@linzumi/cli 1.0.114 → 1.0.115

package/scripts/build-worker-spawn-parity-oracle.mjs

@@ -0,0 +1,814 @@
+// Spec: kandan/plans/2026-07-10-compute-nodes-rescript-commander-zero-ts-program.md
+// (M3 cluster 12, worker-spawn).
+// Relationship: Builds the TS-side PARITY ORACLE for the worker fork +
+// lifecycle + IPC protocol of the ReScript commander port. The oracle
+// bundles the REAL TS worker seams - the runner.ts spawn-path exports (the
+// worker argv render + redaction, the node loader exec-argv filter, the env
+// overlay, the ready-message parse, the ready-timeout vocabulary, the GAP A
+// bounded-respawn orchestrator, the doomed-start preflight, the
+// stillborn-worker vocabulary), the thread-worker IPC module (BOTH halves),
+// the worker output routing module, the active-worker-liveness state
+// machine, the remote codex harness worker's pure exports, and the worker
+// argv PARSE (parseThreadCodexWorkerArgs, imported lazily with a
+// neutralized argv[1] so the CLI entry's main-module gate can never fire) -
+// behind the cluster 1/2 one-shot BATCH driver (a JSON array of cases on
+// stdin, a JSON array of results on stdout).
+//
+// PROCESS MODE: invoked as `node <oracle> ipc-child <threadId>` the oracle
+// becomes a REAL IPC worker child running the REAL bindThreadCodexWorkerIpc
+// over process IPC with a scripted codex client - the cross-impl leg's TS
+// worker (a ReScript parent drives it; a TS parent drives the ReScript
+// child; the frames must be byte-identical either way).
+//
+// Determinism: IPC/microtask scheduling serializes through a bounded
+// microtask drain after every scripted step (the cluster 10 convention);
+// scratch paths normalize through "$DIR"; the remote join payload's
+// process material (pid, CLI version) normalizes through placeholders.
+//
+// SECRETS: synthetic case payloads only; .differential/ is gitignored.
+import { mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+const driverSource = `
+import { mkdirSync, mkdtempSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname as pathDirname, join } from 'node:path';
+import {
+  boundedWorkerOutputForTest,
+  isStillbornWorkerErrorForTest,
+  redactedThreadRunnerCliArgsForTest,
+  spawnThreadRunnerWithBoundedRespawnForTest,
+  stillbornWorkerFailedReasonForTest,
+  threadRunnerCliArgsForTest,
+  threadRunnerExitBeforeReadyMessageForTest,
+  threadRunnerNodeArgsForTest,
+  threadRunnerReadyMessageForTest,
+  threadRunnerReadyTimeoutErrorForTest,
+  threadRunnerReadyTimeoutMsForTest,
+  threadRunnerScriptPathForTest,
+  threadRunnerWorkerEnvOverlay,
+  threadStartTerminalFailureForTest,
+  threadWorkerPreflightFailureLineForTest,
+  threadWorkerStartPreflightFailureForTest,
+} from './src/runner';
+import {
+  bindThreadCodexWorkerIpc,
+  connectThreadCodexWorkerIpc,
+  isThreadCodexWorkerSessionClosedMessage,
+} from './src/threadCodexWorkerIpc';
+import {
+  createThreadWorkerOutputChunkHandler,
+  routeThreadWorkerOutputChunk,
+} from './src/threadWorkerOutputRouting';
+import {
+  createWorkerLivenessState,
+  defaultWorkerLivenessConfig,
+  recordPingSent,
+  recordPong,
+  recordProbeReply,
+  recordProbeSent,
+  shouldSendPing,
+  tickPongDeadline,
+  workerLivenessVerdict,
+} from './src/activeWorkerLiveness';
+import {
+  remoteCodexHarnessWorkerConfigFromEnv,
+  remoteCodexHarnessWorkerConfigFromJson,
+  remoteHarnessRunnerJoinPayload,
+  resolveLinzumiCliEntrypoint,
+} from './src/remoteCodexHarnessWorker';
+
+const dirPlaceholder = '$DIR';
+
+function scratch() {
+  return realpathSync(mkdtempSync(join(tmpdir(), 'linzumi-worker-spawn-oracle-')));
+}
+
+function substitute(value, from, to) {
+  if (typeof value === 'string') {
+    return value.split(from).join(to);
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => substitute(entry, from, to));
+  }
+  if (typeof value === 'object' && value !== null) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [
+        substitute(key, from, to),
+        substitute(entry, from, to),
+      ])
+    );
+  }
+  return value;
+}
+
+function outcome(run) {
+  try {
+    const value = run();
+    return value === undefined ? { defined: false } : { defined: true, value };
+  } catch (error) {
+    return {
+      threw: true,
+      message: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+async function drainMicrotasks() {
+  for (let tick = 0; tick < 8; tick += 1) {
+    await Promise.resolve();
+  }
+}
+
+// --- The scripted fake codex client (both the batch driver and ipc-child use it) ---
+
+function scriptedCodex(spec, trace) {
+  const notificationCallbacks = [];
+  const requestCallbacks = [];
+  const responses = spec.responses ?? {};
+  return {
+    surface: {
+      request: (method, params) => {
+        trace.push({ t: 'codexRequest', method, params: params ?? null });
+        const scripted = responses[method];
+        if (scripted === undefined) {
+          return Promise.resolve({ id: 0, result: { echoed: method } });
+        }
+        if (scripted.reject !== undefined) {
+          return Promise.reject(new Error(scripted.reject));
+        }
+        return Promise.resolve(scripted.response);
+      },
+      notify: (method, params) => {
+        trace.push({ t: 'codexNotify', method, params: params ?? null });
+      },
+      onNotification: (callback) => {
+        notificationCallbacks.push(callback);
+      },
+      onRequest:
+        spec.withoutOnRequest === true
+          ? undefined
+          : (callback) => {
+              requestCallbacks.push(callback);
+            },
+    },
+    emitNotification: (notification) => {
+      for (const callback of notificationCallbacks) {
+        callback(notification);
+      }
+    },
+    emitServerRequest: (request) => {
+      const settled = [];
+      for (const callback of requestCallbacks) {
+        settled.push(
+          Promise.resolve(callback(request)).then(
+            (value) => trace.push({ t: 'serverRequestResolved', value: value ?? null }),
+            (error) =>
+              trace.push({
+                t: 'serverRequestRejected',
+                message: error instanceof Error ? error.message : String(error),
+              })
+          )
+        );
+      }
+      return settled;
+    },
+  };
+}
+
+// --- ipc-child mode: the REAL TS worker half over REAL process IPC -----------------
+
+async function runIpcChild() {
+  const trace = [];
+  const codex = scriptedCodex(
+    {
+      responses: {
+        'thread/read': { response: { id: 7, result: { items: ['a', 'b'] } } },
+        'boom/method': { reject: 'scripted boom' },
+      },
+    },
+    trace
+  );
+  bindThreadCodexWorkerIpc(codex.surface);
+  // Scripted choreography driven by plain (non-worker-frame) IPC cues from
+  // the parent harness: emit a notification / a server request, then report
+  // the child-side trace.
+  process.on('message', (message) => {
+    if (message === null || typeof message !== 'object') {
+      return;
+    }
+    if (message.cue === 'emit_notification') {
+      codex.emitNotification(message.notification);
+      process.send?.({ cue: 'notification_emitted' });
+    } else if (message.cue === 'emit_server_request') {
+      void Promise.all(codex.emitServerRequest(message.request)).then(() => {
+        process.send?.({ cue: 'server_request_settled', trace });
+      });
+    } else if (message.cue === 'report') {
+      process.send?.({ cue: 'trace', trace });
+    } else if (message.cue === 'exit') {
+      process.exit(0);
+    }
+  });
+  process.send?.({ cue: 'child_ready' });
+  // Keep the event loop alive until the parent orders exit.
+  setInterval(() => {}, 60_000);
+}
+
+// --- Batch ops ----------------------------------------------------------------------
+
+function handleIpcWorker(testCase) {
+  const trace = [];
+  const sent = [];
+  const codex = scriptedCodex(testCase.codex ?? {}, trace);
+  let connected = true;
+  let sendMode = 'ok';
+  const ipc = {
+    send: (message) => {
+      if (sendMode === 'throw') {
+        throw new Error(testCase.sendThrowMessage ?? 'scripted send failure');
+      }
+      sent.push(message);
+      return true;
+    },
+    get connected() {
+      return connected;
+    },
+    on: (event, callback) => {
+      if (event === 'message') {
+        ipcMessageHandlers.push(callback);
+      }
+      return ipc;
+    },
+    once: (event, callback) => {
+      if (event === 'disconnect') {
+        disconnectHandlers.push(callback);
+      }
+      return ipc;
+    },
+  };
+  const ipcMessageHandlers = [];
+  const disconnectHandlers = [];
+
+  const run = async () => {
+    bindThreadCodexWorkerIpc(codex.surface, ipc);
+    for (const step of testCase.script ?? []) {
+      if (step.step === 'parentMessage') {
+        for (const handler of ipcMessageHandlers) {
+          handler(step.message);
+        }
+      } else if (step.step === 'notification') {
+        codex.emitNotification(step.notification);
+      } else if (step.step === 'serverRequest') {
+        codex.emitServerRequest(step.request);
+      } else if (step.step === 'disconnectChannel') {
+        connected = false;
+      } else if (step.step === 'sendMode') {
+        sendMode = step.mode;
+      } else if (step.step === 'disconnectEvent') {
+        for (const handler of disconnectHandlers.splice(0)) {
+          handler();
+        }
+      }
+      await drainMicrotasks();
+    }
+    return { sent, trace };
+  };
+  return run().catch((error) => ({
+    threw: true,
+    message: error instanceof Error ? error.message : String(error),
+    sent,
+    trace,
+  }));
+}
+
+async function handleIpcParent(testCase) {
+  const trace = [];
+  const sent = [];
+  let connected = true;
+  let sendMode = 'ok';
+  const messageHandlers = [];
+  const exitHandlers = [];
+  const disconnectHandlers = [];
+  const child = {
+    send: (message) => {
+      if (sendMode === 'throw') {
+        throw new Error(testCase.sendThrowMessage ?? 'scripted send failure');
+      }
+      sent.push(message);
+      return true;
+    },
+    get connected() {
+      return connected;
+    },
+    on: (event, callback) => {
+      if (event === 'message') messageHandlers.push(callback);
+      return child;
+    },
+    once: (event, callback) => {
+      if (event === 'exit') exitHandlers.push(callback);
+      if (event === 'disconnect') disconnectHandlers.push(callback);
+      return child;
+    },
+    off: (event, callback) => {
+      const pool =
+        event === 'message'
+          ? messageHandlers
+          : event === 'exit'
+            ? exitHandlers
+            : disconnectHandlers;
+      const index = pool.indexOf(callback);
+      if (index >= 0) pool.splice(index, 1);
+      return child;
+    },
+  };
+
+  const client = connectThreadCodexWorkerIpc(child);
+  client.onNotification((notification) => trace.push({ t: 'notification', notification }));
+  if (testCase.requestHandlers !== undefined) {
+    for (const handler of testCase.requestHandlers) {
+      client.onRequest((request) => {
+        trace.push({ t: 'serverRequest', handler: handler.name, request });
+        if (handler.kind === 'answer') return handler.result;
+        if (handler.kind === 'reject') return Promise.reject(new Error(handler.message));
+        return undefined;
+      });
+    }
+  }
+
+  for (const step of testCase.script ?? []) {
+    if (step.step === 'request') {
+      void client.request(step.method, step.params ?? undefined).then(
+        (response) => trace.push({ t: 'requestResolved', response }),
+        (error) =>
+          trace.push({
+            t: 'requestRejected',
+            message: error instanceof Error ? error.message : String(error),
+          })
+      );
+    } else if (step.step === 'notify') {
+      try {
+        client.notify(step.method, step.params ?? undefined);
+        trace.push({ t: 'notifyOk' });
+      } catch (error) {
+        trace.push({
+          t: 'notifyThrew',
+          message: error instanceof Error ? error.message : String(error),
+        });
+      }
+    } else if (step.step === 'childMessage') {
+      for (const handler of [...messageHandlers]) {
+        handler(step.message);
+      }
+    } else if (step.step === 'lateNotificationSubscribe') {
+      client.onNotification((notification) =>
+        trace.push({ t: 'lateNotification', notification })
+      );
+    } else if (step.step === 'exitEvent') {
+      for (const handler of exitHandlers.splice(0)) handler();
+    } else if (step.step === 'disconnectEvent') {
+      for (const handler of disconnectHandlers.splice(0)) handler();
+    } else if (step.step === 'disconnectChannel') {
+      connected = false;
+    } else if (step.step === 'sendMode') {
+      sendMode = step.mode;
+    } else if (step.step === 'isClosed') {
+      trace.push({ t: 'isClosed', value: client.isClosed?.() ?? null });
+    } else if (step.step === 'close') {
+      client.close();
+      trace.push({ t: 'closed' });
+    }
+    await drainMicrotasks();
+  }
+  return { sent, trace };
+}
+
+async function handleRespawn(testCase) {
+  const script = [...(testCase.script ?? [])];
+  const trace = [];
+  const attempt = (attemptNumber) => {
+    const step = script.shift() ?? { kind: 'ready' };
+    trace.push({ t: 'attempt', attemptNumber, kind: step.kind });
+    if (step.kind === 'ready') {
+      return Promise.resolve({ kind: 'ready', handle: { marker: 'handle-' + attemptNumber } });
+    }
+    return Promise.resolve({
+      kind: 'exited-before-ready',
+      code: step.code ?? null,
+      signal: step.signal ?? null,
+      capturedOutput: step.capturedOutput ?? '',
+    });
+  };
+  try {
+    const handle = await spawnThreadRunnerWithBoundedRespawnForTest(attempt, {
+      maxAttempts: testCase.maxAttempts,
+      backoffMs: 0,
+      sleep: () => Promise.resolve(),
+      onRespawn: (info) =>
+        trace.push({ t: 'respawn', attemptNumber: info.attemptNumber }),
+    });
+    return { trace, handle };
+  } catch (error) {
+    return {
+      trace,
+      threw: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+function handleOutputRouting(testCase) {
+  const trace = [];
+  let captured = '';
+  const capture = { active: true };
+  let tui = false;
+  const handler = createThreadWorkerOutputChunkHandler({
+    tuiActive: () => tui,
+    terminal: { write: (chunk) => trace.push({ t: 'terminal', chunk: String(chunk) }) },
+    writeAuditEvent: (event, data) => trace.push({ t: 'audit', event, data }),
+    pid: testCase.pid ?? undefined,
+    streamName: testCase.streamName ?? 'stderr',
+    capture,
+    appendCapturedOutput: (text) => {
+      captured += text;
+    },
+  });
+  for (const step of testCase.script ?? []) {
+    if (step.step === 'chunk') {
+      tui = step.tuiActive === true;
+      capture.active = step.captureActive === true;
+      handler(step.text);
+    } else if (step.step === 'route') {
+      trace.push({
+        t: 'route',
+        route: routeThreadWorkerOutputChunk({
+          tuiActive: step.tuiActive === true,
+          captureActive: step.captureActive === true,
+        }),
+      });
+    }
+  }
+  return { trace, captured };
+}
+
+function handleLiveness(testCase) {
+  const config = testCase.config ?? defaultWorkerLivenessConfig;
+  let state;
+  const trace = [];
+  for (const step of testCase.schedule ?? []) {
+    switch (step.op) {
+      case 'create':
+        state = createWorkerLivenessState(step.now);
+        break;
+      case 'pingSent':
+        recordPingSent(state, step.now);
+        break;
+      case 'pong':
+        recordPong(state, step.now);
+        break;
+      case 'probeSent':
+        recordProbeSent(state, step.now);
+        break;
+      case 'probeReply':
+        recordProbeReply(state, step.now);
+        break;
+      case 'tick':
+        tickPongDeadline(state, config, step.now);
+        break;
+      case 'verdict':
+        trace.push({ t: 'verdict', now: step.now, value: workerLivenessVerdict(state, config, step.now) });
+        break;
+      case 'shouldSendPing':
+        trace.push({ t: 'shouldSendPing', now: step.now, value: shouldSendPing(state, config, step.now) });
+        break;
+    }
+  }
+  return { trace };
+}
+
+function handlePreflight(testCase) {
+  const dir = scratch();
+  const sub = (value) => substitute(value, dirPlaceholder, dir);
+  for (const relPath of testCase.mkdirs ?? []) {
+    mkdirSync(join(dir, relPath), { recursive: true });
+  }
+  const result = outcome(() =>
+    threadWorkerStartPreflightFailureForTest({
+      cwd: sub(testCase.cwd),
+      allowedCwds: sub(testCase.allowedCwds ?? []),
+    })
+  );
+  return substitute(result, dir, dirPlaceholder);
+}
+
+const savedEnv = {};
+
+function setCaseEnv(env) {
+  for (const [key, value] of Object.entries(env ?? {})) {
+    savedEnv[key] = process.env[key];
+    if (value === null) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+}
+
+function restoreCaseEnv() {
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+    delete savedEnv[key];
+  }
+}
+
+let indexModulePromise;
+
+// parseThreadCodexWorkerArgs lives in the CLI entry module, whose
+// main-module gate compares import.meta.url with argv[1]; neutralize
+// argv[1] BEFORE the lazy import so the gate can never fire inside the
+// oracle.
+function loadIndexModule() {
+  if (indexModulePromise === undefined) {
+    process.argv[1] = '/nonexistent/linzumi-worker-spawn-oracle-argv1';
+    indexModulePromise = import('./src/index');
+  }
+  return indexModulePromise;
+}
+
+async function handleParseWorkerArgs(testCase) {
+  const dir = scratch();
+  const sub = (value) => substitute(value, dirPlaceholder, dir);
+  for (const relPath of testCase.mkdirs ?? []) {
+    mkdirSync(join(dir, relPath), { recursive: true });
+  }
+  const { parseThreadCodexWorkerArgs } = await loadIndexModule();
+  setCaseEnv(sub(testCase.env ?? {}));
+  try {
+    const options = parseThreadCodexWorkerArgs(sub(testCase.args ?? []));
+    // Project the worker-relevant slice (the codec's contract surface).
+    return substitute(
+      {
+        value: {
+          kandanUrl: options.kandanUrl,
+          token: options.token,
+          runnerId: options.runnerId,
+          workspaceSlug: options.workspaceSlug ?? null,
+          cwd: options.cwd,
+          codexBin: options.codexBin,
+          vmExecution: options.vmExecution === true,
+          executionMode: options.executionMode ?? null,
+          egressMode: options.egressMode ?? null,
+          projectPublicId: options.projectPublicId ?? null,
+          goldenImagePublicId: options.goldenImagePublicId ?? null,
+          fast: options.fast === true,
+          logFile: options.logFile ?? null,
+          allowedCwds: options.allowedCwds,
+          missingAllowedCwds: options.missingAllowedCwds ?? [],
+          allowedForwardPorts: options.allowedForwardPorts ?? [],
+          runtimeDefaults: options.runtimeDefaults ?? null,
+          codexModelProvider: options.codexModelProvider ?? null,
+          linzumiAgentMcpToken: options.linzumiAgentMcpToken ?? null,
+          kandanThreadId: options.threadProcess?.kandanThreadId ?? null,
+          debugTrace: options.debugTrace ?? null,
+        },
+      },
+      dir,
+      dirPlaceholder
+    );
+  } catch (error) {
+    return substitute(
+      { threw: error instanceof Error ? error.message : String(error) },
+      dir,
+      dirPlaceholder
+    );
+  } finally {
+    restoreCaseEnv();
+  }
+}
+
+async function handle(testCase) {
+  switch (testCase.op) {
+    case 'cliArgs':
+      return outcome(() => threadRunnerCliArgsForTest(testCase.options));
+    case 'redactedCliArgs':
+      return outcome(() => redactedThreadRunnerCliArgsForTest(testCase.args));
+    case 'envOverlay':
+      return outcome(() =>
+        threadRunnerWorkerEnvOverlay(testCase.options, {
+          devServicesParentPid: testCase.devServicesParentPid,
+          forwardableOpenAiApiKey: testCase.forwardableOpenAiApiKey ?? undefined,
+        })
+      );
+    case 'nodeArgs':
+      return outcome(() =>
+        threadRunnerNodeArgsForTest(testCase.scriptPath, testCase.args, testCase.execArgv)
+      );
+    case 'scriptPath':
+      return outcome(() =>
+        threadRunnerScriptPathForTest(testCase.scriptPath ?? undefined, testCase.cwd)
+      );
+    case 'readyMessage':
+      return outcome(() =>
+        threadRunnerReadyMessageForTest(testCase.message, testCase.expectedKandanThreadId)
+      );
+    case 'sessionClosedGuard':
+      return outcome(() => isThreadCodexWorkerSessionClosedMessage(testCase.message));
+    case 'readyTimeoutMs':
+      return outcome(() =>
+        threadRunnerReadyTimeoutMsForTest({
+          threadRunnerReadyTimeoutMs: testCase.configured ?? undefined,
+        })
+      );
+    case 'readyTimeoutError':
+      return outcome(
+        () =>
+          threadRunnerReadyTimeoutErrorForTest(testCase.kandanThreadId, testCase.timeoutMs).message
+      );
+    case 'boundedOutput':
+      return outcome(() => boundedWorkerOutputForTest(testCase.value));
+    case 'exitBeforeReadyMessage':
+      return outcome(() =>
+        threadRunnerExitBeforeReadyMessageForTest({
+          kind: 'exited-before-ready',
+          code: testCase.code ?? null,
+          signal: testCase.signal ?? null,
+          capturedOutput: testCase.capturedOutput ?? '',
+        })
+      );
+    case 'preflight':
+      return handlePreflight(testCase);
+    case 'preflightLine':
+      return outcome(() => threadWorkerPreflightFailureLineForTest(testCase.capturedOutput));
+    case 'stillborn':
+      return outcome(() => ({
+        isStillborn: isStillbornWorkerErrorForTest(new Error(testCase.message)),
+        failedReason: stillbornWorkerFailedReasonForTest(new Error(testCase.message)),
+        terminal: threadStartTerminalFailureForTest(new Error(testCase.message)),
+      }));
+    case 'respawn':
+      return handleRespawn(testCase);
+    case 'outputRouting':
+      return handleOutputRouting(testCase);
+    case 'liveness':
+      return handleLiveness(testCase);
+    case 'ipcWorker':
+      return handleIpcWorker(testCase);
+    case 'ipcParent':
+      return handleIpcParent(testCase);
+    case 'remoteConfig':
+      return outcome(() => remoteCodexHarnessWorkerConfigFromJson(testCase.json));
+    case 'remoteConfigEnv':
+      return outcome(() => remoteCodexHarnessWorkerConfigFromEnv(testCase.env ?? {}));
+    case 'remoteEntrypoint':
+      return outcome(() => resolveLinzumiCliEntrypoint(testCase.entrypoint ?? undefined));
+    case 'remoteJoinPayload':
+      return outcome(() => {
+        const payload = remoteHarnessRunnerJoinPayload(testCase.config);
+        payload.runnerPid = 0;
+        payload.version = '<version>';
+        return payload;
+      });
+    case 'parseWorkerArgs':
+      return handleParseWorkerArgs(testCase);
+    default:
+      return { threw: true, message: 'unknown op ' + String(testCase.op) };
+  }
+}
+
+// --- ipc-parent mode: the REAL TS parent half over REAL process IPC ------------------
+// "node <oracle> ipc-parent <childEntry> [childArg...]" spawns the child
+// with an IPC channel, drives the REAL connectThreadCodexWorkerIpc through
+// the fixed cross-impl choreography, and prints one JSON result: the raw
+// frames the child sent (cue messages excluded), the parent-observed
+// events, and the child's own trace. Run against the TS ipc-child AND the
+// ReScript child probe, the outputs must be byte-identical - the same
+// commander parent drives both workers identically.
+async function runIpcParent() {
+  const { spawn } = await import('node:child_process');
+  const childArgs = process.argv.slice(3);
+  const child = spawn(process.execPath, childArgs, {
+    stdio: ['ignore', 'inherit', 'inherit', 'ipc'],
+  });
+  const frames = [];
+  const parentEvents = [];
+  let childTrace = null;
+  const cueWaiters = new Map();
+  const waitForCue = (cue) =>
+    new Promise((resolve) => {
+      cueWaiters.set(cue, resolve);
+    });
+  child.on('message', (message) => {
+    if (message !== null && typeof message === 'object' && message.cue !== undefined) {
+      const waiter = cueWaiters.get(message.cue);
+      if (waiter !== undefined) {
+        cueWaiters.delete(message.cue);
+        waiter(message);
+      }
+      return;
+    }
+    frames.push(message);
+  });
+
+  await waitForCue('child_ready');
+  const client = connectThreadCodexWorkerIpc(child);
+  client.onNotification((notification) =>
+    parentEvents.push({ t: 'notification', notification })
+  );
+  client.onRequest((request) => {
+    parentEvents.push({ t: 'serverRequest', request });
+    return { decision: 'approved' };
+  });
+
+  try {
+    const readResponse = await client.request('thread/read', { threadId: 't-cross' });
+    parentEvents.push({ t: 'requestResolved', response: readResponse });
+  } catch (error) {
+    parentEvents.push({
+      t: 'requestRejected',
+      message: error instanceof Error ? error.message : String(error),
+    });
+  }
+  try {
+    await client.request('boom/method');
+    parentEvents.push({ t: 'requestResolved', response: null });
+  } catch (error) {
+    parentEvents.push({
+      t: 'requestRejected',
+      message: error instanceof Error ? error.message : String(error),
+    });
+  }
+  client.notify('turn/interrupt', { reason: 'cross-impl' });
+  const notified = waitForCue('notification_emitted');
+  child.send({
+    cue: 'emit_notification',
+    notification: { method: 'thread/event', params: { kind: 'delta', n: 1 } },
+  });
+  await notified;
+  const settled = waitForCue('server_request_settled');
+  child.send({
+    cue: 'emit_server_request',
+    request: { id: 21, method: 'applyPatchApproval', params: { call: 'c-cross' } },
+  });
+  await settled;
+  const reported = waitForCue('trace');
+  child.send({ cue: 'report' });
+  childTrace = (await reported).trace;
+  child.send({ cue: 'exit' });
+  await new Promise((resolve) => child.once('exit', resolve));
+  process.stdout.write(JSON.stringify({ frames, parentEvents, childTrace }));
+}
+
+if (process.argv[2] === 'ipc-child') {
+  await runIpcChild();
+} else if (process.argv[2] === 'ipc-parent') {
+  await runIpcParent();
+} else {
+  let stdin = '';
+  process.stdin.setEncoding('utf8');
+  for await (const chunk of process.stdin) {
+    stdin += chunk;
+  }
+  const cases = JSON.parse(stdin);
+  const results = [];
+  for (const testCase of cases) {
+    results.push(await handle(testCase));
+  }
+  process.stdout.write(JSON.stringify(results));
+}
+`;
+
+await mkdir(join(packageRoot, '.differential'), { recursive: true });
+
+// runner.ts's graph resolves assets/ relative to the bundle at import time
+// (same requirement as build-differential-entry.mjs).
+await mkdir(join(packageRoot, '.differential/assets'), { recursive: true });
+const { copyFile } = await import('node:fs/promises');
+await copyFile(
+  join(packageRoot, 'src/assets/linzumi-logo.svg'),
+  join(packageRoot, '.differential/assets/linzumi-logo.svg')
+);
+
+await build({
+  stdin: {
+    contents: driverSource,
+    resolveDir: packageRoot,
+    sourcefile: 'worker-spawn-parity-driver.ts',
+    loader: 'ts',
+  },
+  bundle: true,
+  platform: 'node',
+  target: 'node20',
+  format: 'esm',
+  outfile: join(packageRoot, '.differential/worker-spawn-parity-oracle.mjs'),
+  minify: false,
+  sourcemap: false,
+  legalComments: 'none',
+  external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
+});