@junghanacs/entwurf 0.12.0

package/scripts/smoke-meta-honesty.sh

@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+#
+# smoke-meta-honesty — 1.0.0 meta-bridge: the HONESTY regression gate (#30 bbot
+# "release blockers" review). Two surfaces whose whole value is telling the truth:
+#
+#   PART A — doorbell count (blocker #1). doorbell.sh must count EVERY queued
+#     *.msg, deliver them ALL to *.msg.delivered, and announce the real N with an
+#     honest singular/plural. The old bug saw `ls | head -1`, mv'd one, and
+#     hard-coded "1 unread" — a lying count, which for a project whose core value
+#     is honesty is a release blocker.
+#
+#   PART B — hook level logging (blocker #2) + sender-marker evidence. A silent
+#     registration miss is the dangerous case: the session opens fine but never
+#     becomes a garden citizen. The runtime hook must STAY best-effort (no terminal
+#     scream), but it must log a failure as ` ERROR ` so the doctor — the fail-loud
+#     surface — can grep it. A normal create/attach must NOT emit ERROR (no false
+#     alarm), and must log sender-marker evidence so send-side replyable identity
+#     is not silently lost.
+#
+# Deterministic + offline (no `claude -p`, no network). Safe for pnpm check /
+# pre-commit. Isolates its store via PI_CODING_AGENT_DIR in a temp dir.
+#
+# RUNTIME DEPS: bash + node (the hook runs under `node --experimental-strip-types`)
+# + python3 (doorbell.sh parses the FileChanged stdin JSON with python3). NOT pure
+# "node+bash" — the doctor (Phase 2) must verify python3 too.
+#
+# USAGE: ./run.sh smoke-meta-honesty
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/.." && pwd)"
+DOORBELL="$REPO/pi/meta-bridge/entwurf-meta-receive/scripts/doorbell.sh"
+HOOK="$REPO/pi-extensions/meta-bridge-hook.ts"
+
+NODE_BIN="$(command -v node || true)"
+[ -n "$NODE_BIN" ] || { echo "FAIL: node not on PATH (the hook needs strip-types)"; exit 1; }
+command -v python3 >/dev/null || { echo "FAIL: python3 not on PATH (doorbell.sh parses the FileChanged JSON with it)"; exit 1; }
+
+fail=0
+ok()  { echo "  ok    $*"; }
+bad() { echo "  FAIL  $*"; fail=1; }
+
+TMP="$(mktemp -d -t psa-meta-honesty.XXXXXX)"
+cleanup() { rm -rf "$TMP"; }
+trap cleanup EXIT
+
+echo "smoke-meta-honesty (store=$TMP/agent)"
+
+# ---------------------------------------------------------------------------
+# PART A — doorbell count honesty
+# ---------------------------------------------------------------------------
+echo "[A] doorbell count (blocker #1)"
+
+# Run the doorbell against a mailbox holding $1 .msg files; capture the stderr
+# notice + exit code. The poked signal's dirname IS the garden mailbox.
+doorbell_run() {
+  local n="$1" gid="$2"
+  local mb="$TMP/mb/$gid"
+  rm -rf "$mb"; mkdir -p "$mb"
+  local i
+  for ((i = 1; i <= n; i++)); do printf 'body %d\n' "$i" > "$mb/msg-$i.msg"; done
+  DOORBELL_OUT="$(echo "{\"file_path\":\"$mb/inbox.signal\"}" | bash "$DOORBELL" 2>&1)" && DOORBELL_RC=0 || DOORBELL_RC=$?
+  # Count via find (pipefail-safe: no `ls` exit-2 on an empty glob killing the run).
+  DOORBELL_DELIVERED="$(find "$mb" -maxdepth 1 -name '*.msg.delivered' | wc -l | tr -d ' ')"
+  DOORBELL_LEFT="$(find "$mb" -maxdepth 1 -name '*.msg' | wc -l | tr -d ' ')"
+}
+
+# 2 messages -> "2 unread mailbox messages", both delivered, exit 2 (wake)
+doorbell_run 2 "20260606T101759-aaaaaa"
+if echo "$DOORBELL_OUT" | grep -q "2 unread mailbox messages"; then ok "2 msgs announced as '2 ... messages'"; else bad "2 msgs NOT announced honestly: $DOORBELL_OUT"; fi
+[ "$DOORBELL_DELIVERED" = "2" ] && ok "2 msgs ALL delivered (.delivered=$DOORBELL_DELIVERED)" || bad "2 msgs: expected 2 delivered, got $DOORBELL_DELIVERED"
+[ "$DOORBELL_LEFT" = "0" ] && ok "no undelivered .msg left behind" || bad "$DOORBELL_LEFT .msg left undelivered (count under-reach)"
+[ "$DOORBELL_RC" = "2" ] && ok "exit 2 (wake)" || bad "expected exit 2 (wake), got $DOORBELL_RC"
+
+# 1 message -> honest SINGULAR. Match the full phrase (not a `\b` word boundary,
+# which is a GNU-grep extension unreliable on BSD/macOS grep — this repo is
+# Linux+macOS), and assert the plural form is absent.
+doorbell_run 1 "20260606T101759-bbbbbb"
+if echo "$DOORBELL_OUT" | grep -q "1 unread mailbox message available" && ! echo "$DOORBELL_OUT" | grep -q "1 unread mailbox messages"; then
+  ok "1 msg announced as singular '1 ... message'"
+else
+  bad "1 msg singular/plural wrong: $DOORBELL_OUT"
+fi
+
+# 0 messages -> no wake (exit 0), nothing delivered
+doorbell_run 0 "20260606T101759-cccccc"
+[ "$DOORBELL_RC" = "0" ] && ok "empty mailbox: exit 0 (no false wake)" || bad "empty mailbox should exit 0, got $DOORBELL_RC"
+
+# BACKLOG: an earlier doorbell rang for a message the model never read (still a
+# *.msg.delivered, which entwurf_inbox_read WILL drain) + a fresh *.msg arrives.
+# True unread = 2. Counting only the fresh one would be "1 unread" — the same lie
+# one layer deeper. The notice must match what the read tool returns.
+BL="$TMP/mb/20260606T101759-dddddd"; rm -rf "$BL"; mkdir -p "$BL"
+printf 'old unread (rung, never read)\n' > "$BL/old.msg.delivered"
+printf 'fresh arrival\n' > "$BL/new.msg"
+BL_OUT="$(echo "{\"file_path\":\"$BL/inbox.signal\"}" | bash "$DOORBELL" 2>&1)" && BL_RC=0 || BL_RC=$?
+BL_DELIV="$(find "$BL" -maxdepth 1 -name '*.msg.delivered' | wc -l | tr -d ' ')"
+if echo "$BL_OUT" | grep -q "2 unread mailbox messages"; then ok "backlog .delivered + fresh .msg counted as 2 (not 1)"; else bad "backlog count lied: $BL_OUT"; fi
+[ "$BL_DELIV" = "2" ] && ok "backlog: both end as .msg.delivered (read tool drains 2)" || bad "backlog: expected 2 .delivered, got $BL_DELIV"
+[ "$BL_RC" = "2" ] && ok "backlog: fresh arrival triggers wake (exit 2)" || bad "backlog: expected exit 2, got $BL_RC"
+
+# ---------------------------------------------------------------------------
+# PART B — hook level logging
+# ---------------------------------------------------------------------------
+echo "[B] hook ERROR logging (blocker #2)"
+
+export PI_CODING_AGENT_DIR="$TMP/agent"
+HOOK_LOG="$TMP/agent/meta-bridge-hook.log"
+run_hook() { echo "$1" | "$NODE_BIN" --experimental-strip-types "$HOOK" >/dev/null 2>&1 || true; }
+
+# Normal SessionStart create -> INFO, NO ERROR (no false alarm).
+rm -f "$HOOK_LOG"
+run_hook "{\"hook_event_name\":\"SessionStart\",\"session_id\":\"native-ok-1\",\"transcript_path\":\"$TMP/t.jsonl\",\"cwd\":\"$TMP\"}"
+if grep -q ' INFO .*create record' "$HOOK_LOG" 2>/dev/null; then ok "normal create logs INFO"; else bad "normal create did not log INFO ($HOOK_LOG)"; fi
+if grep -q ' INFO sender marker ' "$HOOK_LOG" 2>/dev/null; then ok "normal create writes sender marker evidence (send-side replyable meta-session)"; else bad "normal create did not log sender marker evidence ($HOOK_LOG)"; fi
+if grep -q ' ERROR ' "$HOOK_LOG" 2>/dev/null; then bad "normal create emitted a FALSE ERROR: $(grep ' ERROR ' "$HOOK_LOG")"; else ok "normal create emits no ERROR (no false alarm)"; fi
+
+# Silent-miss path: duplicate nativeSessionId in the store makes scanByNativeId
+# throw -> upsert fails -> the session is NOT a garden citizen. Must log ` ERROR `
+# so the doctor can catch it, but must NOT scream (hook still exits 0).
+STORE="$TMP/agent/meta-sessions"
+REC="$(ls "$STORE"/*.meta.json | head -1)"
+cp "$REC" "$STORE/decoy-dup.meta.json"   # same nativeSessionId body, different filename -> ambiguity
+rm -f "$HOOK_LOG"
+echo "{\"hook_event_name\":\"SessionStart\",\"session_id\":\"native-ok-1\",\"transcript_path\":\"$TMP/t.jsonl\",\"cwd\":\"$TMP\"}" \
+  | "$NODE_BIN" --experimental-strip-types "$HOOK" >/dev/null 2>&1; HOOK_RC=$?
+if grep -q ' ERROR .*upsert failed' "$HOOK_LOG" 2>/dev/null; then ok "duplicate nativeId logs ERROR (doctor-catchable silent miss)"; else bad "duplicate nativeId did NOT log ERROR: $(cat "$HOOK_LOG" 2>/dev/null)"; fi
+[ "$HOOK_RC" = "0" ] && ok "hook stays best-effort (exit 0, no terminal scream) on failure" || bad "hook should exit 0 on best-effort failure, got $HOOK_RC"
+
+# Degraded SessionStart (missing transcript_path) = the session FAILED to become a
+# garden citizen = silent registration miss -> ERROR (not WARN), still best-effort.
+rm -f "$HOOK_LOG"
+echo "{\"hook_event_name\":\"SessionStart\",\"session_id\":\"native-degraded\",\"cwd\":\"$TMP\"}" \
+  | "$NODE_BIN" --experimental-strip-types "$HOOK" >/dev/null 2>&1; DEG_RC=$?
+if grep -q ' ERROR .*degraded envelope' "$HOOK_LOG" 2>/dev/null; then ok "degraded SessionStart logs ERROR (silent miss)"; else bad "degraded SessionStart did NOT log ERROR: $(cat "$HOOK_LOG" 2>/dev/null)"; fi
+[ "$DEG_RC" = "0" ] && ok "degraded SessionStart stays best-effort (exit 0)" || bad "degraded SessionStart should exit 0, got $DEG_RC"
+
+# Degraded UserPromptSubmit is only a best-effort backfill, never a citizenship
+# event -> WARN, and must NOT raise a false ERROR.
+rm -f "$HOOK_LOG"
+echo "{\"hook_event_name\":\"UserPromptSubmit\",\"session_id\":\"native-degraded\",\"cwd\":\"$TMP\"}" \
+  | "$NODE_BIN" --experimental-strip-types "$HOOK" >/dev/null 2>&1 || true
+if grep -q ' WARN .*degraded envelope' "$HOOK_LOG" 2>/dev/null; then ok "degraded UserPromptSubmit logs WARN"; else bad "degraded UserPromptSubmit did NOT log WARN: $(cat "$HOOK_LOG" 2>/dev/null)"; fi
+if grep -q ' ERROR ' "$HOOK_LOG" 2>/dev/null; then bad "degraded UserPromptSubmit raised a FALSE ERROR: $(grep ' ERROR ' "$HOOK_LOG")"; else ok "degraded UserPromptSubmit raises no false ERROR"; fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "smoke-meta-honesty: PASS"; else echo "smoke-meta-honesty: FAIL (see above)"; exit 1; fi

package/scripts/smoke-meta-install-state.sh

@@ -0,0 +1,403 @@
+#!/usr/bin/env bash
+# smoke-meta-install-state — deterministic Phase-2 gate for stateful install /
+# uninstall / doctor hardening. Offline: no real claude CLI, no user config.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/.." && pwd)"
+export REPO
+STATE="$REPO/scripts/meta-bridge-state.py"
+STORE_DOCTOR="$REPO/scripts/meta-bridge-store-doctor.ts"
+# shellcheck source=scripts/meta-bridge-hook-log.sh
+source "$REPO/scripts/meta-bridge-hook-log.sh"
+
+command -v python3 >/dev/null || { echo "FAIL: python3 not on PATH"; exit 1; }
+command -v node >/dev/null || { echo "FAIL: node not on PATH"; exit 1; }
+
+fail=0
+ok()  { echo "  ok    $*"; }
+bad() { echo "  FAIL  $*"; fail=1; }
+
+TMP="$(mktemp -d -t psa-meta-install-state.XXXXXX)"
+cleanup() { rm -rf "$TMP"; }
+trap cleanup EXIT
+
+export HOME="$TMP/home"
+export CLAUDE_CONFIG_DIR="$HOME/.claude"
+mkdir -p "$CLAUDE_CONFIG_DIR"
+ASM="$TMP/assembled-marketplace"
+export ASM
+mkdir -p "$ASM"
+
+cat > "$CLAUDE_CONFIG_DIR/settings.json" <<'JSON'
+{
+  "cleanupPeriodDays": 30,
+  "enabledPlugins": {
+    "entwurf-meta-receive@meta-bridge-local": false,
+    "keep@user": true
+  },
+  "permissions": {
+    "allow": ["Read", "CustomUserTool", "mcp__pi-tools-bridge__*"],
+    "deny": ["Agent"]
+  },
+  "env": {
+    "DISABLE_AUTOCOMPACT": "0",
+    "KEEP_ME": "yes"
+  },
+  "statusLine": {
+    "type": "command",
+    "command": "/old/user/statusline.sh"
+  },
+  "promptSuggestionEnabled": true,
+  "skipDangerousModePermissionPrompt": false,
+  "showTurnDuration": true
+}
+JSON
+cat > "$HOME/.claude.json" <<'JSON'
+{
+  "mcpServers": {
+    "entwurf-bridge": {
+      "type": "stdio",
+      "command": "old",
+      "args": ["old-start.sh"]
+    },
+    "keep-server": {
+      "type": "stdio",
+      "command": "keep"
+    }
+  }
+}
+JSON
+
+py() { python3 "$STATE" "$@" --repo "$REPO" --asm "$ASM"; }
+
+py prepare >/dev/null
+STATE_FILE="$CLAUDE_CONFIG_DIR/entwurf.install-state.json"
+[ -f "$STATE_FILE" ] && ok "prepare writes install-state before any merge" || bad "state file missing after prepare"
+if python3 - <<'PY'
+import json, os, stat
+path=os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
+assert stat.S_IMODE(os.stat(path).st_mode) == 0o600
+s=json.load(open(path))
+assert s['files']['settings']['keys']['enabledPlugins.entwurf-meta-receive@meta-bridge-local']['original']['value'] is False
+assert s['files']['settings']['keys']['cleanupPeriodDays']['original']['value'] == 30
+assert s['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']['original']['value'] == '0'
+assert s['files']['settings']['keys']['statusLine']['original']['value']['command'] == '/old/user/statusline.sh'
+assert s['files']['settings']['keys']['promptSuggestionEnabled']['original']['value'] is True
+assert s['files']['settings']['keys']['autoCompactEnabled']['original']['existed'] is False
+assert s['files']['claudeRoot']['keys']['mcpServers.entwurf-bridge']['original']['value']['command'] == 'old'
+PY
+then ok "state captures original scalar/map values and is mode 0600"; else bad "state did not capture original values / mode 0600"; fi
+
+py apply >/dev/null
+if python3 - <<'PY'
+import json, os
+cfg=os.environ['CLAUDE_CONFIG_DIR']
+settings=json.load(open(cfg + '/settings.json'))
+root=json.load(open(os.environ['HOME'] + '/.claude.json'))
+assert settings['enabledPlugins']['entwurf-meta-receive@meta-bridge-local'] is True
+assert settings['enabledPlugins']['keep@user'] is True
+assert settings['extraKnownMarketplaces']['meta-bridge-local']['source']['path'] == os.environ['ASM']
+assert settings['cleanupPeriodDays'] == 365
+assert settings['env']['DISABLE_AUTOCOMPACT'] == '1'
+assert settings['env']['KEEP_ME'] == 'yes'
+assert settings['statusLine']['command'] == os.environ['REPO'] + '/scripts/meta-bridge-statusline.sh'
+for key in ['promptSuggestionEnabled','awaySummaryEnabled','autoMemoryEnabled','verbose','autoCompactEnabled','showTurnDuration','terminalProgressBarEnabled','useAutoModeDuringPlan']:
+    assert settings[key] is False, key
+assert settings['skipDangerousModePermissionPrompt'] is True
+for item in ['Bash','Read','Write','Edit','Grep','Glob','WebFetch','WebSearch','Skill','mcp__entwurf-bridge__*']:
+    assert item in settings['permissions']['allow'], item
+assert settings['permissions']['allow'].count('Read') == 1
+# S2 rename cutover: the legacy pre-rename allow item is pruned, but an unrelated
+# user-authored allow item survives (prune is targeted, not a blanket wipe).
+assert 'mcp__pi-tools-bridge__*' not in settings['permissions']['allow']
+assert 'CustomUserTool' in settings['permissions']['allow']
+assert 'keep-server' in root['mcpServers']
+assert root['mcpServers']['entwurf-bridge']['env']['ENTWURF_BRIDGE_EXTERNAL_AGENT_ID'] == 'external-mcp/claude-code'
+PY
+then ok "apply installs managed keyset without clobbering unrelated keys"; else bad "apply keyset check failed"; fi
+
+# Keyset-survival guard (B1): once installed, `state.py check` is the
+# effect-based survival assertion doctor consumes. If another consumer
+# (agent-config merge, hand edit) overwrites a pi-owned key, check must fail loud
+# AND name the drifted key so doctor can surface which one. Adversarial flips
+# below; restore with apply afterward so the later cases see a clean keyset.
+if py check >/dev/null 2>&1; then ok "survival check passes on a freshly applied keyset"; else bad "survival check failed right after apply"; fi
+SURVIVAL_SNAP="$TMP/settings-survival-snapshot.json"
+cp "$CLAUDE_CONFIG_DIR/settings.json" "$SURVIVAL_SNAP"  # exact restore point (array-replace below would drop user items)
+python3 - <<'PY'
+import json, os
+p=os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'
+d=json.load(open(p)); d['verbose']=True  # a consumer/user clobbers a pi scalar
+json.dump(d, open(p,'w'), indent=2)
+PY
+ERR_SCALAR="$(py check 2>&1 >/dev/null || true)"
+if printf '%s' "$ERR_SCALAR" | grep -q 'verbose'; then ok "survival check fails and names an overwritten pi scalar (verbose)"; else bad "survival check did not name clobbered scalar: $ERR_SCALAR"; fi
+python3 - <<'PY'
+import json, os
+p=os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'
+d=json.load(open(p)); d['verbose']=False; d['permissions']['allow']=['OnlyUserTool']  # array REPLACE drops pi items
+json.dump(d, open(p,'w'), indent=2)
+PY
+ERR_ARRAY="$(py check 2>&1 >/dev/null || true)"
+if printf '%s' "$ERR_ARRAY" | grep -qi 'allow'; then ok "survival check fails when permissions.allow is array-replaced (pi items dropped)"; else bad "survival check did not catch dropped permissions.allow items: $ERR_ARRAY"; fi
+cp "$SURVIVAL_SNAP" "$CLAUDE_CONFIG_DIR/settings.json"  # back to clean keyset before the legacy-reinject case
+python3 - <<'PY'
+import json, os
+p=os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'
+d=json.load(open(p)); d['permissions']['allow'].append('mcp__pi-tools-bridge__*')  # someone re-injects the pruned legacy item
+json.dump(d, open(p,'w'), indent=2)
+PY
+ERR_LEGACY="$(py check 2>&1 >/dev/null || true)"
+if printf '%s' "$ERR_LEGACY" | grep -qi 'legacy'; then ok "survival check fails when a pruned legacy allow item is re-injected"; else bad "survival check did not catch re-injected legacy allow item: $ERR_LEGACY"; fi
+cp "$SURVIVAL_SNAP" "$CLAUDE_CONFIG_DIR/settings.json"  # exact restore so later cases see the clean installed keyset
+if py check >/dev/null 2>&1; then ok "survival check passes again after restoring the keyset"; else bad "keyset not restored after adversarial survival cases"; fi
+
+# Re-run prepare/apply after install: the original snapshot must remain the
+# pre-install values, not the already-managed values.
+py prepare >/dev/null
+py apply >/dev/null
+if python3 - <<'PY'
+import json, os
+s=json.load(open(os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'))
+assert s['files']['settings']['keys']['enabledPlugins.entwurf-meta-receive@meta-bridge-local']['original']['value'] is False
+assert s['files']['settings']['keys']['cleanupPeriodDays']['original']['value'] == 30
+assert s['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']['original']['value'] == '0'
+assert s['files']['settings']['keys']['statusLine']['original']['value']['command'] == '/old/user/statusline.sh'
+assert s['files']['settings']['keys']['promptSuggestionEnabled']['original']['value'] is True
+PY
+then ok "rerun preserves first pre-install snapshot"; else bad "rerun overwrote original snapshot"; fi
+
+# User changes after install: array additions should survive uninstall; scalar
+# managed toggles restore the original value by design.
+python3 - <<'PY'
+import json, os
+p=os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'
+d=json.load(open(p))
+d['permissions']['allow'].append('UserAfterInstall')
+d['permissions']['deny'].append('UserDeniedAfterInstall')
+json.dump(d, open(p,'w'), indent=2); open(p,'a').write('\n')
+PY
+py uninstall >/dev/null
+if python3 - <<'PY'
+import json, os
+settings=json.load(open(os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'))
+root=json.load(open(os.environ['HOME'] + '/.claude.json'))
+assert settings['cleanupPeriodDays'] == 30
+assert settings['enabledPlugins']['entwurf-meta-receive@meta-bridge-local'] is False
+assert 'meta-bridge-local' not in settings.get('extraKnownMarketplaces', {})
+assert settings['env']['DISABLE_AUTOCOMPACT'] == '0'
+assert settings['env']['KEEP_ME'] == 'yes'
+assert settings['statusLine']['command'] == '/old/user/statusline.sh'
+assert settings['promptSuggestionEnabled'] is True
+assert settings['skipDangerousModePermissionPrompt'] is False
+assert settings['showTurnDuration'] is True
+for key in ['awaySummaryEnabled','autoMemoryEnabled','verbose','autoCompactEnabled','terminalProgressBarEnabled','useAutoModeDuringPlan']:
+    assert key not in settings, key
+allow=settings['permissions']['allow']
+deny=settings['permissions']['deny']
+assert 'CustomUserTool' in allow and 'UserAfterInstall' in allow
+assert 'Bash' not in allow and 'mcp__entwurf-bridge__*' not in allow
+assert 'Agent' in deny and 'UserDeniedAfterInstall' in deny and 'TaskCreate' not in deny
+assert root['mcpServers']['entwurf-bridge']['command'] == 'old'
+assert 'keep-server' in root['mcpServers']
+assert not os.path.exists(os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json')
+PY
+then ok "uninstall restores scalars/maps and removes only managed array additions"; else bad "uninstall restoration check failed"; fi
+
+if py uninstall >/dev/null 2>&1; then bad "state manager uninstall without state should not guess"; else ok "state manager uninstall without state fails instead of guessing"; fi
+
+# The wrapper must ALSO refuse before side effects. A fake claude records whether
+# plugin/MCP removals were attempted; no state means the log must stay empty.
+FAKE_BIN="$TMP/fake-bin"; mkdir -p "$FAKE_BIN"
+cat > "$FAKE_BIN/claude" <<'SH'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >> "$FAKE_CLAUDE_LOG"
+exit 0
+SH
+chmod +x "$FAKE_BIN/claude"
+FAKE_CLAUDE_LOG="$TMP/fake-claude-nostate.log"
+if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
+  bad "wrapper uninstall without state should fail"
+else
+  if [ ! -s "$FAKE_CLAUDE_LOG" ]; then ok "wrapper uninstall without state has zero Claude side effects"; else bad "wrapper uninstall without state touched Claude: $(cat "$FAKE_CLAUDE_LOG")"; fi
+fi
+
+# With valid state, the wrapper may remove Claude registrations and then restore
+# JSON state. This proves the preflight gate is ordered before side effects.
+py prepare >/dev/null
+py apply >/dev/null
+FAKE_CLAUDE_LOG="$TMP/fake-claude-state.log"
+if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
+  if grep -q 'plugin uninstall entwurf-meta-receive@meta-bridge-local' "$FAKE_CLAUDE_LOG" && grep -q 'mcp remove entwurf-bridge -s user' "$FAKE_CLAUDE_LOG" && [ ! -f "$STATE_FILE" ]; then
+    ok "wrapper uninstall with valid state removes Claude registrations and restores state"
+  else
+    bad "wrapper uninstall with state missed expected side effects/state removal"
+  fi
+else
+  bad "wrapper uninstall with valid state failed"
+fi
+
+# Doctor hook-log recovery predicate: only a later `INFO armed watch` clears an
+# ERROR. A UserPromptSubmit `INFO attach record` is degraded backfill, not wake
+# recovery.
+HOOK_SYN="$TMP/hook-log"
+printf '2026-06-06T00:00:00.000Z ERROR arm failed\n' > "$HOOK_SYN"
+if meta_bridge_hook_log_status "$HOOK_SYN" >/dev/null 2>&1; then bad "hook-log predicate: ERROR-only should fail"; else ok "hook-log predicate fails on ERROR-only"; fi
+printf '2026-06-06T00:00:00.000Z ERROR arm failed\n2026-06-06T00:00:01.000Z INFO armed watch /tmp/inbox.signal\n' > "$HOOK_SYN"
+if meta_bridge_hook_log_status "$HOOK_SYN" >/dev/null; then ok "hook-log predicate recovers on later INFO armed watch"; else bad "hook-log predicate did not recover on armed watch"; fi
+printf '2026-06-06T00:00:00.000Z INFO armed watch /tmp/inbox.signal\n2026-06-06T00:00:01.000Z ERROR arm failed\n' > "$HOOK_SYN"
+if meta_bridge_hook_log_status "$HOOK_SYN" >/dev/null 2>&1; then bad "hook-log predicate: ERROR after armed watch should fail"; else ok "hook-log predicate fails when ERROR is newer than armed watch"; fi
+printf '2026-06-06T00:00:00.000Z ERROR arm failed\n2026-06-06T00:00:01.000Z INFO attach record x.meta.json (event=UserPromptSubmit, native=n)\n' > "$HOOK_SYN"
+if meta_bridge_hook_log_status "$HOOK_SYN" >/dev/null 2>&1; then bad "hook-log predicate: UserPromptSubmit attach must not recover"; else ok "hook-log predicate does not treat UserPromptSubmit attach as recovery"; fi
+printf '2026-06-06T00:00:00.000Z INFO attach record x.meta.json (event=UserPromptSubmit, native=n)\n' > "$HOOK_SYN"
+if meta_bridge_hook_log_status "$HOOK_SYN" >/dev/null; then ok "hook-log predicate passes when no ERROR exists"; else bad "hook-log predicate failed no-ERROR log"; fi
+
+# Migration: the Phase-0/1 installer may already have left exact pi-owned keys in
+# place before a state file existed. Exact managed plugin/marketplace/MCP values
+# are treated as legacy-owned-by-us (absent original), so uninstall removes them
+# instead of restoring the tribal install forever.
+python3 - <<'PY'
+import json, os
+cfg=os.environ['CLAUDE_CONFIG_DIR']; home=os.environ['HOME']; asm=os.environ['ASM']; repo=os.environ['REPO']
+settings={
+  'enabledPlugins': {'entwurf-meta-receive@meta-bridge-local': True},
+  'extraKnownMarketplaces': {'meta-bridge-local': {'source': {'source': 'directory', 'path': asm}}},
+  'permissions': {'allow': ['Read'], 'deny': ['Agent']},
+  'env': {'DISABLE_AUTOCOMPACT': '1'}
+}
+root={'mcpServers': {'entwurf-bridge': {'type':'stdio','command':'bash','args':[repo + '/mcp/entwurf-bridge/start.sh'],'env': {'ENTWURF_BRIDGE_EXTERNAL_AGENT_ID':'external-mcp/claude-code','ENTWURF_BRIDGE_REQUIRE_META_SENDER':'1'}}}}
+json.dump(settings, open(cfg + '/settings.json','w'), indent=2); open(cfg + '/settings.json','a').write('\n')
+json.dump(root, open(home + '/.claude.json','w'), indent=2); open(home + '/.claude.json','a').write('\n')
+PY
+py prepare >/dev/null
+if python3 - <<'PY'
+import json, os
+s=json.load(open(os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'))
+assert s['files']['settings']['keys']['enabledPlugins.entwurf-meta-receive@meta-bridge-local']['original']['existed'] is False
+assert s['files']['settings']['keys']['extraKnownMarketplaces.meta-bridge-local']['original']['existed'] is False
+assert s['files']['claudeRoot']['keys']['mcpServers.entwurf-bridge']['original']['existed'] is False
+assert s['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']['original']['existed'] is True
+PY
+then ok "legacy exact plugin/marketplace/MCP migrate as pi-owned absent, policy keys remain user-owned"; else bad "legacy migration state check failed"; fi
+py uninstall >/dev/null
+if python3 - <<'PY'
+import json, os
+settings=json.load(open(os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'))
+root=json.load(open(os.environ['HOME'] + '/.claude.json'))
+assert 'entwurf-meta-receive@meta-bridge-local' not in settings.get('enabledPlugins', {})
+assert 'meta-bridge-local' not in settings.get('extraKnownMarketplaces', {})
+assert 'entwurf-bridge' not in root.get('mcpServers', {})
+assert settings['env']['DISABLE_AUTOCOMPACT'] == '1'
+PY
+then ok "legacy migration uninstall removes pi-owned wiring but preserves policy scalar"; else bad "legacy migration uninstall check failed"; fi
+
+# Store-doctor hardening: valid store passes, corrupt/duplicate/drift fail loudly.
+valid_record() {
+  local gid="$1" native="$2"
+  cat <<JSON
+{
+  "schemaVersion": 1,
+  "gardenId": "$gid",
+  "backend": "claude-code",
+  "nativeSessionId": "$native",
+  "transcriptPath": "/tmp/$native.jsonl",
+  "cwd": "/tmp",
+  "createdAt": "2026-06-06T00:00:00.000Z",
+  "lastSeen": "2026-06-06T00:00:00.000Z",
+  "delivery": {
+    "wakeMode": "self-fetch",
+    "deliveryLevel": "D6",
+    "lastEnqueuedAt": null,
+    "lastDeliveredAt": null,
+    "lastReadAt": null
+  }
+}
+JSON
+}
+STORE="$TMP/store"; export STORE; mkdir -p "$STORE"
+valid_record "20260606T000000-aaaaaa" "native-a" > "$STORE/20260606T000000-aaaaaa.meta.json"
+valid_record "20260606T000001-bbbbbb" "native-b" > "$STORE/20260606T000001-bbbbbb.meta.json"
+
+STATUS_INPUT_MATCH='{"session_id":"native-a","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-4-6"},"context_window":{"context_window_size":200000,"used_percentage":2,"current_usage":{"input_tokens":10}}}'
+STATUS_INPUT_MISS='{"session_id":"native-missing","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-opus-4-8"}}'
+STATUS_INPUT_READY='{"workspace":{"current_dir":"/tmp"},"model":{"id":"claude-haiku-4-5"}}'
+STATUS_OUT_MATCH="$(printf '%s' "$STATUS_INPUT_MATCH" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+if [ "$(printf '%s\n' "$STATUS_OUT_MATCH" | wc -l | tr -d ' ')" = "2" ]; then ok "statusline renders exactly two rows"; else bad "statusline should render two rows: $STATUS_OUT_MATCH"; fi
+if printf '%s\n' "$STATUS_OUT_MATCH" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$STATUS_OUT_MATCH" | sed -n '2p' | grep -q '🪛 20260606T000000-aaaaaa cc | s'; then ok "statusline keeps row-1 work context and maps native session_id to row-2 garden-id"; else bad "statusline did not show expected two-row content for native-a: $STATUS_OUT_MATCH"; fi
+STATUS_OUT_MISS="$(printf '%s' "$STATUS_INPUT_MISS" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+if printf '%s' "$STATUS_OUT_MISS" | grep -q '🪛 ? cc'; then ok "statusline no-record fallback is ?"; else bad "statusline no-record fallback wrong: $STATUS_OUT_MISS"; fi
+STATUS_OUT_READY="$(printf '%s' "$STATUS_INPUT_READY" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+if printf '%s' "$STATUS_OUT_READY" | grep -q '🪛 ready cc'; then ok "statusline no-session_id fallback is ready"; else bad "statusline ready fallback wrong: $STATUS_OUT_READY"; fi
+cp "$STORE/20260606T000000-aaaaaa.meta.json" "$STORE/20260606T000003-dddddd.meta.json"
+STATUS_OUT_DUP="$(printf '%s' "$STATUS_INPUT_MATCH" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+if printf '%s' "$STATUS_OUT_DUP" | grep -q '🪛 ! cc'; then ok "statusline duplicate nativeSessionId fallback is !"; else bad "statusline duplicate fallback wrong: $STATUS_OUT_DUP"; fi
+rm "$STORE/20260606T000003-dddddd.meta.json"
+
+if node --experimental-strip-types "$STORE_DOCTOR" "$STORE" >/dev/null; then ok "store doctor accepts valid records"; else bad "store doctor rejected valid records"; fi
+cp "$STORE/20260606T000000-aaaaaa.meta.json" "$STORE/20260606T000002-cccccc.meta.json"
+if node --experimental-strip-types "$STORE_DOCTOR" "$STORE" >/dev/null 2>&1; then bad "store doctor missed body/filename drift + duplicate"; else ok "store doctor fails on body/filename drift and duplicate nativeSessionId"; fi
+rm "$STORE/20260606T000002-cccccc.meta.json"
+python3 - <<'PY'
+import json, os
+p=os.environ['STORE'] + '/20260606T000001-bbbbbb.meta.json'
+d=json.load(open(p)); d['delivery']['wakeMode']='direct-inject'; json.dump(d, open(p,'w'), indent=2); open(p,'a').write('\n')
+PY
+if node --experimental-strip-types "$STORE_DOCTOR" "$STORE" >/dev/null 2>&1; then bad "store doctor missed backend↔wakeMode contradiction"; else ok "store doctor fails on backend↔wakeMode contradiction"; fi
+
+# Doctor fail-loud regression (B1'): meta-bridge-doctor.sh must surface a managed-
+# config drift, NOT die silently at the "[managed config state]" header. A bare
+# CHECK_ERR="$(state.py check)" assignment under `set -e` exited the doctor the
+# instant check returned nonzero — so the operator saw the header and nothing
+# else; the very "which key drifted" detail the section exists to print was lost,
+# and every later section ([plugin install], [meta-record store], the SILENT-MISS
+# guard) never ran. The fix wraps the substitution as an `if` condition so its
+# nonzero status is consumed instead of tripping set -e. This gate forces a real
+# state drift behind a fully-faked claude toolchain (no real claude, no real
+# install-meta-bridge) and proves the doctor (a) still exits 1, (b) prints
+# "Drift detail:", (c) names the concrete drifted key, and (d) runs the WHOLE
+# chain to its final summary line — i.e. no early set -e death anywhere.
+DOC_HOME="$TMP/doctor-home"; DOC_CFG="$DOC_HOME/.claude"
+DOC_AGENT="$TMP/doctor-agent"; DOC_STORE="$DOC_AGENT/meta-sessions"
+DOC_BIN="$TMP/doctor-bin"; DOC_ASM="$REPO/pi/meta-bridge/.assembled"  # SAME asm the doctor's check uses, so only the MCP drifts
+mkdir -p "$DOC_CFG" "$DOC_STORE" "$DOC_BIN"
+echo '{}' > "$DOC_CFG/settings.json"
+echo '{}' > "$DOC_HOME/.claude.json"
+# A healthy claude-code meta-record so the SessionStart-evidence section is green
+# and the ONLY failure of record is the deliberate MCP drift.
+valid_record "20260606T120000-eeeeee" "doctor-native" > "$DOC_STORE/20260606T120000-eeeeee.meta.json"
+# Fake claude: a healthy toolchain so the doctor sails past every other section.
+cat > "$DOC_BIN/claude" <<'SH'
+#!/usr/bin/env bash
+case "$1${2:+ $2}" in
+  "--version") echo "2.1.167 (Claude Code)" ;;
+  "plugin list") printf '%s\n' "entwurf-meta-receive@meta-bridge-local" "  Status: enabled" ;;
+  "mcp get") printf '%s\n' "Scope: User config" "Status: ✔ Connected" ;;
+  *) : ;;
+esac
+exit 0
+SH
+chmod +x "$DOC_BIN/claude"
+# Build a valid install-state + managed keyset, then drift ONLY the user MCP.
+env HOME="$DOC_HOME" CLAUDE_CONFIG_DIR="$DOC_CFG" python3 "$STATE" prepare --repo "$REPO" --asm "$DOC_ASM" >/dev/null
+env HOME="$DOC_HOME" CLAUDE_CONFIG_DIR="$DOC_CFG" python3 "$STATE" apply   --repo "$REPO" --asm "$DOC_ASM" >/dev/null
+env HOME="$DOC_HOME" python3 - <<'PY'
+import json, os
+p = os.path.join(os.environ['HOME'], '.claude.json')
+d = json.load(open(p))
+d.setdefault('mcpServers', {})['entwurf-bridge'] = {'type': 'stdio', 'command': 'CLOBBERED-BY-ANOTHER-CONSUMER'}
+json.dump(d, open(p, 'w'), indent=2)
+PY
+# Capture without tripping THIS script's own set -e (the very trap under test).
+set +e
+DOC_OUT="$(env HOME="$DOC_HOME" CLAUDE_CONFIG_DIR="$DOC_CFG" PI_CODING_AGENT_DIR="$DOC_AGENT" ENTWURF_META_SESSIONS_DIR="$DOC_STORE" PATH="$DOC_BIN:$PATH" bash "$REPO/scripts/meta-bridge-doctor.sh" 2>&1)"
+DOC_CODE=$?
+set -e
+if [ "$DOC_CODE" -eq 1 ]; then ok "doctor exits 1 on a managed-config drift"; else bad "doctor exit on drift was $DOC_CODE, want 1:"$'\n'"$DOC_OUT"; fi
+if printf '%s\n' "$DOC_OUT" | grep -q 'Drift detail:'; then ok "doctor prints 'Drift detail:' instead of dying at the managed-config header"; else bad "doctor did not print Drift detail — silent early death?:"$'\n'"$DOC_OUT"; fi
+if printf '%s\n' "$DOC_OUT" | grep -q 'user MCP entwurf-bridge'; then ok "doctor names the concrete drifted key (user MCP entwurf-bridge)"; else bad "doctor did not name the drifted MCP key:"$'\n'"$DOC_OUT"; fi
+if printf '%s\n' "$DOC_OUT" | grep -q '\[plugin install'; then ok "doctor continues to a later section after the drift (no early set -e death)"; else bad "doctor did not reach a later section header after the drift:"$'\n'"$DOC_OUT"; fi
+if printf '%s\n' "$DOC_OUT" | grep -q 'meta-bridge doctor: FAIL'; then ok "doctor runs the whole chain to its final summary line"; else bad "doctor did not reach its final summary line (mid-run death):"$'\n'"$DOC_OUT"; fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "smoke-meta-install-state: PASS"; else echo "smoke-meta-install-state: FAIL (see above)"; exit 1; fi