@junghanacs/entwurf 0.12.0

package/scripts/smoke-acp-raw-turn-live.ts

@@ -0,0 +1,261 @@
+// S2a-2 — raw ACP backend pipe, one live turn. LIVE-gated, OUT of `pnpm check`.
+//
+//   LIVE=1 ./run.sh smoke-acp-raw-turn-live
+//
+// What this proves (and ONLY this): the pinned Claude ACP adapter
+// (@agentclientprotocol/claude-agent-acp@0.39.0) spawns, speaks the ACP wire
+// protocol over stdio NDJSON, and returns one real model turn. It is the
+// bytes-flow proof that the S2a dep surface is not just installable but
+// actually drivable — before any provider/overlay/streamSimple code (S2b+).
+//
+// Deliberately NOT here (S2b+ / forbidden ahead of the raw pipe):
+//   - no pi provider path, no streamSimple (backend-stub stays fail-loud);
+//   - no config overlay, no tool-narrowing, no identity carrier / engraving;
+//   - no _meta.systemPrompt (kept absent so the billing carrier never grows);
+//   - no mailbox-absence / overlay-active assertions (those need S2b).
+//
+// Boundary notes (GPT-reviewed):
+//   - launch source MUST be the resolved package bin. A silent PATH fallback
+//     would hide a dep-pin / pack miss, so it FAILS acceptance unless the
+//     operator sets ENTWURF_ACP_RAW_TURN_ALLOW_PATH_FALLBACK=1 (then the run
+//     is stamped "debug/non-acceptance").
+//   - cwd is a fresh mkdtemp scratch — this isolates the repo, NOT ~/.claude
+//     side effects. Without an overlay the adapter reads the operator's own
+//     local Claude auth/config; entwurf neither copies nor proxies it.
+
+import { strict as assert } from "node:assert";
+import { type ChildProcessByStdio, spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { mkdtemp, rm } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { Readable, Writable } from "node:stream";
+import { ndJsonStream, PROTOCOL_VERSION } from "@agentclientprotocol/sdk";
+import { connectAcpClient } from "../pi-extensions/lib/acp/acp-client.ts";
+import { terminateChild } from "./lib/acp-child-cleanup.ts";
+
+const REQUESTED_MODEL_ID = process.env.ENTWURF_ACP_RAW_TURN_MODEL ?? "claude-sonnet-4-6";
+const ALLOW_PATH_FALLBACK = process.env.ENTWURF_ACP_RAW_TURN_ALLOW_PATH_FALLBACK === "1";
+const RAW_TAIL_CAP = 64 * 1024; // cap captured raw NDJSON to 64KB tail on report.
+
+function fail(msg: string): never {
+	console.error(`[smoke-acp-raw-turn-live] FAIL: ${msg}`);
+	process.exit(1);
+}
+
+const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
+
+// Guard each RPC so a hung backend fails this smoke instead of the outer
+// process timeout — keeps the failure attributable to the right step.
+function withTimeout<T>(label: string, p: Promise<T>, ms: number): Promise<T> {
+	return Promise.race([
+		p,
+		sleep(ms).then((): never => {
+			throw new Error(`${label} timed out after ${ms}ms`);
+		}),
+	]);
+}
+
+if (process.env.LIVE !== "1") {
+	console.error("[smoke-acp-raw-turn-live] skipped — set LIVE=1 to run the real ACP turn.");
+	process.exit(0);
+}
+
+// ---------------------------------------------------------------------------
+// Launch resolution — package bin only (acceptance), PATH fallback is debug.
+// ---------------------------------------------------------------------------
+function resolveLaunch(): { command: string; args: string[]; source: string; acceptance: boolean } {
+	const require = createRequire(import.meta.url);
+	try {
+		const pkgJsonPath = require.resolve("@agentclientprotocol/claude-agent-acp/package.json");
+		const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf8")) as { bin?: string | Record<string, string> };
+		const binPath = typeof pkgJson.bin === "string" ? pkgJson.bin : pkgJson.bin?.["claude-agent-acp"];
+		if (binPath) {
+			return {
+				command: process.execPath,
+				args: [join(dirname(pkgJsonPath), binPath)],
+				source: "package:@agentclientprotocol/claude-agent-acp",
+				acceptance: true,
+			};
+		}
+		fail("@agentclientprotocol/claude-agent-acp resolved but exposes no bin entry");
+	} catch (err) {
+		if (!ALLOW_PATH_FALLBACK) {
+			fail(
+				`could not resolve @agentclientprotocol/claude-agent-acp package bin (${(err as Error).message}). ` +
+					"This is an acceptance failure — the dep pin / install is broken. Set " +
+					"ENTWURF_ACP_RAW_TURN_ALLOW_PATH_FALLBACK=1 only for debug.",
+			);
+		}
+	}
+	return {
+		command: "claude-agent-acp",
+		args: [],
+		source: "PATH:claude-agent-acp (debug/non-acceptance)",
+		acceptance: false,
+	};
+}
+
+// ---------------------------------------------------------------------------
+// Drive one turn.
+// ---------------------------------------------------------------------------
+async function main(): Promise<void> {
+	const launch = resolveLaunch();
+	const scratch = await mkdtemp(join(tmpdir(), "entwurf-s2a-raw-"));
+	console.error(`[smoke-acp-raw-turn-live] launch source: ${launch.source}`);
+	console.error(`[smoke-acp-raw-turn-live] scratch cwd:   ${scratch}`);
+	console.error(`[smoke-acp-raw-turn-live] model request:  ${REQUESTED_MODEL_ID}`);
+
+	const child: ChildProcessByStdio<Writable, Readable, Readable> = spawn(launch.command, launch.args, {
+		cwd: scratch,
+		env: { ...process.env },
+		stdio: ["pipe", "pipe", "pipe"],
+	}) as ChildProcessByStdio<Writable, Readable, Readable>;
+
+	const stderrTail: string[] = [];
+	child.stderr.on("data", (c) => {
+		stderrTail.push(c.toString());
+		if (stderrTail.length > 200) stderrTail.shift();
+	});
+
+	// Tee stdout so we capture the raw NDJSON bytes the SDK consumes.
+	let rawBytes = "";
+	child.stdout.on("data", (c) => {
+		rawBytes += c.toString();
+		if (rawBytes.length > RAW_TAIL_CAP * 2) rawBytes = rawBytes.slice(-RAW_TAIL_CAP);
+	});
+
+	const stdoutWeb = Readable.toWeb(child.stdout) as unknown as ReadableStream<Uint8Array>;
+	const stdinWeb = Writable.toWeb(child.stdin) as unknown as WritableStream<Uint8Array>;
+	const stream = ndJsonStream(stdinWeb, stdoutWeb);
+
+	let collectedText = "";
+	let unexpectedPermission = 0;
+	let unexpectedFileOp = 0;
+
+	const connection = connectAcpClient(stream as any, {
+		// agent text chunks land here as sessionUpdate notifications.
+		sessionUpdate: async (notification: any) => {
+			const u = notification?.update;
+			if (u?.sessionUpdate === "agent_message_chunk") {
+				const t = u?.content?.text;
+				if (typeof t === "string") collectedText += t;
+			}
+		},
+		// A raw "say OK" turn should need no tools / files. Anything else is
+		// unexpected — refuse and count it, then fail at the end.
+		requestPermission: async (): Promise<any> => {
+			unexpectedPermission++;
+			return { outcome: { outcome: "cancelled" } };
+		},
+		readTextFile: async (): Promise<any> => {
+			unexpectedFileOp++;
+			throw new Error("unexpected readTextFile in raw OK turn");
+		},
+		writeTextFile: async (): Promise<any> => {
+			unexpectedFileOp++;
+			throw new Error("unexpected writeTextFile in raw OK turn");
+		},
+	});
+
+	let failure: Error | null = null;
+	try {
+		// Acceptance precondition: the launch must be the resolved package bin.
+		if (!launch.acceptance) {
+			throw new Error("launch was a PATH fallback (debug) — not an acceptance PASS");
+		}
+
+		// 1) initialize
+		const init = await withTimeout(
+			"initialize",
+			connection.initialize({
+				protocolVersion: PROTOCOL_VERSION,
+				clientCapabilities: {},
+				clientInfo: { name: "entwurf-smoke", version: "s2a-raw" },
+			} as any),
+			30_000,
+		);
+		assert.ok(init, "initialize returned no result");
+		console.error(`[smoke-acp-raw-turn-live] initialize ok (protocolVersion=${(init as any)?.protocolVersion})`);
+
+		// 2) newSession — minimal: scratch cwd, no MCP, NO _meta (carrier absent).
+		const created = (await withTimeout(
+			"newSession",
+			connection.newSession({ cwd: scratch, mcpServers: [] } as any),
+			30_000,
+		)) as any;
+		const sessionId = created?.sessionId;
+		assert.ok(sessionId, "newSession returned no sessionId");
+		const available = Array.isArray(created?.models)
+			? created.models
+			: Array.isArray(created?.availableModels)
+				? created.availableModels
+				: undefined;
+		console.error(
+			`[smoke-acp-raw-turn-live] newSession ok (sessionId=${String(sessionId).slice(0, 12)}…` +
+				(available ? `, models=${available.map((m: any) => m?.modelId ?? m?.id ?? m).join(",")}` : "") +
+				")",
+		);
+
+		// 3) force the requested model — REQUIRED. If the adapter cannot honor
+		//    the switch, the "sonnet" claim would be a lie; fail loudly instead
+		//    of silently running the session default.
+		const setConfig = (connection as any).setSessionConfigOption;
+		if (typeof setConfig !== "function") {
+			throw new Error(
+				`setSessionConfigOption unsupported — cannot enforce ${REQUESTED_MODEL_ID}; S2a requires honest model enforcement`,
+			);
+		}
+		await withTimeout(
+			"setSessionConfigOption",
+			setConfig.call(connection, { sessionId, configId: "model", value: REQUESTED_MODEL_ID }),
+			30_000,
+		);
+		console.error(`[smoke-acp-raw-turn-live] model set -> ${REQUESTED_MODEL_ID}`);
+
+		// 4) prompt — one tiny turn, no carrier.
+		const promptResult = (await withTimeout(
+			"prompt",
+			connection.prompt({
+				sessionId,
+				prompt: [{ type: "text", text: "Reply with exactly OK and nothing else." }],
+			} as any),
+			120_000,
+		)) as any;
+		console.error(`[smoke-acp-raw-turn-live] prompt returned (stopReason=${promptResult?.stopReason})`);
+
+		// ---- assertions ----
+		assert.ok(promptResult, "prompt returned no result");
+		assert.equal(unexpectedPermission, 0, `unexpected permission request(s): ${unexpectedPermission}`);
+		assert.equal(unexpectedFileOp, 0, `unexpected file op(s): ${unexpectedFileOp}`);
+		assert.ok(rawBytes.trim().length > 0, "no raw NDJSON bytes captured from backend stdout");
+		const normalized = collectedText.replace(/\s+/g, " ").trim().toUpperCase();
+		assert.ok(
+			normalized.includes("OK"),
+			`agent text did not contain "OK" (got: ${JSON.stringify(collectedText.slice(0, 200))})`,
+		);
+
+		console.log("[smoke-acp-raw-turn-live] PASS — raw ACP turn drove a live model reply");
+		console.log(`  launch:    ${launch.source}`);
+		console.log(`  model:     ${REQUESTED_MODEL_ID}`);
+		console.log(`  reply:     ${JSON.stringify(collectedText.trim().slice(0, 120))}`);
+		console.log(`  rawBytes:  ${rawBytes.length} captured (NDJSON)`);
+	} catch (err) {
+		failure = err instanceof Error ? err : new Error(String(err));
+		console.error(`[smoke-acp-raw-turn-live] stderr tail:\n${stderrTail.slice(-20).join("")}`);
+		console.error(`[smoke-acp-raw-turn-live] raw NDJSON tail:\n${rawBytes.slice(-2048)}`);
+	} finally {
+		connection.close?.();
+		await terminateChild(child);
+		try {
+			await rm(scratch, { recursive: true, force: true });
+		} catch {
+			// scratch cleanup is best-effort
+		}
+	}
+
+	if (failure) fail(failure.message);
+}
+
+await main();

package/scripts/smoke-acp-session-reuse-live.ts

@@ -0,0 +1,172 @@
+// S2d-1b-2b — live in-memory session reuse acceptance. LIVE-gated, OUT of check.
+//
+//   LIVE=1 ./run.sh smoke-acp-session-reuse-live
+//
+// The deterministic gate (check-acp-session-reuse) proves the prompt SCOPE
+// (delta-only) and the wiring with a fake seam. This proves the REAL thing: a
+// process-scoped pi process drives TWO real ACP turns over ONE reused
+// claude-agent-acp child, and turn 2 — which sends ONLY the latest user delta —
+// gets an answer that depends on a codeword introduced in turn 1. That is only
+// possible if (a) the child/connection were actually reused (not respawned) and
+// (b) the live ACP session kept turn 1 in its own history (so the delta was
+// enough). A respawn-per-turn backend (S2c) would forget the codeword.
+//
+// It forces process-scoped by pushing the real `--entwurf-control` resident flag
+// into argv (resolveLifecyclePolicy reads process.argv), then calls the REAL
+// streamShellAcp (real overlay + real spawn) twice with the same sessionId.
+//
+// The one-shot exit0 half (a `pi -p` turn-scoped session tears down cleanly) is
+// owned by smoke-acp-provider-live — reuse must not regress it.
+
+import { strict as assert } from "node:assert";
+import { execFileSync } from "node:child_process";
+import { copyFileSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import type { Api, AssistantMessageEvent, Context, Model } from "@earendil-works/pi-ai";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-4-6";
+const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
+
+function fail(msg: string): never {
+	console.error(`[smoke-acp-session-reuse-live] FAIL: ${msg}`);
+	process.exit(1);
+}
+
+if (process.env.LIVE !== "1") {
+	console.error("[smoke-acp-session-reuse-live] skipped — set LIVE=1 to run the real 2-turn reuse acceptance.");
+	process.exit(0);
+}
+
+type Stream = AsyncIterable<AssistantMessageEvent> & {
+	result: () => Promise<{ stopReason: string; errorMessage?: string }>;
+};
+
+async function consume(stream: Stream): Promise<{ text: string; error?: string; done: boolean }> {
+	let text = "";
+	let error: string | undefined;
+	let done = false;
+	for await (const ev of stream) {
+		if (ev.type === "text_delta") text += ev.delta;
+		else if (ev.type === "done") done = true;
+		else if (ev.type === "error") error = ev.error.errorMessage ?? "error";
+	}
+	return { text, error, done };
+}
+
+const nonce = `${process.pid.toString(36)}${Date.now().toString(36)}`.toUpperCase();
+const codeword = `KIWI${nonce}`;
+const scratch = mkdtempSync(resolve(tmpdir(), "entwurf-reuse-"));
+const TMP_EMIT = resolve(REPO_ROOT, ".tmp-verify/acp-reuse-live");
+rmSync(TMP_EMIT, { recursive: true, force: true });
+
+async function main(): Promise<void> {
+	// Compile so backend.js's `.js` sibling imports resolve (same trick as gates).
+	execFileSync("node_modules/.bin/tsc", ["--outDir", TMP_EMIT, "--rootDir", ".", "--noEmit", "false"], {
+		cwd: REPO_ROOT,
+		stdio: "pipe",
+	});
+	// tsc emits only .ts→.js; the engraving carrier is a .md asset that ships
+	// alongside engraving.js in the real package, and backend.js reads it at its
+	// default path. Copy it into the emit tree so the carrier resolves (the
+	// deterministic check-acp-session-reuse gate does the same copyFileSync).
+	const promptsOut = resolve(TMP_EMIT, "pi-extensions/lib/acp/prompts");
+	mkdirSync(promptsOut, { recursive: true });
+	copyFileSync(resolve(REPO_ROOT, "pi-extensions/lib/acp/prompts/engraving.md"), resolve(promptsOut, "engraving.md"));
+	const backendUrl = pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend.js")).href;
+	const backend = (await import(backendUrl)) as any;
+
+	// Force process-scoped: the real resident flag makes resolveLifecyclePolicy
+	// pick `process-scoped`, so turn 2 reuses the in-memory child.
+	if (!process.argv.includes("--entwurf-control")) process.argv.push("--entwurf-control");
+
+	const model = { id: MODEL } as unknown as Model<Api>;
+	const options = { cwd: scratch, sessionId: "reuse-smoke" };
+
+	console.error(`[smoke-acp-session-reuse-live] repo:     ${REPO_ROOT}`);
+	console.error(`[smoke-acp-session-reuse-live] cwd:      ${scratch}`);
+	console.error(`[smoke-acp-session-reuse-live] model:    entwurf/${MODEL}`);
+	console.error(`[smoke-acp-session-reuse-live] codeword: ${codeword}`);
+
+	// --- turn 1 (new): introduce the codeword, full transcript ---
+	const turn1: Context = {
+		messages: [
+			{
+				role: "user",
+				content: `Remember this codeword: ${codeword}. Reply with exactly OK and nothing else.`,
+				timestamp: 0,
+			},
+		],
+	};
+	const r1 = await Promise.race([
+		consume(backend.streamShellAcp(model, turn1, options) as Stream),
+		new Promise<never>((_, rej) => setTimeout(() => rej(new Error("turn 1 timed out")), TURN_TIMEOUT_MS)),
+	]);
+	if (r1.error) fail(`turn 1 errored: ${r1.error}`);
+	if (!r1.done) fail("turn 1 did not complete");
+	console.error(`[smoke-acp-session-reuse-live] turn 1 reply: ${JSON.stringify(r1.text.slice(-120))}`);
+
+	// --- turn 2 (reuse): ask for the codeword, DELTA ONLY ---
+	const turn2: Context = {
+		messages: [
+			...turn1.messages,
+			{
+				role: "assistant",
+				content: [{ type: "text", text: r1.text || "OK" }],
+				api: "entwurf",
+				provider: "entwurf",
+				model: MODEL,
+				usage: {
+					input: 0,
+					output: 0,
+					cacheRead: 0,
+					cacheWrite: 0,
+					totalTokens: 0,
+					cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+				},
+				stopReason: "stop",
+				timestamp: 0,
+			},
+			{
+				role: "user",
+				content: "What codeword did I ask you to remember? Reply with exactly that codeword and nothing else.",
+				timestamp: 0,
+			},
+		],
+	};
+	const r2 = await Promise.race([
+		consume(backend.streamShellAcp(model, turn2, options) as Stream),
+		new Promise<never>((_, rej) => setTimeout(() => rej(new Error("turn 2 timed out")), TURN_TIMEOUT_MS)),
+	]);
+	if (r2.error) fail(`turn 2 errored: ${r2.error}`);
+	if (!r2.done) fail("turn 2 did not complete");
+	console.error(`[smoke-acp-session-reuse-live] turn 2 reply: ${JSON.stringify(r2.text.slice(-120))}`);
+
+	// The codeword only lives in turn 1. Turn 2 sent only the delta question, so a
+	// correct answer proves the reused live ACP session remembered turn 1.
+	assert.ok(
+		r2.text.includes(codeword),
+		`turn 2 reply did not contain the turn-1 codeword ${codeword} — reuse/memory failed (reply: ${JSON.stringify(r2.text.slice(-200))})`,
+	);
+
+	console.log(
+		"[smoke-acp-session-reuse-live] PASS — 2-turn reuse over one ACP child; turn-2 delta recalled the turn-1 codeword",
+	);
+	console.log(`  model:    entwurf/${MODEL}`);
+	console.log(`  codeword: ${codeword} recalled in turn 2 (delta-only)`);
+}
+
+main()
+	.then(() => {
+		// retained child is SIGKILLed by the backend's process 'exit' hook.
+		process.exit(0);
+	})
+	.catch((err) => {
+		fail(err instanceof Error ? err.message : String(err));
+	})
+	.finally(() => {
+		rmSync(scratch, { recursive: true, force: true });
+		rmSync(TMP_EMIT, { recursive: true, force: true });
+	});

package/scripts/smoke-acp-skill-live.ts

@@ -0,0 +1,144 @@
+// S2g LIVE 2 — operator skillPlugins passthrough acceptance. LIVE-gated, OUT of
+// `pnpm check`.
+//
+//   LIVE=1 ./run.sh smoke-acp-skill-live
+//
+// The other half of the GLG baseline ("the model knows no skills either"). The
+// deterministic gate proved the resolved config carries `skillPlugins` +
+// auto-adds `Skill`/`Skill(*)` and that `_meta.claudeCode.options.plugins`
+// reaches `newSession`. This live smoke proves the last mile: a real ACP child
+// loads the plugin and the model can SURFACE/USE the skill.
+//
+// Method (GPT `…2f9325` LIVE 2): a temp skill plugin (.claude-plugin/plugin.json
+// + skills/<name>/SKILL.md) whose SKILL.md body carries a per-run nonce and an
+// instruction to emit it. A scratch `.pi/settings.json` points
+// `entwurfProvider.skillPlugins` at the plugin dir. The prompt asks the model
+// to use that skill and report the nonce. The nonce lives ONLY in the skill body,
+// so it cannot appear unless the skill reached the session's tool schema and the
+// model activated it.
+//
+// Model-in-loop skill activation is inherently a bit more brittle than the MCP
+// probe (the model must choose to invoke the skill), so the failure message
+// surfaces whether the Skill tool was even offered. Pre-S2g (skillPlugins:[]
+// hardcoded) this smoke FAILS: the skill is never loaded.
+
+import { strict as assert } from "node:assert";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-4-6";
+const PROVIDER = "entwurf";
+const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
+
+function fail(msg: string): never {
+	console.error(`[smoke-acp-skill-live] FAIL: ${msg}`);
+	process.exit(1);
+}
+
+if (process.env.LIVE !== "1") {
+	console.error("[smoke-acp-skill-live] skipped — set LIVE=1 to run the real pi provider turn.");
+	process.exit(0);
+}
+
+const STUB_PATTERN = /AcpBackendNotImplementedError|not implemented in S0/i;
+
+const scratch = mkdtempSync(join(tmpdir(), "entwurf-s2g-skill-"));
+try {
+	const nonce = `SKILL_${process.pid.toString(36)}${Date.now().toString(36)}`;
+	const skillName = "probe-secret";
+
+	// Build the temp skill plugin (the minimum shape the validator accepts).
+	const pluginDir = join(scratch, "plugin");
+	mkdirSync(join(pluginDir, ".claude-plugin"), { recursive: true });
+	writeFileSync(
+		join(pluginDir, ".claude-plugin", "plugin.json"),
+		`${JSON.stringify({ name: "entwurf-s2g-probe-plugin", description: "S2g live skill passthrough probe." }, null, 2)}\n`,
+	);
+	const skillDir = join(pluginDir, "skills", skillName);
+	mkdirSync(skillDir, { recursive: true });
+	writeFileSync(
+		join(skillDir, "SKILL.md"),
+		[
+			"---",
+			`name: ${skillName}`,
+			"description: Reveals this project's secret probe code. Use it whenever the user asks for the probe secret code.",
+			"---",
+			"",
+			`# ${skillName}`,
+			"",
+			`The secret probe code is ${nonce}.`,
+			"",
+			"When this skill is used, reply with exactly that code and nothing else.",
+			"",
+		].join("\n"),
+	);
+
+	// Register the plugin via the operator skillPlugins surface.
+	mkdirSync(join(scratch, ".pi"), { recursive: true });
+	writeFileSync(
+		join(scratch, ".pi", "settings.json"),
+		`${JSON.stringify({ entwurfProvider: { skillPlugins: [pluginDir] } }, null, 2)}\n`,
+	);
+
+	const prompt =
+		`Use the ${skillName} skill to obtain this project's secret probe code, then reply with exactly ` +
+		"that code and nothing else.";
+
+	console.error(`[smoke-acp-skill-live] repo:   ${REPO_ROOT}`);
+	console.error(`[smoke-acp-skill-live] cwd:    ${scratch}`);
+	console.error(`[smoke-acp-skill-live] model:  ${PROVIDER}/${MODEL}`);
+	console.error(`[smoke-acp-skill-live] skill:  ${skillName} (nonce ${nonce} only inside SKILL.md)`);
+
+	const args = [
+		"--no-extensions",
+		"-e",
+		REPO_ROOT,
+		"--mode",
+		"text",
+		"-p",
+		"--approve",
+		"--provider",
+		PROVIDER,
+		"--model",
+		MODEL,
+		prompt,
+	];
+	const res = spawnSync("pi", args, { cwd: scratch, encoding: "utf8", timeout: TURN_TIMEOUT_MS, env: process.env });
+	const stdout = res.stdout ?? "";
+	const combined = `${stdout}\n${res.stderr ?? ""}`;
+	const tail = combined.split("\n").slice(-30).join("\n");
+	if (res.error) {
+		console.error(`[smoke-acp-skill-live] output tail:\n${tail}`);
+		fail(`pi spawn failed: ${res.error.message}`);
+	}
+	assert.ok(!STUB_PATTERN.test(combined), "S0 stub fired — provider path did not open");
+	if (res.status !== 0) {
+		console.error(`[smoke-acp-skill-live] output tail:\n${tail}`);
+		fail(`pi exited ${res.status}`);
+	}
+	const sawSkillTool = /\[tool:(start|running)\]\s+Skill/i.test(combined);
+	assert.ok(
+		stdout.includes(nonce),
+		`reply did not carry the skill nonce ${nonce} — the operator skill plugin was not loaded/usable ` +
+			`(S2g skillPlugins passthrough failure). Skill tool notice ${sawSkillTool ? "WAS" : "was NOT"} seen. ` +
+			`stdout tail: ${JSON.stringify(stdout.slice(-300))}`,
+	);
+
+	console.log(
+		"[smoke-acp-skill-live] PASS — the operator-declared skill plugin reached the live ACP session: the model",
+	);
+	console.log(`  used the ${skillName} skill and returned ${nonce} (the nonce lives only inside SKILL.md).`);
+	console.log(
+		`  model: ${PROVIDER}/${MODEL}; Skill tool notice ${sawSkillTool ? "observed" : "not observed (reply-only evidence)"}`,
+	);
+} finally {
+	try {
+		rmSync(scratch, { recursive: true, force: true });
+	} catch {
+		// best-effort cleanup
+	}
+}