fix(opencode): honor exact Corepack pnpm specs

[seonghobae]

Summary

• replace the duplicated hard-coded pnpm tarball bootstrap with the Node 24 bundled Corepack implementation
• fetch the exact trusted base package-manager spec during the review image build
• execute install, test, coverage, Tauri, and frontend build commands through Corepack while preserving the networkless unprivileged runtime
• document the incident, trust boundary, standards basis, and buyer impact

Root cause

LineageWeave PRs #405 and #387 declare an exact Corepack-compatible packageManager value with an integrity suffix. The trusted materializer accepted that value, but the OpenCode image admitted only one hard-coded pnpm version and rejected the already-validated exact spec before repository tests could start.

The central workflow reuses the native Corepack implementation already bundled with the pinned Node runtime. It prepares the exact materialized spec in the trusted image layer, keeps the cache root-owned and read-only at runtime, and invokes pnpm through Corepack. No second package-manager source or floating version is introduced.

Exact-head verification

• head: 46c061095b0569d86303408610e238298d196351
• merged protected base: 9fd60f2c8c33f11a030fe7528adb1e686a993fb1
• Linux amd64 production-image reproduction with Node 24.18.0: exact LineageWeave pnpm 9.15.9 plus integrity spec fetched 244 locked packages and ran as uid 65532
• central suite: 1,371 passed, 1 skipped
• statement and branch coverage: 100% (8,340 statements / 3,214 branches)
• docstring coverage: 100%
• focused Corepack plus reconciled-base contracts: 75 passed
• complete Strix shell regression suite: PASS
• actionlint schema for the changed workflow, compileall, CodeGraph sync, and diff hygiene: passed
• prior review threads are resolved; the exact head requires fresh independent review

Standards and security

The implementation follows the exact package-manager contract documented by Node.js packageManager and the Corepack project. Trusted-spec validation, disabled lifecycle scripts, networkless runtime execution, and the existing PR-head trust boundary remain unchanged.

Detailed APA 7 references and RCA are in docs/doctoring/opencode-exact-pnpm-corepack-runtime.md.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ba4fb6d6-0e81-4706-96c9-35648def5766

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}