From cedb40b02fd20d55eb3072026e2288d19531425d Mon Sep 17 00:00:00 2001
From: ABC <79597906+abcxff@users.noreply.github.com>
Date: Tue, 2 Jun 2026 20:46:04 -0400
Subject: [PATCH] fix: pin ghostty-web SHA in opencode build to preserve
 frozen-lockfile (#1458)

---
 .../opencode/scripts/build-opencode-acp.mjs   | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/registry/agent/opencode/scripts/build-opencode-acp.mjs b/registry/agent/opencode/scripts/build-opencode-acp.mjs
index c631c2879..a60c99f55 100644
--- a/registry/agent/opencode/scripts/build-opencode-acp.mjs
+++ b/registry/agent/opencode/scripts/build-opencode-acp.mjs
@@ -19,6 +19,14 @@ const SOURCE_REPOSITORY = "anomalyco/opencode";
 const SOURCE_VERSION = "1.3.13";
 const SOURCE_TARBALL_URL = `https://github.com/${SOURCE_REPOSITORY}/archive/refs/tags/v${SOURCE_VERSION}.tar.gz`;
 
+// Upstream `packages/app/package.json` pins `ghostty-web: github:anomalyco/ghostty-web#main`,
+// but the bundled bun.lock snapshots the SHA below. Because `main` is a moving ref, a fresh
+// `bun install --frozen-lockfile` resolves to whatever `main` points at *now* and fails the
+// lockfile check. Rewriting the manifest to the lockfile's SHA before install keeps frozen-
+// lockfile guarantees intact (i.e. CI still breaks loudly if either side drifts) without
+// trusting arbitrary new HEADs on the ghostty-web branch.
+const GHOSTTY_WEB_PINNED_SHA = "4af877d";
+
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const packageDir = resolve(__dirname, "..");
 const distDir = resolve(packageDir, "dist");
@@ -47,6 +55,20 @@ function run(command, args, options = {}) {
 	return result;
 }
 
+function pinGhosttyWebRef(sourceRoot) {
+	const manifestPath = resolve(sourceRoot, "packages", "app", "package.json");
+	const raw = readFileSync(manifestPath, "utf-8");
+	const movingRef = '"ghostty-web": "github:anomalyco/ghostty-web#main"';
+	const pinnedRef = `"ghostty-web": "github:anomalyco/ghostty-web#${GHOSTTY_WEB_PINNED_SHA}"`;
+	if (raw.includes(pinnedRef)) return;
+	if (!raw.includes(movingRef)) {
+		throw new Error(
+			`Expected ghostty-web ref ${movingRef} in ${manifestPath}; upstream layout changed — re-audit GHOSTTY_WEB_PINNED_SHA before updating.`,
+		);
+	}
+	writeFileSync(manifestPath, raw.replace(movingRef, pinnedRef));
+}
+
 const PATCHED_SOURCE_FILES = [
 	"packages/opencode/src/cli/cmd/acp.ts",
 	"packages/opencode/src/config/config.ts",
@@ -3550,6 +3572,7 @@ async function main() {
 		}
 
 		run("tar", ["-xzf", tarballPath, "--strip-components=1", "-C", sourceRoot]);
+		pinGhosttyWebRef(sourceRoot);
 		run(bunBin, ["install", "--frozen-lockfile"], { cwd: sourceRoot });
 		await ensureNodeAcpPatch(sourceRoot, tarballPath);
 		await applyNodeAcpRuntimeTweaks(sourceRoot);