fix(cli): finish loaded commands when selection links move

[adrianwebb]

Outcome

The loaded CLI binary completes when its invocation symlink changes during dependency loading. The old path guard re-resolved a mutable development selection and silently returned exit zero with no output. The executable now delegates directly to the existing command runtime, preserving awaited output and exit status.

Work authority

• Work item / Issue: CLI Current cli backlog: retained requirements after issue consolidation #274; SDK #387 continuation of #376.

• Proposal / decision: User-approved strict capacity-provider and agent-execution implementation plan.

• Assignment / checkpoint: Public CLI execution and current governed library read-back.

• Actor: Codex desktop.

• Human authority: adrianwebb, explicit implementation and cleanup authorization.

• Agent / capacity provider: Codex desktop; no simulated provider proof.

• Exact base ref: staging d443ddce30edd92e98a1313280f673d5bd31b691.

• Exact head ref: codex/cli-loaded-entrypoint-274 90488e13994ec8be4741ab3b488059210052690f.

• Agent-authored under human authority

Plan

Reproduce empty successful output through the actual production-installed archive, remove the redundant executable-path check, retain command-output and denial tests, and reuse existing component scene identities. Fresh complete owner suites must precede scenes. Ordinary staging merge follows required exact-candidate Actions.

Changes and commits

6c4bd5e retains RED in the original three-archive installation case: a Node resolution hook moves the invocation symlink after the original main module is loaded; that unchanged installed binary returned empty output at exit zero. 90488e1 removes path comparison from the sole executable entrypoint and adds native unit checks for help output and canonical unknown-command rejection.

The original installed-archive case now also verifies loaded-binary completion across that move, exact unchanged archived binary bytes and normal cleanup. Existing source/API and runtime routing remain unchanged. The existing registry and component scene retain all identities (369 complete assertions,168 component steps). No new runner, configuration, session expiration or selection switch is introduced. Package Node support is unchanged.

Verification

Pinned Node24.12.0 focused native package/unit cases12/12passed, zero failures/skips/todos. RED SHA256 cf23169571bbb0c5747410d5b51cf9a8ad0419b625b3ab8c4bbde8dce4febdd3; focused final 6ed0e84bbbe46057ab555958ad531f575daed4850f409ef159ef8a10e2ab8ce8. File architecture and strict node node_modules/typescript/bin/tsc --noEmit -p tsconfig.json passed.

The complete owning npm test passed all369 assertions on committed90488e1 with the unchanged exact Platform authority. An earlier complete run correctly rejected the then-uncommitted main repair (368/369 passed); its checkout regression was retained, the repair committed and the unchanged full suite rerun. A prior check attempt used a nonexistent typecheck script; it was replaced by the real compiler command, with the failed invocation retained.

Actual public library reads also retained empty exit-zero output; the controlled native regression proves this race can cause that behavior, without claiming it is the independently established cause of every earlier empty read. Required Actions must freshly run complete CLI and executing Reviewer suites before168 steps. No local acceptance scene or campaign was launched.

Required 38034466158 passed initial CLI369 assertions, then fresh complete CLI369 and held executing Reviewer199 before all168 component steps, zero failed/skipped/todo/diagnostics. Tested merge a05a4858d25fbfe9332c673f5d719c8c6edfd11f, tree 58b65ead88a25ba879ffe8e8d36faf8d4855f9ed. Artifact11663920084 ZIP SHA256 ea5c932a2c75a7f4296a29bdfcf482275e10bb6c4d50a57e07867b29be8d06da; report b1926cba397604de76d9323f9883fb8c036ff42d228fee08619dc71b53be6eb0. Current required verify and validate passed. Earlier failed observations remain failed.

Risk and rollback

The manifest-declared executable always executes its command runtime; reusable command logic remains in runtime.ts. Ordinary revert restores prior behavior if necessary. The original scripts-disabled production archive proof, watchdogs, selected development lifetime, explicit switch/stop and executable-byte custody are preserved.

Completion summary

Focused and complete local verification pass on committed candidate. Required Actions and all existing component steps pass. Ordinary staging merge/read-back completed at 6a1f8fc3892c069c1efab72c05baa0f0dfa48964, with the exact tested tree. The primary checkout is clean on staging and only this delivery’s remote branch was deleted under its exact source lease. Complete governed definition contents, current campaign authority and strict SDK acceptance remain unproven.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.