@linzumi/cli 1.0.272 → 1.0.273

package/scripts/build-canonical-codex-transpiler-oracle.mjs

@@ -1,93 +0,0 @@
-// Spec: kandan/plans/2026-07-13-t1-canonical-activity-format-spec.md
-// (section 11, the T.2 amendment; compute-nodes program, workstream T,
-// task T.2).
-// Relationship: Builds the TS-side ORACLE for the codex transpiler's
-// live-injection leg. T.2's ReScript module
-// (packages/linzumi-cli-rescript/src/transpile/HarnessCodexTranspiler.res)
-// owns the codex SESSION-FORMAT directions; canonical -> codex
-// `thread/inject_items` stays THE one implementation here in
-// src/transcriptCompiler.ts (`transpileCanonicalToCodexInjectItems`, the
-// T.1 re-expressed rebuild path). This oracle bundles that REAL
-// implementation behind a one-shot stdin/stdout driver so the T.2
-// conformance
-// (packages/linzumi-cli-rescript/src/parity/HarnessCodexTranspilerConformance.res)
-// can prove a T.2 foreign-export page parses through the real consumer and
-// feeds the real inject_items emission - one implementation, never a
-// ReScript re-expression.
-//
-// Like build-protocol-parity-oracle.mjs, the output is a local test
-// artifact (.differential/ is gitignored, never published) and stays
-// unminified for debuggability.
-import { mkdir } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { build } from 'esbuild';
-
-const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
-
-const driverSource = `
-import {
-  parseCanonicalActivityPage,
-  transpileCanonicalToCodexInjectItems,
-} from './src/transcriptCompiler';
-
-let stdin = '';
-process.stdin.setEncoding('utf8');
-for await (const chunk of process.stdin) {
-  stdin += chunk;
-}
-const input = JSON.parse(stdin);
-const page = parseCanonicalActivityPage(input.page);
-
-if (page === undefined) {
-  process.stdout.write(JSON.stringify({ parsed: false }));
-} else {
-  const emission = transpileCanonicalToCodexInjectItems({
-    nodes: page.nodes,
-    budget: page.budget,
-    resumeFailure:
-      typeof input.resume_failure === 'string' ? input.resume_failure : '',
-    threadTitle: page.threadTitle,
-  });
-  process.stdout.write(
-    JSON.stringify({
-      parsed: true,
-      ir_version: page.irVersion,
-      node_count: page.nodes.length,
-      node_kinds: page.nodes.map((node) => node.kind),
-      emission: {
-        items: emission.items,
-        emitted_node_count: emission.emittedNodeCount,
-        omitted_node_count: emission.omittedNodeCount,
-        redacted_reasoning_count: emission.redactedReasoningCount,
-        max_emission_tokens: emission.maxEmissionTokens,
-      },
-    })
-  );
-}
-`;
-
-await mkdir(join(packageRoot, '.differential'), { recursive: true });
-
-await build({
-  stdin: {
-    contents: driverSource,
-    resolveDir: packageRoot,
-    sourcefile: 'canonical-codex-transpiler-driver.ts',
-    loader: 'ts',
-  },
-  bundle: true,
-  platform: 'node',
-  target: 'node20',
-  format: 'esm',
-  outfile: join(
-    packageRoot,
-    '.differential/canonical-codex-transpiler-oracle.mjs'
-  ),
-  minify: false,
-  sourcemap: false,
-  legalComments: 'none',
-  // transcriptCompiler is dependency-light; anything leaking in from the
-  // wider commander graph stays external exactly like the entry build.
-  external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
-});

package/scripts/build-config-identity-parity-oracle.mjs

@@ -1,526 +0,0 @@
-// Spec: kandan/plans/2026-07-10-compute-nodes-rescript-commander-zero-ts-program.md
-// (M3 cluster 2, config-identity).
-// Relationship: Builds the TS-side PARITY ORACLE for the config/identity
-// cluster of the ReScript commander port, the sibling of
-// build-protocol-parity-oracle.mjs (cluster 1). The oracle bundles the REAL
-// TS config/identity modules (localConfig.ts, machineFingerprint.ts,
-// machineFingerprintV2.ts, authCache.ts, the cursor-store exports of
-// runner.ts, controlQuarantine.ts's state-file stem, updateNudge.ts's
-// restart-attempt store) behind a one-shot batch driver: a JSON array of
-// cases on stdin, a JSON array of results on stdout. The ReScript package's
-// ConfigIdentityParityConformance drives the SAME inputs through the ported
-// modules in its own scratch directories and asserts
-// accept/reject/normalized-output equivalence AND byte-identical file
-// output - the cross-impl round-trip contract that lets both commanders
-// share ~/.linzumi through M4.
-//
-// Determinism: every source of nondeterminism is pinned per case - id
-// creators are injected constants, timestamps come from a fixed `nowMs`
-// (writeLocalSignupAuth's injectable `now`; a scoped global-Date override
-// for authCache, whose issuedAt is not injectable), and scratch paths are
-// normalized through the "$DIR" placeholder in both directions.
-//
-// SECRETS: the oracle only ever sees the conformance suite's synthetic
-// tokens; nothing here logs case payloads.
-//
-// Like the cluster 1 oracle, the output is a local test artifact
-// (.differential/ is gitignored, never published) and stays unminified for
-// debuggability.
-import { copyFile, mkdir } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { build } from 'esbuild';
-
-const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
-
-const driverSource = `
-import {
-  mkdtempSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  realpathSync,
-  statSync,
-  writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, relative } from 'node:path';
-import {
-  addAllowedCwd,
-  addAllowedCwdForLinzumiUrl,
-  ensureLocalMachineId,
-  ensureLocalMachineIdForLinzumiUrl,
-  ensureLocalRunnerId,
-  ensureLocalRunnerIdForLinzumiUrl,
-  localMachineIdSeedPath,
-  localRunnerIdSeedPath,
-  readConfiguredAllowedCwdDetails,
-  readConfiguredAllowedCwdDetailsForLinzumiUrl,
-  readLocalConfig,
-  readLocalConfigForLinzumiUrl,
-  readLocalSignupAuth,
-  removeAllowedCwd,
-  removeAllowedCwdForLinzumiUrl,
-  replaceAllowedCwdsForLinzumiUrl,
-  writeLocalConfig,
-  writeLocalSignupAuth,
-  writeLocalSignupCompletion,
-} from './src/localConfig';
-import {
-  rawStableMachineIdentifier,
-  stableMachineFingerprint,
-  stableMachineId,
-} from './src/machineFingerprint';
-import {
-  machineFingerprintV2HelloFields,
-  rawOsUsername,
-  stableMachineFingerprintV2,
-} from './src/machineFingerprintV2';
-import {
-  readCachedLocalRunnerToken,
-  readPersonalAgentDelegationToken,
-  writeCachedLocalRunnerToken,
-} from './src/authCache';
-import {
-  createControlCursorFileStore,
-  createRunnerControlEpochStore,
-} from './src/runner';
-import { runnerStateFileStem } from './src/controlQuarantine';
-import { fileRestartAttemptStore } from './src/updateNudge';
-
-// --- Placeholder + snapshot plumbing --------------------------------------------
-
-const dirPlaceholder = '$DIR';
-
-function scratch() {
-  // realpath so macOS /var -> /private/var never splits the two impls'
-  // placeholder substitution.
-  return realpathSync(mkdtempSync(join(tmpdir(), 'linzumi-config-identity-oracle-')));
-}
-
-function substitute(value, from, to) {
-  if (typeof value === 'string') {
-    return value.split(from).join(to);
-  }
-  if (Array.isArray(value)) {
-    return value.map((entry) => substitute(entry, from, to));
-  }
-  if (typeof value === 'object' && value !== null) {
-    return Object.fromEntries(
-      Object.entries(value).map(([key, entry]) => [
-        substitute(key, from, to),
-        substitute(entry, from, to),
-      ])
-    );
-  }
-  return value;
-}
-
-function snapshotFiles(dir) {
-  const files = {};
-  const walk = (current) => {
-    for (const name of readdirSync(current).sort()) {
-      const full = join(current, name);
-      if (statSync(full).isDirectory()) {
-        walk(full);
-      } else {
-        files[relative(dir, full)] = readFileSync(full, 'utf8');
-      }
-    }
-  };
-  walk(dir);
-  return files;
-}
-
-function outcome(run) {
-  try {
-    const value = run();
-    return value === undefined ? { defined: false } : { defined: true, value };
-  } catch (error) {
-    return {
-      threw: true,
-      message: error instanceof Error ? error.message : String(error),
-    };
-  }
-}
-
-const RealDate = Date;
-
-function withFixedNow(nowMs, run) {
-  if (nowMs === undefined) {
-    return run();
-  }
-  class FixedDate extends RealDate {
-    constructor(...args) {
-      if (args.length === 0) {
-        super(nowMs);
-      } else {
-        super(...args);
-      }
-    }
-    static now() {
-      return nowMs;
-    }
-  }
-  globalThis.Date = FixedDate;
-  try {
-    return run();
-  } finally {
-    globalThis.Date = RealDate;
-  }
-}
-
-// --- Config lifecycle ------------------------------------------------------------
-
-function runConfigAction(action, dir, configPath) {
-  switch (action.fn) {
-    case 'mkdir':
-      // Setup helper (not a ported function): void the created-path return
-      // so both impls report the same undefined outcome.
-      return outcome(() => {
-        mkdirSync(action.path, { recursive: true });
-      });
-    case 'writeFile':
-      return outcome(() => writeFileSync(action.path, action.contents, 'utf8'));
-    case 'ensureLocalMachineId':
-      return outcome(() =>
-        ensureLocalMachineId(configPath, () => action.machineId)
-      );
-    case 'ensureLocalMachineIdForLinzumiUrl':
-      return outcome(() =>
-        ensureLocalMachineIdForLinzumiUrl(
-          action.linzumiUrl,
-          configPath,
-          () => action.machineId
-        )
-      );
-    case 'ensureLocalRunnerId':
-      return outcome(() =>
-        ensureLocalRunnerId(configPath, () => action.runnerId)
-      );
-    case 'ensureLocalRunnerIdForLinzumiUrl':
-      return outcome(() =>
-        ensureLocalRunnerIdForLinzumiUrl(
-          action.linzumiUrl,
-          configPath,
-          () => action.runnerId
-        )
-      );
-    case 'machineIdSeedPath':
-      return outcome(() => localMachineIdSeedPath(configPath, action.linzumiUrl));
-    case 'runnerIdSeedPath':
-      return outcome(() => localRunnerIdSeedPath(configPath, action.linzumiUrl));
-    case 'writeLocalConfig':
-      return outcome(() => writeLocalConfig(action.config, configPath));
-    case 'addAllowedCwd':
-      return outcome(() => addAllowedCwd(action.pathValue, configPath));
-    case 'addAllowedCwdForLinzumiUrl':
-      return outcome(() =>
-        addAllowedCwdForLinzumiUrl(action.pathValue, action.linzumiUrl, configPath)
-      );
-    case 'removeAllowedCwd':
-      return outcome(() => removeAllowedCwd(action.pathValue, configPath));
-    case 'removeAllowedCwdForLinzumiUrl':
-      return outcome(() =>
-        removeAllowedCwdForLinzumiUrl(action.pathValue, action.linzumiUrl, configPath)
-      );
-    case 'replaceAllowedCwdsForLinzumiUrl':
-      return outcome(() =>
-        replaceAllowedCwdsForLinzumiUrl(action.pathValues, action.linzumiUrl, configPath)
-      );
-    case 'readLocalConfig':
-      return outcome(() => readLocalConfig(configPath));
-    case 'readLocalConfigForLinzumiUrl':
-      return outcome(() => readLocalConfigForLinzumiUrl(action.linzumiUrl, configPath));
-    case 'readConfiguredAllowedCwdDetails':
-      return outcome(() => readConfiguredAllowedCwdDetails(configPath));
-    case 'readConfiguredAllowedCwdDetailsForLinzumiUrl':
-      return outcome(() =>
-        readConfiguredAllowedCwdDetailsForLinzumiUrl(action.linzumiUrl, configPath)
-      );
-    case 'readLocalSignupAuth':
-      return outcome(() => readLocalSignupAuth(configPath));
-    case 'writeLocalSignupAuth':
-      return outcome(() =>
-        writeLocalSignupAuth(
-          {
-            ...action.auth,
-            now: action.auth.nowMs === undefined ? undefined : new RealDate(action.auth.nowMs),
-          },
-          configPath
-        )
-      );
-    case 'writeLocalSignupCompletion':
-      return outcome(() =>
-        writeLocalSignupCompletion(
-          {
-            ...action.completion,
-            now:
-              action.completion.nowMs === undefined
-                ? undefined
-                : new RealDate(action.completion.nowMs),
-          },
-          configPath
-        )
-      );
-    default:
-      return { threw: true, message: 'unknown config action ' + String(action.fn) };
-  }
-}
-
-function handleConfigLifecycle(testCase) {
-  const dir = scratch();
-  const configPath = join(dir, 'config.json');
-  const actions = substitute(testCase.actions, dirPlaceholder, dir);
-  const results = actions.map((action) => runConfigAction(action, dir, configPath));
-  return substitute({ results, files: snapshotFiles(dir) }, dir, dirPlaceholder);
-}
-
-// --- Auth lifecycle ----------------------------------------------------------------
-
-function runAuthAction(action, authFilePath) {
-  switch (action.fn) {
-    case 'writeFile':
-      return outcome(() => writeFileSync(authFilePath, action.contents, 'utf8'));
-    case 'writeCachedLocalRunnerToken':
-      return outcome(() =>
-        writeCachedLocalRunnerToken({
-          kandanUrl: action.kandanUrl,
-          accessToken: action.accessToken,
-          expiresInSeconds: action.expiresInSeconds,
-          authFilePath,
-        })
-      );
-    case 'readCachedLocalRunnerToken':
-      return outcome(() => readCachedLocalRunnerToken(action.kandanUrl, authFilePath));
-    case 'readPersonalAgentDelegationToken':
-      return outcome(() => readPersonalAgentDelegationToken(authFilePath));
-    default:
-      return { threw: true, message: 'unknown auth action ' + String(action.fn) };
-  }
-}
-
-function handleAuthLifecycle(testCase) {
-  const dir = scratch();
-  const authFilePath = join(dir, 'auth.json');
-  const actions = substitute(testCase.actions, dirPlaceholder, dir);
-  const results = actions.map((action) =>
-    withFixedNow(testCase.nowMs, () => runAuthAction(action, authFilePath))
-  );
-  return substitute({ results, files: snapshotFiles(dir) }, dir, dirPlaceholder);
-}
-
-// --- Fingerprint probes ---------------------------------------------------------------
-
-function handleFingerprint(testCase) {
-  const spec = testCase.probes ?? {};
-  const probes = {
-    ...(spec.platform === undefined ? {} : { platform: spec.platform }),
-    execFile: () => {
-      if (spec.execFileOutput === undefined) {
-        throw new Error('execFile probe failed');
-      }
-      return spec.execFileOutput;
-    },
-    readFile: (path) => {
-      const contents = (spec.readFiles ?? {})[path];
-      if (contents === undefined) {
-        throw new Error('readFile probe failed: ' + path);
-      }
-      return contents;
-    },
-    username: () => {
-      if (spec.username === undefined) {
-        throw new Error('username probe failed');
-      }
-      return spec.username;
-    },
-  };
-  return {
-    raw: outcome(() => rawStableMachineIdentifier(probes)),
-    v1: outcome(() => stableMachineFingerprint(probes)),
-    machineId: outcome(() => stableMachineId(probes)),
-    rawUsername: outcome(() => rawOsUsername(probes)),
-    v2: outcome(() => stableMachineFingerprintV2(probes)),
-    helloFields: outcome(() =>
-      machineFingerprintV2HelloFields(stableMachineFingerprintV2(probes))
-    ),
-  };
-}
-
-// --- Cursor store ------------------------------------------------------------------------
-
-function collectingLog(events, dir) {
-  return (event, payload) => {
-    events.push({ event, payload: substitute(payload, dir, dirPlaceholder) });
-  };
-}
-
-function runStoreAction(store, action) {
-  switch (action.fn) {
-    case 'initial':
-      return outcome(() => store.initial(action.topic));
-    case 'onAdvance':
-      return outcome(() => store.onAdvance(action.topic, action.seq));
-    case 'reset':
-      return outcome(() => store.reset(action.topic, action.seq));
-    case 'adoptEpoch':
-      return outcome(() => store.adoptEpoch(action.epoch));
-    case 'epoch':
-      return outcome(() => store.epoch());
-    case 'flush':
-      return outcome(() => store.flush());
-    default:
-      return { threw: true, message: 'unknown store action ' + String(action.fn) };
-  }
-}
-
-function readFileOrNull(path) {
-  try {
-    return readFileSync(path, 'utf8');
-  } catch {
-    return null;
-  }
-}
-
-function handleCursorStore(testCase) {
-  const dir = scratch();
-  const path = join(dir, 'store.json');
-  if (testCase.initialContents !== undefined) {
-    writeFileSync(path, testCase.initialContents, 'utf8');
-  }
-  const events = [];
-  const store = createControlCursorFileStore(path, collectingLog(events, dir), {
-    ...(testCase.discardSeqsOnFirstEpochAdoption === undefined
-      ? {}
-      : { discardSeqsOnFirstEpochAdoption: testCase.discardSeqsOnFirstEpochAdoption }),
-    ...(testCase.fsyncOnWrite === undefined
-      ? {}
-      : { fsyncOnWrite: testCase.fsyncOnWrite }),
-  });
-  const results = (testCase.actions ?? []).map((action) => runStoreAction(store, action));
-  store.flush();
-  return { results, fileBytes: readFileOrNull(path), events };
-}
-
-function handleEpochStore(testCase) {
-  const dir = scratch();
-  const cursorPath = join(dir, 'cursor.json');
-  const startTurnPath = join(dir, 'start-turn.json');
-  if (testCase.cursorContents !== undefined) {
-    writeFileSync(cursorPath, testCase.cursorContents, 'utf8');
-  }
-  if (testCase.startTurnContents !== undefined) {
-    writeFileSync(startTurnPath, testCase.startTurnContents, 'utf8');
-  }
-  const events = [];
-  const log = collectingLog(events, dir);
-  const cursorStore = createControlCursorFileStore(cursorPath, log);
-  const startTurnStore = createControlCursorFileStore(startTurnPath, log, {
-    discardSeqsOnFirstEpochAdoption: true,
-  });
-  const epochStore = createRunnerControlEpochStore(cursorStore, startTurnStore, log, {
-    runnerId: testCase.runnerId,
-    kandanUrl: testCase.kandanUrl,
-  });
-  const initialEpoch = outcome(() => epochStore.current());
-  const adoptResults = (testCase.adopts ?? []).map((adopt) =>
-    outcome(() => epochStore.adopt(adopt.topic, adopt.epoch))
-  );
-  cursorStore.flush();
-  startTurnStore.flush();
-  return {
-    initialEpoch,
-    adoptResults,
-    cursorBytes: readFileOrNull(cursorPath),
-    startTurnBytes: readFileOrNull(startTurnPath),
-    events,
-  };
-}
-
-// --- Restart-attempt store -----------------------------------------------------------------
-
-function handleRestartAttemptStore(testCase) {
-  const dir = scratch();
-  const path = join(dir, 'attempt.json');
-  if (testCase.initialContents !== undefined) {
-    writeFileSync(path, testCase.initialContents, 'utf8');
-  }
-  const store = fileRestartAttemptStore(path);
-  const loaded = outcome(() => store.load());
-  let saved = { defined: false };
-  if (testCase.record !== undefined) {
-    saved = outcome(() => store.save(testCase.record));
-  }
-  return { loaded, saved, fileBytes: readFileOrNull(path) };
-}
-
-// --- Dispatch --------------------------------------------------------------------------------
-
-function handle(testCase) {
-  switch (testCase.op) {
-    case 'configLifecycle':
-      return handleConfigLifecycle(testCase);
-    case 'authLifecycle':
-      return handleAuthLifecycle(testCase);
-    case 'fingerprint':
-      return handleFingerprint(testCase);
-    case 'cursorStore':
-      return handleCursorStore(testCase);
-    case 'epochStore':
-      return handleEpochStore(testCase);
-    case 'stateFileStem':
-      return outcome(() => runnerStateFileStem(testCase.runnerId));
-    case 'restartAttemptStore':
-      return handleRestartAttemptStore(testCase);
-    default:
-      return { threw: true, message: 'unknown op ' + String(testCase.op) };
-  }
-}
-
-let stdin = '';
-process.stdin.setEncoding('utf8');
-for await (const chunk of process.stdin) {
-  stdin += chunk;
-}
-const cases = JSON.parse(stdin);
-process.stdout.write(JSON.stringify(cases.map(handle)));
-`;
-
-await mkdir(join(packageRoot, '.differential'), { recursive: true });
-
-// runner.ts's graph resolves assets/ relative to the bundle at import time
-// (same requirement as build-differential-entry.mjs).
-await mkdir(join(packageRoot, '.differential/assets'), { recursive: true });
-await copyFile(
-  join(packageRoot, 'src/assets/linzumi-logo.svg'),
-  join(packageRoot, '.differential/assets/linzumi-logo.svg')
-);
-
-await build({
-  stdin: {
-    contents: driverSource,
-    resolveDir: packageRoot,
-    sourcefile: 'config-identity-parity-driver.ts',
-    loader: 'ts',
-  },
-  bundle: true,
-  // Spec: plans/2026-09-09-ts-native-account-continuation.md. Match the
-  // production/auth-oracle ESM bridge for reachable CJS runtime dependencies;
-  // the distinct banner binding cannot collide with bundled createRequire.
-  banner: {
-    js: "import { createRequire as __configIdentityOracleCreateRequire } from 'node:module';\nconst require = __configIdentityOracleCreateRequire(import.meta.url);",
-  },
-  platform: 'node',
-  target: 'node20',
-  format: 'esm',
-  outfile: join(packageRoot, '.differential/config-identity-parity-oracle.mjs'),
-  minify: false,
-  sourcemap: false,
-  legalComments: 'none',
-  // runner.ts pulls the wider commander graph; the same runtime externals
-  // as the differential entry build stay external (they are installed in
-  // this package's node_modules, and the oracle only exercises the
-  // config/identity exports).
-  external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
-});