Restrict launches to prepared runtime images

src/lib/server/provisioning/native.ts

@@ -9,7 +9,7 @@ import { ensureHostSchema } from '../hosts/schema.js';
 import { unsettledCancelledCommand } from './cancellation.js';
 import { config, relDestForKind, serverDir } from '../config.js';
 import { nativeInstance, nativeRequest, unplacedNativeCreation, type NativeInstance } from '../backends/native.js';
-import { getHost, getHostOperationStatus, queueHostOperation, queueHostOperationSerialized, releaseHostPorts, reserveHostPort } from '../hosts/index.js';
+import { getHost, listHosts, getHostOperationStatus, queueHostOperation, queueHostOperationSerialized, releaseHostPorts, reserveHostPort } from '../hosts/index.js';
 import { newestReadyLibraryId, assertReadyLibrary } from '../game-files/index.js';
 import { blueprintRecipe, captureRecipePlan, recipeForDeployment, recipeStorage, summarizeRecipe, type LaunchRecipePlan } from '../fleet/launch-recipes.js';
 import { prepareNativeLaunch, evaluateNativePlacement, type PreparedNativeLaunch } from './launch-preparation.js';
@@ -55,6 +55,14 @@ export function nativeLaunchSelection(input: Record<string, unknown>, game: stri
         if (!host) throw new Error('The selected host was not found.');
         if (host.decommission) throw new Error('The selected host is being removed. Choose another host.');
     }
+    // Only the controller-configured default may be prepared automatically.
+    // Custom runtimes must already be present in trusted host inventory; a
+    // launch request must never authorize a registry download.
+    if (image !== config.defaultRuntimeImage && !listHosts().some(host =>
+        !host.decommission && (automatic ? host.mode === 'active' : host.id === input.hostId)
+        && host.inventory.runtimeImages?.includes(image))) {
+        throw new Error('Custom runtime images must be prepared by an admin from the host page before launching.');
+    }
     const rawNetwork = input.automatic === true ? input.network ?? {} : input;
     if (!rawNetwork || typeof rawNetwork !== 'object' || Array.isArray(rawNetwork)) throw new Error('Invalid network overrides.');
     const network = rawNetwork as NativeSelection;