@lark-codem/codem-cli 0.1.269-dev.100103647402.0.gd62de11 → 0.1.269-dev.100103656607.0.g3c6c983

package/bin/codem.js

@@ -145,19 +145,6 @@ function explainWindowsFatalStatus(code) {
   ].join("\n");
 }
 
-// Source/development and npm entrypoints select before invoking business code.
-// The compiled entry has the same guard for managed/direct binary installations.
-if (process.env.CODEM_WORKER_RUNTIME !== undefined) {
- const { isWorkerRuntimeStartup } = await import("./worker-runtime.js");
- if (isWorkerRuntimeStartup()) {
- const bootstrap = await import("../dist/src/worker-runtime-bootstrap.js").catch(() => null);
- if (bootstrap) {
-  try { process.exitCode = await bootstrap.runWorkerRuntimeBootstrap(); }
-  catch (error) { writeStderrSync(`worker runtime startup failed: ${error.message}`); process.exitCode = 1; }
-  process.exit(process.exitCode ?? 0);
- }
- }
-}
 const binaryPath = resolvePlatformBinary();
 
 if (binaryPath) {

package/package.json

@@ -1,8 +1,7 @@
 {
   "name": "@lark-codem/codem-cli",
-  "version": "0.1.269-dev.100103647402.0.gd62de11",
+  "version": "0.1.269-dev.100103656607.0.g3c6c983",
   "codemServiceManagementProtocol": 3,
-  "codemWorkerRuntimeProtocol": 1,
   "codemProfileProtocol": 1,
   "type": "module",
   "description": "CodeM local CLI for Feishu-driven coding sessions",
@@ -30,17 +29,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@lark-codem/codem-core": "0.8.86-dev.100103647402.0.gad1f090",
+    "@lark-codem/codem-core": "0.8.86-dev.100103656607.0.gd23c9f9",
     "zod": "3.25.76",
     "@lark-codem/lark-cli": "0.1.1"
   },
   "optionalDependencies": {
-    "@lark-codem/codem-cli-darwin-arm64": "0.1.269-dev.100103647402.0.gd62de11",
-    "@lark-codem/codem-cli-darwin-x64": "0.1.269-dev.100103647402.0.gd62de11",
-    "@lark-codem/codem-cli-linux-arm64": "0.1.269-dev.100103647402.0.gd62de11",
-    "@lark-codem/codem-cli-linux-x64": "0.1.269-dev.100103647402.0.gd62de11",
-    "@lark-codem/codem-cli-win32-arm64": "0.1.269-dev.100103647402.0.gd62de11",
-    "@lark-codem/codem-cli-win32-x64": "0.1.269-dev.100103647402.0.gd62de11"
+    "@lark-codem/codem-cli-darwin-arm64": "0.1.269-dev.100103656607.0.g3c6c983",
+    "@lark-codem/codem-cli-darwin-x64": "0.1.269-dev.100103656607.0.g3c6c983",
+    "@lark-codem/codem-cli-linux-arm64": "0.1.269-dev.100103656607.0.g3c6c983",
+    "@lark-codem/codem-cli-linux-x64": "0.1.269-dev.100103656607.0.g3c6c983",
+    "@lark-codem/codem-cli-win32-arm64": "0.1.269-dev.100103656607.0.g3c6c983",
+    "@lark-codem/codem-cli-win32-x64": "0.1.269-dev.100103656607.0.g3c6c983"
   },
   "engines": {
     "node": ">=18"

package/profile/runtime-logs.js

@@ -1,4 +1,3 @@
-import { workerRuntimeAttributes } from "./worker-runtime-observation.js";
 import { createHash, randomUUID } from "node:crypto";
 import os from "node:os";
 import fs from "node:fs";
@@ -11,43 +10,11 @@ const CAPACITY = 256;
 const BATCH_SIZE = 32;
 const INTERVAL_MS = 10_000;
 const REQUEST_TIMEOUT_MS = 3_000;
-const MAX_BATCH_BYTES = 256 * 1024;
-const LIFECYCLE_EVENT_NAME = "codem_bridge_lifecycle";
-const LIFECYCLE_COMPONENTS = {
-  daemon_startup: "daemon", runtime_sync: "runtime-post", command_handoff: "bridge",
-  runner_operation: "bridge", delivery_settled: "runtime-post", runtime_state: "bridge",
-  event_discarded: "runtime-post", process_lifecycle: "linco"
-};
-const LIFECYCLE_METRICS = [
-  "duration_ms", "ack_settle_duration_ms", "startup_wait_ms", "operation_age_ms",
-  "outage_duration_ms", "consecutive_failures", "deferred_age_ms", "pending_command_ack_count",
-  "pending_ack_age_ms", "pending_event_count", "oldest_event_age_ms", "lifetime_ms"
-];
-const LIFECYCLE_DIMENSIONS = {
-  outcome: ["success", "failed", "rejected", "canceled", "unknown", "accepted", "duplicate", "conflicting", "observed", "recovered"],
-  operation: ["prepare", "spawn", "ready", "cancel", "shutdown"],
-  scope: ["startup", "runner", "sync", "command", "queue"],
-  kind: ["command_ack", "runtime_event", "control", "events", "relay", "offline"],
-  phase: ["startup_marker", "prelude", "healthcheck", "config_load", "update_check", "service_reconcile", "login_gate", "launch", "authentication", "singleton", "initialize", "start_client", "first_sync", "trusted_device",
-    "build_request", "request", "validate_response", "apply_response", "persist_state",
-    "admission", "handler", "resolve_binary", "build_env", "host_capabilities", "parse_capabilities",
-    "strict_resume", "verify_binding", "prepare", "spawn", "ready", "cancel", "teardown"],
-  reason: ["overflow", "oversized", "timeout", "cleanup_failed", "unsupported_command", "invalid_payload",
-    "shutting_down_handoff", "handoff_target_not_active", "handler_inflight", "duplicate_inflight",
-    "runtime_unavailable", "runtime_environment_failed", "capability_probe_failed", "runtime_binary_changed",
-    "strict_resume_unsupported", "turn_context_unsupported", "active_run_protocol_mismatch", "trusted_device_blocked",
-    "invalid_runtime_event", "event_rejected", "task_terminated:canceled", "task_terminated:failed", "task_terminated:succeeded"],
-  error_source: ["bridge", "base", "linco", "transport"],
-  stability: ["stable", "unstable", "unknown"],
-  action: ["exit", "restart"],
-  expected: ["true", "false", "unknown"],
-  critical: ["true", "false"]
-};
 const TRUSTED_DEVICE_EVENTS = new Set(["host_identity_collection", "host_identity_command", "host_session_attempt", "host_session_expired", "trusted_device_admission_blocked", "trusted_device_admission_recovered"]);
 const TRUSTED_DEVICE_PHASES = ["auth", "identity", "provider", "host_key", "activation_state", "activation_apply", "activation_sign", "activation_complete", "credential_resolve", "session_apply", "session_sign", "session_complete", "trusted_device"];
 const TRUSTED_DEVICE_DIMENSIONS = {
   phase: TRUSTED_DEVICE_PHASES,
-  operation: ["create", "renew", "recovery", "platform_identity", "network_interfaces", "network_ports", "serial_number", "platform_uuid", "network_adapters"],
+  operation: ["create", "renew", "recovery", "platform_identity", "network_interfaces", "network_ports"],
   outcome: ["success", "partial", "failed", "ready", "not_registered", "no_auth", "reset", "blocked", "invalid", "verified", "not_required", "absent", "expired"],
   failure_kind: ["none", "timeout", "exec_failed", "invalid_json", "empty_identity", "read_failed", "authorization", "unknown"]
 };
@@ -77,13 +44,11 @@ const OBSERVATION_METRICS = {
   diagnostic_reporter_health: ["dropped_delta", "upload_failure_delta", "pending_event_count"]
 };
 const EXTRA_FIELDS = ["observation_id", "runtime_client_instance_id", "command_id", "delivery_id", "probe_id", "sync_id", "transport_request_id", "attempt_id"];
-const LIFECYCLE_EXTRA_FIELDS = [...EXTRA_FIELDS, "process_instance_id", "startup_id", "request_id", "event_id"];
 const STRING_FIELDS = new Set([
   ...EXTRA_FIELDS, "command_type", "ack_status", "ack_outcome", "readback_scope", "timing_origin", "required_capability",
   "request_id", "command_id", "session_id", "task_id", "dispatch_id", "event_id", "sync_id",
   "process_instance_id", "run_id", "stage", "phase", "status", "outcome", "reason", "action",
   "error_class", "error_code", "error_kind", "error_type", "code", "signal", "stop_reason",
-  "first_error", "retry_source", "cleanup_result",
   "terminal_event", "event_type", "actor_type", "source", "trigger", "hook_id", "hook_event",
   "target_version", "cli_version", "core_version", "version", "previous_state", "state",
   "failure_kind", "failure_impact", "failure_type", "failure_subtype", "failure_code", "failure_status", "delay_source", "mode", "provider", "name", "termination", "interaction_id", "interaction_kind", "owner_state", "artifact_id", "resource_type", "delivery_mode", "host", "scheme", "tool_call_id", "tool_name", "background_task_id", "model", "artifact_kind", "codem_user_id", "device_id", "operation", "foreground_error_code",
@@ -93,12 +58,11 @@ const VALUE_FIELDS = new Set([
   "session_retained",
   ...new Set(Object.values(OBSERVATION_METRICS).flat()),
   "pid", "exit_code", "duration_ms", "elapsed_ms", "wait_ms", "run_ms", "total_ms", "took_ms",
-  "attempt", "attempts", "attempt_count", "retryable", "http_status", "errno", "active_task_count",
+  "attempt", "attempts", "attempt_count", "retryable", "http_status", "active_task_count",
   "pending_event_count", "pending_command_ack_count", "next_retry_ms", "consecutive_failures",
   "outage_duration_ms", "startup_duration_ms", "failed_attempts", "active_runs", "completed",
   "delivered", "result_delivered", "queued_behind_existing", "expected", "timed_out",
-  "force_exit_ms", "teardown_ceiling_ms", "recovered", "count", "ms_since_process_start", "owner_pid", "consumed", "delivery_attempt", "ack_deadline_ms", "command_to_bridge_ms", "size_bytes", "source_size_bytes", "processed_bytes", "before", "after", "omitted_detail_count", "opened", "selected", "foreground",
-  ...LIFECYCLE_METRICS
+  "force_exit_ms", "teardown_ceiling_ms", "recovered", "count", "ms_since_process_start", "owner_pid", "consumed", "delivery_attempt", "ack_deadline_ms", "command_to_bridge_ms", "size_bytes", "source_size_bytes", "processed_bytes", "before", "after", "omitted_detail_count", "opened", "selected", "foreground"
 ]);
 
 function token(value) {
@@ -124,7 +88,7 @@ function extraProjection(fields = {}) {
   return Object.fromEntries(EXTRA_FIELDS.filter(key => token(fields?.[key])).map(key => [key, token(fields[key])]));
 }
 
-function projectFields(input, fingerprintErrors = true) {
+function projectFields(input) {
   const result = {};
   for (const [key, value] of Object.entries(input ?? {}).slice(0, 100)) {
     const name = fieldName(key);
@@ -135,7 +99,6 @@ function projectFields(input, fingerprintErrors = true) {
       result[name] = value;
     }
   }
-  if (!fingerprintErrors) return result;
   const error = input?.error ?? input?.terminalError;
   const fingerprint = input?.error_fingerprint ?? input?.errorFingerprint;
   if (typeof fingerprint === "string" && /^[a-f0-9]{24}$/u.test(fingerprint)) result.error_fingerprint = fingerprint;
@@ -158,36 +121,6 @@ function projectFields(input, fingerprintErrors = true) {
   return result;
 }
 
-// Build the display summary from classified fields. Keep free-form text at
-// its source so collecting telemetry never scans upstream or local messages.
-function lifecycleErrorSummary(dimensions, fields) {
-  return [
-    dimensions.phase ?? dimensions.operation ?? dimensions.scope,
-    dimensions.error_source,
-    dimensions.error_code,
-    dimensions.reason !== dimensions.error_code ? dimensions.reason : undefined,
-    Number.isSafeInteger(fields.errno) && fields.errno !== 0 ? `errno=${fields.errno}` : undefined,
-    Number.isSafeInteger(fields.exit_code) ? `exit_code=${fields.exit_code}` : undefined
-  ].filter(Boolean).join(" · ");
-}
-
-function lifecycleErrorCode(fields) {
-  const code = token(fields.error_code ?? fields.error?.code ?? fields.error?.cause?.code)?.toLowerCase();
-  if (code && /^(?:e(?:connreset|connrefused|pipe|timedout|netunreach|hostunreach|notfound|ai_again|acces|perm|noent|exist|nospace|nospc|io)|runtime_post_[a-z_]{1,48}|http_[1-5]\d\d|(?:[a-z_]{1,35}_)?timeout|not_logged_in|unsupported_command|invalid_payload|invalid_response|relogin_required|rotation_pending|cleanup_failed|oversized|overflow|unexpected_exit|spawn_failed|ready_missing|prepare_failed|ack_rejected|ack_conflicting)$/u.test(code)) return code;
-  const status = Number(fields.http_status);
-  if (Number.isInteger(status) && status >= 100 && status <= 599) return `http_${status}`;
-  return fields.outcome === "failed" || fields.outcome === "rejected" || fields.outcome === "conflicting" ? "unknown" : undefined;
-}
-
-function keepLegacyMetric(event, fields, role, severity) {
-  if (/^startup\.(?:main|update_check|daemon_service_reconcile|login_gate|login_handoff_to_linco)$/u.test(event) && severity === "info") return false;
-  if (/(?:^|\.)drain_(?:started|completed)$/u.test(event) && severity === "info") return false;
-  if (role === "daemon" && event === "runtime_capability_probe" && severity === "info") return false;
-  if (role === "daemon" && ["sync_ready", "sync_failed", "sync_recovered", "shutdown_completed"].includes(event)) return false;
-  if (event === "command_ack" && ["settled", "pending"].includes(fields.stage)) return false;
-  return true;
-}
-
 export function runtimeLogIdentity(config) {
   const oauth = optional(() => config?.auth?.oauth);
   return {
@@ -200,15 +133,6 @@ export function runtimeLogIdentity(config) {
   };
 }
 
-// Prefer an operation's attribution over the identity of its eventual sender.
-export function runtimeObservationTenant(value) {
-  return optional(() => {
-    const payload = value?.payload ?? value;
-    const context = payload?.telemetryContext ?? payload?.telemetry_context;
-    return token(context?.tenantId ?? context?.tenant_id ?? payload?.tenantId ?? payload?.tenant_id ?? value?.tenantId ?? value?.tenant_id);
-  });
-}
-
 export class RuntimeLogReporter {
   #live = { queue: [], inflight: undefined, abort: undefined };
   #replay = { queue: [], inflight: undefined, abort: undefined };
@@ -228,8 +152,6 @@ export class RuntimeLogReporter {
   #platform;
   #osVersion;
   #crashDirectory;
-  #restoring;
-  #savedDuringRestore = new Set();
 
   constructor({ role = "cli", version = "unknown", send = sendSlardarPcBatch, instanceId = randomUUID(), diagnosticId: supportId = diagnosticId(), platform = process.platform, osVersion = os.release(), crashDirectory } = {}) {
     this.#send = send;
@@ -242,7 +164,7 @@ export class RuntimeLogReporter {
     this.#osVersion = osVersion;
     this.#timer = setInterval(() => { void this.flush(); }, INTERVAL_MS);
     this.#timer.unref?.();
-    this.#restoring = this.#restoreCrashes().finally(() => { this.#savedDuringRestore = undefined; });
+    this.#restoreCrashes();
   }
 
   // Crash files hold already-projected records and the identity at failure time.
@@ -250,48 +172,33 @@ export class RuntimeLogReporter {
   // deliverNow also queues the record for this process's next flush. A
   // successful send deletes its file; otherwise the next process replays it.
   persistCrash(component, event, fields = {}, { deliverNow = false } = {}) {
+    let entry;
+    let crashFile;
     try {
       if (this.#closed || (!this.#crashDirectory && !deliverNow)) return;
-      const entry = this.#logEntry("fatal", component, event, fields);
-      this.#saveCrash(entry);
-      if (deliverNow) this.#replay.queue.push(entry);
-    } catch { /* Crash diagnostics must preserve the original exit behavior. */ }
-  }
-
-  #saveCrash(entry) {
-    if (!this.#crashDirectory) return;
-    try {
+      if (!this.record("fatal", component, event, fields)) return;
+      entry = this.#live.queue.pop();
+      if (!this.#crashDirectory) return;
       fs.mkdirSync(this.#crashDirectory, { recursive: true, mode: 0o700 });
       const names = fs.readdirSync(this.#crashDirectory).filter(name => /^js-[a-f0-9-]+\.json$/u.test(name));
       if (names.length >= 32) return;
-      const name = `js-${randomUUID()}.json`;
-      const file = path.join(this.#crashDirectory, name);
+      const file = path.join(this.#crashDirectory, `js-${randomUUID()}.json`);
       fs.writeFileSync(file, JSON.stringify(entry), { flag: "wx", mode: 0o600 });
-      this.#savedDuringRestore?.add(name);
-      entry.crashFile = file;
-    } catch { /* Local storage can be full or unavailable. */ }
+      crashFile = file;
+    } catch { /* Crash diagnostics must preserve the original exit behavior. */ } finally {
+      if (deliverNow && entry) this.#replay.queue.push({ ...entry, attempts: 0, ...(crashFile ? { crashFile } : {}) });
+    }
   }
 
-  async #restoreCrashes() {
-    if (!this.#crashDirectory) return;
+  #restoreCrashes() {
     try {
-      for (const name of (await fs.promises.readdir(this.#crashDirectory)).filter(name => /^js-[a-f0-9-]+\.json$/u.test(name)).slice(0, 32)) {
-        if (this.#closed) return;
-        if (this.#savedDuringRestore?.has(name)) continue;
+      for (const name of fs.readdirSync(this.#crashDirectory).filter(name => /^js-[a-f0-9-]+\.json$/u.test(name)).slice(0, 32)) {
         const file = path.join(this.#crashDirectory, name);
         try {
-          const stat = await fs.promises.lstat(file);
-          if (!stat.isFile() || stat.size > 65536) continue;
-          const entry = JSON.parse(await fs.promises.readFile(file, "utf8"));
+          if (fs.lstatSync(file).isSymbolicLink() || fs.statSync(file).size > 65536) continue;
+          const entry = JSON.parse(fs.readFileSync(file, "utf8"));
           if (entry?.record?.category?.reporter !== "codem_js" || entry?.record?.log_type !== "log" || !entry.header) continue;
-          if (this.#closed) return;
-          if (entry.metricName === LIFECYCLE_EVENT_NAME) {
-            entry.record.category.replay = "1";
-            this.#replay.queue.push({ ...entry, attempts: 0, crashFile: file });
-          } else {
-            this.#replay.queue.push({ header: entry.header, record: entry.record, metricName: entry.metricName,
-              metrics: metricProjection(entry.record.category.event, entry.metrics), extra: extraProjection(entry.extra), attempts: 0, crashFile: file });
-          }
+          this.#replay.queue.push({ header: entry.header, record: entry.record, metrics: metricProjection(entry.record.category.event, entry.metrics), extra: extraProjection(entry.extra), attempts: 0, crashFile: file });
         } catch { /* A partial crash write cannot prevent startup. */ }
       }
     } catch { /* First startup or unavailable storage. */ }
@@ -321,90 +228,28 @@ export class RuntimeLogReporter {
   record(level, component, event, fields = {}) {
     try {
       if (this.#closed) return false;
-      return this.#enqueue(this.#logEntry(level, component, event, fields));
-    } catch { return false; }
-  }
-
-  #logEntry(level, component, event, fields) {
-    let safeFields;
-    try { safeFields = projectFields(fields); } catch { safeFields = {}; }
-    if (OBSERVATION_EVENTS.has(event)) safeFields.observation_id = randomUUID();
-    const severity = ["info", "warn", "error", "fatal"].includes(level) ? level : "info";
-    // Keep arbitrary upstream error codes out of trusted-device metric dimensions.
-    const trustedDevice = TRUSTED_DEVICE_EVENTS.has(event);
-    const dimensions = trustedDevice ? {} : Object.fromEntries(["stage", "error_class", "error_code", "error_kind", "outcome"]
-      .filter(key => safeFields[key]).map(key => [key, safeFields[key]]));
-    if (OBSERVATION_EVENTS.has(event)) {
-      for (const [key, values] of Object.entries(trustedDevice ? TRUSTED_DEVICE_DIMENSIONS : OBSERVATION_DIMENSIONS)) {
-        if (safeFields[key]) dimensions[key] = values.includes(safeFields[key]) ? safeFields[key] : "unknown";
-      }
-    }
-    return {
-      ...this.#entry(severity, component, event, safeFields, this.#identity, dimensions, true),
-      metricName: keepLegacyMetric(event, safeFields, this.#role, severity) ? "codem_runtime_diagnostic" : null,
-      metrics: metricProjection(event, safeFields), extra: extraProjection(safeFields)
-    };
-  }
-
-  recordLifecycle(event, fields = {}, { persist = false } = {}) {
-    try {
-      if (this.#closed || !Object.hasOwn(LIFECYCLE_COMPONENTS, event)) return false;
-      const unstable = fields.stability === "unstable" || fields.outcome === "failed" || fields.outcome === "conflicting";
-      const hasDetail = fields.detail ?? (persist || unstable || fields.outcome === "rejected" || fields.outcome === "unknown");
-      const severity = persist ? "fatal" : unstable ? "error" : "info";
-      const dimensions = {
-        stability: unstable ? "unstable" : fields.outcome === "unknown" ? "unknown" : "stable",
-        has_detail: hasDetail ? "1" : "0", replay: "0"
-      };
-      for (const [key, values] of Object.entries(LIFECYCLE_DIMENSIONS)) {
-        if (fields[key] != null && values.includes(String(fields[key]))) dimensions[key] = String(fields[key]);
-      }
-      const errorCode = lifecycleErrorCode(fields);
-      if (errorCode) dimensions.error_code = errorCode;
-      if (fields.command_type) dimensions.command_type = OBSERVATION_DIMENSIONS.command_type.includes(fields.command_type) ? fields.command_type : "other";
-      const metrics = Object.fromEntries(LIFECYCLE_METRICS
-        .filter(key => typeof fields[key] === "number" && Number.isFinite(fields[key]) && fields[key] >= 0)
-        .map(key => [key, Math.round(fields[key])]));
-      if (event !== "runtime_state") {
-        metrics.count = event === "delivery_settled" && Number.isSafeInteger(fields.count) && fields.count > 0 ? fields.count : 1;
-      }
-      const identity = {
-        ...this.#identity,
-        ...(Object.hasOwn(fields, "tenantId") ? { tenantId: token(fields.tenantId) } : {})
-      };
-      const { replay: _replay, ...logDimensions } = dimensions;
-      const summary = hasDetail ? lifecycleErrorSummary(dimensions, fields) : "";
-      const { reason: _reason, error_code: _errorCode, ...projected } = projectFields(fields, false);
-      const safeFields = {
-        ...projected, ...logDimensions, ...metrics,
-        process_instance_id: this.#instanceId,
-        ...(event === "daemon_startup" ? { startup_id: this.#instanceId } : {}),
-        observation_id: randomUUID(),
-        ...(summary ? { error_summary: summary } : {})
-      };
-      const extra = Object.fromEntries(LIFECYCLE_EXTRA_FIELDS
-        .filter(key => token(safeFields[key])).map(key => [key, safeFields[key]]));
-      if (summary) extra.error_summary = summary;
-      const entry = {
-        ...this.#entry(severity, LIFECYCLE_COMPONENTS[event], event, safeFields, identity, dimensions, hasDetail),
-        metricName: LIFECYCLE_EVENT_NAME, metrics, extra
-      };
-      if (persist && hasDetail) this.#saveCrash(entry);
-      return this.#enqueue(entry);
-    } catch { return false; }
-  }
-
-  #entry(severity, component, event, safeFields, identity, dimensions, includeLog) {
-    const category = {
-        ...workerRuntimeAttributes(),
+      let safeFields;
+      try { safeFields = projectFields(fields); } catch { safeFields = {}; }
+      if (OBSERVATION_EVENTS.has(event)) safeFields.observation_id = randomUUID();
+      const severity = ["info", "warn", "error", "fatal"].includes(level) ? level : "info";
+      const identity = { ...this.#identity };
+      const category = {
         client_kind: "cli", runtime_role: this.#role, reporter: "codem_js", log_schema: "1",
         component: token(component) ?? "unknown", event: token(event) ?? "unknown", severity,
         identity_source: identity.deviceId ? "codem" : "process",
         diagnostic_id: this.#diagnosticId,
         ...(identity.tenantId ? { tenant_id: identity.tenantId } : {}),
         ...(identity.serverEnvironment ? { server_environment: identity.serverEnvironment } : {}),
-        ...dimensions
-    };
+        ...Object.fromEntries(["stage", "error_class", "error_code", "error_kind", "outcome"].filter((key) => safeFields[key]).map((key) => [key, safeFields[key]]))
+      };
+      if (OBSERVATION_EVENTS.has(category.event)) {
+        const trustedDevice = TRUSTED_DEVICE_EVENTS.has(category.event);
+        // Keep arbitrary upstream error codes in logs, not metric dimensions.
+        if (trustedDevice) for (const key of ["stage", "error_class", "error_code", "error_kind", "outcome"]) delete category[key];
+        for (const [key, values] of Object.entries(trustedDevice ? TRUSTED_DEVICE_DIMENSIONS : OBSERVATION_DIMENSIONS)) {
+          if (safeFields[key]) category[key] = values.includes(safeFields[key]) ? safeFields[key] : "unknown";
+        }
+      }
       const header = {
         aid: SLARDAR_PC_AID,
         device_id: identity.deviceId ?? this.#instanceId,
@@ -414,35 +259,31 @@ export class RuntimeLogReporter {
         os: this.#platform, os_version: this.#osVersion
       };
       const timestamp = Date.now();
-      const payload = includeLog ? {
+      const payload = {
         schema_version: 1, timestamp, component: category.component, event: category.event, level: severity,
         process_instance_id: this.#instanceId, diagnostic_id: this.#diagnosticId, pid: process.pid,
         ...(identity.tenantId ? { tenant_id: identity.tenantId } : {}),
         fields: safeFields
-      } : undefined;
+      };
       const record = {
         app_version: this.#version, app_minor_version: "", build_id: "",
         process_type: `codem-${this.#role}`, session_id: "", timestamp, category,
         log_type: "log", log_level: severity === "fatal" ? "error" : severity,
-        ...(payload ? { log_content: `CodeM diagnostic ${severity} ${category.component}/${category.event}\n${JSON.stringify(payload)}` } : {})
+        log_content: `CodeM diagnostic ${severity} ${category.component}/${category.event}\n${JSON.stringify(payload)}`
       };
-      const criticalSettlement = event === "delivery_settled" && dimensions.critical === "true";
       const priority = severity === "fatal" ? 3 :
         ["resumed", "settled"].includes(safeFields.stage) || (severity === "error" && !safeFields.suppressed_count) ? 2 :
-        severity === "info" && !criticalSettlement ? 0 : 1;
-    return { header, record, includeLog, priority, attempts: 0, crashFile: undefined };
-  }
-
-  #enqueue(entry) {
-    const queue = this.#live.queue;
-    if (queue.length >= CAPACITY) {
-      const minimum = Math.min(...queue.map(item => item.priority));
-      if (minimum > entry.priority) { this.#dropped += 1; return false; }
-      queue.splice(queue.findIndex(item => item.priority === minimum), 1);
-      this.#dropped += 1;
-    }
-    queue.push(entry);
-    return true;
+        severity === "info" ? 0 : 1;
+      if (this.#live.queue.length >= CAPACITY) {
+        const minimum = Math.min(...this.#live.queue.map(entry => entry.priority ?? (entry.record.log_level === "info" ? 0 : 1)));
+        if (minimum > priority) { this.#dropped += 1; return false; }
+        const expendable = this.#live.queue.findIndex(entry => (entry.priority ?? (entry.record.log_level === "info" ? 0 : 1)) === minimum);
+        this.#live.queue.splice(expendable, 1);
+        this.#dropped += 1;
+      }
+      this.#live.queue.push({ header, record, metrics: metricProjection(category.event, safeFields), extra: extraProjection(safeFields), priority, attempts: 0 });
+      return true;
+    } catch { return false; }
   }
 
   async flush({ timeoutMs = REQUEST_TIMEOUT_MS } = {}) {
@@ -475,7 +316,7 @@ export class RuntimeLogReporter {
     // Run both lanes concurrently: old replay cannot delay live sends. Waiting
     // for both within one budget also gives short-lived invocations a chance
     // to finish replay; a timeout leaves its original crash file for next time.
-    const replay = this.#restoring.then(() => this.#flushLane(this.#replay, REQUEST_TIMEOUT_MS));
+    const replay = this.#flushLane(this.#replay, REQUEST_TIMEOUT_MS);
     let timer;
     try {
       await Promise.race([
@@ -506,27 +347,16 @@ export class RuntimeLogReporter {
         const first = lane.queue[0];
         const key = JSON.stringify(first.header);
         const batch = [];
-        const data = [];
-        let bytes = 0;
-        while (batch.length < BATCH_SIZE && lane.queue.length && JSON.stringify(lane.queue[0].header) === key && Boolean(lane.queue[0].crashFile) === Boolean(first.crashFile)) {
-          const { record, metrics, extra, metricName = "codem_runtime_diagnostic", includeLog = true } = lane.queue[0];
-          const records = includeLog ? [record] : [];
-          if (metricName) records.push({
-            app_version: record.app_version, app_minor_version: "", build_id: "",
-            process_type: record.process_type, session_id: "", timestamp: record.timestamp,
-            log_type: "flexible", event_name: metricName, category: record.category,
-            metrics: metrics ?? { count: 1 }, ...(extra ? { extra } : {})
-          });
-          const entryBytes = Buffer.byteLength(JSON.stringify(records));
-          if (batch.length && bytes + entryBytes > MAX_BATCH_BYTES) break;
-          bytes += entryBytes;
-          batch.push(lane.queue.shift());
-          data.push(...records);
-        }
+        while (batch.length < BATCH_SIZE && lane.queue.length && JSON.stringify(lane.queue[0].header) === key && Boolean(lane.queue[0].crashFile) === Boolean(first.crashFile)) batch.push(lane.queue.shift());
+        const data = batch.flatMap(({ record, metrics, extra }) => [record, {
+          app_version: record.app_version, app_minor_version: "", build_id: "",
+          process_type: record.process_type, session_id: "", timestamp: record.timestamp,
+          log_type: "flexible", event_name: "codem_runtime_diagnostic", category: record.category, metrics: metrics ?? { count: 1 }, ...(extra ? { extra } : {})
+        }]);
         try {
           await Promise.race([Promise.resolve().then(() => this.#send({ header: first.header, data }, { signal: controller.signal })), deadline]);
           for (const entry of batch) {
-            if (entry.crashFile) await fs.promises.unlink(entry.crashFile).catch(() => {});
+            if (entry.crashFile) { try { fs.unlinkSync(entry.crashFile); } catch { /* Replay may duplicate after a crash or concurrent startup. */ } }
           }
         } catch {
           this.#uploadFailures += 1;
@@ -583,25 +413,15 @@ export function recordRuntimeLog(level, component, event, fields = {}) {
   try { return active?.record(level, component, event, fields) ?? false; } catch { return false; }
 }
 
-// An explicit result or state observation. This never waits for the collector;
-// persist is reserved for rare terminal failures that can outlive this process.
-export function recordBridgeLifecycle(event, fields, options = {}) {
-  try { return active?.recordLifecycle(event, fields, options) ?? false; } catch { return false; }
-}
-
-export function flushRuntimeLogsInBackground() {
-  if (active) setImmediate(() => { void active?.flush().catch(() => {}); }).unref?.();
-}
-
 export function persistRuntimeCrash(component, event, fields) {
   try { active?.persistCrash(component, event, fields); } catch { /* best effort */ }
 }
 
 // A failure that ends a short-lived process: persist first, then try to deliver
 // within one upload budget, so an immediate exit cannot lose the count.
-export function reportRuntimeFailure(component, event, fields = {}) {
+export async function reportRuntimeFailure(component, event, fields = {}, budgetMs = 3_000) {
   try { active?.persistCrash(component, event, fields, { deliverNow: true }); } catch { /* best effort */ }
-  flushRuntimeLogsInBackground();
+  await flushRuntimeLogs(budgetMs);
 }
 
 export async function flushRuntimeLogs(budgetMs = 200) {

package/profile/slardar-pc-transport.js

@@ -1,6 +1,5 @@
 import https from "node:https";
-import { gzip } from "node:zlib";
-import { promisify } from "node:util";
+import { gzipSync } from "node:zlib";
 
 // PC Custom Log / Custom Event wire format, verified against Parfait 1.7.0.0's
 // public IUploader callback. This is not the Slardar Web/BID protocol. Keep the
@@ -11,13 +10,10 @@ export const SLARDAR_PC_AID = "1880";
 // from the native Parfait SDK. Do not advertise a native SDK we do not run.
 export const SLARDAR_PC_REPORTER_VERSION = "1.0.0.0";
 const ENDPOINT = `https://pc-mon.zijieapi.com/monitor_pc/collect/api/pc_log?aid=${SLARDAR_PC_AID}`;
-const compress = promisify(gzip);
 
-export async function sendSlardarPcBatch(payload, { signal, request = https.request } = {}) {
-  signal?.throwIfAborted();
-  const body = await compress(Buffer.from(JSON.stringify(payload)));
-  signal?.throwIfAborted();
+export function sendSlardarPcBatch(payload, { signal, request = https.request } = {}) {
   return new Promise((resolve, reject) => {
+    const body = gzipSync(Buffer.from(JSON.stringify(payload)));
     const req = request(ENDPOINT, {
       method: "POST",
       signal,

package/bin/linco-paths.js

@@ -1,45 +0,0 @@
-import os from "node:os";
-import path from "node:path";
-
-export function resolveEffectiveLincoHome({
-  env = process.env, homeDir = os.homedir(), workingDirectory = process.cwd(), platform = process.platform
-} = {}) {
-  const pathApi = platform === "win32" ? path.win32 : path;
-  const configured = Object.hasOwn(env ?? {}, "LINCO_HOME")
-    ? String(env.LINCO_HOME ?? "") : pathApi.join(String(homeDir), ".codem");
-  return pathApi.resolve(String(workingDirectory), configured);
-}
-
-// Mirror Core sessions_root_for, including present-but-empty path overrides.
-// Sidecars are siblings of the session root, never sandbox CODEM_STATE_HOME.
-export function resolveLincoSessionsRoot(options = {}) {
-  const { env = process.env, workingDirectory = process.cwd(), platform = process.platform } = options;
-  const pathApi = platform === "win32" ? path.win32 : path;
-  return Object.hasOwn(env ?? {}, "LINCO_SESSIONS_ROOT")
-    ? pathApi.resolve(String(workingDirectory), String(env.LINCO_SESSIONS_ROOT ?? ""))
-    : pathApi.join(options.effectiveLincoHome ?? resolveEffectiveLincoHome(options), "sessions");
-}
-
-export function resolveLincoHostContextRoot(options = {}) {
-  const pathApi = options.platform === "win32" ? path.win32 : path;
-  return pathApi.join(pathApi.dirname(resolveLincoSessionsRoot(options)), "host-context");
-}
-
-export function sameRecoveryPath(retained, current, platform = process.platform) {
-  if (typeof retained !== "string" || typeof current !== "string") return false;
-  if (platform !== "win32" || retained === current) return retained === current;
-  // Rust canonicalize retains the extended-length drive/UNC prefix; Node
-  // realpath removes it. Strip only that representation difference, preserving
-  // case and literal segments rather than resolving untrusted binding paths.
-  const identity = value => {
-    if (value.toLowerCase().startsWith("\\\\?\\unc\\")) value = `\\\\${value.slice(8)}`;
-    else if (value.startsWith("\\\\?\\")) value = value.slice(4);
-    const root = path.win32.parse(value).root;
-    if (!path.win32.isAbsolute(value) || root.length <= 1) return null;
-    // Namespaced UNC roots may omit the trailing separator. Do not normalize
-    // non-root segments: verbatim paths must not acquire lexical aliases.
-    return value === root && !value.endsWith("\\") ? `${value}\\` : value;
-  };
-  const retainedIdentity = identity(retained);
-  return retainedIdentity !== null && retainedIdentity === identity(current);
-}

package/bin/tt-env.js

@@ -1,171 +0,0 @@
-// CODEM_X_TT_ENV 泳道支持：按环境变量把 codem 请求打入 BOE 环境 / PPE·BOE 泳道。
-// 与 linco 侧（linco-code crates/linco-core/src/tt_env.rs）同一契约、同一矩阵：
-//
-// | 值      | 域名                                  | x-tt-env | x-use-ppe |
-// |---------|---------------------------------------|----------|-----------|
-// | boe     | codem.feishu.cn → codem.feishu-boe.cn | —        | —         |
-// | boe_*   | codem.feishu.cn → codem.feishu-boe.cn | 原值     | —         |
-// | ppe     | 不变（PPE 与线上同域名）              | —        | 1         |
-// | ppe_*   | 不变                                  | 原值     | 1         |
-// | 其他    | 完全惰性                              | —        | —         |
-//
-// daemon spawn linco 时 env 全量继承（linco-runner buildLincoProcessEnv），
-// 该变量无需任何桥接代码即透传给 linco 进程。
-//
-// 头注入统一走 ttEnvHeadersFor(url)：只对官方 codem host（prod/BOE）产出头，
-// 任何可被 env 覆写到第三方 host 的出口（agent-config / project 端点）天然
-// 拿不到泳道头——泄露风险在构造上排除，而非靠调用点纪律。
-//
-// 个人和 native sandbox 的 serverUrl 经 resolveServerUrl 派生；cloud/custom
-// sandbox 保留自己的配置优先级，再用 rewriteUrlForTtEnv 改写选中的官方域名。
-// Runtime POST 使用已解析的 serverUrl 拼接路径，与 managed-config 保持同一环境；
-// 自定义服务地址不受影响。BOE 身份态通过 resolveStateHome 隔离到 .boe 子树。
-
-import path from "node:path";
-
-export const CODEM_X_TT_ENV = "CODEM_X_TT_ENV";
-
-const PROD_ROUTER_HOST = "codem.feishu.cn";
-const BOE_ROUTER_HOST = "codem.feishu-boe.cn";
-
-
-// 合法形状：boe / ppe 裸值，或 boe_ / ppe_ 前缀 + [A-Za-z0-9_-] 泳道名。其余
-// 一律 null（惰性）。显式剥 BOM（U+FEFF，Windows env 文件复制常见混入）；泳道
-// 名限定字符集，控制字符等坏值直接判惰性而不是变成非法 header value。两条都
-// 是与 linco 侧（tt_env.rs）钉死的契约——同一变量被两个进程各自解析，任何
-// 语义分叉都会造成"bridge 进泳道、linco 留 prod"的半程泳道。
-export function parseTtEnvLane(raw) {
-  if (typeof raw !== "string") {
-    return null;
-  }
-  // 字符类显式含 U+0085(NEL)：JS \s 不含它而 Rust char::is_whitespace 含，
-  // 不补齐会在这一个字符上出现两侧判定分叉。
-  const value = raw.replace(/^[\s…]+|[\s…]+$/gu, "");
-  const bare = value === "boe" || value === "ppe";
-  const named = /^(?:boe|ppe)_[A-Za-z0-9_-]+$/u.test(value);
-  if (!bare && !named) {
-    return null;
-  }
-  return {
-    value,
-    isBoe: value === "boe" || value.startsWith("boe_"),
-    xTtEnv: named ? value : null,
-    usePpe: value === "ppe" || value.startsWith("ppe_")
-  };
-}
-
-export function resolveTtEnvLane(env = process.env) {
-  return parseTtEnvLane(env?.[CODEM_X_TT_ENV]);
-}
-
-function isOfficialCodemHost(hostname) {
-  const host = hostname.toLowerCase();
-  return host === PROD_ROUTER_HOST || host === BOE_ROUTER_HOST;
-}
-
-// BOE 泳道下把官方 prod host 重写为 BOE host；显式自定义 server（localhost /
-// 私有化）与非法 URL 原样返回，保证 --server 显式指向永远赢过泳道。
-export function rewriteUrlForTtEnv(url, env = process.env) {
-  const lane = resolveTtEnvLane(env);
-  if (!lane?.isBoe) {
-    return url;
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return url;
-  }
-  if (parsed.hostname.toLowerCase() !== PROD_ROUTER_HOST) {
-    return url;
-  }
-  parsed.hostname = BOE_ROUTER_HOST;
-  let rewritten = parsed.toString();
-  // URL 序列化会给裸域名补尾部 "/"，与既有 serverUrl 约定（仅存域名）不符：
-  // 输入没带尾斜杠时保持原样。
-  if (!url.endsWith("/") && parsed.pathname === "/" && rewritten.endsWith("/")) {
-    rewritten = rewritten.slice(0, -1);
-  }
-  return rewritten;
-}
-
-// 目标是官方 codem host（prod/BOE）时产出泳道头，否则 {}——第三方 host 永远拿不到。
-export function ttEnvHeadersFor(url, env = process.env) {
-  const lane = resolveTtEnvLane(env);
-  if (!lane || (!lane.xTtEnv && !lane.usePpe)) {
-    return {};
-  }
-  let hostname;
-  try {
-    hostname = (url instanceof URL ? url : new URL(String(url))).hostname;
-  } catch {
-    return {};
-  }
-  if (!isOfficialCodemHost(hostname)) {
-    return {};
-  }
-  const headers = {};
-  if (lane.xTtEnv) {
-    headers["x-tt-env"] = lane.xTtEnv;
-  }
-  if (lane.usePpe) {
-    headers["x-use-ppe"] = "1";
-  }
-  return headers;
-}
-
-// 环境状态根：身份/环境态（config/credentials/sessions/daemon 锁等）的落盘
-// 基目录。boe 与 prod(ppe) 账号体系独立，各存一份互不打爆：boe* 泳道落
-// `$CODEM_HOME/.boe`，其余共用 `$CODEM_HOME`。程序安装态（runtime/ 二进制、
-// 更新状态、bin）**不走本函数**、始终留在 CODEM_HOME——否则首次 boe 启动
-// launcher 在空的 .boe/runtime 找不到版本会触发重装。spawn linco 时子进程
-// CODEM_HOME 指到本函数产物，linco（含 LINCO_HOME 派生的全部状态）自动跟随。
-export function resolveStateHome(codemHome, env = process.env) {
-  const lane = resolveTtEnvLane(env);
-  if (!lane?.isBoe) {
-    return codemHome;
-  }
-  // 幂等：daemon 把 linco 子进程 CODEM_HOME 设为已派生的状态根并透传泳道变量，
-  // linco 回调 bridge CLI 的嵌套进程会再走一次派生——basename 已是 .boe 时
-  // 原样返回，否则出现 .boe/.boe 双目录（首次 BOE 登录 / AK 刷新读写错位）。
-  if (path.basename(codemHome) === ".boe") {
-    return codemHome;
-  }
-  return path.join(codemHome, ".boe");
-}
-
-// 泳道作用域文件名：/v1/models 这类**按泳道头返回不同内容**的缓存，必须以
-// 完整泳道值分文件——boe_a 与 boe_b、裸 ppe 与 prod 的 catalog 都可能不同，
-// 只分 boe/非 boe 两档会让跨泳道切换在 TTL 内复用错误 endpoint（与 linco
-// model_discovery::cache_file_name 同契约）。泳道名字符集由 parseTtEnvLane
-// 限定 [A-Za-z0-9_-]，可安全嵌入文件名。
-export function laneScopedFileName(baseName, env = process.env) {
-  const lane = resolveTtEnvLane(env);
-  if (!lane) {
-    return baseName;
-  }
-  const dot = baseName.lastIndexOf(".");
-  return dot > 0
-    ? `${baseName.slice(0, dot)}.${lane.value}${baseName.slice(dot)}`
-    : `${baseName}.${lane.value}`;
-}
-
-// 启动日志一行（无泳道时 null）：泳道头漏注入的故障模式是"静默打到线上"，
-// 这行日志是运行现场唯一的可观测抓手。
-export function describeTtEnvLane(env = process.env) {
-  const lane = resolveTtEnvLane(env);
-  if (!lane) {
-    return null;
-  }
-  const parts = [`CODEM_X_TT_ENV=${lane.value}`];
-  if (lane.isBoe) {
-    parts.push(`host→${BOE_ROUTER_HOST}`);
-  }
-  if (lane.xTtEnv) {
-    parts.push(`x-tt-env:${lane.xTtEnv}`);
-  }
-  if (lane.usePpe) {
-    parts.push("x-use-ppe:1");
-  }
-  return parts.join(" ");
-}

package/bin/worker-runtime-telemetry.js

@@ -1,75 +0,0 @@
-// Observation only. This module runs before either business Bridge (including
-// an unmodified stable CLI), and imports only stdlib and shared lane rules.
-import http from 'node:http';
-import https from 'node:https';
-import { rewriteUrlForTtEnv, ttEnvHeadersFor } from './tt-env.js';
-
-export function workerRuntimeTelemetryTarget({env=process.env,args=process.argv.slice(2)}={}) {
- if (/^(1|true|yes|on)$/i.test(env.CODEM_TELEMETRY_DISABLED || '') || !env.CODEM_TOKEN || !env.CODEM_SANDBOX_DISPATCH_ID) return null;
- // Mirror daemon's Commander options without importing business Bridge code:
- // optional --sandbox [mode], required --server <url>, last occurrence wins.
- let sandbox,serverFlag;
- for(let index=0;index<args.length;index++) {
-  const arg=args[index];
-  if(arg==='--')break;
-  if(arg==='--sandbox') {
-   sandbox=args[index+1] && !args[index+1].startsWith('-') ? args[++index] : true;
-  } else if(arg.startsWith('--sandbox=')) {
-   sandbox=arg.slice('--sandbox='.length);
-  } else if(arg==='--server') {
-   if(!args[index+1] || args[index+1].startsWith('-'))return null;
-   serverFlag=args[++index];
-  } else if(arg.startsWith('--server=')) {
-   serverFlag=arg.slice('--server='.length);
-  }
- }
- if(sandbox!==undefined && sandbox!==true && sandbox!=='native')return null;
- const native=sandbox==='native';
- // Native rejects --server and ignores legacy sandbox URL aliases. Cloud's
- // --server default is CODEM_SERVER_URL, before the sandbox-config fallbacks.
- if(native && serverFlag!==undefined)return null;
- const candidates=native ? [env.CODEM_SERVER_URL,'https://codem.feishu.cn'] : [serverFlag===undefined ? env.CODEM_SERVER_URL : serverFlag,env.CODEM_SANDBOX_SERVER_URL,env.SANDBOX_SERVER_URL,env.SERVER_URL,'http://localhost:3000'];
- const server=candidates.find(value=>typeof value==='string' && value.trim()).trim();
- const url=new URL(rewriteUrlForTtEnv(server,env));
- if (!['http:','https:'].includes(url.protocol) || url.username || url.password) return null;
- url.pathname=`${url.pathname.replace(/\/+$/,'') || '/goapi/codem'}/sandbox/telemetry/workflow_metrics`;
- url.search='';url.hash='';
- return {url,headers:{'Content-Type':'application/json',Authorization:`Bearer sandbox_${env.CODEM_TOKEN}`,...ttEnvHeadersFor(url,env)}};
-}
-
-export async function reportWorkerRuntime(runtime,{env=process.env,args=process.argv.slice(2),signal,timeoutMS=750}={}) {
- try {
-  const target=workerRuntimeTelemetryTarget({env,args});
-  if (!target || signal?.aborted) return false;
-  const body=JSON.stringify({worker_runtime:{dispatch_id:env.CODEM_SANDBOX_DISPATCH_ID,family:runtime.family,cli_version:runtime.cliVersion,core_version:runtime.coreVersion}});
-  return await new Promise(resolve=>{
-   let timer,finished=false;
-   const done=value=>{if(finished)return;finished=true;clearTimeout(timer);resolve(value);};
-   const request=(target.url.protocol==='https:'?https:http).request(target.url,{method:'POST',headers:{...target.headers,'Content-Length':Buffer.byteLength(body)},signal},response=>{
-    let payload='';
-    response.on('data',chunk=>{payload+=chunk;if(payload.length>4096){done(false);request.destroy();}});
-    response.once('error',()=>done(false));
-    response.once('end',()=>{try{done(response.statusCode===200 && JSON.parse(payload).accepted===true);}catch{done(false);}});
-   });
-   request.once('error',()=>done(false));
-   timer=setTimeout(()=>{done(false);request.destroy();},timeoutMS);
-   timer.unref();
-   request.end(body);
-  });
- } catch { return false; }
-}
-
-export function observeWorkerRuntime(runtime,options={}) {
- const controller=new AbortController();
- let timer;
- // Native's dispatch token may only be materialized by the child's first
- // normal Sync. Bounded retries do not acquire a lease or replay a task.
- const delays=[1000,5000,30000];
- const attempt=async index=>{
-  const accepted=await reportWorkerRuntime(runtime,{...options,signal:controller.signal});
-  if(accepted || controller.signal.aborted || index===delays.length)return;
-  timer=setTimeout(()=>void attempt(index+1),delays[index]);timer.unref();
- };
- void attempt(0);
- return ()=>{clearTimeout(timer);controller.abort();};
-}

package/bin/worker-runtime.js

@@ -1,294 +0,0 @@
-// Startup-only routing. Keep this module independent of Bridge business imports:
-// it is also executed by container entrypoints before either Bridge is loaded.
-import { spawn } from 'node:child_process';
-import { createHash, randomUUID } from 'node:crypto';
-import fs from 'node:fs/promises';
-import { constants as fsConstants } from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { setTimeout as delay } from 'node:timers/promises';
-import { applyHostedWindowsChildOptions } from './platform-child-process.js';
-import { resolveEffectiveLincoHome, resolveLincoSessionsRoot, sameRecoveryPath } from './linco-paths.js';
-import { observeWorkerRuntime } from './worker-runtime-telemetry.js';
-
-export const WORKER_HOST_HOME = process.env.CODEM_WORKER_HOST_HOME || path.join(os.homedir(), '.codem');
-export const WORKER_RUNTIME_ROOT = path.join(WORKER_HOST_HOME, 'worker-runtimes');
-export const EXACT_RUNTIME_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
-const families = ['stable', 'current'];
-
-
-async function readJSON(file) { return JSON.parse(await fs.readFile(file, 'utf8')); }
-async function confinedFile(root, relative) {
- if (typeof relative !== 'string' || !relative || path.isAbsolute(relative)) throw new Error('invalid runtime path');
- const realRoot = await fs.realpath(root);
- const resolved = await fs.realpath(path.resolve(realRoot, relative));
- const inside = path.relative(realRoot, resolved);
- if (!inside || inside === '..' || inside.startsWith(`..${path.sep}`) || path.isAbsolute(inside)) throw new Error('runtime path escapes pair');
- if (!(await fs.stat(resolved)).isFile()) throw new Error('runtime entry is not a file');
- return resolved;
-}
-
-// Only installers write these immutable pair manifests. No npm resolution or
-// floating global/current Core lookup happens in the execution process.
-export async function readWorkerRuntime(root, family, { version = null, generation = null } = {}) {
- if (!families.includes(family)) throw new Error('invalid worker runtime');
- const familyRoot = path.join(root, family);
- let pointerChannel = null;
- let runtimeRoot = version ? path.join(familyRoot, 'versions', version) : familyRoot;
- if (version && !EXACT_RUNTIME_VERSION.test(version)) throw new Error('invalid runtime version');
- if (!version) try {
-  const pointer = await readJSON(path.join(familyRoot, 'current.json'));
-  if (!EXACT_RUNTIME_VERSION.test(pointer.version)) throw new Error('invalid runtime pointer');
-  pointerChannel = pointer.channel;
-  version = pointer.version;
-  generation = pointer.generation ?? null;
-  runtimeRoot = path.join(familyRoot, 'versions', version);
- } catch (error) { if (error.code !== 'ENOENT') throw error; }
- if (generation !== null) {
-  if (typeof generation !== 'string' || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(generation) || !version) throw new Error('invalid runtime generation');
-  runtimeRoot = path.join(familyRoot, 'generations', generation, 'versions', version);
- }
- const relative = path.relative(await fs.realpath(familyRoot), await fs.realpath(runtimeRoot));
- if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) throw new Error('runtime generation escapes family');
- const manifest = await readJSON(path.join(runtimeRoot, 'runtime-manifest.json'));
- if (manifest.schema !== 1 || manifest.family !== family || !EXACT_RUNTIME_VERSION.test(manifest.cliVersion) || !EXACT_RUNTIME_VERSION.test(manifest.coreVersion)) throw new Error('invalid runtime manifest');
- if (manifest.workflowPrebound !== (family === 'current')) throw new Error('runtime architecture does not match family');
- if (version && manifest.cliVersion !== version) throw new Error('runtime pointer version does not match pair');
- const cliEntry = await confinedFile(runtimeRoot, manifest.cliEntry);
- const corePath = await confinedFile(runtimeRoot, manifest.coreBinaryPath);
- return { ...manifest, ...(pointerChannel ? { channel: pointerChannel } : {}), generation, root: runtimeRoot, cliEntry, corePath };
-}
-
-function routeIdentity(env) {
- const values = [env.CODEM_SANDBOX_TENANT_KEY, env.CODEM_SANDBOX_PROJECT_KEY, env.CODEM_SANDBOX_SESSION_ID];
- if (values.some(value => typeof value !== 'string' || !value.trim() || value.length > 1024 || /[\0\r\n]/.test(value))) throw new Error('worker runtime requires trusted tenant/project/session');
- const scope = createHash('sha256').update(JSON.stringify(values)).digest('hex');
- const lincoHome = resolveEffectiveLincoHome({ env });
- const sessions = resolveLincoSessionsRoot({ env, effectiveLincoHome: lincoHome });
- const directory = path.join(path.dirname(sessions), 'worker-runtime-routes');
- const dispatch = env.CODEM_SANDBOX_DISPATCH_ID;
- if (typeof dispatch !== 'string' || !dispatch.trim() || dispatch.length > 1024 || /[\0\r\n]/.test(dispatch)) throw new Error('worker runtime requires trusted dispatch');
- const executionScope = createHash('sha256').update(JSON.stringify([scope, dispatch])).digest('hex');
- return { scope, lincoHome, sessions, markerPath: path.join(directory, `${scope}.json`), executionScope,
-  executionPath: path.join(directory, `${scope}-${executionScope}.json`) };
-}
-
-// This is only architecture routing, not a second checkpoint validator. Source
-// adoption is committed to the original Root before the new main Agent starts
-// (Core resume_prebound / SourceTaskAttached). Core still owns full replay,
-// identity, compatibility and the existing recovery locks.
-async function retainedRootMatches(lincoHome, metadata, file, tos) {
- const runId = metadata?.run_id;
- if (typeof runId !== 'string' || !runId) return true;
- const bindingPath = path.join(lincoHome, 'workflow-runs', 'locks', `${createHash('sha256').update(runId).digest('hex')}.lock`);
- let handle;
- try { handle = await fs.open(bindingPath, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0)); }
- catch (error) { if (error.code === 'ENOENT') return true; throw error; }
- let retained;
- try {
-  const limit = 4 * 1024 * 1024;
-  const stat = await handle.stat();
-  if (!stat.isFile()) throw new Error('workflow recovery binding is not a regular file');
-  if (stat.size > limit) throw new Error('workflow recovery binding exceeds replay limit');
-  const chunks = [], buffer = Buffer.allocUnsafe(64 * 1024);
-  let size = 0;
-  for (;;) {
-   const { bytesRead } = await handle.read(buffer, 0, buffer.length, null);
-   if (!bytesRead) break;
-   size += bytesRead;
-   if (size > limit) throw new Error('workflow recovery binding exceeds replay limit');
-   chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
-  }
-  try { retained = JSON.parse(Buffer.concat(chunks).toString('utf8')); }
-  catch { throw new Error('invalid retained workflow binding'); }
- } finally { await handle.close(); }
- // The retained binding, not today's sandbox type, froze the Root layout.
- // Core still validates its complete contents and canonical workspace later.
- const retainedTos = retained.storage_profile === 'tos_v1';
- if (!retainedTos && retained.storage_profile !== undefined) throw new Error('unsupported retained workflow storage profile');
- if (retainedTos !== tos || retained.initial_state?.metadata?.run_id !== runId ||
-  retained.initial_state?.metadata?.root_session_id !== metadata.root_session_id) return false;
- if (typeof retained.root_session_path !== 'string' || !path.isAbsolute(retained.root_session_path)) throw new Error('invalid retained workflow root path');
- return sameRecoveryPath(retained.root_session_path, await fs.realpath(file));
-}
-
-async function historicalFamily(sessions, session, lincoHome) {
- if (!session || /[/\\\0]/.test(session) || session === '.' || session === '..') throw new Error('invalid recovery session');
- let directories;
- try { directories = await fs.readdir(sessions, { withFileTypes: true }); }
- catch (error) { if (error.code === 'ENOENT') return null; throw error; }
- let found = false;
- for (const entry of directories) {
-  if (!entry.isDirectory()) continue;
-  for (const layout of ['', 'workflow-tos-v1']) {
-  const file = path.join(sessions, entry.name, layout, `${session}.jsonl`);
-  let handle;
-  try { handle = await fs.open(file, 'r'); }
-  catch (error) { if (error.code === 'ENOENT') continue; throw error; }
-  try {
-   // Same replay/record bounds as WorkflowStoreLimits; never load all Sessions.
-   if ((await handle.stat()).size > 64 * 1024 * 1024) throw new Error('workflow recovery history exceeds replay limit');
-   let pending = Buffer.alloc(0), root = null;
-   for await (const chunk of handle.createReadStream()) {
-    pending = Buffer.concat([pending, chunk]);
-    let newline;
-    while ((newline = pending.indexOf(10)) !== -1) {
-     if (newline > 4 * 1024 * 1024) throw new Error('workflow recovery record exceeds replay limit');
-     let value;
-     try { value = JSON.parse(pending.subarray(0, newline).toString('utf8')); }
-     catch { throw new Error('invalid workflow recovery history'); }
-     pending = pending.subarray(newline + 1);
-     if (root === null) {
-      if (value.type !== 'workflow_metadata' || value.record?.initial_state?.metadata?.root_session_id !== session) { root = false; break; }
-      if (!await retainedRootMatches(lincoHome, value.record.initial_state.metadata, file, layout === 'workflow-tos-v1')) { root = false; break; }
-      root = found = true;
-      if (value.record.local_execution || value.record.initialization?.local_execution) return 'current';
-     }
-     if (root && value.type === 'workflow_local' && value.record?.event?.kind === 'source_task_attached') return 'current';
-    }
-    if (root === false) break;
-    if (pending.length > 4 * 1024 * 1024) throw new Error('workflow recovery record exceeds replay limit');
-   }
-  } finally { await handle.close(); }
-  }
- }
- return found ? 'stable' : null;
-}
-
-async function promoteRoute(markerPath, scope) {
- // Join any first publisher before promotion, so a delayed stable reservation
- // cannot replace a current record published from durable recovery evidence.
- if (await recordRoute(markerPath, scope, 'current') === 'current') return;
- const temporary = `${markerPath}.${randomUUID()}.tmp`;
- try {
-  await fs.mkdir(path.dirname(markerPath), { recursive: true, mode: 0o700 });
-  await fs.writeFile(temporary, `${JSON.stringify({ schema: 1, scope, family: 'current' })}\n`, { mode: 0o600, flag: 'wx' });
-  await fs.rename(temporary, markerPath);
- } finally { await fs.rm(temporary, { force: true }); }
-}
-async function readRoute(markerPath, scope) {
- try {
-  let contents = await fs.readFile(markerPath, 'utf8');
-  // Exclusive creation reserves the name before complete-log rename on TOS.
-  // Only the empty reservation is transient; corrupt records fail immediately.
-  // A killed publisher leaves refusal evidence, never a reusable empty slot.
-  for (let attempt = 0; contents === '' && attempt < 100; attempt++) {
-   await delay(50);
-   contents = await fs.readFile(markerPath, 'utf8');
-  }
-  if (contents === '') throw new Error('runtime route publication incomplete');
-  const marker = JSON.parse(contents);
-  if (marker.schema !== 1 || marker.scope !== scope || !families.includes(marker.family)) throw new Error('identity or schema mismatch');
-  return marker.family;
- } catch (error) {
-  if (error.code === 'ENOENT') return null;
-  throw new Error('invalid runtime route', { cause: error });
- }
-}
-async function recordRoute(markerPath, scope, family) {
- await fs.mkdir(path.dirname(markerPath), { recursive: true, mode: 0o700 });
- const temporary = `${markerPath}.${randomUUID()}.tmp`;
- try {
-  await fs.writeFile(temporary, `${JSON.stringify({ schema: 1, scope, family })}\n`, { mode: 0o600, flag: 'wx' });
-  // TOS rejects hard links and no-replace rename. Only the exclusive creator
-  // may replace its empty reservation with the complete record. Losers read it.
-  let reservation;
-  try { reservation = await fs.open(markerPath, 'wx', 0o600); }
-  catch (error) { if (error.code !== 'EEXIST') throw error; }
-  if (reservation) {
-   await reservation.close();
-   await fs.rename(temporary, markerPath);
-  }
- } finally { await fs.rm(temporary, { force: true }); }
- return readRoute(markerPath, scope);
-}
-
-export async function selectWorkerRuntime({ env = process.env, root = env.CODEM_WORKER_RUNTIME_ROOT || WORKER_RUNTIME_ROOT, loadRuntime = readWorkerRuntime, currentChannel = null } = {}) {
- const requested = env.CODEM_WORKER_RUNTIME;
- if (!families.includes(requested)) throw new Error('invalid worker runtime');
- const { scope, lincoHome, sessions, markerPath, executionScope, executionPath } = routeIdentity(env);
- let actual = await readRoute(markerPath, scope);
- const restoring = env.CODEM_TASK_MODE === 'resume';
- const upgradeFrom = env.CODEM_WORKER_RUNTIME_UPGRADE_FROM;
- if (upgradeFrom !== undefined && (upgradeFrom !== 'stable' || !restoring || requested !== 'current')) throw new Error('invalid worker runtime upgrade');
- if (restoring && actual !== 'current') {
-  const historical = await historicalFamily(sessions, env.CODEM_SANDBOX_SESSION_ID, lincoHome);
-  if (historical === 'current') {
-   await promoteRoute(markerPath, scope);
-   actual = 'current';
-  }
- }
- const frozen = await readRoute(executionPath, executionScope);
- if (frozen === 'stable' && actual === 'current') throw new Error('execution runtime conflicts with retained current state');
- const upgrading = restoring && actual === 'stable' && requested === 'current' && !frozen;
- const reasons = [];
- const load = async family => {
-  try {
-   const runtime = await loadRuntime(root, family);
-   // A retained alpha pair can recover its own Session, but cannot serve a new
-   // latest-channel Session after a failed channel switch.
-   if ((!actual || upgrading) && !frozen && family === 'current' && currentChannel !== null) {
-    const channel = typeof currentChannel === 'function' ? await currentChannel() : currentChannel;
-    if (runtime.channel !== channel) throw new Error('worker runtime channel unavailable');
-   }
-   return runtime;
-  } catch { reasons.push(`${family}_unavailable`); return null; }
- };
- let runtime = await load(frozen || (actual === 'current' ? 'current' : restoring ? requested : actual || requested));
- if (!frozen && actual !== 'current' && !runtime && requested === 'current') runtime = await load('stable');
- if (!runtime) throw new Error(`${actual ? 'required ' : ''}runtime unavailable: ${reasons.join(',')}`);
- if (!actual) {
-  actual = await recordRoute(markerPath, scope, runtime.family);
-  if (actual !== runtime.family) {
-   runtime = await load(actual);
-   if (!runtime) throw new Error('required runtime unavailable after concurrent selection');
-  }
- }
- // Freeze fallback per Dispatch, independently of the monotonic Session family.
- // A later user recovery has a new Dispatch; command retries keep this choice.
- const executionFamily = await recordRoute(executionPath, executionScope, runtime.family);
- if (executionFamily !== runtime.family) {
-  if (executionFamily === 'stable' && await readRoute(markerPath, scope) === 'current') throw new Error('execution runtime conflicts with retained current state');
-  runtime = await load(executionFamily);
-  if (!runtime) throw new Error('required runtime unavailable after concurrent execution selection');
- }
- if (restoring && actual === 'stable' && runtime.family === 'current') await promoteRoute(markerPath, scope);
- return { ...runtime, runtimeRoot: root, lincoHome, sessionsRoot: sessions, requested, markerPath, fallbackReason: requested !== runtime.family ? reasons.join(',') || 'session_family' : null };
-}
-
-export function launchWorkerRuntime(runtime, { args = process.argv.slice(2), env = process.env, nodePath = process.execPath, invocation = null, log = console.error } = {}) {
- log(JSON.stringify({ event: 'worker_runtime_selected', requested_family: runtime.requested, actual_family: runtime.family, fallback_reason: runtime.fallbackReason,
-  bridge_version: runtime.cliVersion, core_version: runtime.coreVersion, pair: `${runtime.cliVersion}/${runtime.coreVersion}`, dispatch_id: env.CODEM_SANDBOX_DISPATCH_ID, session_id: env.CODEM_SANDBOX_SESSION_ID }));
- return new Promise((resolve, reject) => {
-  const launch = invocation || { command: nodePath, args: [runtime.cliEntry, ...args] };
-  const child = spawn(launch.command, launch.args, applyHostedWindowsChildOptions({ ...launch.options, stdio: 'inherit', env: { ...env,
-   // Keep relative/empty overrides frozen even if business startup changes cwd.
-   ...(runtime.lincoHome ? { LINCO_HOME: runtime.lincoHome } : {}),
-   ...(runtime.sessionsRoot ? { LINCO_SESSIONS_ROOT: runtime.sessionsRoot } : {}),
-   CODEM_LINCO_PATH: runtime.corePath, CODEM_WORKER_RUNTIME_ROOT: runtime.runtimeRoot, CODEM_WORKER_RUNTIME_READY: '1', CODEM_WORKER_RUNTIME_ACTUAL: runtime.family, CODEM_WORKER_CLI_VERSION: runtime.cliVersion, CODEM_WORKER_CORE_VERSION: runtime.coreVersion,
-   CODEM_PLUGIN_NODE: env.CODEM_PLUGIN_NODE || nodePath,
-   CODEM_SKIP_UPDATE_CHECK: '1', CODEM_DISABLE_DAEMON_AUTO_UPDATE: '1' } }));
-  const stopObservation=observeWorkerRuntime(runtime,{env,args});
-  const signals = ['SIGTERM', 'SIGINT', 'SIGHUP'];
-  const handlers = signals.map(signal => () => { if (child.exitCode === null && child.signalCode === null) { try { child.kill(signal); } catch {} } });
-  signals.forEach((signal, index) => process.on(signal, handlers[index]));
-  const cleanup = () => {stopObservation();signals.forEach((signal, index) => process.off(signal, handlers[index]));};
-  child.once('error', error => { cleanup(); reject(error); });
-  child.once('exit', (code, signal) => { cleanup(); resolve(code ?? (signal ? 128 + (os.constants.signals[signal] || 1) : 1)); });
- });
-}
-
-export function isWorkerRuntimeStartup(args = process.argv.slice(2), env = process.env) {
- return env.CODEM_WORKER_RUNTIME !== undefined && env.CODEM_WORKER_RUNTIME_READY !== '1' && args[0] === 'daemon' && args.some(arg => arg === '--sandbox' || arg.startsWith('--sandbox='));
-}
-
-// Container entrypoints invoke this directly, with a baked immutable root.
-async function runStandalone() {
- try {
-  const runtime = await selectWorkerRuntime();
-  process.exitCode = await launchWorkerRuntime(runtime, { nodePath: process.execPath });
- } catch (error) { console.error(`worker runtime startup failed: ${error.message}`); process.exitCode = 1; }
-}
-
-if (typeof Bun === 'undefined' && process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) void runStandalone();

package/profile/worker-runtime-observation.js

@@ -1,10 +0,0 @@
-const exactVersion = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
-
-// Low-cardinality process context shared by existing logs, metric categories,
-// and tracing. Ordinary personal-Bot processes have no worker attribution.
-export function workerRuntimeAttributes(env = process.env) {
- if (env.CODEM_WORKER_RUNTIME_READY !== '1' || !['stable', 'current'].includes(env.CODEM_WORKER_RUNTIME_ACTUAL)) return {};
- return { worker_runtime_family: env.CODEM_WORKER_RUNTIME_ACTUAL,
-  ...(exactVersion.test(env.CODEM_WORKER_CLI_VERSION || '') ? { worker_cli_version: env.CODEM_WORKER_CLI_VERSION } : {}),
-  ...(exactVersion.test(env.CODEM_WORKER_CORE_VERSION || '') ? { worker_core_version: env.CODEM_WORKER_CORE_VERSION } : {}) };
-}