@junghanacs/entwurf 0.12.0

package/scripts/check-acp-overlay.ts

@@ -0,0 +1,154 @@
+// Deterministic gate for the S2b Claude config overlay materializer.
+//
+// Drives ensureClaudeConfigOverlay against INJECTED temp realDir/overlayDir
+// (no operator ~/.claude touched), then asserts the overlay shape the ACP
+// child must see:
+//   - settings.json: permissions.defaultMode "default", autoMemoryEnabled
+//     false, hooks === {} (configured-but-empty → mailbox absence by design);
+//   - whitelisted operator entries symlinked to their real path;
+//   - projects/sessions are overlay-PRIVATE real dirs, NOT symlinks;
+//   - non-whitelist operator entries (CLAUDE.md, settings.local.json, plugins,
+//     agents) never appear in the overlay;
+//   - stale symlinks (a prior "linked everything" overlay) are cleaned up,
+//     including a binary-owned STALE SYMLINK (backups → operator data) torn down
+//     and a whitelist symlink whose real source is gone (telemetry) removed;
+//   - binary-owned real files (.claude.json) are preserved across re-runs;
+//   - claudeLaunchEnvDefaults plants CLAUDE_CONFIG_DIR = overlayDir;
+//   - idempotent (a second run yields the identical shape).
+//
+// Pure/deterministic — no live model, no network, OUT of nothing (IN pnpm check).
+
+import { strict as assert } from "node:assert";
+import {
+	lstatSync,
+	mkdirSync,
+	mkdtempSync,
+	readFileSync,
+	readlinkSync,
+	rmSync,
+	symlinkSync,
+	writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+	claudeLaunchEnvDefaults,
+	ensureClaudeConfigOverlay,
+	OVERLAY_BINARY_OWNED,
+	OVERLAY_EMPTY_DIRS,
+	OVERLAY_PASSTHROUGH,
+} from "../pi-extensions/lib/acp/overlay.ts";
+
+const root = mkdtempSync(join(tmpdir(), "entwurf-s2b-overlay-"));
+const realDir = join(root, "real-claude");
+const overlayDir = join(root, "overlay");
+
+try {
+	// --- seed a fake operator ~/.claude ---
+	mkdirSync(realDir, { recursive: true });
+	// whitelisted (must be linked)
+	writeFileSync(join(realDir, ".credentials.json"), '{"fake":"creds"}\n', "utf8");
+	mkdirSync(join(realDir, "skills"), { recursive: true });
+	mkdirSync(join(realDir, "cache"), { recursive: true });
+	writeFileSync(join(realDir, "stats-cache.json"), "{}\n", "utf8");
+	// NON-whitelist operator personal config (must NOT appear in overlay)
+	writeFileSync(join(realDir, "CLAUDE.md"), "# personal\n", "utf8");
+	writeFileSync(join(realDir, "settings.local.json"), '{"env":{"SECRET":"x"}}\n', "utf8");
+	mkdirSync(join(realDir, "plugins"), { recursive: true });
+	mkdirSync(join(realDir, "agents"), { recursive: true });
+	// operator data the overlay must shadow with empty dirs
+	mkdirSync(join(realDir, "projects", "some-cwd"), { recursive: true });
+	mkdirSync(join(realDir, "sessions"), { recursive: true });
+
+	// --- pre-seed a STALE overlay from an earlier "linked everything" version ---
+	mkdirSync(overlayDir, { recursive: true });
+	symlinkSync(join(realDir, "plugins"), join(overlayDir, "plugins")); // stale non-whitelist symlink
+	symlinkSync(join(realDir, "projects"), join(overlayDir, "projects")); // stale projects symlink → must become empty dir
+	writeFileSync(join(overlayDir, ".claude.json"), '{"binary":"owned"}\n', "utf8"); // binary-owned real file → preserved
+	symlinkSync(join(realDir, "plugins"), join(overlayDir, "backups")); // binary-owned STALE SYMLINK → must be torn down (not preserved)
+	symlinkSync(join(realDir, "telemetry"), join(overlayDir, "telemetry")); // whitelist symlink whose real source is GONE → must be removed
+
+	// --- run ---
+	ensureClaudeConfigOverlay(realDir, overlayDir);
+
+	// settings.json
+	const settings = JSON.parse(readFileSync(join(overlayDir, "settings.json"), "utf8"));
+	assert.equal(settings.permissions?.defaultMode, "default", "settings.permissions.defaultMode must be 'default'");
+	assert.equal(settings.autoMemoryEnabled, false, "settings.autoMemoryEnabled must be false");
+	assert.ok(
+		settings.hooks && typeof settings.hooks === "object" && Object.keys(settings.hooks).length === 0,
+		"settings.hooks must be a configured-but-EMPTY object {} (mailbox absence by design)",
+	);
+
+	// whitelisted entries → symlinks to the real path
+	for (const entry of OVERLAY_PASSTHROUGH) {
+		const overlayPath = join(overlayDir, entry);
+		const realPath = join(realDir, entry);
+		if (entry === ".credentials.json" || entry === "skills" || entry === "cache" || entry === "stats-cache.json") {
+			const st = lstatSync(overlayPath);
+			assert.ok(st.isSymbolicLink(), `whitelist entry ${entry} must be a symlink`);
+			assert.equal(readlinkSync(overlayPath), realPath, `whitelist entry ${entry} must point at the real path`);
+		} else {
+			// not seeded in realDir → must be absent in overlay
+			assert.throws(() => lstatSync(overlayPath), `unseeded whitelist entry ${entry} must not exist in overlay`);
+		}
+	}
+
+	// projects/sessions → real dirs, NOT symlinks
+	for (const entry of OVERLAY_EMPTY_DIRS) {
+		const st = lstatSync(join(overlayDir, entry));
+		assert.ok(st.isDirectory() && !st.isSymbolicLink(), `${entry} must be an overlay-private real dir, not a symlink`);
+	}
+
+	// non-whitelist operator config never leaks
+	for (const leak of ["CLAUDE.md", "settings.local.json", "plugins", "agents"]) {
+		assert.throws(() => lstatSync(join(overlayDir, leak)), `non-whitelist entry ${leak} must NOT appear in overlay`);
+	}
+
+	// binary-owned real file preserved
+	assert.ok(OVERLAY_BINARY_OWNED.has(".claude.json"), "test premise: .claude.json is binary-owned");
+	assert.equal(
+		readFileSync(join(overlayDir, ".claude.json"), "utf8"),
+		'{"binary":"owned"}\n',
+		"binary-owned .claude.json must be preserved across overlay build",
+	);
+
+	// binary-owned STALE SYMLINK torn down — a binary-owned name is preserved only
+	// when it is a real binary-authored file/dir; a symlink pointing at operator
+	// data (migration residue) must be removed so the binary re-inits fresh.
+	assert.ok(OVERLAY_BINARY_OWNED.has("backups"), "test premise: backups is binary-owned");
+	assert.throws(
+		() => lstatSync(join(overlayDir, "backups")),
+		"binary-owned stale symlink (backups → operator data) must be torn down, not preserved",
+	);
+
+	// whitelist entry whose real source is GONE → stale overlay copy removed (the
+	// telemetry symlink was preseeded but realDir/telemetry was never created).
+	assert.throws(
+		() => lstatSync(join(overlayDir, "telemetry")),
+		"whitelist entry must be removed when its operator-side source no longer exists",
+	);
+
+	// launch env builder
+	assert.deepEqual(
+		claudeLaunchEnvDefaults(overlayDir),
+		{ CLAUDE_CONFIG_DIR: overlayDir },
+		"claudeLaunchEnvDefaults must plant CLAUDE_CONFIG_DIR = overlayDir",
+	);
+
+	// idempotency — a second run yields the identical critical shape
+	ensureClaudeConfigOverlay(realDir, overlayDir);
+	const credSt = lstatSync(join(overlayDir, ".credentials.json"));
+	assert.ok(credSt.isSymbolicLink(), "credentials symlink must survive a second run");
+	const projSt = lstatSync(join(overlayDir, "projects"));
+	assert.ok(projSt.isDirectory() && !projSt.isSymbolicLink(), "projects must stay a real dir on re-run");
+	assert.throws(() => lstatSync(join(overlayDir, "plugins")), "stale plugins symlink must stay gone on re-run");
+
+	console.log(
+		`[check-acp-overlay] ok — overlay authors hooks:{} settings, symlinks ${OVERLAY_PASSTHROUGH.size}-entry whitelist, ` +
+			`shadows projects/sessions with private dirs, hides operator personal config, preserves binary-owned real files ` +
+			`while tearing down binary-owned/whitelist stale symlinks, plants CLAUDE_CONFIG_DIR, idempotent`,
+	);
+} finally {
+	rmSync(root, { recursive: true, force: true });
+}

package/scripts/check-acp-prompt-builder.ts

@@ -0,0 +1,191 @@
+// Deterministic gate for the S2d bootstrapPath-scoped ACP prompt builder (핀4).
+//
+// The S2c→S2d hazard: contextToAcpPrompt flattens the WHOLE transcript because
+// spawn-per-turn sessions hold no memory. Once S2d adds session reuse, sending
+// that whole transcript to a session that ALREADY remembers the prior turns
+// duplicates history. So the prompt SCOPE must follow bootstrapPath:
+//   - "new"                      → full transcript (the only history carrier)
+//   - "reuse" | "resume" | "load"→ latest user delta only (first user after the
+//                                  last assistant; the trailing-group FIRST user
+//                                  so the SessionStart hook message is skipped).
+//
+// This gate proves the split deterministically — BEFORE the session store that
+// produces the reuse paths exists, so the builder is correct the moment it is
+// wired. Pure/deterministic — IN pnpm check.
+
+import { strict as assert } from "node:assert";
+import type { Context } from "@earendil-works/pi-ai";
+import {
+	type AcpBootstrapPath,
+	buildAcpPrompt,
+	contextToAcpPrompt,
+	latestUserDelta,
+} from "../pi-extensions/lib/acp/context.ts";
+
+const REUSE_PATHS: AcpBootstrapPath[] = ["reuse", "resume", "load"];
+
+// A multi-turn context: a prior turn, an assistant answer, the real latest user
+// turn (with an image), and a SessionStart hook user-message appended AFTER it.
+function multiTurn(): Context {
+	return {
+		systemPrompt: "SECRET-SYSTEM-PROMPT",
+		tools: [{ name: "x", description: "d", parameters: {} as never }],
+		messages: [
+			{ role: "user", content: "first question", timestamp: 0 },
+			{
+				role: "assistant",
+				content: [{ type: "text", text: "an answer" }],
+				api: "x",
+				provider: "x",
+				model: "x",
+				usage: {
+					input: 0,
+					output: 0,
+					cacheRead: 0,
+					cacheWrite: 0,
+					totalTokens: 0,
+					cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+				},
+				stopReason: "stop",
+				timestamp: 0,
+			},
+			{
+				role: "user",
+				content: [
+					{ type: "image", data: "BASE64IMAGEDATA", mimeType: "image/png" },
+					{ type: "text", text: "follow up" },
+				],
+				timestamp: 0,
+			},
+			// pi appends the SessionStart hook AFTER the real prompt — the builder
+			// must NOT pick this as the latest user delta.
+			{ role: "user", content: "device=thinkpad time_kst=20260618T160000", timestamp: 0 },
+		],
+	};
+}
+
+// ---------------------------------------------------------------------------
+// 1) "new" → full transcript (identical to contextToAcpPrompt)
+// ---------------------------------------------------------------------------
+{
+	const ctx = multiTurn();
+	const prompt = buildAcpPrompt(ctx, "new");
+	assert.deepEqual(prompt, contextToAcpPrompt(ctx), '"new" is the full-transcript builder');
+	assert.equal(prompt.length, 1, '"new" is a single text block');
+	const text = prompt[0].text;
+	assert.match(text, /User: first question/, '"new" carries the prior user turn (history)');
+	assert.match(text, /Assistant: an answer/, '"new" carries the assistant turn');
+	assert.match(text, /follow up/, '"new" carries the latest user turn');
+	assert.ok(!text.includes("SECRET-SYSTEM-PROMPT"), '"new" never leaks systemPrompt');
+	assert.ok(!text.includes("BASE64IMAGEDATA"), '"new" never embeds raw image data');
+}
+
+// ---------------------------------------------------------------------------
+// 2) reuse / resume / load → latest user delta ONLY
+// ---------------------------------------------------------------------------
+for (const path of REUSE_PATHS) {
+	const ctx = multiTurn();
+	const prompt = buildAcpPrompt(ctx, path);
+	assert.deepEqual(prompt, latestUserDelta(ctx), `"${path}" is the delta builder`);
+	assert.equal(prompt.length, 1, `"${path}" is a single text block`);
+	const text = prompt[0].text;
+	// Only the real latest user turn — not prior history, not the hook message.
+	assert.match(text, /follow up/, `"${path}" carries the latest user turn`);
+	assert.ok(!text.includes("first question"), `"${path}" excludes prior history (no duplicate injection)`);
+	assert.ok(!text.includes("an answer"), `"${path}" excludes the assistant turn`);
+	assert.ok(
+		!text.includes("device=thinkpad"),
+		`"${path}" skips the SessionStart hook user-message (trailing-group FIRST user, not last)`,
+	);
+	// Image still leaves a marker, never raw data.
+	assert.match(text, /\[image omitted: image\/png\]/, `"${path}" keeps the image marker`);
+	assert.ok(!text.includes("BASE64IMAGEDATA"), `"${path}" never embeds raw image data`);
+}
+
+// ---------------------------------------------------------------------------
+// 3) delta differs from full transcript (the whole point)
+// ---------------------------------------------------------------------------
+{
+	const ctx = multiTurn();
+	assert.notDeepEqual(
+		buildAcpPrompt(ctx, "reuse"),
+		buildAcpPrompt(ctx, "new"),
+		"reuse delta must NOT equal the full-transcript new prompt",
+	);
+}
+
+// ---------------------------------------------------------------------------
+// 4) no assistant yet → first user of the whole context is the delta
+// ---------------------------------------------------------------------------
+{
+	const ctx: Context = {
+		messages: [
+			{ role: "user", content: "only question", timestamp: 0 },
+			{ role: "user", content: "device=thinkpad time_kst=x", timestamp: 0 },
+		],
+	};
+	const delta = latestUserDelta(ctx);
+	assert.equal(delta.length, 1, "delta exists when there is a user turn");
+	assert.equal(delta[0].text, "only question", "first user wins (hook message skipped) even with no assistant");
+}
+
+// ---------------------------------------------------------------------------
+// 5) trailing message is assistant (no user after it) → empty delta
+// ---------------------------------------------------------------------------
+{
+	const ctx: Context = {
+		messages: [
+			{ role: "user", content: "q", timestamp: 0 },
+			{
+				role: "assistant",
+				content: [{ type: "text", text: "a" }],
+				api: "x",
+				provider: "x",
+				model: "x",
+				usage: {
+					input: 0,
+					output: 0,
+					cacheRead: 0,
+					cacheWrite: 0,
+					totalTokens: 0,
+					cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+				},
+				stopReason: "stop",
+				timestamp: 0,
+			},
+		],
+	};
+	assert.deepEqual(latestUserDelta(ctx), [], "no user after the last assistant → empty delta");
+}
+
+// ---------------------------------------------------------------------------
+// 6) empty context → empty for every path
+// ---------------------------------------------------------------------------
+{
+	const empty: Context = { messages: [] };
+	assert.deepEqual(buildAcpPrompt(empty, "new"), [], "empty context → empty new prompt");
+	for (const path of REUSE_PATHS) {
+		assert.deepEqual(buildAcpPrompt(empty, path), [], `empty context → empty ${path} prompt`);
+	}
+}
+
+// ---------------------------------------------------------------------------
+// 7) unknown bootstrapPath → THROW (fail-loud, never silent delta-only)
+// ---------------------------------------------------------------------------
+// 핀4 safety: a bad path must crash, not quietly fall through to delta-only —
+// that would lose history on a path that should carry the full transcript.
+{
+	const ctx = multiTurn();
+	assert.throws(
+		() => buildAcpPrompt(ctx, "bogus" as AcpBootstrapPath),
+		/unknown bootstrapPath/,
+		"unknown bootstrapPath must crash, not silently delta-only (history loss is the fail-open hazard)",
+	);
+}
+
+console.log(
+	"[check-acp-prompt-builder] ok — bootstrapPath scopes the prompt: new=full transcript (history carrier), " +
+		"reuse/resume/load=latest user delta (first user after last assistant, SessionStart hook skipped, image marker " +
+		"kept, no raw image data, prior history excluded), no-assistant/trailing-assistant/empty edges, " +
+		"unknown bootstrapPath → throw (fail-loud, never silent delta-only)",
+);

package/scripts/check-acp-provider-surface.ts

@@ -0,0 +1,159 @@
+// Deterministic gate for the ACP provider registration surface (S0 loader/fence,
+// updated S2c when the real backend replaced the fail-loud stub).
+//
+// Three layers:
+//   (1 lib)     loads the REAL lib modules and asserts the curated Claude
+//               surface + no-auth sentinel shape;
+//   (2 entry)   COMPILES the project to a temp dir (root tsc emit, so the `.js`
+//               imports resolve to real emitted `.js`), imports the compiled
+//               acp-provider.js, and drives its default export against a fake pi
+//               that captures registerProvider — real execution capture of the
+//               actual entry, idempotency included, and that streamSimple is the
+//               real streamShellAcp backend (by name, NOT invoked — that spawns);
+//   (3 source)  an auxiliary source-shape lock on acp-provider.ts.
+//
+// Layer 2 is the GPT-reviewed resolution to a fence tension: acp-provider.ts
+// imports its lib with `.js` suffixes (the root/jiti runtime convention), which
+// plain `node --experimental-strip-types` cannot resolve to `.ts`. Rather than
+// force the entry onto a `.ts` strip-types fence (S0 avoids that) or collapse the
+// lib/acp split, the gate emits the real build artifact and imports THAT — so the
+// `.js` imports and the real default export both execute. Temp output lives under
+// .tmp-verify/ (forbidden from the npm tarball) and is removed after the run.
+
+import { strict as assert } from "node:assert";
+import { execFileSync } from "node:child_process";
+import { readFileSync, rmSync } from "node:fs";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+	CURATED_ANCHOR_MODEL_ID,
+	curatedClaudeModels,
+	ENTWURF_ACP_NO_AUTH_SENTINEL,
+	PROVIDER_ID,
+} from "../pi-extensions/lib/acp/models.ts";
+
+// ---------------------------------------------------------------------------
+// Layer 1 — lib-level surface (real modules, real behavior)
+// ---------------------------------------------------------------------------
+
+// Current pre-rename provider id. S1 must rename this load-bearing routing id to `entwurf` together with its gates.
+assert.equal(PROVIDER_ID, "entwurf", "PROVIDER_ID must match the current pre-rename provider id");
+
+// no-auth sentinel shape: lowercase + hyphen only, so pi does not read it as an
+// ENV reference. An ALL-CAPS value would trip the legacy-env path.
+assert.match(
+	ENTWURF_ACP_NO_AUTH_SENTINEL,
+	/^[a-z0-9-]+$/,
+	`no-auth sentinel must be lowercase+hyphen (got "${ENTWURF_ACP_NO_AUTH_SENTINEL}")`,
+);
+assert.equal(ENTWURF_ACP_NO_AUTH_SENTINEL, "entwurf-no-auth", "no-auth sentinel literal drifted");
+
+// curated Claude anchor present + full row shape.
+const models = curatedClaudeModels();
+assert.ok(models.length >= 1, "curated Claude surface must register at least one model");
+const ids = models.map((m) => m.id);
+assert.ok(
+	ids.includes(CURATED_ANCHOR_MODEL_ID),
+	`curated Claude anchor ${CURATED_ANCHOR_MODEL_ID} missing from surface: ${ids.join(", ")}`,
+);
+const REQUIRED_MODEL_FIELDS = ["id", "name", "reasoning", "input", "cost", "contextWindow", "maxTokens"] as const;
+for (const m of models) {
+	for (const field of REQUIRED_MODEL_FIELDS) {
+		assert.ok(field in m, `model ${m.id} missing required ProviderModelConfig field: ${field}`);
+	}
+	assert.ok(m.contextWindow > 0, `model ${m.id} contextWindow must be positive`);
+	assert.ok(m.maxTokens > 0, `model ${m.id} maxTokens must be positive`);
+}
+
+// S2c: the provider path is open — streamSimple is the REAL ACP backend, no
+// longer the S0 fail-loud stub. The wiring is verified through the compiled
+// entry (Layer 2) WITHOUT invoking it: streamShellAcp returns its stream
+// synchronously and spawns the backend on a microtask, so calling it in a
+// deterministic gate would launch a real child. Live behavior is proved by
+// smoke-acp-provider-live (LIVE-gated).
+
+// ---------------------------------------------------------------------------
+// Layer 2 — real entry capture (compiled acp-provider.js driven by a fake pi)
+// ---------------------------------------------------------------------------
+
+interface CapturedCfg {
+	baseUrl?: string;
+	apiKey?: string;
+	api?: string;
+	models?: Array<{ id: string }>;
+	streamSimple?: (...args: unknown[]) => unknown;
+}
+
+const TMP_EMIT = ".tmp-verify/acp-entry-capture";
+rmSync(TMP_EMIT, { recursive: true, force: true });
+try {
+	// Root tsc emit (no input files → uses the root tsconfig's program), so the
+	// entry's `.js` imports resolve to real emitted siblings.
+	execFileSync("node_modules/.bin/tsc", ["--outDir", TMP_EMIT, "--rootDir", ".", "--noEmit", "false"], {
+		stdio: "pipe",
+	});
+
+	const entryUrl = pathToFileURL(resolve(TMP_EMIT, "pi-extensions/acp-provider.js")).href;
+	const mod = await import(entryUrl);
+
+	const calls: Array<{ id: string; cfg: CapturedCfg }> = [];
+	const fakePi = {
+		registerProvider(id: string, cfg: CapturedCfg) {
+			calls.push({ id, cfg });
+		},
+	};
+
+	// Drive the REAL default export twice — the second call must be a no-op.
+	mod.default(fakePi);
+	mod.default(fakePi);
+
+	assert.equal(
+		calls.length,
+		1,
+		`entry must register exactly once across two calls (idempotency) — got ${calls.length}`,
+	);
+	const cap = calls[0];
+	assert.equal(cap.id, PROVIDER_ID, `entry registered the wrong provider id: ${cap.id}`);
+	assert.equal(cap.cfg.apiKey, ENTWURF_ACP_NO_AUTH_SENTINEL, "entry apiKey is not the no-auth sentinel");
+	assert.equal(cap.cfg.api, "entwurf", "entry api field drifted");
+	const capIds = (cap.cfg.models ?? []).map((m) => m.id);
+	for (const want of ["claude-sonnet-4-6", CURATED_ANCHOR_MODEL_ID]) {
+		assert.ok(capIds.includes(want), `entry model surface missing ${want} (got: ${capIds.join(", ") || "none"})`);
+	}
+	assert.equal(typeof cap.cfg.streamSimple, "function", "entry streamSimple must be a function");
+	// Regression guard: the entry must wire the REAL backend (streamShellAcp),
+	// not the removed S0 stub. We check by name rather than invoking — invoking
+	// would spawn a real ACP child. The compiled fn keeps its source name.
+	assert.equal(
+		cap.cfg.streamSimple?.name,
+		"streamShellAcp",
+		`entry must wire the real streamShellAcp backend (got "${cap.cfg.streamSimple?.name}")`,
+	);
+} finally {
+	rmSync(TMP_EMIT, { recursive: true, force: true });
+}
+
+// ---------------------------------------------------------------------------
+// Layer 3 — auxiliary source-shape lock (pi-extensions/acp-provider.ts)
+// ---------------------------------------------------------------------------
+
+const entrySrc = readFileSync("pi-extensions/acp-provider.ts", "utf8");
+assert.ok(
+	!/apiKey:\s*["'`]/.test(entrySrc),
+	"entry must not assign apiKey a string literal — use the no-auth sentinel constant",
+);
+const registerCalls = entrySrc.match(/\.registerProvider\(/g) ?? [];
+assert.equal(
+	registerCalls.length,
+	1,
+	`entry must call registerProvider exactly once in source (found ${registerCalls.length})`,
+);
+// The entry must wire the real backend and must not reference the removed stub.
+assert.match(entrySrc, /streamSimple:\s*streamShellAcp\b/, "entry must wire streamSimple: streamShellAcp");
+assert.ok(!/backend-stub/.test(entrySrc), "entry must not import the removed S0 backend-stub");
+
+console.log(
+	`[check-acp-provider-surface] ok — compiled entry registers ${PROVIDER_ID} once (idempotent) with the no-auth ` +
+		`sentinel + curated Claude surface (sonnet + ${CURATED_ANCHOR_MODEL_ID}) + real streamShellAcp backend (S2c); ` +
+		`lib surface verified live (${models.length} model(s))`,
+);