.equal(readFileSync(join(bridge, "package.json"), "utf8"), bridgeBefore);
  assert.deepEqual(stageBundledProviderOptionalDependencies(directory, staged, profiles), staged);
  writeFileSync(join(directory, "package.json"), JSON.stringify(staged));
  const packs = JSON.parse(execFileSync("npm", ["pack", "--ignore-scripts", "--offline", "--json"], {
    cwd: directory, encoding: "utf8", timeout: 30_000,
    env: { ...process.env, HOME: directory, npm_config_cache: join(directory, "cache"), npm_config_update_notifier: "false" },
  }));
  const paths = packs[0].files.map(file => file.path);
  assert.ok(paths.some(path => path.endsWith("@anthropic-ai/claude-agent-sdk/sdk.mjs")));
  assert.equal(paths.some(path => /@anthropic-ai\/claude-agent-sdk-(?:linux|darwin|win32)-/.test(path)), false);
});

test("Claude bundle validation rejects unqualified declarations before removing native payloads", (t) => {
  const { directory, runtime, producer, profiles, publish } = claudeFixture(t);
  const file = join(runtime, "package.json"), original = JSON.parse(readFileSync(file, "utf8"));
  for (const metadata of [
    { ...original, version: "0.3.285" },
    { ...original, optionalDependencies: { ...claudeOptional, "@anthropic-ai/claude-agent-sdk-darwin-arm64": "latest" } },
    { ...original, optionalDependencies: {} },
  ]) {
    writeFileSync(file, JSON.stringify(metadata));
    assert.throws(() => stageBundledProviderOptionalDependencies(directory, publish, profiles), /version mismatch|not qualified/);
    assert.equal(existsSync(producer), true);
  }
});

test("mixed provider bundles validate both runtimes before removing either producer executable", (t) => {
  const codex = codexFixture(t), claude = claudeFixture(t);
  for (const name of ["@agentclientprotocol/claude-agent-acp", "@anthropic-ai/claude-agent-sdk", "@anthropic-ai/claude-agent-sdk-linux-x64"]) {
    cpSync(join(claude.graph, name), join(codex.graph, name), { recursive: true });
  }
  const profiles = [...codex.profiles, ...claude.profiles];
  const publish = { ...codex.publish, dependencies: { ...codex.publish.dependencies, ...claude.publish.dependencies },
    bundleDependencies: [...codex.publish.bundleDependencies, ...claude.publish.bundleDependencies] };
  const file = join(codex.graph, "@anthropic-ai/claude-agent-sdk/package.json");
  const metadata = JSON.parse(readFileSync(file, "utf8"));
  writeFileSync(file, JSON.stringify({ ...metadata, version: "0.3.285" }));
  assert.throws(() => stageBundledProviderOptionalDependencies(codex.directory, publish, profiles), /Claude runtime version mismatch/);
  assert.equal(existsSync(codex.producer), true);
  assert.deepEqual(JSON.parse(readFileSync(join(codex.runtime, "package.json"), "utf8")).optionalDependencies, codexOptional);
  writeFileSync(file, JSON.stringify(metadata));
  const staged = stageBundledProviderOptionalDependencies(codex.directory, publish, profiles);
  assert.deepEqual(staged.optionalDependencies, { ...codexOptional, ...claudeOptional });
});

test("Codex bundles retain pinned JavaScript and delegate official consumer platform aliases without native payloads", (t) => {
  const { directory, graph, bridge, runtime, producer, nested, profiles, publish } = codexFixture(t);
  const before = [bridge, runtime].map(path => readFileSync(join(path, "package.json"), "utf8"));
  const staged = stageBundledProviderOptionalDependencies(directory, publish, profiles);
  assert.deepEqual(staged.optionalDependencies, codexOptional);
  assert.deepEqual(staged.bundleDependencies, publish.bundleDependencies);
  assert.equal(staged.paperclipProviderArtifacts, undefined);
  assert.equal(existsSync(producer), false);
  assert.equal(existsSync(nested), false, "Transitive producer platform packages must also be removed");
  assert.equal(existsSync(join(runtime, "vendor")), false, "Wrapper fallback native payload must be removed");
  assert.equal(existsSync(join(graph, "unrelated-linux-x64")), true);
  assert.equal(readFileSync(join(bridge, "package.json"), "utf8"), before[0], "The patched bridge metadata is unchanged");
  const originalRuntime = JSON.parse(before[1]); delete originalRuntime.optionalDependencies;
  assert.deepEqual(JSON.parse(readFileSync(join(runtime, "package.json"), "utf8")), originalRuntime,
    "Only the wrapper platform declarations move to the published authority root");
  assert.equal(readFileSync(join(runtime, "bin/codex.js"), "utf8"), "// official JavaScript fixture, never executed\n");
  assert.deepEqual(stageBundledProviderOptionalDependencies(directory, staged, profiles), staged);
  writeFileSync(join(directory, "package.json"), JSON.stringify(staged));
  const packs = JSON.parse(execFileSync("npm", ["pack", "--ignore-scripts", "--offline", "--json"], {
    cwd: directory, encoding: "utf8", timeout: 30_000,
    env: { ...process.env, HOME: directory, npm_config_cache: join(directory, "cache"), npm_config_update_notifier: "false" },
  }));
  const paths = packs[0].files.map(file => file.path);
  assert.ok(paths.some(path => path.endsWith("@openai/codex/bin/codex.js")), "The actual npm tarball retains its pinned JS runtime");
  assert.equal(paths.some(path => /@openai\/codex-(?:linux|darwin|win32)-|@openai\/codex\/vendor\//.test(path)), false,
    "Actual npm pack must contain no native Codex payload on any platform");
});

test("Codex bundle validation fails before deleting producer binaries for altered pins or optional declarations", (t) => {
  const { directory, runtime, producer, profiles, publish } = codexFixture(t);
  const file = join(runtime, "package.json"), original = JSON.parse(readFileSync(file, "utf8"));
  writeFileSync(file, JSON.stringify({ ...original, version: "0.156.1" }));
  assert.throws(() => stageBundledProviderOptionalDependencies(directory, publish, profiles), /runtime version mismatch/);
  writeFileSync(file, JSON.stringify({ ...original, optionalDependencies: { ...codexOptional, "@openai/codex-untrusted": "0.160.0" } }));
  assert.throws(() => stageBundledProviderOptionalDependencies(directory, publish, profiles), /not qualified/);
  writeFileSync(file, JSON.stringify(original));
  const missing = { ...original }; delete missing.optionalDependencies;
  writeFileSync(file, JSON.stringify(missing));
  assert.throws(() => stageBundledProviderOptionalDependencies(directory, publish, profiles), /not qualified/,
    "Missing wrapper declarations require the exact published-root delegation mapping");
  writeFileSync(file, JSON.stringify(original));
  assert.throws(() => stageBundledProviderOptionalDependencies(directory, { ...publish,
    optionalDependencies: { "@openai/codex-darwin-arm64": "npm:@openai/codex@0.156.1-darwin-arm64" } }, profiles), /conflicts with published/);
  assert.equal(existsSync(producer), true);
  assert.equal(readFileSync(file, "utf8"), JSON.stringify(original), "Conflicting root declarations must not normalize metadata");
});

test("Codex stripping rejects linked native payloads and wrapper fallback directories without touching external files", (t) => {
  const { directory, runtime, producer, profiles, publish, writePackage } = codexFixture(t);
  const outside = writePackage(join(directory, "outside"), { name: "@openai/codex", version: "0.160.0-linux-x64", os: ["linux"], cpu: ["x64"] });
  rmSync(producer, { recursive: true }); symlinkSync(outside, producer, "dir");
  assert.throws(() => stageBundledProviderOptionalDependencies(directory, publish, profiles), /escapes its producer graph/);
  rmSync(producer); rmSync(join(runtime, "vendor"), { recursive: true }); symlinkSync(outside, join(runtime, "vendor"), "dir");
  assert.throws(() => stageBundledProviderOptionalDependencies(directory, publish, profiles), /escapes its producer graph/);
  assert.equal(existsSync(join(outside, "package.json")), true);
});

test("Linux-produced esbuild bundles publish exact consumer platform dependencies and retain their hooks", (t) => {
  const { directory, graph, esbuild, producerBinary, publish, writePackage } = esbuildFixture(t);
  const original = readFileSync(join(esbuild, "package.json"), "utf8");
  const issuer = createRequire(join(esbuild, "package.json"));
  // The original producer-only topology cannot resolve a Mac binary. The
  // public optional declaration lets npm obtain it before offline hooks run.
  assert.throws(() => issuer.resolve("@esbuild/darwin-arm64/bin/esbuild"), /Cannot find module/);
  const staged = stageBundledEsbuildOptionalDependencies(directory, publish);
  for (const target of [...nativeTargets, "win32-x64"]) assert.equal(staged.optionalDependencies[`@esbuild/${target}`], "0.28.2");
  assert.equal(staged.optionalDependencies.unrelated, "1.0.0");
  assert.deepEqual(staged.bundleDependencies, ["acpx"]);
  assert.deepEqual(staged.dependencies, publish.dependencies);
  assert.equal(publish.optionalDependencies["@esbuild/darwin-arm64"], undefined);
  assert.equal(existsSync(producerBinary), false);
  assert.equal(existsSync(join(graph, "unrelated-linux-x64")), true);
  assert.equal(readFileSync(join(esbuild, "package.json"), "utf8"), original);
  assert.deepEqual(stageBundledEsbuildOptionalDependencies(directory, staged), staged);
  for (const target of ["darwin-arm64", "darwin-x64"]) {
    const artifact = writePackage(join(graph, `@esbuild/${target}`), {
      name: `@esbuild/${target}`, version: staged.optionalDependencies[`@esbuild/${target}`], os: ["darwin"], cpu: [target.slice(7)],
    });
    mkdirSync(join(artifact, "bin")); writeFileSync(join(artifact, "bin/esbuild"), "consumer-selected fixture; never executed");
    assert.equal(issuer.resolve(`@esbuild/${target}/bin/esbuild`), join(artifact, "bin/esbuild"));
  }
});

test("bundled esbuild rejects conflicting published or nested platform versions without removing the producer", (t) => {
  const { directory, graph, producerBinary, publish, writePackage } = esbuildFixture(t);
  assert.throws(() => stageBundledEsbuildOptionalDependencies(directory, {
    ...publish, optionalDependencies: { "@esbuild/darwin-arm64": "0.27.0" },
  }), /platform version conflicts/);
  assert.equal(existsSync(producerBinary), true);
  writePackage(join(graph, "esbuild"), { name: "esbuild", version: "0.27.0",
    optionalDependencies: Object.fromEntries(nativeTargets.map(target => [`@esbuild/${target}`, "0.27.0"])) });
  assert.throws(() => stageBundledEsbuildOptionalDependencies(directory, publish), /platform version conflicts|installed platform identity mismatch/);
  assert.equal(existsSync(producerBinary), true);
});

test("bundled esbuild rejects missing targets, altered declarations and incorrect platform identity", (t) => {
  const { directory, esbuild, producerBinary, publish } = esbuildFixture(t);
  const path = join(esbuild, "package.json"), metadata = JSON.parse(readFileSync(path, "utf8"));
  writeFileSync(path, JSON.stringify({ ...metadata, optionalDependencies: { "@esbuild/linux-x64": "0.28.2" } }));
  assert.throws(() => stageBundledEsbuildOptionalDependencies(directory, publish), /omitted a supported platform/);
  writeFileSync(path, JSON.stringify({ ...metadata, optionalDependencies: { ...metadata.optionalDependencies, "@esbuild/win32-x64": "^0.28.2" } }));
  assert.throws(() => stageBundledEsbuildOptionalDependencies(directory, publish), /exact package version/);
  writeFileSync(path, JSON.stringify(metadata));
  writeFileSync(join(producerBinary, "package.json"), JSON.stringify({ name: "@esbuild/linux-x64", version: "0.27.0" }));
  assert.throws(() => stageBundledEsbuildOptionalDependencies(directory, publish), /installed platform identity mismatch/);
  assert.equal(existsSync(producerBinary), true);
});

test("bundled esbuild cannot follow a platform payload or package namespace outside its producer graph", (t) => {
  const { directory, graph, producerBinary, publish, writePackage } = esbuildFixture(t);
  const external = writePackage(join(directory, "outside"), { name: "@esbuild/linux-x64", version: "0.28.2" });
  rmSync(producerBinary, { recursive: true }); symlinkSync(external, producerBinary, "dir");
  assert.throws(() => stageBundledEsbuildOptionalDependencies(directory, publish), /escapes its producer graph/);
  assert.equal(readFileSync(join(external, "package.json"), "utf8").includes("0.28.2"), true);
  rmSync(join(graph, "@esbuild"), { recursive: true }); symlinkSync(external, join(graph, "@esbuild"), "dir");
  assert.throws(() => stageBundledEsbuildOptionalDependencies(directory, publish), /escapes its producer graph/);
});

test("Paperclip Runner pins the qualified ACPX host callbacks", () => {
  assert.equal(rootPackage.pnpm.patchedDependencies["acpx@0.22.0"], "patches/acpx@0.22.0.patch");
  assert.equal(
    rootPackage.pnpm.patchedDependencies["@agentclientprotocol/claude-agent-acp@0.73.0"],
    "patches/@agentclientprotocol__claude-agent-acp@0.73.0.patch",
  );
  assert.equal(runnerPackage.dependencies.acpx, "0.22.0");
  assert.equal(runnerPackage.dependencies["@agentclientprotocol/claude-agent-acp"], "0.73.0");
  assert.equal(runnerPackage.dependencies["@agentclientprotocol/codex-acp"], "1.6.2");
  for (const callback of [
    "spawnAgent", "requestExtension", "protocolGuardFactory",
  ]) assert.match(acpxRuntimePatch, new RegExp(callback));
  // Moved to stock 0.22 hooks (spawnAgent, processLifecycle, onAcpMessage).
  const added = acpxRuntimePatch.split("\n").filter(line => line.startsWith("+")).join("\n");
  for (const removed of ["spawnCwd", "onAgentSpawn", "onAgentStderr", "onSessionNotification", "onClientOperation", "spawnEnvironment", "agentGoalCapability", "onAgentInitialize"]) {
    assert.doesNotMatch(added, new RegExp(removed));
  }
  assert.match(claudeAcpPatch, /usage: \{/);
  assert.match(claudeAcpPatch, /cache_creation_input_tokens/);
});

test("published packages preserve the patched embedded-postgres runtime", () => {
  assert.equal(
    rootPackage.pnpm.patchedDependencies["embedded-postgres@18.1.0-beta.16"],
    "patches/embedded-postgres@18.1.0-beta.16.patch",
  );
  assert.deepEqual(dbPackage.bundleDependencies, ["embedded-postgres"]);
  assert.equal(bundledCliNpmDependencies.has("embedded-postgres"), true);
  assert.equal(cliEsbuildConfig.external.includes("embedded-postgres"), false);
});

test("bundled package staging materializes publishConfig entrypoints", () => {
  const staged = materializePublishManifest(adapterUtilsPackage);

  assert.equal(staged.publishConfig, undefined);
  assert.equal(staged.main, "./dist/index.js");
  assert.equal(staged.types, "./dist/index.d.ts");
  assert.deepEqual(staged.exports, adapterUtilsPackage.publishConfig.exports);
});

test("bundled package staging materializes workspace dependency versions", () => {
  const staged = materializePublishManifest({
    name: "@paperclipai/example",
    version: "2026.723.0",
    dependencies: { exact: "workspace:*", caret: "workspace:^", tilde: "workspace:~" },
  });

  assert.deepEqual(staged.dependencies, {
    exact: "2026.723.0",
    caret: "^2026.723.0",
    tilde: "~2026.723.0",
  });
});

test("bundled package staging installs only dependencies included in the tarball", () => {
  const publishManifest = {
    name: "@paperclipai/db",
    version: "2026.723.0-canary.8",
    dependencies: {
      "@paperclipai/shared": "2026.723.0-canary.8",
      "drizzle-orm": "^0.45.2",
      "embedded-postgres": "^18.1.0-beta.16",
    },
    devDependencies: {
      "@paperclipai/paperclip-runner": "2026.723.0-canary.8",
    },
    bundleDependencies: ["embedded-postgres"],
  };
  const installManifest = createBundledInstallManifest(publishManifest, ["embedded-postgres"]);

  assert.deepEqual(installManifest.dependencies, {
    "embedded-postgres": "^18.1.0-beta.16",
  });
  assert.equal(installManifest.devDependencies, undefined);
  assert.deepEqual(publishManifest.devDependencies, {
    "@paperclipai/paperclip-runner": "2026.723.0-canary.8",
  });
  assert.deepEqual(installManifest.bundleDependencies, ["embedded-postgres"]);
});

test("bundled package staging selects only the installed dependency version's patch", (t) => {
  const destinationDir = mkdtempSync(join(tmpdir(), "paperclip-bundled-patch-selection-"));
  const installedPackageDir = join(destinationDir, "node_modules", "acpx");
  mkdirSync(installedPackageDir, { recursive: true });
  writeFileSync(
    join(installedPackageDir, "package.json"),
    JSON.stringify({ name: "acpx", version: "0.12.0" }),
  );
  t.after(() => rmSync(destinationDir, { recursive: true, force: true }));

  assert.deepEqual(
    selectBundledDependencyPatches(destinationDir, ["acpx"], {
      "acpx@0.12.0": "patches/acpx@0.12.0.patch",
      "acpx@0.13.1": "patches/acpx@0.13.1.patch",
    }),
    [
      {
        packageName: "acpx",
        specifier: "acpx@0.12.0",
        patchPath: "patches/acpx@0.12.0.patch",
      },
    ],
  );
});

test("bundled package patch selection handles scoped package names", (t) => {
  const destinationDir = mkdtempSync(join(tmpdir(), "paperclip-scoped-patch-selection-"));
  const installedPackageDir = join(destinationDir, "node_modules", "@example", "runtime");
  mkdirSync(installedPackageDir, { recursive: true });
  writeFileSync(
    join(installedPackageDir, "package.json"),
    JSON.stringify({ name: "@example/runtime", version: "1.2.3" }),
  );
  t.after(() => rmSync(destinationDir, { recursive: true, force: true }));

  assert.deepEqual(
    selectBundledDependencyPatches(destinationDir, ["@example/runtime"], {
      "@example/runtime@1.2.3": "patches/runtime@1.2.3.patch",
      "@example/runtime@2.0.0": "patches/runtime@2.0.0.patch",
    }),
    [
      {
        packageName: "@example/runtime",
        specifier: "@example/runtime@1.2.3",
        patchPath: "patches/runtime@1.2.3.patch",
      },
    ],
  );
});

test("bundled package patch selection reports missing installed metadata", (t) => {
  const destinationDir = mkdtempSync(join(tmpdir(), "paperclip-missing-patch-metadata-"));
  t.after(() => rmSync(destinationDir, { recursive: true, force: true }));

  assert.throws(
    () =>
      selectBundledDependencyPatches(destinationDir, ["acpx"], {
        "acpx@0.12.0": "patches/acpx@0.12.0.patch",
      }),
    /Cannot select a patch for bundled dependency acpx: failed to read/,
  );
});

test("bundled package patch selection rejects an unpatched installed version", (t) => {
  const destinationDir = mkdtempSync(join(tmpdir(), "paperclip-unmatched-patch-version-"));
  const installedPackageDir = join(destinationDir, "node_modules", "acpx");
  mkdirSync(installedPackageDir, { recursive: true });
  writeFileSync(
    join(installedPackageDir, "package.json"),
    JSON.stringify({ name: "acpx", version: "0.14.0" }),
  );
  t.after(() => rmSync(destinationDir, { recursive: true, force: true }));

  assert.throws(
    () =>
      selectBundledDependencyPatches(destinationDir, ["acpx"], {
        "acpx@0.12.0": "patches/acpx@0.12.0.patch",
        "acpx@0.13.1": "patches/acpx@0.13.1.patch",
      }),
    /installed acpx@0\.14\.0, but configured patches are acpx@0\.12\.0, acpx@0\.13\.1/,
  );
});

test("server package staging applies every bundled runtime patch and preserves the vendored runner", (t) => {
  const fixtureDir = realpathSync(mkdtempSync(join(tmpdir(), "paperclip-bundled-stage-")));
  const sourceDir = join(fixtureDir, "source");
  const destinationDir = join(fixtureDir, "destination");
  const binDir = join(fixtureDir, "bin");
  const callLog = join(fixtureDir, "calls.log");
  const fixtureSourceRoot = join(fixtureDir, "repo");
  const fixtureArtifacts = join(fixtureDir, "native-artifacts");
  mkdirSync(sourceDir);
  mkdirSync(join(sourceDir, "dist"));
  writeFileSync(join(sourceDir, "dist", "index.js"), "export {};\n");
  mkdirSync(destinationDir);
  mkdirSync(binDir);
  writeFileSync(
    join(sourceDir, "package.json"),
    JSON.stringify({ ...serverPackage, files: ["dist"] }),
  );
  writeFileSync(callLog, "");
  mkdirSync(fixtureArtifacts);
  const nativePackage = join(fixtureArtifacts, "@openai/codex-linux-x64");
  mkdirSync(join(nativePackage, "vendor"), { recursive: true });
  writeFileSync(join(nativePackage, "package.json"), JSON.stringify({ name: "@openai/codex", version: "0.160.0-linux-x64", os: ["linux"], cpu: ["x64"] }));
  writeFileSync(join(nativePackage, "vendor/codex"), "producer host fixture; never executed");
  mkdirSync(join(fixtureSourceRoot, "packages/paperclip-runner/src/drivers/acpx"), { recursive: true });
  writeFileSync(join(fixtureSourceRoot, "package.json"), JSON.stringify(rootPackage));
  writeFileSync(join(fixtureSourceRoot, "packages/paperclip-runner/acpx-profiles.json"), JSON.stringify(profileData));
  mkdirSync(join(fixtureSourceRoot, "patches"));
  for (const patchPath of Object.values(rootPackage.pnpm.patchedDependencies)) {
    writeFileSync(join(fixtureSourceRoot, patchPath), readFileSync(new URL(`../${patchPath}`, import.meta.url)));
  }
  t.after(() => rmSync(fixtureDir, { recursive: true, force: true }));

  const writeExecutable = (name, body) => {
    writeFileSync(join(binDir, name), body, { mode: 0o755 });
  };
  writeExecutable(
    "pnpm",
    `#!/usr/bin/env bash
set -euo pipefail
printf 'pnpm %s\\n' "$*" >> "$FAKE_CALL_LOG"
destination="\${!#}"
cp "$FAKE_SOURCE_PACKAGE" "$destination/package.json"
mkdir -p "$destination/node_modules/.pnpm"
`,
  );
  writeExecutable(
    "npm",
    `#!/usr/bin/env bash
set -euo pipefail
printf 'npm %s\\n' "$*" >> "$FAKE_CALL_LOG"
[ "$*" = "install --omit=dev --ignore-scripts --no-audit --no-fund" ]
node -e 'const fs = require("node:fs"); const pkg = require("./package.json"); if ("devDependencies" in pkg) process.exit(1); for (const [name, version] of Object.entries(pkg.dependencies)) { const dir = "node_modules/" + name; fs.mkdirSync(dir + "/dist", { recursive: true }); fs.writeFileSync(dir + "/package.json", JSON.stringify({ name, version })); } for (const [bridge, runtimes] of Object.entries(pkg.overrides ?? {})) { for (const [name, version] of Object.entries(runtimes)) { const dir = "node_modules/" + name; fs.mkdirSync(dir, { recursive: true }); const native = name === "@openai/codex"; const targets = ["linux-x64","linux-arm64","darwin-x64","darwin-arm64","win32-x64","win32-arm64"]; const optionalDependencies = native ? Object.fromEntries(targets.map(target => [name+"-"+target,"npm:"+name+"@"+version+"-"+target])) : name === "@anthropic-ai/claude-agent-sdk" ? Object.fromEntries([...targets,"linux-x64-musl","linux-arm64-musl"].map(target => [name+"-"+target,version])) : undefined; fs.writeFileSync(dir + "/package.json", JSON.stringify({ name, version, optionalDependencies })); } }'
node -e 'const fs=require("node:fs");fs.cpSync(process.env.FAKE_NATIVE_ARTIFACTS+"/@openai/codex-linux-x64","node_modules/@openai/codex-linux-x64",{recursive:true});fs.mkdirSync("node_modules/@openai/codex/vendor",{recursive:true});fs.writeFileSync("node_modules/@openai/codex/vendor/codex","producer fallback fixture");'
mkdir -p node_modules/acpx/dist
node -e 'const fs=require("node:fs");fs.mkdirSync("node_modules/esbuild",{recursive:true});fs.writeFileSync("node_modules/esbuild/package.json",JSON.stringify({name:"esbuild",version:"0.28.2",scripts:{postinstall:"node install.js"},optionalDependencies:Object.fromEntries(["linux-x64","darwin-arm64","darwin-x64"].map(target=>["@esbuild/"+target,"0.28.2"]))}));fs.mkdirSync("node_modules/@esbuild/linux-x64",{recursive:true});fs.writeFileSync("node_modules/@esbuild/linux-x64/package.json",JSON.stringify({name:"@esbuild/linux-x64",version:"0.28.2",os:["linux"],cpu:["x64"]}));'
printf 'unpatched runtime\\n' > node_modules/acpx/dist/runtime.js
printf '{"name":"acpx","version":"0.22.0"}\\n' > node_modules/acpx/package.json
`,
  );
  writeExecutable(
    "patch",
    `#!/usr/bin/env bash
set -euo pipefail
printf 'patch %s\\n' "$*" >> "$FAKE_CALL_LOG"
target=""
while [ "$#" -gt 0 ]; do
  if [ "$1" = "-d" ]; then
    target="$2"
    shift 2
  else
    shift
  fi
done
patch_input="$(cat)"
printf '%s\\n' "$patch_input" > "$target/applied.patch"
if [[ "$target" != */acpx ]]; then
  exit 0
fi
grep -q requestExtension <<< "$patch_input"
grep -q spawnAgent <<< "$patch_input"
printf 'patched requestExtension runtime\\n' > "$target/dist/runtime.js"
`,
  );

  execFileSync(
    process.execPath,
    [
      "--input-type=module", "-e",
      `import { prepareBundledPackage } from ${JSON.stringify(new URL("./prepare-bundled-package.mjs", import.meta.url).href)}; prepareBundledPackage(process.argv[1], process.argv[2], { sourceRoot: process.argv[3] });`,
      sourceDir,
      destinationDir,
      fixtureSourceRoot,
    ],
    {
      env: {
        ...process.env,
        PATH: `${binDir}:${process.env.PATH}`,
        FAKE_CALL_LOG: callLog,
        FAKE_SOURCE_PACKAGE: join(sourceDir, "package.json"),
        FAKE_NATIVE_ARTIFACTS: fixtureArtifacts,
      },
      stdio: "pipe",
    },
  );

  const stagedAcpxDir = join(destinationDir, "node_modules/acpx");
  assert.equal(lstatSync(stagedAcpxDir).isDirectory(), true);
  assert.equal(lstatSync(stagedAcpxDir).isSymbolicLink(), false);
  assert.equal(existsSync(join(destinationDir, "node_modules/.pnpm")), false);
  const stagedManifest = JSON.parse(readFileSync(join(destinationDir, "package.json"), "utf8"));
  for (const [name, version] of Object.entries({ ...codexOptional, ...claudeOptional })) {
    assert.equal(stagedManifest.optionalDependencies[name], version);
    assert.equal(existsSync(join(destinationDir, "node_modules", name)), false);
    assert.equal(stagedManifest.bundleDependencies.includes(name), false);
  }
  assert.equal(existsSync(join(destinationDir, "node_modules/@openai/codex/vendor")), false);
  assert.equal(stagedManifest.paperclipProviderArtifacts, undefined);
  assert.equal(JSON.parse(readFileSync(join(destinationDir, "node_modules/@openai/codex/package.json"), "utf8")).optionalDependencies, undefined);
  assert.equal(stagedManifest.optionalDependencies["@esbuild/darwin-arm64"], "0.28.2");
  assert.equal(stagedManifest.optionalDependencies["@esbuild/darwin-x64"], "0.28.2");
  assert.equal(existsSync(join(destinationDir, "node_modules/@esbuild/linux-x64")), false);
  assert.equal(JSON.parse(readFileSync(join(destinationDir, "node_modules/esbuild/package.json"))).scripts.postinstall, "node install.js");
  assert.match(
    readFileSync(join(stagedAcpxDir, "dist/runtime.js"), "utf8"),
    /requestExtension/,
  );
  assert.match(
    readFileSync(callLog, "utf8"),
    /patch -p1 --forward -d .*node_modules\/acpx/,
  );
  const patchedBundledDependencies = serverPackage.bundleDependencies.filter(name => rootPackage.pnpm.patchedDependencies[`${name}@${serverPackage.dependencies[name]}`]);
  assert.equal(
    readFileSync(callLog, "utf8")
      .split("\n")
      .filter((line) => line.startsWith("patch ")).length,
    patchedBundledDependencies.length,
  );
  for (const name of patchedBundledDependencies) {
    const specifier = `${name}@${serverPackage.dependencies[name]}`;
    const patchPath = rootPackage.pnpm.patchedDependencies[specifier];
    assert.equal(
      readFileSync(
        join(destinationDir, "node_modules", name, "applied.patch"),
        "utf8",
      ),
      `${readFileSync(new URL(`../${patchPath}`, import.meta.url), "utf8").trimEnd()}\n`,
      `${specifier} receives its own full configured patch`,
    );
  }
});

test("bundled package dry runs preview without querying published versions", () => {
  assert.match(releaseScript, /run_bundled_npm_pack pack --pack-destination "\$publish_dir"/);
  assert.match(releaseLib, /BUNDLED_NPM_PACK_VERSION="10\.9\.7"/);
  assert.match(releaseLib, /BUNDLED_NPM_PUBLISH_VERSION="11\.18\.0"/);
  assert.match(
    releaseLib,
    /npx --yes "npm@\$BUNDLED_NPM_PACK_VERSION" "\$@" --ignore-scripts/,
  );
  assert.match(
    releaseLib,
    /npx --yes "npm@\$BUNDLED_NPM_PUBLISH_VERSION" "\$@" --ignore-scripts/,
  );
  assert.match(releaseLib, /"\$@" --ignore-scripts --loglevel verbose/);
  assert.match(releaseLib, /run_bundled_npm_publish publish --tag "\$dist_tag"/);
  assert.doesNotMatch(releaseLib, /run_bundled_npm_publish publish "\.\/\$tarball"/);
});

test("npm builds use corepack instead of requiring a global pnpm", () => {
  assert.match(buildNpmScript, /corepack pnpm -r typecheck/);
  assert.doesNotMatch(buildNpmScript, /^\s*pnpm -r typecheck/m);
});