feat: implement java-tron-up runtime installer

[ulissesferreira]

Summary

This PR stacks on #9207 (scaffold PR) and contains the real java-tron-up runtime installer implementation.

It replaces the scaffold template files with:

• src/install.ts — core java-tron download, extraction, and installation logic
• src/bin/java-tron-up.ts — CLI entrypoint (wired via bin field in package.json)
• src/index.ts — updated public exports
• src/install.test.ts — test suite for the installer
• README.md — full usage documentation
• CHANGELOG.md — initial changelog entry
• knip.config.ts — ignores the sysctl system binary (not an npm package)

Together with #9207, this PR replaces #8825. PR #8825 should not be merged.

Verification

The following checks were run and passed:

• yarn workspace @metamask/java-tron-up run build ✅
• yarn workspace @metamask/java-tron-up run test ✅
• yarn eslint packages/java-tron-up ✅
• yarn constraints ✅
• yarn workspace @metamask/java-tron-up run changelog:validate ✅
• yarn dedupe --check ✅

Changeset vs scaffold branch

Only these paths differ from the scaffold base:

• packages/java-tron-up/ — real implementation (replaces template)
• knip.config.ts — added ignoreBinaries: ['sysctl'] entry for this package
• yarn.lock — minor update

---

Note

Low Risk
New dev/E2E tooling with checksum-verified downloads and tests; no changes to wallet controllers or production runtime paths.

Overview
Replaces the @metamask/java-tron-up scaffold with a runtime-only installer modeled on @metamask/foundryup: it does not start or seed a TRON node; consumers own process startup and network setup.

Core behavior: install.ts pins GreatVoyage-v4.8.1 FullNode.jar and platform-matched Azul Zulu Java (JDK 8 on x64, JDK 17 on arm64), downloads via HTTP(S) with redirect handling, verifies SHA-256 checksums, caches under .metamask/cache (or ~/.cache/metamask when Yarn global cache is enabled), and writes a node_modules/.bin/java-tron Node wrapper that runs java -jar FullNode.jar. Options can be overridden from CLI flags or root package.json (javaTronUp / aliases). java-tron-up cache clean removes only the java-tron-up cache namespace.

Surface area: New CLI at src/bin/java-tron-up.ts wired through package.json bin; public API exports from index.ts; install.test.ts covers caching, config parsing, symlink replacement, and cache isolation. README documents usage for Extension E2E; knip ignores the sysctl system binary used for Rosetta detection on darwin-x64. Jest coverage thresholds are relaxed and the CLI entry is excluded from coverage.

^{Reviewed by Cursor Bugbot for commit f125d72. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6c4f407. Configure here.}

[cursor]

Package config skips defaults

Medium Severity

When package.json supplies a partial fullNode or javaRuntime block (for example only linux-x64, as documented in the README), installJavaTron uses that object instead of the pinned defaults. Install then fails on other platforms with “not configured” even though defaults define those platforms.

 

^{Reviewed by Cursor Bugbot for commit 6c4f407. Configure here.}

[cursor]

Cached Java never verified

Medium Severity

On a Java runtime cache hit, installJavaRuntime returns the cached bin/java path immediately. Cached FullNode.jar is always checksum-verified on reuse, but the extracted JDK/JRE tree is not, so corrupted or tampered cache contents can be used without detection.

Additional Locations (1)

• packages/java-tron-up/src/install.ts#L411-L418

 

^{Reviewed by Cursor Bugbot for commit 6c4f407. Configure here.}