@linzumi/cli 1.0.275 → 1.0.276

package/scripts/build.mjs

@@ -114,375 +114,52 @@ if (
 )
   throw new Error('preview_identity_packaged_asset_invalid');
 
+// Spec: spec/single-commander.md. Required ReScript assets fail the build.
 const { build } = await import('esbuild');
-
-// Spec: plans/2026-08-17-tcp-tunnel-cli.spec.md. The zero-TS tunnel command
-// is a mandatory ReScript build input, not a fail-soft optional rung.
-const tcpTunnelCliEntry = join(
-  packageRoot,
-  '../linzumi-cli-rescript/src/forwarding/CommanderTcpTunnelCli.res.mjs'
-);
-await access(tcpTunnelCliEntry);
-
-// M3 cluster 15: the ReScript package ships no version literal (repo rule);
-// the CLI version is esbuild-`define`d into the impl-res bundle as
-// process.env.LINZUMI_CLI_VERSION (read via CommanderEntryVersion.res), the
-// same source of truth as src/version.ts linzumiCliVersion.
-const packageVersion = JSON.parse(
-  await readFile(join(packageRoot, 'package.json'), 'utf8')
-).version;
-
-await rm(join(packageRoot, 'dist'), { recursive: true, force: true });
-for (const implementation of ['impl-ts', 'impl-res']) {
-  const destination = join(
-    packageRoot,
-    'dist',
-    implementation,
-    'native/darwin'
-  );
-  await mkdir(destination, { recursive: true });
-  await copyFile(identityAsset, join(destination, 'preview-process-identity'));
-  await chmod(join(destination, 'preview-process-identity'), 0o755);
-  await copyFile(identityManifestPath, join(destination, 'manifest.json'));
-}
-
-// Renamed banner import (the build-auth-parity-oracle.mjs convention, made
-// load-bearing by prod RCA 2026-07-20): esbuild injects banners VERBATIM -
-// outside symbol renaming - so a bare `createRequire` here collides with any
-// source module's own top-level `import { createRequire } from 'node:module'`
-// (bundledCodexBin.ts) and the bundle dies at load with "Identifier
-// 'createRequire' has already been declared". These bundles are currently
-// minified (which renames the source-side binding and masks the collision),
-// but the identically-bannered UNMINIFIED nix image bundles shipped exactly
-// that SyntaxError on 2026-07-11 and crash-looped the hosted @linzumi runner
-// for 9 days. Keep the banner symbol collision-proof, never rely on minify.
+const packageVersion = JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8')).version;
+const commanderSource = join(packageRoot, '../linzumi-cli-rescript/src');
 const banner = {
   js: "import { createRequire as __linzumiBundleCreateRequire } from 'node:module';\nconst require = __linzumiBundleCreateRequire(import.meta.url);",
 };
-
-// M3 cluster 15 (entry/packaging/selector): ONE package ships BOTH commander
-// implementations - dist/impl-ts/ (this package's esbuild output, relocated
-// from the historical flat dist/index.js) and dist/impl-res/ (the ReScript
-// commander bundled from ../linzumi-cli-rescript) - behind the tiny plain-JS
-// chooser bundled to dist/index.js. The byte-pinned bin/linzumi.js entry
-// (I153) keeps importing ../dist/index.js and calling main(argv), so the bin
-// bytes stay EXACTLY as pinned and the chooser lives behind them.
-//
-// OWNER GATE (2026-07-15): the chooser resolves an absent/unknown
-// ~/.linzumi/commanderImpl cache to "ts"; nothing in the package selects
-// impl-res by default.
-await build({
-  entryPoints: [join(packageRoot, 'src/commanderImplChooser.mjs')],
-  bundle: true,
-  platform: 'node',
-  target: 'node20',
-  format: 'esm',
-  outfile: join(packageRoot, 'dist/index.js'),
-  minify: true,
-  sourcemap: false,
-  legalComments: 'none',
-  // The impl bundles are runtime dynamic imports the chooser selects between;
-  // they must never be inlined into the chooser bundle.
-  external: ['./impl-ts/*', './impl-res/*'],
-});
-
-await build({
-  entryPoints: [join(packageRoot, 'src/index.ts')],
-  bundle: true,
-  platform: 'node',
-  target: 'node20',
-  format: 'esm',
-  outfile: join(packageRoot, 'dist/impl-ts/index.js'),
-  // Production hardening: minify the published CLI bundle and ship no source
-  // map. We already bundle to a single impl bundle (no loose src/); minifying
-  // reduces accidental source/IP leakage in the npm artifact. This is NOT a
-  // security boundary -- the published package is public by definition, so no
-  // secret may live in this code and all authz stays server-side.
-  minify: true,
-  sourcemap: false,
-  legalComments: 'none',
-  external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
-  banner,
-});
-
-await build({
-  entryPoints: [tcpTunnelCliEntry],
-  bundle: true,
-  platform: 'node',
-  target: 'node20',
-  format: 'esm',
-  outfile: join(packageRoot, 'dist/tcp-tunnel-cli.mjs'),
-  minify: true,
-  sourcemap: false,
-  legalComments: 'none',
-  external: ['ws'],
-  banner,
-});
-
-// The in-guest Linzumi MCP bridge: a self-contained MCP server bundle that the
-// VM Codex supervisor injects into a coding job's microVM and runs with a plain
-// `node`. Unlike dist/index.js it bundles EVERYTHING (no `external`), so the
-// guest needs no extra npm packages - only Node, which provisioning already
-// installs. The MCP server path uses only the bundled @modelcontextprotocol/sdk
-// and global fetch; it never touches ws/undici/blessed/claude-agent-sdk, so
-// bundling with no externals stays lean (Spec:
-// plans/2026-06-12-local-vm-codex-execution-phase1.md in-guest MCP bridge).
-// Output extension is .mjs (not .js): the bundle is ESM (banner createRequire +
-// a node:url built-in import are top-level `import` statements). In the guest it
-// lives at /opt/linzumi/ next to the CJS relay.js with no package.json in scope,
-// so a `.js` would be treated as CommonJS on Node versions without ESM-syntax
-// detection and throw "Cannot use import statement outside a module". A
-// `package.json {"type":"module"}` marker would fix mcp-server but BREAK the CJS
-// relay.js at the same path, so the unambiguous `.mjs` extension is the correct
-// fix.
-await build({
-  entryPoints: [join(packageRoot, 'src/mcpServerEntry.ts')],
-  bundle: true,
-  platform: 'node',
-  target: 'node20',
-  format: 'esm',
-  outfile: join(packageRoot, 'dist/mcp-server.mjs'),
-  minify: true,
-  sourcemap: false,
-  legalComments: 'none',
-  banner,
-});
-
-// M3 cluster 15: the TS impl's guest MCP bridge also ships CO-LOCATED at
-// dist/impl-ts/mcp-server.mjs (the 'ts' candidate ladder's impl-specific
-// head; the flat dist/mcp-server.mjs above stays as the rollback backstop
-// and the guest path contract). Same bytes, copied - never a second build.
-await mkdir(join(packageRoot, 'dist/impl-ts'), { recursive: true });
-await copyFile(
-  join(packageRoot, 'dist/tcp-tunnel-cli.mjs'),
-  join(packageRoot, 'dist/impl-ts/tcp-tunnel-cli.mjs')
-);
-await copyFile(
-  join(packageRoot, 'dist/mcp-server.mjs'),
-  join(packageRoot, 'dist/impl-ts/mcp-server.mjs')
-);
-
-// M3 cluster 14 selector story (compute-nodes program, M3 packaging): the
-// ReScript impl's guest MCP bridge, bundled from the compiled
-// CommanderMcpEntry artifact into dist/impl-res/mcp-server.mjs - the head
-// of the 'rescript' candidate ladder (mcpServerBundleCandidates in
-// src/vmSandbox/startVmCodexAppServer.ts / CommanderMcpBundleSelection.res).
-// Same no-externals rationale as dist/mcp-server.mjs above: the guest gets
-// ONE file and a bare `node`. Like the F5 cross-harness bridge, the
-// ReScript artifacts may not be built in this checkout (publish CI builds
-// only @linzumi/cli); the selector ladder is fail-soft by design - a
-// missing impl-res bundle falls back to the flat TS bundle - so the honest
-// posture here is warn-and-skip, never a broken stub. Post-M4.3 this leg
-// BECOMES the dist/mcp-server.mjs build and the TS leg above is deleted
-// with the TS impl.
-try {
-  await build({
-    entryPoints: [
-      join(
-        packageRoot,
-        '../linzumi-cli-rescript/src/mcp/CommanderMcpEntry.res.mjs'
-      ),
-    ],
-    bundle: true,
-    platform: 'node',
-    target: 'node20',
-    format: 'esm',
-    outfile: join(packageRoot, 'dist/impl-res/mcp-server.mjs'),
-    minify: true,
-    sourcemap: false,
-    legalComments: 'none',
-    banner,
-  });
-} catch (error) {
-  console.warn(
-    '[build] impl-res mcp-server bundle could not be built (are the ' +
-      'linzumi-cli-rescript artifacts compiled?); the selector ladder falls ' +
-      `back to the flat dist/mcp-server.mjs: ${
-        error instanceof Error ? error.message : String(error)
-      }`
-  );
-}
-
-// Long-lived topics producer (spec/topics-rules.md :topics/first-producers-v1
-// slice a): `linzumi topics post` is ReScript per the zero-TS program
-// (CommanderTopicsCli.res); bundle it beside the flat CLI bundle so the
-// dispatcher's `new URL('./topics-cli.mjs', import.meta.url)` resolves at
-// runtime. Publish CI compiles @linzumi/cli-rescript before pack, so real
-// releases always carry it; a checkout without the compiled artifacts gets
-// the same warn-and-skip posture as the mcp bundle above (the dispatcher
-// then falls back to the package-source candidate, and failing that prints
-// an honest "unavailable in this build" refusal).
-try {
-  await build({
-    entryPoints: [
-      join(
-        packageRoot,
-        '../linzumi-cli-rescript/src/topics/CommanderTopicsCli.res.mjs'
-      ),
-    ],
-    bundle: true,
-    platform: 'node',
-    target: 'node20',
-    format: 'esm',
-    outfile: join(packageRoot, 'dist/topics-cli.mjs'),
-    minify: true,
-    sourcemap: false,
-    legalComments: 'none',
-    banner,
-  });
-} catch (error) {
-  console.warn(
-    '[build] topics-cli bundle could not be built (are the ' +
-      'linzumi-cli-rescript artifacts compiled?); `linzumi topics post` ' +
-      `falls back to the package-source candidate: ${
-        error instanceof Error ? error.message : String(error)
-      }`
-  );
-}
-
-// The in-guest CLOUD turn driver: a self-contained dist/cloud-supervisor.mjs
-// bundle that vmCloudSupervisor injects onto the persistent overlay of a
-// workspace-agent smolcloud VM and runs with a bare `node` (the guest's
-// node:22-bookworm-slim has node, but no npm packages beyond what provisioning
-// installs globally). Unlike dist/index.js it bundles EVERYTHING (no
-// `external`) so the guest needs no extra packages. It uses `ws` (bundled) for
-// the guest-loopback codex websocket. Same .mjs rationale as mcp-server.mjs:
-// the bundle is ESM (banner createRequire + node:* built-in imports) and lives
-// next to CJS files with no package.json in scope, so the explicit .mjs makes
-// Node treat it as ESM regardless of Node version.
-await build({
-  entryPoints: [join(packageRoot, 'src/cloudSupervisorEntry.ts')],
-  bundle: true,
-  platform: 'node',
-  target: 'node20',
-  format: 'esm',
-  outfile: join(packageRoot, 'dist/impl-ts/cloud-supervisor.mjs'),
-  minify: true,
-  sourcemap: false,
-  legalComments: 'none',
-  banner,
-});
-
-// The in-guest bundles are impl-AGNOSTIC guest artifacts (they run inside the
-// VM, not inside either commander), so the impl-res dist carries the same
-// bytes: its vmCloudSupervisor twin resolves siblings of ITS bundle exactly
-// like the TS one does (resolveDistBundle / dirname(import.meta.url)).
-await mkdir(join(packageRoot, 'dist/impl-res'), { recursive: true });
-await copyFile(
-  join(packageRoot, 'dist/impl-ts/cloud-supervisor.mjs'),
-  join(packageRoot, 'dist/impl-res/cloud-supervisor.mjs')
-);
-
-// F5 cross-harness failover bridge (Workstream F task F5): the runner
-// dynamic-imports ./crossHarnessFailover.mjs relative to its own bundle, so
-// dist ships a self-contained sibling bundle with the compiled ReScript
-// transpiler artifacts (packages/linzumi-cli-rescript, built by `rescript`)
-// resolved at build time. When the artifacts are not built in this checkout
-// the publish must not silently ship a broken rung: emit an HONEST stub
-// whose import succeeds but whose executor refuses loudly - the ladder then
-// terminates red-with-receipts exactly as F2 (the flag's rollback posture) -
-// and warn in the build log.
-try {
+await rm(join(packageRoot, 'dist'), { recursive: true, force: true });
+await mkdir(join(packageRoot, 'dist/native/darwin'), { recursive: true });
+await copyFile(identityAsset, join(packageRoot, 'dist/native/darwin/preview-process-identity'));
+await chmod(join(packageRoot, 'dist/native/darwin/preview-process-identity'), 0o755);
+await copyFile(identityManifestPath, join(packageRoot, 'dist/native/darwin/manifest.json'));
+await mkdir(join(packageRoot, 'dist/assets'), { recursive: true });
+await copyFile(join(packageRoot, 'src/assets/linzumi-logo.svg'), join(packageRoot, 'dist/assets/linzumi-logo.svg'));
+
+for (const [source, output, external] of [
+  ['entry/CommanderEntryMain.res.mjs', 'index.js', ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk']],
+  ['mcp/CommanderMcpEntry.res.mjs', 'mcp-server.mjs', []],
+  ['worker/CommanderHostedAccountWorker.res.mjs', 'hosted-coding-account-worker.js', []],
+  ['topics/CommanderTopicsCli.res.mjs', 'topics-cli.mjs', []],
+  ['forwarding/CommanderTcpTunnelCli.res.mjs', 'tcp-tunnel-cli.mjs', ['ws', 'undici']],
+]) {
   await build({
-    entryPoints: [join(packageRoot, 'src/crossHarnessFailover.mjs')],
+    entryPoints: [join(commanderSource, source)],
     bundle: true,
     platform: 'node',
     target: 'node20',
     format: 'esm',
-    outfile: join(packageRoot, 'dist/impl-ts/crossHarnessFailover.mjs'),
+    outfile: join(packageRoot, 'dist', output),
     minify: true,
     sourcemap: false,
     legalComments: 'none',
+    external,
     banner,
+    define: {'process.env.LINZUMI_CLI_VERSION': JSON.stringify(packageVersion)},
   });
-} catch (error) {
-  console.warn(
-    '[build] cross-harness failover bridge could not be bundled (are the ' +
-      'linzumi-cli-rescript artifacts built?); shipping the honest refusal ' +
-      `stub instead: ${error instanceof Error ? error.message : String(error)}`
-  );
-  await mkdir(join(packageRoot, 'dist/impl-ts'), { recursive: true });
-  await writeFile(
-    join(packageRoot, 'dist/impl-ts/crossHarnessFailover.mjs'),
-    'export async function transpileAndSeedClaudeSession() {\n' +
-      '  return {\n' +
-      '    ok: false,\n' +
-      "    failure: 'the cross-harness failover transpiler bridge was not bundled into this build',\n" +
-      '  };\n' +
-      '}\n' +
-      'export async function seedCanonicalTranscriptIntoClaudeSession() {\n' +
-      '  return {\n' +
-      '    ok: false,\n' +
-      "    failure: 'the canonical Claude rehydration bridge was not bundled into this build',\n" +
-      '  };\n' +
-      '}\n'
-  );
 }
-// The F5 bridge is self-contained; the impl-res commander resolves the same
-// sibling name next to ITS bundle.
-await copyFile(
-  join(packageRoot, 'dist/impl-ts/crossHarnessFailover.mjs'),
-  join(packageRoot, 'dist/impl-res/crossHarnessFailover.mjs')
-);
-
-for (const implDir of ['dist/impl-ts', 'dist/impl-res']) {
-  await mkdir(join(packageRoot, implDir, 'assets'), { recursive: true });
-  await copyFile(
-    join(packageRoot, 'src/assets/linzumi-logo.svg'),
-    join(packageRoot, implDir, 'assets/linzumi-logo.svg')
-  );
-}
-
-// M3 cluster 15: the ReScript commander itself - dist/impl-res/index.js,
-// bundled from the compiled composition-root entry
-// (packages/linzumi-cli-rescript/src/entry/CommanderEntryMain.res). Same
-// externals/banner posture as the TS impl bundle: the runtime deps stay
-// external (they ship in the package's dependency closure), everything else
-// is inlined. When the ReScript artifacts are not compiled in this checkout
-// the build ships an HONEST refusal stub whose import succeeds but whose
-// main() refuses loudly - the chooser's short-lived-exit breaker then falls
-// back to TS (never a silent wrong impl). Publish CI compiles the ReScript
-// package first and the package-size gate asserts the REAL bundle shipped,
-// so the stub can never reach npm.
-try {
-  await build({
-    entryPoints: [
-      join(
-        packageRoot,
-        '../linzumi-cli-rescript/src/entry/CommanderEntryMain.res.mjs'
-      ),
-    ],
-    bundle: true,
-    platform: 'node',
-    target: 'node20',
-    format: 'esm',
-    outfile: join(packageRoot, 'dist/impl-res/index.js'),
-    minify: true,
-    sourcemap: false,
-    legalComments: 'none',
-    external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
-    banner,
-    define: {
-      'process.env.LINZUMI_CLI_VERSION': JSON.stringify(packageVersion),
-    },
-  });
-} catch (error) {
-  console.warn(
-    '[build] impl-res commander bundle could not be built (are the ' +
-      'linzumi-cli-rescript artifacts compiled?); shipping the honest ' +
-      `refusal stub instead: ${error instanceof Error ? error.message : String(error)}`
-  );
-  await writeFile(
-    join(packageRoot, 'dist/impl-res/index.js'),
-    'export async function main() {\n' +
-      "  throw new Error('the rescript commander implementation was not bundled into this build');\n" +
-      '}\n'
-  );
+for (const [source, output] of [
+  ['remoteCodexHarnessWorkerEntrypoint.ts', 'remote-codex-harness-worker.js'],
+  ['cloudSupervisorEntry.ts', 'cloud-supervisor.mjs'],
+  ['crossHarnessFailover.mjs', 'crossHarnessFailover.mjs'],
+]) {
+  await build({entryPoints: [join(packageRoot, 'src', source)], bundle: true,
+    platform: 'node', target: 'node20', format: 'esm',
+    outfile: join(packageRoot, 'dist', output), minify: true,
+    sourcemap: false, legalComments: 'none', banner,
+    external: output === 'remote-codex-harness-worker.js' ? ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'] : []});
 }
-
-// LOAD-SMOKE TOOTH (prod RCA 2026-08-06): parsing alone did not catch a
-// createRequire dependency that was absent from the Nix image. The published
-// package has a separate build recipe, so import its fully installed commander
-// bundle here as well; any eager MODULE_NOT_FOUND or other load-time failure
-// fails the build.
-await import(pathToFileURL(join(packageRoot, 'dist/impl-ts/index.js')).href);
+await import(pathToFileURL(join(packageRoot, 'dist/index.js')).href);

package/scripts/bump-cli-version.mjs

@@ -1,3 +1,4 @@
+// Spec: spec/single-commander.md. Retained operational version pins.
 // Single-command CLI version bump.
 //
 // Releasing the CLI:
@@ -5,7 +6,8 @@
 // this script too, so a REAL version literal here would collide with the
 // live package version and abort a bump.)
 //
-//   1. pnpm bump-version <new-version>     (for example: 1.2.3-beta)
+//   1. pnpm bump-version <new-version> --spec plans/<release-spec>.md
+//      (for example: 1.2.3-beta with its approved release spec)
 //   2. Run the test suite: pnpm vitest run --config vitest.config.mjs
 //   3. Commit with a "[deploy-commander]" title and merge to main (the
 //      deprecated "[deploy-cli]" marker was retired in the N3.9 window on
@@ -21,8 +23,10 @@
 // drift past a release.
 //
 // Flags:
+//   --spec <path>  Required standalone release spec under plans/.
 //   --dry-run      Plan and verify every rewrite without writing files.
 //   --root <dir>   Operate on a different package root (used by tests).
+// Release contract: plans/2026-07-12-linzumi-unscoped-npm-package-spec.md
 import { readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -33,11 +37,12 @@ function fail(message) {
 }
 
 const usage =
-  'usage: node scripts/bump-cli-version.mjs <new-version> [--dry-run] [--root <dir>]';
+  'usage: node scripts/bump-cli-version.mjs <new-version> --spec plans/<release-spec>.md [--dry-run] [--root <dir>]';
 
 const rawArgs = process.argv.slice(2);
 let dryRun = false;
 let explicitRoot;
+let releaseSpec;
 const positional = [];
 
 for (let index = 0; index < rawArgs.length; index += 1) {
@@ -45,6 +50,13 @@ for (let index = 0; index < rawArgs.length; index += 1) {
 
   if (arg === '--dry-run') {
     dryRun = true;
+  } else if (arg === '--spec') {
+    releaseSpec = rawArgs[index + 1];
+    index += 1;
+
+    if (releaseSpec === undefined) {
+      fail(`--spec requires a standalone release spec under plans/\n${usage}`);
+    }
   } else if (arg === '--root') {
     explicitRoot = rawArgs[index + 1];
     index += 1;
@@ -75,6 +87,26 @@ const packageRoot =
   explicitRoot ?? dirname(dirname(fileURLToPath(import.meta.url)));
 const aliasPackageRoot = join(dirname(packageRoot), 'linzumi');
 
+if (
+  releaseSpec === undefined ||
+  !/^plans\/[A-Za-z0-9][A-Za-z0-9._/-]*\.md$/.test(releaseSpec) ||
+  releaseSpec.split('/').some((part) => part === '.' || part === '..')
+) {
+  fail(`--spec requires a standalone release spec under plans/\n${usage}`);
+}
+
+try {
+  if (
+    readFileSync(join(packageRoot, '../..', releaseSpec), 'utf8').trim() === ''
+  ) {
+    fail(`--spec requires a nonempty standalone release spec: ${releaseSpec}`);
+  }
+} catch (error) {
+  fail(
+    `--spec requires a readable standalone release spec: ${releaseSpec} (${error.message})`
+  );
+}
+
 let manifest;
 
 try {
@@ -141,12 +173,6 @@ const knownSites = [
     pattern: `expect(manifest.version).toBe('${oldVersion}');`,
     replacement: `expect(manifest.version).toBe('${newVersion}');`,
   },
-  {
-    file: 'test/cli.test.ts',
-    description: '--version output expectation',
-    pattern: `'linzumi ${oldVersion}'`,
-    replacement: `'linzumi ${newVersion}'`,
-  },
   {
     file: 'test/runnerBridge.test.ts',
     description: 'runner join metadata version pin',
@@ -193,7 +219,7 @@ function appendVersionSpecComment(content) {
   const today = new Date().toISOString().slice(0, 10);
   const entry = [
     `- Date: ${today}`,
-    '  Spec: scripts/bump-cli-version.mjs (automated version bump)',
+    `  Spec: ${releaseSpec}`,
     `  Relationship: Bumps the published CLI version so the`,
     '  current mainline CLI can be released under a fresh immutable npm',
     '  version with `[deploy-commander]`.',

package/scripts/check-package-size-budget.mjs

@@ -1,25 +1,4 @@
-/*
-- Date: 2026-07-15
-  Spec: kandan/plans/2026-07-10-compute-nodes-rescript-commander-zero-ts-program.md
-        (M3 packaging paragraph: "Package-size budget in publish CI")
-  Relationship: The M3 cluster 15 publish-CI package-size gate. Runs
-  `npm pack --dry-run --json`, enforces the dual-impl package budget with the
-  warn-band shape of test/ciBudget.ts (warn at 85% of the fail limit,
-  actionable per-file top-offender breakdown - never a bare at-limit
-  assertion; see the 2026-07-12 "expected 1000 to be less than 1000" staging
-  red), and asserts the dual-impl packaging PARITY facts: both impl bundles
-  ship for real (the impl-res honest-refusal stub that dev builds emit when
-  the ReScript artifacts are not compiled must never reach npm), the chooser
-  stays tiny, and the guest-bundle ladder files exist.
-
-  Budget rationale (measured 2026-07-15 on this branch): the dual-impl
-  package measures ~4.96 MB unpacked with the impl-res stub; the real
-  impl-res commander bundle lands well under 3 MB (it bundles the same code
-  the ~2.26 MB impl-ts bundle carries, compiled from ReScript). 12 MB
-  unpacked caps runaway growth at roughly 1.5x the projected dual-impl size
-  while leaving the dual-impl period real headroom; the 85% warn band
-  (10.2 MB) makes erosion loud before it reds a publish.
-*/
+// Spec: spec/single-commander.md. One complete Commander bundle.
 import { execFileSync } from 'node:child_process';
 import { dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -28,42 +7,22 @@ const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
 
 export const UNPACKED_SIZE_LIMIT_BYTES = 12 * 1024 * 1024;
 export const WARN_RATIO = 0.85;
-// The chooser must stay a TINY plain-JS shim (it runs before either impl
-// bundle loads); a fat dist/index.js means impl code leaked into it.
-export const CHOOSER_SIZE_LIMIT_BYTES = 64 * 1024;
-// A real commander bundle is megabytes; the honest-refusal stub is ~125
-// bytes. Anything under this floor is not a real implementation.
 export const REAL_IMPL_BUNDLE_FLOOR_BYTES = 200 * 1024;
 
 const requiredFiles = [
   'bin/linzumi.js',
-  'bin/remote-codex-harness-worker.js',
   'dist/index.js',
-  'dist/impl-ts/index.js',
-  'dist/impl-res/index.js',
+  'dist/remote-codex-harness-worker.js',
+  'dist/hosted-coding-account-worker.js',
+  'dist/cloud-supervisor.mjs',
+  'dist/crossHarnessFailover.mjs',
   'dist/mcp-server.mjs',
-  'dist/impl-ts/mcp-server.mjs',
-  'dist/impl-res/mcp-server.mjs',
-  'dist/impl-ts/crossHarnessFailover.mjs',
-  'dist/impl-res/crossHarnessFailover.mjs',
-  'dist/impl-ts/cloud-supervisor.mjs',
-  'dist/impl-res/cloud-supervisor.mjs',
+  'dist/topics-cli.mjs',
+  'dist/tcp-tunnel-cli.mjs',
+  'dist/native/darwin/preview-process-identity',
+  'dist/assets/linzumi-logo.svg',
 ];
-
-// Per-file real-bundle floors (Greptile P2): the co-located guest bundles
-// have honest-stub fallbacks in the build too (the F5 refusal stub is ~200
-// bytes; the real bridge is ~8 KB; the real cloud supervisor is ~93 KB), so
-// each gets a floor that distinguishes stub from real - a botched build must
-// red the publish, not ship a refusal stub to the fleet.
-export const GUEST_BUNDLE_FLOOR_BYTES = {
-  'dist/impl-ts/crossHarnessFailover.mjs': 2 * 1024,
-  'dist/impl-res/crossHarnessFailover.mjs': 2 * 1024,
-  'dist/impl-ts/cloud-supervisor.mjs': 20 * 1024,
-  'dist/impl-res/cloud-supervisor.mjs': 20 * 1024,
-  'dist/mcp-server.mjs': 100 * 1024,
-  'dist/impl-ts/mcp-server.mjs': 100 * 1024,
-  'dist/impl-res/mcp-server.mjs': 100 * 1024,
-};
+export const GUEST_BUNDLE_FLOOR_BYTES = {'dist/mcp-server.mjs': 100 * 1024, 'dist/crossHarnessFailover.mjs': 1024};
 
 function formatMb(bytes) {
   return `${Math.round((bytes / (1024 * 1024)) * 100) / 100} MB`;
@@ -89,17 +48,10 @@ export function evaluatePackedPackage(packReport) {
     }
   }
 
-  const chooserSize = files.get('dist/index.js') ?? 0;
-  if (chooserSize > CHOOSER_SIZE_LIMIT_BYTES) {
-    failures.push(
-      `dist/index.js (the chooser) is ${chooserSize} bytes > ${CHOOSER_SIZE_LIMIT_BYTES}: impl code must not leak into the chooser shim`
-    );
+  for (const path of files.keys()) {
+    if (/^dist\/impl-/.test(path)) failures.push(`obsolete implementation bundle: ${path}`);
   }
-
-  for (const implBundle of [
-    'dist/impl-ts/index.js',
-    'dist/impl-res/index.js',
-  ]) {
+  for (const implBundle of ['dist/index.js']) {
     const size = files.get(implBundle) ?? 0;
     if (size > 0 && size < REAL_IMPL_BUNDLE_FLOOR_BYTES) {
       failures.push(