@junghanacs/entwurf 0.12.4 → 0.12.6

package/run.sh

@@ -91,12 +91,13 @@ Usage:
   ./run.sh smoke-meta-async-drift     # 1.0.0 meta-bridge step 1: drift sentinel — version pins + Claude binary undocumented-behavior markers (LIVE=1 adds plugin watch-arm probe)
   ./run.sh smoke-meta-honesty         # 1.0.0 meta-bridge: honesty regression gate (#30 blockers) — doorbell counts ALL msgs honestly + hook logs failures as ERROR (best-effort, no scream). Offline/deterministic (deps: bash+node+python3)
   ./run.sh smoke-meta-install-state   # 1.0.0 meta-bridge Phase 2: stateful install/uninstall + store-doctor regression gate. Offline/deterministic (deps: bash+node+python3)
+  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + normalizes stale + remove symmetry + fails loud. Offline/hermetic (deps: bash+python3)
   ./run.sh smoke-meta-prune           # 1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)
   ./run.sh smoke-meta-keyset-guard    # 0.10.0 meta-bridge: keyset-owner guard regression — check-keyset-overlap + managed-keys SSOT (disjoint passes, collisions fail). Offline/hermetic (deps: bash+python3)
   ./run.sh check-meta-manifest-schema # 0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)
   ./run.sh smoke-claude-native-resume-live # LIVE-only: Claude Code native fresh→--resume continuity + meta-record uniqueness; proves meta-bridge records identity without touching the backend resume path
 
-  ./run.sh install-meta-bridge        # 1.0.0 meta-bridge Phase 2: stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
+  ./run.sh install-meta-bridge        # INTERNAL part of `setup` (native-harness plugin) + doctor recovery path — prefer `setup`; stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
   ./run.sh uninstall-meta-bridge      # 1.0.0 meta-bridge Phase 2: stateful GLOBAL uninstall (restore only keys/items captured in install-state)
   ./run.sh doctor-meta-bridge         # 1.0.0 meta-bridge Phase 2: fail-loud doctor — toolchain + state + plugin/MCP + store scan + hook errors + SessionStart evidence + writer-version parity (source↔assembled↔installed: FAIL on a stale deployed meta-record writer)
   ./run.sh meta-bridge-prune          # 1.0.0 meta-bridge Phase 4: LISTING-ONLY store hygiene — classify orphan/stale/ambiguous/keep, print manual rm commands, delete NOTHING ([dir] [--ttl-days N])
@@ -106,7 +107,7 @@ Usage:
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with 0.80.x peers
   ./run.sh sync-auth                  # copy ~/.pi/agent/auth.json anthropic OAuth credentials to entwurf alias
-  ./run.sh install [project-dir]      # install this local package into project .pi/settings.json
+  ./run.sh install [project-dir]      # INTERNAL part of `setup` (project .pi/settings.json wiring) + npm-consumer entry — prefer `setup`, don't call directly for dev
   ./run.sh setup:links [--force]      # repair ~/.pi/agent/entwurf-targets.json link (use --force to replace a stale operator file or wrong symlink; a .bak is taken)
   ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json
 
@@ -239,11 +240,67 @@ preflight_dep_integrity() {
   fi
 }
 
+preflight_pi_settings_shapes() {
+  local project_settings="$1"
+  local user_settings="$2"
+  python3 - "$project_settings" "$user_settings" <<'PY'
+import json, sys
+from pathlib import Path
+
+project = Path(sys.argv[1])
+user = Path(sys.argv[2])
+
+def load_object(path: Path, label: str):
+    if not path.exists():
+        return None
+    data = json.loads(path.read_text())
+    if not isinstance(data, dict):
+        raise SystemExit(f"{label} settings is not a JSON object: {path}")
+    return data
+
+def check_packages(data, path: Path, label: str):
+    if data is None:
+        return
+    packages = data.get("packages")
+    if packages is not None and not isinstance(packages, list):
+        raise SystemExit(f"{label} settings packages is not a JSON array: {path}")
+
+def check_project_provider(data, path: Path):
+    if data is None:
+        return
+    provider = data.get("entwurfProvider")
+    if provider is None:
+        return
+    if not isinstance(provider, dict):
+        raise SystemExit(f"project settings entwurfProvider is not an object: {path}")
+    servers = provider.get("mcpServers")
+    if servers is not None and not isinstance(servers, dict):
+        raise SystemExit(f"project settings entwurfProvider.mcpServers is not an object: {path}")
+
+project_data = load_object(project, "project")
+user_data = load_object(user, "user")
+check_packages(project_data, project, "project")
+check_packages(user_data, user, "user")
+check_project_provider(project_data, project)
+PY
+}
+
 install_local_package() {
-  local project_dir
+  local project_dir agent_dir
   project_dir=$(normalize_project_dir "$1")
+  agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
   preflight_dep_integrity
+  # Fail BEFORE any settings write if either target config already has a corrupt
+  # shape. The packages[] SSOT and provider writer run in two separate steps, so
+  # without this preflight a bad entwurfProvider could leave a half-installed
+  # packages[] entry behind (2026-07-03 install-boundary hardening).
+  preflight_pi_settings_shapes "$project_dir/.pi/settings.json" "$agent_dir/settings.json"
   mkdir -p "$project_dir/.pi"
+  # packages[] registration via the shared SSOT — same is_entwurf_source
+  # predicate + idempotency as user-scope and remove (not a substring match).
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR"
+  # entwurfProvider.mcpServers + legacy prune (project-scope only; packages[] was
+  # already written above by register-pi-package.py).
   python3 - "$project_dir/.pi/settings.json" "$REPO_DIR" <<'PY'
 import json, sys
 from pathlib import Path
@@ -258,23 +315,6 @@ if settings_path.exists():
 else:
     data = {}
 
-# --- packages[] registration --------------------------------------------------
-packages = data.get("packages")
-if not isinstance(packages, list):
-    packages = []
-
-filtered = []
-for item in packages:
-    source = item.get("source") if isinstance(item, dict) else item
-    if isinstance(source, str) and ("entwurf" in source) and source != repo_dir:
-        continue
-    filtered.append(item)
-
-if repo_dir not in filtered:
-    filtered.append(repo_dir)
-
-data["packages"] = filtered
-
 # --- entwurfProvider.mcpServers bundled entries ---------------------------
 # Ship the two in-repo MCP adapters pre-wired so `pi install` produces a
 # working setup without the consumer hand-editing settings.json. User-authored
@@ -334,9 +374,25 @@ for name, reason in LEGACY_BUNDLED.items():
 
 settings_path.write_text(json.dumps(data, indent=2) + "\n")
 print(f"install: updated {settings_path}")
-print(f"install: package source -> {repo_dir}")
 PY
   ensure_agent_dir_symlinks
+  register_user_scope_citizen
+}
+
+# Register entwurf as a pi USER-SCOPE citizen so its extensions
+# (entwurf-control.ts → --entwurf-control / --emacs-agent-socket) load from ANY
+# cwd, not only inside the entwurf checkout. project-scope `.pi/settings.json`
+# only applies when pi runs inside the repo; the `pit`/`pia`/`pihome` global
+# launchers and the npm consumer's "installs → just works" both need the entry
+# in ~/.pi/agent/settings.json's packages[]. This is the wiring that dropped when
+# `pi install` was removed from setup (2026-07-03: `--entwurf-control` unknown in
+# a foreign cwd). Idempotent: absent → append, present → no-op; a stale entwurf
+# entry at a different path is normalized to REPO_DIR. Every other package and key
+# in the operator's user settings is preserved untouched.
+register_user_scope_citizen() {
+  local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
+  # Shared idempotent implementation (also driven by smoke-user-scope-citizen).
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR"
 }
 
 # Ensure agent-level resources that entwurf code reads from
@@ -424,6 +480,14 @@ ensure_agent_dir_symlinks() {
 remove_local_package() {
   local project_dir
   project_dir=$(normalize_project_dir "$1")
+  # Same fail-before-write rule as install: remove has two writers too
+  # (packages[] SSOT, then entwurfProvider cleanup), so a malformed provider must
+  # not leave a half-removed packages[] entry behind.
+  preflight_pi_settings_shapes "$project_dir/.pi/settings.json" "$(mktemp -u)"
+  # packages[] cleanup via the shared SSOT — same is_entwurf_source predicate as
+  # install, so remove never over-deletes a look-alike repo (entwurf-notes, …)
+  # that install would never have registered.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR" --remove
   python3 - "$project_dir/.pi/settings.json" "$REPO_DIR" <<'PY'
 import json, sys
 from pathlib import Path
@@ -438,19 +502,6 @@ data = json.loads(settings_path.read_text())
 if not isinstance(data, dict):
     raise SystemExit("settings.json is not an object")
 
-# --- packages[] cleanup -------------------------------------------------------
-packages = data.get("packages")
-pkg_removed = 0
-if isinstance(packages, list):
-    filtered = []
-    for item in packages:
-        source = item.get("source") if isinstance(item, dict) else item
-        if isinstance(source, str) and ("entwurf" in source):
-            pkg_removed += 1
-            continue
-        filtered.append(item)
-    data["packages"] = filtered
-
 # --- entwurfProvider.mcpServers cleanup ------------------------------------
 # Only remove entries that look like they came from ./run.sh install: either
 # the command matches the current $REPO_DIR anchor exactly, or it ends with
@@ -484,7 +535,7 @@ if isinstance(provider, dict):
         data.pop("entwurfProvider", None)
 
 settings_path.write_text(json.dumps(data, indent=2) + "\n")
-print(f"remove: removed {pkg_removed} packages[] entries, {mcp_removed} mcpServers entries from {settings_path}")
+print(f"remove: removed {mcp_removed} mcpServers entries from {settings_path}")
 PY
 }
 
@@ -1469,6 +1520,87 @@ check_install_preflight() {
   fi
   rm -rf "$fake" "$proj"
   ok "[check-install-preflight] representative dangling symlink (test -d blind spot) → fails before writing settings, names the dep"
+
+  # negative 3 — corrupt project provider shape. install_local_package now has a
+  # two-step writer (packages[] SSOT, then entwurfProvider.mcpServers), so a
+  # malformed provider MUST fail before the packages[] step writes anything.
+  fake=$(mktemp -d); proj=$(mktemp -d)
+  mkdir -p "$proj/.pi" "$fake/home"
+  printf '{"entwurfProvider": []}\n' > "$proj/.pi/settings.json"
+  local before after
+  before=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  rc=0; out=$(HOME="$fake/home" PI_CODING_AGENT_DIR="$fake/home/.pi/agent" "$REPO_DIR/run.sh" install "$proj" 2>&1) || rc=$?
+  after=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt entwurfProvider did NOT fail install"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ "$before" != "$after" ]; then
+    fail "[check-install-preflight] corrupt entwurfProvider was partially rewritten (packages[] leak)"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if ! printf '%s' "$out" | grep -q "entwurfProvider is not an object"; then
+    fail "[check-install-preflight] corrupt entwurfProvider failed for the WRONG reason:"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ -f "$fake/home/.pi/agent/settings.json" ]; then
+    fail "[check-install-preflight] corrupt project provider still wrote user-scope settings"; cat "$fake/home/.pi/agent/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  rm -rf "$fake" "$proj"
+  ok "[check-install-preflight] corrupt project entwurfProvider → fails before any project/user settings write"
+
+  # negative 4 — corrupt project mcpServers shape, same no-partial-write contract.
+  fake=$(mktemp -d); proj=$(mktemp -d)
+  mkdir -p "$proj/.pi" "$fake/home"
+  printf '{"entwurfProvider": {"mcpServers": []}}\n' > "$proj/.pi/settings.json"
+  before=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  rc=0; out=$(HOME="$fake/home" PI_CODING_AGENT_DIR="$fake/home/.pi/agent" "$REPO_DIR/run.sh" install "$proj" 2>&1) || rc=$?
+  after=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt entwurfProvider.mcpServers did NOT fail install"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ "$before" != "$after" ]; then
+    fail "[check-install-preflight] corrupt mcpServers was partially rewritten (packages[] leak)"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if ! printf '%s' "$out" | grep -q "entwurfProvider.mcpServers is not an object"; then
+    fail "[check-install-preflight] corrupt mcpServers failed for the WRONG reason:"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  rm -rf "$fake" "$proj"
+  ok "[check-install-preflight] corrupt project entwurfProvider.mcpServers → fails before any project settings write"
+
+  # negative 5 — corrupt user-scope packages shape. Since install writes project
+  # settings before user registration, this preflight must catch the user file up
+  # front so a bad ~/.pi/agent/settings.json cannot leave the project half-wired.
+  fake=$(mktemp -d); proj=$(mktemp -d)
+  mkdir -p "$fake/home/.pi/agent"
+  printf '{"packages": {"broken": true}}\n' > "$fake/home/.pi/agent/settings.json"
+  rc=0; out=$(HOME="$fake/home" PI_CODING_AGENT_DIR="$fake/home/.pi/agent" "$REPO_DIR/run.sh" install "$proj" 2>&1) || rc=$?
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt user packages did NOT fail install"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ -f "$proj/.pi/settings.json" ]; then
+    fail "[check-install-preflight] corrupt user packages still wrote project settings (partial install)"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if ! printf '%s' "$out" | grep -q "user settings packages is not a JSON array"; then
+    fail "[check-install-preflight] corrupt user packages failed for the WRONG reason:"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  rm -rf "$fake" "$proj"
+  ok "[check-install-preflight] corrupt user-scope packages → fails before project settings write"
+
+  # negative 6 — remove has the same two-step write risk (packages[] remove,
+  # then provider cleanup). A corrupt provider must fail before packages[] is
+  # altered, otherwise uninstall becomes a partial destructive write.
+  proj=$(mktemp -d)
+  mkdir -p "$proj/.pi"
+  printf '{"entwurfProvider": [], "packages": ["%s"]}\n' "$REPO_DIR" > "$proj/.pi/settings.json"
+  before=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  rc=0; out=$("$REPO_DIR/run.sh" remove "$proj" 2>&1) || rc=$?
+  after=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt provider did NOT fail remove"; echo "$out"; rm -rf "$proj"; exit 1
+  fi
+  if [ "$before" != "$after" ]; then
+    fail "[check-install-preflight] corrupt provider remove partially rewrote packages[]"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$proj"; exit 1
+  fi
+  rm -rf "$proj"
+  ok "[check-install-preflight] remove with corrupt provider → fails before packages[] removal"
 }
 
 check_pi_preflight() {
@@ -1735,6 +1867,12 @@ check_pack() {
     # doctor.sh runs this prebuilt JS when installed under node_modules (strip-types
     # refuses the .ts there), same boundary start.sh crosses. build-bridge emits it.
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js"
+    # 0.12.5 — the node_modules-safe plugin hook + its lib. install-meta-bridge copies
+    # these compiled JS into the assembled plugin when installed (raw .ts can't
+    # strip-types under node_modules). meta-session.js is shared with the store-doctor
+    # above; listed here too so the hook axis fails loud if the emit graph drops it.
+    "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
     "pi/entwurf-targets.json"
@@ -1887,6 +2025,10 @@ check_pack_install() {
     # 0.12.4 — prebuilt node_modules-safe store-scan artifact for the doctor
     # (see check-pack). The installed-scan smoke below runs exactly this file.
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js"
+    # 0.12.5 — node_modules-safe plugin hook + lib (see check-pack). The installed
+    # hook regression below runs exactly this compiled JS from under node_modules.
+    "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
     "pi/entwurf-targets.json"
@@ -1992,8 +2134,14 @@ check_pack_install() {
     return 1
   fi
 
-  local loader_out
-  loader_out=$(cd "$tmp" && pi -e "$tmp/node_modules/@junghanacs/entwurf" --list-models entwurf 2>&1) || {
+  # HOME/PI_CODING_AGENT_DIR redirected to a throwaway dir: this loader smoke must
+  # depend ONLY on the -e package path, never on the operator's real
+  # ~/.pi/agent/settings.json — otherwise a live-config change could silently
+  # pass/fail the gate (the exact "check must not depend on live wiring" impurity
+  # this whole lane is about).
+  local loader_out loader_home="$tmp/loader-home"
+  mkdir -p "$loader_home/.pi/agent"
+  loader_out=$(cd "$tmp" && HOME="$loader_home" PI_CODING_AGENT_DIR="$loader_home/.pi/agent" pi -e "$tmp/node_modules/@junghanacs/entwurf" --list-models entwurf 2>&1) || {
     fail "[check-pack-install] pi loader smoke failed (exit non-zero):"
     echo "$loader_out" | tail -10 | sed 's/^/    /' >&2
     return 1
@@ -2043,8 +2191,8 @@ check_pack_install() {
     fail "[check-pack-install] npm-managed layout missing executable run.sh (postinstall-chmod did not run?) at $npm_pkg"
     return 1
   fi
-  if [ ! -x "$npmroot/node_modules/.bin/entwurf" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-bridge" ]; then
-    fail "[check-pack-install] npm-managed neutral install missing package bins (entwurf / entwurf-bridge)"
+  if [ ! -x "$npmroot/node_modules/.bin/entwurf" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-bridge" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-statusline" ]; then
+    fail "[check-pack-install] npm-managed neutral install missing package bins (entwurf / entwurf-bridge / entwurf-statusline)"
     ls -l "$npmroot/node_modules/.bin" 2>/dev/null | sed 's/^/    /' >&2 || true
     return 1
   fi
@@ -2065,6 +2213,158 @@ check_pack_install() {
   fi
   echo "[check-pack-install] npm-managed install regression pass (hoisted-dep run.sh install wrote settings)"
 
+  # THE 2026-07-03 regression gate: removing `pi install` from setup dropped
+  # user-scope citizen registration, so `--entwurf-control` was Unknown in a
+  # foreign cwd. Prove the npm consumer path closes it end-to-end: run.sh install
+  # (run above under HOME="$npmhome") must have registered the package in the USER
+  # settings, and pi must then load the entwurf extension + its flags from a cwd
+  # OUTSIDE the project. Fully isolated in the temp HOME — never touches ~/.pi.
+  local npm_user_settings="$npmhome/.pi/agent/settings.json"
+  if [ ! -f "$npm_user_settings" ]; then
+    fail "[check-pack-install] npm-managed install did not register a user-scope citizen at $npm_user_settings"
+    return 1
+  fi
+  if ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+sys.exit(0 if any(isinstance(s,str) and s.endswith('/node_modules/@junghanacs/entwurf') for s in srcs) else 1)
+"; then
+    fail "[check-pack-install] user-scope settings.json lacks the npm entwurf package in packages[]:"
+    sed 's/^/    /' "$npm_user_settings" >&2
+    return 1
+  fi
+  # Foreign cwd ($tmp — NOT the project, no project .pi): --entwurf-control must be
+  # a KNOWN flag and the entwurf provider must load, sourced only from user scope.
+  # Before the fix this printed "Unknown options: --entwurf-control".
+  local foreign_out
+  foreign_out=$(cd "$tmp" && HOME="$npmhome" PI_CODING_AGENT_DIR="$npmhome/.pi/agent" pi --entwurf-control --list-models entwurf 2>&1) || {
+    fail "[check-pack-install] foreign-cwd --entwurf-control smoke failed (user-scope citizen not loading?):"
+    echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  }
+  if grep -qi "Unknown option" <<<"$foreign_out" || ! grep -q "claude-opus-4-8" <<<"$foreign_out"; then
+    fail "[check-pack-install] foreign-cwd --entwurf-control did not load the entwurf extension from user scope:"
+    echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] user-scope citizen regression pass (npm consumer: --entwurf-control loads from a foreign cwd)"
+
+  # Installed meta-bridge ownership regression (0.12.5): package upgrades must not
+  # bake versioned pnpm-store paths into Claude settings. MCP already uses the
+  # stable `entwurf-bridge` bin; statusLine must now use `entwurf-statusline`, and
+  # the plugin marketplace source must be the version-stable operator data dir
+  # rather than <node_modules>/pi/meta-bridge/.assembled. Use a fake claude CLI so
+  # this stays deterministic/offline while running the REAL installed
+  # install-meta-bridge path and meta-bridge-state apply.
+  local fake_claude_dir="$npm_tmp/fake-claude-bin" fake_claude_log="$npm_tmp/fake-claude.log"
+  mkdir -p "$fake_claude_dir"
+  cat > "$fake_claude_dir/claude" <<'SH'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >> "${FAKE_CLAUDE_LOG:?}"
+case "$1${2:+ $2}" in
+  "--version") echo "2.1.197 (Claude Code)" ;;
+  "plugin validate") : ;;
+  "plugin uninstall") : ;;
+  "plugin marketplace") : ;;
+  "plugin install") : ;;
+  "plugin list") printf '%s\n' "entwurf-meta-receive@meta-bridge-local" "  Status: enabled" ;;
+  "mcp remove") : ;;
+  "mcp add") : ;;
+  "mcp get") printf '%s\n' "Scope: User config" "Status: ✔ Connected" ;;
+  *) : ;;
+esac
+exit 0
+SH
+  chmod +x "$fake_claude_dir/claude"
+  local mb_home="$npm_tmp/meta-home" mb_cfg="$npm_tmp/meta-claude" mb_log
+  mkdir -p "$mb_home" "$mb_cfg"
+  mb_log=$(HOME="$mb_home" XDG_DATA_HOME="$mb_home/.local/share" CLAUDE_CONFIG_DIR="$mb_cfg" FAKE_CLAUDE_LOG="$fake_claude_log" PATH="$fake_claude_dir:$npmroot/node_modules/.bin:$PATH" "$npm_pkg/run.sh" install-meta-bridge 2>&1) || {
+    fail "[check-pack-install] installed install-meta-bridge failed under fake claude:"
+    echo "$mb_log" | tail -20 | sed 's/^/    /' >&2
+    return 1
+  }
+  local stable_asm="$mb_home/.local/share/entwurf/meta-bridge/.assembled"
+  local installed_hook="$stable_asm/entwurf-meta-receive/meta-bridge-hook.js"
+  if [ ! -f "$installed_hook" ]; then
+    fail "[check-pack-install] installed meta-bridge did not assemble the compiled hook JS into the stable operator data dir: $installed_hook"
+    return 1
+  fi
+  if [ -f "$stable_asm/entwurf-meta-receive/meta-bridge-hook.ts" ]; then
+    fail "[check-pack-install] installed meta-bridge shipped a raw .ts hook — installed packages must run compiled JS (strip-types is refused under node_modules)"
+    return 1
+  fi
+  # The artifact existing is not enough (review BLOCKER 1): Claude runs the hooks.json
+  # COMMAND, so assert the baked command actually targets the compiled .js with both
+  # placeholders resolved. A bake that mis-targeted .ts (or left a placeholder) would
+  # still pass the direct-JS smoke below, then fail live.
+  local installed_hooks_json="$stable_asm/entwurf-meta-receive/hooks/hooks.json"
+  if ! grep -q 'meta-bridge-hook\.js' "$installed_hooks_json"; then
+    fail "[check-pack-install] installed hooks.json does not point at the compiled meta-bridge-hook.js: $installed_hooks_json"
+    return 1
+  fi
+  if grep -qE 'meta-bridge-hook\.ts|__HOOK_ENTRY__|__NODE_BIN__' "$installed_hooks_json"; then
+    fail "[check-pack-install] installed hooks.json references a raw .ts entry or an unbaked placeholder (__HOOK_ENTRY__/__NODE_BIN__): $installed_hooks_json"
+    return 1
+  fi
+  if [ -e "$npm_pkg/pi/meta-bridge/.assembled/entwurf-meta-receive" ]; then
+    fail "[check-pack-install] installed meta-bridge still assembled inside the versioned package store: $npm_pkg/pi/meta-bridge/.assembled"
+    return 1
+  fi
+  # 0.12.5 strip-types-fence regression (GPT safety pin). The compiled hook must run
+  # FROM UNDER node_modules with plain node — the exact fence that broke oracle's
+  # 0.12.4 raw-.ts hook (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING). L2 relocates
+  # the runtime marketplace source to XDG, but this hardens the ARTIFACT itself so
+  # it is safe even if a future cache/marketplace path lands under node_modules.
+  local nm_probe="$npmroot/node_modules/@junghanacs/entwurf/pi/meta-bridge/.assembled-packprobe/entwurf-meta-receive"
+  mkdir -p "$nm_probe/lib"
+  cp "$installed_hook" "$nm_probe/meta-bridge-hook.js"
+  cp "$stable_asm/entwurf-meta-receive/lib/meta-session.js" "$nm_probe/lib/meta-session.js"
+  cp "$stable_asm/entwurf-meta-receive/lib/session-id.js" "$nm_probe/lib/session-id.js"
+  cp "$stable_asm/entwurf-meta-receive/entwurf-capabilities.json" "$nm_probe/entwurf-capabilities.json"
+  local probe_env='{"session_id":"pack-probe","transcript_path":"/tmp/x.jsonl","cwd":"/tmp","hook_event_name":"SessionStart","model":{"id":"probe"}}'
+  local probe_out
+  if probe_out="$(printf '%s' "$probe_env" | env PI_CODING_AGENT_DIR="$(mktemp -d)" CLAUDE_PLUGIN_ROOT="$nm_probe" node "$nm_probe/meta-bridge-hook.js" 2>&1)" && printf '%s' "$probe_out" | grep -q hookSpecificOutput; then
+    : # compiled hook crosses the node_modules strip-types fence safely
+  else
+    fail "[check-pack-install] compiled hook failed to run under node_modules with plain node: $(printf '%s' "$probe_out" | tr '\n' ' ' | cut -c1-200)"
+    rm -rf "$nm_probe"; return 1
+  fi
+  # FAIL-reproduction (review BLOCKER 2): a raw .ts at the SAME node_modules location
+  # must be refused SPECIFICALLY by the strip-types fence — not by some unrelated
+  # failure. A missing lib would also exit nonzero and hollow out the proof, so
+  # capture stderr and require the exact ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING.
+  cp "$npm_pkg/pi-extensions/meta-bridge-hook.ts" "$nm_probe/meta-bridge-hook.ts"
+  local ts_out ts_rc
+  ts_out="$(printf '%s' "$probe_env" | env PI_CODING_AGENT_DIR="$(mktemp -d)" CLAUDE_PLUGIN_ROOT="$nm_probe" node "$nm_probe/meta-bridge-hook.ts" 2>&1)" && ts_rc=0 || ts_rc=$?
+  if [ "${ts_rc:-0}" -eq 0 ]; then
+    fail "[check-pack-install] raw .ts hook UNEXPECTEDLY ran under node_modules — strip-types fence moved; the compiled-hook rationale must be revisited"
+    rm -rf "$nm_probe"; return 1
+  fi
+  if ! printf '%s' "$ts_out" | grep -q 'ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING'; then
+    fail "[check-pack-install] raw .ts hook failed under node_modules but NOT via the strip-types fence (expected ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING); got: $(printf '%s' "$ts_out" | tr '\n' ' ' | cut -c1-200) — the regression no longer proves the compiled-hook rationale"
+    rm -rf "$nm_probe"; return 1
+  fi
+  rm -rf "$nm_probe"
+  echo "[check-pack-install] installed hook is node_modules-safe compiled JS (hooks.json points at .js; runs under node_modules with plain node; raw .ts refused there by the strip-types fence)"
+  python3 - "$mb_cfg/settings.json" "$mb_home/.claude.json" "$stable_asm" <<'PY'
+import json, sys
+settings = json.load(open(sys.argv[1]))
+root = json.load(open(sys.argv[2]))
+stable_asm = sys.argv[3]
+market = settings.get("extraKnownMarketplaces", {}).get("meta-bridge-local", {})
+assert market == {"source": {"source": "directory", "path": stable_asm}}, market
+assert settings.get("statusLine") == {"type": "command", "command": "entwurf-statusline"}, settings.get("statusLine")
+mcp = root.get("mcpServers", {}).get("entwurf-bridge", {})
+assert mcp.get("command") == "entwurf-bridge" and mcp.get("args") == [], mcp
+PY
+  if ! grep -q "$stable_asm" "$fake_claude_log"; then
+    fail "[check-pack-install] fake claude did not receive the stable marketplace path during install-meta-bridge"
+    sed 's/^/    /' "$fake_claude_log" >&2 || true
+    return 1
+  fi
+  echo "[check-pack-install] installed meta-bridge ownership pass (stable statusline bin + stable marketplace dir + stable MCP bin)"
+
   # 0.12.1 C — installed bridge BOOT regression. This is the test whose absence
   # let the 0.12.0 install bug ship: the README's bridge launcher was
   # `node --experimental-strip-types src/index.ts`, which Node REFUSES under
@@ -2873,6 +3173,14 @@ case "$cmd" in
     # duplicate/drift records. Offline + deterministic (deps bash+node+python3).
     (cd "$REPO_DIR" && bash scripts/smoke-meta-install-state.sh)
     ;;
+  smoke-user-scope-citizen)
+    # 0.12.6 install-boundary gate: register-pi-package.py is the shared
+    # packages[] SSOT for project/user install and remove; user scope makes
+    # --entwurf-control load from any cwd. Idempotent, preserves unrelated
+    # packages/keys, normalizes stale entries, remove is symmetric, and corrupt
+    # settings fail loud. The tripwire the 2026-07-03 `pi install` removal lacked.
+    (cd "$REPO_DIR" && bash scripts/smoke-user-scope-citizen.sh)
+    ;;
   smoke-claude-native-resume-live)
     # LIVE-only Detour A probe: two real Claude Code native turns (fresh +
     # --resume) in a scratch cwd. Verifies native resume works while the
@@ -2882,9 +3190,10 @@ case "$cmd" in
     ;;
   install-meta-bridge)
     # 1.0.0 meta-bridge step 5: operator-grade GLOBAL install of the garden-native
-    # receive plugin. Assembles a self-contained, node-path-baked copy under
-    # pi/meta-bridge/.assembled and runs marketplace add + install --scope user, so
-    # every native Claude Code session auto-loads it (no manual --plugin-dir).
+    # receive plugin. Assembles a self-contained, node-path-baked copy under the
+    # XDG data dir ($XDG_DATA_HOME/entwurf/meta-bridge/.assembled — dev clone and
+    # installed package alike, never the checkout) and runs marketplace add +
+    # install --scope user, so every native Claude Code session auto-loads it.
     # Idempotent; Linux/macOS only (Windows fail-fast).
     (cd "$REPO_DIR" && bash scripts/meta-bridge-install.sh "$@")
     ;;

package/scripts/meta-bridge-doctor.sh

@@ -17,6 +17,23 @@ MKT_NAME="meta-bridge-local"
 PLUGIN="entwurf-meta-receive"
 CLAUDE_CFG="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# The live artifact lives under the XDG data dir (dev clone and installed package
+# alike — never the checkout). Prefer the path RECORDED in install-state so a doctor
+# run under a different XDG_DATA_HOME than install still hashes the REAL assembled
+# bundle (and state.py check compares the same recorded marketplace path); fall back
+# to the current-XDG computation only when no state exists yet (fresh host).
+# LIB_EXT still tracks the hook artifact mode (0.12.5): installed packages ship the
+# tsc-emitted `.js` closure (node_modules-safe), dev clones run the `.ts` source.
+# The writer-version parity below hashes meta-session.<LIB_EXT> so an installed
+# `.js` bundle is compared against the SAME-pipeline dist `.js`, never against the
+# `.ts` source (which would hash-mismatch and false-STALE).
+ASM="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge/.assembled"
+RECORDED_ASM="$(python3 "$REPO/scripts/meta-bridge-state.py" assembled-path --repo "$REPO" 2>/dev/null || true)"
+[ -n "$RECORDED_ASM" ] && ASM="$RECORDED_ASM"
+case "$REPO" in
+  */node_modules/@junghanacs/entwurf) LIB_EXT="js" ;;
+  *)                                  LIB_EXT="ts" ;;
+esac
 # shellcheck source=scripts/meta-bridge-hook-log.sh
 source "$REPO/scripts/meta-bridge-hook-log.sh"
 
@@ -65,7 +82,7 @@ if command -v python3 >/dev/null; then
   # which key drifted — silent instead of fail-loud. As an `if` condition the
   # substitution's nonzero status is consumed (set -e suspended), so we always
   # reach the detail. stderr (drift detail) is captured via `2>&1 >/dev/null`.
-  if CHECK_ERR="$(python3 "$REPO/scripts/meta-bridge-state.py" check --repo "$REPO" --asm "$REPO/pi/meta-bridge/.assembled" 2>&1 >/dev/null)"; then
+  if CHECK_ERR="$(python3 "$REPO/scripts/meta-bridge-state.py" check --repo "$REPO" --asm "$ASM" 2>&1 >/dev/null)"; then
     ok "state file present and managed settings/MCP keyset survives intact"
   else
     bad "managed settings/MCP keyset missing or overwritten — another consumer may have clobbered a pi-owned key. Re-run ./run.sh install-meta-bridge. Drift detail:"
@@ -93,8 +110,23 @@ if [ -n "$CACHE_HOOKS" ]; then
   # line 158) so BAKED="" routes to that bad(...): an installed hooks.json exists but
   # the doctor cannot read its load-bearing hook command, so the store-churn guard is
   # blind — a verify-impossible state must fail loud, not pass as a soft warn (A3b).
-  BAKED="$({ grep -oE '"command": "[^ ]+ \$\{CLAUDE_PLUGIN_ROOT\}/meta-bridge-hook.ts"' "$CACHE_HOOKS" || true; } | head -1 | sed -E 's/.*"command": "([^ ]+) .*/\1/')"
-  if [ -n "$BAKED" ] && [ -x "$BAKED" ]; then ok "baked node exists + executable: $BAKED"
+  # Match either hook artifact (0.12.5): installed ships meta-bridge-hook.js, dev
+  # clones meta-bridge-hook.ts. Capture the whole command so we run the SAME entry
+  # file the live hook runs (never a hardcoded extension that drifts from install).
+  HOOK_CMD="$({ grep -oE '"command": "[^ ]+ \$\{CLAUDE_PLUGIN_ROOT\}/meta-bridge-hook\.(ts|js)"' "$CACHE_HOOKS" || true; } | head -1)"
+  BAKED="$(printf '%s' "$HOOK_CMD" | sed -E 's/.*"command": "([^ ]+) .*/\1/')"
+  HOOK_FILE="$(printf '%s' "$HOOK_CMD" | sed -E 's#.*/([^/"]+)"$#\1#')"
+  if [ -n "$BAKED" ] && [ -x "$BAKED" ]; then
+    ok "baked node exists + executable: $BAKED"
+    CACHE_ROOT="$(cd "$(dirname "$CACHE_HOOKS")/.." && pwd)"
+    TMP_AGENT="$(mktemp -d 2>/dev/null || mktemp -d -t entwurf-doctor-hook)"
+    HOOK_ENV='{"session_id":"doctor-synthetic-native","transcript_path":"/tmp/entwurf-doctor-synthetic-transcript.jsonl","cwd":"/tmp","hook_event_name":"SessionStart","model":{"id":"doctor-model"}}'
+    if HOOK_OUT="$(printf '%s' "$HOOK_ENV" | env PI_CODING_AGENT_DIR="$TMP_AGENT" CLAUDE_PLUGIN_ROOT="$CACHE_ROOT" "$BAKED" "$CACHE_ROOT/$HOOK_FILE" 2>&1)" && printf '%s' "$HOOK_OUT" | grep -q 'hookSpecificOutput'; then
+      ok "cached SessionStart hook executes cleanly in an isolated temp agent dir"
+    else
+      bad "cached SessionStart hook failed to execute — stale plugin cache / unsupported TS syntax / broken bundle. Re-run install-meta-bridge from the intended surface. Detail: $(printf '%s' "$HOOK_OUT" | tr '\n' ' ' | cut -c1-300)"
+    fi
+    rm -rf "$TMP_AGENT" 2>/dev/null || true
   elif [ -n "$BAKED" ]; then bad "baked node path is DEAD (nix GC / version bump?): $BAKED — re-run ./run.sh install-meta-bridge"
   else bad "could not parse baked node path from $CACHE_HOOKS — hook command format drift; doctor cannot verify the NixOS store-churn guard. Re-run ./run.sh install-meta-bridge or update the doctor parser."; fi
 else
@@ -114,9 +146,15 @@ except Exception:
     print('')
 PY
 )"
-  EXPECTED_STATUSLINE="$REPO/scripts/meta-bridge-statusline.sh"
-  if [ "$STATUSLINE_CMD" = "$EXPECTED_STATUSLINE" ]; then ok "statusLine.command is repo-owned: $STATUSLINE_CMD"; else bad "statusLine.command drifted (got '$STATUSLINE_CMD', expected '$EXPECTED_STATUSLINE')"; fi
-  if [ -x "$EXPECTED_STATUSLINE" ]; then ok "statusline executable"; else bad "statusline script not executable: $EXPECTED_STATUSLINE"; fi
+  EXPECTED_STATUSLINE="$(python3 "$REPO/scripts/meta-bridge-state.py" desired-statusline --repo "$REPO" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("command", ""))')"
+  if [ "$STATUSLINE_CMD" = "$EXPECTED_STATUSLINE" ]; then ok "statusLine.command matches expected (dev: checkout path; installed: entwurf-statusline bin shim): $STATUSLINE_CMD"; else bad "statusLine.command drifted (got '$STATUSLINE_CMD', expected '$EXPECTED_STATUSLINE')"; fi
+  if [[ "$EXPECTED_STATUSLINE" == */* ]]; then
+    if [ -x "$EXPECTED_STATUSLINE" ]; then ok "statusline executable"; else bad "statusline script not executable: $EXPECTED_STATUSLINE"; fi
+  elif command -v "$EXPECTED_STATUSLINE" >/dev/null 2>&1; then
+    ok "statusline bin resolves on PATH: $(command -v "$EXPECTED_STATUSLINE")"
+  else
+    bad "statusline bin not on PATH: $EXPECTED_STATUSLINE"
+  fi
   SAMPLE_STATUSLINE_OUT="$(printf '%s' '{"session_id":"doctor-no-record","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-5"},"context_window":{"context_window_size":200000,"used_percentage":1,"current_usage":{"input_tokens":1}}}' | "$EXPECTED_STATUSLINE" 2>/dev/null || true)"
   if [ "$(printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | wc -l | tr -d ' ')" = "2" ] && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '🪛' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q ' cc | s'; then ok "statusline synthetic execution emits two rows (work context + identity)"; else bad "statusline synthetic execution failed or omitted two-row work/identity marker"; fi
 else
@@ -241,10 +279,17 @@ registry_for_ms() { # $1=bundle meta-session.ts → sibling plugin-root registry
   dirname "$(dirname "$1")"
 }
 
-SRC_MS="$REPO/pi-extensions/lib/meta-session.ts"
+# Source authority for parity depends on the mode: an installed bundle carries the
+# dist `.js`, so compare it against the dist `.js` (same tsc pipeline → hash-equal);
+# a dev clone carries the `.ts`, so compare against the `.ts` source.
+if [ "$LIB_EXT" = "js" ]; then
+  SRC_MS="$REPO/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
+else
+  SRC_MS="$REPO/pi-extensions/lib/meta-session.ts"
+fi
 SRC_REG="$REPO/pi/entwurf-capabilities.json"
-ASM_MS="$REPO/pi/meta-bridge/.assembled/$PLUGIN/lib/meta-session.ts"
-INST_MS="$(ls "$CLAUDE_CFG"/plugins/cache/"$MKT_NAME"/"$PLUGIN"/*/lib/meta-session.ts 2>/dev/null | head -1 || true)"
+ASM_MS="$ASM/$PLUGIN/lib/meta-session.$LIB_EXT"
+INST_MS="$(ls "$CLAUDE_CFG"/plugins/cache/"$MKT_NAME"/"$PLUGIN"/*/lib/meta-session."$LIB_EXT" 2>/dev/null | head -1 || true)"
 
 ASM_ROOT="$(registry_for_ms "$ASM_MS")"
 INST_ROOT="$(registry_for_ms "${INST_MS:-}")"