feat(install): bundle musl runtime for portable install on old-glibc Linux

x64 musl archives now carry the musl loader + libstdc++/libgcc_s under
bin/lib/. setup.sh detects an old-glibc host (musl loader absent) and
installs the real binary under libexec, rewrites its ELF interpreter
in place (offset-guarded, no file growth so bun's appended payload stays
intact) to a per-user loader path, and drops a wrapper on PATH that sets
LD_LIBRARY_PATH. glibc/arm64/Alpine installs are unchanged. Adds an
install-time smoke test that surfaces missing-AVX2 CPUs early.

Author: suibianwanwan

packages/opencode/script/build.ts

@@ -316,6 +316,25 @@ if (fs.existsSync(allSkillsSrc)) {
   console.log(`Bundled ${skillEntries.length} skills into all platform dists`)
 }
 
+// Bundle the musl runtime (loader + libstdc++/libgcc_s) into x64 musl dists so
+// the archive can self-install on old-glibc Linux (e.g. CentOS/RHEL 7) with no
+// root and no network: setup.sh points the ELF interpreter at a per-user copy
+// of the loader and serves the rest via LD_LIBRARY_PATH. Only x64 musl targets
+// carry these libs; glibc/arm64/Alpine installs are untouched.
+const muslRuntimeSrc = path.join(__dirname, "musl-runtime", "x64")
+if (fs.existsSync(muslRuntimeSrc)) {
+  for (const key of Object.keys(binaries)) {
+    const target = findTarget(key)
+    if (!target || target.os !== "linux" || target.arch !== "x64" || target.abi !== "musl") continue
+    const destLib = path.join("dist", key, "bin", "lib")
+    fs.mkdirSync(destLib, { recursive: true })
+    for (const f of fs.readdirSync(muslRuntimeSrc)) {
+      fs.copyFileSync(path.join(muslRuntimeSrc, f), path.join(destLib, f))
+    }
+    console.log(`Bundled musl runtime into ${key}/bin/lib`)
+  }
+}
+
 if (Script.archive) {
   const setupSh = path.join(dir, "..", "..", "scripts", "setup.sh")
   const keys = Object.keys(binaries)

packages/opencode/script/musl-runtime/x64/ld-musl-x86_64.so.1

@@ -21,16 +21,87 @@ if [ ! -f "$SOURCE_BINARY" ]; then
 fi
 
 mkdir -p "$INSTALL_DIR" "$METADATA_DIR"
-cp "$SOURCE_BINARY" "$TARGET_BINARY"
-chmod +x "$TARGET_BINARY"
 
-case "$(uname -s)" in
-  Darwin)
-    xattr -dr com.apple.quarantine "$TARGET_BINARY" 2>/dev/null || true
-    codesign --force --sign - "$TARGET_BINARY" 2>/dev/null || true
-    codesign -v --verbose=4 "$TARGET_BINARY" 2>/dev/null || true
-    ;;
-esac
+# Portable musl install: when this archive carries the musl runtime (bin/lib/)
+# AND the system lacks the musl loader (old-glibc distros like CentOS/RHEL 7),
+# install the real binary under libexec, point its ELF interpreter at a per-user
+# loader via an in-place edit (no file growth -> bun's appended payload stays
+# intact), and put a small wrapper on PATH. On Alpine the loader already exists,
+# so we fall through to the plain copy below.
+MUSL_LOADER_SRC="${SCRIPT_DIR}/lib/ld-musl-x86_64.so.1"
+if [ -f "$MUSL_LOADER_SRC" ] && [ ! -e "/lib/ld-musl-x86_64.so.1" ]; then
+  LIBEXEC="$(dirname "$INSTALL_DIR")/libexec/cz-cli"
+  mkdir -p "$LIBEXEC"
+  cp -f "$SOURCE_BINARY" "$LIBEXEC/cz-cli.real"
+  chmod +x "$LIBEXEC/cz-cli.real"
+  rm -rf "$LIBEXEC/lib"; cp -rf "${SCRIPT_DIR}/lib" "$LIBEXEC/lib"
+
+  OLD="/lib/ld-musl-x86_64.so.1"   # original ELF interpreter, 24 chars
+  INTERP=""
+  for p in "$HOME/.ld.so" "$HOME/.cz-ld.so" "/tmp/ld-musl-x86_64.so.1"; do
+    [ "${#p}" -le 24 ] || continue
+    d=$(dirname "$p"); [ -d "$d" ] && [ -w "$d" ] || continue
+    INTERP="$p"; break
+  done
+  [ -n "$INTERP" ] || { print_error "no writable loader path <=24 chars (\$HOME too long?)"; exit 1; }
+  echo "ELF interpreter -> $INTERP (${#INTERP} chars)"
+
+  # In-place patch .interp. PT_INTERP lives at a build-fixed offset (568) in the
+  # ELF header region; we do NOT scan the whole ~140MB binary. Verify the slot by
+  # reading it back; only on mismatch scan the first 64 KiB (headers live at the
+  # start). Every write is guarded by a read-back so a wrong offset aborts rather
+  # than corrupts.
+  BIN="$LIBEXEC/cz-cli.real"
+  read_slot() { dd if="$BIN" bs=1 skip="$1" count=24 2>/dev/null; }
+  OFF=""
+  if [ "$(read_slot 568)" = "$OLD" ]; then
+    OFF=568
+  else
+    HEAD=$(mktemp)
+    dd if="$BIN" bs=4096 count=16 of="$HEAD" 2>/dev/null   # first 64 KiB only
+    M=$(grep -aboF -- "$OLD" "$HEAD" 2>/dev/null || true); OFF=${M%%:*}
+    rm -f "$HEAD"
+  fi
+  case "$OFF" in
+    ''|*[!0-9]*) print_error "musl interpreter string not found in binary"; exit 1 ;;
+  esac
+  [ "$(read_slot "$OFF")" = "$OLD" ] || { print_error "unexpected bytes at interp offset $OFF"; exit 1; }
+  dd if=/dev/zero of="$BIN" bs=1 seek="$OFF" count=24 conv=notrunc 2>/dev/null
+  printf '%s' "$INTERP" | dd of="$BIN" bs=1 seek="$OFF" conv=notrunc 2>/dev/null
+  [ "$(read_slot "$OFF" | tr -d '\0')" = "$INTERP" ] || { print_error "interp patch verification failed"; exit 1; }
+
+  # Wrapper on PATH: ensure the loader is present, set the lib path, exec the real
+  # binary. This becomes $TARGET_BINARY so cz-agent and callers work unchanged.
+  cat > "$TARGET_BINARY" <<EOF
+#!/bin/sh
+LIBEXEC="$LIBEXEC"
+INTERP="$INTERP"
+[ -f "\$INTERP" ] || cp -f "\$LIBEXEC/lib/ld-musl-x86_64.so.1" "\$INTERP"
+export LD_LIBRARY_PATH="\$LIBEXEC/lib\${LD_LIBRARY_PATH:+:\$LD_LIBRARY_PATH}"
+exec "\$LIBEXEC/cz-cli.real" "\$@"
+EOF
+  chmod +x "$TARGET_BINARY"
+
+  # Seed the loader now so the first run is clean, then smoke-test. A failure here
+  # is almost always a missing-AVX2 CPU (SIGILL) — surface it at install time.
+  [ -f "$INTERP" ] || cp -f "$LIBEXEC/lib/ld-musl-x86_64.so.1" "$INTERP"
+  if ! "$TARGET_BINARY" --version >/dev/null 2>&1; then
+    print_error "installed binary failed to run (musl portable)."
+    print_error "If this CPU lacks AVX2 (grep -c avx2 /proc/cpuinfo == 0) a baseline build is required."
+    exit 1
+  fi
+else
+  cp "$SOURCE_BINARY" "$TARGET_BINARY"
+  chmod +x "$TARGET_BINARY"
+
+  case "$(uname -s)" in
+    Darwin)
+      xattr -dr com.apple.quarantine "$TARGET_BINARY" 2>/dev/null || true
+      codesign --force --sign - "$TARGET_BINARY" 2>/dev/null || true
+      codesign -v --verbose=4 "$TARGET_BINARY" 2>/dev/null || true
+      ;;
+  esac
+fi
 
 # cz-agent: convenience wrapper for `cz-cli agent` (same dir, already on PATH;
 # works in any shell and in scripts, unlike a shell alias).