@linzumi/cli 1.0.118 → 1.0.120

package/scripts/build-vm-sandbox-parity-oracle.mjs

@@ -0,0 +1,1266 @@
+// Spec: kandan/plans/2026-07-10-compute-nodes-rescript-commander-zero-ts-program.md
+// (M3 cluster 14, vmSandbox).
+// Relationship: Builds the TS-side PARITY ORACLE for the vmSandbox area of
+// the ReScript commander port. The oracle esbuild-bundles the REAL TS
+// vmSandbox modules - the egress-policy gate, the guest cloud turn codec +
+// exit-line/preflight parses, every guest provisioning/liveness command
+// builder, the packed-golden capability probe + CLI argv builders, the VM
+// execution state file + marker registries, the golden select/query/gc
+// planning stack, the golden build pure core (manifest/checksum/manager
+// detection), the local/cloud readiness aggregators over scripted probes,
+// the supervisor config codec + create-boundary egress resolution + the
+// goldenUsableForEgress security decision, the guest cloud supervisor's
+// pure predicates, the cloud backend codecs (key resolution, gates,
+// redaction, SSE parse), the workspace-agent identity gate, the job
+// worktree lifecycle over a scripted GitRunner, the relay script emitter,
+// and the vm CLI help/dispatch surface - behind the cluster 1/2 one-shot
+// BATCH driver (a JSON array of cases on stdin, a JSON array of results on
+// stdout).
+//
+// Determinism: filesystem-touching ops run in per-case mkdtemp scratch dirs
+// normalized through "$DIR"; env-reading ops take env as a PARAMETER where
+// the TS function accepts one, and only the vmCli ops (whose bodies read
+// process.env through defaulted params) set/restore process.env around the
+// call. Scripted fetch/git/query seams are built from the case JSON.
+//
+// SECRETS: synthetic case payloads only; .differential/ is gitignored.
+import { mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+const driverSource = `
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  DEFAULT_VM_EGRESS_MODE,
+  PLACEHOLDER_GATEWAY_CIDR,
+  assertEgressPolicyUpheld,
+  defaultGatewayEgressCidrs,
+  isPlaceholderEgressPolicy,
+  isValidEgressCidr,
+  isWideOpenCidr,
+  normalizeVmEgressMode,
+  openEgressPolicy,
+  resolveVmEgressPolicy,
+  resolveVmEgressPolicyForActiveVm,
+} from './src/vmSandbox/vmEgressPolicy';
+import {
+  GUEST_CLOUD_TURN_EXIT_PHASE,
+  GuestCloudTurnSecretEnv,
+  decodeGuestCloudTurnConfig,
+  encodeGuestCloudTurnConfig,
+} from './src/vmSandbox/vmCloudTurnProtocol';
+import {
+  CloudTurnError,
+  DEFAULT_CLOUD_TURN_TIMEOUT_MS,
+  cloudSupervisorConstsForTest,
+  cloudTurnTimeoutMs,
+  injectTurnSecrets,
+  parseCloudTurnExitLineForTest,
+  parsePreflightOutput,
+} from './src/vmSandbox/vmCloudSupervisor';
+import * as guestProvision from './src/vmSandbox/vmGuestProvision';
+import * as guestCloudProvision from './src/vmSandbox/vmGuestCloudProvision';
+import {
+  PackedGoldenUnavailableError,
+  isRegistryLocked,
+  machineCreateFromArgs,
+  macE2fsprogsSbin,
+  mkfsExt4Candidates,
+  packCreateFromVmArgs,
+  packedCreateRetryAttempts,
+  packedCreateRetryBaseMs,
+  packedSidecarPath,
+  probePackedGoldenCapability,
+  resolveSmolNativeLayout,
+  smolCliEnv,
+  smolNativePlatformDir,
+} from './src/vmSandbox/vmPackedGolden';
+import {
+  GOLDEN_MACHINE_NAME_PREFIX,
+  defaultGuestCpus,
+  defaultGuestMemoryMb,
+  goldensToReap,
+  guestCodexVersion,
+  isGoldenMachineName,
+  pinnedGuestCodexVersion,
+  pinnedSmolmachinesVersion,
+  readGoldenMachineRegistrations,
+  readVmExecutionState,
+  readVmMachines,
+  registerGoldenMachine,
+  registerVmMachine,
+  setVmExecutionEnabled,
+  unregisterGoldenMachines,
+  unregisterVmMachines,
+  vmExecutionEnabled,
+  vmMachineName,
+  vmRuntimeDirPath,
+  vmStateFilePath,
+  writeVmExecutionState,
+} from './src/vmSandbox/vmExecutionConfig';
+import { normalizeGitRemoteUrl } from './src/vmSandbox/vmGoldenKeys';
+import { resolveGoldenForJob } from './src/vmSandbox/vmGoldenSelect';
+import {
+  createGoldenQueryTransport,
+  goldenGraphqlEndpoint,
+  goldenImagesByProjectDocument,
+  latestGoldenImageDocument,
+  nodeToRecordForTest,
+  recordFromByProjectForTest,
+  recordFromLatestForTest,
+} from './src/vmSandbox/vmGoldenQuery';
+import {
+  defaultGoldenGcGraceMs,
+  defaultGoldenGcIntervalMs,
+  fetchGoldenKeepSet,
+  goldenGcProjectsDocument,
+  goldenGcViewerWorkspacesDocument,
+  reconcileGoldenMachines,
+} from './src/vmSandbox/vmGoldenGc';
+import {
+  buildLockfileHashes,
+  coldRebuildFallbackReason,
+  detectPackageManager,
+  goldenArtifactPath,
+  goldenBuildMachineName,
+  goldenBuildManifest,
+  goldenLockfileNames,
+  goldenManifestChecksum,
+  goldenToolchainProbes,
+  isWellFormedGoldenBuildResult,
+  packageManagerInstallScript,
+  repoKeyForTarget,
+  resolveSnapshotOutcome,
+} from './src/vmSandbox/vmGoldenBuild';
+import {
+  osLabelFor,
+  probeLocalVmReadiness,
+  runtimeVersionIsForkable,
+} from './src/vmSandbox/vmLocalVmReadiness';
+import {
+  SMOLCLOUD_COMPUTE_KEY_PREFIX,
+  probeSmolcloudReadiness,
+  smolcloudComputeKey,
+} from './src/vmSandbox/vmCloudVmReadiness';
+import {
+  decodeVmSupervisorConfig,
+  encodeVmSupervisorConfig,
+  forkRetryConstsForTest,
+  goldenUsableForEgress,
+  guestDiagnosticsMarker,
+  guestLinzumiMcpCodexArgs,
+  guestLinzumiMcpServerConfig,
+  isEagainForTest,
+  resolveCreateMachineEgressPolicy,
+  smolmachinesSupportsGoldenBoot,
+  vmSupervisorReadyPrefix,
+} from './src/vmSandbox/vmCodexSupervisor';
+import {
+  agentMessageTextFromParams,
+  assertDangerFullAccess,
+  guestTurnProgressConstsForTest,
+  isBenignReplyDedupe,
+  isSuccessfulAgentReplyToolCall,
+} from './src/vmSandbox/guestCloudSupervisor';
+import {
+  SMOLCLOUD_DEFAULT_BASE_URL,
+  cloudMachineSource,
+  cloudTimeoutConstsForTest,
+  encodeCloudPath,
+  parseSseExecEvents,
+  redactCloudSecrets,
+  resolveCloudConnection,
+  resolveSmolcloudApiKey,
+  vmCloudAgentExecutionEnabled,
+  vmCloudAgentExplicitlyDisabled,
+  vmCloudExecutionEnabled,
+} from './src/vmSandbox/vmCloudBackend';
+import {
+  AGENT_HOME,
+  AGENT_HOME_PROVISIONED_MARKER,
+  AGENT_MACHINE_NAME_PREFIX,
+  DEFAULT_AGENT_AUTO_STOP_SECONDS,
+  DEFAULT_AGENT_CPUS,
+  DEFAULT_AGENT_DISK_GB,
+  DEFAULT_AGENT_IMAGE,
+  DEFAULT_AGENT_MEMORY_MB,
+  DEFAULT_MAX_CONCURRENT_TURNS,
+  agentMachineName,
+  agentVolumeName,
+  assertValidWorkspacePublicId,
+  verifyWorkspaceAgentMachine,
+} from './src/vmSandbox/vmCloudAgentWorkspace';
+import {
+  JOB_WORKTREES_DIRNAME,
+  jobBranchName,
+  jobWorktreeMounts,
+  jobWorktreePath,
+  prepareJobWorktree,
+  removeJobWorktree,
+  resolveRepoToplevel,
+} from './src/vmSandbox/vmJobWorktree';
+import { vmRelayScriptSource, vmTunnelWireConstsForTest } from './src/vmSandbox/vmTunnel';
+import { runVmCommand, vmHelpText } from './src/vmSandbox/vmCli';
+import {
+  readyTimeoutMsForTest,
+  scrubSupervisorEnv,
+  startVmConstsForTest,
+} from './src/vmSandbox/startVmCodexAppServer';
+import { buildVmLinzumiMcpConfig } from './src/vmSandbox/startVmCodexAppServer';
+
+const dirPlaceholder = '$DIR';
+
+function scratch() {
+  return realpathSync(mkdtempSync(join(tmpdir(), 'linzumi-vm-sandbox-oracle-')));
+}
+
+function substitute(value, from, to) {
+  if (typeof value === 'string') {
+    return value.split(from).join(to);
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => substitute(entry, from, to));
+  }
+  if (typeof value === 'object' && value !== null) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [
+        substitute(key, from, to),
+        substitute(entry, from, to),
+      ])
+    );
+  }
+  return value;
+}
+
+function outcome(run) {
+  try {
+    const value = run();
+    return value === undefined ? { defined: false } : { defined: true, value };
+  } catch (error) {
+    return {
+      threw: true,
+      message: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+async function outcomeAsync(run) {
+  try {
+    const value = await run();
+    return value === undefined ? { defined: false } : { defined: true, value };
+  } catch (error) {
+    return {
+      threw: true,
+      message: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+function withCapturedWarn(run) {
+  const warns = [];
+  const original = console.warn;
+  console.warn = (line) => warns.push(String(line));
+  try {
+    return { outcome: outcome(run), warns };
+  } finally {
+    console.warn = original;
+  }
+}
+
+const savedEnv = {};
+
+function setCaseEnv(env) {
+  for (const [key, value] of Object.entries(env ?? {})) {
+    savedEnv[key] = process.env[key];
+    if (value === null) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+}
+
+function restoreCaseEnv() {
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+    delete savedEnv[key];
+  }
+}
+
+// --- Wire-order builders --------------------------------------------------------
+
+// The guest cloud turn config in the exact runCloudTurn insertion order.
+function turnConfigFromFields(fields) {
+  return {
+    codexVersion: fields.codexVersion,
+    input: fields.input,
+    ...(fields.model === undefined ? {} : { model: fields.model }),
+    ...(fields.reasoningEffort === undefined
+      ? {}
+      : { reasoningEffort: fields.reasoningEffort }),
+    sandbox: fields.sandbox,
+    approvalPolicy: fields.approvalPolicy,
+    ...(fields.modelProvider === undefined
+      ? {}
+      : { modelProvider: fields.modelProvider }),
+    kandanUrl: fields.kandanUrl,
+    ...(fields.threadId === undefined ? {} : { threadId: fields.threadId }),
+    ...(fields.sourceSeq === undefined ? {} : { sourceSeq: fields.sourceSeq }),
+    ...(fields.codexThreadId === undefined
+      ? {}
+      : { codexThreadId: fields.codexThreadId }),
+    ...(fields.ownerUsername === undefined
+      ? {}
+      : { ownerUsername: fields.ownerUsername }),
+    cwd: fields.cwd,
+    appServerPort: fields.appServerPort,
+    ...(fields.turnNonce === undefined ? {} : { turnNonce: fields.turnNonce }),
+  };
+}
+
+// --- Guest command dispatch ------------------------------------------------------
+
+function handleGuestCmd(testCase) {
+  const v = testCase.version;
+  switch (testCase.fn) {
+    case 'provisionMarkerPath':
+      return outcome(() => guestProvision.guestProvisionMarkerPath(v));
+    case 'provisionCommand':
+      return outcome(() => guestProvision.guestProvisionCommand(v));
+    case 'provisionCheckCommand':
+      return outcome(() => guestProvision.guestProvisionCheckCommand(v));
+    case 'ensureDnsCommand':
+      return outcome(() => guestProvision.guestEnsureDnsCommand());
+    case 'codexEnvFileContents':
+      return outcome(() =>
+        guestProvision.guestCodexEnvFileContents(
+          Object.fromEntries(testCase.envPairs)
+        )
+      );
+    case 'startCodexCommand':
+      return outcome(() =>
+        guestProvision.guestStartCodexCommand({
+          cwd: testCase.cwd,
+          codexArgs: testCase.codexArgs,
+        })
+      );
+    case 'scrubSecretsCommand':
+      return outcome(() => guestProvision.guestScrubSecretsCommand());
+    case 'readyzCheckCommand':
+      return outcome(() => guestProvision.guestReadyzCheckCommand(testCase.port));
+    case 'startRelayCommand':
+      return outcome(() => guestProvision.guestStartRelayCommand());
+    case 'stopCodexCommand':
+      return outcome(() => guestProvision.guestStopCodexCommand());
+    case 'resetCodexCommand':
+      return outcome(() => guestProvision.guestResetCodexCommand());
+    case 'diagnosticsCommand':
+      return outcome(() => guestProvision.guestDiagnosticsCommand());
+    case 'shellQuote':
+      return outcome(() => guestProvision.shellQuote(testCase.value));
+    case 'localPaths':
+      return outcome(() => ({
+        provisionMarkerVersion: guestProvision.provisionMarkerVersion,
+        guestRelayScriptPath: guestProvision.guestRelayScriptPath,
+        guestCodexLogPath: guestProvision.guestCodexLogPath,
+        guestRelayLogPath: guestProvision.guestRelayLogPath,
+        guestMcpServerScriptPath: guestProvision.guestMcpServerScriptPath,
+        guestSecretsDir: guestProvision.guestSecretsDir,
+        guestCodexHome: guestProvision.guestCodexHome,
+        guestMcpAuthFilePath: guestProvision.guestMcpAuthFilePath,
+        guestCodexEnvFilePath: guestProvision.guestCodexEnvFilePath,
+        guestCaBundlePath: guestProvision.guestCaBundlePath,
+        guestDnsNameservers: guestProvision.guestDnsNameservers,
+      }));
+    case 'cloudProvisionMarkerPath':
+      return outcome(() => guestCloudProvision.guestCloudProvisionMarkerPath(v));
+    case 'cloudProvisionCommand':
+      return outcome(() => guestCloudProvision.guestCloudProvisionCommand(v));
+    case 'cloudProvisionCheckCommand':
+      return outcome(() =>
+        guestCloudProvision.guestCloudProvisionCheckCommand(v)
+      );
+    case 'cloudPreflightCommand':
+      return outcome(() => guestCloudProvision.guestCloudPreflightCommand(v));
+    case 'cloudScrubSecretsCommand':
+      return outcome(() => guestCloudProvision.guestCloudScrubSecretsCommand());
+    case 'assertTurnNonce':
+      return outcome(() => {
+        guestCloudProvision.assertValidTurnNonce(testCase.nonce);
+        return 'ok';
+      });
+    case 'heartbeatPath':
+      return outcome(() => guestCloudProvision.guestCloudHeartbeatPath(testCase.nonce));
+    case 'exitMarkerPath':
+      return outcome(() => guestCloudProvision.guestCloudExitMarkerPath(testCase.nonce));
+    case 'turnProbeCommand':
+      return outcome(() => guestCloudProvision.guestCloudTurnProbeCommand(testCase.nonce));
+    case 'turnProbeCleanupCommand':
+      return outcome(() =>
+        guestCloudProvision.guestCloudTurnProbeCleanupCommand(testCase.nonce)
+      );
+    case 'cloudPaths':
+      return outcome(() => ({
+        cloudProvisionMarkerVersion: guestCloudProvision.cloudProvisionMarkerVersion,
+        guestCloudAppServerPort: guestCloudProvision.guestCloudAppServerPort,
+        guestCloudSupervisorPath: guestCloudProvision.guestCloudSupervisorPath,
+        guestCloudMcpBundlePath: guestCloudProvision.guestCloudMcpBundlePath,
+        guestCloudSecretsDir: guestCloudProvision.guestCloudSecretsDir,
+        guestCloudMcpAuthPath: guestCloudProvision.guestCloudMcpAuthPath,
+        guestCloudCodexHome: guestCloudProvision.guestCloudCodexHome,
+        guestCloudThreadMapPath: guestCloudProvision.guestCloudThreadMapPath,
+        guestCloudCaBundlePath: guestCloudProvision.guestCloudCaBundlePath,
+        guestCloudHeartbeatDir: guestCloudProvision.guestCloudHeartbeatDir,
+        guestHeartbeatIntervalMs: guestCloudProvision.GUEST_HEARTBEAT_INTERVAL_MS,
+        agentHome: AGENT_HOME,
+        agentHomeProvisionedMarker: AGENT_HOME_PROVISIONED_MARKER,
+      }));
+    default:
+      return { threw: true, message: 'unknown guestCmd fn ' + String(testCase.fn) };
+  }
+}
+
+// --- Scripted seams ---------------------------------------------------------------
+
+function scriptedGoldenQuery(spec, trace) {
+  return async (args) => {
+    trace.push({ t: 'query', args: { ...args, explicitGoldenId: args.explicitGoldenId ?? null } });
+    const scripted = spec[args.projectId] ?? spec['*'] ?? { kind: 'null' };
+    if (scripted.kind === 'throw') {
+      throw new Error(scripted.message);
+    }
+    return scripted.kind === 'record' ? scripted.record : null;
+  };
+}
+
+function scriptedFetch(routes, requests) {
+  return async (url, init) => {
+    const urlText = String(url);
+    requests.push({
+      url: urlText,
+      method: init?.method ?? 'GET',
+      body: init?.body === undefined ? null : JSON.parse(init.body),
+    });
+    const route = routes.find((candidate) => urlText.endsWith(candidate.suffix));
+    if (route === undefined) {
+      throw new Error('no scripted route for ' + urlText);
+    }
+    if (route.abort === true) {
+      const error = new Error('This operation was aborted');
+      error.name = 'AbortError';
+      throw error;
+    }
+    if (route.networkError !== undefined) {
+      throw new Error(route.networkError);
+    }
+    return {
+      ok: route.status >= 200 && route.status < 300,
+      status: route.status,
+      statusText: route.statusText ?? '',
+      headers: { get: () => 'application/json' },
+      json: async () => route.body,
+      text: async () => JSON.stringify(route.body ?? ''),
+    };
+  };
+}
+
+function scriptedGitRunner(script, trace) {
+  return async (cwd, args) => {
+    const key = args.join(' ');
+    trace.push({ t: 'git', cwd, args: [...args] });
+    const scripted = script[key];
+    if (scripted === undefined) {
+      throw new Error('no scripted git for ' + key);
+    }
+    if (scripted.err !== undefined) {
+      throw new Error(scripted.err);
+    }
+    return scripted.out ?? '';
+  };
+}
+
+// --- Op dispatch --------------------------------------------------------------------
+
+async function handle(testCase) {
+  switch (testCase.op) {
+    // ---- egress -------------------------------------------------------------------
+    case 'egressDefaults':
+      return outcome(() => ({
+        placeholder: PLACEHOLDER_GATEWAY_CIDR,
+        defaults: [...defaultGatewayEgressCidrs],
+        defaultMode: DEFAULT_VM_EGRESS_MODE,
+      }));
+    case 'egressNormalize':
+      return outcome(() => normalizeVmEgressMode(testCase.value));
+    case 'egressValidCidr':
+      return outcome(() => isValidEgressCidr(testCase.cidr));
+    case 'egressWideOpen':
+      return outcome(() => isWideOpenCidr(testCase.cidr));
+    case 'egressResolve':
+      return outcome(() => resolveVmEgressPolicy(testCase.env));
+    case 'egressPlaceholder':
+      return outcome(() => isPlaceholderEgressPolicy(testCase.env));
+    case 'egressOpenPolicy':
+      return outcome(() => openEgressPolicy());
+    case 'egressResolveActive': {
+      const logs = [];
+      const result = outcome(() =>
+        resolveVmEgressPolicyForActiveVm(testCase.env, testCase.mode, (line) =>
+          logs.push(line)
+        )
+      );
+      return { result, logs };
+    }
+    case 'egressAssert':
+      return outcome(() => assertEgressPolicyUpheld(testCase.policy));
+    // ---- turn codec ------------------------------------------------------------------
+    case 'turnEncode':
+      return outcome(() =>
+        encodeGuestCloudTurnConfig(turnConfigFromFields(testCase.fields))
+      );
+    case 'turnDecode':
+      return outcome(() => decodeGuestCloudTurnConfig(testCase.encoded));
+    case 'exitLine':
+      return outcome(() => parseCloudTurnExitLineForTest(testCase.line));
+    case 'preflightParse':
+      return outcome(() => parsePreflightOutput(testCase.stdout));
+    case 'injectSecrets':
+      return outcome(() =>
+        injectTurnSecrets({
+          codexVersion: 'x',
+          input: [],
+          sandbox: 'danger-full-access',
+          approvalPolicy: 'never',
+          kandanUrl: 'https://scripted.example',
+          cwd: '/scripted',
+          mcpAuthFileContents: testCase.mcpAuthFileContents,
+          ...(testCase.llmProxyToken === undefined || testCase.llmProxyToken === null
+            ? {}
+            : { llmProxyToken: testCase.llmProxyToken }),
+        })
+      );
+    case 'cloudTurnTimeout':
+      return outcome(() => cloudTurnTimeoutMs(testCase.env));
+    case 'cloudTurnError':
+      return outcome(() => {
+        const error = new CloudTurnError(testCase.message, testCase.retryable);
+        return { name: error.name, message: error.message, retryable: error.retryable };
+      });
+    case 'cloudConsts':
+      return outcome(() => ({
+        defaultCloudTurnTimeoutMs: DEFAULT_CLOUD_TURN_TIMEOUT_MS,
+        exitPhase: GUEST_CLOUD_TURN_EXIT_PHASE,
+        secretEnv: { ...GuestCloudTurnSecretEnv },
+        ...cloudSupervisorConstsForTest,
+      }));
+    // ---- guest commands ------------------------------------------------------------------
+    case 'guestCmd':
+      return handleGuestCmd(testCase);
+    // ---- packed golden -------------------------------------------------------------------
+    case 'packedPlatformDir':
+      return outcome(() => smolNativePlatformDir(testCase.platform, testCase.arch));
+    case 'packedLayout':
+      return outcome(() =>
+        resolveSmolNativeLayout(testCase.runtimeDir, testCase.platform, testCase.arch)
+      );
+    case 'packedCapability':
+      return outcome(() =>
+        probePackedGoldenCapability({
+          runtimeDir: testCase.runtimeDir,
+          platform: testCase.platform,
+          arch: testCase.arch,
+          fileExists: (path) => testCase.files.includes(path),
+          hasMkfsExt4: () => testCase.mkfs === true,
+        })
+      );
+    case 'smolCliEnv':
+      return outcome(() => smolCliEnv(testCase.layout, testCase.baseEnv));
+    case 'packArgs':
+      return outcome(() =>
+        packCreateFromVmArgs({
+          machineName: testCase.machineName,
+          outBase: testCase.outBase,
+          layout: testCase.layout,
+        })
+      );
+    case 'sidecarPath':
+      return outcome(() => packedSidecarPath(testCase.outBase));
+    case 'machineFromArgs':
+      return outcome(() =>
+        machineCreateFromArgs({
+          jobMachineName: testCase.jobMachineName,
+          sidecarPath: testCase.sidecarPath,
+        })
+      );
+    case 'registryLocked':
+      return outcome(() => isRegistryLocked(testCase.message));
+    case 'packedConsts':
+      return outcome(() => ({
+        macE2fsprogsSbin,
+        mkfsExt4Candidates: [...mkfsExt4Candidates],
+        packedCreateRetryAttempts,
+        packedCreateRetryBaseMs,
+      }));
+    case 'packedUnavailableMessage':
+      return outcome(() => new PackedGoldenUnavailableError(testCase.blockers).message);
+    // ---- execution config -------------------------------------------------------------------
+    case 'pins':
+      return outcome(() => ({
+        pinnedSmolmachinesVersion,
+        pinnedGuestCodexVersion,
+        defaultGuestCpus,
+        defaultGuestMemoryMb,
+        goldenMachineNamePrefix: GOLDEN_MACHINE_NAME_PREFIX,
+        defaultAgentImage: DEFAULT_AGENT_IMAGE,
+      }));
+    case 'readVmState': {
+      const dir = scratch();
+      const path = join(dir, 'vm.json');
+      if (testCase.contents !== null) {
+        writeFileSync(path, testCase.contents);
+      }
+      return substitute(
+        outcome(() => readVmExecutionState(path)),
+        dir,
+        dirPlaceholder
+      );
+    }
+    case 'writeVmState': {
+      const dir = scratch();
+      const path = join(dir, 'nested', 'vm.json');
+      return substitute(
+        outcome(() => {
+          writeVmExecutionState(testCase.state, path);
+          return {
+            bytes: readFileSync(path, 'utf8'),
+            mode: statSync(path).mode & 0o777,
+          };
+        }),
+        dir,
+        dirPlaceholder
+      );
+    }
+    case 'setVmEnabled': {
+      const dir = scratch();
+      const path = join(dir, 'vm.json');
+      if (testCase.contents !== null) {
+        writeFileSync(path, testCase.contents);
+      }
+      return substitute(
+        outcome(() => {
+          const next = setVmExecutionEnabled(testCase.enabled, path);
+          return { next, bytes: readFileSync(path, 'utf8') };
+        }),
+        dir,
+        dirPlaceholder
+      );
+    }
+    case 'vmEnabled': {
+      const dir = scratch();
+      const path = join(dir, 'vm.json');
+      if (testCase.contents !== null) {
+        writeFileSync(path, testCase.contents);
+      }
+      const { outcome: result, warns } = withCapturedWarn(() =>
+        vmExecutionEnabled(testCase.env, path)
+      );
+      return substitute({ result, warns }, dir, dirPlaceholder);
+    }
+    case 'guestCodexVersion':
+      return outcome(() => guestCodexVersion(testCase.env));
+    case 'stateFilePath':
+      return outcome(() => vmStateFilePath(testCase.env));
+    case 'runtimeDirPath':
+      return outcome(() => vmRuntimeDirPath(testCase.env));
+    case 'vmMachineName':
+      return outcome(() =>
+        vmMachineName({ cwd: testCase.cwd, kandanThreadId: testCase.sessionId ?? undefined })
+      );
+    case 'goldensToReap':
+      return outcome(() => goldensToReap(testCase.present, testCase.keep));
+    case 'isGoldenName':
+      return outcome(() => isGoldenMachineName(testCase.name));
+    case 'registrySchedule': {
+      const dir = scratch();
+      const path = join(dir, 'vm.json');
+      const trace = [];
+      for (const step of testCase.script) {
+        if (step.step === 'registerMachine') {
+          trace.push({ t: 'registerMachine', result: outcome(() => registerVmMachine(step.name, path)) });
+        } else if (step.step === 'unregisterMachines') {
+          trace.push({ t: 'unregisterMachines', result: outcome(() => unregisterVmMachines(step.names, path)) });
+        } else if (step.step === 'listMachines') {
+          trace.push({ t: 'listMachines', names: readVmMachines(path) });
+        } else if (step.step === 'registerGolden') {
+          trace.push({ t: 'registerGolden', result: outcome(() => registerGoldenMachine(step.name, path)) });
+        } else if (step.step === 'unregisterGoldens') {
+          trace.push({ t: 'unregisterGoldens', result: outcome(() => unregisterGoldenMachines(step.names, path)) });
+        } else if (step.step === 'listGoldens') {
+          trace.push({
+            t: 'listGoldens',
+            names: readGoldenMachineRegistrations(path).map((r) => r.name),
+          });
+        }
+      }
+      return substitute({ trace }, dir, dirPlaceholder);
+    }
+    // ---- golden planning ------------------------------------------------------------------------
+    case 'normalizeGitRemote':
+      return outcome(() => normalizeGitRemoteUrl(testCase.raw));
+    case 'goldenEndpoint':
+      return outcome(() => goldenGraphqlEndpoint(testCase.baseUrl));
+    case 'goldenDocs':
+      return outcome(() => ({
+        latest: latestGoldenImageDocument,
+        byProject: goldenImagesByProjectDocument,
+        gcWorkspaces: goldenGcViewerWorkspacesDocument,
+        gcProjects: goldenGcProjectsDocument,
+      }));
+    case 'nodeToRecord':
+      return outcome(() => nodeToRecordForTest(testCase.node));
+    case 'recordFromLatest':
+      return outcome(() => recordFromLatestForTest(testCase.data));
+    case 'recordFromByProject': {
+      const warns = [];
+      const result = outcome(() =>
+        recordFromByProjectForTest(testCase.data, testCase.explicitGoldenId, (m) =>
+          warns.push(m)
+        )
+      );
+      return { result, warns };
+    }
+    case 'resolveGolden': {
+      const warns = [];
+      const trace = [];
+      const result = await outcomeAsync(() =>
+        resolveGoldenForJob({
+          projectId: testCase.projectId,
+          computeKey: testCase.computeKey,
+          explicitGoldenId: testCase.explicitGoldenId ?? undefined,
+          query:
+            testCase.query === null
+              ? undefined
+              : scriptedGoldenQuery(testCase.query, trace),
+          artifactExists: (path) => (testCase.files ?? []).includes(path),
+          warn: (m) => warns.push(m),
+        })
+      );
+      return { result, warns, trace };
+    }
+    case 'queryTransport': {
+      const requests = [];
+      const warns = [];
+      const transport = createGoldenQueryTransport({
+        kandanUrl: testCase.baseUrl,
+        token: 'synthetic-token',
+        fetchImpl: scriptedFetch(testCase.routes, requests),
+        warn: (m) => warns.push(m),
+      });
+      const result = await outcomeAsync(() =>
+        transport({
+          projectId: testCase.projectId,
+          computeKey: testCase.computeKey,
+          explicitGoldenId: testCase.explicitGoldenId ?? undefined,
+        })
+      );
+      return { result, warns, requests };
+    }
+    case 'keepSet': {
+      const trace = [];
+      const serverLists = {
+        listWorkspaceIds: async () => {
+          if (testCase.workspaces.throw !== undefined) {
+            throw new Error(testCase.workspaces.throw);
+          }
+          return testCase.workspaces.ids;
+        },
+        listProjectIds: async (workspaceId) => {
+          const scripted = testCase.projects[workspaceId];
+          if (scripted === undefined || scripted.throw !== undefined) {
+            throw new Error(scripted?.throw ?? 'no scripted projects for ' + workspaceId);
+          }
+          return scripted.ids;
+        },
+      };
+      const result = await outcomeAsync(() =>
+        fetchGoldenKeepSet({
+          computeKey: testCase.computeKey,
+          serverLists,
+          query: scriptedGoldenQuery(testCase.query, trace),
+        })
+      );
+      return { result, trace };
+    }
+    case 'gcReconcile': {
+      const trace = [];
+      const logs = [];
+      const unregistered = [];
+      const result = await outcomeAsync(() =>
+        reconcileGoldenMachines({
+          computeKey: testCase.computeKey,
+          listPresent: () => testCase.present,
+          serverLists: {
+            listWorkspaceIds: async () => {
+              if (testCase.workspaces.throw !== undefined) {
+                throw new Error(testCase.workspaces.throw);
+              }
+              return testCase.workspaces.ids;
+            },
+            listProjectIds: async (workspaceId) => {
+              const scripted = testCase.projects[workspaceId];
+              if (scripted === undefined || scripted.throw !== undefined) {
+                throw new Error(scripted?.throw ?? 'no scripted projects for ' + workspaceId);
+              }
+              return scripted.ids;
+            },
+          },
+          query: scriptedGoldenQuery(testCase.query, trace),
+          deleteMachine: async (name) => {
+            const scripted = (testCase.deletes ?? {})[name] ?? { kind: 'deleted' };
+            if (scripted.kind === 'throw') {
+              throw new Error(scripted.message);
+            }
+            return scripted.kind;
+          },
+          unregister: (names) => unregistered.push(...names),
+          log: (line) => logs.push(line),
+          nowMs: () => testCase.nowMs,
+          graceMs: testCase.graceMs,
+        })
+      );
+      return { result, logs, unregistered };
+    }
+    case 'gcConsts':
+      return outcome(() => ({ defaultGoldenGcIntervalMs, defaultGoldenGcGraceMs }));
+    case 'detectPm':
+      return outcome(() => detectPackageManager(new Set(testCase.lockfiles)));
+    case 'pmScript':
+      return outcome(() => packageManagerInstallScript(testCase.manager));
+    case 'lockfileHashes':
+      return outcome(() => buildLockfileHashes(new Map(testCase.entries)));
+    case 'manifest':
+      return outcome(() => goldenBuildManifest(testCase.parts));
+    case 'manifestChecksum':
+      return outcome(() => goldenManifestChecksum(testCase.parts));
+    case 'wellFormed':
+      return outcome(() => isWellFormedGoldenBuildResult(testCase.value));
+    case 'coldReason':
+      return outcome(() => coldRebuildFallbackReason(testCase.sourceCommits));
+    case 'snapshotOutcome':
+      return outcome(() =>
+        resolveSnapshotOutcome({
+          snapshot: testCase.snapshot,
+          coldRebuild: testCase.coldRebuild,
+        })
+      );
+    case 'artifactPath':
+      return outcome(() => goldenArtifactPath(testCase.runtimeDir, testCase.machineName));
+    case 'goldenName':
+      return outcome(() =>
+        goldenBuildMachineName({
+          projectPublicId: testCase.projectPublicId ?? undefined,
+          computeKey: testCase.computeKey ?? undefined,
+          cwd: testCase.cwd,
+        })
+      );
+    case 'repoKey':
+      return outcome(() => repoKeyForTarget(testCase.target));
+    case 'buildCoreConsts':
+      return outcome(() => ({
+        goldenLockfileNames: [...goldenLockfileNames],
+        goldenToolchainProbes: goldenToolchainProbes.map((p) => ({
+          key: p.key,
+          command: [...p.command],
+        })),
+      }));
+    // ---- readiness ---------------------------------------------------------------------------------
+    case 'runtimeForkable':
+      return outcome(() => runtimeVersionIsForkable(testCase.version));
+    case 'osLabel':
+      return outcome(() => osLabelFor(testCase.platform, testCase.arch));
+    case 'localReadiness':
+      return await outcomeAsync(() =>
+        probeLocalVmReadiness({
+          platform: testCase.platform,
+          arch: testCase.arch,
+          runtimeDir: testCase.runtimeDir,
+          vmCapability: () => testCase.vmCapability,
+          installedRuntimeVersion: () => testCase.runtimeVersion ?? undefined,
+          fileExists: (path) => testCase.files.includes(path),
+          mkfsExt4Present: () => testCase.mkfs === true,
+          macNativeDeps: async () => testCase.macStatus,
+          workspaceLocalVmExecutionFlag: testCase.flag ?? null,
+        })
+      );
+    case 'cloudComputeKey':
+      return outcome(() => ({
+        prefix: SMOLCLOUD_COMPUTE_KEY_PREFIX,
+        key: smolcloudComputeKey(testCase.clusterId),
+      }));
+    case 'cloudReadiness': {
+      const requests = [];
+      return await outcomeAsync(() =>
+        probeSmolcloudReadiness({
+          env: testCase.env,
+          config: testCase.config,
+          fetchImpl: scriptedFetch(testCase.routes ?? [], requests),
+        })
+      );
+    }
+    case 'cloudReadinessUnreadableState': {
+      const dir = scratch();
+      const path = join(dir, 'vm.json');
+      writeFileSync(path, testCase.contents);
+      const result = await outcomeAsync(() =>
+        probeSmolcloudReadiness({ env: testCase.env, statePath: path })
+      );
+      return substitute(result, dir, dirPlaceholder);
+    }
+    // ---- supervisor core ---------------------------------------------------------------------------
+    case 'supEncode':
+      return outcome(() => encodeVmSupervisorConfig(testCase.payload));
+    case 'supDecode':
+      return outcome(() =>
+        decodeVmSupervisorConfig(
+          testCase.encoded ?? encodeVmSupervisorConfig(testCase.payload)
+        )
+      );
+    case 'guestMcpConfig':
+      return outcome(() => guestLinzumiMcpServerConfig(testCase.mcp, testCase.guestCwd));
+    case 'guestMcpArgs':
+      return outcome(() => guestLinzumiMcpCodexArgs(testCase.mcp, testCase.guestCwd));
+    case 'createEgress': {
+      const { outcome: result, warns } = withCapturedWarn(() =>
+        resolveCreateMachineEgressPolicy(testCase.config, testCase.env)
+      );
+      return { result, warns };
+    }
+    case 'goldenUsable': {
+      const { outcome: result, warns } = withCapturedWarn(() =>
+        goldenUsableForEgress(testCase.config, testCase.env)
+      );
+      return { result, warns };
+    }
+    case 'isEagain':
+      return outcome(() => isEagainForTest(testCase.message));
+    case 'supportsGoldenBoot':
+      return outcome(() =>
+        smolmachinesSupportsGoldenBoot({
+          Machine: {
+            create: async () => undefined,
+            connect: async () => undefined,
+            ...(testCase.supportsImageBoot === undefined
+              ? {}
+              : { supportsImageBoot: testCase.supportsImageBoot }),
+          },
+        })
+      );
+    case 'supConsts':
+      return outcome(() => ({
+        vmSupervisorReadyPrefix,
+        guestDiagnosticsMarker,
+        ...forkRetryConstsForTest,
+      }));
+    case 'dangerAssert':
+      return outcome(() => {
+        assertDangerFullAccess({
+          codexVersion: 'x',
+          input: [],
+          sandbox: testCase.sandbox,
+          approvalPolicy: testCase.approvalPolicy,
+          kandanUrl: 'https://scripted.example',
+          cwd: '/scripted',
+          appServerPort: 4500,
+        });
+        return 'ok';
+      });
+    case 'agentText':
+      return outcome(() => agentMessageTextFromParams(testCase.params));
+    case 'replyToolCall':
+      return outcome(() => isSuccessfulAgentReplyToolCall(testCase.params));
+    case 'benignDedupe':
+      return outcome(() => isBenignReplyDedupe(testCase.message));
+    case 'progressConsts':
+      return outcome(() => ({ ...guestTurnProgressConstsForTest }));
+    case 'scrubEnv':
+      return outcome(() => scrubSupervisorEnv(testCase.env));
+    case 'readyTimeout':
+      return outcome(() => readyTimeoutMsForTest(testCase.env));
+    case 'startConsts':
+      return outcome(() => ({ ...startVmConstsForTest }));
+    case 'buildMcpConfig': {
+      const dir = scratch();
+      let bundlePath;
+      if (testCase.bundle === 'absent') {
+        bundlePath = join(dir, 'missing-mcp-server.mjs');
+      } else {
+        bundlePath = join(dir, 'mcp-server.mjs');
+        writeFileSync(bundlePath, testCase.bundle);
+      }
+      const { outcome: result, warns } = withCapturedWarn(() =>
+        buildVmLinzumiMcpConfig({
+          cwd: dir,
+          kandanThreadId: undefined,
+          appServerOptions: {},
+          llmProxyToken: undefined,
+          linzumiMcp:
+            testCase.mcp === null
+              ? undefined
+              : {
+                  authFileContents: testCase.mcp.authFileContents,
+                  kandanUrl: testCase.mcp.kandanUrl,
+                  ownerUsername: testCase.mcp.ownerUsername ?? undefined,
+                  threadId: testCase.mcp.threadId ?? undefined,
+                  ...(testCase.mcp.agentSession === undefined
+                    ? {}
+                    : { agentSession: testCase.mcp.agentSession }),
+                },
+          mcpServerBundlePath: bundlePath,
+        })
+      );
+      return substitute({ result, warns }, dir, dirPlaceholder);
+    }
+    // ---- cloud codecs ----------------------------------------------------------------------------------
+    case 'redact':
+      return outcome(() => redactCloudSecrets(testCase.text));
+    case 'encodePath':
+      return outcome(() => encodeCloudPath(testCase.path));
+    case 'machineSource':
+      return outcome(() => cloudMachineSource(testCase.image));
+    case 'sse': {
+      const chunks = testCase.chunks;
+      const encoder = new TextEncoder();
+      const stream = new ReadableStream({
+        start(controller) {
+          for (const chunk of chunks) {
+            controller.enqueue(encoder.encode(chunk));
+          }
+          controller.close();
+        },
+      });
+      const events = [];
+      for await (const event of parseSseExecEvents(stream)) {
+        events.push(event);
+      }
+      return { events };
+    }
+    case 'apiKey':
+      return outcome(() =>
+        resolveSmolcloudApiKey(testCase.env, testCase.config ?? undefined, (path) => {
+          const scripted = (testCase.keyFiles ?? {})[path];
+          if (scripted === undefined) {
+            throw new Error('ENOENT: no scripted key file ' + path);
+          }
+          return scripted;
+        })
+      );
+    case 'cloudEnabled': {
+      const dir = scratch();
+      const path = join(dir, 'vm.json');
+      if (testCase.contents !== null) {
+        writeFileSync(path, testCase.contents);
+      }
+      return outcome(() => vmCloudExecutionEnabled(testCase.env, path));
+    }
+    case 'agentDisabled':
+      return outcome(() => vmCloudAgentExplicitlyDisabled(testCase.env));
+    case 'agentEnabled': {
+      const dir = scratch();
+      const path = join(dir, 'vm.json');
+      if (testCase.contents !== null) {
+        writeFileSync(path, testCase.contents);
+      }
+      return outcome(() => vmCloudAgentExecutionEnabled(testCase.env, path));
+    }
+    case 'connection':
+      return outcome(() => {
+        const conn = resolveCloudConnection({
+          env: testCase.env,
+          config: testCase.config ?? undefined,
+        });
+        return conn === undefined
+          ? undefined
+          : { baseUrl: conn.baseUrl, apiKey: conn.apiKey };
+      });
+    case 'cloudBackendConsts':
+      return outcome(() => ({
+        defaultBaseUrl: SMOLCLOUD_DEFAULT_BASE_URL,
+        ...cloudTimeoutConstsForTest,
+        agentMachineNamePrefix: AGENT_MACHINE_NAME_PREFIX,
+        defaultAgentAutoStopSeconds: DEFAULT_AGENT_AUTO_STOP_SECONDS,
+        defaultAgentCpus: DEFAULT_AGENT_CPUS,
+        defaultAgentMemoryMb: DEFAULT_AGENT_MEMORY_MB,
+        defaultAgentDiskGb: DEFAULT_AGENT_DISK_GB,
+        defaultMaxConcurrentTurns: DEFAULT_MAX_CONCURRENT_TURNS,
+      }));
+    case 'workspaceId':
+      return outcome(() => {
+        assertValidWorkspacePublicId(testCase.id);
+        return 'ok';
+      });
+    case 'agentNames':
+      return outcome(() => ({
+        machine: agentMachineName(testCase.id),
+        volume: agentVolumeName(testCase.id),
+      }));
+    case 'verifyAgent':
+      return outcome(() => {
+        verifyWorkspaceAgentMachine(testCase.info, testCase.id);
+        return 'ok';
+      });
+    // ---- worktree ---------------------------------------------------------------------------------------
+    case 'worktreeNames':
+      return outcome(() => ({
+        dirname: JOB_WORKTREES_DIRNAME,
+        branch: jobBranchName(testCase.jobId),
+        path: jobWorktreePath(testCase.repoToplevel, testCase.jobId),
+      }));
+    case 'worktreeMounts':
+      return outcome(() => jobWorktreeMounts(testCase.prepared));
+    case 'resolveToplevel': {
+      const trace = [];
+      const result = await outcomeAsync(() =>
+        resolveRepoToplevel(testCase.cwd, scriptedGitRunner(testCase.git, trace))
+      );
+      return { result, trace };
+    }
+    case 'worktreePrepare': {
+      const dir = scratch();
+      mkdirSync(join(dir, 'repo'), { recursive: true });
+      const trace = [];
+      const script = JSON.parse(
+        JSON.stringify(testCase.git).split(dirPlaceholder).join(dir)
+      );
+      const result = await outcomeAsync(() =>
+        prepareJobWorktree(
+          {
+            repoCwd: substitute(testCase.repoCwd, dirPlaceholder, dir),
+            jobId: testCase.jobId,
+            ...(testCase.ref === undefined ? {} : { ref: testCase.ref }),
+          },
+          scriptedGitRunner(script, trace)
+        )
+      );
+      return substitute({ result, trace }, dir, dirPlaceholder);
+    }
+    case 'worktreeRemove': {
+      const trace = [];
+      const result = await outcomeAsync(() =>
+        removeJobWorktree(
+          {
+            repoToplevel: testCase.repoToplevel,
+            worktreePath: testCase.worktreePath,
+          },
+          scriptedGitRunner(testCase.git, trace)
+        )
+      );
+      return { result, trace };
+    }
+    // ---- relay + cli --------------------------------------------------------------------------------------
+    case 'relayScript':
+      return outcome(() =>
+        vmRelayScriptSource({
+          bridgePort: testCase.bridgePort,
+          token: testCase.token,
+          guestTargetPort: testCase.guestTargetPort,
+        })
+      );
+    case 'tunnelConsts':
+      return outcome(() => ({ ...vmTunnelWireConstsForTest }));
+    case 'vmHelp': {
+      const dir = scratch();
+      setCaseEnv({
+        LINZUMI_VM_CONFIG_FILE: join(dir, 'vm.json'),
+        LINZUMI_VM_RUNTIME_DIR: join(dir, 'rt'),
+        SMOLCLOUD_API_KEY: testCase.agentKey ?? null,
+        SMOL_CLOUD_TOKEN: null,
+        LINZUMI_VM_CLOUD: null,
+        LINZUMI_VM_CLOUD_AGENT: null,
+      });
+      try {
+        return outcome(() => vmHelpText());
+      } finally {
+        restoreCaseEnv();
+      }
+    }
+    case 'vmDispatch': {
+      const dir = scratch();
+      setCaseEnv({
+        LINZUMI_VM_CONFIG_FILE: join(dir, 'vm.json'),
+        LINZUMI_VM_RUNTIME_DIR: join(dir, 'rt'),
+        SMOLCLOUD_API_KEY: testCase.agentKey ?? null,
+        SMOL_CLOUD_TOKEN: null,
+        LINZUMI_VM_CLOUD: null,
+        LINZUMI_VM_CLOUD_AGENT: null,
+      });
+      const writes = [];
+      try {
+        const result = await outcomeAsync(() =>
+          runVmCommand(testCase.args, (line) => writes.push(line))
+        );
+        let stateBytes = null;
+        try {
+          stateBytes = readFileSync(join(dir, 'vm.json'), 'utf8');
+        } catch {
+          stateBytes = null;
+        }
+        return substitute({ result, writes, stateBytes }, dir, dirPlaceholder);
+      } finally {
+        restoreCaseEnv();
+      }
+    }
+    default:
+      return { threw: true, message: 'unknown op ' + String(testCase.op) };
+  }
+}
+
+let stdin = '';
+process.stdin.setEncoding('utf8');
+for await (const chunk of process.stdin) {
+  stdin += chunk;
+}
+const cases = JSON.parse(stdin);
+const results = [];
+for (const testCase of cases) {
+  results.push(await handle(testCase));
+}
+process.stdout.write(JSON.stringify(results));
+`;
+
+await mkdir(join(packageRoot, '.differential'), { recursive: true });
+
+// Some transitive imports resolve assets/ relative to the bundle at import
+// time (the build-differential-entry.mjs requirement).
+await mkdir(join(packageRoot, '.differential/assets'), { recursive: true });
+const { copyFile } = await import('node:fs/promises');
+await copyFile(
+  join(packageRoot, 'src/assets/linzumi-logo.svg'),
+  join(packageRoot, '.differential/assets/linzumi-logo.svg')
+);
+
+await build({
+  stdin: {
+    contents: driverSource,
+    resolveDir: packageRoot,
+    sourcefile: 'vm-sandbox-parity-driver.ts',
+    loader: 'ts',
+  },
+  bundle: true,
+  platform: 'node',
+  target: 'node20',
+  format: 'esm',
+  outfile: join(packageRoot, '.differential/vm-sandbox-parity-oracle.mjs'),
+  minify: false,
+  sourcemap: false,
+  legalComments: 'none',
+  external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
+});