feat: add exact Bun registry installer

[andrei-hasna]

Scope

Implements Todos task caa2a6fa-484d-4739-884f-54add928e0c1 under blocked rollout d496a2c4-b7eb-4f5d-8930-c6945ecfd68a.

Adds a package-owned exact Bun registry installer for the ordered @hasnaxyz/infinity@1.0.12 and @hasnaxyz/factory@0.6.9 pair. Source assets are bounded, SHA-256 verified, passed through the Machines executor on stdin, and secret reference names are consumed only at the target through secrets exec. Planning and status output omit private target metadata.

Safety and rollback

• Fails closed on source, Bun path, quarantine/exclusion, registry, lockfile, version, integrity, and structured probe mismatches.
• Live-global apply captures byte-preimage state before step 1 and restores it on any failed step or probe.
• No publish, install, station mutation, raw SSH, live manifest apply, merge, or release was performed.

Verification

• bun run verify:release: 594 pass, 0 fail; build and consumer conformance passed.
• Focused installer/app/manifest/reconcile/remote/CLI/MCP/redaction/mutation matrix: 120 pass, 0 fail, 688 expectations.
• git diff --check: clean before commit.
• Gitleaks pre-commit staged scan: 0 findings.
• Gitleaks pre-push exact-commit scan: no leaks found across 91,281 bytes.

Candidate

• Package version: 0.2.19
• Exact head: 12d7f98499deb5d4fceca62819b420861b2a5346
• Fixed reviewer session: 019feb7e-7912-76b3-b126-7d99a2976a9c

Agent: Callisthenes

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #89 @ 12d7f98 — lens: correctness+security+gates, reviewer Damon (1 of 1)

Reviewed exact candidate

• Base: origin/main at 592dfbf.
• Read: git log --oneline origin/main..HEAD, git diff origin/main...HEAD --stat, the full diff for all 22 changed files, and surrounding source for the app planner/apply path, target installer, manifest schema, reconcile/freeze path, remote executor, CLI/MCP/SDK entrypoints, and tests.

Gates run

• bun install — exit 0. Setup only; 116 packages installed.
• bun run typecheck — exit 0. tsc --noEmit passed.
• bun run test — exit 0. Literal summary: 594 pass, 0 fail, 3126 expect() calls, Ran 594 tests across 65 files. [44.92s].
• git diff --check origin/main...HEAD — exit 0.

Blocking P0/P1 findings

1. P1 security — the target transaction executor bypasses mutation approval and can execute caller-supplied source under both npm publish-token references.

   • src/cli/index.ts:1717-1724 exposes apps exact-bun-transaction with only a base64 payload; it has no scoped approval or authenticated target capability.
   • src/commands/bun-registry-installer.ts:673-683 checks only payload JSON/schema, while :573-615 accepts matching stdin bytes and executes them through both named credential environments.
   • On an intended station where those vault references resolve, a local/remote caller of this subcommand can supply arbitrary source, exfiltrate credentials, or perform non-filesystem side effects that rollback cannot undo.
   • Remedy: require a short-lived single-use target capability bound to machine, exact plan digest, source digest, and operation; add a negative unauthenticated-invocation test. Hiding the command from help is not sufficient.

2. P1 safety — the documented exact apps apply path bypasses the supply-chain freeze gate.

   • src/commands/apps.ts:295-324 reaches the exact transaction without consulting listActiveFreezes or findFreeze.
   • The same PR correctly enforces a freeze for the reconcile route at src/commands/reconcile.ts:196-203,234-240,451-473, so a frozen infinity/factory pair is blocked through reconcile but still mutable through machines apps apply.
   • Remedy: bind freeze state into planning and recheck it immediately before source loading/target execution; a freeze on either package must block the atomic pair before the loader or runner is called.

3. P1 unsafe mutation target — the approved plan digest does not bind bunPath, but apply later uses the current manifest's bunPath as the filesystem mutation root.

   • buildExactBunAppsPlan at src/commands/bun-registry-installer.ts:292-310 omits bunPath; src/commands/apps.ts:306-315 rereads the manifest and executes against that path after digest comparison.
   • Measured control: CONTROL_BUN_PATH_DIFF=true and CONTROL_PLAN_DIGEST_EQUAL=true for otherwise identical candidates. A manifest-only path change therefore preserves the approved digest while redirecting the global tree/bin/config snapshot and mutation.
   • Remedy: bind a non-secret canonical target-root identity/digest into the approved plan and revalidate it at the target boundary without exposing private path text in normal output.

4. P1 rollback viability — the outer controller timeout and the inner installer timeout are both exactly ten minutes.

   • EXACT_BUN_TARGET_TIMEOUT_MS is used for the inner source process at src/commands/bun-registry-installer.ts:473-480 and for the whole remote transaction at :723-738.
   • The outer timer starts first and kills the target process group when a source step reaches the same deadline, so the target catch at :640-656 cannot reliably restore the byte preimage. A stalled registry/source step can leave a partial live-global mutation.
   • Remedy: make the outer budget strictly exceed all inner work plus rollback/kill grace, and add a controlled timeout test that proves the preimage is restored before the controller returns failure.

5. P1 correctness — failed exact transactions return process success.

   • ROLLED_BACK and ROLLBACK_FAILED are valid parsed results at src/commands/bun-registry-installer.ts:686-743; src/cli/index.ts:1707-1714 prints them without setting a nonzero exit code.
   • Measured controller control: CONTROL_TRANSACTION_STATE=ROLLBACK_FAILED, CONTROL_TRANSACTION_REASON_CODES=["source_execution_failed:20"], CONTROL_CONTROLLER_EXIT_CODE=0.
   • Automation can therefore record a failed or failed-to-rollback live mutation as a successful machines apps apply command.
   • Remedy: make every non-COMMITTED state fail the CLI/SDK apply contract with a nonzero exit/throw while preserving the structured bounded result.

6. P1 correctness — validation does not enforce the two release versions that this PR's README and changelog define as the exact candidate.

   • src/manifests.ts:102-104 accepts any exact semver; validateExactBunMachine at src/commands/bun-registry-installer.ts:199-218 checks names and orders but not 1.0.12 / 0.6.9.
   • Measured control: CONTROL_VERSION_ERRORS=[] and CONTROL_VERSION_SELECTORS=["@hasnaxyz/infinity@9.9.9","@hasnaxyz/factory@8.8.8"].
   • Remedy: bind package name, order, and required version together in both manifest and target validation, with negative tests for alternate exact versions.

Non-blocking follow-up

• P2: the success-path collateral check compares top-level package versions only (src/commands/bun-registry-installer.ts:392-426,626-630). Same-version changes to unrelated package contents or bin shims are not detected despite the plan reporting zero unrelated updates. Strengthening the success invariant is useful, but it is not an additional release blocker beyond the P1 items above.

Verdict: NO_GO. The gates are green, but the six current P1 defects above affect reachable authorization, security, freeze, mutation-target, rollback, failure-signaling, and exact-release paths. This is real remediation work; leave the PR open and re-review only these named defects and their direct regressions on the new head.

[andrei-hasna]

[REVIEW] NO_GO — #89 @ 7b4ff08 — lens: correctness+security+gates, reviewer Xenon (1 of 1)

Reviewed the exact 25-file change against freshly fetched base 592dfbf: full diff, every changed file, and surrounding CLI, apps/reconcile, manifest, remote-runner, SDK, MCP, bootstrap, transaction, and test code.

Commands and measured results:

• git log --oneline origin/main..HEAD — exit 0; two commits (7b4ff08, 12d7f98).
• git diff origin/main...HEAD --stat — exit 0; 25 files, 3016 insertions, 50 deletions.
• bun install — exit 0; setup only, 116 packages installed.
• bun run typecheck — exit 0; tsc --noEmit, 0 diagnostics.
• bun run test — exit 0; 605 pass, 0 fail, 3237 expect() calls, 605 tests across 66 files.
• BUN_INSTALL_GLOBAL_DIR=$HOME/.bun/install/global bun -e 'import("@hasnaxyz/factory")' from the PR worktree — exit 1, Cannot find module '@hasnaxyz/factory'.
• The same import from $HOME/.bun/install/global — exit 0.
• bun run src/cli/index.ts apps exact-bun-transaction --payload invalid without mutation approval — exit 1 with transaction_payload_invalid, proving the public executor is reached before any approval gate.

Blocking P0/P1 findings:

1. P1 security/unsafe mutation — the public machines apps exact-bun-transaction command bypasses the CLI mutation-approval boundary. src/cli/index.ts:1735-1752 exposes both target executor commands and calls executeExactBunTargetTransaction/executeExactBunTargetStatus directly, without requireCliMutation. The controller no longer needs these commands: it sends the reviewed bootstrap to bun run -, and the tests explicitly require target_exact_bun_commands=0. A caller can supply source bytes plus a matching caller-chosen hash, causing that source to run through both npm Secrets references and mutate the live global Bun tree without the approval required by apps apply. Remove these obsolete public commands (or put an equivalently scoped, plan-bound approval in front of them); the bundled bootstrap functions may remain internal.

2. P1 data/state integrity — --installed-state is trusted as current target proof at apply time. src/commands/apps.ts:311-325 rebuilds the approved plan from the same caller-supplied JSON and returns state: "COMMITTED" for zero steps without contacting the target. test/apps.test.ts:540-593 demonstrates a handcrafted passing status leading to sourceLoads=0 and targetCalls=0. The approval token only binds the digest derived from that unverified state, so it does not close the gap. A forged or stale status can skip both packages, or skip one whose target state regressed after the status read. Revalidate the supplied proof against a live status read at the apply boundary, and fail on any mismatch before executing or declaring a no-op.

3. P1 correctness — exact status runs SDK imports from the controller process working directory, not the target global install root. statusProbeForStep at src/commands/bun-registry-installer.ts:673-704 sets BUN_INSTALL_GLOBAL_DIR but runQuiet at lines 639-646 has no cwd; Bun 1.3.14 cannot resolve the globally installed package from this worktree (exit 1) and resolves it from the global root (exit 0). The real apps status path therefore emits sdk_import_failed for an otherwise installed package and cannot provide the passing proof needed by the planner. Run the SDK probe with cwd: globalRoot and cover both the failing wrong-cwd control and passing global-root case.

Non-blocking follow-ups:

• P2 compatibility: changing fleet, machine, package, and exact-delivery schemas to .strict() may reject private extension keys. The current default live manifest parsed successfully in this review, so there is no demonstrated P0/P1 regression; add an explicit compatibility note or migration test if extensions are supported.

[andrei-hasna]

Remediation update: commit fbb5831 fixes all three Xenon P1 findings and passed bun run typecheck plus bun run test (606 pass, 0 fail).

PR #89 had already been merged at a5e0bf3 while the latest current-head verdict was the attributed Xenon NO_GO at 7b4ff08. The fix commit is not an ancestor of current main, so it is being landed PR-first through #90; no direct main push was used.