Native bunx/install: verify platform and integration parity

Follow-up to #66 and #508. The original missing native x and Pantry-backed install dispatch are implemented and verified on Darwin. This issue remains open for platform/integration verification and wider installer parity; passing local bins alone was not used as proof of installation.

Published native checkpoint

Published 3be72ca5b on codex/runtime-port as Chris Breuer, with no coauthors; not merged to main.

• Native bunx and the real native install chain now execute in Home, including missing-package downloads, dependencies, bin/cache selection, copied aliases and leading --bun x.
• Full unchanged bun-run: 291 pass / 0 fail / 416 assertions, resolving all three remaining rewrite cases from the 288/3 parent.
• Full unchanged bunx with an isolated PATH and node/bun hard links to the exact Home binary: 33 pass / 1 Windows-only skip / 0 fail / 161 assertions. No installed Node/Bun runtime executes those JavaScript children.
• Ordinary PATH bunx is 32 pass / 1 skip / 1 fail, because the installed claude command satisfies binary lookup before the alias test reaches its mock registry. Pinned Bun reproduces this failure and passes the isolated alias control. An earlier symlink-only Home PATH run also retains its cowsay/yargs basename failure; the successful hard-link run does not alter runtime values or package source.
• Native installation/analyzer/credential/cache safety/runtime-auto-install regression passes normally and with VM destruction/JSC checks. Upstream add --analyze: 1 pass / 18 assertions. Unchanged workspace suites: 58/58 / 192 assertions.
• Native build 17/17; runtime units 1,820 pass / 19 skips / 0 failures, 19/19 steps; regression commands 56/56, including 25 native files, full spawn 126 pass / 5 skips / 5,484 assertions and child-process 32 pass / 1 skip / 1 TODO / 72 assertions.
• All 33 measured upstream source files match pin 4982b91e3702094330f3be3883354c52b8c01323. The unchanged test's regenerated tarball was archived, normalized contents checked, and the pinned fixture restored. No upstream assertion, workload or deadline changed.

The hash-verification panic was fixed with the actual legacy Wyhash11 implementation, preserving the assertion. Saved registry tokens now obey the pin's host/transport isolation rule. Angular's original five-minute timeout was caused by a no-op HTTP initializer in runtime auto-install; the real owned HTTP thread is now used and the unchanged Angular test passes.

Darwin verification only. Skips/TODOs, other platforms, branch integration, other installer features and full source ownership remain unverified. The complete port and 100% logical Bun-suite parity remain unfinished. Related: #66, #508, #518, #519; optional config scanning is #517.

Evidence and execution boundaries are recorded in docs/docs/NATIVE_RUNTIME_BINDINGS.md, zig-out/bunx-publication21.json, bunx-source-integrity21.json, bunx-regression21s.json, bunx-unit21.{log,json}, bunx-corpus-candidate21-native-hardlinks.json, and package-wide-bunx-candidate21.json. Binary SHA-256: b57fad4dfb9c8cf03a79da23f782e3bf18c3d1d7539df9036b8b1fd73b90b852. Earlier disk/build/hash/timeout failures remain recorded, not counted as passes.

Resolver and initialization follow-up

9b3a5c1ad publishes #525: unchanged tsconfig-override now passes 6/6 and resolver passes 39 tests (2 skips, 1 TODO), with repeated native initialization errors catchable. Bun-run remains 291/291, bunx retains 33 passes plus the Windows skip, and all 21 config controls still match. #526 separately tracks the reproduced EOF-delimited registry-response pending-task assertion; it remains unfixed in this candidate. See #66 for full verification and platform/integration limits.

Additional source audit while verifying #519: activating the owned BunxCommand.exec is necessary but not sufficient for native install parity. Its missing-package path launches selfExePath(), "add", ... with BUN_INTERNAL_BUNX_INSTALL=true (packages/runtime/src/runtime/cli/bunx_command.zig). Home's current add/install branches in src/main.zig route to Pantry. Thus successful local/cached binaries and dependency-parser errors would prove only those paths, not the install path.

The owned InstallCommand and PackageManager implementation exist, but their presence is not execution evidence. This issue's acceptance retains the real install chain: use an isolated loopback registry and cache, verify the Home-owned installer path and child executable identity, and explicitly report any remaining Pantry/installed-Bun delegation. Do not classify the entire bunx feature complete from resolving the three malformed-spec bun-run cases. No bunx source changes have been made in the current workspace-filter tranche. Related: #66, #508, #519.

Native bunx / installer implementation is in progress after published checkpoint 7286e0f297526e1fa6a9f2977caed4e6f352a6fd (still the verified baseline).

The working tree now routes strict-native x, copied bunx/homex, add, and install to Home-owned code. It also brings in pinned cache-root/bin trust checks. The install analyzer is being separated from application-build dispatch while retaining the normal dependency parse/link pipeline; patch creation is being adapted to Home’s synchronous process interface.

This is not yet a passing checkpoint: the newly reachable installer is still being brought through compilation, with each failed build retained under zig-out/bunx-build*.{log,json}. No new binary or suite pass is being claimed. An isolated loopback-registry regression has been written to require actual manifest/tarball downloads, dependency installation, native executable identity, cache reuse, copied-executable self-installation, and unsafe-cache rejection. It fails on the published baseline as expected and has not yet passed on a candidate.

The unchanged upstream bunx suite includes a global /tmp cleanup. Its runner now refuses to start if that cleanup would touch any pre-existing matching paths; upstream source/assertions/timeouts remain unchanged. Related tracking: #508 and #66.

Local execution has recovered after filesystem exhaustion, with about 20 GiB free. All 20 owned port inputs still match the saved build-17 snapshot. The published 7286e0f297526e1fa6a9f2977caed4e6f352a6fd control binary was rechecked by SHA-256 and retained.

Correction to the prior evidence note: bunx-build17 exited 1 after 177.95 seconds, but its JSON report could not be saved (ENOSPC) and its log is empty. This failed attempt is now explicitly recorded in zig-out/bunx-build17-recovered.json; it is not evidence of successful compilation. Its incomplete object was removed only after confirming no open handles. The duplicate installed zig-out/bin/home-debug had also been removed after verifying it matched the retained control, so test runners must wait for a valid rebuild.

Build 18 is running from the unchanged port sources. No native bunx candidate has passed verification yet, and no unverified code has been committed or pushed. The strict-native unchanged bunx baseline remains 0 pass / 33 fail / 1 skip, 56 assertions; the separate bun-run baseline is 288 pass / 3 fail. After the build: real loopback-registry installation/cache/bin tests, unchanged upstream suites, dependency analysis, and broad runtime regression/unit checks. Related: #66, #508.

Candidate build 18 is the first valid native bunx/installer build: 17/17 build steps, native VM smoke passed, executable SHA-256 59e83c63d2ad384f73a6b695ceac55ec85bbcf6da5ea16b06f9e8f0e4a469cbc (177,142,456 bytes).

The full unchanged bun-run.test.ts now passes 291/291, 416 assertions, 4.19 seconds (previous checkpoint: 288 pass / 3 fail). This resolves the three malformed-spec dispatch cases on this candidate, but is not complete bunx/installer parity.

The real loopback-registry regression failed during lockfile saving after dependency resolution/download/extraction, at the existing Lockfile.verifyData package-name hash assertion. The assertion is retained. Source audit against pin 4982b91e3702094330f3be3883354c52b8c01323 found two Home aliases incorrectly binding Wyhash11 to the current standard-library Wyhash. Bun uses its retained legacy implementation; the unnamed root package's required zero hash exposes the mismatch. Build 19 replaces those aliases with the existing owned legacy implementation and adds a concrete empty-name hash assertion to the existing unit test.

Build 19 and all subsequent runtime verification remain pending; no code from this tranche has been committed or pushed. Evidence: zig-out/bunx-build18.{log,json}, zig-out/bunx-build18-binary.json, zig-out/package-wide-bunx-candidate18.json, zig-out/bunx-native-candidate18.json, zig-out/bunx-legacy-hash-pin.json. Related tracking: #508, #66.

Unpublished native bunx checkpoint (candidate 19; published branch still 7286e0f):

• Debug build: 17/17 steps plus real native VM smoke passed.
• Real local-registry package installation, dependency download, cache execution, copied bunx alias, cache safety checks, and both add --analyze / install --analyze passed.
• The unchanged upstream bunx corpus now reports 23 pass, 10 fail, 1 skip, 5 errors, 129 assertions. Angular retained its original 300,000 ms deadline and timed out; this is a failure, not a pass.
• Two failures are leading --bun x dispatch. A fix is written and rebuilding.
• Mock-registry failures exposed a missing pinned Rust security change: saved registry tokens must not follow a registry override to another host or an HTTPS downgrade. The stale Zig implementation forwarded the token. The exact pinned Rust host/transport check is now ported, with synthetic-credential tests being built. No saved credential values are included in logs or reports.
• The pinned release control (1.4.0-canary.1+4982b91e3) passes the selected mock-registry test (1 pass, 7 assertions) in the same environment. This is control evidence only, not Home coverage.
• Angular’s sampled native stack is waiting for dependency resolution; investigation continues. No timeout/assertion changes or runtime delegation were introduced.

Related: #66, #508. No commit/push of this tranche yet; the wider Bun port remains incomplete.

Pantry reuse checkpoint for #66: user-facing home add/install/remove/update/outdated/audit remains intentionally Pantry-backed; Home's private native installer remains limited to strict Bun compatibility execution. Pantry main now includes 3afa6ccd1, authored and committed by Chris Breuer with no coauthors.

The change makes delegated package.json installs fail closed. A missing Bun/pnpm/Yarn/npm executable, spawn failure, signal termination, or non-zero child exit is no longer collapsed into “nothing to do”: fast-path, ordinary-project, and workspace pantry install return non-zero and never write the JS-install marker. Package.json dependencies continue to be delegated exactly once to the project-selected manager, while explicit Pantry/system dependencies remain native Pantry work.

Darwin verification:

• Pantry Zig suite: 36/36 build steps succeeded.
• Documentation contracts: 4 pass / 0 fail.
• Real Pantry CLI black-box: fake npm exit 42 produces Pantry exit 1, JavaScript dependency installation failed: JsInstallFailed, and no marker; fake npm success produces exit 0 and the marker.
• The same fixture through /Users/chris/Code/Home/lang/zig-out/bin/home-debug install --quiet produces the exact 1/0 boundary, proving Home forwards Pantry's result rather than masking it.
• zig fmt --check and git diff --check passed.

No Home source change was needed for this checkpoint. #518 remains open for its stated cross-platform and broader bunx/install integration scope; this result specifically hardens the Pantry reuse boundary requested for package-manager work.

A new full-VM installer checkpoint is published on main via 988b757fc.

Home now exposes the real bun:internal-for-testing.npm_manifest_test_helpers.parseManifest binding instead of the no-op export. Reaching it also ported the dormant function to current Zig filesystem/list APIs. With #618 provisioning in place, the unchanged Verdaccio-backed lifecycle file improves from 24 pass / 36 fail to 48 pass / 12 fail / 699 assertions in both Debug and ReleaseFast.

The remaining 12 are now narrowly classified:

• #642 — four bun pm trust / pm untrusted command and re-trust failures.
• #643 — seven exact identity, collision, alias, transitive-source, binary-lock, and canonical-tarball trust failures.
• #644 — one temporary node-gyp wrapper failure because the child cannot resolve the active runtime executable.

The other 48 cases exercise real root/workspace/dependency lifecycle ordering, trusted/untrusted installation, default trust, git/file packages, node-gyp generation, concurrency, stdout/stderr inheritance, ignore-scripts, and stress behavior through the unchanged workload.

Verification also includes Debug and ReleaseFast builds plus the complete runtime unit target at 1,824 pass / 19 existing Zig skips / 0 fail. No corpus fixture, assertion, deadline, environment rewrite, or installed-Bun delegation was added. #518 stays open for its broader installer scope.

Bun lifecycle parity advanced on main via 7774c52 and 78cad9f. Native pm trust/untrusted/default-trusted and native remove are wired through the owned package manager, and temporary Bun/node shims now share the active PATH directory. Debug and ReleaseFast focused coverage is 5/5 with 100 assertions; the unchanged full lifecycle file is 54/60 with 758 assertions. #642 and #644 are closed; the six residual exact trust-identity/source failures remain isolated in #643. Runtime units remain 1,824 passed / 19 existing skips / 0 failed.

Installer/lifecycle parity checkpoint from df4dff8: the unchanged bun-install-lifecycle-scripts.test.ts file is now 60/60 with 808 assertions and 0 failures in both Debug and ReleaseFast, up from 54/60. This closes #643 with collision-safe full lockfile keys, resolved npm identity, root/workspace-only non-npm trust, canonical-registry source validation, fail-closed legacy binary trust records, and canonical alias persistence in text lockfiles. Runtime units remain 1,824 passed / 19 existing skips / 0 failed across 1,843 tests. No corpus edits or weakened assertions.