@junghanacs/entwurf 0.12.3 → 0.12.5

package/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.12.5 — 2026-07-01
+
+### Fixed
+
+- **The plugin hook now runs as compiled JS when installed — the strip-types class is closed for good.** The SessionStart/UserPromptSubmit hook ran as a raw `meta-bridge-hook.ts`. When the marketplace source sits below `node_modules` (a global npm/pnpm install), Claude executes that `.ts` directly and Node refuses strip-types there (`ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`), so every session failed. The hook was the last `.ts`-at-runtime surface; `build-bridge` now emits `dist/pi-extensions/meta-bridge-hook.js` and the installer copies that compiled closure (dev clones still run the `.ts` for transparent editing), mirroring the same installed-vs-dev split `start.sh` (0.12.1) and the store-doctor (0.12.4) already use. `check-pack-install` now runs the installed compiled hook **from under `node_modules` with plain `node`** and proves a raw `.ts` at the same location is refused — the exact fence that broke real hosts is a green regression. The doctor's writer-version parity compares `meta-session.<js|ts>` by install mode so a compiled bundle no longer false-STALEs against the `.ts` source.
+- **Installed meta-bridge paths are now stable across package upgrades.** The installed statusline uses a new `entwurf-statusline` bin shim (matching the existing `entwurf-bridge` MCP shim), and installed meta-bridge marketplace assemblies move out of versioned pnpm store paths into a version-stable operator data directory. Package upgrades still require `entwurf install-meta-bridge` to refresh the Claude plugin bundle/cache, but old-store dead links no longer strand `statusLine` or marketplace source paths. The doctor now also executes the cached SessionStart hook once in an isolated temp agent dir, catching stale plugin-cache / hook-syntax failures before the next real Claude Code session.
+
+### Verification
+
+- Oracle and local review both reproduced the installed hook fence: compiled `meta-bridge-hook.js` runs from under `node_modules` with plain `node`, while the raw `.ts` at the same location fails specifically with `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`.
+- `./run.sh check-pack` and `./run.sh check-pack-install` passed on 2026-07-01 with the hook-JS tarball requirements, baked `hooks.json` `.js` assertion, and raw-`.ts` fence reproduction.
+- `pnpm check` passed on 2026-07-01 after the hook-JS + stable installed-path changes.
+- `./run.sh install-meta-bridge && ./run.sh doctor-meta-bridge` passed from the development clone after re-materializing the gitignored `.assembled` bundle.
+
+## 0.12.4 — 2026-07-01
+
+### Fixed
+
+- **Installed `doctor-meta-bridge` no longer false-fails on node_modules strip-types.** The doctor previously ran `scripts/meta-bridge-store-doctor.ts` and `scripts/check-entwurf-v2-surface.ts` through Node strip-types even from an npm/pnpm-installed package. Node refuses type stripping under `node_modules` (`ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`), so real floor hosts reported false store-scan / v2-surface failures while development clones stayed green. The doctor now branches by package location: installed packages run the prebuilt `mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js` with plain `node` and defer the repo-only v2 source-shape gate after confirming the shipped source and runtime wiring; development clones keep the raw `.ts` gates.
+- **The store-doctor helper now ships as a node_modules-safe dist artifact.** The bridge build emits `dist/scripts/meta-bridge-store-doctor.js` alongside the MCP bridge closure, reusing the already-shipped `meta-session.js` dependency without adding a new runtime package lane. `check-pack` / `check-pack-install` require the artifact in the tarball and prove it scans a real fixture store under `node_modules` with plain `node`.
+- **Clean-host install docs call out the 0.12.4 doctor floor check.** The walkthrough now tells operators exactly which doctor lines prove the installed-vs-dev split and flags any `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING` as a pre-0.12.4 or broken-tarball signal.
+
+### Verification
+
+- `pnpm check` passed on 2026-07-01 after the doctor/install-floor fix.
+- `./run.sh check-pack-install` passed with the new installed store-doctor scan and doctor-dispatch lock assertions.
+- Release-gate prep evidence: `LIVE=1 ./run.sh release-gate /tmp/psa-release-gate-0.12.4.PliLsd` passed on 2026-07-01; log `/tmp/pi-tmux-entwurf-release-gate-0124.log`; summary `MUST: PASS=17 FAIL=0 SKIP=0`, advisory `BEHAVIOR: PASS=0 FAIL=1` (`smoke-resident-garden-guard` post-`/gnew` autonomous `entwurf_self` identity turn; non-blocking).
+- `hejdev6` real floor host reproduced the pre-fix strip-types failure from an installed package and passed after installing the patched tarball: compiled store-doctor scanned `1 record(s)` with plain `node`, and installed `doctor-meta-bridge` reported store-scan ok plus v2-surface deferred.
+
 ## 0.12.3 — 2026-07-01
 
 ### Changed

package/README.md

@@ -80,10 +80,11 @@ A few words that look unusual for a coding tool.
 adapter that hosts the ACP plugin and live control-socket surface, but the base
 install is **not** `pi install npm:...` anymore.
 
-The package exposes two bins:
+The package exposes three bins:
 
 - `entwurf` → `run.sh` (installer, checks, meta-bridge doctor/install)
 - `entwurf-bridge` → the MCP stdio launcher (`mcp/entwurf-bridge/start.sh`)
+- `entwurf-statusline` → the Claude Code statusline renderer (`scripts/meta-bridge-statusline.sh`); a stable bin shim so a package upgrade tracks the current version without rewriting Claude settings
 
 The bridge does not provide Claude credentials, tokens, or subscription access,
 and does not bypass any backend auth. Whatever the operator's local `claude` /
@@ -181,6 +182,19 @@ entwurf install-meta-bridge
 entwurf doctor-meta-bridge
 ```
 
+On npm/pnpm-installed packages, `doctor-meta-bridge` must use prebuilt JS for its
+store scan and defer repo-only source-shape gates; Node refuses strip-types for
+raw `.ts` helpers under `node_modules`. If the doctor reports
+`ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`, reinstall a current package before
+trusting the floor result.
+
+After upgrading a globally installed package, run `entwurf install-meta-bridge`
+again before trusting native Claude Code sessions. The installed statusline and
+MCP entries use stable bin shims, and the marketplace source uses a version-stable
+operator data dir, but the Claude plugin bundle/cache still has to be
+re-materialized for the new package writer. Existing Claude Code sessions should
+be restarted after reinstall.
+
 For manual configuration, [`pi/settings.reference.json`](./pi/settings.reference.json)
 shows the pi adapter settings shape, and the external-host examples below show
 plain MCP registrations.

package/docs/setup-clean-host.md

@@ -4,9 +4,11 @@ End-to-end install of **entwurf** on a host with only `git` available — no
 node, no npm package, no pi binary, no dotfiles. The point is to validate the
 public install surface as an outside user would experience it.
 
-> **Scope.** This is the entwurf 0.12.1 install recipe. The base package install
+> **Scope.** This is the entwurf 0.12.5 install recipe. The base package install
 > is **neutral npm**, not `pi install npm:...`. Pi is an optional adapter lane for
-> the ACP provider / control-socket runtime.
+> the ACP provider / control-socket runtime. The 0.12.5 floor fix is explicitly
+> covered here: installed packages under `node_modules` must not run raw `.ts`
+> bridge, doctor, or plugin-hook helpers through Node strip-types.
 
 `entwurf` is a garden-citizen dispatch substrate and meta-bridge. It does not
 provide, copy, or mediate backend credentials — it lets the official backend CLI
@@ -29,7 +31,7 @@ ssh cleanhost 'uname -a; whoami; which git node npm pi claude 2>/dev/null'
 |---|---|---|
 | Node | **24** recommended; `>=22.6.0` minimum | `engines.node` (Node strip-types / ESM runtime) |
 | npm | bundled with Node 24 | public package install path |
-| entwurf | `@junghanacs/entwurf` | neutral npm package; exposes `entwurf` and `entwurf-bridge` bins |
+| entwurf | `@junghanacs/entwurf` | neutral npm package; exposes `entwurf`, `entwurf-bridge`, and `entwurf-statusline` bins |
 | pi binary | **optional**, `@earendil-works/pi-coding-agent >=0.80.3 <0.81` | needed only for the pi adapter / ACP provider / spawn-bg resume lane |
 
 ## Stage 0 — Node 24 via nvm
@@ -62,6 +64,7 @@ npm install -g @junghanacs/entwurf
 
 which entwurf
 which entwurf-bridge
+which entwurf-statusline
 entwurf --help | head -5
 ```
 
@@ -72,9 +75,14 @@ MCP bridge can boot in Claude Code / Codex / Antigravity without pi present.
 ## Stage 2 — auth-free bridge boot
 
 Prove the installed MCP server answers `tools/list` from inside `node_modules`.
-This is the regression that 0.12.0 missed: Node refuses `--experimental-strip-types`
-for `.ts` under `node_modules`, so the installed package must boot the prebuilt
-JS under `mcp/entwurf-bridge/dist/`.
+This is the first `node_modules` strip-types regression fixed in 0.12.0: Node
+refuses `--experimental-strip-types` for `.ts` under `node_modules`, so the
+installed package must boot the prebuilt JS under `mcp/entwurf-bridge/dist/`.
+The same installed-vs-dev split then closes the other two `.ts`-at-runtime
+surfaces on that same fence: the `doctor-meta-bridge` store-scan helper (0.12.4)
+and the plugin `SessionStart`/`UserPromptSubmit` hook (0.12.5, runs the compiled
+`dist/pi-extensions/meta-bridge-hook.js` when installed). Installed packages run
+tsc-emitted JS on every one of these; dev clones keep the `.ts` source.
 
 ```bash
 node --input-type=module <<'JS'
@@ -141,6 +149,31 @@ entwurf install-meta-bridge
 entwurf doctor-meta-bridge
 ```
 
+On an installed package (`.../node_modules/@junghanacs/entwurf`), the doctor must
+not try to strip-types-run raw `.ts` helpers or hooks. In the output, check for
+these 0.12.5 floor-regression signals:
+
+```text
+ok    cached SessionStart hook executes cleanly in an isolated temp agent dir
+ok    full store scan: no corrupt records, duplicate nativeSessionId, body/filename drift, or backend↔wakeMode contradiction
+ok    check-entwurf-v2-surface: shipped surface source present; exhaustive source-shape gate is a repo/release invariant (not run under node_modules)
+```
+
+If any of those sections reports `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`,
+the host is still running a pre-0.12.5 package or a broken tarball. Reinstall the
+current package and re-run `entwurf install-meta-bridge && entwurf doctor-meta-bridge`.
+
+Upgrade invariant: every global npm/pnpm package upgrade must be followed by
+`entwurf install-meta-bridge` from that same installed binary and then
+`entwurf doctor-meta-bridge`. Installed statusline/MCP entries use stable bin
+shims and the marketplace source lives in a version-stable operator data dir, but
+package managers still do not re-materialize Claude's plugin bundle/cache. If a
+dev checkout's `./run.sh doctor-meta-bridge` expects repo-owned paths while the
+global install intentionally owns the meta-bridge (or the reverse), that is an
+ownership mismatch — run the doctor from the surface that intentionally owns the
+install, or reinstall from the other surface. Restart already-open Claude Code
+sessions after changing the meta-bridge install.
+
 A plain external MCP host can call tools but is non-replyable. A garden-native
 meta-session has a garden id, a mailbox, and a trusted sender marker; it can call
 `entwurf_self`, receive mailbox wakeups, and be replied to by garden id.

package/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js

@@ -0,0 +1,218 @@
+/**
+ * meta-bridge-hook — the Claude Code native-session entry shell (1.0.0 step 4).
+ *
+ * THE load-bearing hook. Shipped inside a plugin bundle whose `hooks/hooks.json`
+ * wires it to `SessionStart` (and `CwdChanged` / `UserPromptSubmit`). Because a
+ * plugin's hooks load at STARTUP (a bare skill's load only on invocation, after
+ * SessionStart has passed), this fires on every native Claude Code open and makes
+ * that session a garden citizen WITHOUT any pi JSONL of its own:
+ *
+ *   stdin {session_id, transcript_path, cwd}  (Claude hook envelope)
+ *     -> upsertMetaSession(claude-code)        idempotent create/attach the record
+ *        -> gardenId                           the session's garden address
+ *     -> arm watchPath <mailbox>/<gardenId>/inbox.signal   idle-wake doorbell
+ *     -> stdout hookSpecificOutput.watchPaths  (SessionStart / CwdChanged only)
+ *
+ * The record is keyed/looked-up by `native_session_id` (THE authority,
+ * scanByNativeId); the idle-wake mailbox is keyed by GARDEN id — that is the
+ * whole point of the meta-bridge over the raw per-session prototype: one garden
+ * address a sender can target, decoupled from the backend's native id grammar.
+ *
+ * FAILURE POLICY (decided, see NEXT.md step 4): the runtime hook is
+ * BEST-EFFORT + LOG. It never screams into the user's terminal and never blocks
+ * startup — on any error it appends a line to `<pi-agent-dir>/meta-bridge-hook.log`
+ * and emits an empty `{}` (no arm). The fail-LOUD surface is the doctor
+ * (step 5), which reads that log + the meta-record dir to catch a silent miss.
+ *
+ * watchPaths can be emitted only from SessionStart / CwdChanged / FileChanged, so
+ * a UserPromptSubmit fire does a degraded RECORD backfill (upsert) but cannot
+ * re-arm the idle watch — the record's address is restored, the wake is not.
+ *
+ * Run (dev clone): `<node> --experimental-strip-types <plugin-root>/meta-bridge-hook.ts`.
+ * Run (installed):  `<node> <plugin-root>/meta-bridge-hook.js` — the tsc-emitted
+ * closure (build-bridge → dist), because Node REFUSES strip-types on a `.ts` below
+ * node_modules (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING). The installer picks
+ * the artifact by layout (0.12.5), mirroring start.sh / store-doctor.
+ * Imports `./lib/meta-session.ts` (+ `./lib/session-id.js`); `rewriteRelativeImportExtensions`
+ * rewrites that to `./lib/meta-session.js` in the emitted closure. The installer
+ * copies the lib dir alongside this file so `${CLAUDE_PLUGIN_ROOT}` self-locates it.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { defaultMetaMailboxDir, defaultMetaSessionsDir, upsertMetaSession, writeMetaReceiverMarker, writeMetaSenderMarker, } from "./lib/meta-session.js";
+function logLine(level, message) {
+    try {
+        // dirname(meta-sessions) == the pi agent dir — no extra resolver export needed.
+        const file = path.join(path.dirname(defaultMetaSessionsDir()), "meta-bridge-hook.log");
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.appendFileSync(file, `${new Date().toISOString()} ${level} ${message}\n`);
+    }
+    catch {
+        /* logging is best-effort; a broken log must not break the session */
+    }
+}
+/** Emit a hook response on stdout and exit 0. `{}` means "did nothing, do not block startup". */
+function emit(payload) {
+    process.stdout.write(`${JSON.stringify(payload)}\n`);
+    process.exit(0);
+}
+/**
+ * Map the hook event to a receiver-marker arm provenance. ONLY the genuinely
+ * arm-capable events map; any other (a future/unknown hook event) returns null so we
+ * never mint an "active receiver" presence we cannot back — fail-closed, not an
+ * optimistic session-start. UserPromptSubmit never reaches here (it early-returns
+ * before the arm block).
+ */
+function armProvenanceFor(eventName) {
+    if (eventName === "SessionStart")
+        return "session-start";
+    if (eventName === "CwdChanged")
+        return "cwd-changed";
+    if (eventName === "FileChanged")
+        return "file-changed";
+    return null;
+}
+function main() {
+    let raw;
+    try {
+        raw = fs.readFileSync(0, "utf8"); // fd 0 = stdin (the Claude hook envelope)
+    }
+    catch (err) {
+        logLine("ERROR", `stdin read failed: ${err instanceof Error ? err.message : String(err)}`);
+        emit({});
+    }
+    let env;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null)
+            throw new Error("envelope is not an object");
+        env = parsed;
+    }
+    catch (err) {
+        logLine("ERROR", `envelope parse failed: ${err instanceof Error ? err.message : String(err)}`);
+        emit({});
+    }
+    const sessionId = typeof env.session_id === "string" ? env.session_id : "";
+    const transcriptPath = typeof env.transcript_path === "string" ? env.transcript_path : "";
+    // cwd: prefer the envelope's, fall back to the process cwd (the hook runs in the session's cwd).
+    const cwd = typeof env.cwd === "string" && env.cwd.length > 0 ? env.cwd : process.cwd();
+    const modelEnvelope = env.model;
+    const model = typeof modelEnvelope === "object" &&
+        modelEnvelope !== null &&
+        typeof modelEnvelope.id === "string"
+        ? modelEnvelope.id
+        : typeof env.model_id === "string"
+            ? env.model_id
+            : undefined;
+    const eventName = typeof env.hook_event_name === "string" ? env.hook_event_name : "SessionStart";
+    if (!sessionId || !transcriptPath) {
+        // A degraded envelope: cannot mint an honest reference record. Log + no-op
+        // rather than write a half-record or guess a transcript path. LEVEL depends
+        // on the event: a degraded SessionStart / CwdChanged means the session FAILED
+        // to become (or refresh) a garden citizen — that is the silent registration
+        // miss the doctor must catch (blocker #2), so ERROR. UserPromptSubmit only
+        // ever does a best-effort record backfill, so a degraded one is just WARN.
+        const degradedLevel = eventName === "UserPromptSubmit" ? "WARN" : "ERROR";
+        logLine(degradedLevel, `degraded envelope (event=${eventName}, session_id=${sessionId ? "set" : "MISSING"}, transcript_path=${transcriptPath ? "set" : "MISSING"})`);
+        emit({});
+    }
+    let gardenId;
+    try {
+        const result = upsertMetaSession({
+            input: { backend: "claude-code", nativeSessionId: sessionId, transcriptPath, cwd, model },
+            onSkip: (filename, e) => logLine("WARN", `scan skipped ${filename}: ${e.message}`),
+        });
+        gardenId = result.record.gardenId;
+        logLine("INFO", `${result.action} record ${path.basename(result.path)} (event=${eventName}, native=${sessionId})`);
+    }
+    catch (err) {
+        // Best-effort: a broken record store must surface via the doctor, not by
+        // breaking the user's session open. Log and continue with no arm. This is
+        // the silent-registration-miss (blocker #2): the session opened fine but is
+        // NOT a garden citizen — the doctor catches it via this ERROR line.
+        logLine("ERROR", `upsert failed (event=${eventName}, native=${sessionId}): ${err instanceof Error ? err.message : String(err)}`);
+        emit({});
+    }
+    // Sender marker, keyed by the shared Claude Code parent pid: the user-scope
+    // MCP child (same parent) reads it at entwurf_v2 send time to promote this
+    // session from anonymous external-mcp to a REPLYABLE meta-session sender —
+    // process ancestry, not cwd inference (same repo + multiple sessions would be
+    // ambiguous). Best-effort: a failed marker only costs reply-addressability
+    // (WARN), it does not break the session or the receiver path.
+    //
+    // SE-1/SE-2 (dual-owner fix): write ONLY for the direct parent (process.ppid =
+    // the Claude CLI that ran this hook, verified the native tree is direct — the
+    // plugin host is not in between). The old code ALSO wrote a marker for the
+    // grandparent. That grandparent is the login shell (e.g. bash under ghostty/i3),
+    // which OUTLIVES the Claude session: when Claude exits, the grandparent marker's
+    // ownerStartKey still matches a live pid, so it passes readMetaSenderMarker's
+    // reuse guard and the dead session keeps looking like a live, replyable receiver
+    // — a false-positive "active receiver" leak. The owner must be the watchPaths
+    // subscriber (the Claude CLI), nothing higher. If a stray topology means the MCP
+    // child's shared ancestor is not process.ppid, that resolves to "no marker"
+    // (fail-closed, honest) rather than a wrong-but-live grandparent identity.
+    const ownerPid = process.ppid;
+    if (typeof ownerPid === "number" && ownerPid > 0) {
+        try {
+            writeMetaSenderMarker({ backend: "claude-code", gardenId, nativeSessionId: sessionId, cwd, ownerPid });
+            logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${eventName})`);
+        }
+        catch (err) {
+            logLine("WARN", `sender marker write failed (event=${eventName}, pid=${ownerPid}, garden=${gardenId}): ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // watchPaths is emittable only from SessionStart / CwdChanged / FileChanged.
+    // UserPromptSubmit reaches here only to backfill the record above; it must NOT
+    // claim to arm a watch it cannot (decided).
+    if (eventName === "UserPromptSubmit") {
+        emit({});
+    }
+    try {
+        const mailbox = path.join(defaultMetaMailboxDir(), gardenId);
+        fs.mkdirSync(mailbox, { recursive: true });
+        const signal = path.join(mailbox, "inbox.signal");
+        if (!fs.existsSync(signal))
+            fs.writeFileSync(signal, "", { mode: 0o600 });
+        logLine("INFO", `armed watch ${signal}`);
+        // Receiver presence marker (SE-2): written on the arm-capable hook path that
+        // emits watchPaths, keyed by garden id with the watch owner pid (= the Claude
+        // CLI, process.ppid — same single owner as the sender marker, never the
+        // grandparent). It records that a LIVE owner reached the watch-arm emit; it is
+        // not proof the host ack'd the watch registration. This is what lets a sender
+        // tell a live receiver from a terminated one whose record still lingers.
+        // Best-effort: a failed/skipped marker only costs deliverability detection
+        // (WARN), it does not break the arm. An unknown event maps to null provenance →
+        // no marker (fail-closed: never claim an active receiver we cannot back).
+        const ownerPid = process.ppid;
+        const armProvenance = armProvenanceFor(eventName);
+        if (armProvenance === null) {
+            logLine("WARN", `receiver marker skipped — non-arm event ${eventName} (garden=${gardenId})`);
+        }
+        else if (typeof ownerPid === "number" && ownerPid > 0) {
+            try {
+                writeMetaReceiverMarker({
+                    gardenId,
+                    backend: "claude-code",
+                    nativeSessionId: sessionId,
+                    ownerPid,
+                    armProvenance,
+                });
+                logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName}`);
+            }
+            catch (err) {
+                logLine("WARN", `receiver marker write failed (event=${eventName}, garden=${gardenId}): ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        emit({
+            hookSpecificOutput: {
+                hookEventName: eventName,
+                watchPaths: [signal],
+            },
+        });
+    }
+    catch (err) {
+        logLine("ERROR", `arm failed (event=${eventName}, garden=${gardenId}): ${err instanceof Error ? err.message : String(err)}`);
+        emit({}); // record landed; only the arm failed — the doctor will flag the missing watch.
+    }
+}
+main();

package/mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+/**
+ * meta-bridge-store-doctor — fail-loud full scan for meta-session records.
+ *
+ * The store is the authority for native→garden lookup. Doctor must therefore
+ * refuse corrupt records, duplicate nativeSessionId authorities, and body ↔
+ * filename drift instead of auto-pruning or silently picking one.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { parseMetaIdentity } from "../pi-extensions/lib/meta-session.js";
+const dir = process.argv[2];
+if (!dir) {
+    console.error("usage: node --experimental-strip-types scripts/meta-bridge-store-doctor.ts <meta-sessions-dir>");
+    process.exit(2);
+}
+const failures = [];
+const nativeToFiles = new Map();
+let scanned = 0;
+if (!fs.existsSync(dir)) {
+    console.log(`meta-store scan ok: ${dir} does not exist yet (0 records)`);
+    process.exit(0);
+}
+for (const filename of fs.readdirSync(dir).sort()) {
+    if (!filename.endsWith(".meta.json"))
+        continue;
+    scanned += 1;
+    const file = path.join(dir, filename);
+    try {
+        // dual-read (3D-4 commit1): parseMetaIdentity reads v1 AND v2 and normalizes,
+        // so doctor's gardenId/nativeSessionId checks survive the v2 cut.
+        const id = parseMetaIdentity(fs.readFileSync(file, "utf8"));
+        const expectedFilename = `${id.gardenId}.meta.json`;
+        if (filename !== expectedFilename) {
+            failures.push(`${filename}: body/filename drift — body gardenId=${id.gardenId}, expected filename ${expectedFilename}`);
+        }
+        const files = nativeToFiles.get(id.nativeSessionId) ?? [];
+        files.push(filename);
+        nativeToFiles.set(id.nativeSessionId, files);
+    }
+    catch (err) {
+        failures.push(`${filename}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+for (const [nativeSessionId, files] of nativeToFiles.entries()) {
+    if (files.length > 1) {
+        failures.push(`duplicate nativeSessionId ${JSON.stringify(nativeSessionId)} in ${files.join(", ")} — authority ambiguity; prune manually`);
+    }
+}
+if (failures.length > 0) {
+    for (const failure of failures)
+        console.error(`FAIL: ${failure}`);
+    process.exit(1);
+}
+console.log(`meta-store scan ok: ${scanned} record(s) scanned, no corrupt/duplicate/drift records`);

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -33,10 +33,35 @@
 	// Clear the root `exclude` (it filters out every `.ts`-extension lib file the
 	// bridge graph needs). Only node_modules must stay excluded.
 	"exclude": ["../../node_modules"],
-	// Just the bridge entry (+ the dependency-free protocol.js it reaches via an
-	// explicit `.js` import). tsc auto-follows the import graph — STATIC imports
-	// AND the lazy `await import("./entwurf-preflight.ts")` — and emits exactly the
-	// boot closure, nothing more. This tracks graph drift automatically and keeps
-	// the pi-lane-only acp/* (unreached at boot) out of the tarball.
-	"include": ["./src/index.ts", "../../protocol.js"]
+	// The bridge boot entry (+ the dependency-free protocol.js it reaches via an
+	// explicit `.js` import) PLUS the doctor's store-scan helper. tsc auto-follows
+	// the import graph — STATIC imports AND the lazy
+	// `await import("./entwurf-preflight.ts")` — and emits exactly that closure,
+	// nothing more (the pi-lane-only acp/* stays out of the tarball).
+	//
+	// WHY store-doctor rides THIS build: meta-bridge-doctor.sh's full store scan
+	// must run from an INSTALLED package (under node_modules, where strip-types is
+	// refused) — the same node_modules boundary start.sh crosses. Its only repo
+	// import is pi-extensions/lib/meta-session.ts, which the bridge graph ALREADY
+	// emits here, so it adds ONE leaf JS (dist/scripts/meta-bridge-store-doctor.js)
+	// and ZERO new deps. It is NOT in index.ts's boot closure, so
+	// check-entwurf-bridge-pi-free (which walks the index eager closure) is unaffected.
+	//
+	// WHY meta-bridge-hook rides THIS build (0.12.5): the SessionStart/UserPromptSubmit
+	// plugin hook ran as raw `.ts` (`node ${CLAUDE_PLUGIN_ROOT}/meta-bridge-hook.ts`).
+	// Under an installed marketplace source below node_modules that is
+	// ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING — the SAME strip-types fence
+	// start.sh (0.12.1) and the store-doctor (0.12.4) already cross by shipping JS.
+	// The hook was the last `.ts`-at-runtime surface; emitting it here closes that
+	// class for good (installer copies the dist JS when installed, keeps `.ts` for a
+	// dev clone). Its only repo import is meta-session.ts, ALREADY emitted for the
+	// store-doctor, so this adds ONE leaf JS (dist/pi-extensions/meta-bridge-hook.js)
+	// and ZERO new deps. It is a plugin hook, never in index.ts's boot closure, so
+	// check-entwurf-bridge-pi-free is unaffected.
+	"include": [
+		"./src/index.ts",
+		"../../protocol.js",
+		"../../scripts/meta-bridge-store-doctor.ts",
+		"../../pi-extensions/meta-bridge-hook.ts"
+	]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.12.3",
+	"version": "0.12.5",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -132,7 +132,8 @@
 	},
 	"bin": {
 		"entwurf": "./run.sh",
-		"entwurf-bridge": "./mcp/entwurf-bridge/start.sh"
+		"entwurf-bridge": "./mcp/entwurf-bridge/start.sh",
+		"entwurf-statusline": "./scripts/meta-bridge-statusline.sh"
 	},
 	"peerDependenciesMeta": {
 		"@earendil-works/pi-ai": {

package/pi/meta-bridge/entwurf-meta-receive/hooks/hooks.json

@@ -6,7 +6,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "__NODE_BIN__ ${CLAUDE_PLUGIN_ROOT}/meta-bridge-hook.ts"
+						"command": "__NODE_BIN__ ${CLAUDE_PLUGIN_ROOT}/__HOOK_ENTRY__"
 					}
 				]
 			}
@@ -17,7 +17,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "__NODE_BIN__ ${CLAUDE_PLUGIN_ROOT}/meta-bridge-hook.ts"
+						"command": "__NODE_BIN__ ${CLAUDE_PLUGIN_ROOT}/__HOOK_ENTRY__"
 					}
 				]
 			}
@@ -28,7 +28,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "__NODE_BIN__ ${CLAUDE_PLUGIN_ROOT}/meta-bridge-hook.ts"
+						"command": "__NODE_BIN__ ${CLAUDE_PLUGIN_ROOT}/__HOOK_ENTRY__"
 					}
 				]
 			}

package/pi-extensions/meta-bridge-hook.ts

@@ -28,9 +28,14 @@
  * a UserPromptSubmit fire does a degraded RECORD backfill (upsert) but cannot
  * re-arm the idle watch — the record's address is restored, the wake is not.
  *
- * Run: `<node> --experimental-strip-types <plugin-root>/meta-bridge-hook.ts`.
- * Imports `./lib/meta-session.ts` (+ `./lib/session-id.js`); the installer copies
- * that lib dir alongside this file so `${CLAUDE_PLUGIN_ROOT}` self-locates it.
+ * Run (dev clone): `<node> --experimental-strip-types <plugin-root>/meta-bridge-hook.ts`.
+ * Run (installed):  `<node> <plugin-root>/meta-bridge-hook.js` — the tsc-emitted
+ * closure (build-bridge → dist), because Node REFUSES strip-types on a `.ts` below
+ * node_modules (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING). The installer picks
+ * the artifact by layout (0.12.5), mirroring start.sh / store-doctor.
+ * Imports `./lib/meta-session.ts` (+ `./lib/session-id.js`); `rewriteRelativeImportExtensions`
+ * rewrites that to `./lib/meta-session.js` in the emitted closure. The installer
+ * copies the lib dir alongside this file so `${CLAUDE_PLUGIN_ROOT}` self-locates it.
  */
 
 import * as fs from "node:fs";

package/run.sh

@@ -1731,6 +1731,16 @@ check_pack() {
     # this dist JS when present (the .ts source can't strip-types under
     # node_modules). prepack runs on `npm pack --dry-run`, so it is in this gate.
     "mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js"
+    # 0.12.4 — the doctor's node_modules-safe store-scan artifact. meta-bridge-
+    # doctor.sh runs this prebuilt JS when installed under node_modules (strip-types
+    # refuses the .ts there), same boundary start.sh crosses. build-bridge emits it.
+    "mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js"
+    # 0.12.5 — the node_modules-safe plugin hook + its lib. install-meta-bridge copies
+    # these compiled JS into the assembled plugin when installed (raw .ts can't
+    # strip-types under node_modules). meta-session.js is shared with the store-doctor
+    # above; listed here too so the hook axis fails loud if the emit graph drops it.
+    "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
     "pi/entwurf-targets.json"
@@ -1880,6 +1890,13 @@ check_pack_install() {
     "mcp/entwurf-bridge/src/index.ts"
     # 0.12.1 C — prepack-built node_modules-safe boot artifact (see check-pack).
     "mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js"
+    # 0.12.4 — prebuilt node_modules-safe store-scan artifact for the doctor
+    # (see check-pack). The installed-scan smoke below runs exactly this file.
+    "mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js"
+    # 0.12.5 — node_modules-safe plugin hook + lib (see check-pack). The installed
+    # hook regression below runs exactly this compiled JS from under node_modules.
+    "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
     "pi/entwurf-targets.json"
@@ -2036,8 +2053,8 @@ check_pack_install() {
     fail "[check-pack-install] npm-managed layout missing executable run.sh (postinstall-chmod did not run?) at $npm_pkg"
     return 1
   fi
-  if [ ! -x "$npmroot/node_modules/.bin/entwurf" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-bridge" ]; then
-    fail "[check-pack-install] npm-managed neutral install missing package bins (entwurf / entwurf-bridge)"
+  if [ ! -x "$npmroot/node_modules/.bin/entwurf" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-bridge" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-statusline" ]; then
+    fail "[check-pack-install] npm-managed neutral install missing package bins (entwurf / entwurf-bridge / entwurf-statusline)"
     ls -l "$npmroot/node_modules/.bin" 2>/dev/null | sed 's/^/    /' >&2 || true
     return 1
   fi
@@ -2058,6 +2075,121 @@ check_pack_install() {
   fi
   echo "[check-pack-install] npm-managed install regression pass (hoisted-dep run.sh install wrote settings)"
 
+  # Installed meta-bridge ownership regression (0.12.5): package upgrades must not
+  # bake versioned pnpm-store paths into Claude settings. MCP already uses the
+  # stable `entwurf-bridge` bin; statusLine must now use `entwurf-statusline`, and
+  # the plugin marketplace source must be the version-stable operator data dir
+  # rather than <node_modules>/pi/meta-bridge/.assembled. Use a fake claude CLI so
+  # this stays deterministic/offline while running the REAL installed
+  # install-meta-bridge path and meta-bridge-state apply.
+  local fake_claude_dir="$npm_tmp/fake-claude-bin" fake_claude_log="$npm_tmp/fake-claude.log"
+  mkdir -p "$fake_claude_dir"
+  cat > "$fake_claude_dir/claude" <<'SH'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >> "${FAKE_CLAUDE_LOG:?}"
+case "$1${2:+ $2}" in
+  "--version") echo "2.1.197 (Claude Code)" ;;
+  "plugin validate") : ;;
+  "plugin uninstall") : ;;
+  "plugin marketplace") : ;;
+  "plugin install") : ;;
+  "plugin list") printf '%s\n' "entwurf-meta-receive@meta-bridge-local" "  Status: enabled" ;;
+  "mcp remove") : ;;
+  "mcp add") : ;;
+  "mcp get") printf '%s\n' "Scope: User config" "Status: ✔ Connected" ;;
+  *) : ;;
+esac
+exit 0
+SH
+  chmod +x "$fake_claude_dir/claude"
+  local mb_home="$npm_tmp/meta-home" mb_cfg="$npm_tmp/meta-claude" mb_log
+  mkdir -p "$mb_home" "$mb_cfg"
+  mb_log=$(HOME="$mb_home" XDG_DATA_HOME="$mb_home/.local/share" CLAUDE_CONFIG_DIR="$mb_cfg" FAKE_CLAUDE_LOG="$fake_claude_log" PATH="$fake_claude_dir:$npmroot/node_modules/.bin:$PATH" "$npm_pkg/run.sh" install-meta-bridge 2>&1) || {
+    fail "[check-pack-install] installed install-meta-bridge failed under fake claude:"
+    echo "$mb_log" | tail -20 | sed 's/^/    /' >&2
+    return 1
+  }
+  local stable_asm="$mb_home/.local/share/entwurf/meta-bridge/.assembled"
+  local installed_hook="$stable_asm/entwurf-meta-receive/meta-bridge-hook.js"
+  if [ ! -f "$installed_hook" ]; then
+    fail "[check-pack-install] installed meta-bridge did not assemble the compiled hook JS into the stable operator data dir: $installed_hook"
+    return 1
+  fi
+  if [ -f "$stable_asm/entwurf-meta-receive/meta-bridge-hook.ts" ]; then
+    fail "[check-pack-install] installed meta-bridge shipped a raw .ts hook — installed packages must run compiled JS (strip-types is refused under node_modules)"
+    return 1
+  fi
+  # The artifact existing is not enough (review BLOCKER 1): Claude runs the hooks.json
+  # COMMAND, so assert the baked command actually targets the compiled .js with both
+  # placeholders resolved. A bake that mis-targeted .ts (or left a placeholder) would
+  # still pass the direct-JS smoke below, then fail live.
+  local installed_hooks_json="$stable_asm/entwurf-meta-receive/hooks/hooks.json"
+  if ! grep -q 'meta-bridge-hook\.js' "$installed_hooks_json"; then
+    fail "[check-pack-install] installed hooks.json does not point at the compiled meta-bridge-hook.js: $installed_hooks_json"
+    return 1
+  fi
+  if grep -qE 'meta-bridge-hook\.ts|__HOOK_ENTRY__|__NODE_BIN__' "$installed_hooks_json"; then
+    fail "[check-pack-install] installed hooks.json references a raw .ts entry or an unbaked placeholder (__HOOK_ENTRY__/__NODE_BIN__): $installed_hooks_json"
+    return 1
+  fi
+  if [ -e "$npm_pkg/pi/meta-bridge/.assembled/entwurf-meta-receive" ]; then
+    fail "[check-pack-install] installed meta-bridge still assembled inside the versioned package store: $npm_pkg/pi/meta-bridge/.assembled"
+    return 1
+  fi
+  # 0.12.5 strip-types-fence regression (GPT safety pin). The compiled hook must run
+  # FROM UNDER node_modules with plain node — the exact fence that broke oracle's
+  # 0.12.4 raw-.ts hook (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING). L2 relocates
+  # the runtime marketplace source to XDG, but this hardens the ARTIFACT itself so
+  # it is safe even if a future cache/marketplace path lands under node_modules.
+  local nm_probe="$npmroot/node_modules/@junghanacs/entwurf/pi/meta-bridge/.assembled-packprobe/entwurf-meta-receive"
+  mkdir -p "$nm_probe/lib"
+  cp "$installed_hook" "$nm_probe/meta-bridge-hook.js"
+  cp "$stable_asm/entwurf-meta-receive/lib/meta-session.js" "$nm_probe/lib/meta-session.js"
+  cp "$stable_asm/entwurf-meta-receive/lib/session-id.js" "$nm_probe/lib/session-id.js"
+  cp "$stable_asm/entwurf-meta-receive/entwurf-capabilities.json" "$nm_probe/entwurf-capabilities.json"
+  local probe_env='{"session_id":"pack-probe","transcript_path":"/tmp/x.jsonl","cwd":"/tmp","hook_event_name":"SessionStart","model":{"id":"probe"}}'
+  local probe_out
+  if probe_out="$(printf '%s' "$probe_env" | env PI_CODING_AGENT_DIR="$(mktemp -d)" CLAUDE_PLUGIN_ROOT="$nm_probe" node "$nm_probe/meta-bridge-hook.js" 2>&1)" && printf '%s' "$probe_out" | grep -q hookSpecificOutput; then
+    : # compiled hook crosses the node_modules strip-types fence safely
+  else
+    fail "[check-pack-install] compiled hook failed to run under node_modules with plain node: $(printf '%s' "$probe_out" | tr '\n' ' ' | cut -c1-200)"
+    rm -rf "$nm_probe"; return 1
+  fi
+  # FAIL-reproduction (review BLOCKER 2): a raw .ts at the SAME node_modules location
+  # must be refused SPECIFICALLY by the strip-types fence — not by some unrelated
+  # failure. A missing lib would also exit nonzero and hollow out the proof, so
+  # capture stderr and require the exact ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING.
+  cp "$npm_pkg/pi-extensions/meta-bridge-hook.ts" "$nm_probe/meta-bridge-hook.ts"
+  local ts_out ts_rc
+  ts_out="$(printf '%s' "$probe_env" | env PI_CODING_AGENT_DIR="$(mktemp -d)" CLAUDE_PLUGIN_ROOT="$nm_probe" node "$nm_probe/meta-bridge-hook.ts" 2>&1)" && ts_rc=0 || ts_rc=$?
+  if [ "${ts_rc:-0}" -eq 0 ]; then
+    fail "[check-pack-install] raw .ts hook UNEXPECTEDLY ran under node_modules — strip-types fence moved; the compiled-hook rationale must be revisited"
+    rm -rf "$nm_probe"; return 1
+  fi
+  if ! printf '%s' "$ts_out" | grep -q 'ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING'; then
+    fail "[check-pack-install] raw .ts hook failed under node_modules but NOT via the strip-types fence (expected ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING); got: $(printf '%s' "$ts_out" | tr '\n' ' ' | cut -c1-200) — the regression no longer proves the compiled-hook rationale"
+    rm -rf "$nm_probe"; return 1
+  fi
+  rm -rf "$nm_probe"
+  echo "[check-pack-install] installed hook is node_modules-safe compiled JS (hooks.json points at .js; runs under node_modules with plain node; raw .ts refused there by the strip-types fence)"
+  python3 - "$mb_cfg/settings.json" "$mb_home/.claude.json" "$stable_asm" <<'PY'
+import json, sys
+settings = json.load(open(sys.argv[1]))
+root = json.load(open(sys.argv[2]))
+stable_asm = sys.argv[3]
+market = settings.get("extraKnownMarketplaces", {}).get("meta-bridge-local", {})
+assert market == {"source": {"source": "directory", "path": stable_asm}}, market
+assert settings.get("statusLine") == {"type": "command", "command": "entwurf-statusline"}, settings.get("statusLine")
+mcp = root.get("mcpServers", {}).get("entwurf-bridge", {})
+assert mcp.get("command") == "entwurf-bridge" and mcp.get("args") == [], mcp
+PY
+  if ! grep -q "$stable_asm" "$fake_claude_log"; then
+    fail "[check-pack-install] fake claude did not receive the stable marketplace path during install-meta-bridge"
+    sed 's/^/    /' "$fake_claude_log" >&2 || true
+    return 1
+  fi
+  echo "[check-pack-install] installed meta-bridge ownership pass (stable statusline bin + stable marketplace dir + stable MCP bin)"
+
   # 0.12.1 C — installed bridge BOOT regression. This is the test whose absence
   # let the 0.12.0 install bug ship: the README's bridge launcher was
   # `node --experimental-strip-types src/index.ts`, which Node REFUSES under
@@ -2127,6 +2259,52 @@ JS
   fi
   echo "[check-pack-install] installed bridge boot pass (dist boots under node_modules, pi-free: $boot_out)"
 
+  # 0.12.4 — installed STORE-DOCTOR regression. meta-bridge-doctor.sh's full store
+  # scan runs the prebuilt dist JS when it lives under node_modules (strip-types
+  # refuses the .ts there — the same class as the bridge boot above). Before the dist
+  # split the doctor ran the raw .ts and reported a FALSE "corrupt records" FAIL on
+  # EVERY installed host. Prove the shipped dist JS scans a fixture store with PLAIN
+  # node (a strip-types fallback would crash with the exact
+  # ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING) AND that its rewritten import of the
+  # emitted meta-session.js resolves — a real record exercises parseMetaIdentity.
+  local installed_store_doctor="$npm_pkg/mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js"
+  if [ ! -f "$installed_store_doctor" ]; then
+    fail "[check-pack-install] installed store-doctor missing prebuilt dist (prepack did not emit it into the tarball?): $installed_store_doctor"
+    return 1
+  fi
+  local sd_fixture="$npm_tmp/store-fixture"
+  mkdir -p "$sd_fixture"
+  # One valid v2 record: filename == "${gardenId}.meta.json" (no drift), unique
+  # nativeSessionId (no dupe). gardenId must match YYYYMMDDTHHMMSS-[0-9a-f]{6}.
+  printf '%s\n' '{"schemaVersion":2,"gardenId":"20990101T000000-abcdef","backend":"claude-code","nativeSessionId":"native-store-doctor-fixture","cwd":"/tmp/entwurf-fixture","model":null,"transcriptPath":null,"parentGardenId":null,"isEntwurf":false,"createdAt":"2099-01-01T00:00:00.000Z","recordUpdatedAt":"2099-01-01T00:00:00.000Z"}' \
+    > "$sd_fixture/20990101T000000-abcdef.meta.json"
+  local sd_out
+  if ! sd_out=$(node "$installed_store_doctor" "$sd_fixture" 2>&1); then
+    fail "[check-pack-install] installed store-doctor FAILED to scan under node_modules (strip-types-under-node_modules regression, or the emitted meta-session import broke):"
+    echo "$sd_out" | tail -15 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! grep -q "1 record(s) scanned" <<<"$sd_out"; then
+    fail "[check-pack-install] installed store-doctor scanned but did not report the fixture record (parseMetaIdentity path not exercised?): $sd_out"
+    return 1
+  fi
+  echo "[check-pack-install] installed store-doctor scan pass (dist JS scans under node_modules with plain node: $sd_out)"
+
+  # 0.12.4 — installed DOCTOR DISPATCH lock. The artifact above proves the store-scan
+  # target runs under node_modules; this proves the doctor SCRIPT actually routes to
+  # it (store scan → dist JS) and defers the strip-types-only source-shape gate
+  # (v2-surface) when installed, instead of running raw .ts and false-failing.
+  local installed_doctor="$npm_pkg/scripts/meta-bridge-doctor.sh"
+  if ! grep -q 'dist/scripts/meta-bridge-store-doctor.js' "$installed_doctor"; then
+    fail "[check-pack-install] installed doctor does not dispatch the store scan to the dist JS under node_modules: $installed_doctor"
+    return 1
+  fi
+  if ! grep -q 'shipped surface source present' "$installed_doctor"; then
+    fail "[check-pack-install] installed doctor does not defer the v2-surface source-shape gate on installed hosts: $installed_doctor"
+    return 1
+  fi
+  echo "[check-pack-install] installed doctor dispatch lock pass (store-scan → dist JS, v2-surface deferred)"
+
   ok "[check-pack-install] publish install smoke pass"
   return 0
 }

package/scripts/meta-bridge-doctor.sh

@@ -17,6 +17,19 @@ MKT_NAME="meta-bridge-local"
 PLUGIN="entwurf-meta-receive"
 CLAUDE_CFG="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# LIB_EXT tracks the hook artifact mode (0.12.5): installed packages ship the
+# tsc-emitted `.js` closure (node_modules-safe), dev clones run the `.ts` source.
+# The writer-version parity below hashes meta-session.<LIB_EXT> so an installed
+# `.js` bundle is compared against the SAME-pipeline dist `.js`, never against the
+# `.ts` source (which would hash-mismatch and false-STALE).
+case "$REPO" in
+  */node_modules/@junghanacs/entwurf)
+    ASM="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge/.assembled"
+    LIB_EXT="js" ;;
+  *)
+    ASM="$REPO/pi/meta-bridge/.assembled"
+    LIB_EXT="ts" ;;
+esac
 # shellcheck source=scripts/meta-bridge-hook-log.sh
 source "$REPO/scripts/meta-bridge-hook-log.sh"
 
@@ -65,7 +78,7 @@ if command -v python3 >/dev/null; then
   # which key drifted — silent instead of fail-loud. As an `if` condition the
   # substitution's nonzero status is consumed (set -e suspended), so we always
   # reach the detail. stderr (drift detail) is captured via `2>&1 >/dev/null`.
-  if CHECK_ERR="$(python3 "$REPO/scripts/meta-bridge-state.py" check --repo "$REPO" --asm "$REPO/pi/meta-bridge/.assembled" 2>&1 >/dev/null)"; then
+  if CHECK_ERR="$(python3 "$REPO/scripts/meta-bridge-state.py" check --repo "$REPO" --asm "$ASM" 2>&1 >/dev/null)"; then
     ok "state file present and managed settings/MCP keyset survives intact"
   else
     bad "managed settings/MCP keyset missing or overwritten — another consumer may have clobbered a pi-owned key. Re-run ./run.sh install-meta-bridge. Drift detail:"
@@ -93,8 +106,23 @@ if [ -n "$CACHE_HOOKS" ]; then
   # line 158) so BAKED="" routes to that bad(...): an installed hooks.json exists but
   # the doctor cannot read its load-bearing hook command, so the store-churn guard is
   # blind — a verify-impossible state must fail loud, not pass as a soft warn (A3b).
-  BAKED="$({ grep -oE '"command": "[^ ]+ \$\{CLAUDE_PLUGIN_ROOT\}/meta-bridge-hook.ts"' "$CACHE_HOOKS" || true; } | head -1 | sed -E 's/.*"command": "([^ ]+) .*/\1/')"
-  if [ -n "$BAKED" ] && [ -x "$BAKED" ]; then ok "baked node exists + executable: $BAKED"
+  # Match either hook artifact (0.12.5): installed ships meta-bridge-hook.js, dev
+  # clones meta-bridge-hook.ts. Capture the whole command so we run the SAME entry
+  # file the live hook runs (never a hardcoded extension that drifts from install).
+  HOOK_CMD="$({ grep -oE '"command": "[^ ]+ \$\{CLAUDE_PLUGIN_ROOT\}/meta-bridge-hook\.(ts|js)"' "$CACHE_HOOKS" || true; } | head -1)"
+  BAKED="$(printf '%s' "$HOOK_CMD" | sed -E 's/.*"command": "([^ ]+) .*/\1/')"
+  HOOK_FILE="$(printf '%s' "$HOOK_CMD" | sed -E 's#.*/([^/"]+)"$#\1#')"
+  if [ -n "$BAKED" ] && [ -x "$BAKED" ]; then
+    ok "baked node exists + executable: $BAKED"
+    CACHE_ROOT="$(cd "$(dirname "$CACHE_HOOKS")/.." && pwd)"
+    TMP_AGENT="$(mktemp -d 2>/dev/null || mktemp -d -t entwurf-doctor-hook)"
+    HOOK_ENV='{"session_id":"doctor-synthetic-native","transcript_path":"/tmp/entwurf-doctor-synthetic-transcript.jsonl","cwd":"/tmp","hook_event_name":"SessionStart","model":{"id":"doctor-model"}}'
+    if HOOK_OUT="$(printf '%s' "$HOOK_ENV" | env PI_CODING_AGENT_DIR="$TMP_AGENT" CLAUDE_PLUGIN_ROOT="$CACHE_ROOT" "$BAKED" "$CACHE_ROOT/$HOOK_FILE" 2>&1)" && printf '%s' "$HOOK_OUT" | grep -q 'hookSpecificOutput'; then
+      ok "cached SessionStart hook executes cleanly in an isolated temp agent dir"
+    else
+      bad "cached SessionStart hook failed to execute — stale plugin cache / unsupported TS syntax / broken bundle. Re-run install-meta-bridge from the intended surface. Detail: $(printf '%s' "$HOOK_OUT" | tr '\n' ' ' | cut -c1-300)"
+    fi
+    rm -rf "$TMP_AGENT" 2>/dev/null || true
   elif [ -n "$BAKED" ]; then bad "baked node path is DEAD (nix GC / version bump?): $BAKED — re-run ./run.sh install-meta-bridge"
   else bad "could not parse baked node path from $CACHE_HOOKS — hook command format drift; doctor cannot verify the NixOS store-churn guard. Re-run ./run.sh install-meta-bridge or update the doctor parser."; fi
 else
@@ -114,9 +142,15 @@ except Exception:
     print('')
 PY
 )"
-  EXPECTED_STATUSLINE="$REPO/scripts/meta-bridge-statusline.sh"
-  if [ "$STATUSLINE_CMD" = "$EXPECTED_STATUSLINE" ]; then ok "statusLine.command is repo-owned: $STATUSLINE_CMD"; else bad "statusLine.command drifted (got '$STATUSLINE_CMD', expected '$EXPECTED_STATUSLINE')"; fi
-  if [ -x "$EXPECTED_STATUSLINE" ]; then ok "statusline executable"; else bad "statusline script not executable: $EXPECTED_STATUSLINE"; fi
+  EXPECTED_STATUSLINE="$(python3 "$REPO/scripts/meta-bridge-state.py" desired-statusline --repo "$REPO" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("command", ""))')"
+  if [ "$STATUSLINE_CMD" = "$EXPECTED_STATUSLINE" ]; then ok "statusLine.command matches expected (dev: checkout path; installed: entwurf-statusline bin shim): $STATUSLINE_CMD"; else bad "statusLine.command drifted (got '$STATUSLINE_CMD', expected '$EXPECTED_STATUSLINE')"; fi
+  if [[ "$EXPECTED_STATUSLINE" == */* ]]; then
+    if [ -x "$EXPECTED_STATUSLINE" ]; then ok "statusline executable"; else bad "statusline script not executable: $EXPECTED_STATUSLINE"; fi
+  elif command -v "$EXPECTED_STATUSLINE" >/dev/null 2>&1; then
+    ok "statusline bin resolves on PATH: $(command -v "$EXPECTED_STATUSLINE")"
+  else
+    bad "statusline bin not on PATH: $EXPECTED_STATUSLINE"
+  fi
   SAMPLE_STATUSLINE_OUT="$(printf '%s' '{"session_id":"doctor-no-record","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-5"},"context_window":{"context_window_size":200000,"used_percentage":1,"current_usage":{"input_tokens":1}}}' | "$EXPECTED_STATUSLINE" 2>/dev/null || true)"
   if [ "$(printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | wc -l | tr -d ' ')" = "2" ] && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '🪛' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q ' cc | s'; then ok "statusline synthetic execution emits two rows (work context + identity)"; else bad "statusline synthetic execution failed or omitted two-row work/identity marker"; fi
 else
@@ -147,10 +181,36 @@ echo "[meta-record store]"
 mkdir -p "$META_SESSIONS" 2>/dev/null || true
 if [ -d "$META_SESSIONS" ] && [ -w "$META_SESSIONS" ]; then ok "writable: $META_SESSIONS"; else bad "meta-sessions dir not writable: $META_SESSIONS"; fi
 if command -v node >/dev/null; then
-  if node --experimental-strip-types "$REPO/scripts/meta-bridge-store-doctor.ts" "$META_SESSIONS" >/dev/null 2>&1; then
-    ok "full store scan: no corrupt records, duplicate nativeSessionId, body/filename drift, or backend↔wakeMode contradiction"
-  else
-    bad "full store scan failed — corrupt/duplicate/drift meta-record(s) present. Inspect with: node --experimental-strip-types $REPO/scripts/meta-bridge-store-doctor.ts $META_SESSIONS"
+  # Full store scan — mode by LOCATION (mirror mcp/entwurf-bridge/start.sh). Node
+  # REFUSES --experimental-strip-types for a .ts under node_modules
+  # (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING), so an INSTALLED package must scan
+  # via the prebuilt dist JS (build-bridge emits it; files:["mcp/"] ships it); a DEV
+  # CLONE lives outside node_modules and runs the .ts source. Before this split the
+  # doctor always ran the .ts and reported a FALSE "corrupt records" FAIL on every
+  # installed host (the 0.12.0 strip-types-under-node_modules class the bridge boot
+  # already fixed, but this doctor helper still ran raw .ts).
+  case "$REPO" in
+    */node_modules/*)
+      store_doctor="$REPO/mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js"
+      if [ -f "$store_doctor" ]; then
+        store_scan=(node "$store_doctor" "$META_SESSIONS")
+      else
+        bad "installed under node_modules but prebuilt store-doctor missing: $store_doctor — the tarball ships it via prepack; reinstall @junghanacs/entwurf"
+        store_scan=()
+      fi
+      ;;
+    *)
+      store_scan=(node --experimental-strip-types "$REPO/scripts/meta-bridge-store-doctor.ts" "$META_SESSIONS")
+      ;;
+  esac
+  # Guard the expansion: bash 3.2 (macOS) + set -u errors on "${arr[@]}" for a
+  # zero-length array, so only run/print when the command was actually built.
+  if [ "${#store_scan[@]}" -gt 0 ]; then
+    if "${store_scan[@]}" >/dev/null 2>&1; then
+      ok "full store scan: no corrupt records, duplicate nativeSessionId, body/filename drift, or backend↔wakeMode contradiction"
+    else
+      bad "full store scan failed — corrupt/duplicate/drift meta-record(s) present. Inspect with: ${store_scan[*]}"
+    fi
   fi
 else
   bad "cannot scan meta-record store without node"
@@ -215,10 +275,17 @@ registry_for_ms() { # $1=bundle meta-session.ts → sibling plugin-root registry
   dirname "$(dirname "$1")"
 }
 
-SRC_MS="$REPO/pi-extensions/lib/meta-session.ts"
+# Source authority for parity depends on the mode: an installed bundle carries the
+# dist `.js`, so compare it against the dist `.js` (same tsc pipeline → hash-equal);
+# a dev clone carries the `.ts`, so compare against the `.ts` source.
+if [ "$LIB_EXT" = "js" ]; then
+  SRC_MS="$REPO/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
+else
+  SRC_MS="$REPO/pi-extensions/lib/meta-session.ts"
+fi
 SRC_REG="$REPO/pi/entwurf-capabilities.json"
-ASM_MS="$REPO/pi/meta-bridge/.assembled/$PLUGIN/lib/meta-session.ts"
-INST_MS="$(ls "$CLAUDE_CFG"/plugins/cache/"$MKT_NAME"/"$PLUGIN"/*/lib/meta-session.ts 2>/dev/null | head -1 || true)"
+ASM_MS="$ASM/$PLUGIN/lib/meta-session.$LIB_EXT"
+INST_MS="$(ls "$CLAUDE_CFG"/plugins/cache/"$MKT_NAME"/"$PLUGIN"/*/lib/meta-session."$LIB_EXT" 2>/dev/null | head -1 || true)"
 
 ASM_ROOT="$(registry_for_ms "$ASM_MS")"
 INST_ROOT="$(registry_for_ms "${INST_MS:-}")"
@@ -297,11 +364,30 @@ if [ -f "$V2_MCP_SRC" ] && grep -q 'server.tool(' "$V2_MCP_SRC" && grep -q '"ent
 else
   bad "MCP entwurf_v2 verb not found in entwurf-bridge"
 fi
-if [ -f "$V2_SURFACE_SRC" ] && (cd "$REPO" && node --experimental-strip-types scripts/check-entwurf-v2-surface.ts >/dev/null 2>&1); then
-  ok "check-entwurf-v2-surface gate passes (surface adapter + pi-native/MCP wiring)"
-else
-  bad "check-entwurf-v2-surface gate FAILED or surface adapter missing — run: ./run.sh check-entwurf-v2-surface"
-fi
+# check-entwurf-v2-surface is a SOURCE-SHAPE gate: it strip-types-runs a .ts gate
+# (which imports typebox, a dev dep) to assert the surface source shape. Under
+# node_modules that cannot run (strip-types refused + dev deps absent), AND its
+# subject — the shipped surface source shape — is a repo/release invariant already
+# enforced by the release gate. So on an INSTALLED host, confirm the surface source
+# SHIPPED and defer the exhaustive gate; the live runtime wiring (flag/tool/MCP verb)
+# is already proven by the grep checks just above. Running the full .ts gate here
+# produced a FALSE "gate FAILED" on every installed host.
+case "$REPO" in
+  */node_modules/*)
+    if [ -f "$V2_SURFACE_SRC" ]; then
+      ok "check-entwurf-v2-surface: shipped surface source present; exhaustive source-shape gate is a repo/release invariant (not run under node_modules)"
+    else
+      bad "entwurf-v2-surface.ts missing from the installed package — the v2 surface source did not ship"
+    fi
+    ;;
+  *)
+    if [ -f "$V2_SURFACE_SRC" ] && (cd "$REPO" && node --experimental-strip-types scripts/check-entwurf-v2-surface.ts >/dev/null 2>&1); then
+      ok "check-entwurf-v2-surface gate passes (surface adapter + pi-native/MCP wiring)"
+    else
+      bad "check-entwurf-v2-surface gate FAILED or surface adapter missing — run: ./run.sh check-entwurf-v2-surface"
+    fi
+    ;;
+esac
 # prefixRoots operator policy (5d-4b): the shared env SSOT both v2 surfaces read. Display
 # ONLY — the parser SSOT lives in entwurf-v2-surface.ts (proven by check-entwurf-v2-surface);
 # the doctor does NOT re-implement parsing. Unset ⇒ no prefix promotion (the safe default).

package/scripts/meta-bridge-install.sh

@@ -13,8 +13,9 @@
 #      entwurf_inbox_read tool comes from USER-scope entwurf-bridge MCP wiring
 #      (`claude mcp add -s user ...`). Project-scoped .mcp.json is deliberately
 #      not enough: a /tmp native session would wake without a receipt tool.
-#   2. marketplace add <repo-stable .assembled>  (NOT /tmp — ephemeral source
-#      would break `claude plugin marketplace update`).
+#   2. marketplace add <stable .assembled>  (dev: repo-local; installed package:
+#      version-stable XDG data dir; NOT /tmp — ephemeral source would break
+#      `claude plugin marketplace update`).
 #   3. install entwurf-meta-receive@meta-bridge-local --scope user  (= global:
 #      every native session auto-loads it; no manual --plugin-dir).
 #   4. install/update USER-scope entwurf-bridge MCP, so every native session has
@@ -30,7 +31,31 @@ REPO="$(cd "$HERE/.." && pwd)"
 MKT_NAME="meta-bridge-local"
 PLUGIN="entwurf-meta-receive"
 SRC="$REPO/pi/meta-bridge"
-ASM="$SRC/.assembled"
+# Dev clone: keep the marketplace source inside the checkout for transparent
+# inspection. Installed package: assemble into a version-stable operator path;
+# Claude settings store this directory path and package-manager upgrades do not
+# rewrite it, so a pnpm-store path would go stale on version/peer churn.
+#
+# The SAME installed-vs-dev split also picks the hook artifact (0.12.5): an
+# installed marketplace source lives below node_modules, where Node REFUSES
+# `--experimental-strip-types` on `.ts` (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING),
+# so installed packages run the tsc-emitted `meta-bridge-hook.js` closure (mirrors
+# start.sh/store-doctor). Dev clones live outside node_modules and run the `.ts`
+# source directly for transparent editing. HOOK_ENTRY is baked into hooks.json.
+case "$REPO" in
+  */node_modules/@junghanacs/entwurf)
+    ASM="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge/.assembled"
+    HOOK_ENTRY="meta-bridge-hook.js"
+    HOOK_SRC="$REPO/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
+    LIB_SRC="$REPO/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
+    LIB_EXT="js" ;;
+  *)
+    ASM="$SRC/.assembled"
+    HOOK_ENTRY="meta-bridge-hook.ts"
+    HOOK_SRC="$REPO/pi-extensions/meta-bridge-hook.ts"
+    LIB_SRC="$REPO/pi-extensions/lib/meta-session.ts"
+    LIB_EXT="ts" ;;
+esac
 
 die() { echo "meta-bridge-install: $*" >&2; exit 1; }
 
@@ -65,9 +90,12 @@ mkdir -p "$ASM"
 cp -r "$SRC/.claude-plugin" "$ASM/.claude-plugin"
 cp -r "$SRC/$PLUGIN" "$ASM/$PLUGIN"
 # entry shell + its lib travel WITH the plugin so the install copy is self-contained.
-cp "$REPO/pi-extensions/meta-bridge-hook.ts" "$ASM/$PLUGIN/meta-bridge-hook.ts"
+# Installed → tsc-emitted JS (dist, node_modules-safe); dev clone → strip-types .ts.
+[ -f "$HOOK_SRC" ] || die "hook artifact missing: $HOOK_SRC (installed package ships it via prepack build-bridge → dist; reinstall @junghanacs/entwurf, or run 'pnpm run build-bridge' in a dev clone)."
+[ -f "$LIB_SRC" ]  || die "hook lib artifact missing: $LIB_SRC (same build-bridge dist closure)."
+cp "$HOOK_SRC" "$ASM/$PLUGIN/$HOOK_ENTRY"
 mkdir -p "$ASM/$PLUGIN/lib"
-cp "$REPO/pi-extensions/lib/meta-session.ts" "$ASM/$PLUGIN/lib/meta-session.ts"
+cp "$LIB_SRC" "$ASM/$PLUGIN/lib/meta-session.$LIB_EXT"
 cp "$REPO/pi-extensions/lib/session-id.js" "$ASM/$PLUGIN/lib/session-id.js"
 # v2 writer (3D-3+) reads the capability registry at runtime
 # (loadMetaCapabilityRegistry). It MUST travel at the plugin ROOT — meta-session's
@@ -76,23 +104,29 @@ cp "$REPO/pi-extensions/lib/session-id.js" "$ASM/$PLUGIN/lib/session-id.js"
 # Without this, a v2 writer throws on every mint/parse. doctor-meta-bridge asserts it.
 cp "$REPO/pi/entwurf-capabilities.json" "$ASM/$PLUGIN/entwurf-capabilities.json"
 chmod +x "$ASM/$PLUGIN/scripts/doorbell.sh"
-# Bake the node abspath into hooks.json — the ONLY templated surface. mailbox /
-# meta-record dirs resolve at runtime inside entry.ts (<pi-agent-dir>, fixed ~/).
+# Bake the node abspath AND the hook entry filename into hooks.json — the two
+# templated surfaces (0.12.5: HOOK_ENTRY is meta-bridge-hook.js when installed,
+# .ts in a dev clone). mailbox / meta-record dirs resolve at runtime inside the
+# hook itself (<pi-agent-dir>, fixed ~/).
 # The plugin owns ONLY the wake/record hooks; the receiver-side entwurf_inbox_read
 # tool is NOT the plugin's job. It comes from USER-scope entwurf-bridge MCP
 # wiring (`claude mcp add -s user ...`), never a plugin .mcp.json duplicate.
 HOOKS="$ASM/$PLUGIN/hooks/hooks.json"
-HOOKS_PATH="$HOOKS" NODE_PATH_TO_BAKE="$NODE_BIN" python3 - <<'PY'
+HOOKS_PATH="$HOOKS" NODE_PATH_TO_BAKE="$NODE_BIN" HOOK_ENTRY_TO_BAKE="$HOOK_ENTRY" python3 - <<'PY'
 from pathlib import Path
 import os
 hooks = Path(os.environ["HOOKS_PATH"])
 node = os.environ["NODE_PATH_TO_BAKE"]
+hook_entry = os.environ["HOOK_ENTRY_TO_BAKE"]
 text = hooks.read_text(encoding="utf-8")
-if "__NODE_BIN__" not in text:
-    raise SystemExit(f"node-path bake failed before replacement (placeholder absent in {hooks})")
-hooks.write_text(text.replace("__NODE_BIN__", node), encoding="utf-8")
+for placeholder in ("__NODE_BIN__", "__HOOK_ENTRY__"):
+    if placeholder not in text:
+        raise SystemExit(f"hooks bake failed before replacement ({placeholder} absent in {hooks})")
+hooks.write_text(text.replace("__NODE_BIN__", node).replace("__HOOK_ENTRY__", hook_entry), encoding="utf-8")
 PY
-grep -q "__NODE_BIN__" "$HOOKS" && die "node-path bake failed (placeholder still present in $HOOKS)."
+for placeholder in "__NODE_BIN__" "__HOOK_ENTRY__"; do
+  grep -q "$placeholder" "$HOOKS" && die "hooks bake failed ($placeholder still present in $HOOKS)."
+done
 echo "[meta-bridge-install] assembled $ASM (node baked, entry+lib bundled; MCP wiring is NOT plugin-owned)"
 
 # --- validate the manifests before touching user config ---------------------

package/scripts/meta-bridge-state.py

@@ -306,6 +306,12 @@ def desired_mcp(repo: Path) -> dict[str, Any]:
 
 
 def desired_statusline(repo: Path) -> dict[str, Any]:
+    if is_installed_package(repo):
+        # Installed package: mirror the MCP stable-bin pattern. The statusLine is
+        # executed at render time, so a bare bin shim lets npm/pnpm update the
+        # target on package upgrade without rewriting Claude settings. Dev clones
+        # stay pinned to their checkout below.
+        return {"type": "command", "command": "entwurf-statusline"}
     return {"type": "command", "command": str((repo / "scripts" / "meta-bridge-statusline.sh").resolve())}
 
 
@@ -543,7 +549,16 @@ def main() -> int:
     parser = argparse.ArgumentParser(description="entwurf meta-bridge state manager")
     parser.add_argument(
         "command",
-        choices=["prepare", "apply", "preflight-uninstall", "uninstall", "check", "managed-keys", "desired-mcp"],
+        choices=[
+            "prepare",
+            "apply",
+            "preflight-uninstall",
+            "uninstall",
+            "check",
+            "managed-keys",
+            "desired-mcp",
+            "desired-statusline",
+        ],
     )
     parser.add_argument("--repo", default=Path(__file__).resolve().parents[1], type=Path)
     parser.add_argument("--asm", default=None, type=Path)
@@ -568,6 +583,10 @@ def main() -> int:
             # write for --repo. Lets a deterministic guard assert the installed-vs-clone
             # dual-mode without spinning up a real `claude` CLI. --repo need not exist.
             print(json.dumps(desired_mcp(repo), indent=2))
+        elif args.command == "desired-statusline":
+            # Same guard surface for the statusLine dual-mode: dev clones pin the
+            # checkout path; installed packages use the stable bin shim.
+            print(json.dumps(desired_statusline(repo), indent=2))
     except StateError as exc:
         print(f"meta-bridge-state: {exc}", file=sys.stderr)
         return 1

package/scripts/meta-bridge-uninstall.sh

@@ -36,4 +36,17 @@ else
 fi
 
 python3 "$REPO/scripts/meta-bridge-state.py" uninstall --repo "$REPO"
+
+# Remove the assembled marketplace source too — an honest inverse must not orphan
+# it. Installed packages assemble into a version-stable operator data dir
+# (~/.local/share/entwurf/meta-bridge/.assembled); leaving that tree behind is the
+# only meta-bridge footprint uninstall would otherwise leak. Dev clones drop their
+# gitignored in-checkout .assembled. Mirror install-meta-bridge's ASM resolution.
+case "$REPO" in
+  */node_modules/@junghanacs/entwurf)
+    rm -rf "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge"
+    rmdir "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf" 2>/dev/null || true ;;
+  *)
+    rm -rf "$REPO/pi/meta-bridge/.assembled" ;;
+esac
 echo "[meta-bridge-uninstall] DONE"

package/scripts/smoke-meta-install-state.sh

@@ -71,6 +71,12 @@ JSON
 
 py() { python3 "$STATE" "$@" --repo "$REPO" --asm "$ASM"; }
 
+DEV_STATUSLINE="$(python3 "$STATE" desired-statusline --repo "$REPO" | python3 -c 'import json,sys; print(json.load(sys.stdin)["command"])')"
+if [ "$DEV_STATUSLINE" = "$REPO/scripts/meta-bridge-statusline.sh" ]; then ok "dev statusLine pins the checkout script"; else bad "dev statusLine command drifted: $DEV_STATUSLINE"; fi
+FAKE_INSTALLED_REPO="$TMP/npmroot/node_modules/@junghanacs/entwurf"
+INSTALLED_STATUSLINE="$(python3 "$STATE" desired-statusline --repo "$FAKE_INSTALLED_REPO" | python3 -c 'import json,sys; print(json.load(sys.stdin)["command"])')"
+if [ "$INSTALLED_STATUSLINE" = "entwurf-statusline" ]; then ok "installed statusLine uses the stable bin shim"; else bad "installed statusLine command drifted: $INSTALLED_STATUSLINE"; fi
+
 py prepare >/dev/null
 STATE_FILE="$CLAUDE_CONFIG_DIR/entwurf.install-state.json"
 [ -f "$STATE_FILE" ] && ok "prepare writes install-state before any merge" || bad "state file missing after prepare"