Export an authenticated capture and environment manifest as a pinned agentenv bundle with provenance, a replay verifier and smoke task.
Followups preserve immutable input ownership, bounded discovery, caller paths and numeric values; bind bundle writes and package copying to retained filesystem owners; verify POSIX modes; retain cleanup authority; and verify framework/npm executable selection. Default MCP remains stdio.
Validation: pinned Linux toolchain, typecheck/build/lint/format/docs/knip, 452 focused tests, ten product-catalog cases, real GitHub response replay in the generated non-root Docker image, and the real pinned agentenv framework smoke workflow. Platform and resource-measurement limits are recorded in the feature verification document.
Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Windows ships two tar implementations. `C:\Windows\System32\tar.exe` (bsdtar)
terminates every listed member with CRLF, so `verify-package-pack.mjs`
splitting the listing on a bare "\n" left a trailing "\r" on each non-final
member. `verifyPackedBridge` compares member identities exactly, so it reported
`package omitted package/bridge/hopper_bridge.py` although the tarball ships
that member (#4128).
`parseTarListing` normalizes line endings once, at the listing owner, and
preserves every member string beyond its line ending. `verifyPackagePack` is
the only tar listing producer in the package verifiers, so its consumers now
compare bare member names; the prefix checks in the same file keep their
behavior because they never matched a line ending.
Covered by `tests/conformance/package/packedTarListing.test.ts`: CRLF and LF
listings both yield exact bridge identities, the trailing line ending no longer
produces an empty member, member strings keep embedded spaces, and a regression
guard pins the previous parse's failure.
Real Windows 11 evidence (`package/bridge/hopper_bridge.py` in the listing):
| tar | listing | split("\n") | parseTarListing |
| ---------------------------------- | ------- | ----------- | --------------- |
| Git for Windows GNU tar | LF | true | true |
| C:\Windows\System32\tar.exe | CRLF | false | true |
Fixes#4128
Co-authored-by: Chow Kim <catch@126.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
