From b4c4793e5130c9ec7a46a2bc9d0b1e86346e932a Mon Sep 17 00:00:00 2001
From: 0libote <79215282+0libote@users.noreply.github.com>
Date: Mon, 19 Oct 2026 10:58:47 +0100
Subject: [PATCH 1/4] fix(runtime): install T3 Code from GitHub release
 archives

---
 CONTRIBUTING.md              |   4 +
 Dockerfile                   |  27 ++---
 docker/runtime/install.mjs   |  42 +++++++
 docker/runtime/manager.mjs   |  66 +----------
 docker/runtime/releases.mjs  | 148 +++++++++++++++++++++++++
 docs/t3code-updates.md       |  20 +++-
 scripts/bump-versions.sh     |  16 ++-
 scripts/smoke-test.sh        |   8 ++
 scripts/t3-runtime-smoke.mjs |  37 +++++++
 tests/t3-releases.test.mjs   | 206 +++++++++++++++++++++++++++++++++++
 tests/t3-runtime.test.mjs    |  39 +++----
 11 files changed, 503 insertions(+), 110 deletions(-)
 create mode 100644 docker/runtime/install.mjs
 create mode 100644 docker/runtime/releases.mjs
 create mode 100644 scripts/t3-runtime-smoke.mjs
 create mode 100644 tests/t3-releases.test.mjs

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b3d67b8..2611d3e 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -7,6 +7,10 @@ Issues and pull requests are welcome. Before opening one:
   notice if they broke. Run it against your build
   (`./scripts/smoke-test.sh t3code:browser`) and add a check for whatever you
   fixed. Most of its checks were added after something broke.
+  The T3 Code archive check stages a real current nightly in a disposable home,
+  verifies its checksum, Setup bridge, launcher protocol and native auth probes,
+  then deletes it without selecting or starting it. It can also run locally:
+  `node scripts/t3-runtime-smoke.mjs docker/runtime docker/t3-client/setup-bridge.js`.
 - **CI builds and tests both images on both architectures** before anything is
   published, so a change that only works on amd64 is caught. The slower agent
   lifecycle test runs on amd64 for every build.
diff --git a/Dockerfile b/Dockerfile
index 591544c..6fdfd45 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -214,7 +214,7 @@ RUN set -eux; \
     rm -rf /var/lib/apt/lists/*
 
 # Pinned so a rebuild is reproducible; `scripts/bump-versions.sh` refreshes it
-# against the registry. The agent harnesses are not baked and therefore carry
+# against published releases. The agent harnesses are not baked and therefore carry
 # no pins here: the harness installer resolves and records an exact version on
 # explicit install.
 ARG T3_VERSION=0.1.0
@@ -228,28 +228,16 @@ ENV T3_INFRA_PREFIX=/opt/t3 \
     T3_INFRA_BINARY=/opt/t3/t3 \
     T3_INFRA_LAUNCHER=/usr/local/bin/t3-admin
 
-# The release is split into architecture-specific packages. Install the
-# platform package explicitly instead of the tiny `t3` npm launcher, then
-# flatten it into one architecture-independent immutable path. Its native
-# modules and client assets must remain beside the executable.
+# Upstream's npm platform packages are frozen. Install the exact GitHub CLI
+# archive and verify SHA256SUMS with the same implementation Setup uses.
+COPY docker/runtime/ /opt/t3-runtime/
 RUN set -eux; \
     case "$TARGETARCH" in \
-      amd64) t3_package='@t3code/t3-linux-x64' ;; \
-      arm64) t3_package='@t3code/t3-linux-arm64' ;; \
+      amd64) t3_arch=x64 ;; \
+      arm64) t3_arch=arm64 ;; \
       *) echo "unsupported T3 architecture: $TARGETARCH" >&2; exit 1 ;; \
     esac; \
-    install_root=/tmp/t3-install; \
-    mkdir -p "$T3_INFRA_PREFIX" "$install_root"; \
-    npm install --no-audit --no-fund --ignore-scripts --prefix "$install_root" \
-        "${t3_package}@${T3_VERSION}"; \
-    package_root="$install_root/node_modules/$t3_package"; \
-    cp -a "$package_root/." "$T3_INFRA_PREFIX/"; \
-    # Keep the package manifest as local audit evidence; runtime does not need
-    # npm's surrounding node_modules layout.
-    test -x "$T3_INFRA_BINARY"; \
-    test -f "$T3_INFRA_PREFIX/client/index.html"; \
-    rm -rf "$install_root"; \
-    npm cache clean --force; \
+    "$T3_INFRA_NODE" /opt/t3-runtime/install.mjs "$T3_VERSION" "$t3_arch" "$T3_INFRA_PREFIX"; \
     # Root-owned and not group/other writable: the t3 user runs the server and
     # must never be able to modify it.
     chown -R root:root "$T3_INFRA_PREFIX"; \
@@ -268,7 +256,6 @@ COPY docker/bin/ /usr/local/bin/
 # helpers: the harness manager owns install/resolve, and the provider
 # integration turns its selection into T3's per-provider `binaryPath`.
 COPY docker/harness/ /opt/t3-harness/
-COPY docker/runtime/ /opt/t3-runtime/
 COPY docker/provider-integration/ /opt/t3-provider/
 COPY docker/setup/ /opt/t3-setup/
 # The one-port router (T3_SINGLE_PORT): T3 Code and the setup page behind a
diff --git a/docker/runtime/install.mjs b/docker/runtime/install.mjs
new file mode 100644
index 0000000..0fac1ae
--- /dev/null
+++ b/docker/runtime/install.mjs
@@ -0,0 +1,42 @@
+// Image-only installer; runtime updates continue through the container supervisor.
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+import { releaseForVersion, unpackRelease, executableVersion } from "./releases.mjs";
+
+export async function installImageRelease(version, arch, destination, { fetcher = fetch, run = promisify(execFile) } = {}) {
+  let stage;
+  try {
+    if (!destination || !path.isAbsolute(destination)) throw new Error("Expected version, architecture and an absolute destination.");
+    const release = await releaseForVersion(version, { arch, fetcher });
+    await fs.mkdir(path.dirname(destination), { recursive: true });
+    stage = await fs.mkdtemp(path.join(path.dirname(destination), ".t3-install-"));
+    const unpacked = await unpackRelease(stage, release, { fetcher, run });
+    // Cross builds verify the checksum and archive root; native CI smoke tests
+    // run the executable on both architectures.
+    if (arch === process.arch) {
+      const result = await run(path.join(unpacked, "t3"), ["--version"], { timeout: 30_000 });
+      if (executableVersion(result.stdout) !== version) throw new Error("The downloaded executable reports a different version.");
+    }
+    // Staging on the state volume is private, but the root-owned image runtime
+    // and its generated audit manifest must be readable by the t3 user.
+    await fs.chmod(unpacked, 0o755);
+    await fs.chmod(path.join(unpacked, "package.json"), 0o644);
+    await fs.rename(unpacked, destination);
+  } finally {
+    if (stage) await fs.rm(stage, { recursive: true, force: true });
+  }
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+  const [version, arch, destination] = process.argv.slice(2);
+  try {
+    await installImageRelease(version, arch, destination);
+    console.log(`[t3code] installed ${version} from its verified GitHub CLI archive (${arch})`);
+  } catch (error) {
+    console.error(`[t3code] ${error.message}`);
+    process.exitCode = 1;
+  }
+}
diff --git a/docker/runtime/manager.mjs b/docker/runtime/manager.mjs
index bfde50f..2d434c4 100644
--- a/docker/runtime/manager.mjs
+++ b/docker/runtime/manager.mjs
@@ -1,8 +1,9 @@
 import { promises as fs, existsSync } from "node:fs";
 import path from "node:path";
-import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { packageRelease, unpackRelease, executableVersion } from "./releases.mjs";
 import { CHANNELS, channelOf, exactVersion, databaseName, validScopes, runtimePaths, readJson, writeJson, readSelection, selectedRuntime, operationBusy } from "./state.mjs";
 // The checkout and image deliberately have different infrastructure prefixes.
 const localHarness = new URL("../harness/", import.meta.url);
@@ -13,14 +14,8 @@ const [{ compareVersions }, { acquireLock, liveHolder }, { createFs }] = await P
 export { databaseBusy, operationBusy } from "./state.mjs";
 
 const execute = promisify(execFile);
-const REGISTRY = "https://registry.npmjs.org";
-const LIMIT = 300 * 1024 * 1024;
-export const platformPackage = (arch = process.arch) => {
-  if (!["x64", "arm64"].includes(arch) || process.platform !== "linux") throw new Error("T3 Code updates support Linux amd64 and arm64.");
-  return `@t3code/t3-linux-${arch}`;
-};
+export { packageRelease, executableVersion, validateArchive } from "./releases.mjs";
 const errorText = (error) => String(error?.message ?? error).slice(0, 400);
-export const executableVersion = (output) => /^(?:t3\s+)?v?(\d+\.\d+\.\d+(?:-nightly\.\d{8}\.\d+)?)$/i.exec(String(output).trim())?.[1] ?? null;
 
 /** Ask the release's own CLI which data store it opens, in a disposable home. */
 export async function discoverRuntime(binary, paths, { run = execute, env = process.env } = {}) {
@@ -37,26 +32,6 @@ export async function discoverRuntime(binary, paths, { run = execute, env = proc
   } finally { await fs.rm(probe, { recursive: true, force: true }); }
 }
 
-export async function packageRelease(channel, { fetcher = fetch, arch = process.arch } = {}) {
-  if (!CHANNELS.includes(channel)) throw new Error("Choose Stable or Nightly.");
-  const name = platformPackage(arch);
-  const response = await fetcher(`${REGISTRY}/${name}/${channel === "stable" ? "latest" : "nightly"}`, { signal: AbortSignal.timeout(15_000) });
-  if (!response.ok) throw new Error(`Could not check ${channel} releases (HTTP ${response.status}).`);
-  const pkg = await response.json();
-  if (pkg.name !== name || !exactVersion(pkg.version) || channelOf(pkg.version) !== channel) throw new Error(`The registry did not return a valid ${channel} release.`);
-  const url = new URL(pkg.dist?.tarball ?? "");
-  if (url.origin !== REGISTRY || url.username || url.password || !/^sha512-[A-Za-z0-9+/]+=*$/.test(pkg.dist?.integrity ?? "")) throw new Error("The release has no supported download integrity information.");
-  return { version: pkg.version, name, url: url.href, integrity: pkg.dist.integrity, bytes: pkg.dist.unpackedSize ?? null };
-}
-
-/** Only normal files/directories under npm's package root may be extracted. */
-export function validateArchive(names, types) {
-  for (const name of names.trim().split("\n")) {
-    if (!name.startsWith("package/") || name.split("/").includes("..") || name.includes("\\")) throw new Error("The release archive contains an unsafe path.");
-  }
-  for (const row of types.trim().split("\n")) if (!/^[d-]/.test(row)) throw new Error("The release archive contains unsupported links or entries.");
-}
-
 export async function installRelease(paths, release, { fetcher = fetch, run = execute, env = process.env, bridge = "/usr/local/share/t3-client/setup-bridge.js", onPhase = async () => {} } = {}) {
   const destination = path.join(paths.versions, release.version);
   const preflight = async (binary) => {
@@ -74,40 +49,11 @@ export async function installRelease(paths, release, { fetcher = fetch, run = ex
   }
   await fs.mkdir(paths.versions, { recursive: true, mode: 0o700 });
   const stage = await fs.mkdtemp(path.join(paths.versions, ".staging-"));
-  const archive = path.join(stage, "download.tgz");
-  const unpacked = path.join(stage, "package");
   try {
-    const space = await fs.statfs(paths.root);
-    if (release.bytes && Number(space.bavail) * Number(space.bsize) < release.bytes * 2 + LIMIT) throw new Error("There is not enough free space to stage this T3 Code release.");
     await onPhase("downloading");
-    const response = await fetcher(release.url, { redirect: "error", signal: AbortSignal.timeout(180_000) });
-    if (!response.ok || !response.body) throw new Error(`Could not download T3 Code (HTTP ${response.status}).`);
-    const hash = createHash("sha512");
-    let bytes = 0;
-    const file = await fs.open(archive, "wx", 0o600);
-    try {
-      for await (const chunk of response.body) {
-        bytes += chunk.length;
-        if (bytes > LIMIT) throw new Error("The release download exceeded the supported size.");
-        hash.update(chunk);
-        await file.writeFile(chunk);
-      }
-      await file.sync();
-    } finally { await file.close(); }
-    const expected = Buffer.from(release.integrity.slice(7), "base64");
-    const actual = hash.digest();
-    if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) throw new Error("T3 Code's download failed its integrity check. The running version was kept.");
+    const unpacked = await unpackRelease(stage, release, { fetcher, run });
     await onPhase("verifying");
-    const options = { timeout: 60_000, maxBuffer: 8 * 1024 * 1024 };
-    const names = await run("/usr/bin/tar", ["-tzf", archive], options);
-    const types = await run("/usr/bin/tar", ["-tvzf", archive], options);
-    validateArchive(names.stdout, types.stdout);
-    await fs.mkdir(unpacked, { mode: 0o700 });
-    await run("/usr/bin/tar", ["-xzf", archive, "--no-same-owner", "--no-same-permissions", "--strip-components=1", "-C", unpacked], options);
-    const pkg = await readJson(path.join(unpacked, "package.json"));
-    if (pkg?.name !== release.name || pkg.version !== release.version) throw new Error("The downloaded package does not match the requested release.");
     const binary = path.join(unpacked, "t3");
-    await fs.chmod(binary, 0o755);
     await preflight(binary);
     const shellPath = path.join(unpacked, "client/index.html");
     const shell = await fs.readFile(shellPath, "utf8");
@@ -138,7 +84,7 @@ export function createRuntimeManager({ env = process.env, fetcher = fetch, insta
     if (channel !== undefined && !CHANNELS.includes(channel)) throw new Error("Choose Stable or Nightly.");
     checking ??= (async () => {
       await load();
-      const results = await Promise.allSettled(CHANNELS.map((channel) => packageRelease(channel, { fetcher })));
+      const results = await Promise.allSettled(CHANNELS.map((channel) => packageRelease(channel, { fetcher, token: env.GITHUB_TOKEN })));
       checkErrors = {};
       results.forEach((result, index) => {
         if (result.status === "fulfilled") {
@@ -192,7 +138,7 @@ export function createRuntimeManager({ env = process.env, fetcher = fetch, insta
       const phase = async (name) => { operation.phase = name; await writeJson(paths.operation, operation); };
       void (async () => {
         try {
-          const release = await packageRelease(channel, { fetcher });
+          const release = await packageRelease(channel, { fetcher, token: env.GITHUB_TOKEN });
           if (release.version !== version) throw new Error("A newer release was published. Check for updates again before installing.");
           const directory = await install(paths, release, { fetcher, env, bridge: env.T3_SETUP_BRIDGE, onPhase: phase });
           const installed = await readJson(path.join(directory, ".installed.json"));
diff --git a/docker/runtime/releases.mjs b/docker/runtime/releases.mjs
new file mode 100644
index 0000000..705c3cc
--- /dev/null
+++ b/docker/runtime/releases.mjs
@@ -0,0 +1,148 @@
+// The same verified upstream CLI archives supply image builds and Setup updates.
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { CHANNELS, channelOf, exactVersion, readJson, writeJson } from "./state.mjs";
+
+const execute = promisify(execFile);
+const API = "https://api.github.com/repos/pingdotgg/t3code/releases";
+const DOWNLOAD = "https://github.com/pingdotgg/t3code/releases/download";
+const LIMIT = 300 * 1024 * 1024;
+const UNPACKED_LIMIT = 1024 * 1024 * 1024;
+const PAGE_SIZE = 20;
+const downloadHosts = new Set(["github.com", "release-assets.githubusercontent.com", "objects.githubusercontent.com"]);
+export const executableVersion = (output) => /^(?:t3\s+)?v?(\d+\.\d+\.\d+(?:-nightly\.\d{8}\.\d+)?)$/i.exec(String(output).trim())?.[1] ?? null;
+
+export function archiveStem(version, arch = process.arch) {
+  if (!exactVersion(version)) throw new Error("Choose an exact Stable or Nightly release.");
+  if (!["x64", "arm64"].includes(arch) || process.platform !== "linux") throw new Error("T3 Code updates support Linux amd64 and arm64.");
+  return `t3-${version}-linux-${arch}`;
+}
+
+// GitHub redirects release assets to signed storage URLs. Follow only its
+// download hosts, without forwarding any authorization or accepting HTTP.
+async function get(url, { fetcher, api = false, token, timeout = 15_000 }) {
+  for (let redirects = 0; redirects <= 4; redirects += 1) {
+    const headers = api ? { accept: "application/vnd.github+json", "x-github-api-version": "2022-11-28", ...(token ? { authorization: `Bearer ${token}` } : {}) } : {};
+    const response = await fetcher(url, { redirect: "manual", signal: AbortSignal.timeout(timeout), headers });
+    if ([301, 302, 303, 307, 308].includes(response.status)) {
+      await response.body?.cancel();
+      const next = new URL(response.headers.get("location") ?? "", url);
+      if (api || !downloadHosts.has(next.hostname) || next.protocol !== "https:" || next.username || next.password || next.port) throw new Error("The release redirected to an unsupported download host.");
+      url = next.href;
+      continue;
+    }
+    if (!response.ok) {
+      await response.body?.cancel();
+      const limited = response.status === 429 || (response.status === 403 && response.headers.get("x-ratelimit-remaining") === "0");
+      throw new Error(limited ? "GitHub's release API rate limit was reached. Try checking again later; the running version was kept." : `Could not fetch T3 Code releases (HTTP ${response.status}).`);
+    }
+    return response;
+  }
+  throw new Error("The release download redirected too many times.");
+}
+
+async function boundedText(response, limit) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of response.body) {
+    bytes += chunk.length;
+    if (bytes > limit) throw new Error("T3 Code's release metadata exceeded the supported size.");
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+export function archiveChecksum(text, name) {
+  const matches = text.split(/\r?\n/).map((line) => /^([a-fA-F0-9]{64}) [ *](\S+)$/.exec(line)).filter((line) => line?.[2] === name);
+  if (matches.length !== 1) throw new Error(`The release must list exactly one SHA-256 checksum for ${name}.`);
+  return matches[0][1].toLowerCase();
+}
+
+export async function releaseForVersion(version, { fetcher = fetch, arch = process.arch } = {}) {
+  const root = archiveStem(version, arch);
+  const name = `${root}.tar.gz`;
+  const base = `${DOWNLOAD}/v${version}`;
+  const sums = await boundedText(await get(`${base}/SHA256SUMS`, { fetcher }), 1024 * 1024);
+  return { version, name: "t3-runtime", archive: name, root, url: `${base}/${name}`, integrity: `sha256-${archiveChecksum(sums, name)}`, bytes: null };
+}
+
+export async function packageRelease(channel, { fetcher = fetch, arch = process.arch, token = process.env.GITHUB_TOKEN } = {}) {
+  if (!CHANNELS.includes(channel)) throw new Error("Choose Stable or Nightly.");
+  // Validate the architecture before making requests.
+  archiveStem("0.0.0", arch);
+  for (let page = 1; page <= 5; page += 1) {
+    const url = channel === "stable" ? `${API}/latest` : `${API}?per_page=${PAGE_SIZE}&page=${page}`;
+    const data = JSON.parse(await boundedText(await get(url, { fetcher, api: true, token }), 4 * 1024 * 1024));
+    const entries = channel === "stable" ? [data] : data;
+    if (!Array.isArray(entries)) throw new Error("GitHub did not return a release list.");
+    const release = entries.find((entry) => {
+      const tag = typeof entry?.tag_name === "string" ? entry.tag_name : "";
+      const version = tag.replace(/^v/, "");
+      return !entry?.draft && exactVersion(version) && tag === `v${version}` && channelOf(version) === channel && (channel !== "stable" || entry.prerelease === false);
+    });
+    if (release) return releaseForVersion(release.tag_name.replace(/^v/, ""), { fetcher, arch });
+    if (channel === "stable" || entries.length < PAGE_SIZE) break;
+  }
+  throw new Error(`GitHub did not return a published ${channel} release. Try checking again later.`);
+}
+
+/** Only ordinary files/directories under this exact archive root may extract. */
+export function validateArchive(names, types, root) {
+  if (!/^t3-\d+\.\d+\.\d+(?:-nightly\.\d{8}\.\d+)?-linux-(?:x64|arm64)$/.test(root)) throw new Error("Invalid release archive root.");
+  const seen = new Set();
+  for (const name of names.trimEnd().split("\n")) {
+    const parts = name.replace(/\/$/, "").split("/");
+    if (parts[0] !== root || parts.some((part) => !part || part === "." || part === "..") || /[\\\x00-\x1f\x7f]/.test(name) || seen.has(name)) throw new Error("The release archive contains an unsafe path.");
+    seen.add(name);
+  }
+  let unpacked = 0;
+  for (const row of types.trimEnd().split("\n")) {
+    if (!/^[d-]/.test(row)) throw new Error("The release archive contains unsupported links or entries.");
+    const size = Number(row.trim().split(/\s+/)[2]);
+    if (!Number.isSafeInteger(size) || size < 0) throw new Error("Could not determine the release archive's unpacked size.");
+    unpacked += size;
+  }
+  if (unpacked > UNPACKED_LIMIT) throw new Error("The unpacked release exceeded the supported size.");
+  return unpacked;
+}
+
+export async function unpackRelease(stage, release, { fetcher = fetch, run = execute } = {}) {
+  if (!["x64", "arm64"].some((arch) => archiveStem(release.version, arch) === release.root)
+    || release.url !== `${DOWNLOAD}/v${release.version}/${release.root}.tar.gz`
+    || !/^sha256-[a-f0-9]{64}$/.test(release.integrity)) throw new Error("Invalid release download or checksum information.");
+  const archive = path.join(stage, "download.tgz");
+  const destination = path.join(stage, "contents");
+  const response = await get(release.url, { fetcher, timeout: 180_000 });
+  const hash = createHash("sha256");
+  let bytes = 0;
+  const file = await fs.open(archive, "wx", 0o600);
+  try {
+    for await (const chunk of response.body) {
+      bytes += chunk.length;
+      if (bytes > LIMIT) throw new Error("The release download exceeded the supported size.");
+      hash.update(chunk);
+      await file.writeFile(chunk);
+    }
+    await file.sync();
+  } finally { await file.close(); }
+  if (!timingSafeEqual(hash.digest(), Buffer.from(release.integrity.slice(7), "hex"))) throw new Error("T3 Code's download failed its integrity check. The running version was kept.");
+  const options = { timeout: 60_000, maxBuffer: 8 * 1024 * 1024, env: { ...process.env, LC_ALL: "C" } };
+  const names = await run("/usr/bin/tar", ["-tzf", archive], options);
+  const types = await run("/usr/bin/tar", ["-tvzf", archive], options);
+  const unpacked = validateArchive(names.stdout, types.stdout, release.root);
+  const space = await fs.statfs(stage);
+  if (Number(space.bavail) * Number(space.bsize) < unpacked + 64 * 1024 * 1024) throw new Error("There is not enough free space to stage this T3 Code release.");
+  await fs.mkdir(destination, { mode: 0o700 });
+  await run("/usr/bin/tar", ["-xzf", archive, "--no-same-owner", "--no-same-permissions", "--strip-components=1", "-C", destination], options);
+  const pkg = await readJson(path.join(destination, "package.json"));
+  if (pkg && (pkg.name !== "t3-runtime" || pkg.version !== release.version)) throw new Error("The downloaded archive does not match the requested release.");
+  // CLI archives omit the staging package.json. Keep a container-owned audit
+  // manifest so bundled version resolution also works with older supervisors.
+  if (!pkg) await writeJson(path.join(destination, "package.json"), { name: "t3-runtime", version: release.version, distribution: release.url, integrity: release.integrity });
+  await fs.chmod(path.join(destination, "t3"), 0o755);
+  await fs.access(path.join(destination, "client/index.html"));
+  return destination;
+}
diff --git a/docs/t3code-updates.md b/docs/t3code-updates.md
index aea5eaa..c8f06a4 100644
--- a/docs/t3code-updates.md
+++ b/docs/t3code-updates.md
@@ -1,7 +1,7 @@
 # Upgrading T3 Code
 
 Open **Setup → Updates**. **Check for updates** checks T3 Code and every agent
-and tool at once; for T3 Code it reads the official platform package's published
+and tool at once; for T3 Code it reads the official GitHub releases for the selected
 channel, and **Update and restart**
 installs its exact release immediately. It does not use mise's waiting period.
 
@@ -23,7 +23,8 @@ this setup console.
 Idle tracks console and client activity, not agent turns: a turn that
 outlasts the idle time with every client closed can still be interrupted.
 T3 Code keeps running while the release downloads, verifies
-its SHA-512 integrity and checks compatibility with the container supervisor.
+its SHA-256 digest against the release's `SHA256SUMS` and checks compatibility
+with the container supervisor. Image builds use the same verified CLI archives.
 Once ready, only T3 Code restarts. Active agent turns and its terminals stop;
 clients reconnect. The Setup service and container keep running. A failed or
 timed-out startup restores the previous version and SQLite snapshot, and an
@@ -37,6 +38,21 @@ after an image upgrade. Existing images need one image upgrade to gain this
 feature, and future releases which require a newer supervisor may still need
 a new image.
 
+Upstream stopped publishing the `@t3code/t3-linux-*` npm packages after
+`0.1.1-nightly.20261016.3190`. Images using that source need a new image with
+the GitHub archive updater before they can find newer nightlies. Existing
+downloaded runtimes, release selections and device credentials remain usable.
+Pulling this repository alone does not change an already running container.
+
+Checks use GitHub's public release API without requiring an account or token.
+If `GITHUB_TOKEN` is supplied (for example in CI), it authenticates only release
+API requests; it is never sent to archive or checksum download hosts.
+A GitHub outage, rate limit, missing archive or invalid checksum leaves the
+running version selected and reports the check or installation error. Failed
+checks retain the previous release information and its successful check time.
+Nightly discovery searches up to 100 recent releases, skipping preview and draft
+builds; it reports an error if no nightly can be found within that bound.
+
 After a successful update, obsolete cached releases are removed. The active
 release, its predecessor and the latest known target for each channel are kept.
 
diff --git a/scripts/bump-versions.sh b/scripts/bump-versions.sh
index 03f1fe4..db074a0 100755
--- a/scripts/bump-versions.sh
+++ b/scripts/bump-versions.sh
@@ -21,12 +21,12 @@ YELLOW=$'\033[33m'; RESET=$'\033[0m'
 drift=0
 changed=0
 
-# ARG name : npm package. The Dockerfile holds each as `ARG <name>=<version>`.
+# ARG name : release source. T3 uses GitHub; the other pins use npm.
 # Agent harnesses are deliberately absent: they are installed at runtime
 # through mise, which resolves and records an exact version on explicit install
 # rather than baking one into the image.
 PINS="
-T3_VERSION:t3
+T3_VERSION:github-t3
 CHROME_DEVTOOLS_MCP_VERSION:chrome-devtools-mcp
 PLAYWRIGHT_MCP_VERSION:@playwright/mcp
 "
@@ -36,6 +36,14 @@ npm_latest() {
     | python3 -c 'import sys,json; print(json.load(sys.stdin)["version"])'
 }
 
+latest_version() {
+  if [ "$1" = github-t3 ]; then
+    node --input-type=module -e 'import { packageRelease } from "./docker/runtime/releases.mjs"; console.log((await packageRelease("stable")).version);'
+  else
+    npm_latest "$1"
+  fi
+}
+
 printf '%s%-28s %-12s %-12s%s\n' "$BOLD" "PIN" "CURRENT" "LATEST" "$RESET"
 
 for entry in $PINS; do
@@ -43,8 +51,8 @@ for entry in $PINS; do
   current="$(grep -m1 "^ARG ${arg}=" Dockerfile | cut -d= -f2)"
   [ -n "$current" ] || { echo "${RED}no ARG ${arg} in Dockerfile${RESET}" >&2; exit 1; }
 
-  if ! latest="$(npm_latest "$pkg")"; then
-    echo "${RED}could not reach the registry for ${pkg}${RESET}" >&2
+  if ! latest="$(latest_version "$pkg")"; then
+    echo "${RED}could not check published releases for ${pkg}${RESET}" >&2
     exit 1
   fi
 
diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
index f557c70..2f7d03f 100755
--- a/scripts/smoke-test.sh
+++ b/scripts/smoke-test.sh
@@ -466,6 +466,14 @@ t3_update_access_is_gated() {
 }
 check "T3 Code upgrades require sign-in, same-site access and a public channel" t3_update_access_is_gated
 
+# Catch a frozen release source or a changed upstream archive layout on each
+# native architecture. This only stages a nightly in /tmp; the live server,
+# selected release and its database are never changed.
+t3_github_archive_stages() {
+  docker exec -i --user t3 "$NAME" node --input-type=module < "$SCRIPT_DIR/t3-runtime-smoke.mjs" >>"$UI_AUDIT_LOG" 2>&1
+}
+check "a real GitHub nightly stages with Setup and supervisor compatibility" t3_github_archive_stages
+
 # This container carries an older image's settings (see LEGACY_ENV). They are
 # reported, the image still names itself correctly, and nothing it started runs
 # with them.
diff --git a/scripts/t3-runtime-smoke.mjs b/scripts/t3-runtime-smoke.mjs
new file mode 100644
index 0000000..fd3c464
--- /dev/null
+++ b/scripts/t3-runtime-smoke.mjs
@@ -0,0 +1,37 @@
+// Stage a real nightly in a disposable home, without selecting it or restarting
+// the container. CI runs this inside both images on native amd64 and arm64.
+// Locally: node scripts/t3-runtime-smoke.mjs docker/runtime docker/t3-client/setup-bridge.js
+import assert from "node:assert/strict";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const directory = path.resolve(process.argv[2] || "/opt/t3-runtime");
+const bridge = path.resolve(process.argv[3] || "/usr/local/share/t3-client/setup-bridge.js");
+const { packageRelease, installRelease } = await import(pathToFileURL(path.join(directory, "manager.mjs")));
+const { runtimePaths, readJson } = await import(pathToFileURL(path.join(directory, "state.mjs")));
+const root = await fs.mkdtemp(path.join(os.tmpdir(), "t3-runtime-smoke-"));
+try {
+  const env = { ...process.env, HOME: root, T3CODE_HOME: path.join(root, "home") };
+  const paths = runtimePaths(env);
+  const release = await packageRelease("nightly");
+  assert.match(release.integrity, /^sha256-[a-f0-9]{64}$/);
+  assert.ok(release.url.endsWith(`-linux-${process.arch}.tar.gz`));
+  const staged = await installRelease(paths, release, { env, bridge });
+  const metadata = await readJson(path.join(staged, ".installed.json"));
+  assert.equal(metadata.version, release.version);
+  assert.equal(metadata.integrity, release.integrity);
+  assert.ok(metadata.database && metadata.scopes.length, "native auth capabilities were probed");
+  const output = await promisify(execFile)(path.join(staged, "t3"), ["--version"], { env, timeout: 30_000 });
+  assert.ok(output.stdout.includes(release.version));
+  const html = await fs.readFile(path.join(staged, "client/index.html"), "utf8");
+  assert.equal(html.split("<script data-t3-setup-bridge>").length, 2, "one Setup bridge");
+  assert.equal(await readJson(paths.selection), null, "staging cannot select a runtime");
+  assert.equal(await readJson(paths.request), null, "staging cannot request a restart");
+  console.log(`Verified GitHub nightly ${release.version} on linux/${process.arch}; Setup, protocol and native auth probes passed.`);
+} finally {
+  await fs.rm(root, { recursive: true, force: true });
+}
diff --git a/tests/t3-releases.test.mjs b/tests/t3-releases.test.mjs
new file mode 100644
index 0000000..e0f03b9
--- /dev/null
+++ b/tests/t3-releases.test.mjs
@@ -0,0 +1,206 @@
+import assert from "node:assert/strict";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import test from "node:test";
+import { archiveStem, archiveChecksum, packageRelease, releaseForVersion, unpackRelease, validateArchive } from "../docker/runtime/releases.mjs";
+import { installRelease } from "../docker/runtime/manager.mjs";
+import { installImageRelease } from "../docker/runtime/install.mjs";
+import { runtimePaths, readJson, writeJson } from "../docker/runtime/state.mjs";
+
+const execute = promisify(execFile);
+const VERSION = "0.1.1-nightly.20261019.3348";
+const digest = "a".repeat(64);
+const entry = (version = VERSION, extra = {}) => ({ tag_name: `v${version}`, draft: false, prerelease: version.includes("nightly"), ...extra });
+const sums = (version = VERSION) => ["x64", "arm64"].map((arch) => `${digest}  ${archiveStem(version, arch)}.tar.gz`).join("\n");
+const source = async (url) => new Response(url.endsWith("/SHA256SUMS") ? sums(/\/v([^/]+)\/SHA256SUMS$/.exec(url)[1]) : JSON.stringify(url.endsWith("/latest") ? entry("0.1.0") : [entry()]));
+
+async function world(t) {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "t3-release-test-"));
+  t.after(() => fs.rm(root, { recursive: true, force: true }));
+  return root;
+}
+
+async function fixture(t, { manifest, banner = VERSION, compatible = true, link = false } = {}) {
+  const root = await world(t);
+  const stem = archiveStem(VERSION);
+  const contents = path.join(root, stem);
+  await fs.mkdir(path.join(contents, "client"), { recursive: true });
+  if (manifest) await writeJson(path.join(contents, "package.json"), { name: "t3-runtime", version: manifest });
+  await fs.writeFile(path.join(contents, "client/index.html"), "<html><body>client</body></html>");
+  await fs.writeFile(path.join(contents, "t3"), `#!${process.execPath}
+const fs = require('node:fs');
+const path = require('node:path');
+if (process.argv[2] === '--version') console.log(${JSON.stringify(banner)});
+else if (process.argv[2] === '__service-preflight') console.log(JSON.stringify({status: ${JSON.stringify(compatible ? "ready" : "blocked")}, version: ${JSON.stringify(VERSION)}, launcherProtocol: 3, reason: 'requires a newer supervisor'}));
+else if (process.argv[2] === 'auth') {
+  const dir = path.join(process.env.T3CODE_HOME, 'userdata');
+  fs.mkdirSync(dir, {recursive:true});
+  fs.writeFileSync(path.join(dir, 'statev2.sqlite'), 'probe only');
+  console.log(JSON.stringify({permissions:['orchestration:read']}));
+}
+`);
+  if (link) await fs.symlink("/etc/passwd", path.join(contents, "escape"));
+  const file = path.join(root, "fixture.tar.gz");
+  await execute("/usr/bin/tar", ["-czf", file, "-C", root, stem]);
+  const bytes = await fs.readFile(file);
+  const release = { version: VERSION, name: "t3-runtime", root: stem, archive: `${stem}.tar.gz`, url: `https://github.com/pingdotgg/t3code/releases/download/v${VERSION}/${stem}.tar.gz`, integrity: `sha256-${createHash("sha256").update(bytes).digest("hex")}` };
+  const env = { ...process.env, T3CODE_HOME: path.join(root, "home") };
+  const bridge = path.join(root, "bridge.js");
+  await fs.writeFile(bridge, 'console.log("data-t3-setup-entry");');
+  return { root, release, env, bridge, fetcher: async (url) => new Response(url.endsWith("/SHA256SUMS") ? `${release.integrity.slice(7)}  ${release.archive}\n` : bytes), paths: runtimePaths(env) };
+}
+
+test("both architectures resolve public GitHub releases and their exact checksums", async () => {
+  for (const arch of ["x64", "arm64"]) for (const channel of ["stable", "nightly"]) {
+    const release = await packageRelease(channel, { fetcher: source, arch });
+    assert.equal(release.version, channel === "stable" ? "0.1.0" : VERSION);
+    assert.equal(release.integrity, `sha256-${digest}`);
+    assert.ok(release.url.endsWith(`-linux-${arch}.tar.gz`));
+    assert.match(release.url, /^https:\/\/github.com\/pingdotgg\/t3code\/releases\/download\//);
+  }
+  await assert.rejects(packageRelease("preview", { fetcher: source }), /Stable or Nightly/);
+  await assert.rejects(packageRelease("stable", { fetcher: source, arch: "riscv64" }), /amd64 and arm64/);
+  await assert.rejects(releaseForVersion("../version", { fetcher: source }), /exact Stable or Nightly/);
+});
+
+test("nightly discovery skips previews and drafts, follows pages and stops at its bound", async () => {
+  const calls = [];
+  const preview = entry("0.1.1-preview.20261019.3350");
+  const fetcher = async (url) => {
+    calls.push(url);
+    if (url.includes("page=1")) return new Response(JSON.stringify(Array(20).fill(preview)));
+    if (url.includes("page=2")) return new Response(JSON.stringify([null, { tag_name: 123 }, entry(VERSION, { draft: true }), preview, entry()]));
+    return source(url);
+  };
+  assert.equal((await packageRelease("nightly", { fetcher })).version, VERSION);
+  assert.equal(calls.length, 3);
+  let pages = 0;
+  await assert.rejects(packageRelease("nightly", { fetcher: async () => { pages += 1; return new Response(JSON.stringify(Array(20).fill(preview))); } }), /published nightly/);
+  assert.equal(pages, 5);
+  for (const release of [preview, entry(VERSION), entry("0.1.0", { draft: true }), entry("0.1.0", { prerelease: true }), entry("0.1.0", { tag_name: "0.1.0" })]) {
+    await assert.rejects(packageRelease("stable", { fetcher: async () => new Response(JSON.stringify(release)) }), /published stable/);
+  }
+});
+
+test("missing, malformed or duplicate architecture checksums cannot select a release", async () => {
+  const name = `${archiveStem(VERSION)}.tar.gz`;
+  assert.equal(archiveChecksum(`${digest.toUpperCase()} *${name}\r\n`, name), digest);
+  for (const text of ["", `${digest}  wrong.tar.gz`, `sha1  ${name}`, `${sums()}\n${sums()}`]) {
+    await assert.rejects(releaseForVersion(VERSION, { fetcher: async () => new Response(text) }), /exactly one SHA-256/);
+  }
+});
+
+test("GitHub rate limits, malformed metadata and oversized checksums report a failure", async () => {
+  await assert.rejects(packageRelease("nightly", { fetcher: async () => new Response("", { status: 403, headers: { "x-ratelimit-remaining": "0" } }) }), /rate limit/);
+  await assert.rejects(packageRelease("nightly", { fetcher: async () => new Response("", { status: 429 }) }), /rate limit/);
+  await assert.rejects(packageRelease("nightly", { fetcher: async () => new Response("", { status: 503 }) }), /HTTP 503/);
+  await assert.rejects(packageRelease("nightly", { fetcher: async () => new Response("{}") }), /release list/);
+  await assert.rejects(releaseForVersion(VERSION, { fetcher: async () => new Response("a".repeat(1024 * 1024 + 1)) }), /metadata exceeded/);
+});
+
+test("asset redirects accept GitHub storage and reject other hosts or protocols", async () => {
+  for (const location of ["https://release-assets.githubusercontent.com/a?signature=test", "https://objects.githubusercontent.com/a"]) {
+    let calls = 0;
+    const release = await releaseForVersion(VERSION, { fetcher: async (url, options) => {
+      assert.equal(options.redirect, "manual");
+      assert.deepEqual(options.headers, {});
+      calls += 1;
+      return calls === 1 ? new Response(null, { status: 302, headers: { location } }) : new Response(sums());
+    } });
+    assert.equal(release.version, VERSION);
+    assert.equal(calls, 2);
+  }
+  for (const location of ["https://evil.example/archive", "http://github.com/archive", "https://user:password@github.com/archive", "https://github.com:444/archive"]) {
+    let calls = 0;
+    await assert.rejects(releaseForVersion(VERSION, { fetcher: async () => { calls += 1; return new Response(null, { status: 302, headers: { location } }); } }), /unsupported download host/);
+    assert.equal(calls, 1);
+  }
+  await assert.rejects(releaseForVersion(VERSION, { fetcher: async () => new Response(null, { status: 302, headers: { location: "https://github.com/loop" } }) }), /too many times/);
+});
+
+test("optional GitHub credentials are sent only to the release API", async () => {
+  const release = await packageRelease("nightly", { token: "test-token", fetcher: async (url, options) => {
+    assert.equal(options.headers.authorization, url.startsWith("https://api.github.com/") ? "Bearer test-token" : undefined);
+    return source(url);
+  } });
+  assert.equal(release.version, VERSION);
+  await assert.rejects(packageRelease("nightly", { token: "test-token", fetcher: async () => new Response(null, { status: 302, headers: { location: "https://github.com/redirect" } }) }), /unsupported download host/);
+});
+
+test("archive paths, links, special files and excessive expansion fail before extraction", () => {
+  const root = archiveStem(VERSION);
+  const row = (type = "-", size = 12) => `${type}rwxr-xr-x 0/0 ${size} 2026-10-19 00:00 ${root}/t3\n`;
+  assert.equal(validateArchive(`${root}/\n${root}/t3\n`, row("d", 0) + row(), root), 12);
+  for (const name of ["/tmp/escape", `${root}/../escape`, "elsewhere/t3", `${root}/dir\\escape`, `${root}/./t3`, `${root}//t3`, `${root}/t3\n${root}/t3`]) assert.throws(() => validateArchive(name, row(), root), /unsafe/);
+  for (const type of ["l", "h", "b", "c", "p"]) assert.throws(() => validateArchive(`${root}/t3`, row(type), root), /unsupported/);
+  assert.throws(() => validateArchive(`${root}/t3`, row("-", 1024 ** 3 + 1), root), /unpacked release/);
+});
+
+test("verified archives stage a runnable release, preserve Setup and record capabilities", async (t) => {
+  const f = await fixture(t);
+  const dir = await installRelease(f.paths, f.release, f);
+  assert.equal((await execute(path.join(dir, "t3"), ["--version"])).stdout.trim(), VERSION);
+  const metadata = await readJson(path.join(dir, ".installed.json"));
+  assert.equal((await readJson(path.join(dir, "package.json"))).distribution, f.release.url);
+  assert.equal(metadata.integrity, f.release.integrity);
+  assert.equal(metadata.database, "statev2.sqlite");
+  assert.deepEqual(metadata.scopes, ["orchestration:read"]);
+  assert.equal((await fs.readFile(path.join(dir, "client/index.html"), "utf8")).split("data-t3-setup-bridge").length, 2);
+  assert.deepEqual(await fs.readdir(f.paths.versions), [VERSION]);
+  assert.equal(await readJson(f.paths.selection), null, "staging never selects or restarts T3");
+});
+
+test("checksum, manifest, link and protocol failures never publish a staged runtime", async (t) => {
+  for (const options of [{ corrupt: true }, { manifest: "0.1.0" }, { banner: "0.1.0" }, { compatible: false }, { link: true }]) {
+    const f = await fixture(t, options);
+    const release = options.corrupt ? { ...f.release, integrity: `sha256-${digest}` } : f.release;
+    await assert.rejects(installRelease(f.paths, release, f), /integrity check|does not match|different T3 Code version|newer supervisor|unsupported links/);
+    assert.deepEqual(await fs.readdir(f.paths.versions), []);
+    assert.equal(await readJson(f.paths.selection), null);
+  }
+});
+
+test("existing npm-era cached runtimes are reused without a download or repatching", async (t) => {
+  const f = await fixture(t);
+  const dir = await installRelease(f.paths, f.release, f);
+  const marker = path.join(dir, ".installed.json");
+  await writeJson(marker, { ...(await readJson(marker)), package: "@t3code/t3-linux-x64", integrity: "sha512-old" });
+  const shell = await fs.readFile(path.join(dir, "client/index.html"), "utf8");
+  assert.equal(await installRelease(f.paths, f.release, { ...f, fetcher: async () => { throw new Error("must not download"); } }), dir);
+  assert.equal(await fs.readFile(path.join(dir, "client/index.html"), "utf8"), shell);
+  assert.equal((await readJson(marker)).integrity, "sha512-old");
+});
+
+test("archive downloads reject tampered origins before fetching or extracting", async (t) => {
+  const f = await fixture(t);
+  const stage = path.join(f.root, "stage");
+  await fs.mkdir(stage);
+  let calls = 0;
+  await assert.rejects(unpackRelease(stage, { ...f.release, url: "https://evil.example/archive" }, { fetcher: async () => { calls += 1; } }), /Invalid release download/);
+  assert.equal(calls, 0);
+});
+
+test("image installs share verification and expose the runtime and manifest to unprivileged users", async (t) => {
+  const f = await fixture(t);
+  const destination = path.join(f.root, "image/t3");
+  await installImageRelease(VERSION, process.arch, destination, f);
+  assert.equal((await fs.stat(destination)).mode & 0o777, 0o755);
+  assert.equal((await fs.stat(path.join(destination, "package.json"))).mode & 0o777, 0o644);
+  assert.equal((await fs.stat(path.join(destination, "t3"))).mode & 0o777, 0o755);
+  assert.equal((await readJson(path.join(destination, "package.json"))).version, VERSION);
+  assert.deepEqual(await fs.readdir(path.dirname(destination)), ["t3"], "image staging is removed");
+});
+
+test("failed image verification keeps an existing runtime and removes staging", async (t) => {
+  const f = await fixture(t, { banner: "0.1.0" });
+  const destination = path.join(f.root, "image/t3");
+  await fs.mkdir(destination, { recursive: true });
+  await fs.writeFile(path.join(destination, "existing"), "keep");
+  await assert.rejects(installImageRelease(VERSION, process.arch, destination, f), /different version/);
+  assert.equal(await fs.readFile(path.join(destination, "existing"), "utf8"), "keep");
+  assert.deepEqual(await fs.readdir(path.dirname(destination)), ["t3"]);
+});
diff --git a/tests/t3-runtime.test.mjs b/tests/t3-runtime.test.mjs
index c246fc8..d4d6568 100644
--- a/tests/t3-runtime.test.mjs
+++ b/tests/t3-runtime.test.mjs
@@ -7,7 +7,7 @@ import { promisify } from "node:util";
 import { randomUUID } from "node:crypto";
 import test from "node:test";
 import { runtimePaths, writeJson, readJson, readSelection, selectedRuntime, exactVersion } from "../docker/runtime/state.mjs";
-import { createRuntimeManager, packageRelease, installRelease, validateArchive, executableVersion } from "../docker/runtime/manager.mjs";
+import { createRuntimeManager, packageRelease, installRelease, executableVersion } from "../docker/runtime/manager.mjs";
 import { recoverUpdate, snapshotDatabase, syncAuthentication, pruneRuntimes, projectScopes } from "../docker/runtime/supervisor.mjs";
 
 const NIGHTLY = "0.0.46-nightly.20261011.2980";
@@ -32,8 +32,15 @@ const waitFor = async (fn, ms = 5000) => {
   while (Date.now() < deadline) { if (await fn()) return; await new Promise((resolve) => setTimeout(resolve, 20)); }
   throw new Error("Timed out waiting for runtime state");
 };
-const release = (version = NIGHTLY) => ({ name: `@t3code/t3-linux-${process.arch}`, version, dist: { tarball: `https://registry.npmjs.org/@t3code/t3-linux-${process.arch}/-/t3-${version}.tgz`, integrity: "sha512-" + Buffer.alloc(64).toString("base64") } });
-const registry = async (url) => new Response(JSON.stringify(release(url.endsWith("/latest") ? "0.0.45" : NIGHTLY)));
+const release = (version = NIGHTLY) => ({ tag_name: `v${version}`, draft: false, prerelease: version.includes("nightly") });
+const nightlyIndex = (url) => url.includes("?per_page=");
+const registry = async (url) => {
+  if (url.endsWith("/SHA256SUMS")) {
+    const version = /\/v([^/]+)\/SHA256SUMS$/.exec(url)[1];
+    return new Response(["x64", "arm64"].map((arch) => "0".repeat(64) + `  t3-${version}-linux-${arch}.tar.gz`).join("\n"));
+  }
+  return new Response(JSON.stringify(nightlyIndex(url) ? [release()] : release("0.0.45")));
+};
 async function seedDatabase(file, value) {
   const { DatabaseSync } = await import("node:sqlite");
   const db = new DatabaseSync(file);
@@ -79,27 +86,11 @@ test("managed CLI resolution parks database commands during activation", async (
   assert.equal((await resolve()).stdout.trim(), paths.binary);
 });
 
-test("channel metadata rejects previews, wrong packages and untrusted download hosts", async () => {
-  assert.equal((await packageRelease("nightly", { fetcher: registry })).version, NIGHTLY);
-  await assert.rejects(packageRelease("preview", { fetcher: registry }), /Stable or Nightly/);
-  await assert.rejects(packageRelease("stable", { fetcher: registry, arch: "riscv64" }), /amd64 and arm64/);
-  for (const modify of [(pkg) => { pkg.name = "another-package"; }, (pkg) => { pkg.version = "0.0.46-preview.20261011.1"; }, (pkg) => { pkg.dist.tarball = "https://untrusted.example/download"; }, (pkg) => { pkg.dist.integrity = "sha1-anything"; }]) {
-    const pkg = release(); modify(pkg);
-    await assert.rejects(packageRelease("nightly", { fetcher: async () => new Response(JSON.stringify(pkg)) }));
-  }
-});
-
-test("archive traversal, links and special files are refused before extraction", () => {
-  validateArchive("package/t3\npackage/client/index.html\n", "-rwxr-xr-x t3\ndrwxr-xr-x client\n");
-  for (const name of ["/tmp/escape", "package/../escape", "elsewhere/t3", "package/dir\\escape"]) assert.throws(() => validateArchive(name, "-file"), /unsafe/);
-  for (const type of ["l", "h", "b", "c", "p"]) assert.throws(() => validateArchive("package/t3", type + "entry"), /unsupported/);
-});
-
 test("integrity failure never executes or publishes the download", async (t) => {
   const { paths } = await world(t);
-  const pkg = release();
+  const pkg = await packageRelease("nightly", { fetcher: registry });
   let runs = 0;
-  await assert.rejects(installRelease(paths, { version: pkg.version, name: pkg.name, url: pkg.dist.tarball, integrity: pkg.dist.integrity }, { fetcher: async () => new Response("corrupt archive"), run: async () => { runs += 1; } }), /integrity check/);
+  await assert.rejects(installRelease(paths, pkg, { fetcher: async () => new Response("corrupt archive"), run: async () => { runs += 1; } }), /integrity check/);
   assert.equal(runs, 0);
   assert.equal((await selectedRuntime(paths)).version, "0.0.45");
   assert.deepEqual(await fs.readdir(paths.versions), []);
@@ -145,7 +136,7 @@ test("cached release checks remain available offline without selecting or instal
 
 test("an unavailable nightly tag does not block a fresh stable release check", async (t) => {
   const { env } = await world(t);
-  const manager = createRuntimeManager({ env, fetcher: async (url) => url.endsWith("/nightly") ? new Response("missing", { status: 404 }) : registry(url) });
+  const manager = createRuntimeManager({ env, fetcher: async (url) => nightlyIndex(url) ? new Response("missing", { status: 404 }) : registry(url) });
   const checked = await manager.check();
   assert.equal(checked.error, null);
   assert.match(checked.errors.nightly, /404/);
@@ -183,7 +174,7 @@ test("Stable success does not mask a failed selected Nightly channel", async (t)
   const { env, paths } = await world(t);
   await fakeRuntime(paths, NIGHTLY);
   await writeJson(paths.selection, { schema: 1, channel: "nightly", version: NIGHTLY });
-  const manager = createRuntimeManager({ env, fetcher: async (url) => url.endsWith("/nightly") ? new Response("missing", { status: 404 }) : registry(url) });
+  const manager = createRuntimeManager({ env, fetcher: async (url) => nightlyIndex(url) ? new Response("missing", { status: 404 }) : registry(url) });
   const result = await manager.check();
   assert.match(result.error, /404/);
   assert.equal(result.channels.stable.version, "0.0.45");
@@ -204,7 +195,7 @@ test("switching checks report the requested channel independently of the selecte
   assert.match(stable.error, /stable offline/);
   assert.equal(nightly.error, null);
   assert.equal(nightly.channels.nightly.version, NIGHTLY);
-  assert.equal(calls.length, 2, 'concurrent channel checks share the registry requests');
+  assert.equal(calls.length, 3, 'concurrent channel checks share GitHub requests, including the successful channel checksum');
   await assert.rejects(manager.check({ channel: 'preview' }), /Stable or Nightly/);
 });
 

From c88a9291c6aef01c211839d7f2a4f03add8ff327 Mon Sep 17 00:00:00 2001
From: 0libote <79215282+0libote@users.noreply.github.com>
Date: Tue, 20 Oct 2026 16:21:02 +0100
Subject: [PATCH 2/4] refactor(runtime): trim release lookup plumbing

---
 docker/runtime/manager.mjs  | 2 +-
 docker/runtime/releases.mjs | 2 +-
 scripts/bump-versions.sh    | 5 +++--
 tests/t3-releases.test.mjs  | 4 ++--
 4 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/docker/runtime/manager.mjs b/docker/runtime/manager.mjs
index 2d434c4..0023965 100644
--- a/docker/runtime/manager.mjs
+++ b/docker/runtime/manager.mjs
@@ -14,7 +14,7 @@ const [{ compareVersions }, { acquireLock, liveHolder }, { createFs }] = await P
 export { databaseBusy, operationBusy } from "./state.mjs";
 
 const execute = promisify(execFile);
-export { packageRelease, executableVersion, validateArchive } from "./releases.mjs";
+export { packageRelease, executableVersion } from "./releases.mjs";
 const errorText = (error) => String(error?.message ?? error).slice(0, 400);
 
 /** Ask the release's own CLI which data store it opens, in a disposable home. */
diff --git a/docker/runtime/releases.mjs b/docker/runtime/releases.mjs
index 705c3cc..2dc27d3 100644
--- a/docker/runtime/releases.mjs
+++ b/docker/runtime/releases.mjs
@@ -66,7 +66,7 @@ export async function releaseForVersion(version, { fetcher = fetch, arch = proce
   const name = `${root}.tar.gz`;
   const base = `${DOWNLOAD}/v${version}`;
   const sums = await boundedText(await get(`${base}/SHA256SUMS`, { fetcher }), 1024 * 1024);
-  return { version, name: "t3-runtime", archive: name, root, url: `${base}/${name}`, integrity: `sha256-${archiveChecksum(sums, name)}`, bytes: null };
+  return { version, name: "t3-runtime", root, url: `${base}/${name}`, integrity: `sha256-${archiveChecksum(sums, name)}` };
 }
 
 export async function packageRelease(channel, { fetcher = fetch, arch = process.arch, token = process.env.GITHUB_TOKEN } = {}) {
diff --git a/scripts/bump-versions.sh b/scripts/bump-versions.sh
index db074a0..29014ab 100755
--- a/scripts/bump-versions.sh
+++ b/scripts/bump-versions.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Refresh the pinned tool versions in the Dockerfile against their registries.
+# Refresh the pinned tool versions in the Dockerfile against published releases.
 #
 # The pins exist so a rebuild is reproducible. The cost of pinning is that an
 # image goes stale the moment upstream ships, and a freshly built image that
@@ -38,7 +38,8 @@ npm_latest() {
 
 latest_version() {
   if [ "$1" = github-t3 ]; then
-    node --input-type=module -e 'import { packageRelease } from "./docker/runtime/releases.mjs"; console.log((await packageRelease("stable")).version);'
+    curl -fsS --max-time 30 https://api.github.com/repos/pingdotgg/t3code/releases/latest \
+      | python3 -c 'import sys,json,re; tag=json.load(sys.stdin)["tag_name"]; re.fullmatch(r"v[0-9]+\.[0-9]+\.[0-9]+", tag) or sys.exit("Expected a stable T3 release tag"); print(tag[1:])'
   else
     npm_latest "$1"
   fi
diff --git a/tests/t3-releases.test.mjs b/tests/t3-releases.test.mjs
index e0f03b9..c332f32 100644
--- a/tests/t3-releases.test.mjs
+++ b/tests/t3-releases.test.mjs
@@ -47,11 +47,11 @@ else if (process.argv[2] === 'auth') {
   const file = path.join(root, "fixture.tar.gz");
   await execute("/usr/bin/tar", ["-czf", file, "-C", root, stem]);
   const bytes = await fs.readFile(file);
-  const release = { version: VERSION, name: "t3-runtime", root: stem, archive: `${stem}.tar.gz`, url: `https://github.com/pingdotgg/t3code/releases/download/v${VERSION}/${stem}.tar.gz`, integrity: `sha256-${createHash("sha256").update(bytes).digest("hex")}` };
+  const release = { version: VERSION, name: "t3-runtime", root: stem, url: `https://github.com/pingdotgg/t3code/releases/download/v${VERSION}/${stem}.tar.gz`, integrity: `sha256-${createHash("sha256").update(bytes).digest("hex")}` };
   const env = { ...process.env, T3CODE_HOME: path.join(root, "home") };
   const bridge = path.join(root, "bridge.js");
   await fs.writeFile(bridge, 'console.log("data-t3-setup-entry");');
-  return { root, release, env, bridge, fetcher: async (url) => new Response(url.endsWith("/SHA256SUMS") ? `${release.integrity.slice(7)}  ${release.archive}\n` : bytes), paths: runtimePaths(env) };
+  return { root, release, env, bridge, fetcher: async (url) => new Response(url.endsWith("/SHA256SUMS") ? `${release.integrity.slice(7)}  ${stem}.tar.gz\n` : bytes), paths: runtimePaths(env) };
 }
 
 test("both architectures resolve public GitHub releases and their exact checksums", async () => {

From fb044cd0739d55450277d11a72e86090e5a68c78 Mon Sep 17 00:00:00 2001
From: Ziyang Zeng <dev@dizy.cc>
Date: Tue, 20 Oct 2026 15:40:59 +0000
Subject: [PATCH 3/4] fix(runtime): preserve disk headroom while staging
 releases

Check capacity before requesting and writing archives, reserve room for the running server, and recheck bounded batches and extraction. Cancel failed downloads, reject inconsistent sizes, and keep existing runtime state intact.

Show release check failures persistently in Setup. Add disk-pressure regressions and responsive browser coverage for rate limits, checksums, escaped diagnostics, and recovery.
---
 docker/runtime/releases.mjs     | 45 +++++++++++++---
 docker/setup/app.js             |  2 +-
 docs/t3code-updates.md          |  5 ++
 scripts/auto-update-ui-audit.js | 19 ++++++-
 tests/t3-releases.test.mjs      | 93 ++++++++++++++++++++++++++++++++-
 5 files changed, 155 insertions(+), 9 deletions(-)

diff --git a/docker/runtime/releases.mjs b/docker/runtime/releases.mjs
index 2dc27d3..c48f10e 100644
--- a/docker/runtime/releases.mjs
+++ b/docker/runtime/releases.mjs
@@ -11,6 +11,8 @@ const API = "https://api.github.com/repos/pingdotgg/t3code/releases";
 const DOWNLOAD = "https://github.com/pingdotgg/t3code/releases/download";
 const LIMIT = 300 * 1024 * 1024;
 const UNPACKED_LIMIT = 1024 * 1024 * 1024;
+const HEADROOM = 64 * 1024 * 1024;
+const SPACE_CHECK_BYTES = 8 * 1024 * 1024;
 const PAGE_SIZE = 20;
 const downloadHosts = new Set(["github.com", "release-assets.githubusercontent.com", "objects.githubusercontent.com"]);
 export const executableVersion = (output) => /^(?:t3\s+)?v?(\d+\.\d+\.\d+(?:-nightly\.\d{8}\.\d+)?)$/i.exec(String(output).trim())?.[1] ?? null;
@@ -109,32 +111,63 @@ export function validateArchive(names, types, root) {
   return unpacked;
 }
 
+const spaceError = () => new Error("There is not enough free space to stage this T3 Code release. Free up storage and try again.");
+async function writableSpace(directory, required) {
+  const space = await fs.statfs(directory);
+  const available = Number(space.bavail) * Number(space.bsize) - HEADROOM;
+  if (available < required) throw spaceError();
+  return available;
+}
+
 export async function unpackRelease(stage, release, { fetcher = fetch, run = execute } = {}) {
   if (!["x64", "arm64"].some((arch) => archiveStem(release.version, arch) === release.root)
     || release.url !== `${DOWNLOAD}/v${release.version}/${release.root}.tar.gz`
     || !/^sha256-[a-f0-9]{64}$/.test(release.integrity)) throw new Error("Invalid release download or checksum information.");
   const archive = path.join(stage, "download.tgz");
   const destination = path.join(stage, "contents");
+  // Refuse a full volume before requesting the archive. Once headers arrive,
+  // admit its actual size (or the download limit when no length is supplied).
+  await writableSpace(stage, 1);
   const response = await get(release.url, { fetcher, timeout: 180_000 });
   const hash = createHash("sha256");
   let bytes = 0;
-  const file = await fs.open(archive, "wx", 0o600);
+  let file;
   try {
+    const header = response.headers.get("content-length");
+    const length = /^\d+$/.test(header ?? "") && Number.isSafeInteger(Number(header)) ? Number(header) : null;
+    if (length !== null && length > LIMIT) throw new Error("The release download exceeded the supported size.");
+    let writable = await writableSpace(stage, length ?? LIMIT);
+    let checkedAt = 0;
+    file = await fs.open(archive, "wx", 0o600);
     for await (const chunk of response.body) {
-      bytes += chunk.length;
-      if (bytes > LIMIT) throw new Error("The release download exceeded the supported size.");
+      if (bytes + chunk.length > LIMIT) throw new Error("The release download exceeded the supported size.");
+      if (length !== null && bytes + chunk.length > length) throw new Error("T3 Code's download did not match its declared size.");
+      // Other processes keep using this volume while T3 runs. Recheck in
+      // bounded batches, and before a chunk could consume the reserved space.
+      if (bytes + chunk.length - checkedAt >= SPACE_CHECK_BYTES || chunk.length > writable) {
+        writable = await writableSpace(stage, length === null ? chunk.length : length - bytes);
+        checkedAt = bytes;
+      }
+      writable -= chunk.length;
       hash.update(chunk);
       await file.writeFile(chunk);
+      bytes += chunk.length;
     }
+    if (length !== null && bytes !== length) throw new Error("T3 Code's download did not match its declared size.");
     await file.sync();
-  } finally { await file.close(); }
+  } catch (error) {
+    if (error.code === "ENOSPC" || error.code === "EDQUOT") throw spaceError();
+    throw error;
+  } finally {
+    try { await file?.close(); }
+    finally { await response.body?.cancel().catch(() => {}); }
+  }
   if (!timingSafeEqual(hash.digest(), Buffer.from(release.integrity.slice(7), "hex"))) throw new Error("T3 Code's download failed its integrity check. The running version was kept.");
   const options = { timeout: 60_000, maxBuffer: 8 * 1024 * 1024, env: { ...process.env, LC_ALL: "C" } };
   const names = await run("/usr/bin/tar", ["-tzf", archive], options);
   const types = await run("/usr/bin/tar", ["-tvzf", archive], options);
   const unpacked = validateArchive(names.stdout, types.stdout, release.root);
-  const space = await fs.statfs(stage);
-  if (Number(space.bavail) * Number(space.bsize) < unpacked + 64 * 1024 * 1024) throw new Error("There is not enough free space to stage this T3 Code release.");
+  await writableSpace(stage, unpacked);
   await fs.mkdir(destination, { mode: 0o700 });
   await run("/usr/bin/tar", ["-xzf", archive, "--no-same-owner", "--no-same-permissions", "--strip-components=1", "-C", destination], options);
   const pkg = await readJson(path.join(destination, "package.json"));
diff --git a/docker/setup/app.js b/docker/setup/app.js
index 0dced3e..d0876c7 100644
--- a/docker/setup/app.js
+++ b/docker/setup/app.js
@@ -1473,7 +1473,7 @@
       </div>
       ${view.error || view.checkError ? html`<div class="tc-runtime-notes">
         ${view.error ? notice('danger', 'circle-alert', 'The last T3 Code update didn’t finish', view.error) : ''}
-        ${view.checkError ? notice('warn', 'globe', 'Couldn’t check for T3 Code updates', 'The last known releases are shown. Check again once the registry is reachable.') : ''}
+        ${view.checkError ? notice('warn', 'globe', 'Couldn’t check for T3 Code updates', view.checkError + ' The last known releases are shown.') : ''}
       </div>` : ''}
       ${!view.supported || view.separateHistory ? html`<div class="tc-card-foot">${icon('info', 'tc-icon--sm')}<span>${!view.supported
         ? 'Updating in place needs the container’s T3 Code supervisor. Pull a newer image once to turn it on.'
diff --git a/docs/t3code-updates.md b/docs/t3code-updates.md
index c8f06a4..9ab4dd0 100644
--- a/docs/t3code-updates.md
+++ b/docs/t3code-updates.md
@@ -53,6 +53,11 @@ checks retain the previous release information and its successful check time.
 Nightly discovery searches up to 100 recent releases, skipping preview and draft
 builds; it reports an error if no nightly can be found within that bound.
 
+Staging checks free space before downloading and extracting, reserving
+64 MiB of headroom for the running server. Downloads without a declared size
+need room for the 300 MiB download limit as well. Space is checked again during
+the download so other activity on the volume can stop staging safely.
+
 After a successful update, obsolete cached releases are removed. The active
 release, its predecessor and the latest known target for each channel are kept.
 
diff --git a/scripts/auto-update-ui-audit.js b/scripts/auto-update-ui-audit.js
index 8f13297..477ecd8 100644
--- a/scripts/auto-update-ui-audit.js
+++ b/scripts/auto-update-ui-audit.js
@@ -71,7 +71,7 @@ const geometry = () => {
       let holdStatus = null;
       const runtime = { ...fixture.t3?.runtime, channel: 'stable', version: '0.1.0',
         releases: { stable: { version: '0.1.0' }, nightly: { version: '0.1.1-nightly.20261017.1' } }, checkedAt: 1, checking: false,
-        checkError: 'registry offline', operation: null, supported: true };
+        checkError: "GitHub's release API rate limit was reached. Try checking again later; the running version was kept.", operation: null, supported: true };
 
       let requestedChannel;
       await host.route('**/*', async (route) => {
@@ -317,6 +317,22 @@ const geometry = () => {
       const card = page.getByRole('region', { name: 'T3 Code', exact: true });
       await card.getByText('Couldn’t check for T3 Code updates', { exact: true }).waitFor();
       assert.equal(await card.getByText('Up to date', { exact: true }).count(), 0);
+      // Background checks have no toast. Their reason must remain visible
+      // after ordinary polls, with remote text escaped and long names wrapped.
+      for (const [name, error] of [
+        ['rate-limit', runtime.checkError],
+        ['checksum', 'The release must list exactly one SHA-256 checksum for t3-0.1.1-nightly.20261019.3373-linux-arm64.tar.gz.'],
+        ['metadata', 'GitHub returned invalid metadata: <script>unsafe</script>'],
+      ]) {
+        runtime.checkError = error;
+        await refreshStatus();
+        await card.getByText(error + ' The last known releases are shown.', { exact: true }).waitFor();
+        assert.equal(await card.locator('script').count(), 0, 'release errors are rendered as text');
+        await refreshStatus();
+        assert.equal(await card.getByText(error + ' The last known releases are shown.', { exact: true }).count(), 1, 'polling keeps the reason available');
+        await check(`release ${name} failure`);
+        await host.screenshot({ path: path.join(output, `${tag}-release-${name}.png`) });
+      }
       await check('selected channel failure');
       await host.screenshot({ path: path.join(output, `${tag}-check-failed.png`) });
       await card.getByRole('button', { name: 'Nightly', exact: true }).click();
@@ -337,6 +353,7 @@ const geometry = () => {
       };
       await control().click();
       await card.getByText('Stable update available', { exact: true }).waitFor();
+      assert.equal(await card.locator('.tc-runtime-notes').count(), 0, 'a successful check clears the persistent warning');
       assert.equal(await card.getByRole('button', { name: 'Update and restart', exact: true }).count(), 1);
       await check('recovered update');
       await finishCheck();
diff --git a/tests/t3-releases.test.mjs b/tests/t3-releases.test.mjs
index c332f32..aff514d 100644
--- a/tests/t3-releases.test.mjs
+++ b/tests/t3-releases.test.mjs
@@ -51,9 +51,100 @@ else if (process.argv[2] === 'auth') {
   const env = { ...process.env, T3CODE_HOME: path.join(root, "home") };
   const bridge = path.join(root, "bridge.js");
   await fs.writeFile(bridge, 'console.log("data-t3-setup-entry");');
-  return { root, release, env, bridge, fetcher: async (url) => new Response(url.endsWith("/SHA256SUMS") ? `${release.integrity.slice(7)}  ${stem}.tar.gz\n` : bytes), paths: runtimePaths(env) };
+  return { root, release, env, bridge, bytes, fetcher: async (url) => new Response(url.endsWith("/SHA256SUMS") ? `${release.integrity.slice(7)}  ${stem}.tar.gz\n` : bytes), paths: runtimePaths(env) };
 }
 
+const MiB = 1024 * 1024;
+const space = (available) => ({ bavail: available, bsize: 1 });
+
+test("a full state volume refuses staging before requesting an archive and keeps live state", async (t) => {
+  const f = await fixture(t);
+  const selection = { schema: 1, channel: "stable", version: null };
+  await writeJson(f.paths.selection, selection);
+  await fs.mkdir(path.join(f.paths.home, "userdata"), { recursive: true });
+  const live = path.join(f.paths.home, "userdata/state.sqlite");
+  await fs.writeFile(live, "live database");
+  let fetched = false;
+  t.mock.method(fs, "statfs", async () => space(64 * MiB));
+  await assert.rejects(installRelease(f.paths, f.release, { ...f, fetcher: async () => { fetched = true; } }), /free space.*Free up storage/);
+  assert.equal(fetched, false);
+  assert.deepEqual(await fs.readdir(f.paths.versions), []);
+  assert.deepEqual(await readJson(f.paths.selection), selection);
+  assert.equal(await fs.readFile(live, "utf8"), "live database");
+});
+
+test("a known archive size admits a small release without requiring the whole download limit", async (t) => {
+  const f = await fixture(t);
+  t.mock.method(fs, "statfs", async () => space(65 * MiB));
+  const staged = await installRelease(f.paths, f.release, { ...f,
+    fetcher: async () => new Response(f.bytes, { headers: { "content-length": String(f.bytes.length) } }),
+  });
+  assert.equal((await readJson(path.join(staged, ".installed.json"))).version, VERSION);
+});
+
+test("insufficient download space cancels the response without creating an archive", async (t) => {
+  const f = await fixture(t);
+  t.mock.method(fs, "statfs", async () => space(64 * MiB + f.bytes.length - 1));
+  for (const header of [String(f.bytes.length), undefined, "invalid", "-1"]) {
+    const stage = await fs.mkdtemp(path.join(f.root, "stage-"));
+    let cancelled = false;
+    const fetcher = async () => new Response(new ReadableStream({ cancel() { cancelled = true; } }), {
+      headers: header === undefined ? {} : { "content-length": header },
+    });
+    await assert.rejects(unpackRelease(stage, f.release, { fetcher }), /free space/);
+    assert.equal(cancelled, true, `response cancelled for length ${header}`);
+    assert.deepEqual(await fs.readdir(stage), []);
+  }
+});
+
+test("unknown download lengths require space for the bounded download and reserved headroom", async (t) => {
+  const f = await fixture(t);
+  t.mock.method(fs, "statfs", async () => space(364 * MiB));
+  const staged = await installRelease(f.paths, f.release, f);
+  assert.equal((await readJson(path.join(staged, ".installed.json"))).version, VERSION);
+});
+
+test("disk pressure during a stream stops before writing into the server's reserved space", async (t) => {
+  const f = await fixture(t);
+  const stage = await fs.mkdtemp(path.join(f.root, "stage-"));
+  let checks = 0, cancelled = false;
+  t.mock.method(fs, "statfs", async () => space(++checks < 3 ? 512 * MiB : 68 * MiB - 1));
+  const fetcher = async () => new Response(new ReadableStream({
+    pull(controller) { controller.enqueue(Buffer.alloc(4 * MiB)); },
+    cancel() { cancelled = true; },
+  }));
+  await assert.rejects(unpackRelease(stage, f.release, { fetcher }), /free space/);
+  assert.equal((await fs.stat(path.join(stage, "download.tgz"))).size, 4 * MiB);
+  assert.equal(cancelled, true);
+  assert.equal(await readJson(f.paths.selection), null);
+});
+
+test("disk space is checked again before extraction and failed staging is removed", async (t) => {
+  const f = await fixture(t);
+  let checks = 0;
+  const commands = [];
+  t.mock.method(fs, "statfs", async () => space(++checks < 3 ? 512 * MiB : 64 * MiB));
+  await assert.rejects(installRelease(f.paths, f.release, { ...f, run: async (command, args, options) => {
+    commands.push(args[0]);
+    return execute(command, args, options);
+  } }), /free space/);
+  assert.deepEqual(commands, ["-tzf", "-tvzf"], "an admitted download never implies extraction is safe");
+  assert.deepEqual(await fs.readdir(f.paths.versions), []);
+});
+
+test("oversized or misleading content lengths never publish or execute a runtime", async (t) => {
+  const f = await fixture(t);
+  for (const length of [301 * MiB, f.bytes.length - 1, f.bytes.length + 1]) {
+    let executed = false;
+    await assert.rejects(installRelease(f.paths, f.release, { ...f,
+      fetcher: async () => new Response(f.bytes, { headers: { "content-length": String(length) } }),
+      run: async () => { executed = true; },
+    }), /supported size|declared size/);
+    assert.equal(executed, false);
+    assert.deepEqual(await fs.readdir(f.paths.versions), []);
+  }
+});
+
 test("both architectures resolve public GitHub releases and their exact checksums", async () => {
   for (const arch of ["x64", "arm64"]) for (const channel of ["stable", "nightly"]) {
     const release = await packageRelease(channel, { fetcher: source, arch });

From fad17f6e338d15727dd42e29e298976b5dfd0c1d Mon Sep 17 00:00:00 2001
From: Ziyang Zeng <dev@dizy.cc>
Date: Tue, 20 Oct 2026 16:04:03 +0000
Subject: [PATCH 4/4] fix(ci): authenticate and diagnose release pin lookups

Use the existing CI token only for GitHub API requests, pass it through stdin instead of command arguments, and retry bounded transient metadata failures. Keep registry lookups unauthenticated and real version drift blocking.

Retain pin-check output in smoke diagnostics. Add regressions for token isolation, public lookups, unavailable metadata and stale or invalid releases.
---
 scripts/bump-versions.sh    | 17 ++++++--
 scripts/smoke-test.sh       | 12 +++---
 tests/version-pins.test.mjs | 84 +++++++++++++++++++++++++++++++++++++
 3 files changed, 105 insertions(+), 8 deletions(-)
 create mode 100644 tests/version-pins.test.mjs

diff --git a/scripts/bump-versions.sh b/scripts/bump-versions.sh
index 29014ab..f5df3f8 100755
--- a/scripts/bump-versions.sh
+++ b/scripts/bump-versions.sh
@@ -32,13 +32,24 @@ PLAYWRIGHT_MCP_VERSION:@playwright/mcp
 "
 
 npm_latest() {
-  curl -fsS --max-time 30 "https://registry.npmjs.org/$1/latest" \
+  curl -fsS --connect-timeout 5 --max-time 30 --retry 2 --retry-max-time 20 \
+    "https://registry.npmjs.org/$1/latest" \
     | python3 -c 'import sys,json; print(json.load(sys.stdin)["version"])'
 }
 
+github_latest() {
+  # CI already supplies a token. Keep it out of process arguments and send it
+  # only to api.github.com; registry and archive requests remain unauthenticated.
+  local headers=""
+  [ -z "${GITHUB_TOKEN:-}" ] || headers="Authorization: Bearer ${GITHUB_TOKEN}"
+  printf '%s\n' "$headers" | curl -fsS --connect-timeout 5 --max-time 30 \
+    --retry 2 --retry-max-time 20 --header @- \
+    "https://api.github.com/repos/$1/releases/latest"
+}
+
 latest_version() {
   if [ "$1" = github-t3 ]; then
-    curl -fsS --max-time 30 https://api.github.com/repos/pingdotgg/t3code/releases/latest \
+    github_latest pingdotgg/t3code \
       | python3 -c 'import sys,json,re; tag=json.load(sys.stdin)["tag_name"]; re.fullmatch(r"v[0-9]+\.[0-9]+\.[0-9]+", tag) or sys.exit("Expected a stable T3 release tag"); print(tag[1:])'
   else
     npm_latest "$1"
@@ -86,7 +97,7 @@ echo "${DIM}T3 Code's own declared minimum is checked by the smoke test.${RESET}
 # Reported, never counted as drift and never bumped here: a new release also
 # needs its checksums and the idiomatic allowlist regenerated.
 mise_pin="$(grep -m1 '^ARG MISE_VERSION=' Dockerfile | cut -d= -f2)"
-mise_latest="$(curl -fsS --max-time 30 https://api.github.com/repos/jdx/mise/releases/latest 2>/dev/null \
+mise_latest="$(github_latest jdx/mise 2>/dev/null \
   | python3 -c 'import sys,json; print(json.load(sys.stdin)["tag_name"].lstrip("v"))' 2>/dev/null || echo "?")"
 if [ "$mise_pin" = "$mise_latest" ]; then
   printf '%smise%s %s is current\n' "$DIM" "$RESET" "$mise_pin"
diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
index 2f7d03f..51145d5 100755
--- a/scripts/smoke-test.sh
+++ b/scripts/smoke-test.sh
@@ -63,8 +63,8 @@ retry() { local n=$1; shift; local i; for i in $(seq 1 "$n"); do
 STATE_MOUNT=""
 PAGE_HTML=""
 SETUP_COPY=""
-# The layout audit runs with its output discarded, so record it here and print
-# it with the failure summary.
+# Keep verbose check output for the failure summary, including live pin
+# lookups and the layout audits which otherwise have their output discarded.
 UI_AUDIT_LOG="${UI_AUDIT_LOG:-}"
 if [ -z "$UI_AUDIT_LOG" ]; then
   UI_AUDIT_LOG="$(mktemp "${TMPDIR:-/tmp}/t3-ui-audit.XXXXXX")"
@@ -219,8 +219,10 @@ fi
 # A freshly built image that immediately asks you to upgrade an agent is a bug
 # in this repo, not in the agent. The pins are what go stale, so assert they
 # were current when the image was built.
-check "the image's pinned versions were current at build time" \
-  "./scripts/bump-versions.sh --check"
+pinned_versions_current() {
+  "$SCRIPT_DIR/bump-versions.sh" --check >>"$UI_AUDIT_LOG" 2>&1
+}
+check "the image's pinned versions were current at build time" pinned_versions_current
 
 printf '\nPairing\n'
 pair_out="$(docker exec "$NAME" t3-pair --no-qr 2>/dev/null || true)"
@@ -1669,7 +1671,7 @@ docker rm -f "${NAME}-boot" >/dev/null 2>&1 || true
 
 printf '\n%d passed, %d failed\n\n' "$pass" "$fail"
 if [ "$fail" -gt 0 ] && [ -s "$UI_AUDIT_LOG" ]; then
-  printf 'Browser/native skill audit output:\n'
+  printf 'Smoke test diagnostics:\n'
   sed 's/^/  /' "$UI_AUDIT_LOG"
   printf '\n'
 fi
diff --git a/tests/version-pins.test.mjs b/tests/version-pins.test.mjs
new file mode 100644
index 0000000..67837fd
--- /dev/null
+++ b/tests/version-pins.test.mjs
@@ -0,0 +1,84 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import test from "node:test";
+
+const execute = promisify(execFile);
+const TOKEN = "pin-check-test-token";
+
+async function fixture(t, extra = {}) {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "t3-pin-test-"));
+  t.after(() => fs.rm(root, { recursive: true, force: true }));
+  await fs.mkdir(path.join(root, "scripts"));
+  await fs.mkdir(path.join(root, "bin"));
+  await fs.copyFile(new URL("../scripts/bump-versions.sh", import.meta.url), path.join(root, "scripts/bump-versions.sh"));
+  const dockerfile = "ARG T3_VERSION=0.1.0\nARG CHROME_DEVTOOLS_MCP_VERSION=1.0.0\nARG PLAYWRIGHT_MCP_VERSION=1.0.0\nARG GH_MIN_VERSION=2.81.0\nARG MISE_VERSION=2026.9.10\n";
+  await fs.writeFile(path.join(root, "Dockerfile"), dockerfile);
+  await fs.writeFile(path.join(root, "bin/curl"), `#!/usr/bin/env python3
+import json, os, sys
+args = sys.argv[1:]
+url = next(arg for arg in args if arg.startswith("https://"))
+headers = sys.stdin.read() if "@-" in args else ""
+with open(os.environ["PIN_REQUESTS"], "a") as log:
+    log.write(json.dumps({"url": url, "args": args, "headers": headers}) + "\\n")
+if os.environ.get("PIN_OFFLINE") and "pingdotgg/t3code" in url:
+    print("curl: (22) The requested URL returned error: 503", file=sys.stderr)
+    sys.exit(22)
+if "pingdotgg/t3code" in url:
+    print(json.dumps({"tag_name": os.environ.get("PIN_T3_TAG", "v0.1.0")}))
+elif "jdx/mise" in url:
+    print(json.dumps({"tag_name": "v2026.9.10"}))
+else:
+    print(json.dumps({"version": "1.0.0"}))
+`, { mode: 0o755 });
+  const env = { ...process.env, PATH: `${path.join(root, "bin")}:${process.env.PATH}`, GITHUB_TOKEN: TOKEN, PIN_REQUESTS: path.join(root, "requests.jsonl"), ...extra };
+  const run = () => execute("bash", [path.join(root, "scripts/bump-versions.sh"), "--check"], { env, timeout: 5000 });
+  const requests = async () => (await fs.readFile(env.PIN_REQUESTS, "utf8")).trim().split("\n").map(JSON.parse);
+  return { root, run, requests, dockerfile };
+}
+
+test("pin checks authenticate only GitHub metadata and keep tokens out of arguments and output", async (t) => {
+  const f = await fixture(t);
+  const result = await f.run();
+  assert.match(result.stdout, /every pin is current/);
+  assert.equal((result.stdout + result.stderr).includes(TOKEN), false);
+  const requests = await f.requests();
+  assert.equal(requests.length, 4);
+  for (const request of requests) {
+    assert.equal(request.args.some((arg) => arg.includes(TOKEN)), false);
+    assert.equal(request.headers.trim(), request.url.startsWith("https://api.github.com/") ? `Authorization: Bearer ${TOKEN}` : "");
+  }
+});
+
+test("public pin checks also work without a GitHub token", async (t) => {
+  const f = await fixture(t, { GITHUB_TOKEN: "" });
+  assert.match((await f.run()).stdout, /every pin is current/);
+  assert.equal((await f.requests()).every((request) => !request.headers.trim()), true);
+});
+
+test("failed release lookups fail closed and preserve useful diagnostics", async (t) => {
+  const f = await fixture(t, { PIN_OFFLINE: "1" });
+  await assert.rejects(f.run(), (error) => {
+    assert.equal(error.code, 1);
+    assert.match(error.stderr, /HTTP|503/);
+    assert.match(error.stderr, /could not check published releases for github-t3/);
+    assert.equal((error.stdout + error.stderr).includes(TOKEN), false);
+    return true;
+  });
+  assert.equal(await fs.readFile(path.join(f.root, "Dockerfile"), "utf8"), f.dockerfile);
+});
+
+test("a newer or invalid upstream version still blocks the pin check without editing the image", async (t) => {
+  for (const tag of ["v0.1.1", "v0.1.1-preview.1"]) {
+    const f = await fixture(t, { PIN_T3_TAG: tag });
+    await assert.rejects(f.run(), (error) => {
+      assert.equal(error.code, 1);
+      assert.match(error.stdout + error.stderr, tag === "v0.1.1" ? /pin\(s\) behind/ : /Expected a stable T3 release tag/);
+      return true;
+    });
+    assert.equal(await fs.readFile(path.join(f.root, "Dockerfile"), "utf8"), f.dockerfile);
+  }
+});