impel-cli 0.20.14 → 0.20.16

package/scripts/profile-native-codex.mjs

@@ -0,0 +1,584 @@
+#!/usr/bin/env node
+
+import crypto from "node:crypto";
+import { spawn, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { nativeSpawnInvocation } from "../src/nativeProcess.js";
+import { summarizeRawAttempt } from "./analyze-native-codex.mjs";
+
+const PROFILE_SCHEMA = "impel.native-codex-profile.v1";
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_GRACE_MS = 5_000;
+const MAX_CAPTURE_BYTES = 256 * 1024 * 1024;
+
+function privateDirectory(directory) {
+  if (fs.existsSync(directory) && fs.lstatSync(directory).isSymbolicLink()) {
+    throw new Error(`refusing to use symlinked output directory ${directory}`);
+  }
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  try { fs.chmodSync(directory, 0o700); } catch { /* Best effort on Windows. */ }
+}
+
+function privateWrite(filePath, contents) {
+  fs.writeFileSync(filePath, contents, { encoding: "utf8", mode: 0o600, flag: "wx" });
+  try { fs.chmodSync(filePath, 0o600); } catch { /* Best effort on Windows. */ }
+}
+
+function openPrivate(filePath) {
+  const descriptor = fs.openSync(filePath, "wx", 0o600);
+  try { fs.chmodSync(filePath, 0o600); } catch { /* Best effort on Windows. */ }
+  return descriptor;
+}
+
+function delay(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+function posixGroupAlive(pid) {
+  try {
+    process.kill(-pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === "EPERM";
+  }
+}
+
+function windowsProcessAlive(pid, spawnSyncImpl = spawnSync) {
+  const result = spawnSyncImpl(
+    "tasklist.exe",
+    ["/FI", `PID eq ${pid}`, "/FO", "CSV", "/NH"],
+    { encoding: "utf8", windowsHide: true },
+  );
+  return result.status === 0 && new RegExp(`"${pid}"`, "u").test(result.stdout || "");
+}
+
+async function waitUntil(predicate, deadlineMs) {
+  const deadline = Date.now() + deadlineMs;
+  while (Date.now() < deadline) {
+    if (!predicate()) return true;
+    await delay(25);
+  }
+  return !predicate();
+}
+
+export async function terminateProcessTree({
+  child,
+  platform = process.platform,
+  graceMs = DEFAULT_GRACE_MS,
+  spawnSyncImpl = spawnSync,
+} = {}) {
+  if (!Number.isSafeInteger(child?.pid) || child.pid <= 0) {
+    return { descendantsRemaining: false };
+  }
+  if (platform === "win32") {
+    spawnSyncImpl("taskkill.exe", ["/PID", String(child.pid), "/T"], {
+      encoding: "utf8",
+      windowsHide: true,
+    });
+    const exited = await waitUntil(() => windowsProcessAlive(child.pid, spawnSyncImpl), graceMs);
+    if (!exited) {
+      spawnSyncImpl("taskkill.exe", ["/PID", String(child.pid), "/T", "/F"], {
+        encoding: "utf8",
+        windowsHide: true,
+      });
+      await waitUntil(() => windowsProcessAlive(child.pid, spawnSyncImpl), 500);
+    }
+    return { descendantsRemaining: windowsProcessAlive(child.pid, spawnSyncImpl) };
+  }
+
+  try { process.kill(-child.pid, "SIGTERM"); } catch (error) {
+    if (error?.code !== "ESRCH") throw error;
+  }
+  const exited = await waitUntil(() => posixGroupAlive(child.pid), graceMs);
+  if (!exited) {
+    try { process.kill(-child.pid, "SIGKILL"); } catch (error) {
+      if (error?.code !== "ESRCH") throw error;
+    }
+    await waitUntil(() => posixGroupAlive(child.pid), 500);
+  }
+  return { descendantsRemaining: posixGroupAlive(child.pid) };
+}
+
+export async function runProfiledProcess({
+  command,
+  args = [],
+  environment = process.env,
+  cwd = process.cwd(),
+  input = "",
+  stdoutPath,
+  stderrPath,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  graceMs = DEFAULT_GRACE_MS,
+  platform = process.platform,
+} = {}) {
+  const stdoutFd = openPrivate(stdoutPath);
+  const stderrFd = openPrivate(stderrPath);
+  const startedAtMs = Date.now();
+  let capturedBytes = 0;
+  let spawnError = null;
+  let exitCode = null;
+  let signal = null;
+  const child = spawn(command, args, {
+    cwd,
+    env: environment,
+    detached: platform !== "win32",
+    stdio: ["pipe", "pipe", "pipe"],
+    windowsHide: true,
+  });
+  child.stdout.on("data", (chunk) => {
+    capturedBytes += chunk.length;
+    if (capturedBytes <= MAX_CAPTURE_BYTES) fs.writeSync(stdoutFd, chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    capturedBytes += chunk.length;
+    if (capturedBytes <= MAX_CAPTURE_BYTES) fs.writeSync(stderrFd, chunk);
+  });
+  child.once("error", (error) => { spawnError = error; });
+  const closed = new Promise((resolve) => child.once("close", (code, childSignal) => {
+    exitCode = code;
+    signal = childSignal;
+    resolve();
+  }));
+  child.stdin.on("error", () => {});
+  child.stdin.end(input);
+
+  let timedOut = false;
+  let cancellationLatencyMs = null;
+  let descendantsRemaining = null;
+  let timeoutHandle;
+  const timeout = new Promise((resolve) => {
+    timeoutHandle = setTimeout(() => resolve("timeout"), timeoutMs);
+  });
+  const winner = await Promise.race([closed.then(() => "closed"), timeout]);
+  clearTimeout(timeoutHandle);
+  if (winner === "timeout") {
+    timedOut = true;
+    const cancellationStarted = Date.now();
+    const termination = await terminateProcessTree({ child, platform, graceMs });
+    descendantsRemaining = termination.descendantsRemaining;
+    await Promise.race([closed, delay(1_000)]);
+    cancellationLatencyMs = Date.now() - cancellationStarted;
+  }
+  try { fs.closeSync(stdoutFd); } catch {}
+  try { fs.closeSync(stderrFd); } catch {}
+  if (capturedBytes > MAX_CAPTURE_BYTES) {
+    throw new Error("profile output exceeded the private capture limit");
+  }
+  return {
+    startedAtMs,
+    endedAtMs: Date.now(),
+    exitCode,
+    signal,
+    timedOut,
+    cancellationLatencyMs,
+    descendantsRemaining,
+    spawnError: spawnError?.message || null,
+  };
+}
+
+function impelInvocation(binary, args, environment = process.env) {
+  if (binary.endsWith(".js")) {
+    return { command: process.execPath, args: [path.resolve(binary), ...args] };
+  }
+  const invocation = nativeSpawnInvocation(binary, args, environment);
+  return { command: invocation.command, args: invocation.args };
+}
+
+function runCaptured(command, args, { environment = process.env, timeoutMs = 60_000 } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      env: environment,
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+    });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => child.kill(), timeoutMs);
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    child.once("error", reject);
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      resolve({ code, stdout, stderr });
+    });
+  });
+}
+
+async function currentTenant(impelBinary, environment) {
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    const invocation = impelInvocation(impelBinary, ["tenant", "current"], environment);
+    const result = await runCaptured(invocation.command, invocation.args, { environment });
+    const lines = result.stdout.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean);
+    if (result.code === 0 && lines.length === 1 && /^[A-Za-z0-9_.:-]{1,160}$/u.test(lines[0])) {
+      return lines[0];
+    }
+    if (attempt === 0) await delay(250);
+  }
+  throw new Error("could not establish one exact current Impel tenant after two bounded attempts");
+}
+
+export async function assertExpectedTenant({ expectedTenant, impelBinary = "impel", environment = process.env }) {
+  const actual = await currentTenant(impelBinary, environment);
+  if (actual !== expectedTenant) {
+    throw new Error(`selected tenant ${JSON.stringify(actual)} does not match expected tenant ${JSON.stringify(expectedTenant)}`);
+  }
+  return actual;
+}
+
+function listRollouts(root, startedAtMs, endedAtMs) {
+  if (!fs.existsSync(root)) return [];
+  const results = [];
+  const days = new Set();
+  for (let timestamp = startedAtMs - 24 * 60 * 60 * 1000;
+    timestamp <= endedAtMs + 24 * 60 * 60 * 1000;
+    timestamp += 24 * 60 * 60 * 1000) {
+    const date = new Date(timestamp);
+    for (const values of [
+      [date.getFullYear(), date.getMonth() + 1, date.getDate()],
+      [date.getUTCFullYear(), date.getUTCMonth() + 1, date.getUTCDate()],
+    ]) {
+      days.add(values.map((value, index) => index === 0 ? String(value) : String(value).padStart(2, "0")).join("/"));
+    }
+  }
+  for (const day of days) {
+    const directory = path.join(root, ...day.split("/"));
+    if (!fs.existsSync(directory) || fs.lstatSync(directory).isSymbolicLink()) continue;
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      if (!entry.isFile() || !/^rollout-.*\.jsonl$/u.test(entry.name)) continue;
+      const entryPath = path.join(directory, entry.name);
+      const modified = fs.statSync(entryPath).mtimeMs;
+      if (modified >= startedAtMs - 2_000 && modified <= endedAtMs + 2_000) results.push(entryPath);
+    }
+  }
+  return results;
+}
+
+function rolloutMetadata(filePath) {
+  const descriptor = fs.openSync(filePath, "r");
+  try {
+    const chunks = [];
+    let bytes = 0;
+    let position = 0;
+    for (;;) {
+      const buffer = Buffer.alloc(64 * 1024);
+      const length = fs.readSync(descriptor, buffer, 0, buffer.length, position);
+      if (length === 0) break;
+      const chunk = buffer.subarray(0, length);
+      const newline = chunk.indexOf(0x0a);
+      chunks.push(newline === -1 ? chunk : chunk.subarray(0, newline));
+      bytes += newline === -1 ? length : newline;
+      if (bytes > 4 * 1024 * 1024) throw new Error("rollout metadata exceeds the bounded parser limit");
+      if (newline !== -1) break;
+      position += length;
+    }
+    const firstLine = Buffer.concat(chunks).toString("utf8").replace(/\r$/u, "");
+    const record = JSON.parse(firstLine);
+    const payload = record.type === "session_meta" ? record.payload : null;
+    const threadId = payload?.session_id || payload?.id;
+    return {
+      threadId: typeof threadId === "string" ? threadId : null,
+      parentThreadId: typeof payload?.parent_thread_id === "string" ? payload.parent_thread_id : null,
+    };
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+function rootThreadIds(stdoutText) {
+  const ids = new Set();
+  for (const line of stdoutText.split(/\r?\n/u)) {
+    if (!line.trim()) continue;
+    try {
+      const event = JSON.parse(line);
+      const value = event.thread_id || event.threadId;
+      if (typeof value === "string") ids.add(value);
+    } catch {
+      // Strict parsing reports this later. Rollout collection stays best effort.
+    }
+  }
+  return ids;
+}
+
+function collectAttemptRollouts({ rolloutRoot, startedAtMs, endedAtMs, stdoutText, destination }) {
+  const candidates = listRollouts(rolloutRoot, startedAtMs, endedAtMs).flatMap((filePath) => {
+    try { return [{ filePath, ...rolloutMetadata(filePath) }]; } catch { return []; }
+  });
+  const selectedIds = rootThreadIds(stdoutText);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const candidate of candidates) {
+      if (candidate.parentThreadId && selectedIds.has(candidate.parentThreadId)
+        && !selectedIds.has(candidate.threadId)) {
+        selectedIds.add(candidate.threadId);
+        changed = true;
+      }
+    }
+  }
+  const selected = candidates.filter((candidate) => selectedIds.has(candidate.threadId));
+  if (selected.length === 0) return [];
+  privateDirectory(destination);
+  return selected.map((candidate, index) => {
+    const target = path.join(destination, `rollout-${String(index + 1).padStart(2, "0")}.jsonl`);
+    privateWrite(target, fs.readFileSync(candidate.filePath, "utf8"));
+    return target;
+  });
+}
+
+function numericFlag(value, name, { minimum = 1, maximum = Number.MAX_SAFE_INTEGER } = {}) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < minimum || parsed > maximum) {
+    throw new Error(`${name} must be an integer from ${minimum} to ${maximum}`);
+  }
+  return parsed;
+}
+
+function parseArguments(argv) {
+  const options = { mode: "direct", cohort: "original", attempts: 1, concurrency: 1, timeoutMs: DEFAULT_TIMEOUT_MS, attemptOffset: 0, extraArgs: [] };
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (["--help", "-h"].includes(argument)) return { help: true };
+    const [name, inline] = argument.split(/=(.*)/su, 2);
+    const take = () => inline === undefined ? argv[index += 1] : inline;
+    if (name === "--expected-tenant") options.expectedTenant = take();
+    else if (name === "--agent") options.agent = take();
+    else if (name === "--prompt-file") options.promptFile = take();
+    else if (name === "--output-dir") options.outputDir = take();
+    else if (name === "--impel-bin") options.impelBinary = take();
+    else if (name === "--mode") options.mode = take();
+    else if (name === "--cohort") options.cohort = take();
+    else if (name === "--slo-class") options.sloClass = take();
+    else if (name === "--attempts") options.attempts = numericFlag(take(), "--attempts", { maximum: 1_000 });
+    else if (name === "--concurrency") options.concurrency = numericFlag(take(), "--concurrency", { maximum: 16 });
+    else if (name === "--timeout-ms") options.timeoutMs = numericFlag(take(), "--timeout-ms", { minimum: 1_000 });
+    else if (name === "--attempt-offset") options.attemptOffset = numericFlag(take(), "--attempt-offset", { minimum: 0 });
+    else if (name === "--extra-codex-arg") options.extraArgs.push(take());
+    else throw new Error(`unknown argument ${argument}`);
+  }
+  for (const required of ["expectedTenant", "agent", "promptFile", "outputDir", "sloClass"]) {
+    if (typeof options[required] !== "string" || !options[required].trim()) throw new Error(`--${required.replace(/[A-Z]/gu, (letter) => `-${letter.toLowerCase()}`)} is required`);
+  }
+  if (!["direct", "compatible"].includes(options.mode)) throw new Error("--mode must be direct or compatible");
+  if (!["original", "replacement"].includes(options.cohort)) throw new Error("--cohort must be original or replacement");
+  if (!["cibi", "ctos"].includes(options.sloClass)) throw new Error("--slo-class must be cibi or ctos");
+  if (options.concurrency > options.attempts) options.concurrency = options.attempts;
+  options.impelBinary ||= "impel";
+  return { ...options, help: false };
+}
+
+function safeAttemptRecord({ options, index, processResult, summary, jsonValid, parseError }) {
+  const codex = summary?.codex || {};
+  const telemetry = summary?.telemetry || {};
+  const durationMs = processResult.endedAtMs - processResult.startedAtMs;
+  const telemetryCompleted = telemetry.eventCounts?.local_tool_completed || 0;
+  const mcpDurationMs = telemetryCompleted > 0
+    ? telemetry.mcpDurationMs || 0
+    : codex.mcpDurationMs || 0;
+  const startCalls = (codex.toolCounts?.answer_native_agent || 0)
+    + (codex.toolCounts?.run_native_agent || 0);
+  const success = processResult.exitCode === 0
+    && !processResult.timedOut
+    && processResult.descendantsRemaining !== true
+    && jsonValid
+    && codex.turnCompleted === true
+    && (codex.errorEvents || 0) === 0
+    && (telemetry.localFailures || 0) === 0
+    && startCalls === 1;
+  return {
+    attemptId: `${options.cohort}-${String(index + 1 + options.attemptOffset).padStart(3, "0")}`,
+    cohort: options.cohort,
+    ...(options.cohort === "replacement" ? { replacementFor: `original-${String(index + 1 + options.attemptOffset).padStart(3, "0")}` } : {}),
+    tenantId: options.expectedTenant,
+    sloClass: options.sloClass,
+    mode: options.mode,
+    promptSha256: options.promptSha256,
+    startedAt: new Date(processResult.startedAtMs).toISOString(),
+    endedAt: new Date(processResult.endedAtMs).toISOString(),
+    durationMs,
+    exitCode: processResult.exitCode,
+    signal: processResult.signal,
+    timedOut: processResult.timedOut,
+    cancellationLatencyMs: processResult.cancellationLatencyMs,
+    descendantsRemaining: processResult.descendantsRemaining,
+    jsonValid,
+    parseFailureClass: parseError ? "invalid-jsonl" : null,
+    success,
+    eventCount: codex.eventCount || 0,
+    threadCount: codex.threadCount || 0,
+    toolCounts: codex.toolCounts || {},
+    parentToolCounts: codex.parentToolCounts || {},
+    childToolCounts: codex.childToolCounts || {},
+    codeCells: codex.codeCells || 0,
+    codeWaits: codex.codeWaits || 0,
+    inputTokens: codex.inputTokens || 0,
+    cachedInputTokens: codex.cachedInputTokens || 0,
+    outputTokens: codex.outputTokens || 0,
+    mcpDurationMs,
+    mcpDurationSource: telemetryCompleted > 0
+      ? "telemetry"
+      : (codex.mcpCompletedCalls || 0) > 0 ? "rollout" : "unavailable",
+    nonMcpOverheadMs: Math.max(0, durationMs - mcpDurationMs),
+    telemetryEventCount: telemetry.eventCount || 0,
+    telemetryCorrelationCount: telemetry.correlationCount || 0,
+    telemetryGatewayRequestCount: telemetry.gatewayRequestCount || 0,
+  };
+}
+
+async function profileAttempt(options, sessionDir, index) {
+  await assertExpectedTenant({
+    expectedTenant: options.expectedTenant,
+    impelBinary: options.impelBinary,
+    environment: process.env,
+  });
+  const attemptName = `${options.cohort}-${String(index + 1 + options.attemptOffset).padStart(3, "0")}`;
+  const attemptDir = path.join(sessionDir, attemptName);
+  privateDirectory(attemptDir);
+  const stdoutPath = path.join(attemptDir, "stdout.jsonl");
+  const stderrPath = path.join(attemptDir, "stderr.log");
+  const telemetryPath = path.join(attemptDir, "telemetry.jsonl");
+  const codexArgs = [
+    "codex",
+    ...(options.mode === "direct" ? ["--agent", options.agent] : []),
+    "exec",
+    "--json",
+    ...options.extraArgs,
+    "-",
+  ];
+  const invocation = impelInvocation(options.impelBinary, codexArgs, process.env);
+  const processResult = await runProfiledProcess({
+    ...invocation,
+    environment: {
+      ...process.env,
+      IMPEL_NATIVE_AGENT_TELEMETRY_PATH: telemetryPath,
+      IMPEL_NATIVE_HOST: options.mode === "direct" ? "codex-direct-profile" : "codex-compatible-agent",
+      IMPEL_NATIVE_HOST_BUILD: options.hostBuild,
+    },
+    input: options.prompt,
+    stdoutPath,
+    stderrPath,
+    timeoutMs: options.timeoutMs,
+  });
+  const stdoutText = fs.readFileSync(stdoutPath, "utf8");
+  const rolloutPaths = collectAttemptRollouts({
+    rolloutRoot: options.rolloutRoot,
+    startedAtMs: processResult.startedAtMs,
+    endedAtMs: processResult.endedAtMs,
+    stdoutText,
+    destination: path.join(attemptDir, "rollouts"),
+  });
+  let summary = null;
+  let parseError = null;
+  try {
+    summary = summarizeRawAttempt({
+      stdoutText,
+      telemetryText: fs.existsSync(telemetryPath) ? fs.readFileSync(telemetryPath, "utf8") : "",
+      rolloutTexts: rolloutPaths.map((rolloutPath) => fs.readFileSync(rolloutPath, "utf8")),
+    });
+  } catch (error) {
+    parseError = error;
+  }
+  const record = safeAttemptRecord({
+    options,
+    index,
+    processResult,
+    summary,
+    jsonValid: parseError === null,
+    parseError,
+  });
+  privateWrite(path.join(attemptDir, "record.json"), `${JSON.stringify(record, null, 2)}\n`);
+  return record;
+}
+
+async function runWorkers(options, sessionDir) {
+  const results = new Array(options.attempts);
+  let next = 0;
+  const worker = async () => {
+    for (;;) {
+      const index = next;
+      next += 1;
+      if (index >= options.attempts) return;
+      results[index] = await profileAttempt(options, sessionDir, index);
+    }
+  };
+  await Promise.all(Array.from({ length: options.concurrency }, () => worker()));
+  return results;
+}
+
+async function restoreTenant(originalTenant, options) {
+  let actual;
+  try { actual = await currentTenant(options.impelBinary, process.env); } catch { return false; }
+  if (actual === originalTenant) return true;
+  const invocation = impelInvocation(options.impelBinary, ["tenant", "use", originalTenant], process.env);
+  const result = await runCaptured(invocation.command, invocation.args, { environment: process.env });
+  if (result.code !== 0) return false;
+  return await currentTenant(options.impelBinary, process.env) === originalTenant;
+}
+
+async function main(argv) {
+  const options = parseArguments(argv);
+  if (options.help) {
+    process.stdout.write(
+      "Usage: node scripts/profile-native-codex.mjs --expected-tenant <id> --slo-class <cibi|ctos> --agent <id|title> --prompt-file <private-file> --output-dir <private-dir> [--mode direct|compatible] [--attempts 30] [--concurrency 2] [--cohort original|replacement]\n",
+    );
+    return;
+  }
+  const promptPath = path.resolve(options.promptFile);
+  if (fs.lstatSync(promptPath).isSymbolicLink() || !fs.lstatSync(promptPath).isFile()) {
+    throw new Error("prompt file must be a regular non-symlink file");
+  }
+  options.prompt = fs.readFileSync(promptPath, "utf8");
+  options.promptSha256 = crypto.createHash("sha256").update(options.prompt, "utf8").digest("hex");
+  const originalTenant = await currentTenant(options.impelBinary, process.env);
+  if (originalTenant !== options.expectedTenant) {
+    throw new Error(`selected tenant ${JSON.stringify(originalTenant)} does not match expected tenant ${JSON.stringify(options.expectedTenant)}`);
+  }
+  const versionInvocation = impelInvocation(options.impelBinary, ["--version"], process.env);
+  const version = await runCaptured(versionInvocation.command, versionInvocation.args, { environment: process.env });
+  if (version.code !== 0 || !/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?\s*$/u.test(version.stdout)) {
+    throw new Error("could not establish the Impel CLI build under test");
+  }
+  options.hostBuild = version.stdout.trim();
+  const configRoot = process.env.IMPEL_CONFIG_DIR || path.join(os.homedir(), ".config", "impel");
+  options.rolloutRoot = path.join(configRoot, "cli", "tenants", options.expectedTenant, "codex", "sessions");
+  const outputRoot = path.resolve(options.outputDir);
+  privateDirectory(outputRoot);
+  const sessionId = `codex-${new Date().toISOString().replace(/[:.]/gu, "-")}-${crypto.randomBytes(4).toString("hex")}`;
+  const sessionDir = path.join(outputRoot, sessionId);
+  privateDirectory(sessionDir);
+  let restored = false;
+  try {
+    const attempts = await runWorkers(options, sessionDir);
+    const aggregate = {
+      schema: PROFILE_SCHEMA,
+      sessionId,
+      generatedAt: new Date().toISOString(),
+      tenantId: options.expectedTenant,
+      sloClass: options.sloClass,
+      mode: options.mode,
+      cohort: options.cohort,
+      cliVersion: options.hostBuild,
+      promptSha256: options.promptSha256,
+      attempts,
+    };
+    const aggregatePath = path.join(sessionDir, "aggregate.json");
+    privateWrite(aggregatePath, `${JSON.stringify(aggregate, null, 2)}\n`);
+    process.stderr.write(`Private Codex profile written under ${sessionDir}\n`);
+    process.stdout.write(`${JSON.stringify(aggregate)}\n`);
+  } finally {
+    restored = await restoreTenant(originalTenant, options);
+    if (!restored) process.stderr.write("profile-native-codex: could not verify restoration of the original tenant\n");
+  }
+  if (!restored) process.exitCode = 1;
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) main(process.argv.slice(2)).catch((error) => {
+  process.stderr.write(`profile-native-codex: ${error.message}\n`);
+  process.exitCode = 1;
+});