@junghanacs/entwurf 0.12.1 → 0.12.3

package/scripts/check-acp-config.ts

@@ -58,7 +58,7 @@ function settings(name: string, block: unknown): string {
 function resolveWith(globalPath: string, projectPath: string, adapter: AcpBackendAdapter = claudeLikeFake) {
 	return resolveProviderConfig({
 		cwd: root,
-		modelId: "claude-sonnet-4-6",
+		modelId: "claude-sonnet-5",
 		adapter,
 		globalSettingsPath: globalPath,
 		projectSettingsPath: projectPath,
@@ -291,11 +291,11 @@ try {
 			weather: { type: "http", url: "https://w.test" },
 			other: { command: "x" },
 		}).servers;
-		const enriched = enrichMcpServersWithEnvelope(servers, { modelId: "claude-sonnet-4-6", piSessionId: "LIVE-1" });
+		const enriched = enrichMcpServersWithEnvelope(servers, { modelId: "claude-sonnet-5", piSessionId: "LIVE-1" });
 		const bridge = enriched.find((s) => s.name === "entwurf-bridge") as Extract<AcpMcpServer, { command: string }>;
 		const env = Object.fromEntries(bridge.env.map((e) => [e.name, e.value]));
 		assert.equal(env.PI_SESSION_ID, "LIVE-1", "live PI_SESSION_ID wins over the stale operator value");
-		assert.equal(env.PI_AGENT_ID, "entwurf/claude-sonnet-4-6", "PI_AGENT_ID injected from the model id");
+		assert.equal(env.PI_AGENT_ID, "entwurf/claude-sonnet-5", "PI_AGENT_ID injected from the model id");
 		assert.equal(env.FOO, "bar", "operator env preserved");
 		const weather = enriched.find((s) => s.name === "weather");
 		assert.ok(!("env" in (weather ?? {})), "http server not enriched (no env carrier)");

package/scripts/check-acp-event-mapper.ts

@@ -21,7 +21,7 @@ import {
 	finalizeAcpStreamState,
 } from "../pi-extensions/lib/acp/event-mapper.ts";
 
-const IDENTITY = { api: "entwurf", provider: "entwurf", model: "claude-sonnet-4-6" };
+const IDENTITY = { api: "entwurf", provider: "entwurf", model: "claude-sonnet-5" };
 
 // Drive a set of synthetic updates through a fresh mapper and collect every
 // emitted event (push is synchronous; the terminal done drains the queue).

package/scripts/check-acp-provider-surface.ts

@@ -117,7 +117,7 @@ try {
 	assert.equal(cap.cfg.apiKey, ENTWURF_ACP_NO_AUTH_SENTINEL, "entry apiKey is not the no-auth sentinel");
 	assert.equal(cap.cfg.api, "entwurf", "entry api field drifted");
 	const capIds = (cap.cfg.models ?? []).map((m) => m.id);
-	for (const want of ["claude-sonnet-4-6", CURATED_ANCHOR_MODEL_ID]) {
+	for (const want of ["claude-sonnet-5", CURATED_ANCHOR_MODEL_ID]) {
 		assert.ok(capIds.includes(want), `entry model surface missing ${want} (got: ${capIds.join(", ") || "none"})`);
 	}
 	assert.equal(typeof cap.cfg.streamSimple, "function", "entry streamSimple must be a function");

package/scripts/check-acp-sdk-surface.ts

@@ -1,16 +1,16 @@
 // Deterministic gate for the S2a ACP SDK dependency surface.
 //
-// Pins the ACP runtime deps to the 0.11.0 behavior-oracle versions and locks
+// Pins the ACP runtime deps to the current behavior-oracle versions and locks
 // the peer-resolution that makes the Claude ACP adapter satisfiable:
 //
-//   @agentclientprotocol/sdk              0.29.0   wire SDK (acp-bridge import source)
-//   @agentclientprotocol/claude-agent-acp 0.50.0   Claude adapter (spawn binary)
+//   @agentclientprotocol/sdk              1.1.0    wire SDK (acp-bridge import source)
+//   @agentclientprotocol/claude-agent-acp 0.54.1   Claude adapter (spawn binary)
 //   @anthropic-ai/sdk                     0.100.1  peer-resolution pin ONLY (see below)
 //
 // The anthropic SDK is NOT an API client / auth surface here. It is a direct
-// dep solely to satisfy @anthropic-ai/claude-agent-sdk@0.3.186's peer floor
+// dep solely to satisfy @anthropic-ai/claude-agent-sdk@0.3.197's peer floor
 // (>=0.93.0); drop it and the tree resolves a stale 0.91.1 so the peer goes
-// unmet — a failure that would only surface at the first raw turn. 0.11.0's
+// unmet — a failure that would only surface at the first raw turn. The
 // lockfile proves the same shape. Source-level import / API-client
 // instantiation / credential use stays forbidden — asserted in layer (4).
 // (GPT hard constraint 2, revised 2026-06-18: direct dep allowed ONLY as an
@@ -42,15 +42,15 @@ const read = (p: string): string => readFileSync(resolve(repoRoot, p), "utf8");
 const pkg = JSON.parse(read("package.json")) as { dependencies?: Record<string, string> };
 const deps = pkg.dependencies ?? {};
 const PINS: Record<string, string> = {
-	"@agentclientprotocol/sdk": "0.29.0",
-	"@agentclientprotocol/claude-agent-acp": "0.50.0",
+	"@agentclientprotocol/sdk": "1.1.0",
+	"@agentclientprotocol/claude-agent-acp": "0.54.1",
 	[ANTHROPIC_SDK]: "0.100.1",
 };
 for (const [name, ver] of Object.entries(PINS)) {
 	assert.equal(
 		deps[name],
 		ver,
-		`package.json dependencies["${name}"] must be exact "${ver}" (got "${deps[name]}") — S2a pins the 0.11.0 oracle versions`,
+		`package.json dependencies["${name}"] must be exact "${ver}" (got "${deps[name]}") — S2a pins the current oracle versions`,
 	);
 }
 
@@ -63,13 +63,13 @@ for (const [name, ver] of Object.entries(PINS)) {
 const lock = read("pnpm-lock.yaml");
 assert.match(
 	lock,
-	/@agentclientprotocol\/claude-agent-acp@0\.50\.0\(@anthropic-ai\/sdk@0\.100\.1/,
-	"pnpm-lock: claude-agent-acp@0.50.0 must peer-resolve @anthropic-ai/sdk@0.100.1 (peer-pin), not the stale 0.91.1",
+	/@agentclientprotocol\/claude-agent-acp@0\.54\.1\(@anthropic-ai\/sdk@0\.100\.1/,
+	"pnpm-lock: claude-agent-acp@0.54.1 must peer-resolve @anthropic-ai/sdk@0.100.1 (peer-pin), not the stale 0.91.1",
 );
 assert.match(
 	lock,
-	/@anthropic-ai\/claude-agent-sdk@0\.3\.186\(@anthropic-ai\/sdk@0\.100\.1/,
-	"pnpm-lock: claude-agent-sdk@0.3.186 must peer-resolve @anthropic-ai/sdk@0.100.1 — else its >=0.93.0 peer floor is unmet",
+	/@anthropic-ai\/claude-agent-sdk@0\.3\.197\(@anthropic-ai\/sdk@0\.100\.1/,
+	"pnpm-lock: claude-agent-sdk@0.3.197 must peer-resolve @anthropic-ai/sdk@0.100.1 — else its >=0.93.0 peer floor is unmet",
 );
 
 // ---------------------------------------------------------------------------
@@ -108,8 +108,8 @@ const casEntry = adapterRequire.resolve("@anthropic-ai/claude-agent-sdk");
 const casInfo = pkgInfoFromEntry(casEntry);
 assert.equal(
 	casInfo.version,
-	"0.3.186",
-	`@anthropic-ai/claude-agent-sdk must runtime-resolve to 0.3.186 from the adapter context (got ${casInfo.version})`,
+	"0.3.197",
+	`@anthropic-ai/claude-agent-sdk must runtime-resolve to 0.3.197 from the adapter context (got ${casInfo.version})`,
 );
 const casRequire = createRequire(resolve(casInfo.dir, "package.json"));
 const sdkEntry = casRequire.resolve(ANTHROPIC_SDK);
@@ -121,19 +121,19 @@ assert.equal(
 );
 
 // ---------------------------------------------------------------------------
-// (2c) adapter-context wire-SDK + MCP-SDK runtime resolve — the 0.50 bump's real
-//      fault surface. Lock text (layer 2) freezes the publish floor; these probe
+// (2c) adapter-context wire-SDK + MCP-SDK runtime resolve — the ACP dep bump's
+//      real fault surface. Lock text (layer 2) freezes the publish floor; these probe
 //      the LIVE module graph the adapter actually traverses: the adapter must SEE
-//      the same wire SDK the backend imports at root (0.29.0), and claude-agent-sdk
+//      the same wire SDK the backend imports at root (1.1.0), and claude-agent-sdk
 //      must SEE its declared MCP peer (1.29.x). Cheap edges, both newly relevant
-//      after the 0.39→0.50 / 0.22→0.29 bump.
+//      after the 0.50→0.54 / 0.29→1.1 bump.
 // ---------------------------------------------------------------------------
 const wireEntry = adapterRequire.resolve("@agentclientprotocol/sdk");
 const wireInfo = pkgInfoFromEntry(wireEntry);
 assert.equal(
 	wireInfo.version,
-	"0.29.0",
-	`@agentclientprotocol/sdk must runtime-resolve to 0.29.0 from the adapter context (got ${wireInfo.version}) — the adapter and the backend must share one wire SDK`,
+	"1.1.0",
+	`@agentclientprotocol/sdk must runtime-resolve to 1.1.0 from the adapter context (got ${wireInfo.version}) — the adapter and the backend must share one wire SDK`,
 );
 // @modelcontextprotocol/sdk gates its bare specifier behind "exports", so a
 // require.resolve of the package ROOT throws (no resolvable entry) — read the
@@ -143,12 +143,12 @@ assert.equal(
 const mcpPkg = JSON.parse(read("node_modules/@modelcontextprotocol/sdk/package.json")) as { version?: string };
 assert.ok(
 	typeof mcpPkg.version === "string" && mcpPkg.version.startsWith("1.29."),
-	`@modelcontextprotocol/sdk must be 1.29.x (got ${mcpPkg.version}) — claude-agent-sdk 0.3.186 declares a ^1.29.0 peer`,
+	`@modelcontextprotocol/sdk must be 1.29.x (got ${mcpPkg.version}) — claude-agent-sdk 0.3.197 declares a ^1.29.0 peer`,
 );
 
 // ---------------------------------------------------------------------------
 // (3) @agentclientprotocol/sdk value-export surface (silent-rename gate)
-//     The 0.11.0 acp-bridge imports these from the wire SDK; a silent upstream
+//     The ACP bridge imports these from the wire SDK; a silent upstream
 //     rename would not fail typecheck (type-only erasure) but would break the
 //     raw turn. Assert the *value* exports exist at runtime.
 // ---------------------------------------------------------------------------

package/scripts/check-acp-session-reuse.ts

@@ -32,7 +32,7 @@ import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import type { Api, AssistantMessageEvent, Context, Message, Model } from "@earendil-works/pi-ai";
 
-const sonnet = { id: "claude-sonnet-4-6" } as unknown as Model<Api>;
+const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
 const opus = { id: "claude-opus-4-8" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent> & {
@@ -488,7 +488,7 @@ try {
 		);
 		const d1 = deltaText(t1);
 		const iPrep = d1.indexOf("[acp: preparing claude session]");
-		const iReady = d1.indexOf("[acp: session ready model=claude-sonnet-4-6]");
+		const iReady = d1.indexOf("[acp: session ready model=claude-sonnet-5]");
 		const iSent = d1.indexOf("[acp: sending prompt]");
 		assert.ok(
 			iPrep >= 0 && iReady > iPrep && iSent > iReady,
@@ -517,7 +517,7 @@ try {
 			messages: [
 				{ role: "user", content: "real user line", timestamp: 0 },
 				mkAssistant([
-					{ type: "text", text: "\n[acp: session ready model=claude-sonnet-4-6]\n", textSignature: MARKER },
+					{ type: "text", text: "\n[acp: session ready model=claude-sonnet-5]\n", textSignature: MARKER },
 					{ type: "text", text: "real assistant line" },
 				]),
 			],

package/scripts/check-acp-session-store.ts

@@ -43,8 +43,8 @@ import {
 
 const baseInput = (): BridgeConfigInput => ({
 	backend: "claude",
-	modelId: "claude-sonnet-4-6",
-	nativeModelId: "claude-sonnet-4-6",
+	modelId: "claude-sonnet-5",
+	nativeModelId: "claude-sonnet-5",
 	appendSystemPrompt: "",
 	mcpServersHash: "deadbeef",
 	settingSources: [],
@@ -61,7 +61,7 @@ const baseInput = (): BridgeConfigInput => ({
 {
 	const sig0 = bridgeConfigSignature(baseInput());
 	assert.ok(isSha256Hex(sig0), "config signature is a sha256 digest (no raw carrier text on disk)");
-	assert.ok(!sig0.includes("claude-sonnet-4-6"), "config signature is a digest — never embeds the raw modelId/carrier");
+	assert.ok(!sig0.includes("claude-sonnet-5"), "config signature is a digest — never embeds the raw modelId/carrier");
 	assert.equal(sig0, bridgeConfigSignature(baseInput()), "signature is deterministic");
 	// Array copies do not affect equality (same content).
 	assert.equal(bridgeConfigSignature({ ...baseInput(), settingSources: [] }), sig0, "empty settingSources stable");
@@ -178,7 +178,7 @@ const baseInput = (): BridgeConfigInput => ({
 
 	const facts = (over: Partial<SessionCompatFacts> = {}): SessionCompatFacts => ({
 		cwd: "/w",
-		modelId: "claude-sonnet-4-6",
+		modelId: "claude-sonnet-5",
 		bridgeConfigSignature: bridgeConfigSignature(baseInput()),
 		contextMessageSignatures: ["user:text:a"],
 		...over,
@@ -201,7 +201,7 @@ const baseInput = (): BridgeConfigInput => ({
 	const sig = bridgeConfigSignature(baseInput());
 	const compatFacts: SessionCompatFacts = {
 		cwd: "/w",
-		modelId: "claude-sonnet-4-6",
+		modelId: "claude-sonnet-5",
 		bridgeConfigSignature: sig,
 		contextMessageSignatures: ["user:text:a"],
 	};
@@ -305,7 +305,7 @@ const baseInput = (): BridgeConfigInput => ({
 {
 	const facts: SessionCompatFacts = {
 		cwd: "/w",
-		modelId: "claude-sonnet-4-6",
+		modelId: "claude-sonnet-5",
 		bridgeConfigSignature: bridgeConfigSignature(baseInput()),
 		contextMessageSignatures: ["user:text:a"],
 	};

package/scripts/check-acp-tool-surface.ts

@@ -90,7 +90,7 @@ assert.ok(nativeThrew, "non-claude backend exposing write natively must throw wh
 // ---------------------------------------------------------------------------
 
 const baseParams = {
-	modelId: "claude-sonnet-4-6",
+	modelId: "claude-sonnet-5",
 	tools: DEFAULT_CLAUDE_TOOLS,
 	permissionAllow: DEFAULT_CLAUDE_PERMISSION_ALLOW,
 	disallowedTools: DEFAULT_CLAUDE_DISALLOWED_TOOLS,
@@ -101,7 +101,7 @@ const baseParams = {
 
 const meta = buildClaudeSessionMeta(baseParams);
 const opts = (meta.claudeCode as { options: Record<string, unknown> }).options;
-assert.equal(opts.model, "claude-sonnet-4-6", "model must propagate");
+assert.equal(opts.model, "claude-sonnet-5", "model must propagate");
 assert.deepEqual(opts.tools, [...DEFAULT_CLAUDE_TOOLS], "tools must propagate (copied)");
 assert.deepEqual(
 	(opts.settings as { permissions: { allow: string[] } }).permissions.allow,

package/scripts/check-entwurf-session-identity.ts

@@ -132,7 +132,7 @@ try {
 		{ p: "entwurf", m: "claude-opus-4-8", title: "Review substrate smoke", tags: ["entwurf", "review"] },
 		{ p: "openai-codex", m: "gpt-5.5", title: "async resume check", tags: ["entwurf", "smoke"] },
 		{ p: "entwurf", m: "gemini-3.1-pro-preview", title: "vision team", tags: ["entwurf"] },
-		{ p: "entwurf", m: "claude-sonnet-4-6", title: "manual session", tags: [] as string[] },
+		{ p: "entwurf", m: "claude-sonnet-5", title: "manual session", tags: [] as string[] },
 	];
 	for (const c of cases) {
 		const sid = generateSessionId(new Date(2026, 5, 3, 19, 12, 45));
@@ -252,7 +252,7 @@ try {
 		tags: ["entwurf"],
 	});
 	eq(parseSessionName(goodName)?.model, recorded, "name model mirrors recorded model");
-	const driftName = "20260603T191245-deadbe==entwurf/claude-sonnet-4-6--x__entwurf";
+	const driftName = "20260603T191245-deadbe==entwurf/claude-sonnet-5--x__entwurf";
 	ok(parseSessionName(driftName)?.model !== recorded, "model drift is detectable for fail-fast");
 
 	// ---- T-collision: header scan is authority; spawn pre-check ----
@@ -440,12 +440,12 @@ try {
 		bigFile,
 		`${JSON.stringify({ type: "session", id: "20260603T210000-bbbbbb", cwd: "/b" })}\n` +
 			msg({ content: bigBody, model: "m-big", provider: "p-big", usage: { cost: { total: 1 } } }) +
-			msg({ content: "final", model: "claude-sonnet-4-6", provider: "entwurf", usage: { cost: { total: 0.5 } } }),
+			msg({ content: "final", model: "claude-sonnet-5", provider: "entwurf", usage: { cost: { total: 0.5 } } }),
 	);
 	const a2 = analyzeSessionFileLike(bigFile);
 	eq(a2.turns, 2, "analyze(big): turns correct across chunk boundaries");
 	eq(a2.lastAssistantText, "final", "analyze(big): trailing turn intact after multi-chunk line");
-	eq(a2.lastModel, "claude-sonnet-4-6", "analyze(big): trailing model intact");
+	eq(a2.lastModel, "claude-sonnet-5", "analyze(big): trailing model intact");
 	eq(Math.round(a2.cost * 100) / 100, 1.5, "analyze(big): cost summed across large line");
 
 	// ---- T-identity: resume identity authority = FIRST model_change ----
@@ -513,21 +513,21 @@ try {
 	const cleanName = buildSessionName({
 		sessionId: idE,
 		provider: "entwurf",
-		model: "claude-sonnet-4-6",
+		model: "claude-sonnet-5",
 		rawTitle: "clean resume",
 		tags: ["entwurf", "async"],
 	});
 	fs.writeFileSync(
 		fileE,
 		sessionLine(idE, "/identity/e") +
-			mc("entwurf", "claude-sonnet-4-6") +
+			mc("entwurf", "claude-sonnet-5") +
 			infoLine(cleanName) +
-			msg({ content: "ok", model: "claude-sonnet-4-6", provider: "entwurf" }),
+			msg({ content: "ok", model: "claude-sonnet-5", provider: "entwurf" }),
 	);
 	noThrow(() => readSessionIdentity(fileE), "identity: clean session does not throw");
 	const recE = readSessionIdentity(fileE);
 	eq(recE?.provider, "entwurf", "identity(clean): provider");
-	eq(recE?.modelId, "claude-sonnet-4-6", "identity(clean): modelId mirrors name");
+	eq(recE?.modelId, "claude-sonnet-5", "identity(clean): modelId mirrors name");
 
 	// 6. no model_change → null (caller refuses with its own no-recorded-model result).
 	const idF = "20260603T220000-6666ff";
@@ -583,7 +583,7 @@ try {
 	);
 	eq(
 		readSessionIdentity(fileE, { requireEntwurf: true })?.modelId,
-		"claude-sonnet-4-6",
+		"claude-sonnet-5",
 		"requireEntwurf: accepted Entwurf session returns first-model_change identity",
 	);
 

package/scripts/check-meta-manifest-schema.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+# check-meta-manifest-schema — deterministic, CLI-version-INDEPENDENT guard for the
+# meta-bridge plugin manifests + the installed-vs-clone MCP wiring decision.
+#
+# Why this exists (0.12.2): `claude plugin validate` is a CLOSED schema — it REJECTS
+# unrecognized keys, and the allowed keyset differs by Claude Code version. 0.12.1
+# shipped a marketplace.json carrying a root `description`; Claude 2.1.195 (the dev
+# box) accepted it, Claude 2.1.97 (the install floor) rejected it with
+# `Unrecognized key: "description"`, so `entwurf install-meta-bridge` died on the
+# floor host while the release looked green. The lesson: a "nice to have" decorative
+# key in a closed-schema manifest is a future regression surface. This guard pins the
+# committed manifests to the MINIMAL keyset confirmed to validate on the lowest
+# supported Claude, independent of whatever CLI version happens to run here.
+#
+# It also asserts meta-bridge-state.py::desired_mcp() picks the stable `entwurf-bridge`
+# bin for an installed package and the clone's start.sh for a dev clone (the other
+# 0.12.1 install-surface fragility: baking the pnpm store path goes stale on peer bumps).
+#
+# Offline / hermetic. Deps: python3 only.
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+REPO = HERE.parent
+MB = REPO / "pi" / "meta-bridge"
+STATE = HERE / "meta-bridge-state.py"
+
+fail = 0
+
+
+def ok(msg: str) -> None:
+    print(f"  ok    {msg}")
+
+
+def bad(msg: str) -> None:
+    global fail
+    print(f"  FAIL  {msg}")
+    fail = 1
+
+
+def load(path: Path):
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except Exception as exc:  # noqa: BLE001
+        bad(f"cannot parse {path}: {exc}")
+        return None
+
+
+def subset(label: str, got, allowed: set[str]) -> None:
+    if not isinstance(got, dict):
+        bad(f"{label}: expected an object, got {type(got).__name__}")
+        return
+    extra = set(got) - allowed
+    if extra:
+        bad(f"{label}: keys {sorted(extra)} outside minimal allowed set {sorted(allowed)} "
+            f"(closed-schema risk: an older Claude may reject them)")
+    else:
+        ok(f"{label}: keys ⊆ {sorted(allowed)}")
+
+
+# --- marketplace.json --------------------------------------------------------
+mkt = load(MB / ".claude-plugin" / "marketplace.json")
+if mkt is not None:
+    subset("marketplace root", mkt, {"name", "owner", "plugins"})
+    subset("marketplace.owner", mkt.get("owner", {}), {"name"})
+    plugins = mkt.get("plugins")
+    if not isinstance(plugins, list) or not plugins:
+        bad("marketplace.plugins must be a non-empty array")
+    else:
+        for i, p in enumerate(plugins):
+            subset(f"marketplace.plugins[{i}]", p, {"name", "source", "description"})
+
+# --- plugin.json -------------------------------------------------------------
+plug = load(MB / "entwurf-meta-receive" / ".claude-plugin" / "plugin.json")
+if plug is not None:
+    subset("plugin.json", plug, {"name", "version", "description"})
+
+# --- hooks.json --------------------------------------------------------------
+hooks = load(MB / "entwurf-meta-receive" / "hooks" / "hooks.json")
+if hooks is not None:
+    subset("hooks.json root", hooks, {"hooks"})
+    # Pin the hook EVENT names too — an unrecognized event key is the same closed-schema
+    # risk as an unrecognized field. These four are the meta-bridge's load-bearing events.
+    subset("hooks.json events", hooks.get("hooks") or {},
+           {"SessionStart", "CwdChanged", "UserPromptSubmit", "FileChanged"})
+    for event, entries in (hooks.get("hooks") or {}).items():
+        if not isinstance(entries, list):
+            bad(f"hooks.{event} must be an array")
+            continue
+        for j, entry in enumerate(entries):
+            subset(f"hooks.{event}[{j}]", entry, {"matcher", "hooks"})
+            for k, h in enumerate(entry.get("hooks", []) if isinstance(entry, dict) else []):
+                # asyncRewake/timeout are load-bearing on the FileChanged doorbell —
+                # allowed, NOT decorative. Anything beyond this set must be reviewed.
+                subset(f"hooks.{event}[{j}].hooks[{k}]", h, {"type", "command", "asyncRewake", "timeout"})
+
+# --- desired_mcp() installed-vs-clone dual-mode ------------------------------
+def desired_mcp(repo: str):
+    out = subprocess.run(
+        [sys.executable, str(STATE), "desired-mcp", "--repo", repo],
+        capture_output=True, text=True,
+    )
+    if out.returncode != 0:
+        bad(f"desired-mcp --repo {repo} exited {out.returncode}: {out.stderr.strip()}")
+        return None
+    return json.loads(out.stdout)
+
+
+# Both probes use SYNTHETIC paths that need not exist — never REPO. If this guard ran
+# from an installed package (e.g. `entwurf check-meta-manifest-schema`), REPO would
+# itself end in node_modules/@junghanacs/entwurf and a REPO-based clone probe would
+# wrongly resolve to the installed shape and self-fail. Fixed, installed-vs-clone-shaped
+# literals make the assertion location-independent.
+installed = desired_mcp("/opt/x/node_modules/@junghanacs/entwurf")
+if installed is not None:
+    if installed.get("command") == "entwurf-bridge" and installed.get("args") == []:
+        ok("desired_mcp(installed-shaped) → stable `entwurf-bridge` bin (no store path baked)")
+    else:
+        bad(f"desired_mcp(installed-shaped) should wire the `entwurf-bridge` bin, got {installed.get('command')} {installed.get('args')}")
+
+clone = desired_mcp("/opt/entwurf-dev-clone")
+if clone is not None:
+    args = clone.get("args") or [""]
+    if clone.get("command") == "bash" and str(args[0]).endswith("mcp/entwurf-bridge/start.sh"):
+        ok("desired_mcp(clone-shaped) → that clone's start.sh (not the global bin)")
+    else:
+        bad(f"desired_mcp(clone-shaped) should wire bash start.sh, got {clone.get('command')} {args}")
+
+# both modes must keep the canonical sender env
+for label, entry in (("installed", installed), ("clone", clone)):
+    if entry is None:
+        continue
+    env = entry.get("env", {})
+    if env.get("ENTWURF_BRIDGE_REQUIRE_META_SENDER") == "1" and \
+       env.get("ENTWURF_BRIDGE_EXTERNAL_AGENT_ID") == "external-mcp/claude-code":
+        ok(f"desired_mcp({label}) carries canonical sender env")
+    else:
+        bad(f"desired_mcp({label}) dropped canonical sender env: {env}")
+
+if fail:
+    print("check-meta-manifest-schema FAIL")
+    sys.exit(1)
+print("check-meta-manifest-schema PASS")

package/scripts/check-model-lock.ts

@@ -210,7 +210,7 @@ async function makeHarness(opts: MakeHarnessOpts = {}): Promise<Harness> {
 // Test models.
 const NATIVE_A: ModelLike = { provider: "openai-codex", id: "gpt-5.4" };
 const NATIVE_B: ModelLike = { provider: "openai-codex", id: "gpt-5.5" };
-const PSA_SONNET: ModelLike = { provider: "entwurf", id: "claude-sonnet-4-6" };
+const PSA_SONNET: ModelLike = { provider: "entwurf", id: "claude-sonnet-5" };
 const PSA_OPUS: ModelLike = { provider: "entwurf", id: "claude-opus-4-8" };
 
 let passed = 0;
@@ -250,7 +250,7 @@ await run("2. native → entwurf: revert + warning notify", async () => {
 	assert.equal(h.notifyCalls.length, 1);
 	assert.equal(h.notifyCalls[0].level, "warning");
 	assert.match(h.notifyCalls[0].message, /locked to openai-codex\/gpt-5\.4/);
-	assert.match(h.notifyCalls[0].message, /entwurf\/claude-sonnet-4-6/);
+	assert.match(h.notifyCalls[0].message, /entwurf\/claude-sonnet-5/);
 });
 
 await run("3. entwurf → native: revert + warning notify", async () => {

package/scripts/check-package-source-routing.ts

@@ -74,7 +74,7 @@ function rmInstall(...segs: string[]): void {
 	fs.rmSync(path.join(tmpAgent, ...segs), { recursive: true, force: true });
 }
 
-const ACP: ResolvedTarget = { provider: "entwurf", model: "claude-sonnet-4-6", explicitOnly: false };
+const ACP: ResolvedTarget = { provider: "entwurf", model: "claude-sonnet-5", explicitOnly: false };
 const eArg = (r: { args: string[] }): string | undefined => {
 	const i = r.args.indexOf("-e");
 	return i >= 0 ? r.args[i + 1] : undefined;
@@ -211,7 +211,7 @@ check("project-scope source (unseen in user settings) fails fast on remote", ()
 //     (resume callers fail-fast; no -e injected).
 check("resume recorded entwurf + remote + no source → unresolvedAcpIntent", () => {
 	setSource(null);
-	const r = getEntwurfExplicitExtensions("claude-sonnet-4-6", true, "entwurf");
+	const r = getEntwurfExplicitExtensions("claude-sonnet-5", true, "entwurf");
 	assert.equal(r.unresolvedAcpIntent, true);
 	assert.equal(eArg(r), undefined);
 	assert.ok(r.warnings.length > 0, "should warn about the unresolved bridge");
@@ -220,7 +220,7 @@ check("resume recorded entwurf + remote + no source → unresolvedAcpIntent", ()
 // 13. recorded provider=entwurf + LOCAL → self-root resolves, no fail-fast.
 check("resume recorded entwurf + local resolves via self-root", () => {
 	setSource(null);
-	const r = getEntwurfExplicitExtensions("claude-sonnet-4-6", false, "entwurf");
+	const r = getEntwurfExplicitExtensions("claude-sonnet-5", false, "entwurf");
 	assert.ok(!r.unresolvedAcpIntent, "local self-root should resolve");
 	assert.equal(eArg(r), REPO_ROOT);
 	assert.equal(r.provider, "entwurf");
@@ -242,7 +242,7 @@ check("resume Codex-via-ACP opt-in + remote + no source → unresolvedAcpIntent"
 //     fail-fast — because the legacy pi-claude-code-use bridge may exist.
 check("resume Claude-only heuristic + remote + no source stays warning-only", () => {
 	setSource(null);
-	const r = getEntwurfExplicitExtensions("claude-sonnet-4-6", true, undefined);
+	const r = getEntwurfExplicitExtensions("claude-sonnet-5", true, undefined);
 	assert.ok(!r.unresolvedAcpIntent, "Claude heuristic must not fail-fast");
 	assert.ok(r.warnings.length > 0, "should warn");
 	assert.equal(eArg(r), undefined);

package/scripts/meta-bridge-doctor.sh

@@ -117,7 +117,7 @@ PY
   EXPECTED_STATUSLINE="$REPO/scripts/meta-bridge-statusline.sh"
   if [ "$STATUSLINE_CMD" = "$EXPECTED_STATUSLINE" ]; then ok "statusLine.command is repo-owned: $STATUSLINE_CMD"; else bad "statusLine.command drifted (got '$STATUSLINE_CMD', expected '$EXPECTED_STATUSLINE')"; fi
   if [ -x "$EXPECTED_STATUSLINE" ]; then ok "statusline executable"; else bad "statusline script not executable: $EXPECTED_STATUSLINE"; fi
-  SAMPLE_STATUSLINE_OUT="$(printf '%s' '{"session_id":"doctor-no-record","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-4-6"},"context_window":{"context_window_size":200000,"used_percentage":1,"current_usage":{"input_tokens":1}}}' | "$EXPECTED_STATUSLINE" 2>/dev/null || true)"
+  SAMPLE_STATUSLINE_OUT="$(printf '%s' '{"session_id":"doctor-no-record","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-5"},"context_window":{"context_window_size":200000,"used_percentage":1,"current_usage":{"input_tokens":1}}}' | "$EXPECTED_STATUSLINE" 2>/dev/null || true)"
   if [ "$(printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | wc -l | tr -d ' ')" = "2" ] && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '🪛' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q ' cc | s'; then ok "statusline synthetic execution emits two rows (work context + identity)"; else bad "statusline synthetic execution failed or omitted two-row work/identity marker"; fi
 else
   bad "cannot validate statusline without python3"

package/scripts/meta-bridge-install.sh

@@ -115,9 +115,23 @@ claude mcp remove entwurf-bridge -s user >/dev/null 2>&1 || true
 # 0.11 S2 cutover: drop any stale USER-scope pi-tools-bridge entry written by a
 # prior version (one-shot rename cleanup, not a runtime alias).
 claude mcp remove pi-tools-bridge -s user >/dev/null 2>&1 || true
-claude mcp add -s user entwurf-bridge \
-  -e ENTWURF_BRIDGE_EXTERNAL_AGENT_ID=external-mcp/claude-code \
-  -- bash "$REPO/mcp/entwurf-bridge/start.sh" >/dev/null
+# 0.12.2 installed-vs-clone dual-mode — MUST mirror meta-bridge-state.py::desired_mcp(),
+# which the trailing `apply` re-asserts as the SSOT. An installed package ($REPO ends
+# in node_modules/@junghanacs/entwurf) wires the STABLE `entwurf-bridge` bin shim; baking
+# the pnpm store path here would go stale on any peer/version bump. A dev clone pins to
+# this clone's start.sh. Both branches carry the same two env vars desired_mcp() writes.
+case "$REPO" in
+  */node_modules/@junghanacs/entwurf)
+    claude mcp add -s user entwurf-bridge \
+      -e ENTWURF_BRIDGE_EXTERNAL_AGENT_ID=external-mcp/claude-code \
+      -e ENTWURF_BRIDGE_REQUIRE_META_SENDER=1 \
+      -- entwurf-bridge >/dev/null ;;
+  *)
+    claude mcp add -s user entwurf-bridge \
+      -e ENTWURF_BRIDGE_EXTERNAL_AGENT_ID=external-mcp/claude-code \
+      -e ENTWURF_BRIDGE_REQUIRE_META_SENDER=1 \
+      -- bash "$REPO/mcp/entwurf-bridge/start.sh" >/dev/null ;;
+esac
 (cd /tmp && claude mcp get entwurf-bridge 2>/dev/null | grep -q "Scope: User config") || \
   die "post-install: entwurf-bridge is not reachable as USER-scope MCP from /tmp"
 echo "[meta-bridge-install] installed entwurf-bridge MCP (scope: user = global receiver tools)"

package/scripts/meta-bridge-state.py

@@ -80,6 +80,8 @@ MANAGED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     ("showTurnDuration", ["showTurnDuration"], False),
     ("terminalProgressBarEnabled", ["terminalProgressBarEnabled"], False),
     ("useAutoModeDuringPlan", ["useAutoModeDuringPlan"], False),
+    ("enableWorkflows", ["enableWorkflows"], False),
+    ("workflowKeywordTriggerEnabled", ["workflowKeywordTriggerEnabled"], False),
 ]
 
 
@@ -264,20 +266,42 @@ def desired_marketplace(asm: Path) -> dict[str, Any]:
     return {"source": {"source": "directory", "path": str(asm.resolve())}}
 
 
+def is_installed_package(repo: Path) -> bool:
+    # An installed (npm / pnpm) layout always ends in node_modules/@junghanacs/entwurf
+    # (pnpm global nests it under .pnpm/<hash>/node_modules/@junghanacs/entwurf). A dev
+    # clone never lives under node_modules/@junghanacs/entwurf, so the trailing three
+    # path components cleanly distinguish the two WITHOUT a PATH lookup (`command -v
+    # entwurf-bridge` could resolve a stale GLOBAL bin from a clone host and is wrong here).
+    parts = repo.resolve().parts
+    return parts[-3:] == ("node_modules", "@junghanacs", "entwurf")
+
+
 def desired_mcp(repo: Path) -> dict[str, Any]:
+    env = {
+        "ENTWURF_BRIDGE_EXTERNAL_AGENT_ID": "external-mcp/claude-code",
+        # Anonymous sends are forbidden on the Claude Code install path: a send
+        # with no pi-session identity AND no meta-sender marker is refused, not
+        # delivered as an unidentified external. The SessionStart hook writes
+        # the marker (parent-pid keyed), so a normally-opened session always has
+        # an authoritative garden-id sender.
+        "ENTWURF_BRIDGE_REQUIRE_META_SENDER": "1",
+    }
+    if is_installed_package(repo):
+        # Installed package: wire the STABLE `entwurf-bridge` bin shim that npm/pnpm
+        # place on PATH. Baking repo/mcp/entwurf-bridge/start.sh would embed the pnpm
+        # store path (.pnpm/@junghanacs+entwurf@<ver>_<peer-hash>/...), which moves
+        # on any peer/version change and leaves a dead MCP command. The bare bin name
+        # tracks whatever version is currently installed — the right behaviour for a
+        # managed install host. start.sh's own position-based dual-mode then runs the
+        # dist boot under node_modules. (0.12.2 fix; 0.12.1 shipped only the clone path.)
+        return {"type": "stdio", "command": "entwurf-bridge", "args": [], "env": env}
+    # Dev clone: pin to THIS clone's launcher (an absolute resolved path), never the
+    # global bin, so a clone host stays bound to its own source tree.
     return {
         "type": "stdio",
         "command": "bash",
         "args": [str((repo / "mcp" / "entwurf-bridge" / "start.sh").resolve())],
-        "env": {
-            "ENTWURF_BRIDGE_EXTERNAL_AGENT_ID": "external-mcp/claude-code",
-            # Anonymous sends are forbidden on the Claude Code install path: a send
-            # with no pi-session identity AND no meta-sender marker is refused, not
-            # delivered as an unidentified external. The SessionStart hook writes
-            # the marker (parent-pid keyed), so a normally-opened session always has
-            # an authoritative garden-id sender.
-            "ENTWURF_BRIDGE_REQUIRE_META_SENDER": "1",
-        },
+        "env": env,
     }
 
 
@@ -519,7 +543,7 @@ def main() -> int:
     parser = argparse.ArgumentParser(description="entwurf meta-bridge state manager")
     parser.add_argument(
         "command",
-        choices=["prepare", "apply", "preflight-uninstall", "uninstall", "check", "managed-keys"],
+        choices=["prepare", "apply", "preflight-uninstall", "uninstall", "check", "managed-keys", "desired-mcp"],
     )
     parser.add_argument("--repo", default=Path(__file__).resolve().parents[1], type=Path)
     parser.add_argument("--asm", default=None, type=Path)
@@ -539,6 +563,11 @@ def main() -> int:
             check(repo, asm)
         elif args.command == "managed-keys":
             print(json.dumps(managed_keys(), indent=2))
+        elif args.command == "desired-mcp":
+            # Debug/guard surface: print the user-scope MCP entry desired_mcp() would
+            # write for --repo. Lets a deterministic guard assert the installed-vs-clone
+            # dual-mode without spinning up a real `claude` CLI. --repo need not exist.
+            print(json.dumps(desired_mcp(repo), indent=2))
     except StateError as exc:
         print(f"meta-bridge-state: {exc}", file=sys.stderr)
         return 1