@linzumi/cli 1.0.120 → 1.0.121

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linzumi/cli",
-  "version": "1.0.120",
+  "version": "1.0.121",
   "description": "Linzumi CLI \u2014 point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.",
   "type": "module",
   "bin": {

package/scripts/build-differential-entry-impl-res.mjs

@@ -0,0 +1,64 @@
+// Spec: kandan/plans/2026-07-10-compute-nodes-rescript-commander-zero-ts-program.md (M3 cluster 15)
+// Relationship: Builds the ReScript-impl differential entry
+// (packages/linzumi-cli-rescript/src/entry/CommanderDifferentialMain.res,
+// compiled by `rescript` to .res.mjs) into a single runnable bundle at
+// .differential/impl-res.mjs - the peer of scripts/build-differential-entry.mjs's
+// impl-ts bundle, with the SAME platform/target/format/externals/banner so the
+// differential harness compares the two impls under one bundling reality.
+//
+// Version injection: the ReScript package ships no version literal (repo
+// rule); the CLI version is esbuild-`define`d into the bundle as
+// process.env.LINZUMI_CLI_VERSION (read via CommanderEntryVersion.res), so the
+// hello `version` equals the TS impl's linzumiCliVersion (== package.json
+// version) and the min-version refusal transcripts stay byte-identical.
+//
+// FAIL LOUDLY when the compiled ReScript artifacts are missing: the
+// differential harness must never silently fall back to a stub.
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+const entryPoint = join(
+  packageRoot,
+  '../linzumi-cli-rescript/src/entry/CommanderDifferentialMain.res.mjs'
+);
+
+if (!existsSync(entryPoint)) {
+  console.error(
+    `impl-res differential entry artifact missing: ${entryPoint}\n` +
+      'run `pnpm build` in packages/linzumi-cli-rescript first (rescript compiles src/**.res -> .res.mjs in-source)'
+  );
+  process.exit(1);
+}
+
+const packageJson = JSON.parse(
+  await readFile(join(packageRoot, 'package.json'), 'utf8')
+);
+
+// Renamed banner import, mirroring scripts/build-differential-entry.mjs: this
+// bundle keeps source-level identifiers and the sources may import
+// createRequire themselves - the published banner's bare name would collide.
+const banner = {
+  js: "import { createRequire as __differentialCreateRequire } from 'node:module';\nconst require = __differentialCreateRequire(import.meta.url);",
+};
+
+await build({
+  entryPoints: [entryPoint],
+  bundle: true,
+  platform: 'node',
+  target: 'node20',
+  format: 'esm',
+  outfile: join(packageRoot, '.differential/impl-res.mjs'),
+  minify: false,
+  sourcemap: false,
+  legalComments: 'none',
+  external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
+  banner,
+  define: {
+    'process.env.LINZUMI_CLI_VERSION': JSON.stringify(packageJson.version),
+  },
+});

package/scripts/build-differential-entry.mjs

@@ -6,8 +6,8 @@
 // differential harness exercises the SAME bundling reality the shipped CLI
 // has - this is the M3 packaging seam's dist/impl-ts precursor: the M3
 // chooser design ships dist/impl-ts/ + dist/impl-res/ side by side, and the
-// M2.5 differential runner's impl parameter selects between them (impl-res
-// fails honestly until M3 cluster 1 lands).
+// M2.5 differential runner's impl parameter selects between them (the
+// impl-res twin is scripts/build-differential-entry-impl-res.mjs).
 //
 // M2.6 mutation mode (`--mutation <name>`): applies ONE seeded behavior
 // delta from scripts/differentialMutations.mjs as a build-time source patch

package/scripts/build.mjs

@@ -1,27 +1,61 @@
 // Spec: plans/2026-05-17-linzumi-cli-node-toolchain-note.md
 // Relationship: Builds the published CLI package with Node-hosted tooling.
-import { copyFile, mkdir, rm, writeFile } from 'node:fs/promises';
+import { copyFile, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { build } from 'esbuild';
 
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
 
+// M3 cluster 15: the ReScript package ships no version literal (repo rule);
+// the CLI version is esbuild-`define`d into the impl-res bundle as
+// process.env.LINZUMI_CLI_VERSION (read via CommanderEntryVersion.res), the
+// same source of truth as src/version.ts linzumiCliVersion.
+const packageVersion = JSON.parse(
+  await readFile(join(packageRoot, 'package.json'), 'utf8')
+).version;
+
 await rm(join(packageRoot, 'dist'), { recursive: true, force: true });
 
 const banner = {
   js: "import { createRequire } from 'node:module';\nconst require = createRequire(import.meta.url);",
 };
 
+// M3 cluster 15 (entry/packaging/selector): ONE package ships BOTH commander
+// implementations - dist/impl-ts/ (this package's esbuild output, relocated
+// from the historical flat dist/index.js) and dist/impl-res/ (the ReScript
+// commander bundled from ../linzumi-cli-rescript) - behind the tiny plain-JS
+// chooser bundled to dist/index.js. The byte-pinned bin/linzumi.js entry
+// (I153) keeps importing ../dist/index.js and calling main(argv), so the bin
+// bytes stay EXACTLY as pinned and the chooser lives behind them.
+//
+// OWNER GATE (2026-07-15): the chooser resolves an absent/unknown
+// ~/.linzumi/commanderImpl cache to "ts"; nothing in the package selects
+// impl-res by default.
 await build({
-  entryPoints: [join(packageRoot, 'src/index.ts')],
+  entryPoints: [join(packageRoot, 'src/commanderImplChooser.mjs')],
   bundle: true,
   platform: 'node',
   target: 'node20',
   format: 'esm',
   outfile: join(packageRoot, 'dist/index.js'),
+  minify: true,
+  sourcemap: false,
+  legalComments: 'none',
+  // The impl bundles are runtime dynamic imports the chooser selects between;
+  // they must never be inlined into the chooser bundle.
+  external: ['./impl-ts/*', './impl-res/*'],
+});
+
+await build({
+  entryPoints: [join(packageRoot, 'src/index.ts')],
+  bundle: true,
+  platform: 'node',
+  target: 'node20',
+  format: 'esm',
+  outfile: join(packageRoot, 'dist/impl-ts/index.js'),
   // Production hardening: minify the published CLI bundle and ship no source
-  // map. We already bundle to a single dist/index.js (no loose src/); minifying
+  // map. We already bundle to a single impl bundle (no loose src/); minifying
   // reduces accidental source/IP leakage in the npm artifact. This is NOT a
   // security boundary -- the published package is public by definition, so no
   // secret may live in this code and all authz stays server-side.
@@ -61,6 +95,16 @@ await build({
   banner,
 });
 
+// M3 cluster 15: the TS impl's guest MCP bridge also ships CO-LOCATED at
+// dist/impl-ts/mcp-server.mjs (the 'ts' candidate ladder's impl-specific
+// head; the flat dist/mcp-server.mjs above stays as the rollback backstop
+// and the guest path contract). Same bytes, copied - never a second build.
+await mkdir(join(packageRoot, 'dist/impl-ts'), { recursive: true });
+await copyFile(
+  join(packageRoot, 'dist/mcp-server.mjs'),
+  join(packageRoot, 'dist/impl-ts/mcp-server.mjs')
+);
+
 // M3 cluster 14 selector story (compute-nodes program, M3 packaging): the
 // ReScript impl's guest MCP bridge, bundled from the compiled
 // CommanderMcpEntry artifact into dist/impl-res/mcp-server.mjs - the head
@@ -118,13 +162,23 @@ await build({
   platform: 'node',
   target: 'node20',
   format: 'esm',
-  outfile: join(packageRoot, 'dist/cloud-supervisor.mjs'),
+  outfile: join(packageRoot, 'dist/impl-ts/cloud-supervisor.mjs'),
   minify: true,
   sourcemap: false,
   legalComments: 'none',
   banner,
 });
 
+// The in-guest bundles are impl-AGNOSTIC guest artifacts (they run inside the
+// VM, not inside either commander), so the impl-res dist carries the same
+// bytes: its vmCloudSupervisor twin resolves siblings of ITS bundle exactly
+// like the TS one does (resolveDistBundle / dirname(import.meta.url)).
+await mkdir(join(packageRoot, 'dist/impl-res'), { recursive: true });
+await copyFile(
+  join(packageRoot, 'dist/impl-ts/cloud-supervisor.mjs'),
+  join(packageRoot, 'dist/impl-res/cloud-supervisor.mjs')
+);
+
 // F5 cross-harness failover bridge (Workstream F task F5): the runner
 // dynamic-imports ./crossHarnessFailover.mjs relative to its own bundle, so
 // dist ships a self-contained sibling bundle with the compiled ReScript
@@ -141,7 +195,7 @@ try {
     platform: 'node',
     target: 'node20',
     format: 'esm',
-    outfile: join(packageRoot, 'dist/crossHarnessFailover.mjs'),
+    outfile: join(packageRoot, 'dist/impl-ts/crossHarnessFailover.mjs'),
     minify: true,
     sourcemap: false,
     legalComments: 'none',
@@ -153,8 +207,9 @@ try {
       'linzumi-cli-rescript artifacts built?); shipping the honest refusal ' +
       `stub instead: ${error instanceof Error ? error.message : String(error)}`
   );
+  await mkdir(join(packageRoot, 'dist/impl-ts'), { recursive: true });
   await writeFile(
-    join(packageRoot, 'dist/crossHarnessFailover.mjs'),
+    join(packageRoot, 'dist/impl-ts/crossHarnessFailover.mjs'),
     'export async function transpileAndSeedClaudeSession() {\n' +
       '  return {\n' +
       '    ok: false,\n' +
@@ -163,9 +218,64 @@ try {
       '}\n'
   );
 }
-
-await mkdir(join(packageRoot, 'dist/assets'), { recursive: true });
+// The F5 bridge is self-contained; the impl-res commander resolves the same
+// sibling name next to ITS bundle.
 await copyFile(
-  join(packageRoot, 'src/assets/linzumi-logo.svg'),
-  join(packageRoot, 'dist/assets/linzumi-logo.svg')
+  join(packageRoot, 'dist/impl-ts/crossHarnessFailover.mjs'),
+  join(packageRoot, 'dist/impl-res/crossHarnessFailover.mjs')
 );
+
+for (const implDir of ['dist/impl-ts', 'dist/impl-res']) {
+  await mkdir(join(packageRoot, implDir, 'assets'), { recursive: true });
+  await copyFile(
+    join(packageRoot, 'src/assets/linzumi-logo.svg'),
+    join(packageRoot, implDir, 'assets/linzumi-logo.svg')
+  );
+}
+
+// M3 cluster 15: the ReScript commander itself - dist/impl-res/index.js,
+// bundled from the compiled composition-root entry
+// (packages/linzumi-cli-rescript/src/entry/CommanderEntryMain.res). Same
+// externals/banner posture as the TS impl bundle: the runtime deps stay
+// external (they ship in the package's dependency closure), everything else
+// is inlined. When the ReScript artifacts are not compiled in this checkout
+// the build ships an HONEST refusal stub whose import succeeds but whose
+// main() refuses loudly - the chooser's short-lived-exit breaker then falls
+// back to TS (never a silent wrong impl). Publish CI compiles the ReScript
+// package first and the package-size gate asserts the REAL bundle shipped,
+// so the stub can never reach npm.
+try {
+  await build({
+    entryPoints: [
+      join(
+        packageRoot,
+        '../linzumi-cli-rescript/src/entry/CommanderEntryMain.res.mjs'
+      ),
+    ],
+    bundle: true,
+    platform: 'node',
+    target: 'node20',
+    format: 'esm',
+    outfile: join(packageRoot, 'dist/impl-res/index.js'),
+    minify: true,
+    sourcemap: false,
+    legalComments: 'none',
+    external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
+    banner,
+    define: {
+      'process.env.LINZUMI_CLI_VERSION': JSON.stringify(packageVersion),
+    },
+  });
+} catch (error) {
+  console.warn(
+    '[build] impl-res commander bundle could not be built (are the ' +
+      'linzumi-cli-rescript artifacts compiled?); shipping the honest ' +
+      `refusal stub instead: ${error instanceof Error ? error.message : String(error)}`
+  );
+  await writeFile(
+    join(packageRoot, 'dist/impl-res/index.js'),
+    'export async function main() {\n' +
+      "  throw new Error('the rescript commander implementation was not bundled into this build');\n" +
+      '}\n'
+  );
+}

package/scripts/check-package-size-budget.mjs

@@ -0,0 +1,186 @@
+/*
+- Date: 2026-07-15
+  Spec: kandan/plans/2026-07-10-compute-nodes-rescript-commander-zero-ts-program.md
+        (M3 packaging paragraph: "Package-size budget in publish CI")
+  Relationship: The M3 cluster 15 publish-CI package-size gate. Runs
+  `npm pack --dry-run --json`, enforces the dual-impl package budget with the
+  warn-band shape of test/ciBudget.ts (warn at 85% of the fail limit,
+  actionable per-file top-offender breakdown - never a bare at-limit
+  assertion; see the 2026-07-12 "expected 1000 to be less than 1000" staging
+  red), and asserts the dual-impl packaging PARITY facts: both impl bundles
+  ship for real (the impl-res honest-refusal stub that dev builds emit when
+  the ReScript artifacts are not compiled must never reach npm), the chooser
+  stays tiny, and the guest-bundle ladder files exist.
+
+  Budget rationale (measured 2026-07-15 on this branch): the dual-impl
+  package measures ~4.96 MB unpacked with the impl-res stub; the real
+  impl-res commander bundle lands well under 3 MB (it bundles the same code
+  the ~2.26 MB impl-ts bundle carries, compiled from ReScript). 12 MB
+  unpacked caps runaway growth at roughly 1.5x the projected dual-impl size
+  while leaving the dual-impl period real headroom; the 85% warn band
+  (10.2 MB) makes erosion loud before it reds a publish.
+*/
+import { execFileSync } from 'node:child_process';
+import { dirname } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+export const UNPACKED_SIZE_LIMIT_BYTES = 12 * 1024 * 1024;
+export const WARN_RATIO = 0.85;
+// The chooser must stay a TINY plain-JS shim (it runs before either impl
+// bundle loads); a fat dist/index.js means impl code leaked into it.
+export const CHOOSER_SIZE_LIMIT_BYTES = 64 * 1024;
+// A real commander bundle is megabytes; the honest-refusal stub is ~125
+// bytes. Anything under this floor is not a real implementation.
+export const REAL_IMPL_BUNDLE_FLOOR_BYTES = 200 * 1024;
+
+const requiredFiles = [
+  'bin/linzumi.js',
+  'bin/remote-codex-harness-worker.js',
+  'dist/index.js',
+  'dist/impl-ts/index.js',
+  'dist/impl-res/index.js',
+  'dist/mcp-server.mjs',
+  'dist/impl-ts/mcp-server.mjs',
+  'dist/impl-res/mcp-server.mjs',
+  'dist/impl-ts/crossHarnessFailover.mjs',
+  'dist/impl-res/crossHarnessFailover.mjs',
+  'dist/impl-ts/cloud-supervisor.mjs',
+  'dist/impl-res/cloud-supervisor.mjs',
+];
+
+// Per-file real-bundle floors (Greptile P2): the co-located guest bundles
+// have honest-stub fallbacks in the build too (the F5 refusal stub is ~200
+// bytes; the real bridge is ~8 KB; the real cloud supervisor is ~93 KB), so
+// each gets a floor that distinguishes stub from real - a botched build must
+// red the publish, not ship a refusal stub to the fleet.
+export const GUEST_BUNDLE_FLOOR_BYTES = {
+  'dist/impl-ts/crossHarnessFailover.mjs': 2 * 1024,
+  'dist/impl-res/crossHarnessFailover.mjs': 2 * 1024,
+  'dist/impl-ts/cloud-supervisor.mjs': 20 * 1024,
+  'dist/impl-res/cloud-supervisor.mjs': 20 * 1024,
+  'dist/mcp-server.mjs': 100 * 1024,
+  'dist/impl-ts/mcp-server.mjs': 100 * 1024,
+  'dist/impl-res/mcp-server.mjs': 100 * 1024,
+};
+
+function formatMb(bytes) {
+  return `${Math.round((bytes / (1024 * 1024)) * 100) / 100} MB`;
+}
+
+export function evaluatePackedPackage(packReport) {
+  const failures = [];
+  const warnings = [];
+  const files = new Map(packReport.files.map((file) => [file.path, file.size]));
+
+  for (const path of requiredFiles) {
+    if (!files.has(path)) {
+      failures.push(`required package file missing from the pack: ${path}`);
+    }
+  }
+
+  const chooserSize = files.get('dist/index.js') ?? 0;
+  if (chooserSize > CHOOSER_SIZE_LIMIT_BYTES) {
+    failures.push(
+      `dist/index.js (the chooser) is ${chooserSize} bytes > ${CHOOSER_SIZE_LIMIT_BYTES}: impl code must not leak into the chooser shim`
+    );
+  }
+
+  for (const implBundle of [
+    'dist/impl-ts/index.js',
+    'dist/impl-res/index.js',
+  ]) {
+    const size = files.get(implBundle) ?? 0;
+    if (size > 0 && size < REAL_IMPL_BUNDLE_FLOOR_BYTES) {
+      failures.push(
+        `${implBundle} is ${size} bytes < ${REAL_IMPL_BUNDLE_FLOOR_BYTES}: this is the honest-refusal stub, not a real commander bundle - the publish build must compile the ReScript package first (pnpm --filter @linzumi/cli-rescript build)`
+      );
+    }
+  }
+
+  for (const [path, floor] of Object.entries(GUEST_BUNDLE_FLOOR_BYTES)) {
+    const size = files.get(path) ?? 0;
+    if (size > 0 && size < floor) {
+      failures.push(
+        `${path} is ${size} bytes < ${floor}: this looks like a build stub, not the real guest bundle`
+      );
+    }
+  }
+
+  // npm pack --json has carried unpackedSize since npm v7; `size` is the
+  // COMPRESSED tarball (2-4x smaller), so falling back to it would make the
+  // budget silently un-enforceable (Greptile P2). An absent unpackedSize is
+  // a gate error, never a pass.
+  const unpackedSize = packReport.unpackedSize;
+  if (typeof unpackedSize !== 'number' || !Number.isFinite(unpackedSize)) {
+    failures.push(
+      'npm pack --json did not report unpackedSize; the budget cannot be evaluated (refusing to fall back to the compressed tarball size)'
+    );
+    return { failures, warnings, unpackedSize: 0, usedRatio: 0 };
+  }
+  const usedRatio = unpackedSize / UNPACKED_SIZE_LIMIT_BYTES;
+  const topOffenders = [...packReport.files]
+    .sort((a, b) => b.size - a.size)
+    .slice(0, 8)
+    .map((file) => `  - ${file.path}: ${formatMb(file.size)}`);
+
+  if (unpackedSize >= UNPACKED_SIZE_LIMIT_BYTES) {
+    failures.push(
+      [
+        `package unpacked size ${formatMb(unpackedSize)} >= the ${formatMb(UNPACKED_SIZE_LIMIT_BYTES)} budget (${Math.round(usedRatio * 1000) / 10}% used)`,
+        'top offenders:',
+        ...topOffenders,
+      ].join('\n')
+    );
+  } else if (unpackedSize >= UNPACKED_SIZE_LIMIT_BYTES * WARN_RATIO) {
+    warnings.push(
+      [
+        `WARNING BAND: package unpacked size ${formatMb(unpackedSize)} is ${Math.round(usedRatio * 1000) / 10}% of the ${formatMb(UNPACKED_SIZE_LIMIT_BYTES)} budget (band starts at ${formatMb(UNPACKED_SIZE_LIMIT_BYTES * WARN_RATIO)})`,
+        'top offenders:',
+        ...topOffenders,
+      ].join('\n')
+    );
+  }
+
+  return { failures, warnings, unpackedSize, usedRatio };
+}
+
+function main() {
+  const raw = execFileSync('npm', ['pack', '--dry-run', '--json'], {
+    cwd: packageRoot,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'inherit'],
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  const parsed = JSON.parse(raw);
+  const report = Array.isArray(parsed) ? parsed[0] : parsed;
+
+  const verdict = evaluatePackedPackage(report);
+
+  console.log(
+    `package size: ${formatMb(verdict.unpackedSize)} unpacked of the ${formatMb(UNPACKED_SIZE_LIMIT_BYTES)} budget (${Math.round(verdict.usedRatio * 1000) / 10}% used), ${report.files.length} files`
+  );
+
+  for (const warning of verdict.warnings) {
+    console.warn(warning);
+  }
+
+  if (verdict.failures.length > 0) {
+    for (const failure of verdict.failures) {
+      console.error(`FAIL: ${failure}`);
+    }
+    process.exit(1);
+  }
+
+  console.log('package-size budget gate: OK');
+}
+
+// Auto-run only when invoked directly (the evaluate function is imported by
+// the vitest teeth).
+if (
+  process.argv[1] !== undefined &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  main();
+}

package/dist/crossHarnessFailover.mjs

@@ -1,6 +0,0 @@
-export async function transpileAndSeedClaudeSession() {
-  return {
-    ok: false,
-    failure: 'the cross-harness failover transpiler bridge was not bundled into this build',
-  };
-}