@linzumi/cli 1.0.117 → 1.0.119

package/scripts/build-editor-parity-oracle.mjs

@@ -0,0 +1,1523 @@
+// Spec: kandan/plans/2026-07-10-compute-nodes-rescript-commander-zero-ts-program.md
+// (M3 cluster 14, editor).
+// Relationship: Builds the TS-side PARITY ORACLE for the local-editor port
+// of the ReScript commander. ONE esbuild bundle imports the REAL
+// localEditor.ts + localEditorRuntime.ts exports (plus the cluster 14 seam
+// re-exports) behind the cluster 1/2 stdin/stdout batch driver (a JSON
+// array of cases in, a JSON array of results out). The ReScript package's
+// EditorParityConformance drives the SAME inputs through
+// src/editor/CommanderEditor* and asserts serialized-JSON equality; the
+// EditorLawsConformance suite replays the named FLOW scenarios below with
+// equivalent scripted deps and asserts the normalized flow outputs match.
+//
+// The two crown ops are named-scenario FLOWS:
+//   - `start_editor_flow`: run the REAL startLocalEditor against a scratch
+//     fake installed runtime and a fake code-server executable (a node
+//     script that binds the given --bind-addr port and serves HTTP - the
+//     localEditor.test.ts technique), covering every frozen refusal reason
+//     plus ready / idempotent / replace / full OCT-collaboration legs
+//     (with a REAL sidecar app.js extracted from a REAL tarball);
+//   - `resolve_runtime_flow`: run the REAL resolveEditorRuntime with a
+//     scripted fetchImpl (manifest legs for every frozen unavailable
+//     reason incl. the 401 token_expired split and checksum_mismatch) over
+//     REAL tar.gz archives built from a fixed tree spec.
+//
+// Determinism: ports normalize to [port], pids to [pid], ISO timestamps to
+// [iso] (the onboarding-oracle normalization trick), scratch roots to $DIR,
+// the mkdtemp'd profile dir to $UDD, the cache root to $CACHE, homedir to
+// $HOME. Audit events are isolated per case through a scratch
+// LINZUMI_CLI_AUDIT_LOG and read back normalized.
+//
+// SECRETS: synthetic case payloads only; .differential/ is gitignored.
+import { mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+const driverSource = `
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { join, relative } from 'node:path';
+import {
+  codeServerArgs,
+  codeServerEnv,
+  codeServerSettingsForTest,
+  localEditorBrowserBaseUrlForTest,
+  localEditorCapabilities,
+  nodeRuntimeExecutable,
+  prepareCodeServerLaunch,
+  prepareCodeServerProfile,
+  prepareLocalEditorCollaboration,
+  startLocalEditor,
+  wrappedCodeServerBinForTest,
+} from './src/localEditor';
+import {
+  codeServerRuntimeRootForTest,
+  defaultEditorRuntimeCacheRootForTest,
+  editorRuntimePlatform,
+  editorRuntimeStatusPayload,
+  normalizeManifestForTest,
+  resolveEditorRuntime,
+  runtimeInstallRootForTest,
+  sameOriginForTest,
+} from './src/localEditorRuntime';
+
+const orNull = (value) => (value === undefined ? null : value);
+
+function outcome(run) {
+  try {
+    const value = run();
+    return value === undefined ? { defined: false } : { defined: true, value };
+  } catch (error) {
+    return {
+      threw: true,
+      message: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+function scratch() {
+  return realpathSync(mkdtempSync(join(tmpdir(), 'linzumi-editor-oracle-')));
+}
+
+function substitute(value, from, to) {
+  if (typeof value === 'string') {
+    return value.split(from).join(to);
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => substitute(entry, from, to));
+  }
+  if (typeof value === 'object' && value !== null) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [
+        substitute(key, from, to),
+        substitute(entry, from, to),
+      ])
+    );
+  }
+  return value;
+}
+
+const PROFILE_DIR_PATTERN = /[^"\\s]*kandan-local-editor-[^\\/"\\s]+/g;
+const ISO_PATTERN = /\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z/g;
+
+function normalizeStrings(value, mapString) {
+  if (typeof value === 'string') {
+    return mapString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => normalizeStrings(entry, mapString));
+  }
+  if (typeof value === 'object' && value !== null) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [
+        key,
+        normalizeStrings(entry, mapString),
+      ])
+    );
+  }
+  return value;
+}
+
+// --- Shared fixture builders (mirrored by EditorLawsConformance.res) --------------------
+
+function writeFileAt(path, contents) {
+  mkdirSync(join(path, '..'), { recursive: true });
+  writeFileSync(path, contents);
+}
+
+function writeBrowserAssetInputs(runtimeRoot) {
+  writeFileAt(
+    join(runtimeRoot, 'lib', 'vscode', 'extensions', 'git-base', 'dist', 'extension.js'),
+    'git-base browser shim'
+  );
+  writeFileAt(
+    join(
+      runtimeRoot,
+      'lib',
+      'vscode',
+      'extensions',
+      'merge-conflict',
+      'dist',
+      'mergeConflictMain.js'
+    ),
+    'merge-conflict browser shim'
+  );
+}
+
+function fakeInstalledEditorRuntime(root, codeServerBin, opts = {}) {
+  const runtimeRoot = join(root, '.fake-runtime');
+  const documentStateExtensionDir = join(
+    runtimeRoot,
+    'kandan',
+    'editor_extensions',
+    'kandan.document-state-telemetry'
+  );
+  mkdirSync(join(documentStateExtensionDir, 'out'), { recursive: true });
+  writeFileSync(
+    join(documentStateExtensionDir, 'package.json'),
+    JSON.stringify({ name: 'kandan.document-state-telemetry' })
+  );
+  writeFileSync(join(documentStateExtensionDir, 'out', 'extension.js'), '');
+  if (opts.withBrowserAssets !== false) {
+    writeBrowserAssetInputs(runtimeRoot);
+  }
+  return {
+    mode: 'server_managed',
+    root: runtimeRoot,
+    codeServerBin,
+    assets: {
+      collaborationExtensionTarball: join(
+        runtimeRoot,
+        'kandan',
+        'editor_extensions',
+        'typefox.open-collaboration-tools.tar.gz'
+      ),
+      collaborationServerTarball: join(
+        runtimeRoot,
+        'kandan',
+        'editor_servers',
+        'open-collaboration-server.tar.gz'
+      ),
+      documentStateExtensionDir,
+    },
+  };
+}
+
+const READY_BIN = (root) => \`#!/bin/sh
+if [ "\\\${PORT+x}" = "x" ]; then
+  printf "PORT leaked into code-server env" >&2
+  exit 99
+fi
+if [ "\\\${PWD:-}" != "\${root}" ]; then
+  printf "PWD was %s" "\\\${PWD:-undefined}" >&2
+  exit 98
+fi
+exec node -e '
+const http = require("node:http");
+const bindIndex = process.argv.indexOf("--bind-addr");
+const bindAddress = process.argv[bindIndex + 1];
+const [hostname, portText] = bindAddress.split(":");
+setTimeout(() => {
+  http.createServer((_request, response) => response.end("ready")).listen(Number(portText), hostname);
+}, 120);
+setInterval(() => {}, 1000);
+' -- "\$@"
+\`;
+
+const SIMPLE_BIN = \`#!/usr/bin/env node
+const http = require("node:http");
+const bindIndex = process.argv.indexOf("--bind-addr");
+const bindAddress = process.argv[bindIndex + 1];
+const [hostname, portText] = bindAddress.split(":");
+http.createServer((_request, response) => response.end("ready")).listen(Number(portText), hostname);
+setInterval(() => {}, 1000);
+\`;
+
+const EXIT_BIN = ['#!/usr/bin/env node', 'setImmediate(() => process.exit(2));'].join('\\n');
+
+const OCT_APP_JS = \`const http = require("node:http");
+const portIndex = process.argv.indexOf("--port");
+const hostIndex = process.argv.indexOf("--hostname");
+const port = Number(process.argv[portIndex + 1]);
+const hostname = process.argv[hostIndex + 1];
+if (process.env.OCT_ACTIVATE_SIMPLE_LOGIN !== "true" || process.env.OCT_SERVER_OWNER !== "Kandan") {
+  process.exit(97);
+}
+http.createServer((_request, response) => response.end("oct")).listen(port, hostname);
+setInterval(() => {}, 1000);
+\`;
+
+const OCT_DEAD_APP_JS = 'setImmediate(() => process.exit(3));\\n';
+
+function tarDirectory(srcDir, archivePath, entries) {
+  const result = spawnSync('tar', ['-czf', archivePath, '-C', srcDir, ...entries], {
+    encoding: 'utf8',
+  });
+  if (result.status !== 0) {
+    throw new Error('tar failed: ' + (result.stderr ?? ''));
+  }
+}
+
+// The two collaboration tarballs the sidecar leg extracts for real.
+function buildCollaborationTarballs(root, runtime, appJs) {
+  const stage = join(root, '.tarball-stage');
+  writeFileAt(join(stage, 'extension', 'extension-marker.txt'), 'oct extension payload');
+  mkdirSync(join(runtime.root, 'kandan', 'editor_extensions'), { recursive: true });
+  mkdirSync(join(runtime.root, 'kandan', 'editor_servers'), { recursive: true });
+  tarDirectory(join(stage, 'extension'), runtime.assets.collaborationExtensionTarball, ['.']);
+  writeFileAt(
+    join(stage, 'server', 'open-collaboration-server', 'bundle', 'app.js'),
+    appJs
+  );
+  tarDirectory(join(stage, 'server'), runtime.assets.collaborationServerTarball, ['.']);
+}
+
+function writeExecutable(path, contents) {
+  mkdirSync(join(path, '..'), { recursive: true });
+  writeFileSync(path, contents);
+  chmodSync(path, 0o755);
+}
+
+const COLLAB_CONTROL = {
+  provider: 'oct',
+  editorSessionId: 42,
+  runtimeSessionId: 'local-runtime-42',
+  roomId: 'octroom42',
+  extensionAssetPath:
+    '/api/v2/editor/runtime-assets/extensions/typefox.open-collaboration-tools.tar.gz',
+  serverAssetPath:
+    '/api/v2/editor/runtime-assets/servers/open-collaboration-server.tar.gz',
+  bootstrapToken: 'signed.bootstrap',
+};
+
+// --- Audit capture ------------------------------------------------------------------------
+
+function caseAuditLog(dir) {
+  const logFile = join(dir, 'audit.jsonl');
+  process.env.LINZUMI_CLI_AUDIT_LOG = logFile;
+  return logFile;
+}
+
+function readAuditEvents(logFile) {
+  if (!existsSync(logFile)) {
+    return [];
+  }
+  return readFileSync(logFile, 'utf8')
+    .split('\\n')
+    .filter((line) => line.trim() !== '')
+    .map((line) => JSON.parse(line));
+}
+
+// --- start_editor_flow ---------------------------------------------------------------------
+
+const LOOPBACK_PORT_PATTERN = /127\\.0\\.0\\.1:\\d+/g;
+const FORWARDS_PORT_PATTERN = /\\/forwards\\/\\d+\\//g;
+
+function normalizeFlowValue(value, dir) {
+  let normalized = substitute(value, dir, '$DIR');
+  normalized = normalizeStrings(normalized, (text) =>
+    text
+      .replace(PROFILE_DIR_PATTERN, '$UDD')
+      .replace(ISO_PATTERN, '[iso]')
+      .replace(LOOPBACK_PORT_PATTERN, '127.0.0.1:[port]')
+      .replace(FORWARDS_PORT_PATTERN, '/forwards/[port]/')
+  );
+  return normalized;
+}
+
+function normalizeAuditEvents(events, dir) {
+  return events.map((entry) => {
+    const mapped = { ...entry };
+    mapped.ts = '[iso]';
+    if (typeof mapped.pid === 'number') {
+      mapped.pid = '[pid]';
+    }
+    if (Array.isArray(mapped.args)) {
+      mapped.args = mapped.args.map((arg, index) =>
+        index > 0 && mapped.args[index - 1] === '--port' ? '[port]' : arg
+      );
+    }
+    return normalizeFlowValue(mapped, dir);
+  });
+}
+
+function eventProjection(event) {
+  return {
+    cwd: event.cwd,
+    portBound: event.port > 0,
+    startedAt: event.startedAt,
+    collaboration:
+      event.collaboration === undefined
+        ? null
+        : {
+            provider: event.collaboration.provider,
+            editorSessionId: event.collaboration.editorSessionId,
+            runtimeSessionId: event.collaboration.runtimeSessionId,
+            roomId: event.collaboration.roomId,
+            serverPortBound: event.collaboration.serverPort > 0,
+            serverUrl: event.collaboration.serverUrl,
+          },
+  };
+}
+
+function capabilitiesProjection(runtime, state) {
+  const capabilities = localEditorCapabilities(runtime, state.status === 'running' ? [state.cwd] : ['/tmp'], state);
+  const mapped = { ...capabilities };
+  if (typeof mapped.localEditorPort === 'number') {
+    mapped.localEditorPort = '[port]';
+  }
+  if (mapped.localEditorCollaboration !== undefined) {
+    mapped.localEditorCollaboration = {
+      ...mapped.localEditorCollaboration,
+      serverPort: '[port]',
+    };
+  }
+  return mapped;
+}
+
+function settingsBytesFromAudit(events) {
+  for (const entry of events) {
+    if (entry.event === 'process.spawn' && entry.purpose === 'local_editor.code_server') {
+      const index = entry.args.indexOf('--user-data-dir');
+      if (index >= 0) {
+        const userDataDir = entry.args[index + 1];
+        const settingsPath = join(userDataDir, 'User', 'settings.json');
+        if (existsSync(settingsPath)) {
+          return readFileSync(settingsPath, 'utf8');
+        }
+      }
+    }
+  }
+  return null;
+}
+
+// Kill a started editor state and WAIT for its exits (bounded): the audit
+// log path is process-global per case, so a straggler process.exit event
+// from case N must never land in case N+1's log.
+async function killStateAndWait(state) {
+  if (state !== undefined && state.status === 'running') {
+    const bounded = (exited) =>
+      Promise.race([exited, new Promise((resolve) => setTimeout(resolve, 3000))]);
+    const waits = [bounded(state.exited)];
+    try {
+      state.process.kill('SIGINT');
+    } catch (_error) {}
+    if (state.collaboration !== undefined) {
+      try {
+        state.collaboration.process.kill('SIGINT');
+      } catch (_error) {}
+      waits.push(bounded(state.collaboration.exited));
+    }
+    await Promise.all(waits);
+  }
+}
+
+async function fetchBody(port) {
+  try {
+    const response = await fetch('http://127.0.0.1:' + port + '/');
+    return await response.text();
+  } catch (error) {
+    return 'fetch failed: ' + (error instanceof Error ? error.message : String(error));
+  }
+}
+
+async function handleStartEditorFlow(testCase) {
+  const dir = scratch();
+  const logFile = caseAuditLog(dir);
+  const previousPort = process.env.PORT;
+  process.env.PORT = '4140';
+  const ports = [];
+  const startedStates = [];
+  const record = { scenario: testCase.scenario };
+  try {
+    const run = async (control, options) => {
+      const result = await startLocalEditor(control, options);
+      if (result.ok) {
+        ports.push(result.event.port);
+        if (result.state.status === 'running' && result.state.collaboration !== undefined) {
+          ports.push(result.state.collaboration.serverPort);
+        }
+        startedStates.push(result.state);
+      }
+      return result;
+    };
+    const project = (result) => ({
+      ok: result.ok,
+      reason: result.ok ? null : result.reason,
+      event: result.ok ? eventProjection(result.event) : null,
+      stateStatus: result.state.status,
+    });
+
+    switch (testCase.scenario) {
+      case 'disabled': {
+        const result = await run(
+          { type: 'start_local_editor', cwd: dir },
+          {
+            codeServerBin: undefined,
+            editorRuntime: undefined,
+            allowedCwds: [dir],
+            currentState: { status: 'disabled' },
+          }
+        );
+        record.result = project(result);
+        break;
+      }
+      case 'missing_cwd':
+      case 'no_allowed_cwd':
+      case 'cwd_not_allowed':
+      case 'cwd_not_found':
+      case 'cwd_dangerous': {
+        const root = join(dir, 'root');
+        const outside = join(dir, 'outside');
+        mkdirSync(root, { recursive: true });
+        mkdirSync(outside, { recursive: true });
+        const runtime = fakeInstalledEditorRuntime(root, 'code-server');
+        const byScenario = {
+          missing_cwd: { cwd: '   ', allowedCwds: [root] },
+          no_allowed_cwd: { cwd: root, allowedCwds: [] },
+          cwd_not_allowed: { cwd: outside, allowedCwds: [root] },
+          cwd_not_found: { cwd: join(root, 'missing-child'), allowedCwds: [root] },
+          cwd_dangerous: { cwd: '/usr/bin', allowedCwds: ['/usr/bin'] },
+        };
+        const spec = byScenario[testCase.scenario];
+        const result = await run(
+          { type: 'start_local_editor', cwd: spec.cwd },
+          {
+            codeServerBin: 'code-server',
+            editorRuntime: runtime,
+            allowedCwds: spec.allowedCwds,
+            currentState: { status: 'disabled' },
+          }
+        );
+        record.result = project(result);
+        break;
+      }
+      case 'sandbox_unavailable': {
+        const root = join(dir, 'root');
+        mkdirSync(root, { recursive: true });
+        const bin = join(root, 'code-server');
+        writeExecutable(bin, SIMPLE_BIN);
+        const runtime = fakeInstalledEditorRuntime(root, bin);
+        const result = await run(
+          { type: 'start_local_editor', cwd: root },
+          {
+            codeServerBin: bin,
+            editorRuntime: runtime,
+            allowedCwds: [root],
+            currentState: { status: 'disabled' },
+            platform: 'freebsd',
+          }
+        );
+        record.result = project(result);
+        break;
+      }
+      case 'missing_browser_base_url': {
+        const root = join(dir, 'root');
+        mkdirSync(root, { recursive: true });
+        const runtime = fakeInstalledEditorRuntime(root, 'code-server');
+        const result = await run(
+          {
+            type: 'start_local_editor',
+            cwd: root,
+            collaboration: { ...COLLAB_CONTROL, bootstrapToken: undefined },
+          },
+          {
+            codeServerBin: 'code-server',
+            editorRuntime: runtime,
+            allowedCwds: [root],
+            currentState: { status: 'disabled' },
+          }
+        );
+        record.result = project(result);
+        break;
+      }
+      case 'spawn_failed': {
+        const root = join(dir, 'root');
+        mkdirSync(root, { recursive: true });
+        const missingBin = join(root, 'missing-code-server');
+        const runtime = fakeInstalledEditorRuntime(root, missingBin);
+        const result = await run(
+          { type: 'start_local_editor', cwd: root },
+          {
+            codeServerBin: missingBin,
+            editorRuntime: runtime,
+            allowedCwds: [root],
+            currentState: { status: 'disabled' },
+            platform: 'darwin',
+          }
+        );
+        record.result = project(result);
+        break;
+      }
+      case 'exit_before_ready': {
+        const root = join(dir, 'root');
+        mkdirSync(root, { recursive: true });
+        const bin = join(root, 'code-server');
+        writeExecutable(bin, EXIT_BIN);
+        const runtime = fakeInstalledEditorRuntime(root, bin);
+        const result = await run(
+          { type: 'start_local_editor', cwd: root },
+          {
+            codeServerBin: bin,
+            editorRuntime: runtime,
+            allowedCwds: [root],
+            currentState: { status: 'disabled' },
+            platform: 'darwin',
+          }
+        );
+        record.result = project(result);
+        break;
+      }
+      case 'ready':
+      case 'ready_idempotent': {
+        const root = join(dir, 'root');
+        mkdirSync(root, { recursive: true });
+        const bin = join(root, 'code-server');
+        writeExecutable(bin, READY_BIN(root));
+        const runtime = fakeInstalledEditorRuntime(root, bin);
+        const options = {
+          codeServerBin: bin,
+          editorRuntime: runtime,
+          allowedCwds: [root],
+          currentState: { status: 'disabled' },
+          platform: 'darwin',
+        };
+        const result = await run({ type: 'start_local_editor', cwd: root }, options);
+        record.result = project(result);
+        if (result.ok) {
+          record.readyBody = await fetchBody(result.event.port);
+          record.capabilities = capabilitiesProjection(runtime, result.state);
+          if (testCase.scenario === 'ready_idempotent') {
+            const second = await run(
+              { type: 'start_local_editor', cwd: root },
+              { ...options, currentState: result.state }
+            );
+            record.second = project(second);
+            record.samePort = second.ok && second.event.port === result.event.port;
+          }
+        }
+        break;
+      }
+      case 'ready_replace': {
+        const cwdA = join(dir, 'project-a');
+        const cwdB = join(dir, 'project-b');
+        mkdirSync(cwdA, { recursive: true });
+        mkdirSync(cwdB, { recursive: true });
+        const bin = join(dir, 'code-server');
+        writeExecutable(bin, SIMPLE_BIN);
+        const runtime = fakeInstalledEditorRuntime(dir, bin);
+        const options = {
+          codeServerBin: bin,
+          editorRuntime: runtime,
+          allowedCwds: [dir],
+          currentState: { status: 'disabled' },
+          platform: 'darwin',
+        };
+        const first = await run({ type: 'start_local_editor', cwd: cwdA }, options);
+        record.result = project(first);
+        if (first.ok) {
+          const second = await run(
+            { type: 'start_local_editor', cwd: cwdB },
+            { ...options, currentState: first.state }
+          );
+          record.second = project(second);
+          record.newPort = second.ok && second.event.port !== first.event.port;
+          const firstExited = await Promise.race([
+            first.state.exited.then(() => true),
+            new Promise((resolve) => setTimeout(() => resolve(false), 5000)),
+          ]);
+          record.firstExited = firstExited;
+        }
+        break;
+      }
+      case 'collaboration':
+      case 'collaboration_sidecar_dies': {
+        const root = join(dir, 'root');
+        mkdirSync(root, { recursive: true });
+        const bin = join(root, 'code-server');
+        writeExecutable(bin, READY_BIN(root));
+        const runtime = fakeInstalledEditorRuntime(root, bin);
+        buildCollaborationTarballs(
+          root,
+          runtime,
+          testCase.scenario === 'collaboration' ? OCT_APP_JS : OCT_DEAD_APP_JS
+        );
+        const result = await run(
+          {
+            type: 'start_local_editor',
+            cwd: root,
+            collaboration: COLLAB_CONTROL,
+            browserBaseUrl: 'https://linzumi.io:4140',
+          },
+          {
+            codeServerBin: bin,
+            editorRuntime: runtime,
+            allowedCwds: [root],
+            currentState: { status: 'disabled' },
+            platform: 'darwin',
+            runnerId: 'runner-a',
+          }
+        );
+        record.result = project(result);
+        if (result.ok) {
+          record.capabilities = capabilitiesProjection(runtime, result.state);
+        }
+        break;
+      }
+      default:
+        return { threw: true, message: 'unknown start scenario ' + String(testCase.scenario) };
+    }
+    if (testCase.scenario === 'collaboration_sidecar_dies') {
+      // The internal SIGINT kill of the code-server child lands its
+      // process.exit audit asynchronously; settle before reading.
+      await new Promise((resolve) => setTimeout(resolve, 500));
+    }
+    const auditEvents = readAuditEvents(logFile);
+    record.settingsBytes = settingsBytesFromAudit(auditEvents);
+    const normalizedAudit = normalizeAuditEvents(auditEvents, dir);
+    // The two parallel tarball installs race their process.exit entries:
+    // the collaboration scenarios compare the audit trail as a SORTED
+    // multiset of serialized entries; every other scenario stays ordered.
+    record.auditEvents =
+      testCase.scenario === 'collaboration' ||
+      testCase.scenario === 'collaboration_sidecar_dies'
+        ? normalizedAudit.map((entry) => JSON.stringify(entry)).sort()
+        : normalizedAudit;
+    return normalizeFlowValue(record, dir);
+  } finally {
+    for (const state of startedStates) {
+      await killStateAndWait(state);
+    }
+    if (previousPort === undefined) {
+      delete process.env.PORT;
+    } else {
+      process.env.PORT = previousPort;
+    }
+  }
+}
+
+// --- resolve_runtime_flow --------------------------------------------------------------------
+
+function sha256(bytes) {
+  return createHash('sha256').update(bytes).digest('hex');
+}
+
+const RUNTIME_TREE_FILES = [
+  ['linzumi-editor-runtime.json', JSON.stringify({ version: '2026.04.29.9', platform: 'darwin-arm64' })],
+  ['bin/code-server', '#!/bin/sh\\necho code-server\\n'],
+  ['lib/vscode/node_modules/vsda/rust/web/vsda.js', 'export default {};'],
+  ['lib/vscode/node_modules/vsda/rust/web/vsda_bg.wasm', 'wasm'],
+  ['kandan/editor_extensions/typefox.open-collaboration-tools.tar.gz', 'oct extension tarball'],
+  ['kandan/editor_servers/open-collaboration-server.tar.gz', 'oct server tarball'],
+  [
+    'kandan/editor_extensions/kandan.document-state-telemetry/package.json',
+    JSON.stringify({ name: 'kandan.document-state-telemetry' }),
+  ],
+  ['kandan/editor_extensions/kandan.document-state-telemetry/out/extension.js', 'module.exports = {};'],
+];
+
+const RUNTIME_ASSET_PATHS = [
+  'bin/code-server',
+  'lib/vscode/node_modules/vsda/rust/web/vsda.js',
+  'lib/vscode/node_modules/vsda/rust/web/vsda_bg.wasm',
+  'kandan/editor_extensions/typefox.open-collaboration-tools.tar.gz',
+  'kandan/editor_servers/open-collaboration-server.tar.gz',
+  'kandan/editor_extensions/kandan.document-state-telemetry/package.json',
+  'kandan/editor_extensions/kandan.document-state-telemetry/out/extension.js',
+];
+
+function buildStandardArchive(root) {
+  const src = join(root, 'runtime-src');
+  for (const [path, contents] of RUNTIME_TREE_FILES) {
+    writeFileAt(join(src, path), contents);
+  }
+  chmodSync(join(src, 'bin', 'code-server'), 0o755);
+  const archivePath = join(root, 'runtime-archive.tar.gz');
+  tarDirectory(src, archivePath, ['.']);
+  const assets = RUNTIME_ASSET_PATHS.map((path) => ({
+    path,
+    sha256: sha256(readFileSync(join(src, path))),
+  }));
+  return { path: archivePath, sha256: sha256(readFileSync(archivePath)), assets };
+}
+
+function buildUpstreamArchive(root, packageRoot) {
+  const src = join(root, 'upstream-src');
+  writeFileAt(join(src, packageRoot, 'bin', 'code-server'), '#!/bin/sh\\necho code-server\\n');
+  chmodSync(join(src, packageRoot, 'bin', 'code-server'), 0o755);
+  const archivePath = join(root, packageRoot + '.tar.gz');
+  tarDirectory(src, archivePath, [packageRoot]);
+  return { path: archivePath, sha256: sha256(readFileSync(archivePath)) };
+}
+
+function standardManifest(archive) {
+  return {
+    version: '2026.04.29.9',
+    platform: 'darwin-arm64',
+    archiveUrl: '/runtime/archive',
+    archiveSha256: archive.sha256,
+    codeServerVersion: '4.112.0',
+    codeServerBinPath: 'bin/code-server',
+    manifestPath: 'linzumi-editor-runtime.json',
+    assets: archive.assets,
+  };
+}
+
+function listTreeFiles(root) {
+  const files = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir).sort()) {
+      const full = join(dir, entry);
+      if (statSync(full).isDirectory()) {
+        walk(full);
+      } else {
+        files.push(relative(root, full));
+      }
+    }
+  };
+  if (existsSync(root)) {
+    walk(root);
+  }
+  return files.sort();
+}
+
+function runtimeResultProjection(result, cacheRoot) {
+  return substitute(
+    {
+      statusPayload: editorRuntimeStatusPayload(result.status),
+      codeServerBin: orNull(result.codeServerBin),
+      runtime:
+        result.runtime === undefined
+          ? null
+          : {
+              root: result.runtime.root,
+              codeServerBin: result.runtime.codeServerBin,
+              assets: result.runtime.assets,
+            },
+    },
+    cacheRoot,
+    '$CACHE'
+  );
+}
+
+async function handleResolveRuntimeFlow(testCase) {
+  const dir = scratch();
+  caseAuditLog(dir);
+  const cacheRoot = join(dir, 'cache');
+  const counters = { manifestFetches: 0, archiveFetches: 0 };
+  let authHeaderOnArchive = null;
+  // tar.gz bytes carry timestamps, so the archive sha256 differs per
+  // driver run: normalize it to $SHA everywhere it surfaces (status
+  // payload, install paths, the installed manifest bytes).
+  let archiveShaToNormalize = null;
+  const record = { scenario: testCase.scenario };
+  const baseOptions = {
+    kandanUrl: 'wss://linzumi.io:4140',
+    token: 'synthetic-token',
+    cacheRoot,
+    platform: 'darwin',
+    arch: 'arm64',
+  };
+
+  const resolveWith = (overrides) => resolveEditorRuntime({ ...baseOptions, ...overrides });
+
+  switch (testCase.scenario) {
+    case 'runtime_custom': {
+      const result = await resolveWith({
+        customCodeServerBin: '/opt/homebrew/bin/code-server',
+        platform: 'freebsd',
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_unsupported_platform': {
+      const result = await resolveWith({ platform: 'freebsd', arch: 'x64' });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_manifest_reject': {
+      const result = await resolveWith({
+        fetchImpl: async () => {
+          throw new Error('scripted network failure');
+        },
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_manifest_500': {
+      const result = await resolveWith({
+        fetchImpl: async () => new Response('boom', { status: 500 }),
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_auth_expired': {
+      const result = await resolveWith({
+        fetchImpl: async () =>
+          Response.json({ ok: false, error: 'token_expired' }, { status: 401 }),
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_auth_unauthorized': {
+      const result = await resolveWith({
+        fetchImpl: async () =>
+          Response.json({ ok: false, error: 'unauthorized' }, { status: 401 }),
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_manifest_invalid': {
+      const result = await resolveWith({
+        fetchImpl: async () =>
+          Response.json({
+            ok: true,
+            runtime: { platform: 'darwin-arm64', archiveUrl: '/runtime/archive' },
+          }),
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_manifest_not_ok': {
+      const result = await resolveWith({
+        fetchImpl: async () => Response.json({ ok: false }),
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_download_404': {
+      const archive = buildStandardArchive(dir);
+      archiveShaToNormalize = archive.sha256;
+      const manifest = standardManifest(archive);
+      const result = await resolveWith({
+        fetchImpl: async (input) => {
+          const url = input.toString();
+          if (url.includes('/manifest')) {
+            counters.manifestFetches += 1;
+            return Response.json({ ok: true, runtime: manifest });
+          }
+          return new Response('not found', { status: 404 });
+        },
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_checksum_mismatch': {
+      const manifest = {
+        version: '2026.04.29.9',
+        platform: 'darwin-arm64',
+        archiveUrl: '/runtime/archive',
+        archiveSha256: '0'.repeat(64),
+        codeServerVersion: '4.112.0',
+        codeServerBinPath: 'bin/code-server',
+        manifestPath: 'linzumi-editor-runtime.json',
+        assets: [],
+      };
+      const result = await resolveWith({
+        fetchImpl: async (input) =>
+          input.toString().includes('/manifest')
+            ? Response.json({ ok: true, runtime: manifest })
+            : new Response('not the approved archive', { status: 200 }),
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_extract_failed': {
+      const archive = buildStandardArchive(dir);
+      archiveShaToNormalize = archive.sha256;
+      const manifest = standardManifest(archive);
+      const result = await resolveWith({
+        fetchImpl: async (input) => {
+          const url = input.toString();
+          if (url.includes('/manifest')) {
+            return Response.json({ ok: true, runtime: manifest });
+          }
+          counters.archiveFetches += 1;
+          return new Response(readFileSync(archive.path), { status: 200 });
+        },
+        extractArchive: async () => false,
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_invalid_archive': {
+      const archive = buildStandardArchive(dir);
+      archiveShaToNormalize = archive.sha256;
+      const manifest = {
+        ...standardManifest(archive),
+        version: '2026.04.29.10',
+        assets: archive.assets.filter(
+          (asset) =>
+            asset.path !==
+            'kandan/editor_extensions/typefox.open-collaboration-tools.tar.gz'
+        ),
+      };
+      const result = await resolveWith({
+        fetchImpl: async (input) =>
+          input.toString().includes('/manifest')
+            ? Response.json({ ok: true, runtime: manifest })
+            : new Response(readFileSync(archive.path), { status: 200 }),
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_install_failed': {
+      const archive = buildStandardArchive(dir);
+      archiveShaToNormalize = archive.sha256;
+      const manifest = standardManifest(archive);
+      manifest.assets = [
+        ...manifest.assets,
+        { path: 'kandan/editor_extensions/extra.bin', sha256: 'a'.repeat(64), url: '/asset/boom' },
+      ];
+      const result = await resolveWith({
+        fetchImpl: async (input) => {
+          const url = input.toString();
+          if (url.includes('/manifest')) {
+            return Response.json({ ok: true, runtime: manifest });
+          }
+          if (url.includes('/runtime/archive')) {
+            return new Response(readFileSync(archive.path), { status: 200 });
+          }
+          throw new Error('scripted asset failure');
+        },
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      break;
+    }
+    case 'runtime_ready_and_cache': {
+      const archive = buildStandardArchive(dir);
+      archiveShaToNormalize = archive.sha256;
+      const manifest = standardManifest(archive);
+      const fetchImpl = async (input) => {
+        const url = input.toString();
+        if (url.includes('/manifest')) {
+          counters.manifestFetches += 1;
+          return Response.json({ ok: true, runtime: manifest });
+        }
+        counters.archiveFetches += 1;
+        return new Response(readFileSync(archive.path), { status: 200 });
+      };
+      const first = await resolveWith({ fetchImpl });
+      const second = await resolveWith({ fetchImpl });
+      record.result = runtimeResultProjection(first, cacheRoot);
+      record.second = runtimeResultProjection(second, cacheRoot);
+      record.archiveFetches = counters.archiveFetches;
+      record.installedManifestBytes = readFileSync(
+        join(cacheRoot, 'darwin-arm64', archive.sha256, 'linzumi-editor-runtime.json'),
+        'utf8'
+      );
+      record.tree = listTreeFiles(join(cacheRoot, 'darwin-arm64', archive.sha256));
+      break;
+    }
+    case 'runtime_upstream_assets': {
+      const packageRoot = 'code-server-4.103.2-linux-amd64';
+      const archive = buildUpstreamArchive(dir, packageRoot);
+      archiveShaToNormalize = archive.sha256;
+      const octExtension = 'oct extension tarball bytes';
+      const octServer = 'oct server tarball bytes';
+      const documentStatePackage = JSON.stringify({ name: 'kandan.document-state-telemetry' });
+      const documentStateExtension = 'module.exports = {};';
+      const vsdaJs = 'export default {};';
+      const vsdaWasm = 'wasm';
+      const manifest = {
+        version: '2026.05.02-code-server-4.103.2-linux-x64',
+        platform: 'linux-x64',
+        archiveUrl:
+          'https://github.com/coder/code-server/releases/download/v4.103.2/code-server-4.103.2-linux-amd64.tar.gz',
+        archiveSha256: archive.sha256,
+        codeServerVersion: '4.103.2',
+        codeServerBinPath: packageRoot + '/bin/code-server',
+        manifestPath: 'linzumi-editor-runtime.json',
+        assets: [
+          {
+            path: packageRoot + '/lib/vscode/node_modules/vsda/rust/web/vsda.js',
+            sha256: sha256(vsdaJs),
+            contentBase64: Buffer.from(vsdaJs).toString('base64'),
+          },
+          {
+            path: packageRoot + '/lib/vscode/node_modules/vsda/rust/web/vsda_bg.wasm',
+            sha256: sha256(vsdaWasm),
+            contentBase64: Buffer.from(vsdaWasm).toString('base64'),
+          },
+          {
+            path: 'kandan/editor_extensions/typefox.open-collaboration-tools.tar.gz',
+            sha256: sha256(octExtension),
+            url: '/api/v2/editor/runtime-assets/extensions/typefox.open-collaboration-tools.tar.gz',
+          },
+          {
+            path: 'kandan/editor_servers/open-collaboration-server.tar.gz',
+            sha256: sha256(octServer),
+            url: '/api/v2/editor/runtime-assets/servers/open-collaboration-server.tar.gz',
+          },
+          {
+            path: 'kandan/editor_extensions/kandan.document-state-telemetry/package.json',
+            sha256: sha256(documentStatePackage),
+            contentBase64: Buffer.from(documentStatePackage).toString('base64'),
+          },
+          {
+            path: 'kandan/editor_extensions/kandan.document-state-telemetry/out/extension.js',
+            sha256: sha256(documentStateExtension),
+            contentBase64: Buffer.from(documentStateExtension).toString('base64'),
+          },
+        ],
+      };
+      const result = await resolveWith({
+        platform: 'linux',
+        arch: 'x64',
+        fetchImpl: async (input, init) => {
+          const url = input.toString();
+          if (url.includes('/manifest')) {
+            return Response.json({ ok: true, runtime: manifest });
+          }
+          if (url.includes('code-server-4.103.2-linux-amd64.tar.gz')) {
+            authHeaderOnArchive = init?.headers !== undefined;
+            return new Response(readFileSync(archive.path), { status: 200 });
+          }
+          if (url.includes('typefox.open-collaboration-tools.tar.gz')) {
+            return new Response(octExtension, { status: 200 });
+          }
+          if (url.includes('open-collaboration-server.tar.gz')) {
+            return new Response(octServer, { status: 200 });
+          }
+          return new Response('not found', { status: 404 });
+        },
+      });
+      record.result = runtimeResultProjection(result, cacheRoot);
+      record.authHeaderOnArchive = authHeaderOnArchive;
+      record.installedVsdaJs =
+        result.runtime === undefined
+          ? null
+          : readFileSync(
+              join(
+                result.runtime.root,
+                packageRoot,
+                'lib',
+                'vscode',
+                'node_modules',
+                'vsda',
+                'rust',
+                'web',
+                'vsda.js'
+              ),
+              'utf8'
+            );
+      record.installedCollabTarball =
+        result.runtime === undefined
+          ? null
+          : readFileSync(result.runtime.assets.collaborationExtensionTarball, 'utf8');
+      break;
+    }
+    default:
+      return { threw: true, message: 'unknown runtime scenario ' + String(testCase.scenario) };
+  }
+  rmSync(dir, { recursive: true, force: true });
+  return archiveShaToNormalize === null
+    ? record
+    : substitute(record, archiveShaToNormalize, '$SHA');
+}
+
+// --- Pure ops ---------------------------------------------------------------------------------
+
+function launchOptionsFromScenario(scenario, dir) {
+  switch (scenario) {
+    case 'darwin_direct':
+      return {
+        codeServerBin: '/opt/homebrew/bin/code-server',
+        port: 5173,
+        cwd: '/Users/dev/code/project',
+        userDataDir: '/private/var/folders/editor-user-data',
+        extensionsDir: '/private/var/folders/editor-user-data/extensions',
+        platform: 'darwin',
+        sandboxExecBin: '/bin/sh',
+      };
+    case 'darwin_path': {
+      const binDir = join(dir, 'bin');
+      writeExecutable(join(binDir, 'code-server'), '#!/bin/sh\\nexit 0\\n');
+      return {
+        codeServerBin: 'code-server',
+        port: 5173,
+        cwd: '/Users/dev/code/project',
+        userDataDir: '/private/var/folders/editor-user-data',
+        extensionsDir: '/private/var/folders/editor-user-data/extensions',
+        platform: 'darwin',
+        sandboxExecBin: '/bin/sh',
+        envPath: binDir,
+      };
+    }
+    case 'darwin_runtime_root': {
+      const runtimeRoot = join(dir, 'runtime');
+      const bin = join(runtimeRoot, 'bin', 'code-server');
+      writeExecutable(bin, '#!/bin/sh\\nexit 0\\n');
+      return {
+        codeServerBin: bin,
+        codeServerRuntimeRoot: runtimeRoot,
+        port: 5173,
+        cwd: '/Users/dev/code/project',
+        userDataDir: '/private/var/folders/editor-user-data',
+        extensionsDir: '/private/var/folders/editor-user-data/extensions',
+        platform: 'darwin',
+        sandboxExecBin: '/bin/sh',
+      };
+    }
+    case 'darwin_missing_path':
+      return {
+        codeServerBin: 'code-server',
+        port: 5173,
+        cwd: '/Users/dev/code/project',
+        userDataDir: '/private/var/folders/editor-user-data',
+        extensionsDir: '/private/var/folders/editor-user-data/extensions',
+        platform: 'darwin',
+        sandboxExecBin: '/bin/sh',
+        envPath: '',
+      };
+    case 'darwin_no_extensions':
+      return {
+        codeServerBin: '/opt/homebrew/bin/code-server',
+        port: 4171,
+        cwd: '/workspace/project',
+        userDataDir: '/tmp/editor-user-data',
+        platform: 'darwin',
+        envPath: '',
+      };
+    case 'linux_bwrap': {
+      const runtimeRoot = join(dir, 'runtime');
+      const bin = join(runtimeRoot, 'bin', 'code-server');
+      const bwrapBin = join(dir, 'bin', 'bwrap');
+      writeExecutable(bin, '#!/bin/sh\\nexit 0\\n');
+      writeExecutable(bwrapBin, '#!/bin/sh\\nexit 0\\n');
+      return {
+        codeServerBin: bin,
+        codeServerRuntimeRoot: runtimeRoot,
+        port: 5173,
+        cwd: '/workspace/project',
+        userDataDir: '/tmp/editor-user-data',
+        extensionsDir: '/tmp/editor-user-data/extensions',
+        platform: 'linux',
+        bubblewrapBin: bwrapBin,
+      };
+    }
+    case 'linux_missing_bwrap':
+      return {
+        codeServerBin: '/usr/local/bin/code-server',
+        port: 5173,
+        cwd: '/workspace/project',
+        userDataDir: '/tmp/editor-user-data',
+        extensionsDir: '/tmp/editor-user-data/extensions',
+        platform: 'linux',
+        envPath: '',
+      };
+    case 'unsupported':
+      return {
+        codeServerBin: '/usr/local/bin/code-server',
+        port: 5173,
+        cwd: '/workspace/project',
+        userDataDir: '/tmp/editor-user-data',
+        extensionsDir: '/tmp/editor-user-data/extensions',
+        platform: 'freebsd',
+      };
+    default:
+      throw new Error('unknown launch scenario ' + String(scenario));
+  }
+}
+
+function collaborationFromJson(value) {
+  if (value === null || value === undefined) {
+    return undefined;
+  }
+  return {
+    provider: value.provider,
+    editorSessionId: value.editorSessionId,
+    runtimeSessionId: value.runtimeSessionId,
+    roomId: value.roomId,
+    extensionAssetPath: value.extensionAssetPath,
+    serverAssetPath: value.serverAssetPath,
+    ...(value.bootstrapToken === null || value.bootstrapToken === undefined
+      ? {}
+      : { bootstrapToken: value.bootstrapToken }),
+    ...(value.serverPort === undefined || value.serverPort === null
+      ? {}
+      : {
+          serverPort: value.serverPort,
+          serverUrl: value.serverUrl,
+          bootstrapServerUrl: value.bootstrapServerUrl,
+          collaborationStateUrl: value.collaborationStateUrl,
+        }),
+  };
+}
+
+function runningCollaborationFromJson(value) {
+  if (value === null || value === undefined) {
+    return undefined;
+  }
+  return {
+    provider: value.provider,
+    editorSessionId: value.editorSessionId,
+    runtimeSessionId: value.runtimeSessionId,
+    roomId: value.roomId,
+    serverPort: value.serverPort,
+    serverUrl: value.serverUrl,
+    bootstrapServerUrl: value.bootstrapServerUrl,
+    collaborationStateUrl: value.collaborationStateUrl,
+    process: { kill: () => true },
+    exited: Promise.resolve(),
+  };
+}
+
+async function handle(testCase) {
+  switch (testCase.op) {
+    case 'code_server_args':
+      return outcome(() =>
+        codeServerArgs(
+          testCase.port,
+          testCase.cwd,
+          testCase.userDataDir,
+          testCase.extensionsDir === null ? undefined : testCase.extensionsDir
+        )
+      );
+    case 'code_server_env':
+      return outcome(() =>
+        codeServerEnv(
+          testCase.env,
+          testCase.cwd,
+          testCase.userDataDir,
+          runningCollaborationFromJson(testCase.collaboration)
+        )
+      );
+    case 'settings_object':
+      return outcome(() =>
+        JSON.stringify(
+          codeServerSettingsForTest(collaborationFromJson(testCase.collaboration)),
+          null,
+          2
+        )
+      );
+    case 'collaboration_prepare':
+      return outcome(() =>
+        orNull(
+          prepareLocalEditorCollaboration(
+            collaborationFromJson(testCase.collaboration),
+            testCase.runnerId,
+            testCase.serverPort === null ? undefined : testCase.serverPort,
+            testCase.browserBaseUrl
+          )
+        )
+      );
+    case 'browser_base_url':
+      return outcome(() =>
+        orNull(
+          localEditorBrowserBaseUrlForTest(
+            {
+              type: 'start_local_editor',
+              cwd: '/tmp',
+              ...(testCase.control === null ? {} : { browserBaseUrl: testCase.control }),
+            },
+            {
+              codeServerBin: undefined,
+              allowedCwds: [],
+              currentState: { status: 'disabled' },
+              ...(testCase.options === null ? {} : { browserBaseUrl: testCase.options }),
+            }
+          )
+        )
+      );
+    case 'capabilities': {
+      const runtime =
+        testCase.hasRuntime === true
+          ? fakeInstalledEditorRuntime(scratch(), 'code-server')
+          : undefined;
+      const state =
+        testCase.state.status === 'running'
+          ? {
+              status: 'running',
+              cwd: testCase.state.cwd,
+              port: testCase.state.port,
+              process: { kill: () => true },
+              exited: Promise.resolve(),
+              ...(testCase.state.collaboration === null ||
+              testCase.state.collaboration === undefined
+                ? {}
+                : {
+                    collaboration: runningCollaborationFromJson(testCase.state.collaboration),
+                  }),
+            }
+          : { status: 'disabled' };
+      return outcome(() => localEditorCapabilities(runtime, testCase.allowedCwds, state));
+    }
+    case 'node_runtime_executable':
+      return outcome(() => nodeRuntimeExecutable(testCase.env, testCase.execPath));
+    case 'wrapped_bin': {
+      const dir = scratch();
+      const binPath = join(dir, 'code-server');
+      if (testCase.script !== null) {
+        writeFileSync(binPath, testCase.script);
+      }
+      return outcome(() => wrappedCodeServerBinForTest(binPath));
+    }
+    case 'launch_prepare': {
+      const dir = scratch();
+      const options = launchOptionsFromScenario(testCase.scenario, dir);
+      const result = prepareCodeServerLaunch(options);
+      return substitute(result, dir, '$DIR');
+    }
+    case 'profile_prepare': {
+      const dir = scratch();
+      const scenarioRuntime = () => {
+        switch (testCase.scenario) {
+          case 'plain':
+          case 'collab':
+            return undefined;
+          case 'with_runtime':
+            return fakeInstalledEditorRuntime(dir, '/usr/local/bin/code-server');
+          case 'missing_assets':
+            return fakeInstalledEditorRuntime(dir, '/usr/local/bin/code-server', {
+              withBrowserAssets: false,
+            });
+          case 'wrapper_runtime': {
+            const realRoot = join(dir, 'real-code-server');
+            const wrapperBin = join(dir, '.fake-runtime', 'bin', 'code-server');
+            writeExecutable(
+              wrapperBin,
+              '#!/bin/sh\\nexec "' + join(realRoot, 'bin', 'code-server') + '" "$@"\\n'
+            );
+            writeBrowserAssetInputs(realRoot);
+            const runtime = fakeInstalledEditorRuntime(dir, wrapperBin, {
+              withBrowserAssets: false,
+            });
+            return runtime;
+          }
+          default:
+            throw new Error('unknown profile scenario ' + String(testCase.scenario));
+        }
+      };
+      const runtime = scenarioRuntime();
+      const collaboration =
+        testCase.scenario === 'collab'
+          ? prepareLocalEditorCollaboration(
+              collaborationFromJson(testCase.collaboration),
+              'runner-a',
+              5555,
+              'https://linzumi.io:4140'
+            )
+          : undefined;
+      const result = prepareCodeServerProfile(collaboration, runtime);
+      const record = { ok: result.ok };
+      if (result.ok) {
+        record.settingsBytes = readFileSync(
+          join(result.userDataDir, 'User', 'settings.json'),
+          'utf8'
+        );
+        record.tmpExists = existsSync(join(result.userDataDir, 'tmp'));
+        record.extensionsDirName = relative(result.userDataDir, result.extensionsDir);
+        record.collaborationServerDirName = relative(
+          result.userDataDir,
+          result.collaborationServerDir
+        );
+        record.documentStateInstalled = existsSync(
+          join(result.extensionsDir, 'kandan.document-state-telemetry', 'package.json')
+        );
+        if (runtime !== undefined && testCase.scenario === 'with_runtime') {
+          record.repairedGitBase = readFileSync(
+            join(
+              runtime.root,
+              'lib',
+              'vscode',
+              'extensions',
+              'git-base',
+              'dist',
+              'browser',
+              'extension.js'
+            ),
+            'utf8'
+          );
+          record.repairedMergeConflict = readFileSync(
+            join(
+              runtime.root,
+              'lib',
+              'vscode',
+              'extensions',
+              'merge-conflict',
+              'dist',
+              'browser',
+              'mergeConflictMain.js'
+            ),
+            'utf8'
+          );
+        }
+        if (testCase.scenario === 'wrapper_runtime') {
+          record.repairedGitBase = readFileSync(
+            join(
+              dir,
+              'real-code-server',
+              'lib',
+              'vscode',
+              'extensions',
+              'git-base',
+              'dist',
+              'browser',
+              'extension.js'
+            ),
+            'utf8'
+          );
+        }
+        rmSync(result.userDataDir, { recursive: true, force: true });
+      } else {
+        record.reason = result.reason;
+      }
+      return record;
+    }
+    case 'runtime_platform':
+      return outcome(() => orNull(editorRuntimePlatform(testCase.platform, testCase.arch)));
+    case 'status_payload':
+      return outcome(() => editorRuntimeStatusPayload(testCase.status));
+    case 'manifest_normalize':
+      return outcome(() => normalizeManifestForTest(testCase.value));
+    case 'runtime_install_root':
+      return outcome(() =>
+        runtimeInstallRootForTest(testCase.cacheRoot, {
+          platform: testCase.platform,
+          archiveSha256: testCase.archiveSha256,
+        })
+      );
+    case 'code_server_runtime_root':
+      return outcome(() => codeServerRuntimeRootForTest(testCase.binPath));
+    case 'same_origin':
+      return outcome(() => sameOriginForTest(new URL(testCase.left), new URL(testCase.right)));
+    case 'default_cache_root':
+      return outcome(() => substitute(defaultEditorRuntimeCacheRootForTest(), homedir(), '$HOME'));
+    case 'start_editor_flow':
+      return handleStartEditorFlow(testCase);
+    case 'resolve_runtime_flow':
+      return handleResolveRuntimeFlow(testCase);
+    default:
+      return { threw: true, message: 'unknown op ' + String(testCase.op) };
+  }
+}
+
+let stdin = '';
+process.stdin.setEncoding('utf8');
+for await (const chunk of process.stdin) {
+  stdin += chunk;
+}
+const cases = JSON.parse(stdin);
+const results = [];
+for (const testCase of cases) {
+  results.push(await handle(testCase));
+}
+process.stdout.write(JSON.stringify(results));
+`;
+
+await mkdir(join(packageRoot, '.differential'), { recursive: true });
+
+await build({
+  stdin: {
+    contents: driverSource,
+    resolveDir: packageRoot,
+    sourcefile: 'editor-parity-driver.ts',
+    loader: 'ts',
+  },
+  bundle: true,
+  platform: 'node',
+  target: 'node20',
+  format: 'esm',
+  outfile: join(packageRoot, '.differential/editor-parity-oracle.mjs'),
+  minify: false,
+  sourcemap: false,
+  legalComments: 'none',
+  external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
+});