@linzumi/cli 1.0.94 → 1.0.96

package/dist/mcp-server.mjs

@@ -145,7 +145,7 @@ ${o}
     </main>
   </body>
 </html>`}function cl(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;")}function ST(e){return e.replace(/[&^|<>()%"]/g,t=>`^${t}`)}function $T(e){let t=process.platform==="darwin"?"open":process.platform==="win32"?"cmd":"xdg-open",r=process.platform==="win32"?["/c","start","",ST(e)]:[e];return new Promise(n=>{il("process.spawn",{command:t,args:r,purpose:"oauth.open_browser"});let o=lT(t,r,{stdio:"ignore",detached:!0});il("process.spawned",{command:t,args:r,pid:o.pid,purpose:"oauth.open_browser"}),o.on("error",()=>n()),o.on("spawn",()=>{o.unref(),n()})})}function Fy(){return jT(ET(),".linzumi","auth.json")}function xi(e,t=Fy()){if(!dl(t))return;let r=pl(ll(t,"utf8")),n=Ve(e),o=r.local_codex_runner?.[n];if(!(o===void 0||o.access_token.trim()==="")&&!(o.expires_at!==void 0&&Date.parse(o.expires_at)<=Date.now()))return{accessToken:o.access_token,kandanBaseUrl:n,issuedAt:o.issued_at,expiresAt:o.expires_at}}function Vy(e){if(!dl(e))throw new Error(`missing personal-agent delegation auth file: ${e}`);let r=pl(ll(e,"utf8")).personal_agent_delegation;if(r===void 0||r.access_token.trim()==="")throw new Error("personal-agent delegation auth file is missing access_token");if(r.expires_at!==void 0&&Date.parse(r.expires_at)<=Date.now())throw new Error("personal-agent delegation auth file token is expired");return{accessToken:r.access_token,issuedAt:r.issued_at,expiresAt:r.expires_at}}function By(e){let t=e.authFilePath??Fy(),r=dl(t)?pl(ll(t,"utf8")):{version:1},n=Ve(e.kandanUrl),o=new Date,s=e.expiresInSeconds===void 0?void 0:new Date(o.getTime()+e.expiresInSeconds*1e3).toISOString(),i={...r,version:1,local_codex_runner:{...r.local_codex_runner??{},[n]:{access_token:e.accessToken,issued_at:o.toISOString(),expires_at:s}}};PT(OT(t),{recursive:!0});let a=`${t}.tmp.${process.pid}.${zT(6).toString("hex")}`;try{IT(a,`${JSON.stringify(i,null,2)}
-`,"utf8"),TT(a,t)}catch(c){try{RT(a,{force:!0})}catch{}throw c}return{accessToken:e.accessToken,kandanBaseUrl:n,issuedAt:o.toISOString(),expiresAt:s}}function pl(e){let t=JSON.parse(e);if(typeof t!="object"||t===null||Array.isArray(t))throw new Error("Kandan auth cache must contain a JSON object");let r=t,n=r.local_codex_runner,o=r.personal_agent_delegation;if(n!==void 0&&(typeof n!="object"||n===null||Array.isArray(n)))throw new Error("Kandan auth cache local_codex_runner must be an object");if(o!==void 0&&(typeof o!="object"||o===null||Array.isArray(o)))throw new Error("Kandan auth cache personal_agent_delegation must be an object");return{version:1,local_codex_runner:AT(n),personal_agent_delegation:CT(o)}}function CT(e){if(typeof e!="object"||e===null||Array.isArray(e))return;let t=e.access_token,r=e.issued_at,n=e.expires_at;if(!(typeof t!="string"||typeof r!="string"))return{access_token:t,issued_at:r,expires_at:typeof n=="string"?n:void 0}}function AT(e){if(!(typeof e!="object"||e===null||Array.isArray(e)))return Object.fromEntries(Object.entries(e).flatMap(([t,r])=>{if(typeof r!="object"||r===null||Array.isArray(r))return[];let n=r.access_token,o=r.issued_at,s=r.expires_at;return typeof n!="string"||typeof o!="string"?[]:[[t,{access_token:n,issued_at:o,expires_at:typeof s=="string"?s:void 0}]]}))}var MT=3,NT=3600*1e3,LT=5e3,DT=5e3,ZT=6e4;function UT(e){return e.cycle<=MT?"prompt":e.lastLoudPromptAtMs===void 0||e.nowMs-e.lastLoudPromptAtMs>=NT?"summary":e.isInteractive?"refresh_line":"silent"}function qT(e){switch(e.kind){case"prompt":return`${e.cycle===1?"":`The previous code expired; here is a fresh one (no restart needed - this prompt stays alive).
+`,{encoding:"utf8",mode:384}),TT(a,t)}catch(c){try{RT(a,{force:!0})}catch{}throw c}return{accessToken:e.accessToken,kandanBaseUrl:n,issuedAt:o.toISOString(),expiresAt:s}}function pl(e){let t=JSON.parse(e);if(typeof t!="object"||t===null||Array.isArray(t))throw new Error("Kandan auth cache must contain a JSON object");let r=t,n=r.local_codex_runner,o=r.personal_agent_delegation;if(n!==void 0&&(typeof n!="object"||n===null||Array.isArray(n)))throw new Error("Kandan auth cache local_codex_runner must be an object");if(o!==void 0&&(typeof o!="object"||o===null||Array.isArray(o)))throw new Error("Kandan auth cache personal_agent_delegation must be an object");return{version:1,local_codex_runner:AT(n),personal_agent_delegation:CT(o)}}function CT(e){if(typeof e!="object"||e===null||Array.isArray(e))return;let t=e.access_token,r=e.issued_at,n=e.expires_at;if(!(typeof t!="string"||typeof r!="string"))return{access_token:t,issued_at:r,expires_at:typeof n=="string"?n:void 0}}function AT(e){if(!(typeof e!="object"||e===null||Array.isArray(e)))return Object.fromEntries(Object.entries(e).flatMap(([t,r])=>{if(typeof r!="object"||r===null||Array.isArray(r))return[];let n=r.access_token,o=r.issued_at,s=r.expires_at;return typeof n!="string"||typeof o!="string"?[]:[[t,{access_token:n,issued_at:o,expires_at:typeof s=="string"?s:void 0}]]}))}var MT=3,NT=3600*1e3,LT=5e3,DT=5e3,ZT=6e4;function UT(e){return e.cycle<=MT?"prompt":e.lastLoudPromptAtMs===void 0||e.nowMs-e.lastLoudPromptAtMs>=NT?"summary":e.isInteractive?"refresh_line":"silent"}function qT(e){switch(e.kind){case"prompt":return`${e.cycle===1?"":`The previous code expired; here is a fresh one (no restart needed - this prompt stays alive).
 `}Authorize this computer:
 Code: ${e.userCode}
 Open: ${e.verificationUri}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linzumi/cli",
-  "version": "1.0.94",
+  "version": "1.0.96",
   "description": "Linzumi CLI \u2014 point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.",
   "type": "module",
   "bin": {

package/scripts/build-config-identity-parity-oracle.mjs

@@ -0,0 +1,520 @@
+// Spec: kandan/plans/2026-07-10-compute-nodes-rescript-commander-zero-ts-program.md
+// (M3 cluster 2, config-identity).
+// Relationship: Builds the TS-side PARITY ORACLE for the config/identity
+// cluster of the ReScript commander port, the sibling of
+// build-protocol-parity-oracle.mjs (cluster 1). The oracle bundles the REAL
+// TS config/identity modules (localConfig.ts, machineFingerprint.ts,
+// machineFingerprintV2.ts, authCache.ts, the cursor-store exports of
+// runner.ts, controlQuarantine.ts's state-file stem, updateNudge.ts's
+// restart-attempt store) behind a one-shot batch driver: a JSON array of
+// cases on stdin, a JSON array of results on stdout. The ReScript package's
+// ConfigIdentityParityConformance drives the SAME inputs through the ported
+// modules in its own scratch directories and asserts
+// accept/reject/normalized-output equivalence AND byte-identical file
+// output - the cross-impl round-trip contract that lets both commanders
+// share ~/.linzumi through M4.
+//
+// Determinism: every source of nondeterminism is pinned per case - id
+// creators are injected constants, timestamps come from a fixed `nowMs`
+// (writeLocalSignupAuth's injectable `now`; a scoped global-Date override
+// for authCache, whose issuedAt is not injectable), and scratch paths are
+// normalized through the "$DIR" placeholder in both directions.
+//
+// SECRETS: the oracle only ever sees the conformance suite's synthetic
+// tokens; nothing here logs case payloads.
+//
+// Like the cluster 1 oracle, the output is a local test artifact
+// (.differential/ is gitignored, never published) and stays unminified for
+// debuggability.
+import { copyFile, mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+const driverSource = `
+import {
+  mkdtempSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, relative } from 'node:path';
+import {
+  addAllowedCwd,
+  addAllowedCwdForLinzumiUrl,
+  ensureLocalMachineId,
+  ensureLocalMachineIdForLinzumiUrl,
+  ensureLocalRunnerId,
+  ensureLocalRunnerIdForLinzumiUrl,
+  localMachineIdSeedPath,
+  localRunnerIdSeedPath,
+  readConfiguredAllowedCwdDetails,
+  readConfiguredAllowedCwdDetailsForLinzumiUrl,
+  readLocalConfig,
+  readLocalConfigForLinzumiUrl,
+  readLocalSignupAuth,
+  removeAllowedCwd,
+  removeAllowedCwdForLinzumiUrl,
+  replaceAllowedCwdsForLinzumiUrl,
+  writeLocalConfig,
+  writeLocalSignupAuth,
+  writeLocalSignupCompletion,
+} from './src/localConfig';
+import {
+  rawStableMachineIdentifier,
+  stableMachineFingerprint,
+  stableMachineId,
+} from './src/machineFingerprint';
+import {
+  machineFingerprintV2HelloFields,
+  rawOsUsername,
+  stableMachineFingerprintV2,
+} from './src/machineFingerprintV2';
+import {
+  readCachedLocalRunnerToken,
+  readPersonalAgentDelegationToken,
+  writeCachedLocalRunnerToken,
+} from './src/authCache';
+import {
+  createControlCursorFileStore,
+  createRunnerControlEpochStore,
+} from './src/runner';
+import { runnerStateFileStem } from './src/controlQuarantine';
+import { fileRestartAttemptStore } from './src/updateNudge';
+
+// --- Placeholder + snapshot plumbing --------------------------------------------
+
+const dirPlaceholder = '$DIR';
+
+function scratch() {
+  // realpath so macOS /var -> /private/var never splits the two impls'
+  // placeholder substitution.
+  return realpathSync(mkdtempSync(join(tmpdir(), 'linzumi-config-identity-oracle-')));
+}
+
+function substitute(value, from, to) {
+  if (typeof value === 'string') {
+    return value.split(from).join(to);
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => substitute(entry, from, to));
+  }
+  if (typeof value === 'object' && value !== null) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [
+        substitute(key, from, to),
+        substitute(entry, from, to),
+      ])
+    );
+  }
+  return value;
+}
+
+function snapshotFiles(dir) {
+  const files = {};
+  const walk = (current) => {
+    for (const name of readdirSync(current).sort()) {
+      const full = join(current, name);
+      if (statSync(full).isDirectory()) {
+        walk(full);
+      } else {
+        files[relative(dir, full)] = readFileSync(full, 'utf8');
+      }
+    }
+  };
+  walk(dir);
+  return files;
+}
+
+function outcome(run) {
+  try {
+    const value = run();
+    return value === undefined ? { defined: false } : { defined: true, value };
+  } catch (error) {
+    return {
+      threw: true,
+      message: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+const RealDate = Date;
+
+function withFixedNow(nowMs, run) {
+  if (nowMs === undefined) {
+    return run();
+  }
+  class FixedDate extends RealDate {
+    constructor(...args) {
+      if (args.length === 0) {
+        super(nowMs);
+      } else {
+        super(...args);
+      }
+    }
+    static now() {
+      return nowMs;
+    }
+  }
+  globalThis.Date = FixedDate;
+  try {
+    return run();
+  } finally {
+    globalThis.Date = RealDate;
+  }
+}
+
+// --- Config lifecycle ------------------------------------------------------------
+
+function runConfigAction(action, dir, configPath) {
+  switch (action.fn) {
+    case 'mkdir':
+      // Setup helper (not a ported function): void the created-path return
+      // so both impls report the same undefined outcome.
+      return outcome(() => {
+        mkdirSync(action.path, { recursive: true });
+      });
+    case 'writeFile':
+      return outcome(() => writeFileSync(action.path, action.contents, 'utf8'));
+    case 'ensureLocalMachineId':
+      return outcome(() =>
+        ensureLocalMachineId(configPath, () => action.machineId)
+      );
+    case 'ensureLocalMachineIdForLinzumiUrl':
+      return outcome(() =>
+        ensureLocalMachineIdForLinzumiUrl(
+          action.linzumiUrl,
+          configPath,
+          () => action.machineId
+        )
+      );
+    case 'ensureLocalRunnerId':
+      return outcome(() =>
+        ensureLocalRunnerId(configPath, () => action.runnerId)
+      );
+    case 'ensureLocalRunnerIdForLinzumiUrl':
+      return outcome(() =>
+        ensureLocalRunnerIdForLinzumiUrl(
+          action.linzumiUrl,
+          configPath,
+          () => action.runnerId
+        )
+      );
+    case 'machineIdSeedPath':
+      return outcome(() => localMachineIdSeedPath(configPath, action.linzumiUrl));
+    case 'runnerIdSeedPath':
+      return outcome(() => localRunnerIdSeedPath(configPath, action.linzumiUrl));
+    case 'writeLocalConfig':
+      return outcome(() => writeLocalConfig(action.config, configPath));
+    case 'addAllowedCwd':
+      return outcome(() => addAllowedCwd(action.pathValue, configPath));
+    case 'addAllowedCwdForLinzumiUrl':
+      return outcome(() =>
+        addAllowedCwdForLinzumiUrl(action.pathValue, action.linzumiUrl, configPath)
+      );
+    case 'removeAllowedCwd':
+      return outcome(() => removeAllowedCwd(action.pathValue, configPath));
+    case 'removeAllowedCwdForLinzumiUrl':
+      return outcome(() =>
+        removeAllowedCwdForLinzumiUrl(action.pathValue, action.linzumiUrl, configPath)
+      );
+    case 'replaceAllowedCwdsForLinzumiUrl':
+      return outcome(() =>
+        replaceAllowedCwdsForLinzumiUrl(action.pathValues, action.linzumiUrl, configPath)
+      );
+    case 'readLocalConfig':
+      return outcome(() => readLocalConfig(configPath));
+    case 'readLocalConfigForLinzumiUrl':
+      return outcome(() => readLocalConfigForLinzumiUrl(action.linzumiUrl, configPath));
+    case 'readConfiguredAllowedCwdDetails':
+      return outcome(() => readConfiguredAllowedCwdDetails(configPath));
+    case 'readConfiguredAllowedCwdDetailsForLinzumiUrl':
+      return outcome(() =>
+        readConfiguredAllowedCwdDetailsForLinzumiUrl(action.linzumiUrl, configPath)
+      );
+    case 'readLocalSignupAuth':
+      return outcome(() => readLocalSignupAuth(configPath));
+    case 'writeLocalSignupAuth':
+      return outcome(() =>
+        writeLocalSignupAuth(
+          {
+            ...action.auth,
+            now: action.auth.nowMs === undefined ? undefined : new RealDate(action.auth.nowMs),
+          },
+          configPath
+        )
+      );
+    case 'writeLocalSignupCompletion':
+      return outcome(() =>
+        writeLocalSignupCompletion(
+          {
+            ...action.completion,
+            now:
+              action.completion.nowMs === undefined
+                ? undefined
+                : new RealDate(action.completion.nowMs),
+          },
+          configPath
+        )
+      );
+    default:
+      return { threw: true, message: 'unknown config action ' + String(action.fn) };
+  }
+}
+
+function handleConfigLifecycle(testCase) {
+  const dir = scratch();
+  const configPath = join(dir, 'config.json');
+  const actions = substitute(testCase.actions, dirPlaceholder, dir);
+  const results = actions.map((action) => runConfigAction(action, dir, configPath));
+  return substitute({ results, files: snapshotFiles(dir) }, dir, dirPlaceholder);
+}
+
+// --- Auth lifecycle ----------------------------------------------------------------
+
+function runAuthAction(action, authFilePath) {
+  switch (action.fn) {
+    case 'writeFile':
+      return outcome(() => writeFileSync(authFilePath, action.contents, 'utf8'));
+    case 'writeCachedLocalRunnerToken':
+      return outcome(() =>
+        writeCachedLocalRunnerToken({
+          kandanUrl: action.kandanUrl,
+          accessToken: action.accessToken,
+          expiresInSeconds: action.expiresInSeconds,
+          authFilePath,
+        })
+      );
+    case 'readCachedLocalRunnerToken':
+      return outcome(() => readCachedLocalRunnerToken(action.kandanUrl, authFilePath));
+    case 'readPersonalAgentDelegationToken':
+      return outcome(() => readPersonalAgentDelegationToken(authFilePath));
+    default:
+      return { threw: true, message: 'unknown auth action ' + String(action.fn) };
+  }
+}
+
+function handleAuthLifecycle(testCase) {
+  const dir = scratch();
+  const authFilePath = join(dir, 'auth.json');
+  const actions = substitute(testCase.actions, dirPlaceholder, dir);
+  const results = actions.map((action) =>
+    withFixedNow(testCase.nowMs, () => runAuthAction(action, authFilePath))
+  );
+  return substitute({ results, files: snapshotFiles(dir) }, dir, dirPlaceholder);
+}
+
+// --- Fingerprint probes ---------------------------------------------------------------
+
+function handleFingerprint(testCase) {
+  const spec = testCase.probes ?? {};
+  const probes = {
+    ...(spec.platform === undefined ? {} : { platform: spec.platform }),
+    execFile: () => {
+      if (spec.execFileOutput === undefined) {
+        throw new Error('execFile probe failed');
+      }
+      return spec.execFileOutput;
+    },
+    readFile: (path) => {
+      const contents = (spec.readFiles ?? {})[path];
+      if (contents === undefined) {
+        throw new Error('readFile probe failed: ' + path);
+      }
+      return contents;
+    },
+    username: () => {
+      if (spec.username === undefined) {
+        throw new Error('username probe failed');
+      }
+      return spec.username;
+    },
+  };
+  return {
+    raw: outcome(() => rawStableMachineIdentifier(probes)),
+    v1: outcome(() => stableMachineFingerprint(probes)),
+    machineId: outcome(() => stableMachineId(probes)),
+    rawUsername: outcome(() => rawOsUsername(probes)),
+    v2: outcome(() => stableMachineFingerprintV2(probes)),
+    helloFields: outcome(() =>
+      machineFingerprintV2HelloFields(stableMachineFingerprintV2(probes))
+    ),
+  };
+}
+
+// --- Cursor store ------------------------------------------------------------------------
+
+function collectingLog(events, dir) {
+  return (event, payload) => {
+    events.push({ event, payload: substitute(payload, dir, dirPlaceholder) });
+  };
+}
+
+function runStoreAction(store, action) {
+  switch (action.fn) {
+    case 'initial':
+      return outcome(() => store.initial(action.topic));
+    case 'onAdvance':
+      return outcome(() => store.onAdvance(action.topic, action.seq));
+    case 'reset':
+      return outcome(() => store.reset(action.topic, action.seq));
+    case 'adoptEpoch':
+      return outcome(() => store.adoptEpoch(action.epoch));
+    case 'epoch':
+      return outcome(() => store.epoch());
+    case 'flush':
+      return outcome(() => store.flush());
+    default:
+      return { threw: true, message: 'unknown store action ' + String(action.fn) };
+  }
+}
+
+function readFileOrNull(path) {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+function handleCursorStore(testCase) {
+  const dir = scratch();
+  const path = join(dir, 'store.json');
+  if (testCase.initialContents !== undefined) {
+    writeFileSync(path, testCase.initialContents, 'utf8');
+  }
+  const events = [];
+  const store = createControlCursorFileStore(path, collectingLog(events, dir), {
+    ...(testCase.discardSeqsOnFirstEpochAdoption === undefined
+      ? {}
+      : { discardSeqsOnFirstEpochAdoption: testCase.discardSeqsOnFirstEpochAdoption }),
+    ...(testCase.fsyncOnWrite === undefined
+      ? {}
+      : { fsyncOnWrite: testCase.fsyncOnWrite }),
+  });
+  const results = (testCase.actions ?? []).map((action) => runStoreAction(store, action));
+  store.flush();
+  return { results, fileBytes: readFileOrNull(path), events };
+}
+
+function handleEpochStore(testCase) {
+  const dir = scratch();
+  const cursorPath = join(dir, 'cursor.json');
+  const startTurnPath = join(dir, 'start-turn.json');
+  if (testCase.cursorContents !== undefined) {
+    writeFileSync(cursorPath, testCase.cursorContents, 'utf8');
+  }
+  if (testCase.startTurnContents !== undefined) {
+    writeFileSync(startTurnPath, testCase.startTurnContents, 'utf8');
+  }
+  const events = [];
+  const log = collectingLog(events, dir);
+  const cursorStore = createControlCursorFileStore(cursorPath, log);
+  const startTurnStore = createControlCursorFileStore(startTurnPath, log, {
+    discardSeqsOnFirstEpochAdoption: true,
+  });
+  const epochStore = createRunnerControlEpochStore(cursorStore, startTurnStore, log, {
+    runnerId: testCase.runnerId,
+    kandanUrl: testCase.kandanUrl,
+  });
+  const initialEpoch = outcome(() => epochStore.current());
+  const adoptResults = (testCase.adopts ?? []).map((adopt) =>
+    outcome(() => epochStore.adopt(adopt.topic, adopt.epoch))
+  );
+  cursorStore.flush();
+  startTurnStore.flush();
+  return {
+    initialEpoch,
+    adoptResults,
+    cursorBytes: readFileOrNull(cursorPath),
+    startTurnBytes: readFileOrNull(startTurnPath),
+    events,
+  };
+}
+
+// --- Restart-attempt store -----------------------------------------------------------------
+
+function handleRestartAttemptStore(testCase) {
+  const dir = scratch();
+  const path = join(dir, 'attempt.json');
+  if (testCase.initialContents !== undefined) {
+    writeFileSync(path, testCase.initialContents, 'utf8');
+  }
+  const store = fileRestartAttemptStore(path);
+  const loaded = outcome(() => store.load());
+  let saved = { defined: false };
+  if (testCase.record !== undefined) {
+    saved = outcome(() => store.save(testCase.record));
+  }
+  return { loaded, saved, fileBytes: readFileOrNull(path) };
+}
+
+// --- Dispatch --------------------------------------------------------------------------------
+
+function handle(testCase) {
+  switch (testCase.op) {
+    case 'configLifecycle':
+      return handleConfigLifecycle(testCase);
+    case 'authLifecycle':
+      return handleAuthLifecycle(testCase);
+    case 'fingerprint':
+      return handleFingerprint(testCase);
+    case 'cursorStore':
+      return handleCursorStore(testCase);
+    case 'epochStore':
+      return handleEpochStore(testCase);
+    case 'stateFileStem':
+      return outcome(() => runnerStateFileStem(testCase.runnerId));
+    case 'restartAttemptStore':
+      return handleRestartAttemptStore(testCase);
+    default:
+      return { threw: true, message: 'unknown op ' + String(testCase.op) };
+  }
+}
+
+let stdin = '';
+process.stdin.setEncoding('utf8');
+for await (const chunk of process.stdin) {
+  stdin += chunk;
+}
+const cases = JSON.parse(stdin);
+process.stdout.write(JSON.stringify(cases.map(handle)));
+`;
+
+await mkdir(join(packageRoot, '.differential'), { recursive: true });
+
+// runner.ts's graph resolves assets/ relative to the bundle at import time
+// (same requirement as build-differential-entry.mjs).
+await mkdir(join(packageRoot, '.differential/assets'), { recursive: true });
+await copyFile(
+  join(packageRoot, 'src/assets/linzumi-logo.svg'),
+  join(packageRoot, '.differential/assets/linzumi-logo.svg')
+);
+
+await build({
+  stdin: {
+    contents: driverSource,
+    resolveDir: packageRoot,
+    sourcefile: 'config-identity-parity-driver.ts',
+    loader: 'ts',
+  },
+  bundle: true,
+  platform: 'node',
+  target: 'node20',
+  format: 'esm',
+  outfile: join(packageRoot, '.differential/config-identity-parity-oracle.mjs'),
+  minify: false,
+  sourcemap: false,
+  legalComments: 'none',
+  // runner.ts pulls the wider commander graph; the same runtime externals
+  // as the differential entry build stay external (they are installed in
+  // this package's node_modules, and the oracle only exercises the
+  // config/identity exports).
+  external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
+});