@junghanacs/entwurf 0.12.0 → 0.12.1

package/scripts/check-entwurf-bridge-pi-free.ts

@@ -0,0 +1,146 @@
+// check-entwurf-bridge-pi-free (0.12.1 A-gate, static half)
+//
+// INVARIANT: the entwurf-bridge MCP server must boot WITHOUT any pi package
+// (`@earendil-works/pi-*`). entwurf is a harness-neutral npm package; pi is one
+// optional adapter lane, not a boot dependency. A plain `npm install
+// @junghanacs/entwurf` (no pi peers) must still stand `entwurf-bridge` up and
+// answer MCP `tools/list`.
+//
+// This gate is the STATIC half of that contract: it walks the EAGER static
+// value-import closure of the bridge entry (`mcp/entwurf-bridge/src/index.ts`)
+// and fails if any reachable module statically value-imports `@earendil-works/*`.
+//
+// "Eager static value-import" is the precise boundary (GPT-agreed):
+//   - `import type …`               → erased by strip-types        → NOT followed
+//   - `import { type A, type B }`    → all-type, erased            → NOT followed
+//   - `import { type A, b }`         → has a value binding, kept    → followed
+//   - `import x` / `import * as x`   → value                        → followed
+//   - `import "x"` (side-effect)     → value                        → followed
+//   - `export { a } from "x"`        → value re-export              → followed
+//   - `export type { a } from "x"`   → type re-export, erased       → NOT followed
+//   - `await import("x")` (dynamic)  → INTENDED lazy boundary       → NOT followed
+//
+// The dynamic-import exemption is deliberate: B-2 makes the pi-coding-agent
+// `preflight` a lazy `await import("./entwurf-preflight.ts")` reached ONLY on an
+// owned-outcome spawn-bg resume, so it is allowed to pull pi at runtime in that
+// one branch. The runtime boot smoke (separate half) is the final authority that
+// peers/self/list/mailbox-deliver come up pi-free.
+
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+
+const REPO = resolve(import.meta.dirname, "..");
+const ENTRY = resolve(REPO, "mcp/entwurf-bridge/src/index.ts");
+const PI_SPECIFIER = /^@earendil-works\/pi-(ai|coding-agent|tui)(\/|$)/;
+
+/** Strip line + block comments so a commented-out import never registers. */
+function stripComments(src: string): string {
+	return src.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1");
+}
+
+/** Is every named binding in a `{ … }` clause a `type` binding? (→ import erased) */
+function allNamedAreType(clause: string): boolean {
+	const parts = clause
+		.split(",")
+		.map((p) => p.trim())
+		.filter(Boolean);
+	if (parts.length === 0) return false; // `import {} from` is odd; treat as value.
+	return parts.every((p) => /^type\s/.test(p));
+}
+
+/**
+ * Return the runtime-loaded (non-type, non-dynamic) module specifiers of `src`.
+ * Only static `import …`/`export … from` whose effect survives strip-types.
+ */
+function runtimeSpecifiers(src: string): string[] {
+	const clean = stripComments(src);
+	const specs: string[] = [];
+	// import … from "spec"  |  import "spec"
+	const importRe = /\bimport\b([^"'`;]*?)\bfrom\b\s*["'`]([^"'`]+)["'`]|\bimport\s*["'`]([^"'`]+)["'`]/g;
+	for (let m = importRe.exec(clean); m !== null; m = importRe.exec(clean)) {
+		const sideEffect = m[3];
+		if (sideEffect) {
+			specs.push(sideEffect);
+			continue;
+		}
+		const clause = (m[1] ?? "").trim();
+		const spec = m[2];
+		if (/^type\b/.test(clause)) continue; // `import type …`
+		const braced = clause.match(/\{([^}]*)\}/);
+		// A pure `{ … }` clause (no default/namespace) that is all-type is erased.
+		if (braced && !/^[A-Za-z0-9_$]/.test(clause) && allNamedAreType(braced[1])) continue;
+		specs.push(spec);
+	}
+	// export … from "spec"  (value re-export);  export type … from → skip
+	const reexportRe = /\bexport\b([^"'`;]*?)\bfrom\b\s*["'`]([^"'`]+)["'`]/g;
+	for (let m = reexportRe.exec(clean); m !== null; m = reexportRe.exec(clean)) {
+		const clause = (m[1] ?? "").trim();
+		const spec = m[2];
+		if (/^type\b/.test(clause)) continue; // `export type … from`
+		const braced = clause.match(/\{([^}]*)\}/);
+		if (braced && allNamedAreType(braced[1])) continue;
+		specs.push(spec);
+	}
+	return specs;
+}
+
+/** Resolve a relative specifier to an on-disk source file, or null if external. */
+function resolveLocal(fromFile: string, spec: string): string | null {
+	if (!spec.startsWith(".")) return null; // bare/external — handled by caller
+	const base = resolve(dirname(fromFile), spec);
+	const candidates = [
+		base,
+		`${base}.ts`,
+		`${base}.js`,
+		`${base}.mjs`,
+		resolve(base, "index.ts"),
+		resolve(base, "index.js"),
+	];
+	for (const c of candidates) if (existsSync(c)) return c;
+	return null;
+}
+
+// BFS over the eager static value-import closure.
+const visited = new Set<string>();
+const violations: Array<{ chain: string[]; specifier: string }> = [];
+const queue: Array<{ file: string; chain: string[] }> = [{ file: ENTRY, chain: [relative(REPO, ENTRY)] }];
+
+while (queue.length > 0) {
+	const { file, chain } = queue.shift()!;
+	if (visited.has(file)) continue;
+	visited.add(file);
+	let src: string;
+	try {
+		src = readFileSync(file, "utf8");
+	} catch {
+		continue;
+	}
+	for (const spec of runtimeSpecifiers(src)) {
+		if (PI_SPECIFIER.test(spec)) {
+			violations.push({ chain, specifier: spec });
+			continue;
+		}
+		const local = resolveLocal(file, spec);
+		if (local && !visited.has(local)) {
+			queue.push({ file: local, chain: [...chain, relative(REPO, local)] });
+		}
+	}
+}
+
+if (violations.length > 0) {
+	console.error("[check-entwurf-bridge-pi-free] FAIL: bridge boot closure statically value-imports pi:");
+	for (const v of violations) {
+		console.error(`  - ${v.specifier}`);
+		console.error(`      via ${v.chain.join(" -> ")}`);
+	}
+	console.error(
+		"\n  The entwurf-bridge MCP server must boot pi-free. Move the pi value-import behind a\n" +
+			"  type-only import, a pi-side module the bridge does not reach, or a lazy `await import()`\n" +
+			"  on the owned-outcome resume branch only.",
+	);
+	process.exit(1);
+}
+
+console.log(
+	`[check-entwurf-bridge-pi-free] ok — bridge boot closure is pi-free (${visited.size} modules walked, no static @earendil-works/pi-* value-import)`,
+);

package/scripts/check-entwurf-v2-contract.ts

@@ -41,10 +41,6 @@ import {
 	ENTWURF_V2_OWNERSHIPS,
 	ENTWURF_V2_REJECT_REASONS,
 	ENTWURF_V2_TRANSPORTS,
-	EntwurfV2InputSchema,
-	EntwurfV2ReceiptRejectSchema,
-	EntwurfV2ReceiptSchema,
-	EntwurfV2ReceiptSuccessSchema,
 	FACT_LIVENESSES,
 	type FactLiveness,
 	factLivenessOf,
@@ -57,6 +53,12 @@ import {
 	resolveDispatch,
 	UNSUPPORTED_DISPATCH_TABLE,
 } from "../pi-extensions/lib/entwurf-v2-contract.ts";
+import {
+	EntwurfV2InputSchema,
+	EntwurfV2ReceiptRejectSchema,
+	EntwurfV2ReceiptSchema,
+	EntwurfV2ReceiptSuccessSchema,
+} from "../pi-extensions/lib/entwurf-v2-contract-schema.ts";
 import { SESSION_ID_RE } from "../pi-extensions/lib/session-id.js";
 import type { SocketLiveness } from "../pi-extensions/lib/socket-probe.ts";
 

package/scripts/smoke-acp-bundled-mcp-live.ts

@@ -207,9 +207,20 @@ async function main(): Promise<void> {
 		);
 
 		// Drive ONE model turn over the stdin RPC: call the BUNDLED bridge's entwurf_self.
+		// Ask for LABELED lines ("socketState: <value>"), not bare values. The old
+		// "reply with the values ... one per line, and nothing else" prompt contradicted
+		// the assertions below, which match on the FIELD NAME (e.g. /socketState…alive/):
+		// a model that obeyed "values only" replied with a bare "alive" line that the
+		// envelope filter (it keys on field-name tokens) dropped, and the [tool:done]
+		// notice truncates the envelope before socketState — so the gate flaked on the
+		// model's formatting choice. Labeled lines make the three identity fields
+		// deterministically observable in the reply regardless of notice truncation.
 		const prompt =
-			"Call the mcp__entwurf-bridge__entwurf_self tool now. Then reply with exactly the " +
-			"sessionId, agentId, and socketState values it returned, one per line, and nothing else. " +
+			"Call the mcp__entwurf-bridge__entwurf_self tool now. Then reply with exactly these " +
+			"three lines, copying the tool result verbatim and nothing else:\n" +
+			"sessionId: <value>\n" +
+			"agentId: <value>\n" +
+			"socketState: <value>\n" +
 			"Do not paraphrase or invent values — copy them verbatim from the tool result.";
 		// The prompt must NOT leak the gid — the gid in the envelope is the proof the bridge
 		// answered, so a gid in the prompt would make that proof circular (the model could echo

package/scripts/smoke-acp-carrier-augment-live.ts

@@ -7,10 +7,17 @@
 // This is the S2e-1 live half: it drives the REAL pi provider path and proves the
 // two 핀1-critical behaviors the gate cannot observe on a real model turn:
 //
-//   1. the augment reaches the model — a unique secret written ONLY into the
-//      scratch cwd's AGENTS.md (NEVER into the user prompt) comes back in the
-//      reply, so buildPiContextAugment's "## <cwd>/AGENTS.md" section actually rode
-//      the wire to the live model via streamShellAcp.
+//   1. the augment reaches the model — a unique BENIGN factual marker written
+//      ONLY into the scratch cwd's AGENTS.md (NEVER into the user prompt) comes
+//      back in the reply, so buildPiContextAugment's "## <cwd>/AGENTS.md" section
+//      actually rode the wire to the live model via streamShellAcp. The marker is
+//      a plain project fact ("internal build codename: <nonce>") asked back with a
+//      normal "answer from project context" question — NOT a "SECRET ... reply
+//      with the value" directive. The old secret-echo phrasing read as a prompt
+//      injection embedded in a /tmp AGENTS.md, and current Claude correctly
+//      REFUSES it ("typical injection pattern"), which made this MUST gate fail
+//      even though the augment DID ride the wire. Proving delivery must not depend
+//      on the model agreeing to echo an exfil-shaped secret.
 //   2. the default (EMPTY) carrier does not trip subscription billing — the turn
 //      exits 0 with no HTTP-400 / "extra usage" billing error. This is the 핀1
 //      live check: a carrier-absent run must bill like a normal subscription call.
@@ -18,11 +25,13 @@
 // Read-tool caveat (deliberate — GPT c32a6c8 Q1): Claude ACP exposes Read, so a
 // model COULD read AGENTS.md directly instead of answering from the augment. We do
 // not forbid that at the wire — the deterministic gate already locks the augment
-// SHAPE; this smoke asks the model to answer WITHOUT tools and treats the secret
+// SHAPE; this smoke asks the model to answer WITHOUT tools and treats the marker
 // in the reply as evidence that the augment+provider path is live AND billing-
 // clean. The honest claim is "the augment rode the live provider path and the
 // empty-carrier turn billed fine", NOT "the model was physically unable to read
-// the file". A wire-dump would over-build for this cut's purpose.
+// the file". A live wire-dump would over-build for this cut's purpose (the
+// production ACP path has no prompt-capture seam; only the deterministic gate's
+// fake child captures payloads).
 //
 // Optional carrier-present path (SMOKE_ACP_CARRIER_PRESENT=1, non-blocking — GPT
 // c32a6c8 Q2): a second turn with a TINY engraving via ENTWURF_ACP_ENGRAVING_PATH
@@ -122,45 +131,52 @@ function assertCleanTurn(label: string, turn: { status: number | null; combined:
 const scratch = mkdtempSync(join(tmpdir(), "entwurf-s2e1-"));
 try {
 	// A nonce unique to this run; lives ONLY in the cwd AGENTS.md, never the prompt.
+	// The marker is a BENIGN project FACT (an internal build codename) with no
+	// directive attached — not a "SECRET ... reply with the value" instruction.
+	// A factual line cannot read as an embedded user-turn injection, so asking for
+	// it back is a normal "answer from project context" task the model performs
+	// instead of refusing (see header). Its uniqueness still proves delivery: the
+	// codename appears nowhere but the cwd AGENTS.md the augment carries.
 	const nonce = `${process.pid.toString(36)}${Date.now().toString(36)}`;
-	const secret = `SAC_${nonce}`;
+	const marker = `nimbus${nonce}`;
 	const agentsPath = join(scratch, "AGENTS.md");
 	writeFileSync(
 		agentsPath,
 		[
-			"# Scratch project — entwurf S2e-1 augment live check",
+			"# Scratch project: entwurf augment live check",
 			"",
-			`SECRET_PROJECT_CODE: ${secret}`,
+			"## Project facts",
 			"",
-			"When asked for the secret project code, reply with the value above.",
+			`- Internal build codename: ${marker}`,
 			"",
 		].join("\n"),
 	);
 
-	// The prompt never names the secret; only the cwd AGENTS.md (carried by the
+	// The prompt never names the marker; only the cwd AGENTS.md (carried by the
 	// augment) holds it. "Without using any tool" pushes the model to answer from
-	// the provided instructions rather than reading the file (Read-tool caveat).
+	// the provided project context rather than reading the file (Read-tool caveat).
 	const prompt =
-		"Without using any tool or reading any file, reply with exactly the " +
-		"SECRET_PROJECT_CODE value from this project's instructions, and nothing else.";
+		"Based on the project context you were given, what is this project's " +
+		"internal build codename? Reply with just the codename and nothing else, " +
+		"and answer from the provided context without using any tool or reading any file.";
 
 	console.error(`[smoke-acp-carrier-augment-live] repo:   ${REPO_ROOT}`);
 	console.error(`[smoke-acp-carrier-augment-live] cwd:    ${scratch}`);
 	console.error(`[smoke-acp-carrier-augment-live] model:  ${PROVIDER}/${MODEL}`);
-	console.error(`[smoke-acp-carrier-augment-live] secret: ${secret} (only in cwd AGENTS.md)`);
+	console.error(`[smoke-acp-carrier-augment-live] marker: ${marker} (only in cwd AGENTS.md)`);
 
 	// --- MUST: empty (default) carrier + augment behavior ---------------------
 	const turn1 = runTurn(scratch, prompt, {});
 	assertCleanTurn("empty-carrier turn", turn1);
 	assert.ok(
-		turn1.stdout.includes(secret),
-		`empty-carrier turn: reply did not carry the cwd-AGENTS secret ${secret} ` +
+		turn1.stdout.includes(marker),
+		`empty-carrier turn: reply did not carry the cwd-AGENTS marker ${marker} ` +
 			`(the augment did not reach the model). stdout tail: ${JSON.stringify(turn1.stdout.slice(-300))}`,
 	);
-	console.log("[smoke-acp-carrier-augment-live] PASS (MUST) — augment delivered the cwd AGENTS.md secret on a");
+	console.log("[smoke-acp-carrier-augment-live] PASS (MUST) — augment delivered the cwd AGENTS.md marker on a");
 	console.log("  live provider turn; the empty default carrier billed clean (exit 0, no 400 canary).");
 	console.log(`  model:  ${PROVIDER}/${MODEL}`);
-	console.log(`  secret: ${secret} present in assistant reply`);
+	console.log(`  marker: ${marker} present in assistant reply`);
 
 	// --- OPTIONAL (non-blocking): tiny carrier-present billing -----------------
 	if (process.env.SMOKE_ACP_CARRIER_PRESENT === "1") {