@linzumi/cli 1.0.106 → 1.0.107

package/README.md

@@ -58,7 +58,7 @@ Install the CLI or run it with `npx`:
 ```bash
 npm install -g @linzumi/cli@latest
 npx -y @linzumi/cli@latest signup
-npx -y @linzumi/cli@1.0.106 --version
+npx -y @linzumi/cli@1.0.107 --version
 linzumi --version
 ```
 

package/dist/index.js

@@ -1473,7 +1473,7 @@ To kick the agent off:
 `,L=Buffer.byteLength(P,"utf8");if(L>s)return l("runner_diagnostics.spool_entry_dropped",{reason:"entry_too_large",entry_bytes:L,max_entry_bytes:s}),!1;_Se(n,{recursive:!0}),m(u)+L>i&&f(),_(L);let D=w()?`
 `:"";return gSe(u,`${D}${P}`,"utf8"),!0}catch(R){return l("runner_diagnostics.spool_failed",{error:R instanceof Error?R.message:String(R)}),!1}},v=k=>{let R=[],P=wSe(k,"utf8");for(let L of P.split(`
 `))if(L.trim()!=="")try{let D=JSON.parse(L);D!==null&&typeof D=="object"&&R.push({parsed:D,raw:L})}catch{}return R};return{append:S,drain:async k=>{if(c)return{uploadedBatches:0,uploadedEntries:0,remainingBatches:p().length,skipped:!0};c=!0;let R=0,P=0;try{f(),_(0);let L=a()-o;for(let D of p()){let j;try{j=v(D)}catch(Z){l("runner_diagnostics.spool_batch_unreadable",{file:D,error:Z instanceof Error?Z.message:String(Z)}),y(D,"unreadable");continue}let q=j.filter(Z=>{let me=FSe(Z.parsed);return me===void 0||me>=L});if(q.length===0){y(D,"empty_or_expired");continue}let E=uP(D,".jsonl"),B=q.map(Z=>Z.raw).join(`
-`),z=q.map(Z=>Z.parsed.spooled_at).filter(Z=>typeof Z=="string"),W={bundle_name:"runner-diagnostics-spool",exported_at:new Date(a()).toISOString(),idempotency_key:E,diagnostics:{kind:"runner_diagnostic_log",spool_batch:!0,idempotency_key:E,entry_count:q.length,...z.length===0?{}:{first_spooled_at:z[0],last_spooled_at:z[z.length-1]}},telemetry_ndjson:B};try{await k(W)}catch(Z){l("runner_diagnostics.spool_upload_failed",{file:D,remaining_batches:p().length,error:Z instanceof Error?Z.message:String(Z)});break}R+=1,P+=q.length;try{k9(D)}catch(Z){l("runner_diagnostics.spool_delete_failed",{file:D,error:Z instanceof Error?Z.message:String(Z)})}}}catch(L){l("runner_diagnostics.spool_drain_failed",{error:L instanceof Error?L.message:String(L)})}finally{c=!1}return{uploadedBatches:R,uploadedEntries:P,remainingBatches:p().length,skipped:!1}},pendingBatchFiles:p}}var PSe,ISe,RSe,ESe,DSe,C9,ASe,$Se,P9=F(()=>{"use strict";ix();PSe=32*1024*1024,ISe=10080*60*1e3,RSe=4*1024*1024,ESe=1024*1024,DSe="spool.jsonl",C9=/^batch-(\d{1,16})-[0-9a-f-]+\.jsonl$/;ASe=/\b([A-Z][A-Z0-9_]{1,})=("[^"\n]*"|'[^'\n]*'|[^\s"'`;,)\]}]+)/g,$Se=/(?:\/(?:[A-Za-z0-9._@~+-]|%[0-9A-Fa-f]{2})+){2,}/g});var qt,lP,ea=F(()=>{"use strict";qt="1.0.106",lP=`linzumi ${qt}`});import{closeSync as R9,existsSync as fP,mkdirSync as qSe,openSync as E9,readFileSync as D9,renameSync as zSe,unlinkSync as yd,writeFileSync as NSe,writeSync as M9}from"node:fs";import{dirname as A9,join as USe}from"node:path";function mP(e){return e instanceof gs||e instanceof Error&&e.name===O9&&"lockPath"in e&&"heldBy"in e}function hP(e,n=Wn(),t){let r=t===void 0?encodeURIComponent(e):ud(t);return USe(A9(n),"runners",`${r}.lock`)}function g0(e){let n=hP(e.machineId,e.configPath,e.linzumiUrl),t=e.isPidAlive??U9,r=e.now??(()=>new Date),o=e.killPid??nke,i=r().toISOString(),s={version:1,machineId:e.machineId,runnerId:e.runnerId,pid:e.pid??process.pid,cwd:e.cwd,workspace:e.workspace,...e.linzumiUrl===void 0?{}:{linzumiUrl:qn(e.linzumiUrl)},...e.launchSource===void 0?{}:{launchSource:e.launchSource},startedAt:i,heartbeatAt:i,cliVersion:e.cliVersion??qt,...e.gracefulUpdateDrain===!0?{gracefulUpdateDrain:!0}:{}};VSe(e.machineId,e.configPath,e.linzumiUrl,t,r,o,e.onTakeover),WSe(n,s,t,r,o,e.onTakeover,e.beforeReadExistingLock,e.beforeReplaceStaleLock);let a=()=>L9(n,s,r),d=setInterval(a,$9);return d.unref(),{path:n,record:s,heartbeat:a,release:()=>{clearInterval(d),z9(n,s)}}}function L9(e,n,t){try{let r=x0(e);if(r===void 0||r.machineId!==n.machineId||r.runnerId!==n.runnerId||r.pid!==n.pid||r.startedAt!==n.startedAt)return;let o={...r,heartbeatAt:t().toISOString()},i=`${e}.tmp`;NSe(i,`${JSON.stringify(o,null,2)}
+`),z=q.map(Z=>Z.parsed.spooled_at).filter(Z=>typeof Z=="string"),W={bundle_name:"runner-diagnostics-spool",exported_at:new Date(a()).toISOString(),idempotency_key:E,diagnostics:{kind:"runner_diagnostic_log",spool_batch:!0,idempotency_key:E,entry_count:q.length,...z.length===0?{}:{first_spooled_at:z[0],last_spooled_at:z[z.length-1]}},telemetry_ndjson:B};try{await k(W)}catch(Z){l("runner_diagnostics.spool_upload_failed",{file:D,remaining_batches:p().length,error:Z instanceof Error?Z.message:String(Z)});break}R+=1,P+=q.length;try{k9(D)}catch(Z){l("runner_diagnostics.spool_delete_failed",{file:D,error:Z instanceof Error?Z.message:String(Z)})}}}catch(L){l("runner_diagnostics.spool_drain_failed",{error:L instanceof Error?L.message:String(L)})}finally{c=!1}return{uploadedBatches:R,uploadedEntries:P,remainingBatches:p().length,skipped:!1}},pendingBatchFiles:p}}var PSe,ISe,RSe,ESe,DSe,C9,ASe,$Se,P9=F(()=>{"use strict";ix();PSe=32*1024*1024,ISe=10080*60*1e3,RSe=4*1024*1024,ESe=1024*1024,DSe="spool.jsonl",C9=/^batch-(\d{1,16})-[0-9a-f-]+\.jsonl$/;ASe=/\b([A-Z][A-Z0-9_]{1,})=("[^"\n]*"|'[^'\n]*'|[^\s"'`;,)\]}]+)/g,$Se=/(?:\/(?:[A-Za-z0-9._@~+-]|%[0-9A-Fa-f]{2})+){2,}/g});var qt,lP,ea=F(()=>{"use strict";qt="1.0.107",lP=`linzumi ${qt}`});import{closeSync as R9,existsSync as fP,mkdirSync as qSe,openSync as E9,readFileSync as D9,renameSync as zSe,unlinkSync as yd,writeFileSync as NSe,writeSync as M9}from"node:fs";import{dirname as A9,join as USe}from"node:path";function mP(e){return e instanceof gs||e instanceof Error&&e.name===O9&&"lockPath"in e&&"heldBy"in e}function hP(e,n=Wn(),t){let r=t===void 0?encodeURIComponent(e):ud(t);return USe(A9(n),"runners",`${r}.lock`)}function g0(e){let n=hP(e.machineId,e.configPath,e.linzumiUrl),t=e.isPidAlive??U9,r=e.now??(()=>new Date),o=e.killPid??nke,i=r().toISOString(),s={version:1,machineId:e.machineId,runnerId:e.runnerId,pid:e.pid??process.pid,cwd:e.cwd,workspace:e.workspace,...e.linzumiUrl===void 0?{}:{linzumiUrl:qn(e.linzumiUrl)},...e.launchSource===void 0?{}:{launchSource:e.launchSource},startedAt:i,heartbeatAt:i,cliVersion:e.cliVersion??qt,...e.gracefulUpdateDrain===!0?{gracefulUpdateDrain:!0}:{}};VSe(e.machineId,e.configPath,e.linzumiUrl,t,r,o,e.onTakeover),WSe(n,s,t,r,o,e.onTakeover,e.beforeReadExistingLock,e.beforeReplaceStaleLock);let a=()=>L9(n,s,r),d=setInterval(a,$9);return d.unref(),{path:n,record:s,heartbeat:a,release:()=>{clearInterval(d),z9(n,s)}}}function L9(e,n,t){try{let r=x0(e);if(r===void 0||r.machineId!==n.machineId||r.runnerId!==n.runnerId||r.pid!==n.pid||r.startedAt!==n.startedAt)return;let o={...r,heartbeatAt:t().toISOString()},i=`${e}.tmp`;NSe(i,`${JSON.stringify(o,null,2)}
 `,"utf8"),zSe(i,e)}catch{}}function xd(e,n,t){if(!n(e.pid))return{state:"dead"};let r=e.heartbeatAt??e.startedAt,o=Date.parse(r);return Number.isNaN(o)||t().getTime()-o>BSe?{state:"wedged",reason:e.heartbeatAt===void 0?"missing_heartbeat":"stale_heartbeat"}:{state:"live"}}function j9(e,n,t,r){return t!==y0||e.launchSource!==y0?!1:r.state!=="live"?!0:JSe(n,e.cliVersion)>0}function JSe(e,n){let t=I9(e),r=I9(n);for(let o=0;o<3;o++){let i=t.core[o],s=r.core[o];if(i===void 0||s===void 0)throw new Error(`compareCliVersions: unexpected undefined at core index ${o}`);if(i!==s)return i>s?1:-1}return t.prerelease.length===0&&r.prerelease.length===0?0:t.prerelease.length===0?1:r.prerelease.length===0?-1:KSe(t.prerelease,r.prerelease)}function I9(e){let n=e.trim().replace(/^v/i,"").split("+",1)[0]??"",t=n.indexOf("-"),r=t===-1?n:n.slice(0,t),o=t===-1?"":n.slice(t+1),i=r.split("."),s=[pP(i[0]),pP(i[1]),pP(i[2])],a=o===""?[]:o.split(".").filter(d=>d!=="");return{core:s,prerelease:a}}function pP(e){let n=Number.parseInt(e??"",10);return Number.isInteger(n)&&n>=0?n:0}function KSe(e,n){let t=Math.max(e.length,n.length);for(let r=0;r<t;r++){let o=e[r],i=n[r];if(o===void 0)return-1;if(i===void 0)return 1;let s=Number.parseInt(o,10),a=Number.parseInt(i,10),d=s.toString()===o,u=a.toString()===i;if(d&&u){if(s!==a)return s>a?1:-1}else{if(d!==u)return d?-1:1;if(o!==i)return o>i?1:-1}}return 0}function F9(e,n,t,r,o){try{r(n.pid)}catch(i){let s=i!==null&&typeof i=="object"&&"code"in i?i.code:void 0;if(s!=="ESRCH")throw s==="EPERM"||s==="EACCES"?new Error(`Cannot take over the runner lock at ${e}: its holder process (pid ${n.pid}) is owned by another user and cannot be stopped. Stop that process, or remove the lock file, then retry.`):i}o?.({lockPath:e,holderPid:n.pid,holderRunnerId:n.runnerId,reason:t})}function VSe(e,n,t,r,o,i,s){if(t===void 0||yr(t)!==yr(Jt))return;let a=hP(e,n),d=x0(a);if(d!==void 0){if(xd(d,r,o).state==="live")throw new gs(a,d);q9(a,r,()=>{let u=fP(a)?gP(a):void 0;if(u===void 0)return;let c=xd(u,r,o);if(c.state==="live")throw new gs(a,u);c.state==="wedged"&&F9(a,u,c.reason,i,s),yd(a)})}}function WSe(e,n,t,r,o,i,s,a){if(h0(e,n))return;s?.();let d=x0(e);if(d===void 0){if(h0(e,n))return;throw new Error(`another Linzumi runner lock appeared while starting: ${e}`)}if(xd(d,t,r).state==="live")throw new gs(e,d);a?.(),q9(e,t,()=>{let u=fP(e)?gP(e):void 0;if(u!==void 0){let c=xd(u,t,r);if(c.state==="live")throw new gs(e,u);c.state==="wedged"&&F9(e,u,c.reason,o,i),yd(e)}if(!h0(e,n))throw new Error(`another Linzumi runner lock appeared while starting: ${e}`)})}function h0(e,n){qSe(A9(e),{recursive:!0});try{let t=E9(e,"wx");try{M9(t,`${JSON.stringify(n,null,2)}
 `)}finally{R9(t)}return!0}catch(t){if(Kc(t,"EEXIST"))return!1;throw t}}function q9(e,n,t){let r=`${e}.replace`;for(;;)try{let o=E9(r,"wx");try{M9(o,`${process.pid}
 `),t()}finally{R9(o),yd(r)}return}catch(o){if(Kc(o,"EEXIST")){let i=HSe(r);if(i===void 0)continue;if(n(i))throw new Error(["another Linzumi runner is already replacing a stale runner lock",`lock: ${e}`,"Wait for that startup to finish, then retry."].join(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linzumi/cli",
-  "version": "1.0.106",
+  "version": "1.0.107",
   "description": "Linzumi CLI \u2014 point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.",
   "type": "module",
   "bin": {

package/scripts/build-harness-codex-parity-oracle.mjs

@@ -0,0 +1,465 @@
+// Spec: kandan/plans/2026-07-10-compute-nodes-rescript-commander-zero-ts-program.md
+// (M3 cluster 7, harness-codex-adapter / workstream H.2).
+// Relationship: Builds the TS-side PARITY ORACLE for the codex-adapter
+// cluster of the ReScript commander port, the sibling of
+// build-session-registry-parity-oracle.mjs (cluster 6). The oracle bundles
+// the REAL TS codex-adapter surface - the app-server module's exported
+// builders (argv/config/env/provider args, stdio, the forwardable-key
+// resolver), the isolated-codex-home module (config.toml, the auth.json
+// carry-through, the effective-auth probes), the parent-death watchdog
+// module (program bytes, config codec, the reap trigger), the shared
+// engine-child reaper, the dev-server reap-exemption read slice, the
+// attach-wait module (tracker semantics, bounded-wait error text, the
+// rollout probe), the runtime-options mapping (approval-policy gates,
+// thread/turn override rendering), the turn-fate status classifier, and
+// runner.ts's exported thread-start runtime param renderer +
+// resumeCodexThreadForReconnect - behind two drivers:
+//
+//   * the cluster 1/2 one-shot BATCH driver (a JSON array of cases on
+//     stdin, a JSON array of results on stdout) for the pure transforms;
+//   * a --flow line driver (the cluster 4 transport-oracle convention:
+//     one JSON op per stdin line, {id,...} replies + {obs:...} events on
+//     stdout) that runs the REAL connectCodexAppServer client - and the
+//     REAL resumeCodexThreadForReconnect recovery flow - against a live
+//     scripted codex app-server double URL, for the dual-impl wire
+//     differential in @linzumi/commander-harness.
+//
+// Determinism: clocks are injected per case (the tracker takes now()), the
+// scratch dirs ride the case inputs, and nothing here reads wall time
+// except the flow driver's transport waits (sequenced on awaited replies).
+//
+// SECRETS: the oracle only ever sees the conformance suite's synthetic
+// payloads; auth flow cases use distinctive synthetic credentials minted by
+// the suite. The output is a local test artifact (.differential/ is
+// gitignored, never published) and stays unminified for debuggability.
+import { copyFile, mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+const driverSource = `
+import {
+  codexAppServerArgs,
+  codexAppServerConfigArgs,
+  codexAppServerStdio,
+  codexModelProviderConfigArgs,
+  connectCodexAppServer,
+  resolveForwardableOpenAiApiKey,
+} from './src/codexAppServer';
+import {
+  codexCredentialStoreFileArgs,
+  ensureIsolatedCodexHome,
+  inheritUserCodexAuth,
+  isolatedCodexHomePath,
+  resolveOpenAiAuthState,
+  userCodexHomePath,
+} from './src/codexHome';
+import {
+  encodeParentDeathWatchdogConfig,
+  parseParentDeathWatchdogConfig,
+  parentDeathWatchdogProgram,
+  parentDeathWatchdogShouldReap,
+  parentDeathWatchdogSpawn,
+} from './src/engineParentDeathWatchdog';
+import {
+  killProcessGroupWithProtectedListeners,
+  parsePidPgidRows,
+  protectedListenerFreshnessMs,
+  readProtectedPidsFromDir,
+} from './src/devServerReapExemption';
+import {
+  CODEX_ATTACH_WAIT_HARD_CAP_MS,
+  CODEX_ATTACH_WAIT_HEARTBEAT_MS,
+  CodexAttachWaitHardCapError,
+  CodexAttachWaitNoProgressError,
+  CodexSessionAttachFailedError,
+  awaitCodexSessionAttach,
+  codexAttachWaitHardCapMs,
+  codexRolloutFileBytesForThread,
+  createCodexAttachProgressTracker,
+} from './src/codexAttachWait';
+import {
+  codexApprovalPolicyForRequest,
+  codexThreadRuntimeOverrides,
+  codexTurnRuntimeOverrides,
+  codexWireApprovalPolicy,
+} from './src/codexRuntimeOptions';
+import { upstreamHttpStatusFate } from './src/terminalFailureRetry';
+import {
+  codexThreadStartRuntimeParams,
+  resumeCodexThreadForReconnect,
+} from './src/runner';
+import { readFileSync, statSync } from 'node:fs';
+import { createInterface } from 'node:readline';
+
+function tryCall(run) {
+  try {
+    return { ok: true, value: run() };
+  } catch (error) {
+    return {
+      ok: false,
+      message: error instanceof Error ? error.message : String(error),
+      name: error instanceof Error ? error.name : 'Error',
+    };
+  }
+}
+
+function fileSnapshot(path) {
+  try {
+    return {
+      exists: true,
+      contents: readFileSync(path, 'utf8'),
+      mode: statSync(path).mode & 0o777,
+    };
+  } catch {
+    return { exists: false };
+  }
+}
+
+function runCase(input) {
+  switch (input.kind) {
+    case 'appServerArgs':
+      return codexAppServerArgs(input.listenUrl, input.options ?? {});
+    case 'configArgs':
+      return codexAppServerConfigArgs(input.options ?? {});
+    case 'modelProviderArgs':
+      return codexModelProviderConfigArgs(input.provider);
+    case 'credentialStoreArgs':
+      return [...codexCredentialStoreFileArgs()];
+    case 'stdio':
+      return codexAppServerStdio();
+    case 'watchdogProgram':
+      return parentDeathWatchdogProgram();
+    case 'watchdogEncode':
+      return encodeParentDeathWatchdogConfig(input.config);
+    case 'watchdogParse':
+      return tryCall(() => parseParentDeathWatchdogConfig(input.raw));
+    case 'watchdogShouldReap':
+      return parentDeathWatchdogShouldReap(input.originalParentPid, input.currentParentPid);
+    case 'watchdogSpawn':
+      return parentDeathWatchdogSpawn(input.nodeExecPath, input.config);
+    case 'parsePidPgidRows':
+      return parsePidPgidRows(input.output);
+    case 'freshnessMs':
+      return protectedListenerFreshnessMs;
+    case 'readProtectedPids':
+      return [...readProtectedPidsFromDir(input.dir, input.nowMs)].sort((a, b) => a - b);
+    case 'groupKill': {
+      const kills = [];
+      const outcome = killProcessGroupWithProtectedListeners(
+        input.groupLeaderPid,
+        input.signal,
+        (pid, signal) => {
+          kills.push({ pid, signal });
+          const failure = (input.killFailures ?? {})[String(pid)];
+          if (failure !== undefined) {
+            const error = new Error(failure);
+            error.code = failure;
+            throw error;
+          }
+        },
+        () => (input.groupPids === null ? undefined : input.groupPids),
+        new Set(input.protectedPids ?? [])
+      );
+      return {
+        mode: outcome.mode,
+        sparedPids: [...outcome.sparedPids],
+        failureCodes: outcome.failures.map((failure) =>
+          failure.error instanceof Error && 'code' in failure.error
+            ? { pid: failure.pid, code: failure.error.code }
+            : { pid: failure.pid, code: null }
+        ),
+        kills: kills.sort((a, b) => a.pid - b.pid),
+      };
+    }
+    case 'attachConstants':
+      return {
+        hardCapMs: CODEX_ATTACH_WAIT_HARD_CAP_MS,
+        heartbeatMs: CODEX_ATTACH_WAIT_HEARTBEAT_MS,
+        hardCapOfEnv: codexAttachWaitHardCapMs(),
+      };
+    case 'attachMessages':
+      return {
+        attachFailed: new CodexSessionAttachFailedError(
+          input.method,
+          input.codexThreadId,
+          input.failure
+        ).message,
+        noProgress: new CodexAttachWaitNoProgressError({
+          method: input.method,
+          codexThreadId: input.codexThreadId,
+          timeoutMs: input.timeoutMs,
+          waitedMs: input.waitedMs,
+          blocker: input.blocker,
+          rollout: input.rollout,
+        }).message,
+        hardCap: new CodexAttachWaitHardCapError({
+          method: input.method,
+          codexThreadId: input.codexThreadId,
+          hardCapMs: input.hardCapMs,
+          blocker: input.blocker,
+          rollout: input.rollout,
+        }).message,
+      };
+    case 'attachTracker': {
+      // Scripted note/fail/clear/snapshot sequence with an injected clock.
+      let nowMs = 0;
+      const tracker = createCodexAttachProgressTracker(() => nowMs);
+      const snapshots = [];
+      for (const op of input.ops) {
+        nowMs = op.nowMs ?? nowMs;
+        if (op.op === 'note') tracker.note(op.id, op.stage, op.detail ?? undefined);
+        if (op.op === 'fail') tracker.fail(op.id, op.failure);
+        if (op.op === 'clear') tracker.clear(op.id);
+        if (op.op === 'snapshot') {
+          const snapshot = tracker.snapshot(op.id);
+          snapshots.push(
+            snapshot === undefined
+              ? null
+              : {
+                  stage: snapshot.stage,
+                  detail: snapshot.detail ?? null,
+                  atMs: snapshot.atMs,
+                  failure: snapshot.failure ?? null,
+                }
+          );
+        }
+      }
+      return snapshots;
+    }
+    case 'attachWaitOutcome': {
+      // The bounded wait driven with a scripted clock: the underlying wait
+      // never settles, so the poller's verdict (fail-fast, no-progress,
+      // hard cap) is the observable. Poll cadence 1ms against a virtual
+      // clock stepped by the poll itself.
+      let nowMs = 0;
+      const tracker = createCodexAttachProgressTracker(() => nowMs);
+      for (const op of input.ops ?? []) {
+        nowMs = op.nowMs ?? nowMs;
+        if (op.op === 'note') tracker.note(input.codexThreadId, op.stage, op.detail ?? undefined);
+        if (op.op === 'fail') tracker.fail(input.codexThreadId, op.failure);
+      }
+      nowMs = input.startMs ?? 0;
+      const logs = [];
+      return awaitCodexSessionAttach({
+        method: input.method,
+        codexThreadId: input.codexThreadId,
+        wait: new Promise(() => {}),
+        tracker,
+        log: (event, payload) => logs.push({ event, payload }),
+        rolloutBytes: () => input.rolloutBytes ?? undefined,
+        noProgressTimeoutMs: input.noProgressTimeoutMs,
+        hardCapMs: input.hardCapMs,
+        heartbeatMs: input.heartbeatMs,
+        pollMs: 1,
+        now: () => {
+          nowMs += input.msPerPoll ?? 25;
+          return nowMs;
+        },
+      }).then(
+        () => ({ settled: 'resolved', logs }),
+        (error) => ({
+          settled: 'rejected',
+          name: error instanceof Error ? error.name : 'Error',
+          message: error instanceof Error ? error.message : String(error),
+          heartbeats: logs.length,
+        })
+      );
+    }
+    case 'rolloutBytes':
+      return codexRolloutFileBytesForThread(input.codexHome, input.codexThreadId) ?? null;
+    case 'approvalPolicyForRequest':
+      return tryCall(() =>
+        codexApprovalPolicyForRequest(input.approvalPolicy ?? undefined, input.sandbox ?? undefined, {
+          sandboxedNeverDefault: input.sandboxedNeverDefault,
+        })
+      );
+    case 'wireApprovalPolicy':
+      return tryCall(() =>
+        codexWireApprovalPolicy(input.approvalPolicy ?? undefined, input.sandbox ?? undefined, {
+          sandboxedNeverDefault: input.sandboxedNeverDefault,
+        })
+      );
+    case 'threadRuntimeOverrides':
+      return tryCall(() => codexThreadRuntimeOverrides(input.options));
+    case 'turnRuntimeOverrides':
+      return tryCall(() => codexTurnRuntimeOverrides(input.options));
+    case 'threadStartRuntimeParams':
+      return tryCall(() => codexThreadStartRuntimeParams(input.runtimeSettings));
+    case 'statusFate':
+      return upstreamHttpStatusFate(input.status);
+    case 'isolatedHomePath':
+      return isolatedCodexHomePath(input.env ?? {});
+    case 'userHomePath':
+      return userCodexHomePath(input.env ?? {});
+    case 'ensureIsolatedHome': {
+      const home = ensureIsolatedCodexHome(input.env ?? {});
+      return { home, config: fileSnapshot(home + '/config.toml') };
+    }
+    case 'inheritAuth': {
+      const installed = inheritUserCodexAuth(input.isolatedHome, input.env ?? {});
+      return { installed, dest: fileSnapshot(input.isolatedHome + '/auth.json') };
+    }
+    case 'authState':
+      return resolveOpenAiAuthState(input.env ?? {});
+    case 'forwardableKey':
+      return resolveForwardableOpenAiApiKey(input.env ?? {}) ?? null;
+    default:
+      return { unknownCase: input.kind };
+  }
+}
+
+async function runBatch() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  const cases = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+  const results = [];
+  for (const item of cases) {
+    const outcome = runCase(item);
+    if (outcome instanceof Promise) {
+      // The attach-wait poller is unref'd by design; hold the event loop
+      // open while the case settles or node would exit mid-await.
+      const keepAlive = setInterval(() => {}, 1000);
+      try {
+        results.push(await outcome);
+      } finally {
+        clearInterval(keepAlive);
+      }
+    } else {
+      results.push(outcome);
+    }
+  }
+  process.stdout.write(JSON.stringify(results));
+}
+
+// --- The flow driver (the dual-impl wire differential's TS leg) -------------
+
+async function runFlow() {
+  let client;
+  const obs = [];
+  const emit = (entry) => process.stdout.write(JSON.stringify({ obs: entry }) + '\\n');
+  const reply = (id, payload) =>
+    process.stdout.write(JSON.stringify({ id, ...payload }) + '\\n');
+
+  const rl = createInterface({ input: process.stdin });
+  for await (const line of rl) {
+    if (line.trim() === '') continue;
+    const op = JSON.parse(line);
+    try {
+      switch (op.op) {
+        case 'connect': {
+          client = await connectCodexAppServer(op.url);
+          client.onNotification((message) =>
+            emit({ kind: 'notification', method: message.method, params: message.params ?? null })
+          );
+          client.onClose?.(() => emit({ kind: 'closed' }));
+          reply(op.id, { ok: true });
+          break;
+        }
+        case 'armApproval': {
+          client.onRequest?.((request) => {
+            emit({ kind: 'server_request', method: request.method, params: request.params ?? null });
+            return { decision: op.decision };
+          });
+          reply(op.id, { ok: true });
+          break;
+        }
+        case 'request': {
+          const response = await client.request(op.method, op.params ?? undefined);
+          emit({ kind: 'reply', method: op.method, response });
+          reply(op.id, { ok: true });
+          break;
+        }
+        case 'resumeReconnect': {
+          const outcome = await resumeCodexThreadForReconnect(
+            client,
+            op.codexThreadId,
+            op.resumeOverrides ?? {},
+            {
+              forceRehydrate: op.forceRehydrate === true,
+              buildRehydrationText: async () => op.rehydrationText ?? 'scripted rehydration text',
+              log: (event, payload) => emit({ kind: 'log', event, payload }),
+            }
+          ).then(
+            (value) => ({ ok: true, value }),
+            (error) => ({
+              ok: false,
+              message: error instanceof Error ? error.message : String(error),
+            })
+          );
+          emit({ kind: 'resume_outcome', outcome });
+          reply(op.id, { ok: true });
+          break;
+        }
+        case 'close': {
+          client?.close();
+          reply(op.id, { ok: true });
+          rl.close();
+          return;
+        }
+        default:
+          reply(op.id, { ok: false, error: 'unknown op ' + op.op });
+      }
+    } catch (error) {
+      reply(op.id, {
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+}
+
+if (process.argv.includes('--flow')) {
+  runFlow().then(
+    () => process.exit(0),
+    (error) => {
+      process.stderr.write(String(error && error.stack ? error.stack : error) + '\\n');
+      process.exit(1);
+    }
+  );
+} else {
+  runBatch().then(
+    () => process.exit(0),
+    (error) => {
+      process.stderr.write(String(error && error.stack ? error.stack : error) + '\\n');
+      process.exit(1);
+    }
+  );
+}
+`;
+
+const outDir = join(packageRoot, '.differential');
+const outPath = join(outDir, 'harness-codex-parity-oracle.mjs');
+
+await mkdir(outDir, { recursive: true });
+// runner.ts's graph resolves assets/ relative to the bundle at import time
+// (the hello-project scaffold's inlined logo), so the asset must sit next
+// to the emitted oracle - the build-auth-parity-oracle precedent.
+await mkdir(join(outDir, 'assets'), { recursive: true });
+await copyFile(
+  join(packageRoot, 'src/assets/linzumi-logo.svg'),
+  join(outDir, 'assets/linzumi-logo.svg')
+);
+
+await build({
+  stdin: {
+    contents: driverSource,
+    resolveDir: packageRoot,
+    sourcefile: 'harness-codex-parity-driver.ts',
+    loader: 'ts',
+  },
+  bundle: true,
+  platform: 'node',
+  target: 'node20',
+  format: 'esm',
+  outfile: outPath,
+  minify: false,
+  sourcemap: false,
+  legalComments: 'none',
+  logLevel: 'silent',
+  external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
+});
+
+process.stdout.write(outPath + '\n');