@neta-art/cohub-cli 7.1.2 → 8.0.0

package/dist/commands/runtime.js

@@ -1,328 +1,204 @@
-import { spawn } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { stat } from "node:fs/promises";
-import { basename, resolve } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 import { createInterface } from "node:readline/promises";
-import { isLocalHarness, resolveCohubEnvironment, resolveWebsocketUrl } from "@neta-art/cohub";
-import { requireAccessToken } from "../auth.js";
 import { createClient } from "../client.js";
-import { error, json as outJson, jsonRequested } from "../output.js";
-import { currentIdentityKey, explicitSpace, resolveSpace } from "../space.js";
-import { canonicalRuntimeRoot, resolveRuntimeSpace } from "../runtime/space-binding.js";
-import { discoverHarnesses } from "../runtime/harness.js";
-import { serveRuntime } from "../runtime/connection.js";
+import { json as outJson, jsonRequested } from "../output.js";
+import { currentIdentityKey } from "../space.js";
+import { resolveRuntimeTarget, runtimeUp, parseRuntimeHarnesses } from "../runtime/launch.js";
+import { canonicalRuntimeRoot, getRuntimeSpaceBinding } from "../runtime/space-binding.js";
+import { installNativeSync } from "../runtime/native-install.js";
+import { listNativeSyncStores } from "../runtime/native-sync-store.js";
+import { requestRuntimeInstance, runtimeInstanceDirectory } from "../runtime/instance.js";
+import { atLeastLevel, diagnosticLevels, formatDiagnostic, printRuntimeSummary } from "../runtime/presentation.js";
 import { RuntimeSessionStore } from "../runtime/session-store.js";
-import { ensureSandboxdBinary } from "./sandboxd-binary.js";
-import { readRuntimeDiagnosticEvents, RuntimeDiagnosticReader, RuntimeDiagnostics, runtimeDiagnosticsDirectory, serializeDiagnosticError, } from "../runtime/diagnostics.js";
-export const resolveLocalSpaceName = (root, name) => name?.trim() || basename(root) || "local-space";
-function sandboxOutputLevel(value, stream) {
-    const level = typeof value === "string" ? value.toLowerCase() : "";
-    if (level.includes("error"))
-        return "error";
-    if (level.includes("warn"))
-        return "warn";
-    return stream === "stderr" ? "error" : "debug";
-}
-function captureSandboxOutput(stream, streamName, diagnostics) {
-    if (!stream)
-        return;
-    let pending = "";
-    const consume = (chunk) => {
-        pending += Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk);
-        let newline = pending.indexOf("\n");
-        while (newline >= 0) {
-            const line = pending.slice(0, newline).trim();
-            pending = pending.slice(newline + 1);
-            if (line)
-                recordSandboxOutput(line, streamName, diagnostics);
-            newline = pending.indexOf("\n");
-        }
-    };
-    stream.on("data", consume);
-    stream.on("end", () => {
-        if (pending.trim())
-            recordSandboxOutput(pending.trim(), streamName, diagnostics);
-    });
-}
-function recordSandboxOutput(line, streamName, diagnostics) {
-    let parsed = null;
-    try {
-        const value = JSON.parse(line);
-        if (value && typeof value === "object" && !Array.isArray(value))
-            parsed = value;
-    }
-    catch {
-        // Older or third-party binaries may still emit text logs.
-    }
-    const level = sandboxOutputLevel(parsed?.level, streamName);
-    const message = typeof parsed?.msg === "string" ? parsed.msg : line;
-    const data = parsed
-        ? Object.fromEntries(Object.entries(parsed).filter(([key]) => !["msg", "level", "time"].includes(key)))
-        : { message: line };
-    diagnostics.log(level, "sandboxd.log", {
-        stream: streamName,
-        message,
-        ...(level === "error" ? { error: { message } } : {}),
-        ...data,
-    }, { component: "sandboxd" });
-}
-function printDiagnostic(event) {
-    const scope = [event.component, event.event].filter(Boolean).join(".");
-    const context = [
-        event.connectionId && `connection=${event.connectionId}`,
-        event.sessionId && `session=${event.sessionId}`,
-        event.turnId && `turn=${event.turnId}`,
-        event.traceContext?.requestId && `request=${event.traceContext.requestId}`,
-        event.traceContext?.traceId && `trace=${event.traceContext.traceId}`,
-    ].filter(Boolean).join(" ");
-    const data = event.data && Object.keys(event.data).length > 0 ? ` ${JSON.stringify(event.data)}` : "";
-    process.stdout.write(`${event.timestamp} ${event.level.toUpperCase().padEnd(5)} ${scope}${context ? ` ${context}` : ""}${data}${event.error ? ` ${JSON.stringify(event.error)}` : ""}\n`);
-}
-export function parseRuntimeHarnesses(values) {
-    const names = values.flatMap((value) => value.split(",")).map((name) => name.trim()).filter(Boolean);
-    if (names.some((name) => !isLocalHarness(name)))
-        throw new Error("Harness must be pi or codex");
-    return [...new Set(names.length ? names : ["pi"])];
-}
+import { readRuntimeDiagnosticEvents, RuntimeDiagnosticReader, runtimeDiagnosticsDirectory, serializeDiagnosticError } from "../runtime/diagnostics.js";
+export { resolveLocalSpaceName, parseRuntimeHarnesses } from "../runtime/launch.js";
+const reportFailure = (cause) => {
+    process.stderr.write(`Runtime failed / Runtime 失败: ${serializeDiagnosticError(cause).message}\n`);
+    process.exitCode = 1;
+};
 export function registerRuntime(program) {
-    const runtime = program.command("runtime").description("Connect a local workspace");
+    const runtime = program.command("runtime").description("Connect a local workspace / 连接本地工作区");
     runtime.command("up [dir]")
-        .description("Connect local Harnesses and files")
-        .option("-s, --space <id>", "Target Space")
-        .option("-n, --name <name>", "New Space name")
-        .option("--harness <name>", "Pi or Codex; repeatable", (value, previous) => [...previous, value], [])
-        .option("--pi <path>", "Pi executable")
-        .option("--codex <path>", "Codex executable")
-        .option("-y, --yes", "Accept local execution access")
-        .option("--json", "JSON output")
+        .description("Connect local Harnesses and files / 连接本地 Harness 和文件")
+        .option("-s, --space <id>", "Target Space / 目标 Space")
+        .option("-n, --new", "Create a new Space / 创建新 Space")
+        .option("--name <name>", "New Space name / 新 Space 名称")
+        .option("-d, --detach", "Run in the background / 后台运行")
+        .option("--harness <name>", "Pi or Codex; repeatable / 可重复指定", (value, previous) => [...previous, value], [])
+        .option("--pi <path>", "Pi executable / Pi 可执行文件")
+        .option("--codex <path>", "Codex executable / Codex 可执行文件")
+        .option("-y, --yes", "Accept defaults and local execution / 接受默认选择并授权本地执行")
+        .option("--verbose", "Show diagnostic details / 显示诊断详情")
+        .option("--json", "JSON output / JSON 输出")
         .action(async (dir, options) => {
-        const controller = new AbortController();
-        const stop = () => controller.abort();
-        process.once("SIGINT", stop);
-        process.once("SIGTERM", stop);
         try {
-            const requestedRoot = resolve(dir ?? process.cwd());
-            if (!(await stat(requestedRoot)).isDirectory())
-                throw new Error("Workspace is not a directory");
-            const root = await canonicalRuntimeRoot(requestedRoot);
-            const harnesses = parseRuntimeHarnesses(options.harness);
-            if (!options.yes) {
-                if (!process.stdin.isTTY)
-                    throw new Error("Use --yes to authorize local execution");
-                const rl = createInterface({ input: process.stdin, output: process.stderr });
-                try {
-                    const answer = await rl.question(`Connect ${root}? Space collaborators can run commands as your OS user, beyond this folder. [y/N] `);
-                    if (!/^y(es)?$/i.test(answer.trim()))
-                        return;
-                }
-                finally {
-                    rl.close();
-                }
-            }
-            const capabilities = await discoverHarnesses(harnesses, options, root);
-            const client = createClient();
-            const requested = options.space?.trim() || explicitSpace(program);
-            const validateLocalRuntime = async (spaceId) => {
-                const sandbox = (await client.space(spaceId).sandbox.get()).sandbox;
-                if (sandbox?.provider !== "local")
-                    throw new Error("Space does not have a local Runtime");
-            };
-            const { spaceId } = await resolveRuntimeSpace({
-                root,
-                identityKey: currentIdentityKey(),
-                explicitSpaceId: requested,
-                createSpace: async () => (await client.spaces.create({
-                    name: resolveLocalSpaceName(root, options.name),
-                    config: { sandbox: { provider: "local" } },
-                })).space.id,
-                validateSpace: validateLocalRuntime,
-            });
-            const spaceClient = client.space(spaceId);
-            const store = new RuntimeSessionStore(spaceId, { projectionSource: spaceClient });
-            const runtimeId = randomUUID();
-            const diagnostics = new RuntimeDiagnostics({ root: store.root, spaceId, runtimeId });
-            store.setDiagnostics(diagnostics);
-            diagnostics.log("info", "runtime.cli_started", {
-                platform: process.platform,
-                arch: process.arch,
-                node: process.versions.node,
-                harnesses,
-                proxyConfigured: ["HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY"].some((key) => Boolean(process.env[key]?.trim())),
-            });
+            await runtimeUp(program, dir, { ...options, json: jsonRequested(options) });
+        }
+        catch (cause) {
+            reportFailure(cause);
+        }
+    });
+    for (const action of ["attach", "detach"])
+        runtime.command(action)
+            .description(action === "attach" ? "Sync native Pi / Codex Turns / 同步原生 Pi / Codex 对话" : "Pause native sync; retain all receipts / 暂停原生同步，保留所有回执")
+            .option("-s, --space <id>", "Target Space / 目标 Space")
+            .option("--harness <name>", "Pi or Codex; repeatable / 可重复指定", (value, previous) => [...previous, value], [])
+            .option("--pi <path>", "Pi executable for capability checks / 用于能力检查的 Pi 路径")
+            .option("--codex <path>", "Codex executable for capability checks / 用于能力检查的 Codex 路径")
+            .option("-y, --yes", "Authorize project conversation and native archive uploads / 授权上传项目对话及原生归档")
+            .option("--json", "JSON output / JSON 输出")
+            .action(async (options) => {
             try {
-                const binary = await ensureSandboxdBinary({
-                    onStatus: (message) => diagnostics.log("info", "sandboxd.download", { message }, { component: "sandboxd" }),
-                });
-                const wsBase = resolveWebsocketUrl({ url: process.env.COHUB_WS_URL });
-                const url = new URL(wsBase);
-                url.pathname = "/runtime/relay";
-                const relay = new URL(wsBase);
-                relay.pathname = "/sandbox/relay";
-                let bridge = null;
-                let bridgeClosed = Promise.resolve();
-                let announced = false;
-                const token = await requireAccessToken();
-                try {
-                    await serveRuntime({
-                        spaceId,
-                        cwd: root,
-                        url: url.toString(),
-                        capabilities,
-                        harnesses: options,
-                        runtimeId,
-                        diagnostics,
-                        token: requireAccessToken,
-                        signal: controller.signal,
-                        store,
-                        onReady: () => {
-                            if (!bridge) {
-                                bridge = spawn(binary, ["--local", "--space", spaceId, "--root", root, "--relay", process.env.COHUB_RELAY_URL?.trim() || relay.toString()], {
-                                    stdio: ["ignore", "pipe", "pipe"],
-                                    env: {
-                                        ...process.env,
-                                        COHUB_RELAY_TOKEN: token,
-                                        COHUB_RUNTIME_ID: runtimeId,
-                                        COHUB_LOG_FORMAT: "json",
-                                    },
-                                });
-                                captureSandboxOutput(bridge.stdout, "stdout", diagnostics);
-                                captureSandboxOutput(bridge.stderr, "stderr", diagnostics);
-                                bridgeClosed = new Promise((resolveClosed) => bridge?.once("close", () => resolveClosed()));
-                                bridge.on("error", (cause) => {
-                                    diagnostics.log("error", "sandboxd.process_error", { error: serializeDiagnosticError(cause) }, { component: "sandboxd" });
-                                    console.error(cause);
-                                    controller.abort();
-                                });
-                                bridge.once("exit", (code, signal) => {
-                                    diagnostics.log(code === 0 ? "info" : "error", "sandboxd.process_exit", { code, signal }, { component: "sandboxd" });
-                                    controller.abort();
-                                });
-                            }
-                            if (announced)
-                                return;
-                            announced = true;
-                            const webUrl = `${resolveCohubEnvironment() === "prod" ? "https://cohub.live" : "https://dev.cohub.live"}/spaces/${spaceId}`;
-                            if (jsonRequested(options))
-                                outJson({ spaceId, root, harnesses, runtimeId, diagnosticsPath: diagnostics.logPath, url: webUrl });
-                            else
-                                console.error(`Runtime connected: ${webUrl} (runtimeId=${runtimeId}, logs=${diagnostics.logPath})`);
-                        },
-                    });
-                }
-                finally {
-                    if (bridge) {
-                        const child = bridge;
-                        child.kill("SIGTERM");
-                        const timeout = setTimeout(() => child.kill("SIGKILL"), 3000);
-                        await bridgeClosed;
-                        clearTimeout(timeout);
+                const spaceId = await resolveRuntimeTarget(program, options.space);
+                const identity = currentIdentityKey();
+                if (!identity)
+                    throw new Error("Sign in first / 请先登录");
+                const root = await canonicalRuntimeRoot(process.cwd());
+                if (action === "attach" && (await getRuntimeSpaceBinding(root, identity))?.spaceId !== spaceId)
+                    throw new Error("Bind this directory with runtime up --space first / 请先使用 runtime up --space 绑定当前目录");
+                const instance = await requestRuntimeInstance(runtimeInstanceDirectory(identity, spaceId));
+                if (action === "attach" && (!instance || instance.root !== root))
+                    throw new Error("Start this directory's Runtime first: cohub runtime up -d / 请先启动当前目录的 Runtime");
+                if (action === "attach" && !instance?.nativeSync)
+                    throw new Error("Restart the Runtime with this CLI before attaching / 请先使用新版 CLI 重启 Runtime，再接入原生客户端");
+                const harnesses = parseRuntimeHarnesses(options.harness.length ? options.harness : instance?.harnesses ?? ["pi", "codex"]);
+                if (action === "attach" && harnesses.some((harness) => !instance?.harnesses.includes(harness)))
+                    throw new Error("Enable these Harnesses with runtime up first / 请先通过 runtime up 启用对应 Harness");
+                if (action === "attach" && !options.yes) {
+                    if (!process.stdin.isTTY)
+                        throw new Error("Use --yes to authorize native sync / 请使用 --yes 授权原生同步");
+                    const rl = createInterface({ input: process.stdin, output: process.stderr });
+                    try {
+                        const answer = await rl.question(`Install user-level ${harnesses.join(" / ")} integration and upload this project's opened conversations, tool output and raw archives to this Space? History may contain secrets. [y/N]\n安装用户级原生集成，并将当前项目打开的对话、工具输出和原始归档上传至此 Space？历史可能包含敏感信息。[y/N] `);
+                        if (!/^y(es)?$/i.test(answer.trim()))
+                            return;
+                    }
+                    finally {
+                        rl.close();
                     }
                 }
+                const result = await installNativeSync({ root, spaceId, identity, harnesses, disabled: action === "detach", executables: { pi: options.pi, codex: options.codex } });
+                if (jsonRequested(options))
+                    outJson(result);
+                else
+                    process.stdout.write(action === "attach"
+                        ? `Native sync enabled. Reload Pi or restart Codex and review its hook trust prompt. / 原生同步已启用。请重载 Pi 或重启 Codex，并审核 Hook 信任提示。\n${result.configPath}\n`
+                        : "Native sync paused; all local records retained / 原生同步已暂停，所有本地记录已保留\n");
             }
             catch (cause) {
-                diagnostics.log("error", "runtime.start_failed", { error: serializeDiagnosticError(cause) });
-                throw cause;
+                reportFailure(cause);
             }
-            finally {
-                await diagnostics.close().catch((error) => console.error("Runtime diagnostics close failed:", error));
+        });
+    runtime.command("status").description("Local and server status / 本地与服务端状态")
+        .option("-s, --space <id>", "Target Space / 目标 Space")
+        .option("--json", "JSON output / JSON 输出")
+        .action(async (options) => {
+        try {
+            const spaceId = await resolveRuntimeTarget(program, options.space);
+            const identity = currentIdentityKey();
+            const local = identity ? await requestRuntimeInstance(runtimeInstanceDirectory(identity, spaceId)) : null;
+            const space = createClient().space(spaceId);
+            const store = new RuntimeSessionStore(spaceId, { projectionSource: space });
+            const [remote, pendingLocalArchives, failedLocalArchives, nativeStores] = await Promise.all([
+                space.getRuntime(undefined, { signal: AbortSignal.timeout(5000) }).then((value) => ({ value, error: null })).catch((error) => ({ value: null, error: serializeDiagnosticError(error).message })),
+                store.archives.pendingCount(), store.archives.failedCaptureCount(),
+                identity ? listNativeSyncStores(store.root, spaceId, identity) : [],
+            ]);
+            const nativeSessions = await Promise.all(nativeStores.map((native) => native.status()));
+            const result = { ...remote.value, spaceId, local, remote: remote.value, remoteError: remote.error, diagnosticsPath: runtimeDiagnosticsDirectory(store.root), pendingLocalArchives, failedLocalArchives, nativeSessions };
+            if (jsonRequested(options))
+                outJson(result);
+            else {
+                if (local)
+                    printRuntimeSummary(local);
+                else
+                    process.stdout.write(`Local process / 本地进程  Not running / 未运行\nSpace / 空间  ${spaceId}\nLogs / 日志  ${result.diagnosticsPath}\n`);
+                process.stdout.write(`Server / 服务端  ${remote.error ? `Unknown / 未知 — ${remote.error}` : remote.value?.online ? "Harness connected / Harness 已连接" : "Offline / 离线"}\nArchives / 归档  ${pendingLocalArchives} pending / 待同步 · ${failedLocalArchives} failed / 失败\n`);
+                if (nativeSessions.length)
+                    process.stdout.write(`Native chats / 原生对话  ${nativeSessions.length} · ${nativeSessions.reduce((sum, session) => sum + session.pendingTurns, 0)} Turns pending / Turn 待同步 · ${nativeSessions.reduce((sum, session) => sum + session.pendingArchives, 0)} archives pending / 归档待同步\n`);
             }
         }
         catch (cause) {
-            if (!controller.signal.aborted)
-                error("Runtime failed", cause instanceof Error ? cause.message : String(cause));
+            reportFailure(cause);
         }
-        finally {
-            process.removeListener("SIGINT", stop);
-            process.removeListener("SIGTERM", stop);
-        }
-    });
-    runtime.command("status").description("Runtime status").option("-s, --space <id>", "Target Space").action(async (options) => {
-        const spaceId = options.space?.trim() || await resolveSpace(program);
-        const client = createClient();
-        const spaceClient = client.space(spaceId);
-        const store = new RuntimeSessionStore(spaceId, { projectionSource: spaceClient });
-        const [status, pendingLocalArchives, failedLocalArchives] = await Promise.all([
-            spaceClient.getRuntime(),
-            store.archives.pendingCount(),
-            store.archives.failedCaptureCount(),
-        ]);
-        outJson({
-            ...status,
-            diagnosticsPath: runtimeDiagnosticsDirectory(store.root),
-            pendingLocalArchives,
-            failedLocalArchives,
-        });
     });
-    runtime.command("logs")
-        .description("Read local Runtime diagnostics")
-        .option("-s, --space <id>", "Target Space")
-        .option("-l, --limit <count>", "Number of events", "100")
-        .option("--follow", "Keep watching for new events")
-        .option("--json", "Print raw diagnostic events")
+    runtime.command("down").description("Stop this local Runtime; retain all data / 停止本地 Runtime，保留所有数据")
+        .option("-s, --space <id>", "Target Space / 目标 Space")
+        .option("-y, --yes", "Stop even with unconfirmed executions / 确认停止包含未确认执行的 Runtime")
+        .option("--json", "JSON output / JSON 输出")
         .action(async (options) => {
-        const spaceId = options.space?.trim() || await resolveSpace(program);
-        const store = new RuntimeSessionStore(spaceId, { projectionSource: createClient().space(spaceId) });
-        const limit = Number(options.limit ?? "100");
-        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 10_000)
-            return error("Invalid diagnostic limit", "Use an integer between 1 and 10000 / 使用 1 到 10000 之间的整数");
-        const asJson = jsonRequested(options);
-        const reader = options.follow ? new RuntimeDiagnosticReader(store.root) : null;
-        const render = async () => {
-            const fresh = options.follow
-                ? await reader?.read({ limit }) ?? []
-                : await readRuntimeDiagnosticEvents(store.root, { limit });
-            if (options.follow && fresh.length === 0)
-                return;
-            if (asJson && options.follow) {
-                for (const event of fresh)
-                    process.stdout.write(`${JSON.stringify(event)}\n`);
-            }
-            else if (asJson) {
-                outJson(fresh);
-            }
-            else if (fresh.length === 0) {
-                process.stdout.write("No Runtime diagnostics / 未找到 Runtime 诊断记录\n");
-            }
-            else {
-                for (const event of fresh)
-                    printDiagnostic(event);
+        try {
+            const spaceId = await resolveRuntimeTarget(program, options.space);
+            const identity = currentIdentityKey();
+            if (!identity)
+                throw new Error("Sign in to the Runtime account / 请登录 Runtime 所属账号");
+            const directory = runtimeInstanceDirectory(identity, spaceId);
+            const local = await requestRuntimeInstance(directory, "stop", Boolean(options.yes));
+            const until = Date.now() + 15_000;
+            let running = Boolean(local);
+            while (running && Date.now() < until) {
+                await delay(250);
+                try {
+                    running = Boolean(await requestRuntimeInstance(directory));
+                }
+                catch {
+                    running = true;
+                } // An unreachable control socket does not prove the process stopped.
             }
-        };
+            if (running)
+                throw new Error("Runtime is still stopping; inspect logs / Runtime 仍在停止，请检查日志");
+            if (jsonRequested(options))
+                outJson({ spaceId, stopped: true });
+            else
+                process.stdout.write("Runtime stopped; data retained / Runtime 已停止，数据已保留\n");
+        }
+        catch (cause) {
+            reportFailure(cause);
+        }
+    });
+    runtime.command("logs").description("Read local Runtime diagnostics / 查看本地 Runtime 日志")
+        .option("-s, --space <id>", "Target Space / 目标 Space")
+        .option("-l, --limit <count>", "Number of events / 事件数量", "100")
+        .option("--level <level>", "Minimum level: debug, info, warn, error / 最低级别", "info")
+        .option("-f, --follow", "Keep watching / 持续查看")
+        .option("--json", "Raw diagnostic events / 原始诊断事件")
+        .action(async (options) => {
+        const controller = new AbortController();
+        const stop = () => controller.abort();
         try {
-            await render();
-            if (!options.follow)
-                return;
-            await new Promise((resolve) => {
-                let timer = null;
-                let stopped = false;
-                const stop = () => {
-                    stopped = true;
-                    if (timer)
-                        clearTimeout(timer);
-                    process.removeListener("SIGINT", stop);
-                    process.removeListener("SIGTERM", stop);
-                    resolve();
-                };
-                const poll = async () => {
-                    if (stopped)
-                        return;
-                    try {
-                        await render();
-                    }
-                    catch {
-                        stop();
-                        return;
-                    }
-                    if (!stopped)
-                        timer = setTimeout(() => void poll(), 2_000);
-                };
-                timer = setTimeout(() => void poll(), 2_000);
-                process.once("SIGINT", stop);
-                process.once("SIGTERM", stop);
-            });
+            const spaceId = await resolveRuntimeTarget(program, options.space);
+            const store = new RuntimeSessionStore(spaceId, { projectionSource: createClient().space(spaceId) });
+            const limit = Number(options.limit);
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 10_000)
+                throw new Error("Use a limit from 1 to 10000 / 数量范围为 1 到 10000");
+            if (!diagnosticLevels.includes(options.level))
+                throw new Error("Use debug, info, warn or error / 请使用有效日志级别");
+            const asJson = jsonRequested(options);
+            const reader = new RuntimeDiagnosticReader(store.root);
+            process.once("SIGINT", stop);
+            process.once("SIGTERM", stop);
+            do {
+                const events = (options.follow ? await reader.read({ limit }) : await readRuntimeDiagnosticEvents(store.root, { limit }))
+                    .filter((event) => atLeastLevel(event.level, options.level));
+                if (asJson && !options.follow)
+                    outJson(events);
+                else
+                    for (const event of events)
+                        process.stdout.write(asJson ? `${JSON.stringify(event)}\n` : formatDiagnostic(event, true));
+                if (!options.follow) {
+                    if (!asJson && !events.length)
+                        process.stdout.write("No matching diagnostics / 未找到匹配日志\n");
+                    break;
+                }
+                await delay(1000, undefined, { signal: controller.signal }).catch(() => undefined);
+            } while (!controller.signal.aborted);
         }
         catch (cause) {
-            error("Runtime logs failed", cause instanceof Error ? cause.message : String(cause));
+            reportFailure(cause);
+        }
+        finally {
+            process.removeListener("SIGINT", stop);
+            process.removeListener("SIGTERM", stop);
         }
     });
 }

package/dist/commands/sandboxd-binary.d.ts

@@ -1,4 +1,4 @@
-export declare const SANDBOXD_VERSION = "v2.53.1";
+export declare const SANDBOXD_VERSION = "v2.54.0";
 export declare class SandboxdDownloadError extends Error {
     name: string;
 }

package/dist/commands/sandboxd-binary.js

@@ -15,11 +15,13 @@ import { Readable } from "node:stream";
 // that tag's publish-cdn job has succeeded, otherwise `runtime up` 404s on the
 // default download.
 //
-// v2.53.1 is the first published tag with the native FSEvents file-monitoring
-// backends and the `runtimeId` control frame (earlier `v2.52.0` predates them,
-// and the old sandbox-only `v1.x` line stopped at `v1.82.4`). Running anything
-// older keeps exhausting file descriptors on macOS.
-export const SANDBOXD_VERSION = "v2.53.1";
+// v2.54.0 is the first published tag with the private managed Runtime control
+// pipe (`COHUB_RUNTIME_MANAGED` over fd 3), so `runtime up` reads connection
+// state from the daemon instead of polling the API every five seconds. It also
+// carries the optional workspace-search runner download. v2.53.1 already has
+// the native FSEvents backends and the `runtimeId` control frame, and older
+// releases stay usable through the compatibility readiness/restart path.
+export const SANDBOXD_VERSION = "v2.54.0";
 const BINARY_NAME = "cohub-sandboxd";
 // Public CDN prefix hosting the release archives (the repo is private, so the
 // GitHub Release assets are not publicly downloadable). Overridable for staging

package/dist/runtime/archive-store.d.ts

@@ -38,6 +38,8 @@ export declare class RuntimeArchiveStore {
         harness: "pi" | "codex";
         nativeSessionId: string;
         path: string;
+        sizeBytes?: number;
+        expectedChecksum?: string;
     }, turnId: string): Promise<HarnessArchive>;
     private capture;
     flush(signal: AbortSignal): Promise<void>;

package/dist/runtime/archive-store.js

@@ -115,6 +115,8 @@ export class RuntimeArchiveStore {
         if (saved) {
             if (saved.sessionId !== state.sessionId || saved.harness !== state.harness)
                 throw new Error("Archive identity mismatch");
+            if (state.expectedChecksum && state.expectedChecksum !== saved.sha256)
+                throw new Error("Native Turn bytes changed; original archive retained");
             const committed = await stat(join(this.root, "ready", `${turnId}.json`)).catch((error) => { if (missing(error))
                 return null; throw error; });
             if (!committed)
@@ -130,12 +132,15 @@ export class RuntimeArchiveStore {
             const before = await file.stat();
             if (!before.isFile() || !before.size)
                 throw new Error("Native archive is empty");
+            const sizeBytes = state.sizeBytes ?? before.size;
+            if (!Number.isSafeInteger(sizeBytes) || sizeBytes < 1 || sizeBytes > before.size)
+                throw new Error("Native archive boundary is unavailable");
             const buffer = Buffer.alloc(RUNTIME_ARCHIVE_SEGMENT_BYTES);
             let offset = 0;
             let digest = createHash("sha256");
             let parent = null;
             // Hash the old prefix, not just its size: equal-size and growing rewrites are valid.
-            if (previous && previous.nativeSessionId === state.nativeSessionId && previous.sizeBytes <= before.size) {
+            if (previous && previous.nativeSessionId === state.nativeSessionId && previous.sizeBytes <= sizeBytes) {
                 while (offset < previous.sizeBytes) {
                     const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, previous.sizeBytes - offset), offset);
                     if (!bytesRead)
@@ -152,8 +157,8 @@ export class RuntimeArchiveStore {
             }
             const segments = [];
             await mkdir(join(this.root, "objects"), { recursive: true, mode: 0o700 });
-            while (offset < before.size) {
-                const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, before.size - offset), offset);
+            while (offset < sizeBytes) {
+                const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, sizeBytes - offset), offset);
                 if (!bytesRead)
                     throw new Error("Native file changed during capture");
                 const bytes = buffer.subarray(0, bytesRead);
@@ -164,8 +169,16 @@ export class RuntimeArchiveStore {
                 offset += bytesRead;
             }
             const after = await stat(state.path);
-            if (before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs)
+            if (before.ino !== after.ino || after.size < sizeBytes || state.sizeBytes === undefined && (before.size !== after.size || before.mtimeMs !== after.mtimeMs))
                 throw new Error("Native file changed during capture");
+            if (state.sizeBytes !== undefined) {
+                // Native clients may append while an earlier Turn is captured. Validate the exact prefix twice.
+                const verified = createHash("sha256");
+                for await (const bytes of createReadStream(state.path, { end: sizeBytes - 1 }))
+                    verified.update(bytes);
+                if (verified.digest("hex") !== digest.copy().digest("hex"))
+                    throw new Error("Native prefix changed during capture");
+            }
             if (process.platform !== "win32") {
                 const directory = await open(join(this.root, "objects"), "r");
                 try {
@@ -177,8 +190,10 @@ export class RuntimeArchiveStore {
             }
             index = harnessArchiveIndexSchema.parse({ ...identity, version: 1, nativeSessionId: state.nativeSessionId,
                 nativeFormat: state.harness === "pi" ? "pi.jsonl" : "codex.rollout", parentTurnId: parent?.turnId ?? null,
-                sizeBytes: before.size, sha256: digest.digest("hex"), segments });
+                sizeBytes, sha256: digest.digest("hex"), segments });
             validateArchiveBoundary(index, parent);
+            if (state.expectedChecksum && index.sha256 !== state.expectedChecksum)
+                throw new Error("Native Turn bytes changed during capture; original retained");
         }
         finally {
             await file.close();
@@ -254,7 +269,6 @@ export class RuntimeArchiveStore {
             catch (error) {
                 if (!signal.aborted) {
                     this.errorReporter?.(error, index);
-                    console.error("Archive pending; native segments retained:", error);
                 }
             }
         }