Commit af6c138a0de297f94ddef3133e2f47d017b46e94 | the-knife

apps/desktop/src/main.ts+5-20

 @@ -17,8 +17,6 @@ import * as Electron from "electron";
 import * as NetService from "@t3tools/shared/Net";
 import { HostProcessArchitecture, HostProcessPlatform } from "@t3tools/shared/hostProcess";
-import { isArchiveDistributedVersion } from "@t3tools/shared/cliRelease";
-import { resolveRemoteT3CliPackageSpec } from "@t3tools/ssh/command";
 import type { RemoteT3RunnerOptions } from "@t3tools/ssh/tunnel";
 import serverPackageJson from "../../server/package.json" with { type: "json" };
 @@ -87,9 +85,11 @@ const desktopEnvironmentLayer = Layer.unwrap(
   }),
 );
+// The remote runs the exact release this app is on, from its self-contained
+// archive, so it needs neither Node nor npm. Development points the remote at
+// a source checkout instead so the two sides can be iterated together.
 const resolveDesktopSshCliRunner = (
   environment: DesktopEnvironment.DesktopEnvironment["Service"],
-  settings: DesktopAppSettings.DesktopSettings,
 ): RemoteT3RunnerOptions => {
   const devRemoteEntryPath = Option.getOrUndefined(environment.devRemoteT3ServerEntryPath);
   if (environment.isDevelopment && devRemoteEntryPath !== undefined) {
 @@ -98,29 +98,14 @@ const resolveDesktopSshCliRunner = (
       nodeEngineRange: serverPackageJson.engines.node,
     };
   }
-  // Preview builds ship as self-contained archives, so the remote runs the
+  return { archiveVersion: environment.appVersion };
-  // same version this app is on without Node or npm.
-  if (!environment.isDevelopment && isArchiveDistributedVersion(environment.appVersion)) {
-    return { archiveVersion: environment.appVersion };
-  }
-  return {
-    packageSpec: resolveRemoteT3CliPackageSpec({
-      appVersion: environment.appVersion,
-      updateChannel: settings.updateChannel,
-      isDevelopment: environment.isDevelopment,
-    }),
-    nodeEngineRange: serverPackageJson.engines.node,
-  };
 };
 const desktopSshEnvironmentLayer = Layer.unwrap(
   Effect.gen(function* () {
     const environment = yield* DesktopEnvironment.DesktopEnvironment;
-    const settings = yield* DesktopAppSettings.DesktopAppSettings;
     return DesktopSshEnvironment.layer({
-      resolveCliRunner: settings.get.pipe(
+      resolveCliRunner: Effect.succeed(resolveDesktopSshCliRunner(environment)),
-        Effect.map((currentSettings) => resolveDesktopSshCliRunner(environment, currentSettings)),
-      ),
     });
   }),
 );

apps/desktop/src/ssh/DesktopSshEnvironment.ts+4-8

 @@ -69,7 +69,6 @@ export class DesktopSshEnvironment extends Context.Service<
 >()("@t3tools/desktop/ssh/DesktopSshEnvironment") {}
 export interface DesktopSshEnvironmentLayerOptions {
-  readonly resolveCliPackageSpec?: () => string;
   readonly resolveCliRunner?: Effect.Effect<SshTunnel.RemoteT3RunnerOptions>;
 }
 @@ -168,13 +167,10 @@ export const make = Effect.gen(function* () {
 export const layer = (options: DesktopSshEnvironmentLayerOptions = {}) =>
   Layer.effect(DesktopSshEnvironment, make).pipe(
     Layer.provide(
-      SshTunnel.SshEnvironmentManager.layer({
+      SshTunnel.SshEnvironmentManager.layer(
-        ...(options.resolveCliPackageSpec === undefined
+        options.resolveCliRunner === undefined
           ? {}
-          : { resolveCliPackageSpec: options.resolveCliPackageSpec }),
+          : { resolveCliRunner: options.resolveCliRunner },
-        ...(options.resolveCliRunner === undefined
+      ),
-          ? {}
-          : { resolveCliRunner: options.resolveCliRunner }),
-      }),
     ),
   );

apps/marketing/.gitignore created+2

...	@@ -0,0 +1,2 @@
1	/public/install.sh
2	/public/install.ps1

apps/marketing/package.json+3-2

 @@ -4,8 +4,9 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "astro dev",
+    "stage:install-scripts": "node scripts/stage-install-scripts.mjs",
-    "build": "astro build",
+    "dev": "node scripts/stage-install-scripts.mjs && astro dev",
+    "build": "node scripts/stage-install-scripts.mjs && astro build",
     "preview": "astro preview",
     "typecheck": "astro check"
   },

apps/marketing/public/install.ps1 deleted-120

...	@@ -1,120 +0,0 @@
1	# Installs the T3 Code CLI from a GitHub Release archive on Windows. Needs
2	# only PowerShell 5.1+; no Node, npm, or compiler.
3	#
4	# irm https://t3.codes/install.ps1 \| iex
5	#
6	# Environment:
7	# T3CODE_CHANNEL release train to follow: stable, nightly, or preview
8	# (default: stable; preview is a maintainers' test train)
9	# T3CODE_VERSION exact version to install (overrides T3CODE_CHANNEL)
10	# T3CODE_HOME T3 home directory (default: ~\.t3)
11	# T3CODE_INSTALL_BIN_DIR where t3.exe is linked (default: ~\.local\bin)
12	# T3CODE_RELEASE_BASE_URL mirror for releases/download (default: GitHub)
13	#
14	# The archive is unpacked into $T3CODE_HOME\runtime\versions\<version>, the
15	# same layout `t3 service install` uses, so the service reuses this download.
16	$ErrorActionPreference = "Stop"
17	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
18
19	$repo = "pingdotgg/t3code"
20	$baseUrl = if ($env:T3CODE_RELEASE_BASE_URL) { $env:T3CODE_RELEASE_BASE_URL.TrimEnd("/") } else { "https://github.com/$repo/releases/download" }
21	$t3Home = if ($env:T3CODE_HOME) { $env:T3CODE_HOME } else { Join-Path $HOME ".t3" }
22	$binDir = if ($env:T3CODE_INSTALL_BIN_DIR) { $env:T3CODE_INSTALL_BIN_DIR } else { Join-Path $HOME ".local\bin" }
23
24	function Fail([string] $message) {
25	Write-Error "t3 install: $message"
26	exit 1
27	}
28
29	# PROCESSOR_ARCHITEW6432 reports the real machine when a 32-bit PowerShell
30	# runs under WOW64; RuntimeInformation needs .NET 4.7.1+, which 5.1 hosts
31	# may lack.
32	$rawArch = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
33	$arch = switch ($rawArch) {
34	"AMD64" { "x64" }
35	"ARM64" { "arm64" }
36	default { Fail "unsupported architecture $rawArch" }
37	}
38
39	$channel = if ($env:T3CODE_CHANNEL) { $env:T3CODE_CHANNEL } else { "stable" }
40	$version = $env:T3CODE_VERSION
41	if (-not $version) {
42	# Tags are v<semver>; the channel is the prerelease identifier, or none for
43	# stable. Only tags of the requested train are considered, so a stable
44	# install can never pick up a nightly or preview build by accident.
45	$tagPattern = switch ($channel) {
46	"stable" { '^v\d+\.\d+\.\d+$' }
47	"nightly" { '^v\d+\.\d+\.\d+-nightly\.\d+\.\d+$' }
48	"preview" { '^v\d+\.\d+\.\d+-preview\.\d+\.\d+$' }
49	default { Fail "T3CODE_CHANNEL must be stable, nightly, or preview" }
50	}
51	$releases = Invoke-RestMethod -Uri "https://api.github.com/repos/$repo/releases?per_page=100" -Headers @{ "User-Agent" = "t3-install" }
52	$tag = ($releases \| Where-Object { -not $_.draft -and $_.tag_name -match $tagPattern } \| Select-Object -First 1).tag_name
53	if (-not $tag) { Fail "could not find a $channel release; set T3CODE_VERSION" }
54	$version = $tag.Substring(1)
55	}
56	if ($version -match '-preview\.') {
57	Write-Warning "t3 $version is a preview build. Preview builds are cut by maintainers from unreleased branches to exercise the release pipeline. They can be broken, receive no fixes, and are never offered as updates. Set T3CODE_CHANNEL=stable (the default) for a supported build."
58	if ($channel -ne "preview" -and -not $env:T3CODE_VERSION) {
59	Fail "refusing a preview build that was not explicitly requested"
60	}
61	}
62
63	$stem = "t3-$version-win32-$arch"
64	$archive = "$stem.zip"
65	$versionsDir = Join-Path $t3Home "runtime\versions"
66	$targetDir = Join-Path $versionsDir $version
67	$marker = Join-Path $targetDir ".install-complete"
68
69	if ((Test-Path $marker) -and ((Get-Content $marker -Raw).Trim() -eq $version)) {
70	Write-Host "t3 $version is already installed at $targetDir"
71	} else {
72	New-Item -ItemType Directory -Force -Path $versionsDir \| Out-Null
73	$staging = Join-Path $versionsDir (".staging-" + [System.IO.Path]::GetRandomFileName())
74	New-Item -ItemType Directory -Path $staging \| Out-Null
75	try {
76	Write-Host "Downloading $archive..."
77	try {
78	Invoke-WebRequest -Uri "$baseUrl/v$version/SHA256SUMS" -OutFile (Join-Path $staging "SHA256SUMS") -UseBasicParsing
79	} catch {
80	$status = $_.Exception.Response.StatusCode.value__
81	if ($status -eq 404) {
82	Fail "t3 $version has no self-contained archive; install it with 'npm install -g t3@$version' instead"
83	}
84	throw
85	}
86	Invoke-WebRequest -Uri "$baseUrl/v$version/$archive" -OutFile (Join-Path $staging $archive) -UseBasicParsing
87
88	$expected = (Get-Content (Join-Path $staging "SHA256SUMS") \| Where-Object { $_ -match "\s\*?$([regex]::Escape($archive))$" } \| Select-Object -First 1)
89	if (-not $expected) { Fail "$archive is not listed in SHA256SUMS" }
90	$expected = ($expected -split "\s+")[0].ToLowerInvariant()
91	$actual = (Get-FileHash -Algorithm SHA256 (Join-Path $staging $archive)).Hash.ToLowerInvariant()
92	if ($actual -ne $expected) { Fail "checksum mismatch for $archive" }
93
94	Expand-Archive -Path (Join-Path $staging $archive) -DestinationPath $staging -Force
95	# The archive wraps everything in one directory named after its stem.
96	Get-ChildItem (Join-Path $staging $stem) \| Move-Item -Destination $staging
97	Remove-Item (Join-Path $staging $stem), (Join-Path $staging $archive), (Join-Path $staging "SHA256SUMS") -Recurse -Force
98
99	& (Join-Path $staging "t3.exe") --version \| Out-Null
100	if ($LASTEXITCODE -ne 0) { Fail "the downloaded executable does not run" }
101	Set-Content -Path (Join-Path $staging ".install-complete") -Value $version -NoNewline
102
103	if (Test-Path $targetDir) { Remove-Item $targetDir -Recurse -Force }
104	Move-Item $staging $targetDir
105	} catch {
106	if (Test-Path $staging) { Remove-Item $staging -Recurse -Force }
107	throw
108	}
109	}
110
111	New-Item -ItemType Directory -Force -Path $binDir \| Out-Null
112	$shim = Join-Path $binDir "t3.cmd"
113	# UTF-8 without a BOM: cmd.exe reads the shim as-is, and ASCII would corrupt
114	# non-ASCII characters in the user's home path.
115	[System.IO.File]::WriteAllText($shim, "@echo off`r`n`"$(Join-Path $targetDir 't3.exe')`" %*", (New-Object System.Text.UTF8Encoding $false))
116	Write-Host "Installed t3 $version"
117	Write-Host " $shim -> $(Join-Path $targetDir 't3.exe')"
118	if (($env:PATH -split ";") -notcontains $binDir) {
119	Write-Host "Add $binDir to your PATH to run t3."
120	}

apps/marketing/public/install.sh deleted-140

...	@@ -1,140 +0,0 @@
1	#!/bin/sh
2	# Installs the T3 Code CLI from a GitHub Release archive. Needs only sh, tar,
3	# sha256sum or shasum, and curl or wget; no Node, npm, or compiler.
4	#
5	# curl -fsSL https://t3.codes/install.sh \| sh
6	#
7	# Environment:
8	# T3CODE_CHANNEL release train to follow: stable, nightly, or preview
9	# (default: stable; preview is a maintainers' test train)
10	# T3CODE_VERSION exact version to install (overrides T3CODE_CHANNEL)
11	# T3CODE_HOME T3 home directory (default: ~/.t3)
12	# T3CODE_INSTALL_BIN_DIR where the `t3` symlink goes (default: ~/.local/bin)
13	# T3CODE_RELEASE_BASE_URL mirror for releases/download (default: GitHub)
14	#
15	# The archive is unpacked into $T3CODE_HOME/runtime/versions/<version>, the
16	# same layout `t3 service install` uses, so the service reuses this download
17	# instead of fetching the release again.
18	set -eu
19
20	repo="pingdotgg/t3code"
21	base_url="${T3CODE_RELEASE_BASE_URL:-https://github.com/${repo}/releases/download}"
22	t3_home="${T3CODE_HOME:-$HOME/.t3}"
23	bin_dir="${T3CODE_INSTALL_BIN_DIR:-$HOME/.local/bin}"
24
25	fail() {
26	printf 't3 install: %s\n' "$1" >&2
27	exit 1
28	}
29
30	# Exit 44 on a 404 so callers can tell "no such asset" from a network failure.
31	fetch() {
32	if command -v curl >/dev/null 2>&1; then
33	status="$(curl -sSL -w '%{http_code}' "$1" -o "$2")" \|\| return 1
34	case "$status" in
35	2??) return 0 ;;
36	404) return 44 ;;
37	*) printf 'GET %s returned HTTP %s\n' "$1" "$status" >&2; return 1 ;;
38	esac
39	elif command -v wget >/dev/null 2>&1; then
40	wget -q --server-response "$1" -O "$2" 2>"$2.headers" && rm -f "$2.headers" && return 0
41	if grep -q ' 404 ' "$2.headers" 2>/dev/null; then rm -f "$2.headers"; return 44; fi
42	cat "$2.headers" >&2; rm -f "$2.headers"; return 1
43	else
44	fail "curl or wget is required"
45	fi
46	}
47
48	case "$(uname -s)" in
49	Darwin) platform="darwin" ;;
50	Linux) platform="linux" ;;
51	*) fail "unsupported operating system $(uname -s); use the desktop app or npm" ;;
52	esac
53	case "$(uname -m)" in
54	arm64 \| aarch64) arch="arm64" ;;
55	x86_64 \| amd64) arch="x64" ;;
56	*) fail "unsupported architecture $(uname -m)" ;;
57	esac
58	command -v tar >/dev/null 2>&1 \|\| fail "tar is required"
59	if command -v sha256sum >/dev/null 2>&1; then
60	checksum() { sha256sum "$1" \| cut -d' ' -f1; }
61	elif command -v shasum >/dev/null 2>&1; then
62	checksum() { shasum -a 256 "$1" \| cut -d' ' -f1; }
63	else
64	fail "sha256sum or shasum is required"
65	fi
66
67	channel="${T3CODE_CHANNEL:-stable}"
68	version="${T3CODE_VERSION:-}"
69	if [ -z "$version" ]; then
70	# Tags are v<semver>; the channel is the prerelease identifier, or none for
71	# stable. Only tags of the requested train are considered, so a stable
72	# install can never pick up a nightly or preview build by accident.
73	case "$channel" in
74	stable) tag_pattern='v$[0-9][0-9]\.[0-9][0-9]\.[0-9][0-9]*$' ;;
75	nightly \| preview) tag_pattern="v$[0-9][^\"]-${channel}\.[0-9]\.[0-9]*$" ;;
76	*) fail "T3CODE_CHANNEL must be stable, nightly, or preview" ;;
77	esac
78	tmp_index="$(mktemp)"
79	fetch "https://api.github.com/repos/${repo}/releases?per_page=100" "$tmp_index"
80	version="$(sed -n "s/.\"tag_name\": \"${tag_pattern}\".*/\1/p" "$tmp_index" \| head -n 1)"
81	rm -f "$tmp_index"
82	[ -n "$version" ] \|\| fail "could not find a ${channel} release; set T3CODE_VERSION"
83	fi
84	case "$version" in
85	-preview.)
86	printf '%s\n' \
87	"t3 ${version} is a preview build." \
88	" Preview builds are cut by maintainers from unreleased branches to exercise the release" \
89	" pipeline. They can be broken, receive no fixes, and are never offered as updates." \
90	" Set T3CODE_CHANNEL=stable (the default) for a supported build." >&2
91	if [ "$channel" != "preview" ] && [ -z "${T3CODE_VERSION:-}" ]; then
92	fail "refusing a preview build that was not explicitly requested"
93	fi
94	;;
95	esac
96
97	stem="t3-${version}-${platform}-${arch}"
98	archive="${stem}.tar.gz"
99	versions_dir="${t3_home}/runtime/versions"
100	target_dir="${versions_dir}/${version}"
101
102	if [ -f "${target_dir}/.install-complete" ] && [ "$(cat "${target_dir}/.install-complete")" = "$version" ]; then
103	printf 't3 %s is already installed at %s\n' "$version" "$target_dir"
104	else
105	mkdir -p "$versions_dir"
106	staging="$(mktemp -d "${versions_dir}/.staging-XXXXXX")"
107	trap 'rm -rf "$staging"' EXIT
108
109	printf 'Downloading %s...\n' "$archive"
110	fetch_status=0
111	fetch "${base_url}/v${version}/SHA256SUMS" "${staging}/SHA256SUMS" \|\| fetch_status=$?
112	if [ "$fetch_status" -eq 44 ]; then
113	fail "t3 ${version} has no self-contained archive; install it with \`npm install -g t3@${version}\` instead"
114	elif [ "$fetch_status" -ne 0 ]; then
115	fail "could not download the release checksums"
116	fi
117	fetch "${base_url}/v${version}/${archive}" "${staging}/${archive}"
118
119	expected="$(grep " \*\{0,1\}${archive}\$" "${staging}/SHA256SUMS" \| cut -d' ' -f1)"
120	[ -n "$expected" ] \|\| fail "${archive} is not listed in SHA256SUMS"
121	actual="$(checksum "${staging}/${archive}")"
122	[ "$actual" = "$expected" ] \|\| fail "checksum mismatch for ${archive}"
123
124	tar -xzf "${staging}/${archive}" -C "$staging" --strip-components=1
125	rm -f "${staging}/${archive}" "${staging}/SHA256SUMS"
126	"${staging}/t3" --version >/dev/null \|\| fail "the downloaded executable does not run"
127	printf '%s\n' "$version" > "${staging}/.install-complete"
128
129	rm -rf "$target_dir"
130	mv "$staging" "$target_dir"
131	trap - EXIT
132	fi
133
134	mkdir -p "$bin_dir"
135	ln -sfn "${target_dir}/t3" "${bin_dir}/t3"
136	printf 'Installed t3 %s\n %s -> %s\n' "$version" "${bin_dir}/t3" "${target_dir}/t3"
137	case ":${PATH}:" in
138	":${bin_dir}:") ;;
139	*) printf 'Add %s to your PATH to run `t3`.\n' "$bin_dir" ;;
140	esac

apps/marketing/scripts/stage-install-scripts.mjs created+15

...	@@ -0,0 +1,15 @@
1	// The CLI install scripts live in scripts/ at the repo root with the rest of
2	// the release tooling; the site serves them at /install.sh and /install.ps1.
3	// Copy them into public/ before every Astro build and dev server so the two
4	// never drift. The copies are gitignored.
5	import * as NodeFS from "node:fs";
6	import * as NodePath from "node:path";
7	import * as NodeURL from "node:url";
8
9	const marketingDir = NodePath.dirname(NodePath.dirname(NodeURL.fileURLToPath(import.meta.url)));
10	const repoRoot = NodePath.dirname(NodePath.dirname(marketingDir));
11	const publicDir = NodePath.join(marketingDir, "public");
12	NodeFS.mkdirSync(publicDir, { recursive: true });
13	for (const name of ["install.sh", "install.ps1"]) {
14	NodeFS.copyFileSync(NodePath.join(repoRoot, "scripts", name), NodePath.join(publicDir, name));
15	}

apps/server/package.json+1-1

...	@@ -16,7 +16,7 @@	...	@@ -16,7 +16,7 @@
16	"type": "module",	16	"type": "module",
17	"scripts": {	17	"scripts": {
18	"dev": "node --watch src/bin.ts",	18	"dev": "node --watch src/bin.ts",
19	"build:bundle": "vp pack && vp pack src/service-launcher.ts --out-dir dist --no-clean",	19	"build:bundle": "vp pack",
20	"build:exe": "node scripts/cli.ts build-exe",	20	"build:exe": "node scripts/cli.ts build-exe",
21	"start": "node dist/bin.mjs",	21	"start": "node dist/bin.mjs",
22	"typecheck": "tsc --noEmit",	22	"typecheck": "tsc --noEmit",

apps/server/scripts/cli.ts+1-5

 @@ -284,11 +284,7 @@ const publishCmd = Command.make(
       const packageJsonPath = path.join(serverDir, "package.json");
       // Assert build assets exist
-      for (const relPath of [
+      for (const relPath of ["dist/bin.mjs", "dist/client/index.html"]) {
-        "dist/bin.mjs",
-        "dist/service-launcher.mjs",
-        "dist/client/index.html",
-      ]) {
         const abs = path.join(serverDir, relPath);
         if (!(yield* fs.exists(abs))) {
           return yield* new ServerCliBuildAssetMissingError({ assetPath: abs });

apps/server/src/cli/service.test.ts+1-2

...	@@ -105,8 +105,7 @@ function makeTestService(serviceStatus: BootService.BootServiceStatus) {	...	@@ -105,8 +105,7 @@ function makeTestService(serviceStatus: BootService.BootServiceStatus) {
105	Effect.sync(() => {	105	Effect.sync(() => {
106	installOptions.push(options);	106	installOptions.push(options);
107	return {	107	return {
108	program: ["/test/node", "/test/service-launcher.mjs"],	108	program: ["/test/t3/runtime/versions/1.0.0/t3", "__service-launcher"],
109	launcherPath: "/test/service-launcher.mjs",
110	baseDir: "/test/t3",	109	baseDir: "/test/t3",
111	unitPath: serviceStatus.unitPath,	110	unitPath: serviceStatus.unitPath,
112	logPath: serviceStatus.logPath,	111	logPath: serviceStatus.logPath,

apps/server/src/cli/serviceLauncher.ts+3-4

 @@ -4,10 +4,9 @@ import { Command } from "effect/unstable/cli";
 import { main as runServiceLauncher } from "../serviceLauncher.ts";
 /**
- * Hosts the service launcher inside the CLI executable. Archive-distributed
+ * Hosts the service launcher inside the CLI executable. The service manager
- * runtimes have no Node on the machine to run `service-launcher.mjs`, so the
+ * runs `t3 __service-launcher` and the launcher spawns the server from the
- * service manager runs `t3 __service-launcher` and the launcher spawns the
+ * same executable, so the machine needs no Node to run either.
- * server from the same executable.
  *
  * The launcher owns SIGTERM handling and the process lifetime: it must finish
  * stopping its child before the process exits, so it runs detached from the

apps/server/src/cli/update.ts+3-14

...	@@ -1,7 +1,6 @@	...	@@ -1,7 +1,6 @@
1	import {	1	import {
2	HostProcessArchitecture,	2	HostProcessArchitecture,
3	HostProcessEnvironment,	3	HostProcessEnvironment,
4	HostProcessExecutablePath,
5	HostProcessInvokedAs,	4	HostProcessInvokedAs,
6	HostProcessIsExecutable,	5	HostProcessIsExecutable,
7	HostProcessPlatform,	6	HostProcessPlatform,
...	@@ -12,7 +11,6 @@ import {	...	@@ -12,7 +11,6 @@ import {
12	CLI_RELEASE_CHANNELS,	11	CLI_RELEASE_CHANNELS,
13	cliReleaseIndexPageUrl,	12	cliReleaseIndexPageUrl,
14	cliReleaseChannelOf,	13	cliReleaseChannelOf,
15	isArchiveDistributedVersion,
16	newestCliReleaseVersion,	14	newestCliReleaseVersion,
17	type CliReleaseChannel,	15	type CliReleaseChannel,
18	} from "@t3tools/shared/cliRelease";	16	} from "@t3tools/shared/cliRelease";
...	@@ -320,7 +318,7 @@ const belongsToBootService = Effect.fn("cli.update.belongs_to_boot_service")(fun	...	@@ -320,7 +318,7 @@ const belongsToBootService = Effect.fn("cli.update.belongs_to_boot_service")(fun
320	Effect.map((result) => (result.code === 0 ? result.stdout : "")),	318	Effect.map((result) => (result.code === 0 ? result.stdout : "")),
321	Effect.orElseSucceed(() => ""),	319	Effect.orElseSucceed(() => ""),
322	);	320	);
323	return /__service-launcher\|service-launcher\.mjs/.test(command);	321	return /__service-launcher/.test(command);
324	}	322	}
325	return false;	323	return false;
326	});	324	});
...	@@ -338,7 +336,6 @@ const runUpdate = Effect.fn("cli.update.run")(function* (input: {	...	@@ -338,7 +336,6 @@ const runUpdate = Effect.fn("cli.update.run")(function* (input: {
338	const runner = yield* ProcessRunner.ProcessRunner;	336	const runner = yield* ProcessRunner.ProcessRunner;
339	const platform = yield* HostProcessPlatform;	337	const platform = yield* HostProcessPlatform;
340	const arch = yield* HostProcessArchitecture;	338	const arch = yield* HostProcessArchitecture;
341	const execPath = yield* HostProcessExecutablePath;
342	const environment = yield* HostProcessEnvironment;	339	const environment = yield* HostProcessEnvironment;
343	const httpClient = yield* HttpClient.HttpClient;	340	const httpClient = yield* HttpClient.HttpClient;
344	const service = yield* BootService.BootService;	341	const service = yield* BootService.BootService;
...	@@ -410,14 +407,6 @@ const runUpdate = Effect.fn("cli.update.run")(function* (input: {	...	@@ -410,14 +407,6 @@ const runUpdate = Effect.fn("cli.update.run")(function* (input: {
410	? serviceVersion	407	? serviceVersion
411	: currentVersion;	408	: currentVersion;
412		409
413	// Only archive-distributed versions install without Node and npm on the
414	// machine. Until nightly and stable ship archives, updating onto them from
415	// here would reintroduce the dependency this command exists to remove.
416	if (!isArchiveDistributedVersion(targetVersion)) {
417	return yield* new CliUpdateError({
418	reason: `t3@${targetVersion} is published on npm only. Install it with \`npm install -g t3@${targetVersion}\`, or pick a version from the preview channel.`,
419	});
420	}
421	if (executableCurrent && serviceCurrent) {	410	if (executableCurrent && serviceCurrent) {
422	yield* Console.log(	411	yield* Console.log(
423	serviceVersion !== undefined	412	serviceVersion !== undefined
...	@@ -480,8 +469,8 @@ const runUpdate = Effect.fn("cli.update.run")(function* (input: {	...	@@ -480,8 +469,8 @@ const runUpdate = Effect.fn("cli.update.run")(function* (input: {
480	validate: (paths) =>	469	validate: (paths) =>
481	runner	470	runner
482	.run({	471	.run({
483	command: pinnedRuntimeCommand(paths, execPath).command,	472	command: pinnedRuntimeCommand(paths).command,
484	args: [...pinnedRuntimeCommand(paths, execPath).args, "--version"],	473	args: [...pinnedRuntimeCommand(paths).args, "--version"],
485	timeout: Duration.seconds(30),	474	timeout: Duration.seconds(30),
486	})	475	})
487	.pipe(	476	.pipe(

apps/server/src/cloud/bootService.test.ts+45-82

...	@@ -1,7 +1,6 @@	...	@@ -1,7 +1,6 @@
1	import * as NodeServices from "@effect/platform-node/NodeServices";	1	import * as NodeServices from "@effect/platform-node/NodeServices";
2	import { expect, it } from "@effect/vitest";	2	import { expect, it } from "@effect/vitest";
3	import {	3	import {
4	HostProcessArguments,
5	HostProcessExecutablePath,	4	HostProcessExecutablePath,
6	HostProcessPlatform,	5	HostProcessPlatform,
7	HostProcessUserId,	6	HostProcessUserId,
...	@@ -12,6 +11,7 @@ import * as Effect from "effect/Effect";	...	@@ -12,6 +11,7 @@ import * as Effect from "effect/Effect";
12	import * as FileSystem from "effect/FileSystem";	11	import * as FileSystem from "effect/FileSystem";
13	import * as Layer from "effect/Layer";	12	import * as Layer from "effect/Layer";
14	import * as Path from "effect/Path";	13	import * as Path from "effect/Path";
		14	import { HttpClient } from "effect/unstable/http";
15	import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";	15	import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
16		16
17	import * as ProcessRunner from "../processRunner.ts";	17	import * as ProcessRunner from "../processRunner.ts";
...	@@ -23,24 +23,25 @@ import {	...	@@ -23,24 +23,25 @@ import {
23	serviceStateHasPendingUpdate,	23	serviceStateHasPendingUpdate,
24	} from "./serviceProtocol.ts";	24	} from "./serviceProtocol.ts";
25		25
26	it("keeps systemd pinned to the stable launcher rather than a versioned server", () => {	26	const linuxRuntime = "/home/theo/.t3/runtime/versions/1.2.3/t3";
27	const unit = BootService.renderBootServiceUnit({	27	const linuxPlan = {
28	program: ["/usr/bin/node", "/home/theo/.t3/runtime/service-launcher.mjs"],	28	program: [linuxRuntime, "__service-launcher"],
29	launcherPath: "/home/theo/.t3/runtime/service-launcher.mjs",	29	baseDir: "/home/theo/.t3",
30	baseDir: "/home/theo/.t3",	30	logPath: "/home/theo/.t3/userdata/logs/boot-service.log",
31	logPath: "/home/theo/.t3/userdata/logs/boot-service.log",	31	unitPath: "/home/theo/.config/systemd/user/t3code.service",
32	unitPath: "/home/theo/.config/systemd/user/t3code.service",	32	};
33	});	33
		34	it("runs the pinned runtime's own executable as the systemd launcher", () => {
		35	const unit = BootService.renderBootServiceUnit(linuxPlan);
34		36
35	expect(unit).toContain("ExecStart=/usr/bin/node /home/theo/.t3/runtime/service-launcher.mjs");	37	expect(unit).toContain(`ExecStart=${linuxRuntime} __service-launcher`);
36	expect(unit).toContain("KillMode=mixed");	38	expect(unit).toContain("KillMode=mixed");
37	expect(unit).not.toContain("versions/1.2.3");	39	expect(unit).not.toContain("node");
38	});	40	});
39		41
40	it("reads the served T3 home back out of a rendered unit or plist", () => {	42	it("reads the served T3 home back out of a rendered unit or plist", () => {
41	const plan = (baseDir: string) => ({	43	const plan = (baseDir: string) => ({
42	program: ["/usr/bin/node", `${baseDir}/runtime/service-launcher.mjs`],	44	program: [`${baseDir}/runtime/versions/1.2.3/t3`, "__service-launcher"],
43	launcherPath: `${baseDir}/runtime/service-launcher.mjs`,
44	baseDir,	45	baseDir,
45	logPath: `${baseDir}/userdata/logs/boot-service.log`,	46	logPath: `${baseDir}/userdata/logs/boot-service.log`,
46	unitPath: "/home/theo/.config/systemd/user/t3code.service",	47	unitPath: "/home/theo/.config/systemd/user/t3code.service",
...	@@ -66,36 +67,15 @@ it("reads the served T3 home back out of a rendered unit or plist", () => {	...	@@ -66,36 +67,15 @@ it("reads the served T3 home back out of a rendered unit or plist", () => {
66	expect(BootService.bootServiceBaseDirOf("[Service]\nExecStart=/x\n")).toBeUndefined();	67	expect(BootService.bootServiceBaseDirOf("[Service]\nExecStart=/x\n")).toBeUndefined();
67	});	68	});
68		69
69	it("runs archive-distributed runtimes as their own executable", () => {
70	const unit = BootService.renderBootServiceUnit({
71	program: ["/home/theo/.t3/runtime/versions/1.3.0-preview.20260911.7/t3", "__service-launcher"],
72	launcherPath: "/home/theo/.t3/runtime/service-launcher.mjs",
73	baseDir: "/home/theo/.t3",
74	logPath: "/home/theo/.t3/userdata/logs/boot-service.log",
75	unitPath: "/home/theo/.config/systemd/user/t3code.service",
76	});
77
78	expect(unit).toContain(
79	"ExecStart=/home/theo/.t3/runtime/versions/1.3.0-preview.20260911.7/t3 __service-launcher",
80	);
81	expect(unit).not.toContain("node");
82	});
83
84	it("survives the kernel OOM-killing a greedy agent child", () => {	70	it("survives the kernel OOM-killing a greedy agent child", () => {
85	const unit = BootService.renderBootServiceUnit({	71	const unit = BootService.renderBootServiceUnit(linuxPlan);
86	program: ["/usr/bin/node", "/home/theo/.t3/runtime/service-launcher.mjs"],
87	launcherPath: "/home/theo/.t3/runtime/service-launcher.mjs",
88	baseDir: "/home/theo/.t3",
89	logPath: "/home/theo/.t3/userdata/logs/boot-service.log",
90	unitPath: "/home/theo/.config/systemd/user/t3code.service",
91	});
92		72
93	expect(unit).toContain("OOMPolicy=continue");	73	expect(unit).toContain("OOMPolicy=continue");
94	});	74	});
95		75
		76	const macRuntime = "/Users/theo/.t3/runtime/versions/1.2.3/t3";
96	const macPlan = {	77	const macPlan = {
97	program: ["/opt/homebrew/bin/node", "/Users/theo/.t3/runtime/service-launcher.mjs"],	78	program: [macRuntime, "__service-launcher"],
98	launcherPath: "/Users/theo/.t3/runtime/service-launcher.mjs",
99	baseDir: "/Users/theo/.t3",	79	baseDir: "/Users/theo/.t3",
100	logPath: "/Users/theo/.t3/userdata/logs/boot-service.log",	80	logPath: "/Users/theo/.t3/userdata/logs/boot-service.log",
101	unitPath: "/Users/theo/Library/LaunchAgents/com.t3tools.t3code.service.plist",	81	unitPath: "/Users/theo/Library/LaunchAgents/com.t3tools.t3code.service.plist",
...	@@ -104,12 +84,13 @@ const macInstallerPath =	...	@@ -104,12 +84,13 @@ const macInstallerPath =
104	"/opt/homebrew/bin:/Users/theo/.npm-global/bin:/Users/theo/.nvm/versions/node/v22.16.0/bin:/usr/bin:/bin";	84	"/opt/homebrew/bin:/Users/theo/.npm-global/bin:/Users/theo/.nvm/versions/node/v22.16.0/bin:/usr/bin:/bin";
105	const macRenderOptions = { homeDir: "/Users/theo", environmentPath: macInstallerPath };	85	const macRenderOptions = { homeDir: "/Users/theo", environmentPath: macInstallerPath };
106		86
107	it("keeps launchd pinned to the stable launcher rather than a versioned server", () => {	87	it("runs the pinned runtime's own executable as the launch agent", () => {
108	const plist = BootService.renderBootServicePlist(macPlan, macRenderOptions);	88	const plist = BootService.renderBootServicePlist(macPlan, macRenderOptions);
109		89
110	expect(plist).toContain("<string>/opt/homebrew/bin/node</string>");	90	expect(plist).toContain(
111	expect(plist).toContain("<string>/Users/theo/.t3/runtime/service-launcher.mjs</string>");	91	` <array>\n <string>${macRuntime}</string>\n <string>__service-launcher</string>\n </array>`,
112	expect(plist).not.toContain("versions/1.2.3");	92	);
		93	expect(plist).not.toContain("node</string>");
113	});	94	});
114		95
115	it("preserves the installer's provider search path in the launch agent", () => {	96	it("preserves the installer's provider search path in the launch agent", () => {
...	@@ -150,23 +131,18 @@ it("escapes XML in host paths", () => {	...	@@ -150,23 +131,18 @@ it("escapes XML in host paths", () => {
150		131
151	const makeHarness = Effect.fn("test.make_boot_service_harness")(function* (	132	const makeHarness = Effect.fn("test.make_boot_service_harness")(function* (
152	platform: NodeJS.Platform = "linux",	133	platform: NodeJS.Platform = "linux",
153	usePinnedLauncher = false,
154	installerPath = macInstallerPath,	134	installerPath = macInstallerPath,
155	) {	135	) {
156	const fs = yield* FileSystem.FileSystem;	136	const fs = yield* FileSystem.FileSystem;
157	const path = yield* Path.Path;	137	const path = yield* Path.Path;
158	const home = yield* fs.makeTempDirectoryScoped({ prefix: "t3-boot-service-test-" });	138	const home = yield* fs.makeTempDirectoryScoped({ prefix: "t3-boot-service-test-" });
159	const baseDir = path.join(home, ".t3");	139	const baseDir = path.join(home, ".t3");
160	const sourceLauncher = path.join(home, "service-launcher.mjs");
161	const statePath = path.join(baseDir, "runtime", "service-state.json");	140	const statePath = path.join(baseDir, "runtime", "service-state.json");
162	yield* fs.writeFileString(sourceLauncher, "export {};\n");	141	// A complete pinned runtime is already present, so install only validates
163	const runtime = pinnedRuntimePaths(path, baseDir, "1.2.3", "linux");	142	// it and never downloads a release archive.
		143	const runtime = pinnedRuntimePaths(path, baseDir, "1.2.3", platform);
164	yield* fs.makeDirectory(path.dirname(runtime.entryPath), { recursive: true });	144	yield* fs.makeDirectory(path.dirname(runtime.entryPath), { recursive: true });
165	yield* fs.writeFileString(runtime.entryPath, "export {};\n");	145	yield* fs.writeFileString(runtime.entryPath, "#!/bin/sh\n");
166	yield* fs.writeFileString(
167	path.join(path.dirname(runtime.entryPath), "service-launcher.mjs"),
168	"export const source = 'pinned runtime';\n",
169	);
170	yield* fs.writeFileString(runtime.sentinelPath, "1.2.3\n");	146	yield* fs.writeFileString(runtime.sentinelPath, "1.2.3\n");
171		147
172	const commands: string[] = [];	148	const commands: string[] = [];
...	@@ -204,7 +180,7 @@ const makeHarness = Effect.fn("test.make_boot_service_harness")(function* (	...	@@ -204,7 +180,7 @@ const makeHarness = Effect.fn("test.make_boot_service_harness")(function* (
204	}	180	}
205	return {	181	return {
206	stdout:	182	stdout:
207	input.args[1] === "--version"	183	input.args[0] === "--version"
208	? "t3 v1.2.3\n"	184	? "t3 v1.2.3\n"
209	: input.command === "loginctl" && input.args[0] === "show-user"	185	: input.command === "loginctl" && input.args[0] === "show-user"
210	? `${control.linger}\n`	186	? `${control.linger}\n`
...	@@ -230,18 +206,18 @@ const makeHarness = Effect.fn("test.make_boot_service_harness")(function* (	...	@@ -230,18 +206,18 @@ const makeHarness = Effect.fn("test.make_boot_service_harness")(function* (
230	baseDir,	206	baseDir,
231	logsDir: path.join(baseDir, "userdata", "logs"),	207	logsDir: path.join(baseDir, "userdata", "logs"),
232	cliVersion: "1.2.3",	208	cliVersion: "1.2.3",
233	host: {	209	host: { execPath: "/usr/bin/t3" },
234	execPath: "/usr/bin/node",
235	...(usePinnedLauncher ? {} : { launcherSourcePath: sourceLauncher }),
236	},
237	}).pipe(	210	}).pipe(
238	Effect.provideService(ProcessRunner.ProcessRunner, runner),	211	Effect.provideService(ProcessRunner.ProcessRunner, runner),
239	Effect.provide(	212	Effect.provide(
240	Layer.mergeAll(	213	Layer.mergeAll(
241	Layer.succeed(HostProcessPlatform, platform),	214	Layer.succeed(HostProcessPlatform, platform),
242	Layer.succeed(HostProcessUserId, 501),	215	Layer.succeed(HostProcessUserId, 501),
243	Layer.succeed(HostProcessExecutablePath, "/usr/bin/node"),	216	Layer.succeed(HostProcessExecutablePath, "/usr/bin/t3"),
244	Layer.succeed(HostProcessArguments, ["/usr/bin/node", path.join(home, "bin.mjs")]),	217	Layer.succeed(
		218	HttpClient.HttpClient,
		219	HttpClient.make(() => Effect.die("no release download expected")),
		220	),
245	ConfigProvider.layer(	221	ConfigProvider.layer(
246	ConfigProvider.fromEnv({	222	ConfigProvider.fromEnv({
247	env: { HOME: home, ...(environmentPath === "" ? {} : { PATH: environmentPath }) },	223	env: { HOME: home, ...(environmentPath === "" ? {} : { PATH: environmentPath }) },
...	@@ -275,9 +251,7 @@ it.layer(NodeServices.layer)("boot service install", (it) => {	...	@@ -275,9 +251,7 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
275	expect(error.message).toContain("last login session ends");	251	expect(error.message).toContain("last login session ends");
276	expect(yield* fs.exists(before.unitPath)).toBe(false);	252	expect(yield* fs.exists(before.unitPath)).toBe(false);
277	expect(yield* fs.exists(statePath)).toBe(false);	253	expect(yield* fs.exists(statePath)).toBe(false);
278	expect(	254	expect(commands.some((command) => command.includes("--version"))).toBe(false);
279	commands.some((command) => command.startsWith("npm ") \|\| command.includes("--version")),
280	).toBe(false);
281	expect(	255	expect(
282	commands.some(	256	commands.some(
283	(command) => command.includes("daemon-reload") \|\| command.includes("restart"),	257	(command) => command.includes("daemon-reload") \|\| command.includes("restart"),
...	@@ -350,14 +324,17 @@ it.layer(NodeServices.layer)("boot service install", (it) => {	...	@@ -350,14 +324,17 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
350		324
351	it.effect("installs, reports current state, and uninstalls", () =>	325	it.effect("installs, reports current state, and uninstalls", () =>
352	Effect.gen(function* () {	326	Effect.gen(function* () {
353	const { service, fs, statePath, commands, timeouts } = yield* makeHarness();	327	const { service, fs, statePath, timeouts, runtime } = yield* makeHarness();
354	const plan = yield* service.install();	328	const plan = yield* service.install();
355		329
356	expect(parseServiceState(yield* fs.readFileString(statePath))).toEqual({	330	expect(parseServiceState(yield* fs.readFileString(statePath))).toEqual({
357	protocol: SERVICE_LAUNCHER_PROTOCOL,	331	protocol: SERVICE_LAUNCHER_PROTOCOL,
358	activeVersion: "1.2.3",	332	activeVersion: "1.2.3",
359	});	333	});
360	expect(yield* fs.readFileString(plan.launcherPath)).toBe("export {};\n");	334	expect(plan.program).toEqual([runtime.entryPath, "__service-launcher"]);
		335	expect(yield* fs.readFileString(plan.unitPath)).toContain(
		336	`ExecStart=${runtime.entryPath} __service-launcher`,
		337	);
361	expect(yield* service.status).toMatchObject({	338	expect(yield* service.status).toMatchObject({
362	current: true,	339	current: true,
363	installedVersion: "1.2.3",	340	installedVersion: "1.2.3",
...	@@ -378,7 +355,6 @@ it.layer(NodeServices.layer)("boot service install", (it) => {	...	@@ -378,7 +355,6 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
378	expect((yield* service.status).current).toBe(false);	355	expect((yield* service.status).current).toBe(false);
379	expect(yield* service.uninstall).toBe(true);	356	expect(yield* service.uninstall).toBe(true);
380	expect((yield* service.status).installed).toBe(false);	357	expect((yield* service.status).installed).toBe(false);
381	expect(commands.some((command) => command.startsWith("npm "))).toBe(false);
382	// The stop can block up to systemd's 90s TimeoutStopSec; the runner's	358	// The stop can block up to systemd's 90s TimeoutStopSec; the runner's
383	// 60s default would cancel it mid-shutdown.	359	// 60s default would cancel it mid-shutdown.
384	expect(timeouts.get("systemctl --user disable --now t3code.service")).toEqual(	360	expect(timeouts.get("systemctl --user disable --now t3code.service")).toEqual(
...	@@ -432,7 +408,6 @@ it.layer(NodeServices.layer)("boot service install", (it) => {	...	@@ -432,7 +408,6 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
432	Effect.gen(function* () {	408	Effect.gen(function* () {
433	const { service, fs, statePath, commands, control } = yield* makeHarness(platform);	409	const { service, fs, statePath, commands, control } = yield* makeHarness(platform);
434	const plan = yield* service.install();	410	const plan = yield* service.install();
435	const launcher = yield* fs.readFileString(plan.launcherPath);
436	const unit = yield* fs.readFileString(plan.unitPath);	411	const unit = yield* fs.readFileString(plan.unitPath);
437	control.stateAfterStop = `{"protocol":${SERVICE_LAUNCHER_PROTOCOL + 1},"activeVersion":"1.2.4"}`;	412	control.stateAfterStop = `{"protocol":${SERVICE_LAUNCHER_PROTOCOL + 1},"activeVersion":"1.2.4"}`;
438	commands.length = 0;	413	commands.length = 0;
...	@@ -445,7 +420,6 @@ it.layer(NodeServices.layer)("boot service install", (it) => {	...	@@ -445,7 +420,6 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
445	targetVersion: "1.2.3",	420	targetVersion: "1.2.3",
446	});	421	});
447	expect(yield* fs.readFileString(statePath)).toBe(control.stateAfterStop);	422	expect(yield* fs.readFileString(statePath)).toBe(control.stateAfterStop);
448	expect(yield* fs.readFileString(plan.launcherPath)).toBe(launcher);
449	expect(yield* fs.readFileString(plan.unitPath)).toBe(unit);	423	expect(yield* fs.readFileString(plan.unitPath)).toBe(unit);
450	expect(	424	expect(
451	commands.filter(	425	commands.filter(
...	@@ -495,17 +469,6 @@ it.layer(NodeServices.layer)("boot service install", (it) => {	...	@@ -495,17 +469,6 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
495	}),	469	}),
496	);	470	);
497		471
498	it.effect("copies the launcher from the prepared pinned runtime", () =>
499	Effect.gen(function* () {
500	const { service, fs } = yield* makeHarness("linux", true);
501	const plan = yield* service.install();
502
503	expect(yield* fs.readFileString(plan.launcherPath)).toBe(
504	"export const source = 'pinned runtime';\n",
505	);
506	}),
507	);
508
509	it.effect("restarts an installed service when repair fails", () =>	472	it.effect("restarts an installed service when repair fails", () =>
510	Effect.gen(function* () {	473	Effect.gen(function* () {
511	const { service, commands, control } = yield* makeHarness();	474	const { service, commands, control } = yield* makeHarness();
...	@@ -572,7 +535,7 @@ it.layer(NodeServices.layer)("boot service install", (it) => {	...	@@ -572,7 +535,7 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
572		535
573	it.effect("installs, reports current state, and uninstalls on macOS", () =>	536	it.effect("installs, reports current state, and uninstalls on macOS", () =>
574	Effect.gen(function* () {	537	Effect.gen(function* () {
575	const { service, fs, statePath, commands, timeouts } = yield* makeHarness("darwin");	538	const { service, fs, statePath, commands, timeouts, runtime } = yield* makeHarness("darwin");
576	const path = yield* Path.Path;	539	const path = yield* Path.Path;
577	const plan = yield* service.install();	540	const plan = yield* service.install();
578		541
...	@@ -588,14 +551,15 @@ it.layer(NodeServices.layer)("boot service install", (it) => {	...	@@ -588,14 +551,15 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
588	protocol: SERVICE_LAUNCHER_PROTOCOL,	551	protocol: SERVICE_LAUNCHER_PROTOCOL,
589	activeVersion: "1.2.3",	552	activeVersion: "1.2.3",
590	});	553	});
591	expect(yield* fs.readFileString(plan.launcherPath)).toBe("export {};\n");	554	expect(yield* fs.readFileString(plan.unitPath)).toContain(
		555	` <string>${runtime.entryPath}</string>\n <string>__service-launcher</string>`,
		556	);
592	expect(yield* service.status).toMatchObject({	557	expect(yield* service.status).toMatchObject({
593	current: true,	558	current: true,
594	installedVersion: "1.2.3",	559	installedVersion: "1.2.3",
595	});	560	});
596	expect(yield* service.uninstall).toBe(true);	561	expect(yield* service.uninstall).toBe(true);
597	expect((yield* service.status).installed).toBe(false);	562	expect((yield* service.status).installed).toBe(false);
598	expect(commands.some((command) => command.startsWith("npm "))).toBe(false);
599	expect(commands.some((command) => command.startsWith("systemctl "))).toBe(false);	563	expect(commands.some((command) => command.startsWith("systemctl "))).toBe(false);
600	// A bootout can block up to the plist's 90s ExitTimeOut; the runner's	564	// A bootout can block up to the plist's 90s ExitTimeOut; the runner's
601	// 60s default would cancel it and let bootstrap race a loaded job.	565	// 60s default would cancel it and let bootstrap race a loaded job.
...	@@ -626,7 +590,7 @@ it.layer(NodeServices.layer)("boot service install", (it) => {	...	@@ -626,7 +590,7 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
626		590
627	it.effect("reconstructs a launch agent search path when the installer has no PATH", () =>	591	it.effect("reconstructs a launch agent search path when the installer has no PATH", () =>
628	Effect.gen(function* () {	592	Effect.gen(function* () {
629	const { service, fs } = yield* makeHarness("darwin", false, "");	593	const { service, fs } = yield* makeHarness("darwin", "");
630	const plan = yield* service.install();	594	const plan = yield* service.install();
631		595
632	expect(yield* fs.readFileString(plan.unitPath)).toContain(	596	expect(yield* fs.readFileString(plan.unitPath)).toContain(
...	@@ -638,7 +602,7 @@ it.layer(NodeServices.layer)("boot service install", (it) => {	...	@@ -638,7 +602,7 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
638		602
639	it.effect("adds missing provider directories to a minimal installer PATH", () =>	603	it.effect("adds missing provider directories to a minimal installer PATH", () =>
640	Effect.gen(function* () {	604	Effect.gen(function* () {
641	const { service, fs } = yield* makeHarness("darwin", false, "/usr/bin:/bin");	605	const { service, fs } = yield* makeHarness("darwin", "/usr/bin:/bin");
642	const plan = yield* service.install();	606	const plan = yield* service.install();
643		607
644	expect(yield* fs.readFileString(plan.unitPath)).toContain(	608	expect(yield* fs.readFileString(plan.unitPath)).toContain(
...	@@ -662,7 +626,6 @@ it.layer(NodeServices.layer)("boot service install", (it) => {	...	@@ -662,7 +626,6 @@ it.layer(NodeServices.layer)("boot service install", (it) => {
662	Effect.gen(function* () {	626	Effect.gen(function* () {
663	const { service, fs } = yield* makeHarness(	627	const { service, fs } = yield* makeHarness(
664	"darwin",	628	"darwin",
665	false,
666	"/opt/homebrew/bin:/Users/theo/\u0001invalid:/usr/bin",	629	"/opt/homebrew/bin:/Users/theo/\u0001invalid:/usr/bin",
667	);	630	);
668	const plan = yield* service.install();	631	const plan = yield* service.install();

apps/server/src/cloud/bootService.ts+12-38

 @@ -26,7 +26,6 @@ import {
   PinnedRuntimeInstallError,
 } from "./pinnedRuntime.ts";
 import {
-  SERVICE_LAUNCHER_FILE,
   SERVICE_LAUNCHER_PROTOCOL,
   SERVICE_STATE_FILE,
   compareExactServiceVersions,
 @@ -86,7 +85,6 @@ export interface BootServicePlan {
    * subcommand so the machine never needs Node.
    */
   readonly program: ReadonlyArray<string>;
-  readonly launcherPath: string;
   readonly baseDir: string;
   readonly logPath: string;
   readonly unitPath: string;
 @@ -533,7 +531,6 @@ export class BootService extends Context.Service<
 export interface BootServiceHost {
   readonly execPath: string;
-  readonly launcherSourcePath?: string;
 }
 export const make = Effect.fn("cloud.boot_service.make")(function* (input: {
 @@ -546,9 +543,7 @@ export const make = Effect.fn("cloud.boot_service.make")(function* (input: {
   const platform = yield* HostProcessPlatform;
   const arch = yield* HostProcessArchitecture;
   const uid = yield* HostProcessUserId;
-  // Archive-distributed versions download from GitHub Releases; npm versions
+  const httpClient = yield* HttpClient.HttpClient;
-  // never touch HTTP, so callers without a client still work.
-  const httpClient = Option.getOrUndefined(yield* Effect.serviceOption(HttpClient.HttpClient));
   const releaseBaseUrl = Option.getOrUndefined(
     yield* Config.string(CLI_RELEASE_BASE_URL_ENV).pipe(Config.option),
   );
 @@ -588,12 +583,8 @@ export const make = Effect.fn("cloud.boot_service.make")(function* (input: {
   });
   const unitPath = detectedManager?.unitPath ?? "";
   const logPath = path.join(input.logsDir, "boot-service.log");
-  const launcherPath = path.join(input.baseDir, "runtime", SERVICE_LAUNCHER_FILE);
   const statePath = path.join(input.baseDir, "runtime", SERVICE_STATE_FILE);
   const runtimePaths = pinnedRuntimePaths(path, input.baseDir, input.cliVersion, platform);
-  const launcherSourcePath =
-    host.launcherSourcePath ??
-    path.join(path.dirname(runtimePaths.entryPath), SERVICE_LAUNCHER_FILE);
   const writeDurably = (filePath: string, contents: string) =>
     Effect.scoped(
       Effect.gen(function* () {
 @@ -613,12 +604,10 @@ export const make = Effect.fn("cloud.boot_service.make")(function* (input: {
         );
       }),
     ).pipe(Effect.mapError((cause) => new BootServiceInstallError({ cause })));
+  // The executable hosts the launcher as a hidden subcommand of itself, so
+  // the unit runs the pinned runtime directly.
   const plan: BootServicePlan = {
-    program:
+    program: [runtimePaths.entryPath, "__service-launcher"],
-      runtimePaths.layout === "archive"
-        ? [runtimePaths.entryPath, "__service-launcher"]
-        : [host.execPath, launcherPath],
-    launcherPath,
     baseDir: input.baseDir,
     logPath,
     unitPath,
 @@ -764,8 +753,8 @@ export const make = Effect.fn("cloud.boot_service.make")(function* (input: {
       validate: (runtime) =>
         runner
           .run({
-            command: pinnedRuntimeCommand(runtime, host.execPath).command,
+            command: pinnedRuntimeCommand(runtime).command,
-            args: [...pinnedRuntimeCommand(runtime, host.execPath).args, "--version"],
+            args: [...pinnedRuntimeCommand(runtime).args, "--version"],
             timeout: Duration.seconds(30),
           })
           .pipe(
 @@ -803,15 +792,6 @@ export const make = Effect.fn("cloud.boot_service.make")(function* (input: {
           : new BootServiceInstallError({ cause: error }),
       ),
     );
-    // Archive runtimes host the launcher in the executable itself; there is
-    // no standalone script to copy.
-    const launcherSource =
-      runtimePaths.layout === "archive"
-        ? undefined
-        : yield* fs
-            .readFileString(launcherSourcePath)
-            .pipe(Effect.mapError((cause) => new BootServiceInstallError({ cause })));
     const installed = yield* fs
       .exists(unitPath)
       .pipe(Effect.mapError((cause) => new BootServiceInstallError({ cause })));
 @@ -844,9 +824,6 @@ export const make = Effect.fn("cloud.boot_service.make")(function* (input: {
       yield* fs
         .makeDirectory(path.dirname(unitPath), { recursive: true })
         .pipe(Effect.mapError((cause) => new BootServiceInstallError({ cause })));
-      if (launcherSource !== undefined) {
-        yield* writeDurably(launcherPath, launcherSource);
-      }
       yield* writeDurably(
         statePath,
         // @effect-diagnostics-next-line preferSchemaOverJson:off - fixed launcher-owned document.
 @@ -893,14 +870,12 @@ export const make = Effect.fn("cloud.boot_service.make")(function* (input: {
     if (!(yield* fs.exists(unitPath))) {
       return { supported: true, installed: false, current: false, unitPath, logPath };
     }
-    const [unit, launcherExists, runtimeEntryExists, runtimeSentinel, stateText] =
+    const [unit, runtimeEntryExists, runtimeSentinel, stateText] = yield* Effect.all([
-      yield* Effect.all([
+      fs.readFileString(unitPath),
-        fs.readFileString(unitPath),
+      fs.exists(runtimePaths.entryPath),
-        runtimePaths.layout === "archive" ? Effect.succeed(true) : fs.exists(launcherPath),
+      fs.readFileString(runtimePaths.sentinelPath).pipe(Effect.option),
-        fs.exists(runtimePaths.entryPath),
+      fs.readFileString(statePath).pipe(Effect.option),
-        fs.readFileString(runtimePaths.sentinelPath).pipe(Effect.option),
+    ]);
-        fs.readFileString(statePath).pipe(Effect.option),
-      ]);
     const state = Option.isSome(stateText) ? parseServiceState(stateText.value) : undefined;
     const installedVersion = Option.isSome(stateText)
       ? serviceStateActiveVersion(stateText.value)
 @@ -920,7 +895,6 @@ export const make = Effect.fn("cloud.boot_service.make")(function* (input: {
       current:
         problems.length === 0 &&
         normalizeUnit(unit) === normalizeUnit(detectedManager.render(plan)) &&
-        launcherExists &&
         runtimeEntryExists &&
         Option.isSome(runtimeSentinel) &&
         runtimeSentinel.value.trim() === input.cliVersion &&

apps/server/src/cloud/pinnedRuntime.test.ts+79-193

 @@ -5,7 +5,6 @@ import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Fiber from "effect/Fiber";
 import * as Path from "effect/Path";
-import * as PlatformError from "effect/PlatformError";
 import { HttpClient, HttpClientResponse } from "effect/unstable/http";
 import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
 @@ -17,16 +16,38 @@ import {
   PinnedRuntimeInstallError,
 } from "./pinnedRuntime.ts";
-const successfulRunner = (fs: FileSystem.FileSystem, path: Path.Path) =>
+// Every install fetches the release archive, checks it against SHA256SUMS,
+// and unpacks it with tar. The fake client serves both files; the fake runner
+// stands in for tar and drops the executable where extraction would.
+const version = "1.2.3";
+const archiveName = `t3-${version}-linux-x64.tar.gz`;
+const archiveBytes = new TextEncoder().encode("not really a tarball");
+const archiveHex = (bytes: Uint8Array) =>
+  Effect.promise(() => crypto.subtle.digest("SHA-256", bytes)).pipe(
+    Effect.map((digest) =>
+      Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join(""),
+    ),
+  );
+const validChecksums = archiveHex(archiveBytes).pipe(
+  Effect.map((hex) => `${hex}  ${archiveName}\n`),
+);
+const releaseHttpClient = (checksums: string, requests: string[] = []) =>
+  HttpClient.make((request) => {
+    requests.push(request.url);
+    const body = request.url.endsWith("/SHA256SUMS") ? checksums : archiveBytes;
+    return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(body)));
+  });
+const extractingRunner = (fs: FileSystem.FileSystem, path: Path.Path, commands: string[] = []) =>
   ProcessRunner.ProcessRunner.of({
     run: (input) =>
       Effect.gen(function* () {
-        const prefixIndex = input.args.indexOf("--prefix");
+        commands.push(input.command);
-        const stagingDir = input.args[prefixIndex + 1];
+        const targetIndex = input.args.indexOf("-C");
-        if (stagingDir === undefined) return yield* Effect.die("missing npm --prefix");
+        const stagingDir = input.args[targetIndex + 1];
-        const entry = path.join(stagingDir, "node_modules", "t3", "dist", "bin.mjs");
+        if (input.command !== "tar" || stagingDir === undefined) {
-        yield* fs.makeDirectory(path.dirname(entry), { recursive: true }).pipe(Effect.orDie);
+          return yield* Effect.die(`unexpected command ${input.command}`);
-        yield* fs.writeFileString(entry, "export {};\n").pipe(Effect.orDie);
+        }
+        yield* fs.writeFileString(path.join(stagingDir, "t3"), "#!/bin/sh\n").pipe(Effect.orDie);
         return {
           stdout: "",
           stderr: "",
 @@ -41,85 +62,62 @@ const successfulRunner = (fs: FileSystem.FileSystem, path: Path.Path) =>
   });
 it.layer(NodeServices.layer)("ensurePinnedRuntimeInstalled", (it) => {
-  it.effect("installs through pnpm when its Node runtime has no npm executable", () =>
+  it.effect("installs the verified release archive as the runtime executable", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
-      const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-pnpm-" });
+      const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-archive-" });
-      const commands: Array<ProcessRunner.ProcessRunInput> = [];
+      const requests: string[] = [];
-      const install = successfulRunner(fs, path);
+      const commands: string[] = [];
       const paths = yield* ensurePinnedRuntimeInstalled({
         baseDir,
-        version: "1.2.3",
+        version,
         fs,
         path,
         platform: "linux",
         arch: "x64",
-        runner: ProcessRunner.ProcessRunner.of({
+        httpClient: releaseHttpClient(yield* validChecksums, requests),
-          run: (input) => {
+        releaseBaseUrl: "https://releases.example/download",
-            commands.push(input);
+        runner: extractingRunner(fs, path, commands),
-            return input.command === "npm"
-              ? Effect.fail(
-                  new ProcessRunner.ProcessSpawnError({
-                    command: "npm",
-                    argumentCount: input.args.length,
-                    cause: PlatformError.systemError({
-                      _tag: "NotFound",
-                      module: "ChildProcess",
-                      method: "spawn",
-                    }),
-                  }),
-                )
-              : install.run(input);
-          },
-        }),
         validate: (staging) =>
           fs.exists(staging.entryPath).pipe(
             Effect.flatMap((exists) => (exists ? Effect.void : Effect.die("missing runtime"))),
             Effect.orDie,
           ),
       });
-      assert.deepEqual(
+      assert.equal(paths.entryPath, path.join(paths.versionDir, "t3"));
-        commands.map((command) => command.command),
+      assert.deepEqual(pinnedRuntimeCommand(paths), { command: paths.entryPath, args: [] });
-        ["npm", "pnpm"],
+      assert.deepEqual(requests, [
-      );
+        `https://releases.example/download/v${version}/SHA256SUMS`,
-      assert.deepEqual(commands[1]!.args, ["--package=npm@11", "dlx", "npm", ...commands[0]!.args]);
+        `https://releases.example/download/v${version}/${archiveName}`,
-      assert.equal(yield* fs.readFileString(paths.sentinelPath), "1.2.3\n");
+      ]);
+      assert.deepEqual(commands, ["tar"]);
+      assert.equal(yield* fs.readFileString(paths.sentinelPath), `${version}\n`);
+      assert.isFalse(yield* fs.exists(path.join(paths.versionDir, "t3-runtime-archive")));
     }),
   );
-  it.effect("does not try a different installer for npm permission failures", () =>
+  it.effect("refuses an archive whose checksum does not match the release", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
-      const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-permission-" });
+      const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-archive-bad-" });
       const commands: string[] = [];
-      yield* ensurePinnedRuntimeInstalled({
+      const error = yield* ensurePinnedRuntimeInstalled({
         baseDir,
-        version: "1.2.3",
+        version,
         fs,
         path,
         platform: "linux",
         arch: "x64",
-        runner: ProcessRunner.ProcessRunner.of({
+        httpClient: releaseHttpClient(`${"0".repeat(64)}  ${archiveName}\n`),
-          run: (input) => {
+        runner: extractingRunner(fs, path, commands),
-            commands.push(input.command);
+        validate: () => Effect.die("must not validate an unverified archive"),
-            return Effect.fail(
-              new ProcessRunner.ProcessSpawnError({
-                command: input.command,
-                argumentCount: input.args.length,
-                cause: PlatformError.systemError({
-                  _tag: "PermissionDenied",
-                  module: "ChildProcess",
-                  method: "spawn",
-                }),
-              }),
-            );
-          },
-        }),
-        validate: () => Effect.die("must not validate a failed install"),
       }).pipe(Effect.flip);
-      assert.deepEqual(commands, ["npm"]);
+      assert.instanceOf(error, PinnedRuntimeInstallError);
+      assert.equal(error.step, "verifying the t3 release archive checksum");
+      assert.deepEqual(commands, []);
+      assert.deepEqual(yield* fs.readDirectory(path.join(baseDir, "runtime", "versions")), []);
     }),
   );
 @@ -128,17 +126,18 @@ it.layer(NodeServices.layer)("ensurePinnedRuntimeInstalled", (it) => {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
       const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-runtime-test-" });
-      const finalPaths = pinnedRuntimePaths(path, baseDir, "1.2.3", "linux");
+      const finalPaths = pinnedRuntimePaths(path, baseDir, version, "linux");
       let validatedDirectory = "";
       const installed = yield* ensurePinnedRuntimeInstalled({
         baseDir,
-        version: "1.2.3",
+        version,
         fs,
         path,
         platform: "linux",
         arch: "x64",
-        runner: successfulRunner(fs, path),
+        httpClient: releaseHttpClient(yield* validChecksums),
+        runner: extractingRunner(fs, path),
         validate: (staging) =>
           Effect.gen(function* () {
             validatedDirectory = staging.versionDir;
 @@ -150,7 +149,7 @@ it.layer(NodeServices.layer)("ensurePinnedRuntimeInstalled", (it) => {
       assert.notEqual(validatedDirectory, finalPaths.versionDir);
       assert.deepEqual(installed, finalPaths);
       assert.isTrue(yield* fs.exists(finalPaths.entryPath));
-      assert.equal(yield* fs.readFileString(finalPaths.sentinelPath), "1.2.3\n");
+      assert.equal(yield* fs.readFileString(finalPaths.sentinelPath), `${version}\n`);
     }),
   );
 @@ -159,16 +158,17 @@ it.layer(NodeServices.layer)("ensurePinnedRuntimeInstalled", (it) => {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
       const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-runtime-test-" });
-      const finalPaths = pinnedRuntimePaths(path, baseDir, "1.2.3", "linux");
+      const finalPaths = pinnedRuntimePaths(path, baseDir, version, "linux");
       yield* ensurePinnedRuntimeInstalled({
         baseDir,
-        version: "1.2.3",
+        version,
         fs,
         path,
         platform: "linux",
         arch: "x64",
-        runner: successfulRunner(fs, path),
+        httpClient: releaseHttpClient(yield* validChecksums),
+        runner: extractingRunner(fs, path),
         validate: () =>
           Effect.fail(new PinnedRuntimeInstallError({ step: "validating the staged runtime" })),
       }).pipe(Effect.flip);
 @@ -188,18 +188,19 @@ it.layer(NodeServices.layer)("ensurePinnedRuntimeInstalled", (it) => {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
       const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-runtime-repair-" });
-      const finalPaths = pinnedRuntimePaths(path, baseDir, "1.2.3", "linux");
+      const finalPaths = pinnedRuntimePaths(path, baseDir, version, "linux");
       yield* fs.makeDirectory(finalPaths.versionDir, { recursive: true });
       yield* fs.writeFileString(path.join(finalPaths.versionDir, "partial"), "incomplete\n");
       yield* ensurePinnedRuntimeInstalled({
         baseDir,
-        version: "1.2.3",
+        version,
         fs,
         path,
         platform: "linux",
         arch: "x64",
-        runner: successfulRunner(fs, path),
+        httpClient: releaseHttpClient(yield* validChecksums),
+        runner: extractingRunner(fs, path),
         validate: () => Effect.void,
       });
 @@ -213,20 +214,22 @@ it.layer(NodeServices.layer)("ensurePinnedRuntimeInstalled", (it) => {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
       const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-runtime-repair-" });
-      const finalPaths = pinnedRuntimePaths(path, baseDir, "1.2.3", "linux");
+      const finalPaths = pinnedRuntimePaths(path, baseDir, version, "linux");
       yield* fs.makeDirectory(path.dirname(finalPaths.entryPath), { recursive: true });
       yield* fs.writeFileString(finalPaths.entryPath, "broken\n");
-      yield* fs.writeFileString(finalPaths.sentinelPath, "1.2.3\n");
+      yield* fs.writeFileString(finalPaths.sentinelPath, `${version}\n`);
       let validations = 0;
+      const requests: string[] = [];
       yield* ensurePinnedRuntimeInstalled({
         baseDir,
-        version: "1.2.3",
+        version,
         fs,
         path,
         platform: "linux",
         arch: "x64",
-        runner: successfulRunner(fs, path),
+        httpClient: releaseHttpClient(yield* validChecksums, requests),
+        runner: extractingRunner(fs, path),
         validate: (paths) =>
           Effect.gen(function* () {
             validations += 1;
 @@ -238,6 +241,7 @@ it.layer(NodeServices.layer)("ensurePinnedRuntimeInstalled", (it) => {
       }).pipe(Effect.flip);
       assert.equal(validations, 1);
+      assert.deepEqual(requests, []);
       assert.equal(yield* fs.readFileString(finalPaths.entryPath), "broken\n");
     }),
   );
 @@ -253,11 +257,12 @@ it.layer(NodeServices.layer)("ensurePinnedRuntimeInstalled", (it) => {
       });
       const install = yield* ensurePinnedRuntimeInstalled({
         baseDir,
-        version: "1.2.3",
+        version,
         fs,
         path,
         platform: "linux",
         arch: "x64",
+        httpClient: releaseHttpClient(yield* validChecksums),
         runner,
         validate: () => Effect.void,
       }).pipe(Effect.forkScoped);
 @@ -268,123 +273,4 @@ it.layer(NodeServices.layer)("ensurePinnedRuntimeInstalled", (it) => {
       assert.deepEqual(yield* fs.readDirectory(versionsDir), []);
     }),
   );
-  // Archive-distributed versions never touch npm: the release archive is
-  // fetched, checked against SHA256SUMS, and unpacked with tar.
-  const archiveVersion = "1.3.0-preview.20260911.7";
-  const archiveName = `t3-${archiveVersion}-linux-x64.tar.gz`;
-  const archiveBytes = new TextEncoder().encode("not really a tarball");
-  const archiveHex = (bytes: Uint8Array) =>
-    Effect.promise(() => crypto.subtle.digest("SHA-256", bytes)).pipe(
-      Effect.map((digest) =>
-        Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join(""),
-      ),
-    );
-  const releaseHttpClient = (checksums: string, requests: string[]) =>
-    HttpClient.make((request) => {
-      requests.push(request.url);
-      const body = request.url.endsWith("/SHA256SUMS") ? checksums : archiveBytes;
-      return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(body)));
-    });
-  const extractingRunner = (fs: FileSystem.FileSystem, path: Path.Path, commands: string[]) =>
-    ProcessRunner.ProcessRunner.of({
-      run: (input) =>
-        Effect.gen(function* () {
-          commands.push(input.command);
-          const targetIndex = input.args.indexOf("-C");
-          const stagingDir = input.args[targetIndex + 1];
-          if (input.command !== "tar" || stagingDir === undefined) {
-            return yield* Effect.die(`unexpected command ${input.command}`);
-          }
-          yield* fs.writeFileString(path.join(stagingDir, "t3"), "#!/bin/sh\n").pipe(Effect.orDie);
-          return {
-            stdout: "",
-            stderr: "",
-            code: ChildProcessSpawner.ExitCode(0),
-            timedOut: false,
-            stdoutTruncated: false,
-            stderrTruncated: false,
-            stdoutInvalidUtf8: false,
-            stderrInvalidUtf8: false,
-          };
-        }),
-    });
-  it.effect("installs archive-distributed versions from the verified release archive", () =>
-    Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-archive-" });
-      const requests: string[] = [];
-      const commands: string[] = [];
-      const checksums = `${yield* archiveHex(archiveBytes)}  ${archiveName}\n`;
-      const paths = yield* ensurePinnedRuntimeInstalled({
-        baseDir,
-        version: archiveVersion,
-        fs,
-        path,
-        platform: "linux",
-        arch: "x64",
-        httpClient: releaseHttpClient(checksums, requests),
-        releaseBaseUrl: "https://releases.example/download",
-        runner: extractingRunner(fs, path, commands),
-        validate: (staging) =>
-          fs.exists(staging.entryPath).pipe(
-            Effect.flatMap((exists) => (exists ? Effect.void : Effect.die("missing runtime"))),
-            Effect.orDie,
-          ),
-      });
-      assert.equal(paths.layout, "archive");
-      assert.equal(paths.entryPath, path.join(paths.versionDir, "t3"));
-      assert.deepEqual(pinnedRuntimeCommand(paths, "/usr/bin/node"), {
-        command: paths.entryPath,
-        args: [],
-      });
-      assert.deepEqual(requests, [
-        `https://releases.example/download/v${archiveVersion}/SHA256SUMS`,
-        `https://releases.example/download/v${archiveVersion}/${archiveName}`,
-      ]);
-      assert.deepEqual(commands, ["tar"]);
-      assert.equal(yield* fs.readFileString(paths.sentinelPath), `${archiveVersion}\n`);
-      assert.isFalse(yield* fs.exists(path.join(paths.versionDir, "t3-runtime-archive")));
-    }),
-  );
-  it.effect("refuses an archive whose checksum does not match the release", () =>
-    Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-archive-bad-" });
-      const commands: string[] = [];
-      const error = yield* ensurePinnedRuntimeInstalled({
-        baseDir,
-        version: archiveVersion,
-        fs,
-        path,
-        platform: "linux",
-        arch: "x64",
-        httpClient: releaseHttpClient(`${"0".repeat(64)}  ${archiveName}\n`, []),
-        runner: extractingRunner(fs, path, commands),
-        validate: () => Effect.die("must not validate an unverified archive"),
-      }).pipe(Effect.flip);
-      assert.instanceOf(error, PinnedRuntimeInstallError);
-      assert.equal(error.step, "verifying the t3 release archive checksum");
-      assert.deepEqual(commands, []);
-      assert.deepEqual(yield* fs.readDirectory(path.join(baseDir, "runtime", "versions")), []);
-    }),
-  );
-  it("runs npm layouts through the host Node", () => {
-    const paths = pinnedRuntimePaths(
-      { join: (...parts: string[]) => parts.join("/") } as Path.Path,
-      "/home/theo/.t3",
-      "1.2.3",
-      "linux",
-    );
-    assert.equal(paths.layout, "npm");
-    assert.deepEqual(pinnedRuntimeCommand(paths, "/usr/bin/node"), {
-      command: "/usr/bin/node",
-      args: ["/home/theo/.t3/runtime/versions/1.2.3/node_modules/t3/dist/bin.mjs"],
-    });
-  });
 });

apps/server/src/cloud/pinnedRuntime.ts+25-108

 @@ -3,7 +3,6 @@ import * as Effect from "effect/Effect";
 import * as Encoding from "effect/Encoding";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
-import * as PlatformError from "effect/PlatformError";
 import * as Schema from "effect/Schema";
 import * as Option from "effect/Option";
 import * as Semaphore from "effect/Semaphore";
 @@ -15,26 +14,21 @@ import {
   cliArchivePlatformKey,
   cliArchiveTarCommand,
   cliReleaseDownloadBaseUrl,
-  isArchiveDistributedVersion,
   parseChecksums,
 } from "@t3tools/shared/cliRelease";
 import * as ProcessRunner from "../processRunner.ts";
 /**
- * A pinned runtime is an exact `t3@<version>` installed into
+ * A pinned runtime is an exact t3 release archive unpacked into
- * <baseDir>/runtime/versions/<version>. The boot service points its unit or
+ * <baseDir>/runtime/versions/<version>: the self-contained executable, the
- * launch agent here, and server self-update installs the target version here before
+ * web client, and the native packages beside it. The boot service points its
- * switching over, never `npx t3`, whose cache is ephemeral and whose
+ * unit or launch agent at the executable, and server self-update installs the
- * registry fetch at boot would make startup depend on the network.
+ * target version here before switching over. The runtime never depends on a
- *
+ * Node or npm on the machine; the only npm involvement in T3 Code is the `t3`
- * Two layouts exist. npm-distributed versions are `npm install`ed and run as
+ * package for people who prefer `npx t3` or `npm install -g t3`, and even a
- * `<node> node_modules/t3/dist/bin.mjs`. Archive-distributed versions are the
+ * CLI installed that way pins an archive when it sets up the service.
- * self-contained release archive unpacked in place and run as `./t3`, which
- * needs neither Node nor npm on the machine. The layout is decided by the
- * version string alone so every consumer agrees without probing the disk.
  */
 const PINNED_RUNTIME_DIR = "runtime";
 const PINNED_RUNTIME_INSTALL_TIMEOUT = Duration.minutes(10);
 const PINNED_RUNTIME_ARCHIVE_FILE = "t3-runtime-archive";
 @@ -42,27 +36,19 @@ const PINNED_RUNTIME_ARCHIVE_FILE = "t3-runtime-archive";
 // the complete install transaction across every caller in this process.
 const pinnedRuntimeInstallLock = Semaphore.makeUnsafe(1);
-export type PinnedRuntimeLayout = "npm" | "archive";
 export interface PinnedRuntimePaths {
-  readonly layout: PinnedRuntimeLayout;
   readonly versionDir: string;
-  /**
+  /** The executable. Its existence is what marks a runtime as present. */
-   * `bin.mjs` for npm layouts, the executable itself for archives. Existence
-   * of this file is what marks a runtime as present.
-   */
   readonly entryPath: string;
   readonly sentinelPath: string;
 }
-/** The exact command that runs a pinned runtime, given the Node hosting the caller. */
+/** The exact command that runs a pinned runtime. */
-export function pinnedRuntimeCommand(
+export function pinnedRuntimeCommand(paths: PinnedRuntimePaths): {
-  paths: PinnedRuntimePaths,
+  readonly command: string;
-  nodePath: string,
+  readonly args: ReadonlyArray<string>;
-): { readonly command: string; readonly args: ReadonlyArray<string> } {
+} {
-  return paths.layout === "archive"
+  return { command: paths.entryPath, args: [] };
-    ? { command: paths.entryPath, args: [] }
-    : { command: nodePath, args: [paths.entryPath] };
 }
 export function pinnedRuntimePaths(
 @@ -72,20 +58,10 @@ export function pinnedRuntimePaths(
   platform: NodeJS.Platform,
 ): PinnedRuntimePaths {
   const versionDir = path.join(baseDir, PINNED_RUNTIME_DIR, "versions", version);
-  const sentinelPath = path.join(versionDir, ".install-complete");
-  if (isArchiveDistributedVersion(version)) {
-    return {
-      layout: "archive",
-      versionDir,
-      entryPath: path.join(versionDir, platform === "win32" ? "t3.exe" : "t3"),
-      sentinelPath,
-    };
-  }
   return {
-    layout: "npm",
     versionDir,
-    entryPath: path.join(versionDir, "node_modules", "t3", "dist", "bin.mjs"),
+    entryPath: path.join(versionDir, platform === "win32" ? "t3.exe" : "t3"),
-    sentinelPath,
+    sentinelPath: path.join(versionDir, ".install-complete"),
   };
 }
 @@ -119,12 +95,12 @@ export class PinnedRuntimePreflightBlockedError extends Schema.TaggedError<Pinne
 }
 /**
- * Installs `t3@<version>` into the pinned runtime directory unless a complete
+ * Installs the t3 release archive for `version` into the pinned runtime
- * install is already there, and returns its paths. The sentinel is written
+ * directory unless a complete install is already there, and returns its
- * only after the install step exits 0; checking the entry file alone is not
+ * paths. The sentinel is written only after extraction and validation
- * enough. npm extracts files before running native builds (node-pty), and tar
+ * succeed; checking the entry file alone is not enough, since tar writes the
- * writes the executable before the last native package, so a killed install
+ * executable before the last native package and a killed install leaves a
- * leaves a plausible-looking but broken tree behind.
+ * plausible-looking but broken tree behind.
  */
 interface PinnedRuntimeInstallInput {
   readonly baseDir: string;
 @@ -137,59 +113,10 @@ interface PinnedRuntimeInstallInput {
   ) => Effect.Effect<void, PinnedRuntimeInstallError | PinnedRuntimePreflightBlockedError>;
   readonly platform: NodeJS.Platform;
   readonly arch: string;
-  /** Archive-distributed versions download from here; npm versions never need it. */
+  readonly httpClient: HttpClient.HttpClient;
-  readonly httpClient?: HttpClient.HttpClient | undefined;
   readonly releaseBaseUrl?: string | undefined;
 }
-const installFromNpm = Effect.fn("cloud.pinned_runtime.install_npm")(function* (
-  input: PinnedRuntimeInstallInput,
-  stagingDir: string,
-) {
-  const installStep = "installing the pinned t3 runtime (this can take a few minutes)";
-  const installArgs = [
-    "install",
-    "--prefix",
-    stagingDir,
-    "--no-fund",
-    "--no-audit",
-    `t3@${input.version}`,
-  ];
-  yield* input.runner
-    .run({
-      command: "npm",
-      args: installArgs,
-      // Native dependencies may compile from source on slower machines.
-      timeout: PINNED_RUNTIME_INSTALL_TIMEOUT,
-    })
-    .pipe(
-      Effect.catchTags({
-        ProcessSpawnError: (error) =>
-          error.cause instanceof PlatformError.PlatformError &&
-          error.cause.reason._tag === "NotFound"
-            ? // pnpm-managed Node installations do not include npm. Keep npm
-              // installation semantics for the pinned runtime and native builds.
-              input.runner.run({
-                command: "pnpm",
-                args: ["--package=npm@11", "dlx", "npm", ...installArgs],
-                timeout: PINNED_RUNTIME_INSTALL_TIMEOUT,
-              })
-            : Effect.fail(error),
-      }),
-      Effect.mapError((cause) => new PinnedRuntimeInstallError({ step: installStep, cause })),
-      Effect.filterOrFail(
-        (result) => result.code === 0,
-        (result) =>
-          new PinnedRuntimeInstallError({
-            step: installStep,
-            exitCode: Number(result.code),
-            stdoutLength: result.stdout.length,
-            stderrLength: result.stderr.length,
-          }),
-      ),
-    );
-});
 const fetchReleaseAsset = Effect.fn("cloud.pinned_runtime.fetch_release_asset")(function* (
   httpClient: HttpClient.HttpClient,
   url: string,
 @@ -227,11 +154,6 @@ const installFromArchive = Effect.fn("cloud.pinned_runtime.install_archive")(fun
     });
   }
   const httpClient = input.httpClient;
-  if (httpClient === undefined) {
-    return yield* new PinnedRuntimeInstallError({
-      step: "downloading the t3 release archive (no HTTP client available)",
-    });
-  }
   const baseUrl = cliReleaseDownloadBaseUrl(input.version, input.releaseBaseUrl);
   const fileName = cliArchiveFileName(input.version, platformKey);
 @@ -356,18 +278,13 @@ const installPinnedRuntime = Effect.fn("cloud.pinned_runtime.ensure_installed")(
       ),
     );
   const stagingPaths: PinnedRuntimePaths = {
-    layout: paths.layout,
     versionDir: stagingDir,
     entryPath: input.path.join(stagingDir, input.path.relative(paths.versionDir, paths.entryPath)),
     sentinelPath: input.path.join(stagingDir, ".install-complete"),
   };
   return yield* Effect.gen(function* () {
-    if (paths.layout === "archive") {
+    yield* installFromArchive(input, stagingDir);
-      yield* installFromArchive(input, stagingDir);
-    } else {
-      yield* installFromNpm(input, stagingDir);
-    }
     yield* input.validate(stagingPaths);
     yield* fs

apps/server/src/cloud/selfUpdate.test.ts+33-10

 @@ -1,13 +1,14 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { expect, it } from "@effect/vitest";
 import { ServerSelfUpdateError, ThreadId } from "@t3tools/contracts";
-import { HostProcessExecutablePath } from "@t3tools/shared/hostProcess";
+import { HostProcessArchitecture, HostProcessPlatform } from "@t3tools/shared/hostProcess";
 import * as Cause from "effect/Cause";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Fiber from "effect/Fiber";
 import * as Path from "effect/Path";
+import { HttpClient, HttpClientResponse } from "effect/unstable/http";
 import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
 import * as ServerConfig from "../config.ts";
 @@ -25,6 +26,28 @@ interface HarnessOptions {
   readonly desktopAppUpdate?: DesktopAppUpdate.DesktopAppUpdate["Service"];
 }
+// The staged runtime is a release archive: the fake client serves SHA256SUMS
+// and the tarball, and the fake runner stands in for tar before it answers
+// the staged preflight.
+const archiveBytes = new TextEncoder().encode("not really a tarball");
+const releaseHttpClient = (order: string[]) =>
+  HttpClient.make((request) =>
+    Effect.gen(function* () {
+      if (request.url.endsWith("/SHA256SUMS")) {
+        const digest = yield* Effect.promise(() => crypto.subtle.digest("SHA-256", archiveBytes));
+        const hex = Array.from(new Uint8Array(digest), (byte) =>
+          byte.toString(16).padStart(2, "0"),
+        ).join("");
+        return HttpClientResponse.fromWeb(
+          request,
+          new Response(`${hex}  t3-1.1.0-linux-x64.tar.gz\n`),
+        );
+      }
+      order.push("download");
+      return HttpClientResponse.fromWeb(request, new Response(archiveBytes));
+    }),
+  );
 const makeHarness = Effect.fn("test.make_self_update_harness")(function* (
   options: HarnessOptions = {},
 ) {
 @@ -35,13 +58,11 @@ const makeHarness = Effect.fn("test.make_self_update_harness")(function* (
   const runner = ProcessRunner.ProcessRunner.of({
     run: (input) =>
       Effect.gen(function* () {
-        if (input.command === "npm") {
+        if (input.command === "tar") {
-          order.push("install");
+          order.push("extract");
-          const prefix = input.args[input.args.indexOf("--prefix") + 1];
+          const stagingDir = input.args[input.args.indexOf("-C") + 1];
-          if (prefix === undefined) return yield* Effect.die("missing npm prefix");
+          if (stagingDir === undefined) return yield* Effect.die("missing tar target");
-          const entry = path.join(prefix, "node_modules", "t3", "dist", "bin.mjs");
+          yield* fs.writeFileString(path.join(stagingDir, "t3"), "#!/bin/sh\n").pipe(Effect.orDie);
-          yield* fs.makeDirectory(path.dirname(entry), { recursive: true }).pipe(Effect.orDie);
-          yield* fs.writeFileString(entry, "export {};\n").pipe(Effect.orDie);
           return {
             stdout: "",
             stderr: "",
 @@ -99,7 +120,9 @@ const makeHarness = Effect.fn("test.make_self_update_harness")(function* (
         run: () => Effect.die("unexpected desktop app update run"),
       },
     ),
-    Effect.provideService(HostProcessExecutablePath, "/usr/bin/node"),
+    Effect.provideService(HttpClient.HttpClient, releaseHttpClient(order)),
+    Effect.provideService(HostProcessPlatform, "linux"),
+    Effect.provideService(HostProcessArchitecture, "x64"),
     Effect.provide(ServerConfig.layer({ ...config, mode: options.mode ?? "web" })),
   );
   return { selfUpdate, order };
 @@ -329,7 +352,7 @@ it.layer(NodeServices.layer)("server self update", (it) => {
         method: "boot-service",
         updateId: "launcher-id",
       });
-      expect(order).toEqual(["install", "preflight", "accept"]);
+      expect(order).toEqual(["download", "extract", "preflight", "accept"]);
     }),
   );

apps/server/src/cloud/selfUpdate.ts+4-9

 @@ -6,11 +6,7 @@ import {
   type ServerSelfUpdateResult,
   type ThreadId,
 } from "@t3tools/contracts";
-import {
+import { HostProcessArchitecture, HostProcessPlatform } from "@t3tools/shared/hostProcess";
-  HostProcessArchitecture,
-  HostProcessExecutablePath,
-  HostProcessPlatform,
-} from "@t3tools/shared/hostProcess";
 import * as Cause from "effect/Cause";
 import * as Config from "effect/Config";
 import * as Context from "effect/Context";
 @@ -180,12 +176,11 @@ export const make = Effect.fn("cloud.server_self_update.make")(function* () {
   const runner = yield* ProcessRunner.ProcessRunner;
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const execPath = yield* HostProcessExecutablePath;
   const platform = yield* HostProcessPlatform;
   const arch = yield* HostProcessArchitecture;
   // Archive-distributed targets download from GitHub Releases. The client is
   // optional so callers without one (tests, npm-only hosts) still construct.
-  const httpClient = Option.getOrUndefined(yield* Effect.serviceOption(HttpClient.HttpClient));
+  const httpClient = yield* HttpClient.HttpClient;
   const releaseBaseUrl = Option.getOrUndefined(
     yield* Config.string(CLI_RELEASE_BASE_URL_ENV).pipe(Config.option),
   );
 @@ -241,9 +236,9 @@ export const make = Effect.fn("cloud.server_self_update.make")(function* () {
         validate: (runtime) =>
           runner
             .run({
-              command: pinnedRuntimeCommand(runtime, execPath).command,
+              command: pinnedRuntimeCommand(runtime).command,
               args: [
-                ...pinnedRuntimeCommand(runtime, execPath).args,
+                ...pinnedRuntimeCommand(runtime).args,
                 "__service-preflight",
                 "--database-path",
                 serverConfig.dbPath,

apps/server/src/cloud/serviceProtocol.ts-1

...	@@ -3,7 +3,6 @@ import type { ServerSelfUpdateOutcome } from "@t3tools/contracts";	...	@@ -3,7 +3,6 @@ import type { ServerSelfUpdateOutcome } from "@t3tools/contracts";
3	/** Protocol 2 snapshots SQLite before trials so migrations can be rolled back safely. */	3	/** Protocol 2 snapshots SQLite before trials so migrations can be rolled back safely. */
4	export const SERVICE_LAUNCHER_PROTOCOL = 2 as const;	4	export const SERVICE_LAUNCHER_PROTOCOL = 2 as const;
5	export const SERVICE_LAUNCHER_CONTEXT_ENV = "T3_SERVICE_LAUNCHER_CONTEXT";	5	export const SERVICE_LAUNCHER_CONTEXT_ENV = "T3_SERVICE_LAUNCHER_CONTEXT";
6	export const SERVICE_LAUNCHER_FILE = "service-launcher.mjs";
7	export const SERVICE_STATE_FILE = "service-state.json";	6	export const SERVICE_STATE_FILE = "service-state.json";
8	/** Written by the launcher just before an explicit stop kills its child, so	7	/** Written by the launcher just before an explicit stop kills its child, so
9	the child can tell "the service is going away" from "the launcher is about	8	the child can tell "the service is going away" from "the launcher is about

apps/server/src/service-launcher.ts deleted-20

...	@@ -1,20 +0,0 @@
1	// Standalone launcher entry for npm-distributed runtimes: `node
2	// service-launcher.mjs`. Archive runtimes reach the same code through the
3	// `t3 __service-launcher` subcommand, so serviceLauncher.ts itself must not run
4	// anything on import.
5	import { isEntrypoint } from "./entrypoint.ts";
6	import { main } from "./serviceLauncher.ts";
7
8	if (
9	isEntrypoint({
10	moduleUrl: import.meta.url,
11	entryPath: process.argv[1],
12	runtimeMain: import.meta.main,
13	})
14	) {
15	main().catch((cause: unknown) => {
16	const error = cause instanceof Error ? cause : new Error(String(cause));
17	process.stderr.write(`[service-launcher] ${error.message}\n`);
18	process.exitCode = 1;
19	});
20	}

apps/server/src/serviceLauncher.test.ts+45-20

 @@ -75,6 +75,27 @@ it("rejects contradictory service state", () => {
   );
 });
+// A pinned runtime is an executable at <versionDir>/t3. The tests stand one up
+// as a Node shebang script so the launcher spawns it the way it spawns the
+// real single-executable, IPC channel included.
+const writeFakeRuntime = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  versionDir: string,
+  childSource: string,
+) =>
+  Effect.gen(function* () {
+    const entryPath = path.join(versionDir, "t3");
+    yield* fs.makeDirectory(versionDir, { recursive: true });
+    yield* fs.writeFileString(entryPath, `#!${process.execPath}\n${childSource}`);
+    yield* fs.chmod(entryPath, 0o755);
+    yield* fs.writeFileString(
+      path.join(versionDir, ".install-complete"),
+      `${path.basename(versionDir)}\n`,
+    );
+    return entryPath;
+  });
 it.layer(NodeServices.layer)("service state persistence", (it) => {
   it.effect("durably replaces and strictly reads one state document", () =>
     Effect.gen(function* () {
 @@ -98,11 +119,12 @@ it.layer(NodeServices.layer)("service state persistence", (it) => {
       const path = yield* Path.Path;
       const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-service-launcher-stop-" });
       const statePath = path.join(root, "runtime", "service-state.json");
-      const versionDir = path.join(root, "runtime", "versions", "1.0.0");
+      yield* writeFakeRuntime(
-      const entryPath = path.join(versionDir, "node_modules", "t3", "dist", "bin.mjs");
+        fs,
-      yield* fs.makeDirectory(path.dirname(entryPath), { recursive: true });
+        path,
-      yield* fs.writeFileString(entryPath, "setInterval(() => {}, 1_000);\n");
+        path.join(root, "runtime", "versions", "1.0.0"),
-      yield* fs.writeFileString(path.join(versionDir, ".install-complete"), "1.0.0\n");
+        "setInterval(() => {}, 1_000);\n",
+      );
       yield* Effect.promise(() =>
         writeServiceState(statePath, {
           protocol: SERVICE_LAUNCHER_PROTOCOL,
 @@ -148,11 +170,12 @@ if (context.update?.status === "pending") {
 }
 `;
       for (const version of ["1.0.0", "1.1.0"]) {
-        const versionDir = path.join(root, "runtime", "versions", version);
+        yield* writeFakeRuntime(
-        const entryPath = path.join(versionDir, "node_modules", "t3", "dist", "bin.mjs");
+          fs,
-        yield* fs.makeDirectory(path.dirname(entryPath), { recursive: true });
+          path,
-        yield* fs.writeFileString(entryPath, childSource);
+          path.join(root, "runtime", "versions", version),
-        yield* fs.writeFileString(path.join(versionDir, ".install-complete"), `${version}\n`);
+          childSource,
+        );
       }
       yield* Effect.promise(() =>
         writeServiceState(statePath, {
 @@ -198,11 +221,12 @@ if (context.update?.status === "pending") {
 }
 `;
       for (const version of ["1.0.0", "1.1.0"]) {
-        const versionDir = path.join(root, "runtime", "versions", version);
+        yield* writeFakeRuntime(
-        const entryPath = path.join(versionDir, "node_modules", "t3", "dist", "bin.mjs");
+          fs,
-        yield* fs.makeDirectory(path.dirname(entryPath), { recursive: true });
+          path,
-        yield* fs.writeFileString(entryPath, childSource);
+          path.join(root, "runtime", "versions", version),
-        yield* fs.writeFileString(path.join(versionDir, ".install-complete"), `${version}\n`);
+          childSource,
+        );
       }
       yield* Effect.promise(() =>
         writeServiceState(statePath, {
 @@ -257,11 +281,12 @@ if (context.update?.status === "pending") {
 }
 `;
       for (const version of ["1.0.0", "1.1.0"]) {
-        const versionDir = path.join(root, "runtime", "versions", version);
+        yield* writeFakeRuntime(
-        const entryPath = path.join(versionDir, "node_modules", "t3", "dist", "bin.mjs");
+          fs,
-        yield* fs.makeDirectory(path.dirname(entryPath), { recursive: true });
+          path,
-        yield* fs.writeFileString(entryPath, childSource);
+          path.join(root, "runtime", "versions", version),
-        yield* fs.writeFileString(path.join(versionDir, ".install-complete"), `${version}\n`);
+          childSource,
+        );
       }
       yield* Effect.promise(() =>
         writeServiceState(statePath, {

apps/server/src/serviceLauncher.ts+11-29

 @@ -1,13 +1,14 @@
 // @effect-diagnostics nodeBuiltinImport:off
 // @effect-diagnostics globalTimers:off
-// This file is shipped as a standalone bundle and copied to a stable path by
+// The launcher supervises the server child for the boot service and must keep
-// `t3 service update`. Keep runtime imports limited to Node built-ins.
+// working across server versions, so it stays on Node built-ins with no Effect
+// runtime: it is the one part of the executable that cannot depend on the
+// rest of it being loadable.
 import * as NodeChildProcess from "node:child_process";
 import * as NodeCrypto from "node:crypto";
 import * as NodeFS from "node:fs";
 import * as NodeFSP from "node:fs/promises";
 import * as NodePath from "node:path";
-import * as NodeSea from "node:sea";
 import type {
   PendingServiceUpdate,
 @@ -41,37 +42,24 @@ interface ManagedChild {
   readonly process: NodeChildProcess.ChildProcess;
 }
-// Mirrors pinnedRuntimePaths: archive-distributed versions are unpacked
+// Mirrors pinnedRuntimePaths: a runtime is an unpacked release archive whose
-// release archives whose executable runs on its own, npm versions are a
+// executable runs on its own. Kept inline so this file stays on Node
-// bin.mjs the launcher's Node runs. Kept inline so this file stays on Node
 // built-ins only.
 const runtimePaths = (baseDir: string, version: string) => {
   const versionDir = NodePath.join(baseDir, "runtime", "versions", version);
-  const archive = /-preview\.\d{8}\.\d+$/.test(version);
   // oxlint-disable-next-line t3code/no-global-process-runtime -- Standalone launcher has no Effect runtime.
   const executableName = process.platform === "win32" ? "t3.exe" : "t3";
   return {
     versionDir,
-    entryPath: archive
+    entryPath: NodePath.join(versionDir, executableName),
-      ? NodePath.join(versionDir, executableName)
-      : NodePath.join(versionDir, "node_modules", "t3", "dist", "bin.mjs"),
     sentinelPath: NodePath.join(versionDir, ".install-complete"),
-    executable: archive,
   };
 };
-const runtimeSpawnArguments = (paths: ReturnType<typeof runtimePaths>) =>
+const runtimeSpawnArguments = (paths: ReturnType<typeof runtimePaths>) => ({
-  paths.executable
+  command: paths.entryPath,
-    ? { command: paths.entryPath, args: ["serve"] }
+  args: ["serve"],
-    : { command: process.execPath, args: [paths.entryPath, "serve"] };
+});
-// An npm-layout runtime needs a Node interpreter. When the launcher itself is
-// the single-executable, process.execPath is `t3`, which cannot run a
-// bin.mjs, so the two layouts cannot be mixed within one service install.
-const launcherIsExecutable = NodeSea.isSea();
-const canLaunchRuntime = (paths: ReturnType<typeof runtimePaths>) =>
-  paths.executable || !launcherIsExecutable;
 /** SQLite persists across the main file plus its WAL and shared-memory sidecars. */
 const DB_FILE_SUFFIXES = ["", "-wal", "-shm"] as const;
 @@ -505,12 +493,6 @@ export class Launcher {
       await reject("The requested database path is not absolute.");
       return;
     }
-    if (!canLaunchRuntime(runtimePaths(this.#baseDir, message.targetVersion))) {
-      await reject(
-        "This service runs from a self-contained t3 executable and cannot switch to an npm-installed version. Reinstall the service with the target version instead.",
-      );
-      return;
-    }
     if (!(await runtimeExists(this.#baseDir, message.targetVersion))) {
       await reject("The requested target runtime is missing or incomplete.");
       return;

docs/operations/release.md+15-13

 @@ -34,8 +34,8 @@ This document covers the unified release workflow for stable and nightly desktop
   - Nightly runs are always GitHub prereleases and never marked latest.
   - Automatically generated release notes are pinned to the previous tag in the same channel, so stable compares to the previous stable tag and nightly compares to the previous nightly tag.
 - Includes Electron auto-update metadata (for example `latest*.yml`, `nightly*.yml`, and `*.blockmap`) in release assets.
-- Builds a self-contained CLI archive per platform (`t3-<version>-<platform>-<arch>.tar.gz`, `.zip` on Windows) on the same runners as the desktop artifacts and attaches them to the GitHub Release with a `SHA256SUMS` file. Only native runners build one (macOS arm64, Linux x64, Windows x64); macOS x64 is skipped because a cross-built executable cannot be verified on real x64 hardware in CI.
+- Builds a self-contained CLI archive per platform (`t3-<version>-<platform>-<arch>.tar.gz`, `.zip` on Windows) on the same runners as the desktop artifacts and attaches them to the GitHub Release with a `SHA256SUMS` file, on every channel. Only native runners build one (macOS arm64, Linux x64, Windows x64); macOS x64 is skipped because a cross-built executable cannot be verified on real x64 hardware in CI.
-  - The archive holds the server as a Node single-executable (`scripts/build-cli-archive.ts`), so unpacking it needs neither Node, npm, nor a compiler. It is the download every runtime installer will verify against `SHA256SUMS`.
+  - The archive holds the server as a Node single-executable (`scripts/build-cli-archive.ts`), so unpacking it needs neither Node, npm, nor a compiler. It is the only form in which T3 Code manages a runtime: the desktop's SSH environments, the boot service, `t3 update`, and the install scripts all download and verify this archive against `SHA256SUMS`. The npm package exists for people who run `npx t3` or `npm install -g t3` themselves; nothing in the product installs from npm. The `curl | sh` installers are `scripts/install.sh` and `scripts/install.ps1`; the marketing site copies them into its `public/` at build time (`apps/marketing/scripts/stage-install-scripts.mjs`) and serves them at `t3.codes/install.sh` and `/install.ps1`.
   - The executable is built with a Node that supports `--build-sea` (`VP_NODE_VERSION=26.8.2`, kept in step with `SEA_NODE_VERSION` in `apps/server/vite.config.ts`), while the repo stays on `engines.node`.
   - macOS archives are signed with the Developer ID certificate and notarized when the Apple secrets are present (ad hoc otherwise, which still runs from `curl`/`tar` installs). Windows executables use the same Azure Trusted Signing setup as the installer. Every native addon in the macOS archive is signed too, since the hardened runtime refuses unsigned libraries.
   - Each archive is extracted and executed on its build runner (`scripts/smoke-cli-archive.ts`) before it is uploaded.
 @@ -251,12 +251,13 @@ Windows packages the bundled server and only its runtime-external/native
 dependency closure in `resources/server.asar`. Native modules and helper
 executables declared as unpacked by that archive must be present at the matching
 paths below `resources/server.asar.unpacked`. The Windows-native backend reads
-the archive in place through Electron. Packaged Windows builds also ship a
+the archive in place through Electron. Packaged Windows builds also ship
-Linux-only `resources/wsl-runtime.tar.gz` plus its SHA-256 sidecar. WSL verifies
+`resources/wsl-runtime.tar.gz` plus its SHA-256 sidecar: the Linux CLI archive
-and extracts that archive into `~/.t3/wsl-runtime/sha256-<archive-digest>` inside
+(`t3-<version>-linux-x64.tar.gz`) built by the `build_linux_cli` job and handed
-the selected distro, then reuses it for later launches of the same update. The
+to the Windows desktop build as `--wsl-runtime`, copied in verbatim so WSL runs
-Windows-side `wsl-server-tree/<version>` extraction remains a fallback and is
+the exact bytes a Linux user downloads. WSL verifies and extracts that archive
-removed after the distro-local runtime passes preflight.
+into `~/.t3/wsl-runtime/sha256-<archive-digest>` inside the selected distro,
+then reuses it for later launches of the same update.
 Windows keeps JavaScript and package metadata inside `app.asar` and unpacks only
 native libraries and helper executables. Avoid enabling whole-package smart
 @@ -272,11 +273,12 @@ break:
 - On same-architecture Windows builds, the packaged primary cannot load the fff
   native library from inside `server.asar` through its `.unpacked` sibling.
 - The isolated, extracted sidecar cannot load the server entry with plain Node.
-- A Windows build with a WSL node-pty prebuild omits the WSL archive or SHA-256
+- A Windows build given `--wsl-runtime` omits the WSL archive or SHA-256
-  sidecar, the sidecar digest does not match the emitted archive, or required
+  sidecar, or the sidecar digest does not match the emitted archive.
-  Linux runtime members are absent.
+- The emitted WSL archive is not a Linux CLI release archive: it must unpack to
-- The emitted WSL archive contains Windows/Darwin node-pty payloads, ConPTY,
+  a single `t3-<version>-linux-<arch>` directory holding `t3`, `client/`, and
-  pnpm install metadata, or Windows-only FFF, ffi-rs, or msgpackr bindings.
+  `node_modules/` with the Linux node-pty binary, and must not carry a loose
+  server bundle (`bin.mjs`).
 - The external Windows resource monitor is absent.
 - The unpacked Windows application contains more than 80 files.

docs/user/background-service.md+2-5

knip.jsonc-1

...	@@ -20,7 +20,6 @@	...	@@ -20,7 +20,6 @@
20	// Vite+ pack entries and the launcher used by installed background services.	20	// Vite+ pack entries and the launcher used by installed background services.
21	"entry": [	21	"entry": [
22	"src/bin.ts!",	22	"src/bin.ts!",
23	"src/service-launcher.ts!",
24	"src/claude-history-worker.ts!",	23	"src/claude-history-worker.ts!",
25	"scripts/cli.ts",	24	"scripts/cli.ts",
26	"src/provider/testFixtures/*.mjs",	25	"src/provider/testFixtures/*.mjs",

packages/shared/src/cliRelease.test.ts-7

 @@ -7,7 +7,6 @@ import {
   cliReleaseDownloadBaseUrl,
   cliReleaseChannelOf,
   cliReleaseIndexPageUrl,
-  isArchiveDistributedVersion,
   newestCliReleaseVersion,
   parseChecksums,
 } from "./cliRelease.ts";
 @@ -56,12 +55,6 @@ describe("cliRelease", () => {
     expect(checksums.size).toBe(2);
   });
-  it("treats only preview builds as archive-distributed", () => {
-    expect(isArchiveDistributedVersion("1.2.3-preview.20260911.4")).toBe(true);
-    expect(isArchiveDistributedVersion("1.2.3-nightly.20260911.4")).toBe(false);
-    expect(isArchiveDistributedVersion("1.2.3")).toBe(false);
-  });
   it("extracts with the System32 bsdtar on Windows and plain tar elsewhere", () => {
     expect(cliArchiveTarCommand("linux", {})).toBe("tar");
     expect(cliArchiveTarCommand("win32", { SystemRoot: "D:\\Win" })).toBe(

packages/shared/src/cliRelease.ts-5

 @@ -70,11 +70,6 @@ export function parseChecksums(text: string): ReadonlyMap<string, string> {
   return checksums;
 }
-/** Whether a version was published from a release train that ships archives. */
-export function isArchiveDistributedVersion(version: string): boolean {
-  return /-preview\.\d{8}\.\d+$/.test(version);
-}
 export type CliReleaseChannel = "stable" | "nightly" | "preview";
 export const CLI_RELEASE_CHANNELS: ReadonlyArray<CliReleaseChannel> = [
   "stable",

packages/ssh/src/command.test.ts-36

...	@@ -14,7 +14,6 @@ import {	...	@@ -14,7 +14,6 @@ import {
14	baseSshArgs,	14	baseSshArgs,
15	getLastNonEmptyOutputLine,	15	getLastNonEmptyOutputLine,
16	parseSshResolveOutput,	16	parseSshResolveOutput,
17	resolveRemoteT3CliPackageSpec,
18	runSshCommand,	17	runSshCommand,
19	} from "./command.ts";	18	} from "./command.ts";
20	import { SshCommandError } from "./errors.ts";	19	import { SshCommandError } from "./errors.ts";
...	@@ -99,41 +98,6 @@ describe("ssh command", () => {	...	@@ -99,41 +98,6 @@ describe("ssh command", () => {
99	}),	98	}),
100	);	99	);
101		100
102	it.effect("resolves the remote t3 package spec from the desktop release channel", () =>
103	Effect.sync(() => {
104	assert.equal(
105	resolveRemoteT3CliPackageSpec({
106	appVersion: "0.0.17",
107	updateChannel: "latest",
108	}),
109	"t3@0.0.17",
110	);
111	assert.equal(
112	resolveRemoteT3CliPackageSpec({
113	appVersion: "0.0.17-nightly.20260415.44",
114	updateChannel: "nightly",
115	}),
116	"t3@0.0.17-nightly.20260415.44",
117	);
118	assert.equal(
119	resolveRemoteT3CliPackageSpec({
120	appVersion: "0.0.0-dev",
121	updateChannel: "nightly",
122	isDevelopment: true,
123	}),
124	"t3@nightly",
125	);
126	assert.equal(
127	resolveRemoteT3CliPackageSpec({
128	appVersion: "0.0.0-dev",
129	updateChannel: "latest",
130	isDevelopment: true,
131	}),
132	"t3@nightly",
133	);
134	}),
135	);
136
137	it.effect("reads the last non-empty ssh output line", () =>	101	it.effect("reads the last non-empty ssh output line", () =>
138	Effect.sync(() => {	102	Effect.sync(() => {
139	assert.equal(	103	assert.equal(

packages/ssh/src/command.ts+1-19

...	@@ -1,6 +1,6 @@	...	@@ -1,6 +1,6 @@
1	import * as NodeCrypto from "node:crypto";	1	import * as NodeCrypto from "node:crypto";
2		2
3	import type { DesktopSshEnvironmentTarget, DesktopUpdateChannel } from "@t3tools/contracts";	3	import type { DesktopSshEnvironmentTarget } from "@t3tools/contracts";
4	import { HostProcessPlatform } from "@t3tools/shared/hostProcess";	4	import { HostProcessPlatform } from "@t3tools/shared/hostProcess";
5	import * as Duration from "effect/Duration";	5	import * as Duration from "effect/Duration";
6	import * as Effect from "effect/Effect";	6	import * as Effect from "effect/Effect";
...	@@ -14,7 +14,6 @@ import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";	...	@@ -14,7 +14,6 @@ import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
14	import { buildSshChildEnvironment, type SshAuthOptions } from "./auth.ts";	14	import { buildSshChildEnvironment, type SshAuthOptions } from "./auth.ts";
15	import { SshCommandError, SshInvalidTargetError } from "./errors.ts";	15	import { SshCommandError, SshInvalidTargetError } from "./errors.ts";
16		16
17	const PUBLISHABLE_T3_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u;
18	const DEFAULT_SSH_COMMAND_TIMEOUT_MS = 60_000;	17	const DEFAULT_SSH_COMMAND_TIMEOUT_MS = 60_000;
19	const MAX_SSH_ERROR_OUTPUT_LENGTH = 4_000;	18	const MAX_SSH_ERROR_OUTPUT_LENGTH = 4_000;
20		19
...	@@ -363,20 +362,3 @@ export const resolveSshTarget = Effect.fn("ssh/command.resolveSshTarget")(functi	...	@@ -363,20 +362,3 @@ export const resolveSshTarget = Effect.fn("ssh/command.resolveSshTarget")(functi
363	),	362	),
364	);	363	);
365	});	364	});
366
367	export function resolveRemoteT3CliPackageSpec(input: {
368	readonly appVersion: string;
369	readonly updateChannel: DesktopUpdateChannel;
370	readonly isDevelopment?: boolean;
371	}): string {
372	const appVersion = input.appVersion.trim();
373	if (!input.isDevelopment && PUBLISHABLE_T3_VERSION_PATTERN.test(appVersion)) {
374	return `t3@${appVersion}`;
375	}
376
377	if (input.isDevelopment) {
378	return "t3@nightly";
379	}
380
381	return input.updateChannel === "nightly" ? "t3@nightly" : "t3@latest";
382	}

packages/ssh/src/runnerProcess.test.ts+81-258

...	@@ -23,23 +23,19 @@ const decodeStarted = Schema.decodeUnknownSync(Schema.fromJsonString(Started));	...	@@ -23,23 +23,19 @@ const decodeStarted = Schema.decodeUnknownSync(Schema.fromJsonString(Started));
23	describe.skipIf(HostProcessPlatform.defaultValue() === "win32")(	23	describe.skipIf(HostProcessPlatform.defaultValue() === "win32")(
24	"remote runner process ownership",	24	"remote runner process ownership",
25	() => {	25	() => {
26	it.live.each(["npx", "npm"] as const)(	26	it.live("keeps the server PID and graceful shutdown through the node-script runner", () =>
27	"keeps the server PID and graceful shutdown through the %s fallback",	27	Effect.gen(function* () {
28	(packageManager) =>	28	const fs = yield* FileSystem.FileSystem;
29	Effect.gen(function* () {	29	const path = yield* Path.Path;
30	const fs = yield* FileSystem.FileSystem;	30	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
31	const path = yield* Path.Path;	31	const fixture = yield* fs.makeTempDirectoryScoped({ prefix: "t3-runner-" });
32	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;	32	const bin = path.join(fixture, "bin");
33	const fixture = yield* fs.makeTempDirectoryScoped({ prefix: "t3-runner-" });	33	const cliPath = path.join(fixture, "installed cli.mjs");
34	const bin = path.join(fixture, "bin");	34	yield* fs.makeDirectory(bin);
35	const cliPath = path.join(fixture, "installed cli.mjs");	35	yield* fs.symlink(process.execPath, path.join(bin, "node"));
36	const callsPath = path.join(fixture, "package-manager-calls.jsonl");	36	yield* fs.writeFileString(
37	const packageSpec = "t3@0.0.35";	37	cliPath,
38	yield* fs.makeDirectory(bin);	38	`#!/usr/bin/env node
39	yield* fs.symlink(process.execPath, path.join(bin, "node"));
40	yield* fs.writeFileString(
41	cliPath,
42	`#!/usr/bin/env node
43	import * as net from "node:net";	39	import * as net from "node:net";
44	const server = net.createServer((socket) => {	40	const server = net.createServer((socket) => {
45	socket.end();	41	socket.end();
...	@@ -56,112 +52,79 @@ server.listen(Number(process.env.T3_TEST_PORT ?? 0), "127.0.0.1", () => {	...	@@ -56,112 +52,79 @@ server.listen(Number(process.env.T3_TEST_PORT ?? 0), "127.0.0.1", () => {
56	}) + "\\n");	52	}) + "\\n");
57	});	53	});
58	`,	54	`,
59	);	55	);
60	yield* fs.chmod(cliPath, 0o700);	56	yield* fs.chmod(cliPath, 0o700);
61	yield* fs.writeFileString(
62	path.join(bin, packageManager),
63	`#!/usr/bin/env node
64	const fs = require("node:fs");
65	const childProcess = require("node:child_process");
66	const args = process.argv.slice(2);
67	fs.appendFileSync(process.env.T3_TEST_CALLS, JSON.stringify(args) + "\\n");
68	if (args.includes("--package")) {
69	process.stdout.write(process.env.T3_TEST_CLI + "\\n");
70	} else {
71	const child = childProcess.spawn(process.execPath, [process.env.T3_TEST_CLI, ...args], { stdio: "inherit" });
72	child.once("exit", (code) => { process.exitCode = code ?? 1; });
73	}
74	`,
75	);
76	yield* fs.chmod(path.join(bin, packageManager), 0o700);
77		57
78	const runServer = (port = 0) =>	58	const runServer = (port = 0) =>
79	Effect.gen(function* () {	59	Effect.gen(function* () {
80	const child = yield* spawner.spawn(	60	const child = yield* spawner.spawn(
81	ChildProcess.make("/bin/sh", ["-s", "--", "serve", "a path with spaces"], {	61	ChildProcess.make("/bin/sh", ["-s", "--", "serve", "a path with spaces"], {
82	cwd: fixture,	62	cwd: fixture,
83	env: {	63	env: {
84	PATH: bin,	64	PATH: bin,
85	T3_TEST_CLI: cliPath,	65	T3_TEST_PORT: String(port),
86	T3_TEST_CALLS: callsPath,	66	},
87	T3_TEST_PORT: String(port),	67	detached: false,
88	},	68	stdin: Stream.make(
89	detached: false,	69	new TextEncoder().encode(buildRemoteT3RunnerScript({ nodeScriptPath: cliPath })),
90	stdin: Stream.make(
91	new TextEncoder().encode(buildRemoteT3RunnerScript({ packageSpec })),
92	),
93	}),
94	);
95	const ready = yield* Deferred.make<typeof Started.Type>();
96	const stdout: string[] = [];
97	const output = yield* child.stdout.pipe(
98	Stream.decodeText(),
99	Stream.splitLines,
100	Stream.runForEach((line) =>
101	Effect.gen(function* () {
102	stdout.push(line);
103	if (stdout.length === 1) {
104	yield* Deferred.succeed(ready, decodeStarted(line));
105	}
106	}),
107	),
108	Effect.forkScoped,
109	);
110	const stderr = yield* child.stderr.pipe(
111	Stream.decodeText(),
112	Stream.mkString,
113	Effect.forkScoped,
114	);
115	const receipt = yield* Effect.raceFirst(
116	Deferred.await(ready),
117	Fiber.join(output).pipe(
118	Effect.flatMap(() => Fiber.join(stderr)),
119	Effect.flatMap((message) =>
120	Effect.die(new Error(`Runner exited before listening: ${message}`)),
121	),
122	),	70	),
123	);	71	}),
124	// A failed PID assertion must still close the owned fixture server, including an npm child.	72	);
125	yield* Effect.addFinalizer(() =>	73	const ready = yield* Deferred.make<typeof Started.Type>();
		74	const stdout: string[] = [];
		75	const output = yield* child.stdout.pipe(
		76	Stream.decodeText(),
		77	Stream.splitLines,
		78	Stream.runForEach((line) =>
126	Effect.gen(function* () {	79	Effect.gen(function* () {
127	if (yield* child.isRunning) {	80	stdout.push(line);
128	yield* Effect.callback<void>((resume) => {	81	if (stdout.length === 1) {
129	const connection = NodeNet.connect(receipt.port, "127.0.0.1");	82	yield* Deferred.succeed(ready, decodeStarted(line));
130	connection.on("error", () => undefined);
131	connection.once("close", () => resume(Effect.void));
132	return Effect.sync(() => connection.destroy());
133	});
134	yield* child.exitCode;
135	}	83	}
136	}).pipe(Effect.orDie),	84	}),
137	);	85	),
138	assert.equal(receipt.pid, child.pid);	86	Effect.forkScoped,
139	assert.deepEqual(receipt.args, ["serve", "a path with spaces"]);	87	);
140	yield* child.kill({ killSignal: "SIGTERM" });	88	const stderr = yield* child.stderr.pipe(
141	assert.equal(yield* child.exitCode, 0);	89	Stream.decodeText(),
142	yield* Fiber.join(output);	90	Stream.mkString,
143	assert.include(stdout, "graceful shutdown");	91	Effect.forkScoped,
144	return receipt.port;	92	);
145	}).pipe(Effect.scoped);	93	const receipt = yield* Effect.raceFirst(
		94	Deferred.await(ready),
		95	Fiber.join(output).pipe(
		96	Effect.flatMap(() => Fiber.join(stderr)),
		97	Effect.flatMap((message) =>
		98	Effect.die(new Error(`Runner exited before listening: ${message}`)),
		99	),
		100	),
		101	);
		102	// A failed PID assertion must still close the owned fixture server.
		103	yield* Effect.addFinalizer(() =>
		104	Effect.gen(function* () {
		105	if (yield* child.isRunning) {
		106	yield* Effect.callback<void>((resume) => {
		107	const connection = NodeNet.connect(receipt.port, "127.0.0.1");
		108	connection.on("error", () => undefined);
		109	connection.once("close", () => resume(Effect.void));
		110	return Effect.sync(() => connection.destroy());
		111	});
		112	yield* child.exitCode;
		113	}
		114	}).pipe(Effect.orDie),
		115	);
		116	assert.equal(receipt.pid, child.pid);
		117	assert.deepEqual(receipt.args, ["serve", "a path with spaces"]);
		118	yield* child.kill({ killSignal: "SIGTERM" });
		119	assert.equal(yield* child.exitCode, 0);
		120	yield* Fiber.join(output);
		121	assert.include(stdout, "graceful shutdown");
		122	return receipt.port;
		123	}).pipe(Effect.scoped);
146		124
147	const port = yield* runServer();	125	const port = yield* runServer();
148	assert.equal(yield* runServer(port), port);	126	assert.equal(yield* runServer(port), port);
149	const calls = (yield* fs.readFileString(callsPath))	127	}).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
150	.trim()
151	.split("\n")
152	.map((line) => JSON.parse(line));
153	const expectedCall = [
154	...(packageManager === "npm" ? ["exec"] : []),
155	"--yes",
156	"--package",
157	packageSpec,
158	"--",
159	"sh",
160	"-c",
161	"command -v t3",
162	];
163	assert.deepEqual(calls, [expectedCall, expectedCall]);
164	}).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
165	);	128	);
166	},	129	},
167	);	130	);
...	@@ -288,143 +251,3 @@ server.listen(0, "127.0.0.1", () => {	...	@@ -288,143 +251,3 @@ server.listen(0, "127.0.0.1", () => {
288	);	251	);
289	},	252	},
290	);	253	);
291
292	describe.skipIf(HostProcessPlatform.defaultValue() === "win32")(
293	"remote runner install diagnostics",
294	() => {
295	const decodeArguments = Schema.decodeUnknownSync(
296	Schema.fromJsonString(Schema.Array(Schema.String)),
297	);
298	const cases = (["npx", "npm"] as const).flatMap((packageManager) =>
299	(
300	[
301	"etarget",
302	"network",
303	"empty-success",
304	"success",
305	"failed-with-path",
306	"existing-cli",
307	"node-override",
308	] as const
309	).map((mode) => ({ packageManager, mode })),
310	);
311
312	it.live.each(cases)("handles $packageManager/$mode", ({ packageManager, mode }) =>
313	Effect.gen(function* () {
314	const fs = yield* FileSystem.FileSystem;
315	const path = yield* Path.Path;
316	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
317	const fixture = yield* fs.makeTempDirectoryScoped({ prefix: "t3-runner-install-" });
318	const bin = path.join(fixture, "bin");
319	const cliPath = path.join(fixture, "installed cli.mjs");
320	const callsPath = path.join(fixture, "installer-calls.jsonl");
321	const packageSpec = "t3@0.0.39-nightly.20260905.1286";
322	const args = ["serve", "a path with spaces"];
323	yield* fs.makeDirectory(bin);
324	yield* fs.symlink(process.execPath, path.join(bin, "node"));
325	yield* fs.writeFileString(
326	cliPath,
327	`#!/usr/bin/env node
328	process.stdout.write(JSON.stringify(process.argv.slice(2)) + "\\n");
329	`,
330	);
331	yield* fs.chmod(cliPath, 0o700);
332	yield* fs.writeFileString(callsPath, "");
333	yield* fs.writeFileString(
334	path.join(bin, packageManager),
335	`#!/usr/bin/env node
336	const fs = require("node:fs");
337	fs.appendFileSync(process.env.T3_TEST_CALLS, JSON.stringify(process.argv.slice(2)) + "\\n");
338	const mode = process.env.T3_TEST_MODE;
339	if (mode === "success" \|\| mode === "failed-with-path") {
340	process.stdout.write(process.env.T3_TEST_CLI + "\\n");
341	}
342	if (mode === "etarget" \|\| mode === "failed-with-path") {
343	process.stderr.write("npm error code ETARGET\\nnpm error notarget No matching version found.\\n");
344	process.exitCode = 42;
345	} else if (mode === "network") {
346	process.stderr.write("npm error code ENETUNREACH\\n");
347	process.exitCode = 43;
348	}
349	`,
350	);
351	yield* fs.chmod(path.join(bin, packageManager), 0o700);
352	if (mode === "existing-cli") yield* fs.symlink(cliPath, path.join(bin, "t3"));
353
354	const child = yield* spawner.spawn(
355	ChildProcess.make("/bin/sh", ["-s", "--", ...args], {
356	cwd: fixture,
357	extendEnv: false,
358	env: {
359	PATH: bin,
360	T3_TEST_MODE: mode,
361	T3_TEST_CLI: cliPath,
362	T3_TEST_CALLS: callsPath,
363	},
364	stdin: Stream.make(
365	new TextEncoder().encode(
366	buildRemoteT3RunnerScript({
367	packageSpec,
368	...(mode === "node-override" ? { nodeScriptPath: cliPath } : {}),
369	}),
370	),
371	),
372	}),
373	);
374	const { stdout, stderr, exitCode } = yield* Effect.all(
375	{
376	stdout: child.stdout.pipe(Stream.decodeText(), Stream.mkString),
377	stderr: child.stderr.pipe(Stream.decodeText(), Stream.mkString),
378	exitCode: child.exitCode,
379	},
380	{ concurrency: "unbounded" },
381	);
382	const installFailed =
383	mode === "etarget" \|\| mode === "network" \|\| mode === "failed-with-path";
384	const missingExecutable = mode === "empty-success";
385	assert.equal(exitCode, installFailed \|\| missingExecutable ? 1 : 0);
386	if (installFailed \|\| missingExecutable) {
387	assert.equal(stdout, "");
388	} else {
389	assert.deepEqual(decodeArguments(stdout), args);
390	}
391	if (installFailed) {
392	const npmError = mode === "network" ? "ENETUNREACH" : "ETARGET";
393	assert.include(stderr, `npm error code ${npmError}\n`);
394	assert.include(stderr, `Remote host could not install ${packageSpec}.`);
395	assert.notInclude(stderr, "Remote host installed");
396	assert.notInclude(stderr, "Install a C toolchain");
397	} else if (missingExecutable) {
398	assert.include(stderr, `Remote host installed ${packageSpec}`);
399	assert.include(stderr, "npm produced no t3 executable");
400	assert.include(stderr, "Install a C toolchain");
401	} else {
402	assert.equal(stderr, "");
403	}
404	const expectedCall = [
405	...(packageManager === "npm" ? ["exec"] : []),
406	"--yes",
407	"--package",
408	packageSpec,
409	"--",
410	"sh",
411	"-c",
412	"command -v t3",
413	];
414	const usesInstaller = mode !== "existing-cli" && mode !== "node-override";
415	const calls = yield* fs.readFileString(callsPath);
416	if (usesInstaller) {
417	assert.deepEqual(
418	calls
419	.trim()
420	.split("\n")
421	.map((line) => decodeArguments(line)),
422	[expectedCall],
423	);
424	} else {
425	assert.equal(calls, "");
426	}
427	}).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
428	);
429	},
430	);

packages/ssh/src/tunnel.test.ts+104-104

...	@@ -23,6 +23,7 @@ import {	...	@@ -23,6 +23,7 @@ import {
23	buildRemoteStopScript,	23	buildRemoteStopScript,
24	buildRemoteT3RunnerScript,	24	buildRemoteT3RunnerScript,
25	SshInvalidArchiveVersionError,	25	SshInvalidArchiveVersionError,
		26	SshMissingRunnerError,
26	describeReadinessCause,	27	describeReadinessCause,
27	issueRemotePairingToken,	28	issueRemotePairingToken,
28	launchOrReuseRemoteServer,	29	launchOrReuseRemoteServer,
...	@@ -104,39 +105,17 @@ function commandArgs(command: ChildProcess.Command): ReadonlyArray<string> {	...	@@ -104,39 +105,17 @@ function commandArgs(command: ChildProcess.Command): ReadonlyArray<string> {
104	return command._tag === "StandardCommand" ? command.args : [];	105	return command._tag === "StandardCommand" ? command.args : [];
105	}	106	}
106		107
107	describe("ssh tunnel scripts", () => {	108	const ARCHIVE = { archiveVersion: "1.2.3-preview.20260911.4" } as const;
108	it("builds the remote t3 runner with npx and npm fallbacks", () => {	109	const NODE_SCRIPT = {
109	const script = buildRemoteT3RunnerScript({ nodeEngineRange: TEST_NODE_ENGINE_RANGE });	110	nodeScriptPath: "/Users/julius/Development/Work/codething-mvp/apps/server/dist/bin.mjs",
110		111	} as const;
111	assert.include(script, "T3_NODE_SCRIPT_PATH=''");
112	assert.include(script, 'exec t3 "$@"');
113	assert.include(script, 'exec "$T3_CLI_PATH" "$@"');
114	assert.include(script, "could not install 't3@latest'");
115	assert.include(script, "require_installed_t3_cli npx --yes --package 't3@latest'");
116	assert.include(script, "require_installed_t3_cli npm exec --yes --package 't3@latest'");
117	assert.include(script, "npm produced no t3 executable");
118	assert.include(script, 'prepend_path_if_dir "$HOME/.local/bin"');
119	assert.include(script, `T3_NODE_ENGINE_RANGE='${TEST_NODE_ENGINE_RANGE}'`);
120	assert.include(script, "remote_node_satisfies_engine()");
121	assert.include(script, "function satisfiesSemverRange");
122	assert.include(script, "satisfiesSemverRange(rawVersion, range)");
123	assert.include(script, 'prepend_path_if_dir "$VOLTA_HOME/bin"');
124	assert.include(script, 'prepend_path_if_dir "$HOME/.asdf/shims"');
125	assert.include(script, 'prepend_path_if_dir "$HOME/.local/share/mise/shims"');
126	assert.include(script, 'eval "$(fnm env --shell bash)"');
127	assert.include(script, "fnm use --silent-if-unchanged");
128	assert.include(script, "fnm use default");
129	assert.include(script, 'prepend_path_if_dir "$HOME/.nodenv/shims"');
130	assert.include(script, 'NVM_DIR="$HOME/.nvm"');
131	assert.include(script, "nvm use --silent default");
132	assert.include(script, 'for T3_NODE_BIN in "$NVM_DIR"/versions/node/*/bin');
133	assert.notInclude(script, "ensure $NVM_DIR/nvm.sh is available");
134	});
135		112
136	it("installs and runs the release archive when an archive version is set", () => {	113	describe("ssh tunnel scripts", () => {
137	const script = buildRemoteT3RunnerScript({ archiveVersion: "1.2.3-preview.20260911.4" });	114	it("installs and runs the release archive without Node, npm, or npx", () => {
		115	const script = buildRemoteT3RunnerScript(ARCHIVE);
138		116
139	assert.include(script, "T3_ARCHIVE_VERSION='1.2.3-preview.20260911.4'");	117	assert.include(script, "T3_ARCHIVE_VERSION='1.2.3-preview.20260911.4'");
		118	assert.include(script, "T3_NODE_SCRIPT_PATH=''");
140	assert.include(	119	assert.include(
141	script,	120	script,
142	"T3_RELEASE_BASE_URL='https://github.com/pingdotgg/t3code/releases/download'",	121	"T3_RELEASE_BASE_URL='https://github.com/pingdotgg/t3code/releases/download'",
...	@@ -145,6 +124,10 @@ describe("ssh tunnel scripts", () => {	...	@@ -145,6 +124,10 @@ describe("ssh tunnel scripts", () => {
145	assert.include(script, 'T3_ARCHIVE="t3-$T3_ARCHIVE_VERSION-$T3_PLATFORM-$T3_ARCH.tar.gz"');	124	assert.include(script, 'T3_ARCHIVE="t3-$T3_ARCHIVE_VERSION-$T3_PLATFORM-$T3_ARCH.tar.gz"');
146	assert.include(script, "SHA256SUMS");	125	assert.include(script, "SHA256SUMS");
147	assert.include(script, 'exec "$T3_RUNTIME_DIR/t3" "$@"');	126	assert.include(script, 'exec "$T3_RUNTIME_DIR/t3" "$@"');
		127	assert.notInclude(script, "npx");
		128	assert.notInclude(script, "npm exec");
		129	assert.notInclude(script, "t3@latest");
		130	assert.notInclude(script, 'exec t3 "$@"');
148	// Concurrent launches serialize on a per-version mkdir lock and recheck	131	// Concurrent launches serialize on a per-version mkdir lock and recheck
149	// the completion marker after acquiring it.	132	// the completion marker after acquiring it.
150	assert.include(	133	assert.include(
...	@@ -167,14 +150,20 @@ describe("ssh tunnel scripts", () => {	...	@@ -167,14 +150,20 @@ describe("ssh tunnel scripts", () => {
167	script.indexOf('"$T3_STAGING/t3" --version'),	150	script.indexOf('"$T3_STAGING/t3" --version'),
168	script.indexOf('> "$T3_STAGING/.install-complete"'),	151	script.indexOf('> "$T3_STAGING/.install-complete"'),
169	);	152	);
170	// The archive branch execs before any of the Node discovery runs.	153	// Node discovery is defined for the dev path but only ever invoked inside
		154	// the node-script branch, which the archive path skips entirely.
		155	assert.equal(script.split("ensure_remote_node_path \|\| true").length - 1, 1);
		156	assert.isBelow(
		157	script.indexOf("ensure_remote_node_path \|\| true"),
		158	script.indexOf('exec node "$T3_NODE_SCRIPT_PATH" "$@"'),
		159	);
171	assert.isBelow(	160	assert.isBelow(
172	script.indexOf('exec "$T3_RUNTIME_DIR/t3"'),	161	script.indexOf('exec node "$T3_NODE_SCRIPT_PATH" "$@"'),
173	script.indexOf("prepend_path_if_dir()"),	162	script.indexOf("T3_ARCHIVE_VERSION="),
174	);	163	);
175		164
176	const launch = buildRemoteLaunchScript({	165	const launch = buildRemoteLaunchScript({
177	archiveVersion: "1.2.3-preview.20260911.4",	166	...ARCHIVE,
178	releaseBaseUrl: "https://mirror.example/t3/",	167	releaseBaseUrl: "https://mirror.example/t3/",
179	});	168	});
180	assert.include(launch, "T3_ARCHIVE_MODE=1");	169	assert.include(launch, "T3_ARCHIVE_MODE=1");
...	@@ -182,7 +171,7 @@ describe("ssh tunnel scripts", () => {	...	@@ -182,7 +171,7 @@ describe("ssh tunnel scripts", () => {
182	assert.include(launch, '"$RUNNER_FILE" __ssh-helper pick-port "$PORT_FILE"');	171	assert.include(launch, '"$RUNNER_FILE" __ssh-helper pick-port "$PORT_FILE"');
183	assert.include(launch, '"$RUNNER_FILE" __ssh-helper wait-ready "$REMOTE_PORT"');	172	assert.include(launch, '"$RUNNER_FILE" __ssh-helper wait-ready "$REMOTE_PORT"');
184	assert.include(launch, '"$RUNNER_FILE" __ssh-helper runtime-port "$DEFAULT_RUNTIME_FILE"');	173	assert.include(launch, '"$RUNNER_FILE" __ssh-helper runtime-port "$DEFAULT_RUNTIME_FILE"');
185	assert.include(buildRemoteLaunchScript(), "T3_ARCHIVE_MODE=0");	174	assert.include(buildRemoteLaunchScript(NODE_SCRIPT), "T3_ARCHIVE_MODE=0");
186	});	175	});
187		176
188	it("rejects archive versions that are not a single exact version segment", () => {	177	it("rejects archive versions that are not a single exact version segment", () => {
...	@@ -202,33 +191,29 @@ describe("ssh tunnel scripts", () => {	...	@@ -202,33 +191,29 @@ describe("ssh tunnel scripts", () => {
202	);	191	);
203	}	192	}
204	assert.include(	193	assert.include(
205	buildRemoteT3RunnerScript({ archiveVersion: "1.2.3-preview.20260911.4" }),	194	buildRemoteT3RunnerScript(ARCHIVE),
206	"T3_ARCHIVE_VERSION='1.2.3-preview.20260911.4'",	195	"T3_ARCHIVE_VERSION='1.2.3-preview.20260911.4'",
207	);	196	);
208	});	197	});
209		198
		199	it("refuses to build a runner with neither an archive version nor a node script", () => {
		200	for (const input of [undefined, {}, { archiveVersion: " " }, { nodeScriptPath: null }]) {
		201	assert.throws(() => buildRemoteT3RunnerScript(input), SshMissingRunnerError);
		202	}
		203	assert.throws(() => buildRemoteLaunchScript(), SshMissingRunnerError);
		204	});
		205
210	it("does not hard-code a remote node engine range", () => {	206	it("does not hard-code a remote node engine range", () => {
211	const script = buildRemoteT3RunnerScript();	207	const script = buildRemoteT3RunnerScript(NODE_SCRIPT);
212		208
213	assert.include(script, "T3_NODE_ENGINE_RANGE=''");	209	assert.include(script, "T3_NODE_ENGINE_RANGE=''");
214	assert.notInclude(script, TEST_NODE_ENGINE_RANGE);	210	assert.notInclude(script, TEST_NODE_ENGINE_RANGE);
215	});	211	});
216		212
217	it("shell-quotes package specs in the remote t3 runner", () => {
218	const script = buildRemoteT3RunnerScript({
219	packageSpec: "t3@nightly; touch /tmp/t3-owned",
220	});
221
222	assert.include(
223	script,
224	"require_installed_t3_cli npx --yes --package 't3@nightly; touch /tmp/t3-owned'",
225	);
226	assert.notInclude(script, "exec npx --yes t3@nightly; touch /tmp/t3-owned");
227	});
228
229	it("builds the remote t3 runner with a node script override", () => {	213	it("builds the remote t3 runner with a node script override", () => {
230	const script = buildRemoteT3RunnerScript({	214	const script = buildRemoteT3RunnerScript({
231	nodeScriptPath: "/Users/julius/Development/Work/codething-mvp/apps/server/dist/bin.mjs",	215	...NODE_SCRIPT,
		216	nodeEngineRange: TEST_NODE_ENGINE_RANGE,
232	});	217	});
233		218
234	assert.include(	219	assert.include(
...	@@ -236,6 +221,24 @@ describe("ssh tunnel scripts", () => {	...	@@ -236,6 +221,24 @@ describe("ssh tunnel scripts", () => {
236	"T3_NODE_SCRIPT_PATH='/Users/julius/Development/Work/codething-mvp/apps/server/dist/bin.mjs'",	221	"T3_NODE_SCRIPT_PATH='/Users/julius/Development/Work/codething-mvp/apps/server/dist/bin.mjs'",
237	);	222	);
238	assert.include(script, 'exec node "$T3_NODE_SCRIPT_PATH" "$@"');	223	assert.include(script, 'exec node "$T3_NODE_SCRIPT_PATH" "$@"');
		224	assert.include(script, "T3_ARCHIVE_VERSION=''");
		225	assert.include(script, 'prepend_path_if_dir "$HOME/.local/bin"');
		226	assert.include(script, `T3_NODE_ENGINE_RANGE='${TEST_NODE_ENGINE_RANGE}'`);
		227	assert.include(script, "remote_node_satisfies_engine()");
		228	assert.include(script, "function satisfiesSemverRange");
		229	assert.include(script, "satisfiesSemverRange(rawVersion, range)");
		230	assert.include(script, 'prepend_path_if_dir "$VOLTA_HOME/bin"');
		231	assert.include(script, 'prepend_path_if_dir "$HOME/.asdf/shims"');
		232	assert.include(script, 'prepend_path_if_dir "$HOME/.local/share/mise/shims"');
		233	assert.include(script, 'eval "$(fnm env --shell bash)"');
		234	assert.include(script, "fnm use --silent-if-unchanged");
		235	assert.include(script, "fnm use default");
		236	assert.include(script, 'prepend_path_if_dir "$HOME/.nodenv/shims"');
		237	assert.include(script, 'NVM_DIR="$HOME/.nvm"');
		238	assert.include(script, "nvm use --silent default");
		239	assert.include(script, 'for T3_NODE_BIN in "$NVM_DIR"/versions/node/*/bin');
		240	assert.notInclude(script, "ensure $NVM_DIR/nvm.sh is available");
		241	assert.notInclude(script, "npx");
239	});	242	});
240		243
241	it("uses the remote t3 runner for launch and pairing scripts", () => {	244	it("uses the remote t3 runner for launch and pairing scripts", () => {
...	@@ -245,39 +248,44 @@ describe("ssh tunnel scripts", () => {	...	@@ -245,39 +248,44 @@ describe("ssh tunnel scripts", () => {
245	username: "julius",	248	username: "julius",
246	port: 2222,	249	port: 2222,
247	} as const;	250	} as const;
		251	const launch = buildRemoteLaunchScript(ARCHIVE);
		252	const devLaunch = buildRemoteLaunchScript({
		253	...NODE_SCRIPT,
		254	nodeEngineRange: TEST_NODE_ENGINE_RANGE,
		255	});
248		256
249	assert.include(	257	assert.include(
250	buildRemoteLaunchScript({ nodeEngineRange: TEST_NODE_ENGINE_RANGE }),	258	launch,
251	'[ -n "$REMOTE_PID" ] && [ -n "$REMOTE_PORT" ] && kill -0 "$REMOTE_PID" 2>/dev/null',	259	'[ -n "$REMOTE_PID" ] && [ -n "$REMOTE_PORT" ] && kill -0 "$REMOTE_PID" 2>/dev/null',
252	);	260	);
253	assert.include(buildRemoteLaunchScript(), "RUNNER_CHANGED=1");	261	assert.include(launch, "RUNNER_CHANGED=1");
254	assert.include(buildRemoteLaunchScript(), "ensure_remote_node_path()");	262	assert.include(launch, "ensure_remote_node_path()");
255	assert.include(buildRemoteLaunchScript(), "if ! ensure_remote_node_path; then");	263	assert.include(launch, "if ! ensure_remote_node_path; then");
		264	assert.include(devLaunch, `T3_NODE_ENGINE_RANGE='${TEST_NODE_ENGINE_RANGE}'`);
		265	assert.include(devLaunch, "does not satisfy required range ");
		266	assert.include(launch, 'kill "$REMOTE_PID" 2>/dev/null \|\| true');
		267	assert.include(launch, "wait_ready");
		268	assert.include(launch, '"$RUNNER_FILE" serve --host 127.0.0.1');
		269	assert.include(launch, '--base-dir "$DEFAULT_SERVER_HOME"');
		270	assert.notInclude(launch, "server-home");
		271	assert.include(launch, "Remote T3 server did not become ready");
		272	assert.include(launch, 'wait_ready "60000"');
		273	assert.include(launch, 'if [ -s "$LOG_FILE" ]; then');
		274	assert.include(launch, "It wrote nothing to %s");
		275	assert.include(launch, "T3_ARCHIVE_VERSION='1.2.3-preview.20260911.4'");
256	assert.include(	276	assert.include(
257	buildRemoteLaunchScript({ nodeEngineRange: TEST_NODE_ENGINE_RANGE }),	277	buildRemotePairingScript(target, ARCHIVE),
258	`T3_NODE_ENGINE_RANGE='${TEST_NODE_ENGINE_RANGE}'`,	278	'"$RUNNER_FILE" auth pairing create --base-dir "$PAIRING_BASE_DIR" --json',
259	);	279	);
260	assert.include(	280	assert.include(
261	buildRemoteLaunchScript({ nodeEngineRange: TEST_NODE_ENGINE_RANGE }),	281	buildRemotePairingScript(target, ARCHIVE),
262	"does not satisfy required range ",	282	'PAIRING_BASE_DIR="$DEFAULT_SERVER_HOME"',
263	);	283	);
264	assert.include(buildRemoteLaunchScript(), 'kill "$REMOTE_PID" 2>/dev/null \|\| true');	284	assert.notInclude(buildRemotePairingScript(target, ARCHIVE), "server-home");
265	assert.include(buildRemoteLaunchScript(), "wait_ready");
266	assert.include(buildRemoteLaunchScript(), '"$RUNNER_FILE" serve --host 127.0.0.1');
267	assert.include(buildRemoteLaunchScript(), '--base-dir "$DEFAULT_SERVER_HOME"');
268	assert.notInclude(buildRemoteLaunchScript(), "server-home");
269	assert.include(buildRemoteLaunchScript(), "Remote T3 server did not become ready");
270	assert.include(buildRemoteLaunchScript(), 'wait_ready "60000"');
271	assert.include(buildRemoteLaunchScript(), 'if [ -s "$LOG_FILE" ]; then');
272	assert.include(buildRemoteLaunchScript(), "It wrote nothing to %s");
273	assert.include(buildRemoteLaunchScript({ packageSpec: "t3@nightly" }), "t3@nightly");
274	assert.include(	285	assert.include(
275	buildRemotePairingScript(target),	286	buildRemotePairingScript(target, ARCHIVE),
276	'"$RUNNER_FILE" auth pairing create --base-dir "$PAIRING_BASE_DIR" --json',	287	"T3_ARCHIVE_VERSION='1.2.3-preview.20260911.4'",
277	);	288	);
278	assert.include(buildRemotePairingScript(target), 'PAIRING_BASE_DIR="$DEFAULT_SERVER_HOME"');
279	assert.notInclude(buildRemotePairingScript(target), "server-home");
280	assert.include(buildRemotePairingScript(target, { packageSpec: "t3@nightly" }), "t3@nightly");
281	assert.include(	289	assert.include(
282	buildRemoteStopScript(target),	290	buildRemoteStopScript(target),
283	'if [ "$REMOTE_MANAGED" != "external" ] && [ -n "$REMOTE_PID" ]',	291	'if [ "$REMOTE_MANAGED" != "external" ] && [ -n "$REMOTE_PID" ]',
...	@@ -285,30 +293,24 @@ describe("ssh tunnel scripts", () => {	...	@@ -285,30 +293,24 @@ describe("ssh tunnel scripts", () => {
285	assert.include(buildRemoteStopScript(target), 'kill "$REMOTE_PID" 2>/dev/null \|\| true');	293	assert.include(buildRemoteStopScript(target), 'kill "$REMOTE_PID" 2>/dev/null \|\| true');
286	assert.include(buildRemoteStopScript(target), 'rm -f "$PID_FILE" "$PORT_FILE" "$MANAGED_FILE"');	294	assert.include(buildRemoteStopScript(target), 'rm -f "$PID_FILE" "$PORT_FILE" "$MANAGED_FILE"');
287	assert.include(	295	assert.include(
288	buildRemoteLaunchScript(),	296	launch,
289	'DEFAULT_RUNTIME_FILE="$DEFAULT_SERVER_HOME/userdata/server-runtime.json"',	297	'DEFAULT_RUNTIME_FILE="$DEFAULT_SERVER_HOME/userdata/server-runtime.json"',
290	);	298	);
291	assert.include(buildRemoteLaunchScript(), "resolve_default_runtime_port()");	299	assert.include(launch, "resolve_default_runtime_port()");
292	assert.include(	300	assert.include(launch, 'DEFAULT_RUNTIME_INFO="$(resolve_default_runtime_port');
293	buildRemoteLaunchScript(),	301	assert.include(launch, "if (!Number.isInteger(pid) \|\| pid <= 0 \|\| !Number.isInteger(port))");
294	'DEFAULT_RUNTIME_INFO="$(resolve_default_runtime_port',	302	assert.include(launch, 'PID_TO_STOP="${REMOTE_PID:-$DEFAULT_RUNTIME_PID}"');
295	);	303	assert.include(launch, 'REMOTE_PORT="$DEFAULT_REMOTE_PORT"');
296	assert.include(	304	assert.include(launch, 'rm -f "$PID_FILE"');
297	buildRemoteLaunchScript(),	305	assert.include(launch, "printf 'external\\n' >\"$MANAGED_FILE\"");
298	"if (!Number.isInteger(pid) \|\| pid <= 0 \|\| !Number.isInteger(port))",	306	assert.include(launch, 'if [ -z "$REMOTE_PORT" ]; then');
299	);
300	assert.include(buildRemoteLaunchScript(), 'PID_TO_STOP="${REMOTE_PID:-$DEFAULT_RUNTIME_PID}"');
301	assert.include(buildRemoteLaunchScript(), 'REMOTE_PORT="$DEFAULT_REMOTE_PORT"');
302	assert.include(buildRemoteLaunchScript(), 'rm -f "$PID_FILE"');
303	assert.include(buildRemoteLaunchScript(), "printf 'external\\n' >\"$MANAGED_FILE\"");
304	assert.include(buildRemoteLaunchScript(), 'if [ -z "$REMOTE_PORT" ]; then');
305	assert.isBelow(	307	assert.isBelow(
306	buildRemoteLaunchScript().indexOf('if [ "$REMOTE_MANAGED" = "managed" ]'),	308	launch.indexOf('if [ "$REMOTE_MANAGED" = "managed" ]'),
307	buildRemoteLaunchScript().indexOf("printf 'external\\n' >\"$MANAGED_FILE\""),	309	launch.indexOf("printf 'external\\n' >\"$MANAGED_FILE\""),
308	);	310	);
309	assert.isBelow(	311	assert.isBelow(
310	buildRemoteLaunchScript().indexOf('DEFAULT_RUNTIME_INFO="$(resolve_default_runtime_port'),	312	launch.indexOf('DEFAULT_RUNTIME_INFO="$(resolve_default_runtime_port'),
311	buildRemoteLaunchScript().indexOf('elif [ -n "$REMOTE_PID" ]'),	313	launch.indexOf('elif [ -n "$REMOTE_PID" ]'),
312	);	314	);
313	});	315	});
314		316
...	@@ -330,7 +332,7 @@ describe("ssh tunnel scripts", () => {	...	@@ -330,7 +332,7 @@ describe("ssh tunnel scripts", () => {
330	const processLayer = Layer.merge(NodeServices.layer, spawnerLayer);	332	const processLayer = Layer.merge(NodeServices.layer, spawnerLayer);
331		333
332	return Effect.gen(function* () {	334	return Effect.gen(function* () {
333	const result = yield* launchOrReuseRemoteServer(target);	335	const result = yield* launchOrReuseRemoteServer(target, undefined, ARCHIVE);
334	assert.equal(result.remotePort, 3774);	336	assert.equal(result.remotePort, 3774);
335	assert.deepEqual(spawnedCommands[0]?.slice(-5, -1), ["sh", "-l", "-s", "--"]);	337	assert.deepEqual(spawnedCommands[0]?.slice(-5, -1), ["sh", "-l", "-s", "--"]);
336	}).pipe(Effect.provide(processLayer));	338	}).pipe(Effect.provide(processLayer));
...	@@ -350,7 +352,9 @@ describe("ssh tunnel scripts", () => {	...	@@ -350,7 +352,9 @@ describe("ssh tunnel scripts", () => {
350	const processLayer = Layer.mergeAll(NodeServices.layer, spawnerLayer, TestClock.layer());	352	const processLayer = Layer.mergeAll(NodeServices.layer, spawnerLayer, TestClock.layer());
351		353
352	return Effect.gen(function* () {	354	return Effect.gen(function* () {
353	const fiber = yield* Effect.forkChild(launchOrReuseRemoteServer(target));	355	const fiber = yield* Effect.forkChild(
		356	launchOrReuseRemoteServer(target, undefined, NODE_SCRIPT),
		357	);
354	yield* Effect.yieldNow;	358	yield* Effect.yieldNow;
355	yield* TestClock.adjust(Duration.seconds(75));	359	yield* TestClock.adjust(Duration.seconds(75));
356		360
...	@@ -359,7 +363,7 @@ describe("ssh tunnel scripts", () => {	...	@@ -359,7 +363,7 @@ describe("ssh tunnel scripts", () => {
359	}).pipe(Effect.provide(processLayer));	363	}).pipe(Effect.provide(processLayer));
360	});	364	});
361		365
362	it.effect("gives cold archive launches a larger budget than npm launches", () => {	366	it.effect("gives cold archive launches a larger budget than node-script launches", () => {
363	const target = {	367	const target = {
364	alias: "devbox",	368	alias: "devbox",
365	hostname: "devbox.example.com",	369	hostname: "devbox.example.com",
...	@@ -373,11 +377,7 @@ describe("ssh tunnel scripts", () => {	...	@@ -373,11 +377,7 @@ describe("ssh tunnel scripts", () => {
373	const processLayer = Layer.mergeAll(NodeServices.layer, spawnerLayer, TestClock.layer());	377	const processLayer = Layer.mergeAll(NodeServices.layer, spawnerLayer, TestClock.layer());
374		378
375	return Effect.gen(function* () {	379	return Effect.gen(function* () {
376	const fiber = yield* Effect.forkChild(	380	const fiber = yield* Effect.forkChild(launchOrReuseRemoteServer(target, undefined, ARCHIVE));
377	launchOrReuseRemoteServer(target, undefined, {
378	archiveVersion: "1.2.3-preview.20260911.4",
379	}),
380	);
381	yield* Effect.yieldNow;	381	yield* Effect.yieldNow;
382	yield* TestClock.adjust(Duration.seconds(800));	382	yield* TestClock.adjust(Duration.seconds(800));
383		383
...	@@ -457,7 +457,7 @@ describe("ssh tunnel scripts", () => {	...	@@ -457,7 +457,7 @@ describe("ssh tunnel scripts", () => {
457	const spawnerLayer = Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, spawner);	457	const spawnerLayer = Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, spawner);
458	const processLayer = Layer.merge(NodeServices.layer, spawnerLayer);	458	const processLayer = Layer.merge(NodeServices.layer, spawnerLayer);
459	return Effect.gen(function* () {	459	return Effect.gen(function* () {
460	const result = yield* issueRemotePairingToken(target);	460	const result = yield* issueRemotePairingToken(target, undefined, ARCHIVE);
461	assert.equal(result.credential, "LCL4R2TPHDKQ");	461	assert.equal(result.credential, "LCL4R2TPHDKQ");
462	}).pipe(Effect.provide(processLayer));	462	}).pipe(Effect.provide(processLayer));
463	});	463	});
...	@@ -485,7 +485,7 @@ describe("ssh tunnel scripts", () => {	...	@@ -485,7 +485,7 @@ describe("ssh tunnel scripts", () => {
485	const spawnerLayer = Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, spawner);	485	const spawnerLayer = Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, spawner);
486	const processLayer = Layer.merge(NodeServices.layer, spawnerLayer);	486	const processLayer = Layer.merge(NodeServices.layer, spawnerLayer);
487	return Effect.gen(function* () {	487	return Effect.gen(function* () {
488	const result = yield* issueRemotePairingToken(target);	488	const result = yield* issueRemotePairingToken(target, undefined, ARCHIVE);
489	assert.equal(result.credential, "LCL4R2TPHDKQ");	489	assert.equal(result.credential, "LCL4R2TPHDKQ");
490	}).pipe(Effect.provide(processLayer));	490	}).pipe(Effect.provide(processLayer));
491	});	491	});
...	@@ -530,7 +530,7 @@ describe("ssh tunnel scripts", () => {	...	@@ -530,7 +530,7 @@ describe("ssh tunnel scripts", () => {
530	Layer.succeed(HttpClient.HttpClient, testHttpClient),	530	Layer.succeed(HttpClient.HttpClient, testHttpClient),
531	Layer.succeed(NetService.NetService, testNetService),	531	Layer.succeed(NetService.NetService, testNetService),
532	SshPasswordPrompt.disabledLayer,	532	SshPasswordPrompt.disabledLayer,
533	SshEnvironmentManager.layer(),	533	SshEnvironmentManager.layer({ resolveCliRunner: Effect.succeed(ARCHIVE) }),
534	);	534	);
535	const target = {	535	const target = {
536	alias: "devbox",	536	alias: "devbox",
...	@@ -655,7 +655,7 @@ describe("ssh tunnel scripts", () => {	...	@@ -655,7 +655,7 @@ describe("ssh tunnel scripts", () => {
655	Layer.succeed(HttpClient.HttpClient, testHttpClient),	655	Layer.succeed(HttpClient.HttpClient, testHttpClient),
656	Layer.succeed(NetService.NetService, testNetService),	656	Layer.succeed(NetService.NetService, testNetService),
657	SshPasswordPrompt.disabledLayer,	657	SshPasswordPrompt.disabledLayer,
658	SshEnvironmentManager.layer(),	658	SshEnvironmentManager.layer({ resolveCliRunner: Effect.succeed(ARCHIVE) }),
659	);	659	);
660	yield* Effect.gen(function* () {	660	yield* Effect.gen(function* () {
661	const manager = yield* SshEnvironmentManager;	661	const manager = yield* SshEnvironmentManager;

packages/ssh/src/tunnel.ts+129-147

 @@ -70,19 +70,22 @@ const REMOTE_ARCHIVE_LAUNCH_TIMEOUT_MS = 900_000;
 const REMOTE_REUSE_READY_TIMEOUT_MS = 2_000;
 export interface RemoteT3RunnerOptions {
-  readonly packageSpec?: string;
+  /**
+   * Dev mode: run `node <path>` on the remote instead of a release archive.
+   * The only mode that needs Node on the remote.
+   */
   readonly nodeScriptPath?: string | null;
   readonly nodeEngineRange?: string | null;
   /**
-   * Exact version whose release archive the remote installs and runs. Takes
+   * Exact version whose self-contained release archive the remote installs
-   * precedence over `packageSpec`; the remote then needs neither Node nor npm.
+   * and runs. Required unless `nodeScriptPath` is set; the remote then needs
+   * neither Node nor npm.
    */
   readonly archiveVersion?: string | null;
   readonly releaseBaseUrl?: string | null;
 }
 export interface SshEnvironmentManagerOptions {
-  readonly resolveCliPackageSpec?: () => string;
   readonly resolveCliRunner?: Effect.Effect<RemoteT3RunnerOptions>;
 }
 @@ -124,17 +127,18 @@ function sshTargetLogFields(target: DesktopSshEnvironmentTarget) {
   };
 }
+function isNodeScriptRunner(runner: RemoteT3RunnerOptions | undefined): boolean {
+  return Boolean(runner?.nodeScriptPath?.trim());
+}
 function sshRunnerLogFields(runner: RemoteT3RunnerOptions | undefined) {
-  if (runner?.archiveVersion?.trim()) {
-    return { runner: "archive", archiveVersion: runner.archiveVersion.trim() };
-  }
   if (runner?.nodeScriptPath?.trim()) {
     return { runner: "node-script", nodeScriptPath: runner.nodeScriptPath.trim() };
   }
-  if (runner?.packageSpec?.trim()) {
+  if (runner?.archiveVersion?.trim()) {
-    return { runner: "package", packageSpec: runner.packageSpec.trim() };
+    return { runner: "archive", archiveVersion: runner.archiveVersion.trim() };
   }
-  return { runner: "default" };
+  return { runner: "archive" };
 }
 interface SshAuthOperationInput<T> {
 @@ -424,144 +428,117 @@ ensure_remote_node_path() {
 const REMOTE_RUNNER_SCRIPT = `#!/bin/sh
 set -eu
-T3_ARCHIVE_VERSION=@@T3_ARCHIVE_VERSION@@
-if [ -n "$T3_ARCHIVE_VERSION" ]; then
-  # Self-contained release archive: no Node, npm, or compiler on the remote.
-  # Unpacked into the pinned-runtime layout so \`t3 service install\` reuses it.
-  T3_RELEASE_BASE_URL=@@T3_RELEASE_BASE_URL@@
-  T3_RUNTIME_DIR="$HOME/.t3/runtime/versions/$T3_ARCHIVE_VERSION"
-  t3_runtime_ready() {
-    [ -x "$T3_RUNTIME_DIR/t3" ] && [ "$(cat "$T3_RUNTIME_DIR/.install-complete" 2>/dev/null)" = "$T3_ARCHIVE_VERSION" ]
-  }
-  if ! t3_runtime_ready; then
-    mkdir -p "$HOME/.t3/runtime/versions"
-    # Concurrent launches (two clients, a retry racing a slow first run) must
-    # not both install: mkdir is the atomic lock and the ready check repeats
-    # under it.
-    T3_LOCK="$HOME/.t3/runtime/versions/.$T3_ARCHIVE_VERSION.install.lock"
-    # mkdir is the only portable atomic exclusive create (mv would silently
-    # nest a candidate inside an existing lock). The owner publishes its pid
-    # right after, so a lock with a live owner is never reclaimed however
-    # slow its download is, and a lock whose owner is dead is reclaimed at
-    # once. A lock with no pid at all is a crash between mkdir and the pid
-    # write; it is reclaimed after a short grace so a live owner has time to
-    # publish.
-    T3_LOCK_WAITED=0
-    T3_LOCK_UNOWNED=0
-    while ! mkdir "$T3_LOCK" 2>/dev/null; do
-      T3_LOCK_OWNER="$(cat "$T3_LOCK/pid" 2>/dev/null || true)"
-      if [ -n "$T3_LOCK_OWNER" ]; then
-        T3_LOCK_UNOWNED=0
-        if ! kill -0 "$T3_LOCK_OWNER" 2>/dev/null; then
-          rm -rf "$T3_LOCK"
-          continue
-        fi
-      else
-        T3_LOCK_UNOWNED=$((T3_LOCK_UNOWNED + 1))
-        if [ "$T3_LOCK_UNOWNED" -ge 5 ]; then
-          rm -rf "$T3_LOCK"
-          continue
-        fi
-      fi
-      if [ "$T3_LOCK_WAITED" -ge @@T3_ARCHIVE_LOCK_WAIT_SECONDS@@ ]; then
-        printf 'Another t3 %s installation has held %s for too long.\\n' "$T3_ARCHIVE_VERSION" "$T3_LOCK" >&2
-        exit 1
-      fi
-      sleep 1
-      T3_LOCK_WAITED=$((T3_LOCK_WAITED + 1))
-    done
-    printf '%s\\n' "$$" > "$T3_LOCK/pid.tmp" && mv "$T3_LOCK/pid.tmp" "$T3_LOCK/pid"
-    trap 'rm -rf "$T3_LOCK"' EXIT
-  fi
-  if ! t3_runtime_ready; then
-    case "$(uname -s)" in
-      Darwin) T3_PLATFORM="darwin" ;;
-      Linux) T3_PLATFORM="linux" ;;
-      *) printf 'Remote host %s has no t3 release archive.\\n' "$(uname -s)" >&2; exit 1 ;;
-    esac
-    case "$(uname -m)" in
-      arm64 | aarch64) T3_ARCH="arm64" ;;
-      x86_64 | amd64) T3_ARCH="x64" ;;
-      *) printf 'Remote host %s has no t3 release archive.\\n' "$(uname -m)" >&2; exit 1 ;;
-    esac
-    T3_ARCHIVE="t3-$T3_ARCHIVE_VERSION-$T3_PLATFORM-$T3_ARCH.tar.gz"
-    T3_STAGING="$(mktemp -d "$HOME/.t3/runtime/versions/.staging-XXXXXX")"
-    trap 'rm -rf "$T3_STAGING" "$T3_LOCK"' EXIT
-    t3_fetch() {
-      if command -v curl >/dev/null 2>&1; then curl -fsSL --connect-timeout 30 --max-time "$3" "$1" -o "$2"
-      elif command -v wget >/dev/null 2>&1; then wget -q --timeout=30 --tries=1 "$1" -O "$2"
-      else printf 'Remote host needs curl or wget to download %s.\\n' "$T3_ARCHIVE" >&2; exit 1
-      fi
-    }
-    t3_fetch "$T3_RELEASE_BASE_URL/v$T3_ARCHIVE_VERSION/SHA256SUMS" "$T3_STAGING/SHA256SUMS" @@T3_ARCHIVE_CHECKSUMS_SECONDS@@
-    t3_fetch "$T3_RELEASE_BASE_URL/v$T3_ARCHIVE_VERSION/$T3_ARCHIVE" "$T3_STAGING/$T3_ARCHIVE" @@T3_ARCHIVE_DOWNLOAD_SECONDS@@
-    T3_EXPECTED="$(grep " \\*\\{0,1\\}$T3_ARCHIVE$" "$T3_STAGING/SHA256SUMS" | cut -d' ' -f1)"
-    if command -v sha256sum >/dev/null 2>&1; then
-      T3_ACTUAL="$(sha256sum "$T3_STAGING/$T3_ARCHIVE" | cut -d' ' -f1)"
-    else
-      T3_ACTUAL="$(shasum -a 256 "$T3_STAGING/$T3_ARCHIVE" | cut -d' ' -f1)"
-    fi
-    if [ -z "$T3_EXPECTED" ] || [ "$T3_ACTUAL" != "$T3_EXPECTED" ]; then
-      printf 'Checksum mismatch for %s.\\n' "$T3_ARCHIVE" >&2; exit 1
-    fi
-    tar -xzf "$T3_STAGING/$T3_ARCHIVE" -C "$T3_STAGING" --strip-components=1
-    rm -f "$T3_STAGING/$T3_ARCHIVE" "$T3_STAGING/SHA256SUMS"
-    # Prove the binary runs here (libc, arch) before marking it ready, or every
-    # later launch would exec a broken install instead of retrying.
-    if ! "$T3_STAGING/t3" --version >/dev/null 2>&1; then
-      printf 'The t3 %s executable does not run on this host.\\n' "$T3_ARCHIVE_VERSION" >&2; exit 1
-    fi
-    printf '%s\\n' "$T3_ARCHIVE_VERSION" > "$T3_STAGING/.install-complete"
-    rm -rf "$T3_RUNTIME_DIR"
-    mv "$T3_STAGING" "$T3_RUNTIME_DIR"
-  fi
-  if [ -n "\${T3_LOCK:-}" ]; then
-    rm -rf "$T3_LOCK"
-    trap - EXIT
-  fi
-  exec "$T3_RUNTIME_DIR/t3" "$@"
-fi
 @@T3_NODE_ENV_SCRIPT@@
-ensure_remote_node_path || true
 T3_NODE_SCRIPT_PATH=@@T3_NODE_SCRIPT_PATH@@
 if [ -n "$T3_NODE_SCRIPT_PATH" ]; then
+  # Dev mode: a source checkout on the remote. This is the only path that
+  # needs Node, so Node discovery runs here and nowhere else.
+  ensure_remote_node_path || true
   if ! command -v node >/dev/null 2>&1; then
     printf 'Remote host is missing node on PATH. Install Node or configure a supported version manager for non-interactive shells.\\n' >&2
     exit 1
   fi
   exec node "$T3_NODE_SCRIPT_PATH" "$@"
 fi
-if command -v t3 >/dev/null 2>&1; then
+T3_ARCHIVE_VERSION=@@T3_ARCHIVE_VERSION@@
-  exec t3 "$@"
+if [ -z "$T3_ARCHIVE_VERSION" ]; then
+  printf 'No t3 release version was provided for the remote runtime.\\n' >&2
+  exit 1
+fi
+# Self-contained release archive: no Node, npm, or compiler on the remote.
+# Unpacked into the pinned-runtime layout so \`t3 service install\` reuses it.
+T3_RELEASE_BASE_URL=@@T3_RELEASE_BASE_URL@@
+T3_RUNTIME_DIR="$HOME/.t3/runtime/versions/$T3_ARCHIVE_VERSION"
+t3_runtime_ready() {
+  [ -x "$T3_RUNTIME_DIR/t3" ] && [ "$(cat "$T3_RUNTIME_DIR/.install-complete" 2>/dev/null)" = "$T3_ARCHIVE_VERSION" ]
+}
+if ! t3_runtime_ready; then
+  mkdir -p "$HOME/.t3/runtime/versions"
+  # Concurrent launches (two clients, a retry racing a slow first run) must
+  # not both install: mkdir is the atomic lock and the ready check repeats
+  # under it.
+  T3_LOCK="$HOME/.t3/runtime/versions/.$T3_ARCHIVE_VERSION.install.lock"
+  # mkdir is the only portable atomic exclusive create (mv would silently
+  # nest a candidate inside an existing lock). The owner publishes its pid
+  # right after, so a lock with a live owner is never reclaimed however
+  # slow its download is, and a lock whose owner is dead is reclaimed at
+  # once. A lock with no pid at all is a crash between mkdir and the pid
+  # write; it is reclaimed after a short grace so a live owner has time to
+  # publish.
+  T3_LOCK_WAITED=0
+  T3_LOCK_UNOWNED=0
+  while ! mkdir "$T3_LOCK" 2>/dev/null; do
+    T3_LOCK_OWNER="$(cat "$T3_LOCK/pid" 2>/dev/null || true)"
+    if [ -n "$T3_LOCK_OWNER" ]; then
+      T3_LOCK_UNOWNED=0
+      if ! kill -0 "$T3_LOCK_OWNER" 2>/dev/null; then
+        rm -rf "$T3_LOCK"
+        continue
+      fi
+    else
+      T3_LOCK_UNOWNED=$((T3_LOCK_UNOWNED + 1))
+      if [ "$T3_LOCK_UNOWNED" -ge 5 ]; then
+        rm -rf "$T3_LOCK"
+        continue
+      fi
+    fi
+    if [ "$T3_LOCK_WAITED" -ge @@T3_ARCHIVE_LOCK_WAIT_SECONDS@@ ]; then
+      printf 'Another t3 %s installation has held %s for too long.\\n' "$T3_ARCHIVE_VERSION" "$T3_LOCK" >&2
+      exit 1
+    fi
+    sleep 1
+    T3_LOCK_WAITED=$((T3_LOCK_WAITED + 1))
+  done
+  printf '%s\\n' "$$" > "$T3_LOCK/pid.tmp" && mv "$T3_LOCK/pid.tmp" "$T3_LOCK/pid"
+  trap 'rm -rf "$T3_LOCK"' EXIT
 fi
-# npm extracts a package before it runs the native builds of its dependencies,
+if ! t3_runtime_ready; then
-# so a failed build (t3 depends on node-pty, which needs a C toolchain) leaves
+  case "$(uname -s)" in
-# the npx cache without a t3 executable. \`npx --yes\` then exits 0 without
+    Darwin) T3_PLATFORM="darwin" ;;
-# running anything at all, which the caller only ever sees as a server that
+    Linux) T3_PLATFORM="linux" ;;
-# never becomes ready. Resolve the CLI once up front so that install failure is
+    *) printf 'Remote host %s has no t3 release archive.\\n' "$(uname -s)" >&2; exit 1 ;;
-# reported here, with npm's own output on stderr.
+  esac
-require_installed_t3_cli() {
+  case "$(uname -m)" in
-  if ! T3_CLI_PATH="$("$@" -- sh -c 'command -v t3')"; then
+    arm64 | aarch64) T3_ARCH="arm64" ;;
-    printf 'Remote host could not install %s. See npm output above for the cause.\\n' @@T3_PACKAGE_SPEC@@ >&2
+    x86_64 | amd64) T3_ARCH="x64" ;;
-    return 1
+    *) printf 'Remote host %s has no t3 release archive.\\n' "$(uname -m)" >&2; exit 1 ;;
+  esac
+  T3_ARCHIVE="t3-$T3_ARCHIVE_VERSION-$T3_PLATFORM-$T3_ARCH.tar.gz"
+  T3_STAGING="$(mktemp -d "$HOME/.t3/runtime/versions/.staging-XXXXXX")"
+  trap 'rm -rf "$T3_STAGING" "$T3_LOCK"' EXIT
+  t3_fetch() {
+    if command -v curl >/dev/null 2>&1; then curl -fsSL --connect-timeout 30 --max-time "$3" "$1" -o "$2"
+    elif command -v wget >/dev/null 2>&1; then wget -q --timeout=30 --tries=1 "$1" -O "$2"
+    else printf 'Remote host needs curl or wget to download %s.\\n' "$T3_ARCHIVE" >&2; exit 1
+    fi
+  }
+  t3_fetch "$T3_RELEASE_BASE_URL/v$T3_ARCHIVE_VERSION/SHA256SUMS" "$T3_STAGING/SHA256SUMS" @@T3_ARCHIVE_CHECKSUMS_SECONDS@@
+  t3_fetch "$T3_RELEASE_BASE_URL/v$T3_ARCHIVE_VERSION/$T3_ARCHIVE" "$T3_STAGING/$T3_ARCHIVE" @@T3_ARCHIVE_DOWNLOAD_SECONDS@@
+  T3_EXPECTED="$(grep " \\*\\{0,1\\}$T3_ARCHIVE$" "$T3_STAGING/SHA256SUMS" | cut -d' ' -f1)"
+  if command -v sha256sum >/dev/null 2>&1; then
+    T3_ACTUAL="$(sha256sum "$T3_STAGING/$T3_ARCHIVE" | cut -d' ' -f1)"
+  else
+    T3_ACTUAL="$(shasum -a 256 "$T3_STAGING/$T3_ARCHIVE" | cut -d' ' -f1)"
   fi
-  if [ -n "$T3_CLI_PATH" ]; then
+  if [ -z "$T3_EXPECTED" ] || [ "$T3_ACTUAL" != "$T3_EXPECTED" ]; then
-    return 0
+    printf 'Checksum mismatch for %s.\\n' "$T3_ARCHIVE" >&2; exit 1
   fi
-  printf 'Remote host installed %s but npm produced no t3 executable, which usually means a native dependency (node-pty) failed to build. Install a C toolchain on the remote host (Debian/Ubuntu: build-essential, Fedora/RHEL: gcc-c++ make, macOS: xcode-select --install) and try again.\\n' @@T3_PACKAGE_SPEC@@ >&2
+  tar -xzf "$T3_STAGING/$T3_ARCHIVE" -C "$T3_STAGING" --strip-components=1
-  return 1
+  rm -f "$T3_STAGING/$T3_ARCHIVE" "$T3_STAGING/SHA256SUMS"
-}
+  # Prove the binary runs here (libc, arch) before marking it ready, or every
-# The launcher records this PID, so exec the CLI without an npm wrapper process.
+  # later launch would exec a broken install instead of retrying.
-if command -v npx >/dev/null 2>&1; then
+  if ! "$T3_STAGING/t3" --version >/dev/null 2>&1; then
-  require_installed_t3_cli npx --yes --package @@T3_PACKAGE_SPEC@@ || exit 1
+    printf 'The t3 %s executable does not run on this host.\\n' "$T3_ARCHIVE_VERSION" >&2; exit 1
-  exec "$T3_CLI_PATH" "$@"
+  fi
+  printf '%s\\n' "$T3_ARCHIVE_VERSION" > "$T3_STAGING/.install-complete"
+  rm -rf "$T3_RUNTIME_DIR"
+  mv "$T3_STAGING" "$T3_RUNTIME_DIR"
 fi
-if command -v npm >/dev/null 2>&1; then
+if [ -n "\${T3_LOCK:-}" ]; then
-  require_installed_t3_cli npm exec --yes --package @@T3_PACKAGE_SPEC@@ || exit 1
+  rm -rf "$T3_LOCK"
-  exec "$T3_CLI_PATH" "$@"
+  trap - EXIT
 fi
-printf 'Remote host is missing the t3 CLI and could not install @@T3_PACKAGE_SPEC@@ because node/npm/npx are unavailable on PATH. Install Node or configure a supported version manager for non-interactive shells.\\n' >&2
+exec "$T3_RUNTIME_DIR/t3" "$@"
-exit 1
 `;
 const REMOTE_LAUNCH_SCRIPT = `set -eu
 @@ -804,10 +781,21 @@ export class SshInvalidArchiveVersionError extends Schema.TaggedError<SshInvalid
 const EXACT_ARCHIVE_VERSION =
   /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
+export class SshMissingRunnerError extends Schema.TaggedError<SshMissingRunnerError>()(
+  "SshMissingRunnerError",
+  {},
+) {
+  override get message(): string {
+    return "A remote t3 runner needs an archive version or a node script path.";
+  }
+}
 export function buildRemoteT3RunnerScript(input?: RemoteT3RunnerOptions): string {
-  const packageSpec = shellSingleQuote(input?.packageSpec?.trim() || "t3@latest");
   const nodeScriptPath = input?.nodeScriptPath?.trim() || "";
   const archiveVersion = input?.archiveVersion?.trim() || "";
+  if (nodeScriptPath === "" && archiveVersion === "") {
+    throw new SshMissingRunnerError();
+  }
   if (archiveVersion !== "" && !EXACT_ARCHIVE_VERSION.test(archiveVersion)) {
     throw new SshInvalidArchiveVersionError({ archiveVersion });
   }
 @@ -818,7 +806,6 @@ export function buildRemoteT3RunnerScript(input?: RemoteT3RunnerOptions): string
   );
   return stripTrailingNewlines(
     applyScriptPlaceholders(REMOTE_RUNNER_SCRIPT, {
-      T3_PACKAGE_SPEC: packageSpec,
       T3_NODE_SCRIPT_PATH: shellSingleQuote(nodeScriptPath),
       T3_ARCHIVE_VERSION: shellSingleQuote(archiveVersion),
       T3_RELEASE_BASE_URL: shellSingleQuote(releaseBaseUrl),
 @@ -841,7 +828,7 @@ export function buildRemoteNodeEnvScript(input?: RemoteT3RunnerOptions): string
 export function buildRemoteLaunchScript(input?: RemoteT3RunnerOptions): string {
   return applyScriptPlaceholders(REMOTE_LAUNCH_SCRIPT, {
-    T3_ARCHIVE_MODE: input?.archiveVersion?.trim() ? "1" : "0",
+    T3_ARCHIVE_MODE: isNodeScriptRunner(input) ? "0" : "1",
     T3_NODE_ENV_SCRIPT: buildRemoteNodeEnvScript(input),
     T3_RUNNER_SCRIPT: stripTrailingNewlines(buildRemoteT3RunnerScript(input)),
     T3_PICK_PORT_SCRIPT: stripTrailingNewlines(REMOTE_PICK_PORT_SCRIPT),
 @@ -894,9 +881,9 @@ export const launchOrReuseRemoteServer = Effect.fn("ssh/tunnel.launchOrReuseRemo
     const result = yield* runSshCommand(target, {
       remoteCommandArgs: ["sh", "-l", "-s", "--", remoteStateKey(target)],
       stdin: buildRemoteLaunchScript(runner),
-      timeoutMs: runner?.archiveVersion?.trim()
+      timeoutMs: isNodeScriptRunner(runner)
-        ? REMOTE_ARCHIVE_LAUNCH_TIMEOUT_MS
+        ? REMOTE_LAUNCH_TIMEOUT_MS
-        : REMOTE_LAUNCH_TIMEOUT_MS,
+        : REMOTE_ARCHIVE_LAUNCH_TIMEOUT_MS,
       ...(input?.authSecret === undefined ? {} : { authSecret: input.authSecret }),
       ...(input?.batchMode === undefined ? {} : { batchMode: input.batchMode }),
       ...(input?.interactiveAuth === undefined ? {} : { interactiveAuth: input.interactiveAuth }),
 @@ -956,7 +943,7 @@ export const issueRemotePairingToken = Effect.fn("ssh/tunnel.issueRemotePairingT
     stdin: buildRemotePairingScript(target, runner),
     // Pairing may be the first command on a cold remote, so it can install
     // the archive on the way.
-    ...(runner?.archiveVersion?.trim() ? { timeoutMs: REMOTE_ARCHIVE_LAUNCH_TIMEOUT_MS } : {}),
+    ...(isNodeScriptRunner(runner) ? {} : { timeoutMs: REMOTE_ARCHIVE_LAUNCH_TIMEOUT_MS }),
     ...(input?.authSecret === undefined ? {} : { authSecret: input.authSecret }),
     ...(input?.batchMode === undefined ? {} : { batchMode: input.batchMode }),
     ...(input?.interactiveAuth === undefined ? {} : { interactiveAuth: input.interactiveAuth }),
 @@ -1687,13 +1674,8 @@ const makeSshEnvironmentManager = Effect.fn("ssh/tunnel.SshEnvironmentManager.ma
       ...sshTargetLogFields(resolvedTarget),
       key,
     });
-    const packageSpec = options.resolveCliPackageSpec?.();
     const runner =
-      options.resolveCliRunner === undefined
+      options.resolveCliRunner === undefined ? undefined : yield* options.resolveCliRunner;
-        ? packageSpec === undefined
-          ? undefined
-          : { packageSpec }
-        : yield* options.resolveCliRunner;
     yield* Effect.logDebug("ssh.environment.runner.resolved", {
       ...sshTargetLogFields(resolvedTarget),
       ...sshRunnerLogFields(runner),

scripts/install.ps1 created+120

...	@@ -0,0 +1,120 @@
1	# Installs the T3 Code CLI from a GitHub Release archive on Windows. Needs
2	# only PowerShell 5.1+; no Node, npm, or compiler.
3	#
4	# irm https://t3.codes/install.ps1 \| iex
5	#
6	# Environment:
7	# T3CODE_CHANNEL release train to follow: stable, nightly, or preview
8	# (default: stable; preview is a maintainers' test train)
9	# T3CODE_VERSION exact version to install (overrides T3CODE_CHANNEL)
10	# T3CODE_HOME T3 home directory (default: ~\.t3)
11	# T3CODE_INSTALL_BIN_DIR where t3.exe is linked (default: ~\.local\bin)
12	# T3CODE_RELEASE_BASE_URL mirror for releases/download (default: GitHub)
13	#
14	# The archive is unpacked into $T3CODE_HOME\runtime\versions\<version>, the
15	# same layout `t3 service install` uses, so the service reuses this download.
16	$ErrorActionPreference = "Stop"
17	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
18
19	$repo = "pingdotgg/t3code"
20	$baseUrl = if ($env:T3CODE_RELEASE_BASE_URL) { $env:T3CODE_RELEASE_BASE_URL.TrimEnd("/") } else { "https://github.com/$repo/releases/download" }
21	$t3Home = if ($env:T3CODE_HOME) { $env:T3CODE_HOME } else { Join-Path $HOME ".t3" }
22	$binDir = if ($env:T3CODE_INSTALL_BIN_DIR) { $env:T3CODE_INSTALL_BIN_DIR } else { Join-Path $HOME ".local\bin" }
23
24	function Fail([string] $message) {
25	Write-Error "t3 install: $message"
26	exit 1
27	}
28
29	# PROCESSOR_ARCHITEW6432 reports the real machine when a 32-bit PowerShell
30	# runs under WOW64; RuntimeInformation needs .NET 4.7.1+, which 5.1 hosts
31	# may lack.
32	$rawArch = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
33	$arch = switch ($rawArch) {
34	"AMD64" { "x64" }
35	"ARM64" { "arm64" }
36	default { Fail "unsupported architecture $rawArch" }
37	}
38
39	$channel = if ($env:T3CODE_CHANNEL) { $env:T3CODE_CHANNEL } else { "stable" }
40	$version = $env:T3CODE_VERSION
41	if (-not $version) {
42	# Tags are v<semver>; the channel is the prerelease identifier, or none for
43	# stable. Only tags of the requested train are considered, so a stable
44	# install can never pick up a nightly or preview build by accident.
45	$tagPattern = switch ($channel) {
46	"stable" { '^v\d+\.\d+\.\d+$' }
47	"nightly" { '^v\d+\.\d+\.\d+-nightly\.\d+\.\d+$' }
48	"preview" { '^v\d+\.\d+\.\d+-preview\.\d+\.\d+$' }
49	default { Fail "T3CODE_CHANNEL must be stable, nightly, or preview" }
50	}
51	$releases = Invoke-RestMethod -Uri "https://api.github.com/repos/$repo/releases?per_page=100" -Headers @{ "User-Agent" = "t3-install" }
52	$tag = ($releases \| Where-Object { -not $_.draft -and $_.tag_name -match $tagPattern } \| Select-Object -First 1).tag_name
53	if (-not $tag) { Fail "could not find a $channel release; set T3CODE_VERSION" }
54	$version = $tag.Substring(1)
55	}
56	if ($version -match '-preview\.') {
57	Write-Warning "t3 $version is a preview build. Preview builds are cut by maintainers from unreleased branches to exercise the release pipeline. They can be broken, receive no fixes, and are never offered as updates. Set T3CODE_CHANNEL=stable (the default) for a supported build."
58	if ($channel -ne "preview" -and -not $env:T3CODE_VERSION) {
59	Fail "refusing a preview build that was not explicitly requested"
60	}
61	}
62
63	$stem = "t3-$version-win32-$arch"
64	$archive = "$stem.zip"
65	$versionsDir = Join-Path $t3Home "runtime\versions"
66	$targetDir = Join-Path $versionsDir $version
67	$marker = Join-Path $targetDir ".install-complete"
68
69	if ((Test-Path $marker) -and ((Get-Content $marker -Raw).Trim() -eq $version)) {
70	Write-Host "t3 $version is already installed at $targetDir"
71	} else {
72	New-Item -ItemType Directory -Force -Path $versionsDir \| Out-Null
73	$staging = Join-Path $versionsDir (".staging-" + [System.IO.Path]::GetRandomFileName())
74	New-Item -ItemType Directory -Path $staging \| Out-Null
75	try {
76	Write-Host "Downloading $archive..."
77	try {
78	Invoke-WebRequest -Uri "$baseUrl/v$version/SHA256SUMS" -OutFile (Join-Path $staging "SHA256SUMS") -UseBasicParsing
79	} catch {
80	$status = $_.Exception.Response.StatusCode.value__
81	if ($status -eq 404) {
82	Fail "t3 $version has no release archive for win32-$arch; releases before the self-contained CLI can only be installed with 'npm install -g t3@$version'"
83	}
84	throw
85	}
86	Invoke-WebRequest -Uri "$baseUrl/v$version/$archive" -OutFile (Join-Path $staging $archive) -UseBasicParsing
87
88	$expected = (Get-Content (Join-Path $staging "SHA256SUMS") \| Where-Object { $_ -match "\s\*?$([regex]::Escape($archive))$" } \| Select-Object -First 1)
89	if (-not $expected) { Fail "$archive is not listed in SHA256SUMS" }
90	$expected = ($expected -split "\s+")[0].ToLowerInvariant()
91	$actual = (Get-FileHash -Algorithm SHA256 (Join-Path $staging $archive)).Hash.ToLowerInvariant()
92	if ($actual -ne $expected) { Fail "checksum mismatch for $archive" }
93
94	Expand-Archive -Path (Join-Path $staging $archive) -DestinationPath $staging -Force
95	# The archive wraps everything in one directory named after its stem.
96	Get-ChildItem (Join-Path $staging $stem) \| Move-Item -Destination $staging
97	Remove-Item (Join-Path $staging $stem), (Join-Path $staging $archive), (Join-Path $staging "SHA256SUMS") -Recurse -Force
98
99	& (Join-Path $staging "t3.exe") --version \| Out-Null
100	if ($LASTEXITCODE -ne 0) { Fail "the downloaded executable does not run" }
101	Set-Content -Path (Join-Path $staging ".install-complete") -Value $version -NoNewline
102
103	if (Test-Path $targetDir) { Remove-Item $targetDir -Recurse -Force }
104	Move-Item $staging $targetDir
105	} catch {
106	if (Test-Path $staging) { Remove-Item $staging -Recurse -Force }
107	throw
108	}
109	}
110
111	New-Item -ItemType Directory -Force -Path $binDir \| Out-Null
112	$shim = Join-Path $binDir "t3.cmd"
113	# UTF-8 without a BOM: cmd.exe reads the shim as-is, and ASCII would corrupt
114	# non-ASCII characters in the user's home path.
115	[System.IO.File]::WriteAllText($shim, "@echo off`r`n`"$(Join-Path $targetDir 't3.exe')`" %*", (New-Object System.Text.UTF8Encoding $false))
116	Write-Host "Installed t3 $version"
117	Write-Host " $shim -> $(Join-Path $targetDir 't3.exe')"
118	if (($env:PATH -split ";") -notcontains $binDir) {
119	Write-Host "Add $binDir to your PATH to run t3."
120	}

scripts/install.sh created+140

...	@@ -0,0 +1,140 @@
1	#!/bin/sh
2	# Installs the T3 Code CLI from a GitHub Release archive. Needs only sh, tar,
3	# sha256sum or shasum, and curl or wget; no Node, npm, or compiler.
4	#
5	# curl -fsSL https://t3.codes/install.sh \| sh
6	#
7	# Environment:
8	# T3CODE_CHANNEL release train to follow: stable, nightly, or preview
9	# (default: stable; preview is a maintainers' test train)
10	# T3CODE_VERSION exact version to install (overrides T3CODE_CHANNEL)
11	# T3CODE_HOME T3 home directory (default: ~/.t3)
12	# T3CODE_INSTALL_BIN_DIR where the `t3` symlink goes (default: ~/.local/bin)
13	# T3CODE_RELEASE_BASE_URL mirror for releases/download (default: GitHub)
14	#
15	# The archive is unpacked into $T3CODE_HOME/runtime/versions/<version>, the
16	# same layout `t3 service install` uses, so the service reuses this download
17	# instead of fetching the release again.
18	set -eu
19
20	repo="pingdotgg/t3code"
21	base_url="${T3CODE_RELEASE_BASE_URL:-https://github.com/${repo}/releases/download}"
22	t3_home="${T3CODE_HOME:-$HOME/.t3}"
23	bin_dir="${T3CODE_INSTALL_BIN_DIR:-$HOME/.local/bin}"
24
25	fail() {
26	printf 't3 install: %s\n' "$1" >&2
27	exit 1
28	}
29
30	# Exit 44 on a 404 so callers can tell "no such asset" from a network failure.
31	fetch() {
32	if command -v curl >/dev/null 2>&1; then
33	status="$(curl -sSL -w '%{http_code}' "$1" -o "$2")" \|\| return 1
34	case "$status" in
35	2??) return 0 ;;
36	404) return 44 ;;
37	*) printf 'GET %s returned HTTP %s\n' "$1" "$status" >&2; return 1 ;;
38	esac
39	elif command -v wget >/dev/null 2>&1; then
40	wget -q --server-response "$1" -O "$2" 2>"$2.headers" && rm -f "$2.headers" && return 0
41	if grep -q ' 404 ' "$2.headers" 2>/dev/null; then rm -f "$2.headers"; return 44; fi
42	cat "$2.headers" >&2; rm -f "$2.headers"; return 1
43	else
44	fail "curl or wget is required"
45	fi
46	}
47
48	case "$(uname -s)" in
49	Darwin) platform="darwin" ;;
50	Linux) platform="linux" ;;
51	*) fail "unsupported operating system $(uname -s); use the desktop app or npm" ;;
52	esac
53	case "$(uname -m)" in
54	arm64 \| aarch64) arch="arm64" ;;
55	x86_64 \| amd64) arch="x64" ;;
56	*) fail "unsupported architecture $(uname -m)" ;;
57	esac
58	command -v tar >/dev/null 2>&1 \|\| fail "tar is required"
59	if command -v sha256sum >/dev/null 2>&1; then
60	checksum() { sha256sum "$1" \| cut -d' ' -f1; }
61	elif command -v shasum >/dev/null 2>&1; then
62	checksum() { shasum -a 256 "$1" \| cut -d' ' -f1; }
63	else
64	fail "sha256sum or shasum is required"
65	fi
66
67	channel="${T3CODE_CHANNEL:-stable}"
68	version="${T3CODE_VERSION:-}"
69	if [ -z "$version" ]; then
70	# Tags are v<semver>; the channel is the prerelease identifier, or none for
71	# stable. Only tags of the requested train are considered, so a stable
72	# install can never pick up a nightly or preview build by accident.
73	case "$channel" in
74	stable) tag_pattern='v$[0-9][0-9]\.[0-9][0-9]\.[0-9][0-9]*$' ;;
75	nightly \| preview) tag_pattern="v$[0-9][^\"]-${channel}\.[0-9]\.[0-9]*$" ;;
76	*) fail "T3CODE_CHANNEL must be stable, nightly, or preview" ;;
77	esac
78	tmp_index="$(mktemp)"
79	fetch "https://api.github.com/repos/${repo}/releases?per_page=100" "$tmp_index"
80	version="$(sed -n "s/.\"tag_name\": \"${tag_pattern}\".*/\1/p" "$tmp_index" \| head -n 1)"
81	rm -f "$tmp_index"
82	[ -n "$version" ] \|\| fail "could not find a ${channel} release; set T3CODE_VERSION"
83	fi
84	case "$version" in
85	-preview.)
86	printf '%s\n' \
87	"t3 ${version} is a preview build." \
88	" Preview builds are cut by maintainers from unreleased branches to exercise the release" \
89	" pipeline. They can be broken, receive no fixes, and are never offered as updates." \
90	" Set T3CODE_CHANNEL=stable (the default) for a supported build." >&2
91	if [ "$channel" != "preview" ] && [ -z "${T3CODE_VERSION:-}" ]; then
92	fail "refusing a preview build that was not explicitly requested"
93	fi
94	;;
95	esac
96
97	stem="t3-${version}-${platform}-${arch}"
98	archive="${stem}.tar.gz"
99	versions_dir="${t3_home}/runtime/versions"
100	target_dir="${versions_dir}/${version}"
101
102	if [ -f "${target_dir}/.install-complete" ] && [ "$(cat "${target_dir}/.install-complete")" = "$version" ]; then
103	printf 't3 %s is already installed at %s\n' "$version" "$target_dir"
104	else
105	mkdir -p "$versions_dir"
106	staging="$(mktemp -d "${versions_dir}/.staging-XXXXXX")"
107	trap 'rm -rf "$staging"' EXIT
108
109	printf 'Downloading %s...\n' "$archive"
110	fetch_status=0
111	fetch "${base_url}/v${version}/SHA256SUMS" "${staging}/SHA256SUMS" \|\| fetch_status=$?
112	if [ "$fetch_status" -eq 44 ]; then
113	fail "t3 ${version} has no release archive for ${platform}-${arch}; releases before the self-contained CLI can only be installed with \`npm install -g t3@${version}\`"
114	elif [ "$fetch_status" -ne 0 ]; then
115	fail "could not download the release checksums"
116	fi
117	fetch "${base_url}/v${version}/${archive}" "${staging}/${archive}"
118
119	expected="$(grep " \*\{0,1\}${archive}\$" "${staging}/SHA256SUMS" \| cut -d' ' -f1)"
120	[ -n "$expected" ] \|\| fail "${archive} is not listed in SHA256SUMS"
121	actual="$(checksum "${staging}/${archive}")"
122	[ "$actual" = "$expected" ] \|\| fail "checksum mismatch for ${archive}"
123
124	tar -xzf "${staging}/${archive}" -C "$staging" --strip-components=1
125	rm -f "${staging}/${archive}" "${staging}/SHA256SUMS"
126	"${staging}/t3" --version >/dev/null \|\| fail "the downloaded executable does not run"
127	printf '%s\n' "$version" > "${staging}/.install-complete"
128
129	rm -rf "$target_dir"
130	mv "$staging" "$target_dir"
131	trap - EXIT
132	fi
133
134	mkdir -p "$bin_dir"
135	ln -sfn "${target_dir}/t3" "${bin_dir}/t3"
136	printf 'Installed t3 %s\n %s -> %s\n' "$version" "${bin_dir}/t3" "${target_dir}/t3"
137	case ":${PATH}:" in
138	":${bin_dir}:") ;;
139	*) printf 'Add %s to your PATH to run `t3`.\n' "$bin_dir" ;;
140	esac

author	Julius Marminge <julius0216@outlook.com> 2026-09-13 21:24:22-07:00
committer	GitHub <noreply@github.com> 2026-09-13 21:24:22-07:00
log	af6c138a0de297f94ddef3133e2f47d017b46e94
tree	0ac168ff249cfda0d1d00b0de7b7a5d5cc77b5c2
parent	c7f23c4668ce3ff2e1b2f63fe51759d1bcc159f8
signature	Signed by PGP key B5690EEEBB952194

...	@@ -39,8 +39,7 @@ On Windows, run `irm https://t3.codes/install.ps1 \| iex` in PowerShell instead.	...	@@ -39,8 +39,7 @@ On Windows, run `irm https://t3.codes/install.ps1 \| iex` in PowerShell instead.
39	It places `t3` in `~/.local/bin` and reuses the same download when you later	39	It places `t3` in `~/.local/bin` and reuses the same download when you later
40	run `t3 service install`. It follows the stable train by default; set	40	run `t3 service install`. It follows the stable train by default; set
41	`T3CODE_CHANNEL=nightly` for nightlies, `T3CODE_VERSION` to pin an exact	41	`T3CODE_CHANNEL=nightly` for nightlies, `T3CODE_VERSION` to pin an exact
42	version, or `T3CODE_RELEASE_BASE_URL` to download from a mirror. Versions that	42	version, or `T3CODE_RELEASE_BASE_URL` to download from a mirror.
43	were only published to npm are refused with the `npm install` to run instead.
44		43
45	`preview` is a third train that maintainers cut from unreleased branches to	44	`preview` is a third train that maintainers cut from unreleased branches to
46	exercise the release pipeline. Those builds can be broken, receive no fixes,	45	exercise the release pipeline. Those builds can be broken, receive no fixes,
...	@@ -58,9 +57,7 @@ restart the service. A server you started by hand is never touched; the	...	@@ -58,9 +57,7 @@ restart the service. A server you started by hand is never touched; the
58	command tells you it is still on the old version so you can restart it	57	command tells you it is still on the old version so you can restart it
59	yourself. Pass an exact version (`t3 update 0.0.41-preview.20260912.1595`) to	58	yourself. Pass an exact version (`t3 update 0.0.41-preview.20260912.1595`) to
60	pin one, `--channel` to follow a different release train (moving onto preview from stable or nightly asks for confirmation), or	59	pin one, `--channel` to follow a different release train (moving onto preview from stable or nightly asks for confirmation), or
61	`--allow-downgrade` to move backwards. Versions published only to npm cannot	60	`--allow-downgrade` to move backwards.
62	be installed this way; the command says so and names the `npm install` to run
63	instead.
64		61
65	## Platform support	62	## Platform support
66		63

feat(server): manage runtimes as release archives only, never from npm (#11510)