@lark-codem/codem-cli 0.1.266-dev.100103549344.0.g63304f4 → 0.1.266-dev.100103550201.0.g346816f

package/bin/codem.js

@@ -145,6 +145,19 @@ function explainWindowsFatalStatus(code) {
   ].join("\n");
 }
 
+// Source/development and npm entrypoints select before invoking business code.
+// The compiled entry has the same guard for managed/direct binary installations.
+if (process.env.CODEM_WORKER_RUNTIME !== undefined) {
+ const { isWorkerRuntimeStartup } = await import("./worker-runtime.js");
+ if (isWorkerRuntimeStartup()) {
+ const bootstrap = await import("../dist/src/worker-runtime-bootstrap.js").catch(() => null);
+ if (bootstrap) {
+  try { process.exitCode = await bootstrap.runWorkerRuntimeBootstrap(); }
+  catch (error) { writeStderrSync(`worker runtime startup failed: ${error.message}`); process.exitCode = 1; }
+  process.exit(process.exitCode ?? 0);
+ }
+ }
+}
 const binaryPath = resolvePlatformBinary();
 
 if (binaryPath) {

package/bin/worker-runtime.js

@@ -0,0 +1,155 @@
+// Startup-only routing. Keep this module independent of Bridge business imports:
+// it is also executed by container entrypoints before either Bridge is loaded.
+import { spawn } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { applyHostedWindowsChildOptions } from './platform-child-process.js';
+
+export const WORKER_HOST_HOME = path.join(os.homedir(), '.codem');
+export const WORKER_RUNTIME_ROOT = path.join(WORKER_HOST_HOME, 'worker-runtimes');
+export const EXACT_RUNTIME_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const families = ['stable', 'current'];
+
+
+async function readJSON(file) { return JSON.parse(await fs.readFile(file, 'utf8')); }
+async function confinedFile(root, relative) {
+ if (typeof relative !== 'string' || !relative || path.isAbsolute(relative)) throw new Error('invalid runtime path');
+ const realRoot = await fs.realpath(root);
+ const resolved = await fs.realpath(path.resolve(realRoot, relative));
+ const inside = path.relative(realRoot, resolved);
+ if (!inside || inside === '..' || inside.startsWith(`..${path.sep}`) || path.isAbsolute(inside)) throw new Error('runtime path escapes pair');
+ if (!(await fs.stat(resolved)).isFile()) throw new Error('runtime entry is not a file');
+ return resolved;
+}
+
+// Only installers write these immutable pair manifests. No npm resolution or
+// floating global/current Core lookup happens in the execution process.
+export async function readWorkerRuntime(root, family, { version = null } = {}) {
+ if (!families.includes(family)) throw new Error('invalid worker runtime');
+ const familyRoot = path.join(root, family);
+ let pointerChannel = null;
+ let runtimeRoot = version ? path.join(familyRoot, 'versions', version) : familyRoot;
+ if (version && !EXACT_RUNTIME_VERSION.test(version)) throw new Error('invalid runtime version');
+ if (!version) try {
+  const pointer = await readJSON(path.join(familyRoot, 'current.json'));
+  if (!EXACT_RUNTIME_VERSION.test(pointer.version)) throw new Error('invalid runtime pointer');
+  pointerChannel = pointer.channel;
+  runtimeRoot = path.join(familyRoot, 'versions', pointer.version);
+ } catch (error) { if (error.code !== 'ENOENT') throw error; }
+ const manifest = await readJSON(path.join(runtimeRoot, 'runtime-manifest.json'));
+ if (manifest.schema !== 1 || manifest.family !== family || !EXACT_RUNTIME_VERSION.test(manifest.cliVersion) || !EXACT_RUNTIME_VERSION.test(manifest.coreVersion)) throw new Error('invalid runtime manifest');
+ if (manifest.workflowPrebound !== (family === 'current')) throw new Error('runtime architecture does not match family');
+ const cliEntry = await confinedFile(runtimeRoot, manifest.cliEntry);
+ const corePath = await confinedFile(runtimeRoot, manifest.coreBinaryPath);
+ return { ...manifest, ...(pointerChannel ? { channel: pointerChannel } : {}), root: runtimeRoot, cliEntry, corePath };
+}
+
+function routeIdentity(env) {
+ const values = [env.CODEM_SANDBOX_TENANT_KEY, env.CODEM_SANDBOX_PROJECT_KEY, env.CODEM_SANDBOX_SESSION_ID];
+ if (values.some(value => typeof value !== 'string' || !value.trim() || value.length > 1024 || /[\0\r\n]/.test(value))) throw new Error('worker runtime requires trusted tenant/project/session');
+ const scope = createHash('sha256').update(JSON.stringify(values)).digest('hex');
+ const sessions = env.LINCO_SESSIONS_ROOT || path.join(os.homedir(), '.codem', 'sessions');
+ if (!path.isAbsolute(sessions)) throw new Error('worker runtime sessions root must be absolute');
+ return { scope, markerPath: path.join(path.dirname(sessions), 'worker-runtime-routes', `${scope}.json`) };
+}
+async function readRoute(markerPath, scope) {
+ try {
+  const marker = await readJSON(markerPath);
+  if (marker.schema !== 1 || marker.scope !== scope || !families.includes(marker.family)) throw new Error('identity or schema mismatch');
+  return marker.family;
+ } catch (error) {
+  if (error.code === 'ENOENT') return null;
+  throw new Error('invalid runtime route', { cause: error });
+ }
+}
+async function recordRoute(markerPath, scope, family) {
+ await fs.mkdir(path.dirname(markerPath), { recursive: true, mode: 0o700 });
+ const temporary = `${markerPath}.${randomUUID()}.tmp`;
+ try {
+  await fs.writeFile(temporary, `${JSON.stringify({ schema: 1, scope, family })}\n`, { mode: 0o600, flag: 'wx' });
+  // No overwrite: concurrent first starts must agree before either starts work.
+  try { await fs.link(temporary, markerPath); } catch (error) { if (error.code !== 'EEXIST') throw error; }
+ } finally { await fs.rm(temporary, { force: true }); }
+ return readRoute(markerPath, scope);
+}
+
+export async function selectWorkerRuntime({ env = process.env, root = env.CODEM_WORKER_RUNTIME_ROOT || WORKER_RUNTIME_ROOT, loadRuntime = readWorkerRuntime, currentChannel = null } = {}) {
+ const requested = env.CODEM_WORKER_RUNTIME;
+ if (!families.includes(requested)) throw new Error('invalid worker runtime');
+ const { scope, markerPath } = routeIdentity(env);
+ let actual = await readRoute(markerPath, scope);
+ const restoring = env.CODEM_TASK_MODE === 'resume';
+ const upgradeFrom = env.CODEM_WORKER_RUNTIME_UPGRADE_FROM;
+ if (upgradeFrom !== undefined && (upgradeFrom !== 'stable' || !restoring || requested !== 'current')) throw new Error('invalid worker runtime upgrade');
+ const upgrading = upgradeFrom === 'stable' && actual === 'stable';
+ // Historical state without proven family cannot safely be assigned to either
+ // architecture. Core remains responsible for validating checkpoint contents.
+ if (!actual && restoring) throw new Error('workflow runtime family unknown: recovery evidence required');
+ const reasons = [];
+ const load = async family => {
+  try {
+   const runtime = await loadRuntime(root, family);
+   // A retained alpha pair can recover its own Session, but cannot serve a new
+   // latest-channel Session after a failed channel switch.
+   if ((!actual || upgrading) && family === 'current' && currentChannel !== null && runtime.channel !== currentChannel) throw new Error('worker runtime channel unavailable');
+   return runtime;
+  } catch { reasons.push(`${family}_unavailable`); return null; }
+ };
+ let runtime = upgrading ? await load('current') : actual ? await load(actual) : await load(requested);
+ if (!actual && !runtime && requested === 'current') runtime = await load('stable');
+ if (!runtime) throw new Error(`${actual ? 'required ' : ''}runtime unavailable: ${reasons.join(',')}`);
+ if (upgrading) {
+  // Only an admitted failed recovery may move stable -> current. Publish after
+  // validating the pair, before any business process starts. Promotion is one-way;
+  // concurrent admitted promotions write identical identity/family bytes.
+  const temporary = `${markerPath}.${randomUUID()}.tmp`;
+  try {
+   await fs.writeFile(temporary, `${JSON.stringify({ schema: 1, scope, family: 'current' })}\n`, { mode: 0o600, flag: 'wx' });
+   await fs.rename(temporary, markerPath);
+  } finally { await fs.rm(temporary, { force: true }); }
+  actual = 'current';
+ }
+ if (!actual) {
+  actual = await recordRoute(markerPath, scope, runtime.family);
+  if (actual !== runtime.family) {
+   runtime = await load(actual);
+   if (!runtime) throw new Error('required runtime unavailable after concurrent selection');
+  }
+ }
+ return { ...runtime, requested, markerPath, fallbackReason: requested !== runtime.family ? reasons.join(',') || 'session_family' : null };
+}
+
+export function launchWorkerRuntime(runtime, { args = process.argv.slice(2), env = process.env, nodePath = process.execPath, invocation = null, log = console.error } = {}) {
+ log(JSON.stringify({ event: 'worker_runtime_selected', requested_family: runtime.requested, actual_family: runtime.family, fallback_reason: runtime.fallbackReason,
+  bridge_version: runtime.cliVersion, core_version: runtime.coreVersion, pair: `${runtime.cliVersion}/${runtime.coreVersion}`, dispatch_id: env.CODEM_SANDBOX_DISPATCH_ID, session_id: env.CODEM_SANDBOX_SESSION_ID }));
+ return new Promise((resolve, reject) => {
+  const launch = invocation || { command: nodePath, args: [runtime.cliEntry, ...args] };
+  const child = spawn(launch.command, launch.args, applyHostedWindowsChildOptions({ ...launch.options, stdio: 'inherit', env: { ...env,
+   CODEM_LINCO_PATH: runtime.corePath, CODEM_WORKER_RUNTIME_READY: '1', CODEM_WORKER_RUNTIME_ACTUAL: runtime.family, CODEM_WORKER_CLI_VERSION: runtime.cliVersion, CODEM_WORKER_CORE_VERSION: runtime.coreVersion,
+   CODEM_PLUGIN_NODE: env.CODEM_PLUGIN_NODE || nodePath,
+   CODEM_SKIP_UPDATE_CHECK: '1', CODEM_DISABLE_DAEMON_AUTO_UPDATE: '1' } }));
+  const signals = ['SIGTERM', 'SIGINT', 'SIGHUP'];
+  const handlers = signals.map(signal => () => { if (child.exitCode === null && child.signalCode === null) { try { child.kill(signal); } catch {} } });
+  signals.forEach((signal, index) => process.on(signal, handlers[index]));
+  const cleanup = () => signals.forEach((signal, index) => process.off(signal, handlers[index]));
+  child.once('error', error => { cleanup(); reject(error); });
+  child.once('exit', (code, signal) => { cleanup(); resolve(code ?? (signal ? 128 + (os.constants.signals[signal] || 1) : 1)); });
+ });
+}
+
+export function isWorkerRuntimeStartup(args = process.argv.slice(2), env = process.env) {
+ return env.CODEM_WORKER_RUNTIME !== undefined && env.CODEM_WORKER_RUNTIME_READY !== '1' && args[0] === 'daemon' && args.some(arg => arg === '--sandbox' || arg.startsWith('--sandbox='));
+}
+
+// Container entrypoints invoke this directly, with a baked immutable root.
+async function runStandalone() {
+ try {
+  const runtime = await selectWorkerRuntime();
+  process.exitCode = await launchWorkerRuntime(runtime, { nodePath: process.execPath });
+ } catch (error) { console.error(`worker runtime startup failed: ${error.message}`); process.exitCode = 1; }
+}
+
+if (typeof Bun === 'undefined' && process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) void runStandalone();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-codem/codem-cli",
-  "version": "0.1.266-dev.100103549344.0.g63304f4",
+  "version": "0.1.266-dev.100103550201.0.g346816f",
   "codemServiceManagementProtocol": 3,
   "codemProfileProtocol": 1,
   "type": "module",
@@ -29,17 +29,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@lark-codem/codem-core": "0.8.80-dev.100103549344.0.ga7d1943",
+    "@lark-codem/codem-core": "0.8.80-dev.100103550201.0.g581a12e",
     "zod": "3.25.76",
     "@lark-codem/lark-cli": "0.1.1"
   },
   "optionalDependencies": {
-    "@lark-codem/codem-cli-darwin-arm64": "0.1.266-dev.100103549344.0.g63304f4",
-    "@lark-codem/codem-cli-darwin-x64": "0.1.266-dev.100103549344.0.g63304f4",
-    "@lark-codem/codem-cli-linux-arm64": "0.1.266-dev.100103549344.0.g63304f4",
-    "@lark-codem/codem-cli-linux-x64": "0.1.266-dev.100103549344.0.g63304f4",
-    "@lark-codem/codem-cli-win32-arm64": "0.1.266-dev.100103549344.0.g63304f4",
-    "@lark-codem/codem-cli-win32-x64": "0.1.266-dev.100103549344.0.g63304f4"
+    "@lark-codem/codem-cli-darwin-arm64": "0.1.266-dev.100103550201.0.g346816f",
+    "@lark-codem/codem-cli-darwin-x64": "0.1.266-dev.100103550201.0.g346816f",
+    "@lark-codem/codem-cli-linux-arm64": "0.1.266-dev.100103550201.0.g346816f",
+    "@lark-codem/codem-cli-linux-x64": "0.1.266-dev.100103550201.0.g346816f",
+    "@lark-codem/codem-cli-win32-arm64": "0.1.266-dev.100103550201.0.g346816f",
+    "@lark-codem/codem-cli-win32-x64": "0.1.266-dev.100103550201.0.g346816f"
   },
   "engines": {
     "node": ">=18"

package/profile/runtime-logs.js

@@ -1,3 +1,4 @@
+import { workerRuntimeAttributes } from "./worker-runtime-observation.js";
 import { createHash, randomUUID } from "node:crypto";
 import os from "node:os";
 import fs from "node:fs";
@@ -234,6 +235,7 @@ export class RuntimeLogReporter {
       const severity = ["info", "warn", "error", "fatal"].includes(level) ? level : "info";
       const identity = { ...this.#identity };
       const category = {
+        ...workerRuntimeAttributes(),
         client_kind: "cli", runtime_role: this.#role, reporter: "codem_js", log_schema: "1",
         component: token(component) ?? "unknown", event: token(event) ?? "unknown", severity,
         identity_source: identity.deviceId ? "codem" : "process",

package/profile/worker-runtime-observation.js

@@ -0,0 +1,10 @@
+const exactVersion = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+// Low-cardinality process context shared by existing logs, metric categories,
+// and tracing. Ordinary personal-Bot processes have no worker attribution.
+export function workerRuntimeAttributes(env = process.env) {
+ if (env.CODEM_WORKER_RUNTIME_READY !== '1' || !['stable', 'current'].includes(env.CODEM_WORKER_RUNTIME_ACTUAL)) return {};
+ return { worker_runtime_family: env.CODEM_WORKER_RUNTIME_ACTUAL,
+  ...(exactVersion.test(env.CODEM_WORKER_CLI_VERSION || '') ? { worker_cli_version: env.CODEM_WORKER_CLI_VERSION } : {}),
+  ...(exactVersion.test(env.CODEM_WORKER_CORE_VERSION || '') ? { worker_core_version: env.CODEM_WORKER_CORE_VERSION } : {}) };
+}