@junghanacs/entwurf 0.12.5 → 0.12.7

package/scripts/register-pi-provider.py

@@ -0,0 +1,287 @@
+#!/usr/bin/env python3
+"""register-pi-provider — own entwurfProvider.mcpServers.entwurf-bridge in a pi settings.json
+(#46 Task 2). The provider analog of register-pi-package.py: user + project scope, same
+predicate/idempotency, ONE shared SSOT. The owned keyset is the SINGLE key
+`entwurfProvider.mcpServers.entwurf-bridge` (봉인계약 4); every sibling
+(skillPlugins/appendSystemPrompt/showToolNotifications/other mcpServers) is preserved untouched.
+
+The command written is ALWAYS the bare stable bin `entwurf-bridge` (dev AND installed — the repo
+start.sh path lives only in the dev-bin symlink state, never in a settings file; #46 tripwire).
+
+ownership classification of the EXISTING command (GPT caveat: an old managed repo path is NOT a
+user value, so its inverse is key-removal, never a restore):
+  absent          key not present                             → we create it
+  managed-current command == entwurf-bridge                   → already ours (idempotent)
+  managed-legacy  command is our old repo start.sh
+                  (== <repo>/mcp/entwurf-bridge/start.sh, or endswith
+                   /entwurf/mcp/entwurf-bridge/start.sh)       → normalize to the bare bin
+  user-override   anything else                               → DO NOT overwrite, DO NOT own
+                                                                (no state; doctor: unowned)
+
+Scope asymmetry (봉인계약 4·6, REASONED — not the unfounded asymmetry dev-bin (B) rejected):
+  user     ~/.pi/agent/settings.json — GLOBAL, durable,파급s to every cwd → install-state +
+           honest inverse. absent/managed-* → remove OUR key on uninstall (a legacy repo path is
+           NOT restored); user-override → no state taken, left untouched. A parent object emptied
+           of our key is tidied; siblings kept.
+  project  <repo>/.pi/settings.json — checkout-LOCAL, disposable, re-creatable, and `run.sh
+           remove` already covers it → NO state. install normalizes the command; remove strips
+           our-managed shapes (the bare bin AND the legacy repo path). project-scope state is a
+           NAMED FOLLOW-UP (NEXT), deliberately out of this lane.
+
+Subcommands:
+  install <settings_path> <repo_dir> --scope <user|project> [--state <state_path>]
+  remove  <settings_path> <repo_dir> --scope <user|project> [--state <state_path>]
+
+Exit codes: 0 ok · 2 no-state · 3 refuse-symlink · 4 invalid-json · 5 usage.
+"""
+
+import json
+import os
+import sys
+
+SERVER_KEY = "entwurf-bridge"
+BARE_COMMAND = "entwurf-bridge"
+STATE_SCHEMA_VERSION = 1
+
+# Legacy-bundled MCP names prior installers wrote; the current cutover supersedes them. Pruned at
+# install time (and project remove) ONLY when the command matches our bundled start.sh path, so a
+# user-customized command is left alone. Mirrors run.sh's pre-Task-2 inline prune (no regression).
+LEGACY_BUNDLED = {
+    "session-bridge": "retracted in 0.4.14, issue #7",
+    "pi-tools-bridge": "renamed to entwurf-bridge in 0.11 S2 cutover",
+}
+
+
+def _prune_legacy(servers: dict, repo_dir: str) -> None:
+    for name, reason in LEGACY_BUNDLED.items():
+        existing = servers.get(name)
+        if not isinstance(existing, dict):
+            continue
+        cmd = existing.get("command")
+        if not isinstance(cmd, str):
+            continue
+        if cmd == f"{repo_dir}/mcp/{name}/start.sh" or cmd.endswith(f"/entwurf/mcp/{name}/start.sh"):
+            del servers[name]
+            sys.stdout.write(f"pruned legacy entwurfProvider.mcpServers.{name} ({reason})\n")
+
+
+def _die(code: int, msg: str) -> "None":
+    sys.stderr.write(msg.rstrip("\n") + "\n")
+    sys.exit(code)
+
+
+def _atomic_write(path: str, text: str) -> None:
+    os.makedirs(os.path.dirname(os.path.abspath(path)), exist_ok=True)
+    tmp = f"{path}.tmp-{os.getpid()}"
+    with open(tmp, "w", encoding="utf-8") as fh:
+        fh.write(text)
+    os.replace(tmp, path)
+
+
+def _load(path: str) -> dict:
+    with open(path, "r", encoding="utf-8") as fh:
+        raw = fh.read()
+    if raw.strip() == "":
+        return {}
+    try:
+        data = json.loads(raw)
+    except json.JSONDecodeError as err:
+        _die(4, f"register-pi-provider: {path} is not valid JSON: {err}")
+    if not isinstance(data, dict):
+        _die(4, f"register-pi-provider: {path} top-level must be a JSON object")
+    return data
+
+
+def _dump(data: dict) -> str:
+    return json.dumps(data, indent=2) + "\n"
+
+
+def _now() -> str:
+    import datetime
+
+    return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _classify(existing_cmd, repo_dir: str) -> str:
+    if existing_cmd is None:
+        return "absent"
+    if existing_cmd == BARE_COMMAND:
+        return "managed-current"
+    if isinstance(existing_cmd, str) and (
+        existing_cmd == f"{repo_dir}/mcp/{SERVER_KEY}/start.sh"
+        or existing_cmd.endswith(f"/entwurf/mcp/{SERVER_KEY}/start.sh")
+    ):
+        return "managed-legacy"
+    return "user-override"
+
+
+def _provider_servers(data: dict, create: bool):
+    """Return (provider, servers) dicts. When create, setdefault them; else may be None."""
+    if create:
+        provider = data.setdefault("entwurfProvider", {})
+        if not isinstance(provider, dict):
+            _die(4, "register-pi-provider: entwurfProvider is not an object")
+        servers = provider.setdefault("mcpServers", {})
+        if not isinstance(servers, dict):
+            _die(4, "register-pi-provider: entwurfProvider.mcpServers is not an object")
+        return provider, servers
+    provider = data.get("entwurfProvider")
+    if not isinstance(provider, dict):
+        return None, None
+    servers = provider.get("mcpServers")
+    if not isinstance(servers, dict):
+        return provider, None
+    return provider, servers
+
+
+def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str) -> None:
+    if os.path.islink(settings_path):
+        target = os.readlink(settings_path)
+        _die(3, f"register-pi-provider: refusing to adopt {settings_path} — it is a symlink to {target} "
+                f"(someone else's SSOT). Manage it there, or replace it with a regular file, then retry.")
+
+    data = _load(settings_path) if os.path.exists(settings_path) else {}
+    provider, servers = _provider_servers(data, create=True)
+    _prune_legacy(servers, repo_dir)   # independent of entwurf-bridge ownership
+    existing = servers.get(SERVER_KEY)
+    existing_cmd = existing.get("command") if isinstance(existing, dict) else existing
+    ownership = _classify(existing_cmd, repo_dir)
+
+    if ownership == "user-override":
+        # DO NOT overwrite our key, DO NOT own it (no state). doctor reports it as unowned. Still
+        # persist so any legacy prune above (and a materialized parent) is written.
+        sys.stdout.write(
+            f"install: preserved entwurfProvider.mcpServers.{SERVER_KEY} (user override, NOT owned: {existing_cmd!r})\n"
+        )
+        _atomic_write(settings_path, _dump(data))
+        return
+
+    # absent / managed-current / managed-legacy → normalize to the bare stable bin.
+    newval = {"command": BARE_COMMAND}
+    # preserve non-empty custom args if the operator set them; else default [].
+    if isinstance(existing, dict) and existing.get("args") not in (None, []):
+        newval["args"] = existing["args"]
+    else:
+        newval["args"] = []
+    servers[SERVER_KEY] = newval
+    _atomic_write(settings_path, _dump(data))
+    sys.stdout.write(
+        f"install: {ownership} → entwurfProvider.mcpServers.{SERVER_KEY} = {BARE_COMMAND} (bare stable bin)\n"
+    )
+
+    if scope == "user":
+        if state_path:
+            state = {
+                "schemaVersion": STATE_SCHEMA_VERSION,
+                "managedSettingsPath": os.path.abspath(settings_path),
+                "scope": "user",
+                "key": f"entwurfProvider.mcpServers.{SERVER_KEY}",
+                "command": BARE_COMMAND,
+                "ownership": ownership,       # absent | managed-current | managed-legacy
+                "preimage": existing,          # raw prior value (audit only; NOT restored)
+                "installedAt": _now(),
+            }
+            _atomic_write(state_path, _dump(state))
+        # reload-timing honesty (봉인: no implicit reload assumption): a running pi does not
+        # re-read settings mid-session — only new sessions pick this up.
+        sys.stdout.write(
+            "install: existing pi sessions unaffected until restart; new sessions pick up the change\n"
+        )
+
+
+def cmd_remove(settings_path: str, repo_dir: str, scope: str, state_path: str) -> None:
+    if scope == "user":
+        if not state_path or not os.path.exists(state_path):
+            sys.stdout.write("remove: no install-state — nothing to undo (never owned, or already removed).\n")
+            return
+        state = _load(state_path)
+        managed = state.get("managedSettingsPath")
+        if not isinstance(managed, str):
+            _die(4, f"register-pi-provider: install-state {state_path} has no managedSettingsPath")
+        if os.path.islink(managed):
+            _die(3, f"register-pi-provider: refusing to uninstall — {managed} became a symlink since install.")
+        if os.path.exists(managed):
+            data = _load(managed)
+            provider, servers = _provider_servers(data, create=False)
+            # honest inverse: absent/managed-* → remove OUR key (a legacy repo path is NOT
+            # restored — it was our old managed value, not a user value).
+            if isinstance(servers, dict):
+                servers.pop(SERVER_KEY, None)
+                if not servers:
+                    provider.pop("mcpServers", None)
+            if isinstance(provider, dict) and not provider:
+                data.pop("entwurfProvider", None)
+            _atomic_write(managed, _dump(data))
+        os.remove(state_path)
+        sys.stdout.write(f"remove: removed our {SERVER_KEY} key (ownership={state.get('ownership')}) from {managed}\n")
+        return
+
+    # project scope: no state — strip our-managed shapes (bare bin OR legacy repo path).
+    if not os.path.exists(settings_path):
+        sys.stdout.write(f"remove: nothing to do ({settings_path} missing)\n")
+        return
+    if os.path.islink(settings_path):
+        _die(3, f"register-pi-provider: refusing to touch {settings_path} — it is a symlink.")
+    data = _load(settings_path)
+    provider, servers = _provider_servers(data, create=False)
+    if not isinstance(servers, dict):
+        sys.stdout.write("remove: no entwurfProvider.mcpServers — nothing to do.\n")
+        return
+    _prune_legacy(servers, repo_dir)
+    existing = servers.get(SERVER_KEY)
+    existing_cmd = existing.get("command") if isinstance(existing, dict) else existing
+    ownership = _classify(existing_cmd, repo_dir)
+    if ownership in ("managed-current", "managed-legacy"):
+        del servers[SERVER_KEY]
+        sys.stdout.write(f"remove: removed entwurfProvider.mcpServers.{SERVER_KEY} ({ownership})\n")
+        if not servers:
+            provider.pop("mcpServers", None)
+        if isinstance(provider, dict) and not provider:
+            data.pop("entwurfProvider", None)
+    elif ownership == "user-override":
+        sys.stdout.write(f"remove: preserved entwurfProvider.mcpServers.{SERVER_KEY} (user override: {existing_cmd!r})\n")
+    else:  # absent
+        sys.stdout.write(f"remove: entwurfProvider.mcpServers.{SERVER_KEY} already absent.\n")
+    _atomic_write(settings_path, _dump(data))
+
+
+def _parse(argv: list):
+    # positional: settings_path repo_dir ; flags: --scope <s> [--state <p>]
+    pos, scope, state_path = [], None, ""
+    i = 0
+    while i < len(argv):
+        a = argv[i]
+        if a == "--scope":
+            i += 1
+            scope = argv[i] if i < len(argv) else None
+        elif a == "--state":
+            i += 1
+            state_path = argv[i] if i < len(argv) else ""
+        else:
+            pos.append(a)
+        i += 1
+    return pos, scope, state_path
+
+
+def main(argv: list) -> None:
+    if len(argv) < 2:
+        _die(5, "usage: register-pi-provider.py <install|remove> <settings_path> <repo_dir> --scope <user|project> [--state <path>]")
+    sub = argv[1]
+    pos, scope, state_path = _parse(argv[2:])
+    if sub not in ("install", "remove"):
+        _die(5, f"register-pi-provider.py: unknown subcommand {sub!r}")
+    if len(pos) != 2:
+        _die(5, f"usage: register-pi-provider.py {sub} <settings_path> <repo_dir> --scope <user|project> [--state <path>]")
+    if scope not in ("user", "project"):
+        _die(5, "register-pi-provider.py: --scope must be user or project")
+    settings_path, repo_dir = pos[0], str(os.path.abspath(pos[1]))
+    if scope == "user" and not state_path:
+        _die(5, "register-pi-provider.py: --state is required for --scope user")
+    if sub == "install":
+        cmd_install(settings_path, repo_dir, scope, state_path)
+    else:
+        cmd_remove(settings_path, repo_dir, scope, state_path)
+
+
+if __name__ == "__main__":
+    main(sys.argv)

package/scripts/smoke-agy-hooks-state.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env bash
+# smoke-agy-hooks-state — regression gate for Antigravity PreInvocation birth imprint wiring.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+BRIDGE="$REPO_DIR/scripts/agy-hooks-bridge.sh"
+IMPRINT="$REPO_DIR/scripts/agy-imprint.ts"
+
+pass=0
+ok() { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
+die() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+want() { eval "$2" && ok "$1" || die "$1"; }
+
+REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/xdg"
+export XDG_STATE_HOME="$SB/state"
+HOOKS="$HOME/.gemini/config/plugins/entwurf-agy-imprint/hooks.json"
+LEGACY="$HOME/.gemini/antigravity-cli/hooks.json"
+LEGACY_PLUGIN="$HOME/.gemini/config/plugins/entwurf-probe/hooks.json"
+LEGACY_PLUGIN_JSON="$(dirname "$LEGACY_PLUGIN")/plugin.json"
+PLUGIN_JSON="$(dirname "$HOOKS")/plugin.json"
+STATE="$XDG_DATA_HOME/entwurf/agy-hooks/install-state.json"
+mkdir -p "$(dirname "$HOOKS")" "$(dirname "$LEGACY")" "$(dirname "$LEGACY_PLUGIN")" "$SB/bin"
+printf '#!/usr/bin/env bash\necho {\\"injectSteps\\":[]}\n' > "$SB/bin/entwurf-agy-imprint"
+chmod +x "$SB/bin/entwurf-agy-imprint"
+export PATH="$SB/bin:$PATH"
+
+printf '{"keep-me":{"PreInvocation":[{"type":"command","command":"echo keep"}]}}\n' > "$HOOKS"
+printf '{"agy-birth-probe":{"PreInvocation":[{"type":"command","command":"cat > /tmp/old"}]},"entwurf-agy-imprint":{"PreInvocation":[{"type":"command","command":"old-imprint"}]},"keep-legacy":{"PreInvocation":[{"type":"command","command":"echo legacy"}]}}\n' > "$LEGACY"
+printf '{"name":"entwurf-probe","version":"1.0.0"}\n' > "$LEGACY_PLUGIN_JSON"
+printf '{"agy-birth-probe":{"PreInvocation":[{"type":"command","command":"cat > /tmp/plugin-old"}]}}\n' > "$LEGACY_PLUGIN"
+bash "$BRIDGE" install >/dev/null
+want "install: imprint hook configured" \
+  "python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); sys.exit(0 if d[\"entwurf-agy-imprint\"][\"PreInvocation\"][0][\"command\"]==\"entwurf-agy-imprint\" else 1)' '$HOOKS'"
+want "install: unrelated hook preserved" \
+  "python3 -c 'import json,sys; sys.exit(0 if \"keep-me\" in json.load(open(sys.argv[1])) else 1)' '$HOOKS'"
+want "install: state written" "[ -f '$STATE' ]"
+want "install: plugin.json materialized" "[ -f '$PLUGIN_JSON' ]"
+want "install: plugin.json uses non-probe name" "grep -q 'entwurf-agy-imprint' '$PLUGIN_JSON'"
+want "install: stable command recorded" \
+  "python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))[\"command\"])' '$STATE' | grep -qx entwurf-agy-imprint"
+want "install: legacy top-level agy-birth-probe removed" \
+  "python3 -c 'import json,sys; sys.exit(0 if \"agy-birth-probe\" not in json.load(open(sys.argv[1])) else 1)' '$LEGACY'"
+want "install: legacy top-level duplicate imprint removed" \
+  "python3 -c 'import json,sys; sys.exit(0 if \"entwurf-agy-imprint\" not in json.load(open(sys.argv[1])) else 1)' '$LEGACY'"
+want "install: unrelated legacy hook preserved" \
+  "python3 -c 'import json,sys; sys.exit(0 if \"keep-legacy\" in json.load(open(sys.argv[1])) else 1)' '$LEGACY'"
+want "install: old entwurf-probe plugin hook file removed" "[ ! -e '$LEGACY_PLUGIN' ]"
+want "install: old entwurf-probe plugin.json removed" "[ ! -e '$LEGACY_PLUGIN_JSON' ]"
+
+DOC_OUT="$(bash "$BRIDGE" doctor)"; DOC_RC=$?
+want "doctor: exits 0" "[ '$DOC_RC' -eq 0 ]"
+want "doctor: command resolvable" "printf '%s' \"\$DOC_OUT\" | grep -q \"configured → 'entwurf-agy-imprint' (resolvable)\""
+want "doctor: state confirms configured" "printf '%s' \"\$DOC_OUT\" | grep -q 'still configure entwurf-agy-imprint'"
+want "doctor: legacy top-level guard reports clean" "printf '%s' \"\$DOC_OUT\" | grep -q 'legacy top-level: present but carries no entwurf/probe hook keys'"
+want "doctor: old plugin guard reports absent" "printf '%s' \"\$DOC_OUT\" | grep -q 'legacy plugin(entwurf-probe): absent'"
+
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d["agy-birth-probe"]={"PreInvocation":[{"type":"command","command":"old"}]}; json.dump(d,open(p,"w"))' "$LEGACY"
+if bash "$BRIDGE" doctor >/dev/null 2>&1; then die "legacy-drift: doctor should FAIL when top-level carries old probe key"; fi
+ok "legacy-drift: doctor FAILS on top-level agy-birth-probe"
+bash "$BRIDGE" install >/dev/null
+want "legacy-drift: re-install cleans top-level again" \
+  "python3 -c 'import json,sys; sys.exit(0 if \"agy-birth-probe\" not in json.load(open(sys.argv[1])) else 1)' '$LEGACY'"
+mkdir -p "$(dirname "$LEGACY_PLUGIN")"
+printf '{"agy-birth-probe":{"PreInvocation":[{"type":"command","command":"old-plugin"}]}}\n' > "$LEGACY_PLUGIN"
+if bash "$BRIDGE" doctor >/dev/null 2>&1; then die "legacy-plugin-drift: doctor should FAIL when old plugin carries probe key"; fi
+ok "legacy-plugin-drift: doctor FAILS on old entwurf-probe plugin key"
+bash "$BRIDGE" install >/dev/null
+want "legacy-plugin-drift: re-install removes old plugin hook file" "[ ! -e '$LEGACY_PLUGIN' ]"
+
+python3 -c 'import json,sys; p=sys.argv[1]; d=json.load(open(p)); d.pop("entwurf-agy-imprint", None); json.dump(d,open(p,"w"))' "$HOOKS"
+if bash "$BRIDGE" doctor >/dev/null 2>&1; then die "drift: doctor should FAIL when state hook is removed"; fi
+ok "drift: doctor FAILS on state-present + hook-removed"
+bash "$BRIDGE" install >/dev/null
+
+rm -f "$HOOKS"
+DOC_OUT="$(bash "$BRIDGE" doctor 2>&1)"; DOC_RC=$?
+want "orphan: doctor exits 0 when hooks file is absent" "[ '$DOC_RC' -eq 0 ]"
+want "orphan: doctor logs ORPHANED" "printf '%s' \"\$DOC_OUT\" | grep -q ORPHANED"
+want "orphan: state removed" "[ ! -f '$STATE' ]"
+
+printf '{"keep-me":{"PreInvocation":[{"type":"command","command":"echo keep"}]}}\n' > "$HOOKS"
+bash "$BRIDGE" install >/dev/null
+bash "$BRIDGE" uninstall >/dev/null
+want "uninstall: imprint hook removed" \
+  "python3 -c 'import json,sys; sys.exit(0 if \"entwurf-agy-imprint\" not in json.load(open(sys.argv[1])) else 1)' '$HOOKS'"
+want "uninstall: unrelated hook survived" \
+  "python3 -c 'import json,sys; sys.exit(0 if \"keep-me\" in json.load(open(sys.argv[1])) else 1)' '$HOOKS'"
+want "uninstall: state removed" "[ ! -f '$STATE' ]"
+
+rm -f "$HOOKS"
+printf '{}\n' > "$SB/real_hooks.json"
+ln -s "$SB/real_hooks.json" "$HOOKS"
+if bash "$BRIDGE" install >/dev/null 2>&1; then die "symlink: install should REFUSE"; fi
+ok "symlink: install refused"
+want "symlink: no state written" "[ ! -f '$STATE' ]"
+rm -f "$HOOKS"
+
+# Direct imprint contract: stdout neutral, create then attach by conversationId, no duplicate.
+AGENT="$SB/agent"
+payload='{"conversationId":"conv-smoke","workspacePaths":["/work/smoke"],"transcriptPath":"/tmp/t.jsonl","modelName":"gemini-smoke"}'
+printf '%s' "$payload" | PI_CODING_AGENT_DIR="$AGENT" node --experimental-strip-types "$IMPRINT" > "$SB/out1"
+want "imprint: stdout is neutral PreInvocation response" "grep -qx '{\"injectSteps\":\[\]}' '$SB/out1'"
+want "imprint: creates one antigravity record" \
+  "[ \$(find '$AGENT/meta-sessions' -name '*.meta.json' | wc -l) -eq 1 ] && grep -q '\"backend\": \"antigravity\"' '$AGENT/meta-sessions'/*.meta.json"
+printf '%s' "$payload" | PI_CODING_AGENT_DIR="$AGENT" node --experimental-strip-types "$IMPRINT" >/dev/null
+want "imprint: second run attaches, no duplicate" "[ \$(find '$AGENT/meta-sessions' -name '*.meta.json' | wc -l) -eq 1 ]"
+printf '%s' '{"workspacePaths":["/work/smoke"]}' | PI_CODING_AGENT_DIR="$SB/agent2" node --experimental-strip-types "$IMPRINT" >/dev/null
+want "imprint: missing conversationId writes no record" "[ ! -d '$SB/agent2/meta-sessions' ] || [ \$(find '$SB/agent2/meta-sessions' -name '*.meta.json' | wc -l) -eq 0 ]"
+
+# ── RE-INSTALL PROVENANCE: an installer is re-run on every upgrade ────────────
+# The preimage answers "what was here before US". Re-capturing it on each install would record OUR
+# OWN previous hook as the operator's, and the honest inverse would then restore us — uninstall
+# leaving behind the very thing it exists to remove. Same bug class, all three agy adapters.
+rm -f "$HOOKS" "$STATE"
+mkdir -p "$(dirname "$HOOKS")"
+printf '{"other-plugin":{"PreInvocation":[{"type":"command","command":"keepme"}]}}\n' > "$HOOKS"
+bash "$BRIDGE" install >/dev/null 2>&1
+bash "$BRIDGE" install >/dev/null 2>&1
+bash "$BRIDGE" install >/dev/null 2>&1
+want "re-install: provenance stays the FIRST install's (preimage still null, not our own hook)" \
+  "python3 -c \"import json,sys;sys.exit(0 if json.load(open('$STATE'))['preimage'] is None else 1)\""
+bash "$BRIDGE" uninstall >/dev/null 2>&1
+want "re-install: uninstall after install×3 still removes our hook (no self-restore)" \
+  "! python3 -c \"import json,sys;sys.exit(0 if 'entwurf-agy-imprint' in json.load(open('$HOOKS')) else 1)\""
+want "re-install: an unrelated plugin's hook survives the whole cycle" \
+  "python3 -c \"import json,sys;sys.exit(0 if 'other-plugin' in json.load(open('$HOOKS')) else 1)\""
+
+REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
+want "purity: checkout unchanged (all writes stayed in sandbox HOME+XDG)" "[ \"$REPO_BEFORE\" = \"$REPO_AFTER\" ]"
+
+# ── FOREIGN TARGET: state describes a hooks file this host does not load ──────────────
+# The recorded hooks file is perfectly configured — it is just not the one agy loads here. A doctor
+# that only inspects the recorded path calls that green while the LIVE PreInvocation hook is
+# unowned: uninstall would leave it in place, and its provenance is unrecorded. A real host reached
+# this shape via a verification run that isolated HOME but SHARED XDG_DATA_HOME. Isolation must move
+# HOME and XDG_DATA_HOME together.
+bash "$BRIDGE" install >/dev/null   # re-own this host (earlier cases may have torn the state down)
+FOREIGN_HOOKS="$SB/foreign-hooks.json"
+cp "$HOOKS" "$FOREIGN_HOOKS"
+python3 -c "
+import json,sys
+p=sys.argv[1]; d=json.load(open(p)); d['managedHooksPath']=sys.argv[2]
+json.dump(d, open(p,'w'))" "$STATE" "$FOREIGN_HOOKS"
+set +e; FT_OUT="$(bash "$BRIDGE" doctor 2>&1)"; FT_RC=$?; set -e
+want "foreign-target: doctor FAILS when install-state manages hooks this host does not load" "[ '$FT_RC' -ne 0 ]"
+want "foreign-target: the report names both the recorded and the live hooks path" \
+  "printf '%s' \"\$FT_OUT\" | grep -q 'FOREIGN TARGET' && printf '%s' \"\$FT_OUT\" | grep -qF '$FOREIGN_HOOKS' && printf '%s' \"\$FT_OUT\" | grep -qF '$HOOKS'"
+want "foreign-target: it names the real damage — the live hook is unowned" \
+  "printf '%s' \"\$FT_OUT\" | grep -qi 'unowned'"
+want "foreign-target: neither the foreign hooks file nor the state is auto-deleted" "[ -f '$FOREIGN_HOOKS' ] && [ -f '$STATE' ]"
+rm -f "$FOREIGN_HOOKS"
+
+# A present state with invalid JSON or no managed target is corrupt evidence, not "no evidence".
+# The doctor must fail loud instead of parsing to an empty string and skipping the ownership check.
+printf 'not-json{{{' > "$STATE"
+set +e; FT_OUT="$(bash "$BRIDGE" doctor 2>&1)"; FT_RC=$?; set -e
+want "corrupt-state: doctor FAILS on unreadable install-state" "[ '$FT_RC' -ne 0 ]"
+want "corrupt-state: report names CORRUPT instead of silently skipping ownership" \
+  "printf '%s' \"\$FT_OUT\" | grep -q 'state: CORRUPT'"
+
+# A RELATIVE managed path is corrupt too — install records absolute paths only, and resolving a
+# relative one against the doctor's cwd could bless whatever directory it happens to run from.
+printf '{"managedHooksPath":".gemini/config/plugins/entwurf-agy-imprint/hooks.json"}' > "$STATE"
+set +e; FT_OUT="$(bash "$BRIDGE" doctor 2>&1)"; FT_RC=$?; set -e
+want "corrupt-state: a relative managedHooksPath is CORRUPT, never resolved against the doctor's cwd" \
+  "[ '$FT_RC' -ne 0 ] && printf '%s' \"\$FT_OUT\" | grep -q 'state: CORRUPT'"
+
+printf '\nsmoke-agy-hooks-state: %d checks passed\n' "$pass"