@sovovs/bycli 1.8.0 → 2.0.0

package/dist/src/config-paths.js

@@ -0,0 +1,31 @@
+import * as os from 'node:os';
+import * as path from 'node:path';
+/**
+ * Resolvers for the byCLI user-data root and its well-known subdirectories.
+ *
+ * The root is `BYCLI_CONFIG_DIR` when set, else `~/.bycli`. These are FUNCTIONS,
+ * not module-level constants, on purpose: `BYCLI_CONFIG_DIR` is set dynamically
+ * (tests, the verify child sandbox in runner-port.ts) — a const captured at import
+ * time would freeze the wrong root and leak across tests. Always resolve on call.
+ *
+ * Existing duplicate idioms this consolidates: observation/artifact.ts, browser/profile.ts.
+ */
+export function getConfigDir() {
+    return process.env.BYCLI_CONFIG_DIR || path.join(os.homedir(), '.bycli');
+}
+/** User adapter root: `$CONFIG_DIR/clis`. Adapters live at `<clis>/<site>/<command>.js`. */
+export function getUserClisDir() {
+    return path.join(getConfigDir(), 'clis');
+}
+/** Per-site memory/recorder root: `$CONFIG_DIR/sites`. */
+export function getSitesDir() {
+    return path.join(getConfigDir(), 'sites');
+}
+/** A single site's directory: `$CONFIG_DIR/sites/<site>`. */
+export function getSiteDir(site) {
+    return path.join(getSitesDir(), site);
+}
+/** A site's recorder artifact dir: `$CONFIG_DIR/sites/<site>/recorder`. */
+export function getSiteRecorderDir(site) {
+    return path.join(getSiteDir(site), 'recorder');
+}

package/dist/src/daemon.js

@@ -26,9 +26,34 @@ import { EXIT_CODES } from './errors.js';
 import { log } from './logger.js';
 import { PKG_VERSION } from './version.js';
 import { DEFAULT_CONTEXT_ID } from './browser/profile.js';
+import { createAdapterDraft, saveAdapterSource, recoverInitTransactions } from './recorder/highlevel/init.js';
+import { verifyAdapter } from './recorder/highlevel/verify.js';
+import { defaultRunnerPort, setDefaultRunnerDaemonPort, setDefaultRunnerObservability, setDefaultRunnerTempGuard } from './recorder/runner/runner-port.js';
+import { createMetrics } from '@sovovs/bycli-recorder-core';
+import { createRecorderLogger } from './recorder/observability/logger.js';
+import { reapOrphanedVerifyRuns } from './recorder/runner/reap.js';
+import { resolveTempPolicy, resolveRunnerConfig, resolveTempCapacity } from './recorder/runner/config.js';
+import { defaultSessionKeyRegistry } from './recorder/runner/session-keys.js';
 import { recordExtensionVersion } from './update-check.js';
 import { buildCommandDispatchFailure, buildExtensionDisconnectFailure, getResponseCorsHeaders, } from './daemon-utils.js';
 const PORT = parseInt(process.env.BYCLI_DAEMON_PORT ?? String(DEFAULT_DAEMON_PORT), 10);
+// The verify runner (M6b) spawns child processes that connect back to THIS daemon for a
+// browser Page. Hand them our port (→ BYCLI_DAEMON_PORT in the child env) so the child's
+// Page reaches us, not a freshly-spawned daemon. Must run before the first /v1/verify
+// builds the default runner singleton.
+setDefaultRunnerDaemonPort(PORT);
+// ─── Observability (#1b · 09) ────────────────────────────────────────
+// daemon/runner-side structured logs + metrics (M8 only did dashboard-be). The metrics instance is
+// a process singleton, shared by reference into the runner port (#1c) so GET /metrics shows runner
+// counters too. LOG_LEVEL is read once at startup — the daemon has no ConfigPort, so no hot reload
+// here (that's a larger, separate milestone); a malformed value falls back to 'info'.
+const LOG_LEVELS = ['error', 'warn', 'info', 'debug'];
+const envLogLevel = process.env.LOG_LEVEL ?? '';
+const metrics = createMetrics();
+const logger = createRecorderLogger(LOG_LEVELS.includes(envLogLevel) ? envLogLevel : 'info');
+// Share these singletons with the verify runner (#1c) BEFORE the first defaultRunnerPort() use, so
+// runner counters surface on GET /metrics and runner logs share the daemon's level.
+setDefaultRunnerObservability(metrics, logger);
 const extensionProfiles = new Map();
 const pending = new Map();
 let commandResultUnknownCount = 0;
@@ -119,6 +144,7 @@ function unregisterExtensionConnection(ws) {
             });
             if (failure.countAsCommandResultUnknown) {
                 commandResultUnknownCount++;
+                metrics.inc('daemon_command_result_unknown_total'); // #1b: structured metric alongside the /status field
                 log.warn(`[daemon] Command result unknown after extension disconnect (id=${id}, action=${p.action}, context=${contextId})`);
             }
             p.reject(new DaemonCommandFailure(failure.message, failure.errorCode, failure.errorHint, failure.status));
@@ -150,6 +176,11 @@ function readBody(req) {
     });
 }
 function jsonResponse(res, status, data, extraHeaders) {
+    // Stash any errorCode for the request-completion metrics choke point (#1b), so handlers don't
+    // each have to wire it through. Only the bounded ErrorCode enum reaches a label/log field.
+    const ec = data?.errorCode;
+    if (typeof ec === 'string')
+        res.__errorCode = ec;
     res.writeHead(status, { 'Content-Type': 'application/json', ...extraHeaders });
     res.end(JSON.stringify(data));
 }
@@ -174,6 +205,32 @@ async function handleRequest(req, res) {
     }
     const url = req.url ?? '/';
     const pathname = url.split('?')[0];
+    // Request-completion metrics choke point (#1b · 09): one place records type/status/errorCode +
+    // latency, no per-handler scatter. Only the high-level surface (/v1/*) and the /command bridge are
+    // counted; the dynamic /v1/requests/{id} segment collapses to a bounded route template so the
+    // `operation` label can't grow unboundedly. /v1/* operations also get a structured log line
+    // (low volume, the recording ops); /command is counted but not logged (per-command WS bridge is
+    // high volume). Never logs headers/token/body — only operation/status/errorCode/durationMs.
+    const reqStarted = Date.now();
+    res.on('finish', () => {
+        let operation = null;
+        if (pathname.startsWith('/v1/requests/'))
+            operation = 'v1.requests';
+        else if (pathname.startsWith('/v1/'))
+            operation = `v1${pathname.slice(3).replace(/\//g, '.')}`; // /v1/init → v1.init
+        else if (pathname === '/command')
+            operation = 'command';
+        if (!operation)
+            return;
+        const status = res.statusCode < 400 ? 'ok' : 'failed';
+        const errorCode = res.__errorCode;
+        const durationMs = Date.now() - reqStarted;
+        metrics.inc('daemon_requests_total', { operation, status, errorCode });
+        if (operation === 'v1.verify')
+            metrics.observe('daemon_verify_duration_ms', durationMs);
+        if (operation.startsWith('v1'))
+            logger.info(`daemon.${operation}`, { status, errorCode, durationMs });
+    });
     // Health-check endpoint — no X-byCLI header required.
     // Used by the extension to silently probe daemon reachability before
     // attempting a WebSocket connection (avoids uncatchable ERR_CONNECTION_REFUSED).
@@ -193,6 +250,102 @@ async function handleRequest(req, res) {
         jsonResponse(res, 403, { ok: false, error: 'Forbidden: missing X-byCLI header' });
         return;
     }
+    // High-level init (M5b · A'): daemon hosts the FS-writing init capability; the
+    // logic lives in the main-repo init module (createAdapterDraft). dashboard-be
+    // forwards here rather than writing main-repo adapter paths itself. Synchronous
+    // (init is a short FS op, not a long-running runner); requestId/async is deferred.
+    if (req.method === 'POST' && pathname === '/v1/init') {
+        try {
+            const body = JSON.parse(await readBody(req));
+            if (typeof body.name !== 'string' || !body.name) {
+                jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: 'name required' });
+                return;
+            }
+            const result = createAdapterDraft(body);
+            if (!result.ok) {
+                // init failures are all client-fixable 400s (validation_failed / responsible_use_required).
+                jsonResponse(res, 400, { ok: false, errorCode: result.errorCode, error: result.reason });
+                return;
+            }
+            jsonResponse(res, 200, { ok: true, data: { report: result.report, dryRun: result.dryRun, generatedSource: result.generatedSource } });
+        }
+        catch (err) {
+            jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: err instanceof Error ? err.message : String(err) });
+        }
+        return;
+    }
+    // N4: save a reviewed, full LLM-generated adapter source to clis/ (verify-then-save flow).
+    if (req.method === 'POST' && pathname === '/v1/save-adapter') {
+        try {
+            const body = JSON.parse(await readBody(req));
+            if (typeof body.name !== 'string' || !body.name || typeof body.source !== 'string' || !body.source) {
+                jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: 'name and source required' });
+                return;
+            }
+            const result = saveAdapterSource(body);
+            if (!result.ok) {
+                jsonResponse(res, 400, { ok: false, errorCode: result.errorCode, error: result.reason });
+                return;
+            }
+            jsonResponse(res, 200, { ok: true, data: { adapterPath: result.adapterPath, reportPath: result.reportPath } });
+        }
+        catch (err) {
+            jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: err instanceof Error ? err.message : String(err) });
+        }
+        return;
+    }
+    // High-level verify (A'): interface + delegation seam. The adapter JS runs in the
+    // M6 child-process runner (08) — verifyAdapter delegates to the real spawn-based
+    // RunnerPort (defaultRunnerPort), so runner_protocol_error now signals an actual
+    // runner fault, not "not implemented". The evidence HMAC is keyed by a per-session salt
+    // held only in daemon memory (M7a · 04:111): be forwards the non-secret sessionId, the
+    // daemon mints + holds the salt, and it never crosses the wire.
+    if (req.method === 'POST' && pathname === '/v1/verify') {
+        try {
+            const body = JSON.parse(await readBody(req));
+            if (typeof body.name !== 'string' || !body.name) {
+                jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: 'name required' });
+                return;
+            }
+            const sessionHmacKey = defaultSessionKeyRegistry().keyFor(body.sessionId);
+            const result = await verifyAdapter(body, sessionHmacKey);
+            if (!result.ok) {
+                const status = result.errorCode === 'validation_failed' ? 400
+                    : result.errorCode === 'queue_full' ? 429 // 03: queue/concurrency exceeded
+                        : 500;
+                // requestId/sessionId correlation the choke point (res-only) can't see (09:89).
+                logger.warn('daemon.verify', { sessionId: body.sessionId, status: 'failed', errorCode: result.errorCode });
+                jsonResponse(res, status, { ok: false, errorCode: result.errorCode, error: result.reason });
+                return;
+            }
+            logger.info('daemon.verify', { requestId: result.requestId, sessionId: body.sessionId, stage: 'accepted' });
+            jsonResponse(res, 200, { ok: true, data: { requestId: result.requestId } });
+        }
+        catch (err) {
+            jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: err instanceof Error ? err.message : String(err) });
+        }
+        return;
+    }
+    // High-level request status (M6 · ADR-0007): be polls verify status here. The runner
+    // registry is keyed by the canonical requestId (be ↔ daemon ↔ runner share one id);
+    // returns summary-only VerifySummary (raw seed/stdout/stderr/trace path never included).
+    if (req.method === 'GET' && pathname.startsWith('/v1/requests/')) {
+        const requestId = decodeURIComponent(pathname.slice('/v1/requests/'.length));
+        if (!requestId) {
+            jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: 'requestId required' });
+            return;
+        }
+        const runStatus = defaultRunnerPort().getRunStatus(requestId);
+        if (!runStatus) {
+            jsonResponse(res, 404, { ok: false, errorCode: 'request_not_found', error: 'unknown requestId' });
+            return;
+        }
+        // RunStatus (queued|running|succeeded|failed|timeout|cancelled) maps 1:1 to request status;
+        // summary is null while queued/running, a VerifySummary once terminal (M6c adds queued).
+        logger.debug('daemon.requests', { requestId, status: runStatus.status });
+        jsonResponse(res, 200, { ok: true, data: { requestId, status: runStatus.status, result: runStatus.summary } });
+        return;
+    }
     if (req.method === 'GET' && pathname === '/status') {
         const uptime = process.uptime();
         const mem = process.memoryUsage();
@@ -226,6 +379,13 @@ async function handleRequest(req, res) {
         });
         return;
     }
+    // Metrics scrape (#1b · 09): loopback diagnostic, same X-byCLI posture as /status (no token).
+    // The counter/histogram registry is pure data in recorder-core; this endpoint (http-bound) stays
+    // in the daemon transport layer. Values are non-sensitive enums/counts only (09).
+    if (req.method === 'GET' && pathname === '/metrics') {
+        jsonResponse(res, 200, { ok: true, ...metrics.snapshot() });
+        return;
+    }
     if (req.method === 'GET' && pathname === '/logs') {
         const params = new URL(url, `http://localhost:${PORT}`).searchParams;
         const level = params.get('level');
@@ -411,6 +571,86 @@ wss.on('connection', (ws) => {
 // ─── Start ───────────────────────────────────────────────────────────
 httpServer.listen(PORT, '127.0.0.1', () => {
     log.info(`[daemon] Listening on http://127.0.0.1:${PORT}`);
+    // Temp-store reap policy (M7b · 09:27-29). Resolved once at startup; out-of-range env → throws,
+    // but we keep the daemon alive by falling back to the (validated-elsewhere) defaults on error.
+    let tempPolicy;
+    try {
+        tempPolicy = resolveTempPolicy();
+    }
+    catch (err) {
+        log.warn(`[daemon] temp policy config invalid, using defaults: ${err instanceof Error ? err.message : String(err)}`);
+        tempPolicy = { tempTtlMs: 3_600_000, startupReapMaxAgeMs: 86_400_000, orphanKillGraceMs: 1_500 };
+    }
+    // Age-reap safety floor (08 / M7b): a verify cannot legitimately outlive timeoutMs + killGraceMs,
+    // so the age threshold must never drop below it — otherwise a short RECORDER_TEMP_TTL_MS (min 60s)
+    // would let the sweep kill a still-running verify (timeoutMs reaches 600s). Fall back to the
+    // absolute config ceiling (max timeoutMs + max killGraceMs) if runner config is unreadable.
+    let minLeakAgeMs = 600_000 + 30_000;
+    try {
+        const rc = resolveRunnerConfig();
+        minLeakAgeMs = rc.timeoutMs + rc.killGraceMs;
+    }
+    catch { /* keep the absolute ceiling (safest, highest floor) */ }
+    // #1d temp-store capacity guard: the runner refuses a new verify (temp_store_full) past the high
+    // watermark rather than risk filling the disk. Resolved at startup (temp root is restart-only,
+    // 09:182); bad env falls back to defaults (consistent with temp policy above). Registered BEFORE the
+    // first defaultRunnerPort() use (no request is served until after this listen callback returns). The
+    // on-pressure sweep reuses the same age-bounded reap as the periodic sweep (never kills a live verify).
+    let tempCapacity;
+    try {
+        tempCapacity = resolveTempCapacity();
+    }
+    catch (err) {
+        log.warn(`[daemon] temp capacity config invalid, using defaults: ${err instanceof Error ? err.message : String(err)}`);
+        tempCapacity = resolveTempCapacity({}); // empty env → validated defaults
+    }
+    setDefaultRunnerTempGuard(tempCapacity, () => {
+        reapOrphanedVerifyRuns({ log: (m) => log.info(m), maxAgeMs: tempPolicy.tempTtlMs, minLeakAgeMs, graceMs: tempPolicy.orphanKillGraceMs });
+    });
+    // Startup reap (08:37): clean up verify temp dirs orphaned by a previously-crashed daemon
+    // (ownerPid-dead), plus any dir older than the startup age backstop (M7b leak sweep). A live
+    // sibling's in-flight verify (young + owner alive, or within the hard-deadline floor) is never touched.
+    try {
+        const r = reapOrphanedVerifyRuns({ log: (m) => log.info(m), maxAgeMs: tempPolicy.startupReapMaxAgeMs, minLeakAgeMs, graceMs: tempPolicy.orphanKillGraceMs });
+        // #1c · 09 startup reap count (orphan runners killed, temp dirs swept)
+        if (r.orphans)
+            metrics.inc('startup_reap_orphans_total', undefined, r.orphans);
+        if (r.killed)
+            metrics.inc('startup_reap_killed_total', undefined, r.killed);
+        if (r.deleted)
+            metrics.inc('startup_reap_deleted_total', undefined, r.deleted);
+    }
+    catch (err) {
+        log.warn(`[daemon] verify startup reap failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // Periodic TTL sweep (M7b): while the daemon runs, reap dirs older than the temp TTL — but never
+    // below the run hard-deadline floor (minLeakAgeMs), so an aggressive TTL can't kill a live verify.
+    // Unref'd so it never keeps the process alive on its own.
+    const sweep = setInterval(() => {
+        try {
+            const r = reapOrphanedVerifyRuns({ log: (m) => log.info(m), maxAgeMs: tempPolicy.tempTtlMs, minLeakAgeMs, graceMs: tempPolicy.orphanKillGraceMs });
+            if (r.killed)
+                metrics.inc('temp_sweep_killed_total', undefined, r.killed);
+            if (r.deleted)
+                metrics.inc('temp_sweep_deleted_total', undefined, r.deleted);
+            // Drop salts for abandoned sessions (M7a TTL backstop; daemon restart already rotates all).
+            const dropped = defaultSessionKeyRegistry().sweepExpired();
+            if (dropped)
+                metrics.inc('session_keys_dropped_total', undefined, dropped);
+        }
+        catch (err) {
+            log.warn(`[daemon] verify temp sweep failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }, tempPolicy.tempTtlMs);
+    sweep.unref?.();
+    // Init write-transaction crash recovery (07:106-117): resolve any adapter draft interrupted
+    // mid-write by a previous crash (roll-forward marker / quarantine unprovenanced / roll back).
+    try {
+        recoverInitTransactions({ log: (m) => log.info(m) });
+    }
+    catch (err) {
+        log.warn(`[daemon] init startup recovery failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
 });
 httpServer.on('error', (err) => {
     if (err.code === 'EADDRINUSE') {

package/dist/src/discovery.d.ts

@@ -7,11 +7,13 @@
  *    when their command is executed.
  * 2. FALLBACK (filesystem scan): Traditional runtime discovery for development.
  */
-/** User runtime directory: ~/.bycli */
+/** User runtime directory: BYCLI_CONFIG_DIR or ~/.bycli.
+ * Resolved once at module load; the entry process fixes BYCLI_CONFIG_DIR before import. */
 export declare const USER_BYCLI_DIR: string;
-/** User CLIs directory: ~/.bycli/clis */
+/** User CLIs directory: <config>/clis */
 export declare const USER_CLIS_DIR: string;
-/** Plugins directory: ~/.bycli/plugins/ */
+/** Plugins directory: <config>/plugins/ (plugins are out of scope for the clis/sites
+ * relocation; kept as a const that many plugin.ts/tests consumers rely on). */
 export declare const PLUGINS_DIR: string;
 /**
  * Ensure ~/.bycli/node_modules/@sovovs/bycli symlink exists so that

package/dist/src/discovery.js

@@ -8,18 +8,20 @@
  * 2. FALLBACK (filesystem scan): Traditional runtime discovery for development.
  */
 import * as fs from 'node:fs';
-import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { Strategy, registerCommand } from './registry.js';
 import { getErrorMessage } from './errors.js';
 import { log } from './logger.js';
 import { findPackageRoot, getCliManifestPath } from './package-paths.js';
-/** User runtime directory: ~/.bycli */
-export const USER_BYCLI_DIR = path.join(os.homedir(), '.bycli');
-/** User CLIs directory: ~/.bycli/clis */
-export const USER_CLIS_DIR = path.join(USER_BYCLI_DIR, 'clis');
-/** Plugins directory: ~/.bycli/plugins/ */
+import { getConfigDir, getUserClisDir } from './config-paths.js';
+/** User runtime directory: BYCLI_CONFIG_DIR or ~/.bycli.
+ * Resolved once at module load; the entry process fixes BYCLI_CONFIG_DIR before import. */
+export const USER_BYCLI_DIR = getConfigDir();
+/** User CLIs directory: <config>/clis */
+export const USER_CLIS_DIR = getUserClisDir();
+/** Plugins directory: <config>/plugins/ (plugins are out of scope for the clis/sites
+ * relocation; kept as a const that many plugin.ts/tests consumers rely on). */
 export const PLUGINS_DIR = path.join(USER_BYCLI_DIR, 'plugins');
 /** Matches files that register commands via cli() or lifecycle hooks */
 const PLUGIN_MODULE_PATTERN = /\b(?:cli|onStartup|onBeforeExecute|onAfterExecute)\s*\(/;

package/dist/src/execution.js

@@ -13,7 +13,8 @@ import { getRegistry, fullName, } from './registry.js';
 import { pathToFileURL } from 'node:url';
 import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
-import * as os from 'node:os';
+import * as path from 'node:path';
+import { getUserClisDir } from './config-paths.js';
 import { executePipeline } from './pipeline/index.js';
 import { adapterLoadError, ArgumentError, CommandExecutionError, attachTraceReceipt, getErrorMessage } from './errors.js';
 import { shouldUseBrowserSession } from './capabilityRouting.js';
@@ -28,7 +29,11 @@ import { resolveAdapterSourcePath } from './adapter-source.js';
 const _loadedModules = new Map();
 /** Track mtime of loaded user adapter files for hot-reload in daemon mode. */
 const _moduleMtimes = new Map();
-const _userClisDir = `${os.homedir()}/.bycli/clis/`;
+/** User adapter dir with a trailing separator, so `startsWith` can't match a sibling
+ * like `clis-foo`. Resolved per-call (config-paths.ts rationale) — no import-time freeze. */
+function userClisPrefix() {
+    return getUserClisDir() + path.sep;
+}
 function normalizeTraceMode(raw) {
     if (raw === undefined || raw === null || raw === '' || raw === 'off')
         return 'off';
@@ -83,7 +88,7 @@ async function runCommand(cmd, page, kwargs, debug) {
     if (internal._lazy && internal._modulePath) {
         const modulePath = internal._modulePath;
         // Hot-reload: if a user adapter's file has changed on disk, invalidate cache
-        const isUserAdapter = modulePath.startsWith(_userClisDir);
+        const isUserAdapter = modulePath.startsWith(userClisPrefix());
         if (isUserAdapter && _loadedModules.has(modulePath)) {
             try {
                 const stat = fs.statSync(modulePath);

package/dist/src/main.js

@@ -13,8 +13,8 @@ if (process.platform !== 'win32') {
     process.env.PATH = [...cur].join(':');
 }
 import * as fs from 'node:fs';
-import * as os from 'node:os';
 import * as path from 'node:path';
+import { getUserClisDir } from './config-paths.js';
 import { fileURLToPath } from 'node:url';
 import { getCompletionsFromManifest, hasAllManifests, printCompletionScriptFast } from './completion-fast.js';
 import { findPackageRoot, getCliManifestPath } from './package-paths.js';
@@ -26,7 +26,7 @@ const __dirname = path.dirname(__filename);
 // Adapters are JS-first and live at <package-root>/clis/.
 // Use findPackageRoot so the path works both in dev (src/main.ts) and prod (dist/src/main.js).
 const BUILTIN_CLIS = path.join(findPackageRoot(__filename), 'clis');
-const USER_CLIS = path.join(os.homedir(), '.bycli', 'clis');
+const USER_CLIS = getUserClisDir();
 // ── Ultra-fast path: lightweight commands bypass full discovery ──────────
 // These are high-frequency or trivial paths that must not pay the startup tax.
 const argv = process.argv.slice(2);
@@ -52,6 +52,22 @@ if (argv[0] === 'completion' && argv.length >= 2) {
     }
     // Unknown shell — fall through to full path for proper error handling
 }
+// Fast path: internal verify-runner — the child process spawned by the verify RunnerPort
+// (08). It loads ONLY the target adapter (by path, from input.json) and emits JSONL; it must
+// never run full adapter discovery, and its stdout must stay pure JSONL.
+if (argv[0] === 'internal' && argv[1] === 'verify-runner') {
+    const { runVerifyRunnerCli } = await import('./recorder/runner/verify-runner-main.js');
+    await runVerifyRunnerCli(argv.slice(2));
+    process.exit(process.exitCode ?? EXIT_CODES.SUCCESS);
+}
+// Fast path: internal highlevel-http — the OPTIONAL standalone High-Level HTTP wrapper (M9,
+// 07 · Optional HTTP Wrapper). Default off; opt-in only via this command. Binds 127.0.0.1 and
+// keeps running, so it must skip full adapter discovery. Distinct from the daemon /v1/* family.
+if (argv[0] === 'internal' && argv[1] === 'highlevel-http') {
+    const { runWrapperCli } = await import('./recorder/http/wrapper-server.js');
+    await runWrapperCli(); // blocks while the server is alive; resolves on close (SIGTERM/SIGINT)
+    process.exit(process.exitCode ?? EXIT_CODES.SUCCESS); // never fall through to CLI discovery
+}
 // Fast path: --get-completions — read from manifest, skip discovery
 const getCompIdx = process.argv.indexOf('--get-completions');
 if (getCompIdx !== -1) {

package/dist/src/plugin.js

@@ -1013,13 +1013,16 @@ function getPluginSource(dir) {
 }
 /** Parse a plugin source string into clone URL, repo name, and optional sub-plugin. */
 function parseSource(source) {
+    // Strip either the legacy `bycli-plugin-` or the current `opencli-plugin-`
+    // repo-name prefix when deriving the local plugin name.
+    const PLUGIN_NAME_PREFIX = /^(?:bycli|opencli)-plugin-/;
     if (source.startsWith('file://')) {
         try {
             const localPath = path.resolve(fileURLToPath(source));
             return {
                 type: 'local',
                 localPath,
-                name: path.basename(localPath).replace(/^bycli-plugin-/, ''),
+                name: path.basename(localPath).replace(PLUGIN_NAME_PREFIX, ''),
             };
         }
         catch {
@@ -1031,14 +1034,14 @@ function parseSource(source) {
         return {
             type: 'local',
             localPath,
-            name: path.basename(localPath).replace(/^bycli-plugin-/, ''),
+            name: path.basename(localPath).replace(PLUGIN_NAME_PREFIX, ''),
         };
     }
     // github:user/repo/subplugin  (monorepo specific sub-plugin)
     const githubSubMatch = source.match(/^github:([\w.-]+)\/([\w.-]+)\/([\w.-]+)$/);
     if (githubSubMatch) {
         const [, user, repo, sub] = githubSubMatch;
-        const name = repo.replace(/^bycli-plugin-/, '');
+        const name = repo.replace(PLUGIN_NAME_PREFIX, '');
         return {
             type: 'git',
             cloneUrl: `https://github.com/${user}/${repo}.git`,
@@ -1050,7 +1053,7 @@ function parseSource(source) {
     const githubMatch = source.match(/^github:([\w.-]+)\/([\w.-]+)$/);
     if (githubMatch) {
         const [, user, repo] = githubMatch;
-        const name = repo.replace(/^bycli-plugin-/, '');
+        const name = repo.replace(PLUGIN_NAME_PREFIX, '');
         return {
             type: 'git',
             cloneUrl: `https://github.com/${user}/${repo}.git`,
@@ -1061,7 +1064,7 @@ function parseSource(source) {
     const urlMatch = source.match(/^https?:\/\/github\.com\/([\w.-]+)\/([\w.-]+?)(?:\.git)?$/);
     if (urlMatch) {
         const [, user, repo] = urlMatch;
-        const name = repo.replace(/^bycli-plugin-/, '');
+        const name = repo.replace(PLUGIN_NAME_PREFIX, '');
         return {
             type: 'git',
             cloneUrl: `https://github.com/${user}/${repo}.git`,
@@ -1075,7 +1078,7 @@ function parseSource(source) {
         const pathPart = sshUrlMatch[1];
         const segments = pathPart.split('/');
         const repoSegment = segments.pop();
-        const name = repoSegment.replace(/^bycli-plugin-/, '');
+        const name = repoSegment.replace(PLUGIN_NAME_PREFIX, '');
         return { type: 'git', cloneUrl: source, name };
     }
     // git@host:user/repo.git (SCP-style)
@@ -1084,7 +1087,7 @@ function parseSource(source) {
         const pathPart = scpMatch[1];
         const segments = pathPart.split('/');
         const repoSegment = segments.pop();
-        const name = repoSegment.replace(/^bycli-plugin-/, '');
+        const name = repoSegment.replace(PLUGIN_NAME_PREFIX, '');
         return { type: 'git', cloneUrl: source, name };
     }
     // Generic https/http git URL (non-GitHub hosts)
@@ -1093,7 +1096,7 @@ function parseSource(source) {
         const pathPart = genericHttpMatch[1];
         const segments = pathPart.split('/');
         const repoSegment = segments.pop();
-        const name = repoSegment.replace(/^bycli-plugin-/, '');
+        const name = repoSegment.replace(PLUGIN_NAME_PREFIX, '');
         // Ensure clone URL ends with .git
         const cloneUrl = source.endsWith('.git') ? source : `${source}.git`;
         return { type: 'git', cloneUrl, name };

package/dist/src/recorder/highlevel/analyze.d.ts

@@ -0,0 +1,29 @@
+/**
+ * High-Level analyze module (M5a, 07-high-level-services.md · analyzeBrowser).
+ *
+ * Module-first (ADR-0004): drives the Page abstraction through the multi-step
+ * site probe (goto / wait / network capture / window-global probe / cookies) to
+ * assemble PageSignals, then calls the PURE analyzeSite() classifier. In-process
+ * async, no child process (07:50). Hosted by the main-repo daemon high-level
+ * surface (Codex A' verdict); dashboard-be only forwards.
+ *
+ * Timeout surfaces as `analyze_timeout` (07:52), never a runner error.
+ */
+import type { IPage } from '../../types.js';
+import { type AdapterRef, type AnalyzeReport } from '../../browser/analyze.js';
+export interface AnalyzeInput {
+    url: string;
+    /** site-level settle window after load (ms); default 2000 (07 input). */
+    settleMs?: number;
+}
+export declare class AnalyzeTimeoutError extends Error {
+    readonly code = "analyze_timeout";
+    constructor(ms: number);
+}
+/**
+ * Collect PageSignals by driving the page, then classify with the pure analyzeSite.
+ * `registry` is the adapter registry used for nearest-adapter matching.
+ */
+export declare function analyzeBrowser(page: IPage, registry: Map<string, AdapterRef>, input: AnalyzeInput): Promise<AnalyzeReport>;
+/** Wrap analyzeBrowser with a deadline → AnalyzeTimeoutError (07:52 analyze_timeout). */
+export declare function analyzeBrowserWithTimeout(page: IPage, registry: Map<string, AdapterRef>, input: AnalyzeInput, timeoutMs: number): Promise<AnalyzeReport>;

package/dist/src/recorder/highlevel/analyze.js

@@ -0,0 +1,91 @@
+/**
+ * High-Level analyze module (M5a, 07-high-level-services.md · analyzeBrowser).
+ *
+ * Module-first (ADR-0004): drives the Page abstraction through the multi-step
+ * site probe (goto / wait / network capture / window-global probe / cookies) to
+ * assemble PageSignals, then calls the PURE analyzeSite() classifier. In-process
+ * async, no child process (07:50). Hosted by the main-repo daemon high-level
+ * surface (Codex A' verdict); dashboard-be only forwards.
+ *
+ * Timeout surfaces as `analyze_timeout` (07:52), never a runner error.
+ */
+import { analyzeSite } from '../../browser/analyze.js';
+import { generateInterceptorJs } from '../../interceptor.js';
+export class AnalyzeTimeoutError extends Error {
+    code = 'analyze_timeout';
+    constructor(ms) {
+        super(`analyze timed out after ${ms}ms`);
+        this.name = 'AnalyzeTimeoutError';
+    }
+}
+const DEFAULT_SETTLE_MS = 2000;
+/** Window-global + cookie + finalUrl probe (mirrors the CLI analyze probe). */
+const PROBE_JS = `(function(){
+  return {
+    cookieNames: (document.cookie || '').split(';').map(function(c){ return c.trim().split('=')[0]; }).filter(Boolean),
+    initialState: {
+      __INITIAL_STATE__: typeof window.__INITIAL_STATE__ !== 'undefined',
+      __NUXT__: typeof window.__NUXT__ !== 'undefined',
+      __NEXT_DATA__: typeof window.__NEXT_DATA__ !== 'undefined',
+      __APOLLO_STATE__: typeof window.__APOLLO_STATE__ !== 'undefined',
+    },
+    title: document.title || '',
+    finalUrl: location.href,
+  };
+})()`;
+/**
+ * Collect PageSignals by driving the page, then classify with the pure analyzeSite.
+ * `registry` is the adapter registry used for nearest-adapter matching.
+ */
+export async function analyzeBrowser(page, registry, input) {
+    const settleMs = input.settleMs ?? DEFAULT_SETTLE_MS;
+    // Prefer the session-level CDP network capture; fall back to an injected interceptor.
+    const hasSessionCapture = (await page.startNetworkCapture?.()) ?? false;
+    await page.goto(input.url);
+    await page.wait(Math.max(1, Math.round(settleMs / 1000)));
+    if (!hasSessionCapture) {
+        // match-all: analyze wants every json/text response, not a filtered subset.
+        try {
+            await page.evaluate(generateInterceptorJs('true'));
+        }
+        catch { /* non-fatal */ }
+    }
+    await page.wait(1);
+    const rawItems = ((await page.readNetworkCapture?.()) ?? []);
+    const networkEntries = rawItems.map((e) => ({
+        url: e.url ?? '',
+        status: e.status ?? 0,
+        contentType: e.ct ?? '',
+        bodyPreview: typeof e.body === 'string'
+            ? e.body.slice(0, 2000)
+            : (e.body ? JSON.stringify(e.body).slice(0, 2000) : null),
+    }));
+    const probe = await page.evaluate(PROBE_JS);
+    const browserCookieNames = (await page.getCookies({ url: probe.finalUrl || input.url }).catch(() => []))
+        .map((c) => c.name)
+        .filter(Boolean);
+    const cookieNames = [...new Set([...probe.cookieNames, ...browserCookieNames])];
+    const signals = {
+        requestedUrl: input.url,
+        finalUrl: probe.finalUrl,
+        cookieNames,
+        networkEntries,
+        initialState: probe.initialState,
+        title: probe.title,
+    };
+    return analyzeSite(signals, registry);
+}
+/** Wrap analyzeBrowser with a deadline → AnalyzeTimeoutError (07:52 analyze_timeout). */
+export async function analyzeBrowserWithTimeout(page, registry, input, timeoutMs) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new AnalyzeTimeoutError(timeoutMs)), timeoutMs);
+    });
+    try {
+        return await Promise.race([analyzeBrowser(page, registry, input), timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}