@junghanacs/entwurf 0.12.5 → 0.12.7

package/scripts/smoke-meta-install-state.sh

@@ -22,10 +22,58 @@ TMP="$(mktemp -d -t psa-meta-install-state.XXXXXX)"
 cleanup() { rm -rf "$TMP"; }
 trap cleanup EXIT
 
+# ⓪ 설치 경계 봉쇄 (2026-07-03 `?` 사건의 구조적 소멸): source origin(repo/npm)과
+# live artifact(XDG)를 분리한다. dev clone과 installed 소비자는 같은 user-scope
+# install이고, 둘 다 marketplace source를 XDG data dir에 조립한다 — 절대 checkout
+# 내부가 아니다. 이 smoke의 어떤 단계도 repo 안에 live source를 만들지 않음을
+# top/bottom fingerprint로 감싸 증명하고, 아래 fake-install로 "install → XDG"를 직접 건다.
+# present/absent만 보면 present→present 덮어쓰기를 놓치므로 내용 해시까지 비교한다.
+asm_fingerprint() {
+  if [ -e "$REPO/pi/meta-bridge/.assembled" ]; then (cd "$REPO/pi/meta-bridge/.assembled" && find . -type f -exec sha256sum {} + 2>/dev/null | sort); else echo ABSENT; fi
+}
+REPO_ASM_FP_START="$(asm_fingerprint)"
+
+# 실제 meta-bridge-install.sh를 격리된 HOME + XDG_DATA_HOME + fake claude로 돌려
+# live marketplace source가 XDG 아래에 조립되고 `plugin marketplace add`가 그 XDG
+# 경로를 받는지 직접 증명한다(오프라인: 실제 claude 없음).
+INS_HOME="$TMP/ins-home"; INS_XDG="$TMP/ins-xdg"; INS_BIN="$TMP/ins-bin"
+mkdir -p "$INS_HOME/.claude" "$INS_BIN"
+echo '{}' > "$INS_HOME/.claude/settings.json"
+echo '{}' > "$INS_HOME/.claude.json"
+INS_LOG="$TMP/ins-claude.log"
+cat > "$INS_BIN/claude" <<'SH'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >> "$FAKE_CLAUDE_LOG"
+case "$1${2:+ $2}" in
+  "plugin list") printf '%s\n' "entwurf-meta-receive@meta-bridge-local" "  Status: enabled" ;;
+  "mcp get")     printf '%s\n' "Scope: User config" "Status: Connected" ;;
+  *) : ;;
+esac
+exit 0
+SH
+chmod +x "$INS_BIN/claude"
+if env HOME="$INS_HOME" CLAUDE_CONFIG_DIR="$INS_HOME/.claude" XDG_DATA_HOME="$INS_XDG" \
+       FAKE_CLAUDE_LOG="$INS_LOG" PATH="$INS_BIN:$PATH" \
+       bash "$REPO/scripts/meta-bridge-install.sh" >/dev/null 2>&1; then
+  if [ -e "$INS_XDG/entwurf/meta-bridge/.assembled/entwurf-meta-receive" ]; then ok "dev install assembles the live marketplace source under XDG (not the checkout)"; else bad "dev install did not assemble under XDG_DATA_HOME"; fi
+  MKT_ADD="$(grep '^plugin marketplace add ' "$INS_LOG" | head -1 || true)"
+  if printf '%s' "$MKT_ADD" | grep -Fq "$INS_XDG/entwurf/meta-bridge/.assembled"; then ok "claude plugin marketplace add received the XDG artifact path"; else bad "marketplace add did not point at XDG: $MKT_ADD"; fi
+else
+  bad "real install-meta-bridge failed under isolated HOME/XDG/fake-claude:"$'\n'"$(cat "$INS_LOG" 2>/dev/null)"
+fi
+
 export HOME="$TMP/home"
+# The wrapper-uninstall below removes ${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/
+# meta-bridge. Pin XDG_DATA_HOME into the sandbox too, so a developer who runs this
+# smoke with XDG_DATA_HOME set in their shell can never have their real live
+# artifact removed — the boundary that keeps check/smoke off global user wiring.
+export XDG_DATA_HOME="$TMP/xdg"
 export CLAUDE_CONFIG_DIR="$HOME/.claude"
 mkdir -p "$CLAUDE_CONFIG_DIR"
-ASM="$TMP/assembled-marketplace"
+# Canonical-suffix asm: production install ALWAYS records a path ending in
+# …/entwurf/meta-bridge/.assembled, and state.py check now shape-validates that
+# suffix — so the survival harness must use a realistic path, not a bare stub.
+ASM="$TMP/asm-xdg/entwurf/meta-bridge/.assembled"
 export ASM
 mkdir -p "$ASM"
 
@@ -213,8 +261,10 @@ then ok "uninstall restores scalars/maps and removes only managed array addition
 
 if py uninstall >/dev/null 2>&1; then bad "state manager uninstall without state should not guess"; else ok "state manager uninstall without state fails instead of guessing"; fi
 
-# The wrapper must ALSO refuse before side effects. A fake claude records whether
-# plugin/MCP removals were attempted; no state means the log must stay empty.
+# ⓪ 봉쇄: wrapper-uninstall을 실제 $REPO 스크립트로 직접 돌린다. 이제 uninstall이
+# 지우는 live artifact는 ${XDG_DATA_HOME}/entwurf/meta-bridge 하나뿐이고, 위에서
+# HOME + XDG_DATA_HOME를 샌드박스로 고정했으므로 실제 개발자 배선/체크아웃에는
+# 닿을 수 없다(2026-07-03 `?` 사건의 구조적 소멸 — 사본 repo 우회가 더는 불필요).
 FAKE_BIN="$TMP/fake-bin"; mkdir -p "$FAKE_BIN"
 cat > "$FAKE_BIN/claude" <<'SH'
 #!/usr/bin/env bash
@@ -222,6 +272,9 @@ printf '%s\n' "$*" >> "$FAKE_CLAUDE_LOG"
 exit 0
 SH
 chmod +x "$FAKE_BIN/claude"
+
+# The wrapper must refuse before side effects. A fake claude records whether
+# plugin/MCP removals were attempted; no state means the log must stay empty.
 FAKE_CLAUDE_LOG="$TMP/fake-claude-nostate.log"
 if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
   bad "wrapper uninstall without state should fail"
@@ -229,10 +282,14 @@ else
   if [ ! -s "$FAKE_CLAUDE_LOG" ]; then ok "wrapper uninstall without state has zero Claude side effects"; else bad "wrapper uninstall without state touched Claude: $(cat "$FAKE_CLAUDE_LOG")"; fi
 fi
 
-# With valid state, the wrapper may remove Claude registrations and then restore
-# JSON state. This proves the preflight gate is ordered before side effects.
-py prepare >/dev/null
-py apply >/dev/null
+# With valid state, the wrapper removes Claude registrations, restores JSON state,
+# AND removes the XDG live artifact RECORDED in state — never the checkout, never a
+# path recomputed from the env. Record an XDG-structured assembled path and seed the
+# sentinel artifact so we can prove uninstall drops exactly the recorded tree.
+WASM="$XDG_DATA_HOME/entwurf/meta-bridge/.assembled"
+python3 "$STATE" prepare --repo "$REPO" --asm "$WASM" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$WASM" >/dev/null
+mkdir -p "$WASM"; : > "$WASM/.sentinel"
 FAKE_CLAUDE_LOG="$TMP/fake-claude-state.log"
 if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
   if grep -q 'plugin uninstall entwurf-meta-receive@meta-bridge-local' "$FAKE_CLAUDE_LOG" && grep -q 'mcp remove entwurf-bridge -s user' "$FAKE_CLAUDE_LOG" && [ ! -f "$STATE_FILE" ]; then
@@ -240,10 +297,97 @@ if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts
   else
     bad "wrapper uninstall with state missed expected side effects/state removal"
   fi
+  # 봉쇄가 회피가 아니라 구조임을 증명: uninstall이 지우는 건 recorded XDG artifact뿐.
+  if [ ! -e "$XDG_DATA_HOME/entwurf/meta-bridge" ]; then ok "wrapper removes the recorded XDG live artifact tree, not the checkout"; else bad "wrapper did not remove the recorded XDG live artifact"; fi
 else
   bad "wrapper uninstall with valid state failed"
 fi
 
+# Honest inverse under a CHANGED XDG_DATA_HOME (GPT hardening): uninstall must remove
+# the RECORDED artifact path, never one recomputed from the current env. Record A,
+# run uninstall with the env pointing at B, and prove A is gone while B is untouched.
+XDGA="$TMP/xdgA"; XDGB="$TMP/xdgB"
+ASM_A="$XDGA/entwurf/meta-bridge/.assembled"
+python3 "$STATE" prepare --repo "$REPO" --asm "$ASM_A" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$ASM_A" >/dev/null
+mkdir -p "$ASM_A"; : > "$ASM_A/.sentinel"
+mkdir -p "$XDGB/entwurf/meta-bridge/.assembled"; : > "$XDGB/entwurf/meta-bridge/.assembled/.sentinel"
+if XDG_DATA_HOME="$XDGB" PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$TMP/fake-claude-mismatch.log" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
+  if [ ! -e "$XDGA/entwurf/meta-bridge" ]; then ok "uninstall removes the RECORDED artifact (XDG A) even when env XDG_DATA_HOME differs"; else bad "uninstall did not remove the recorded artifact A — recomputed from env instead"; fi
+  if [ -e "$XDGB/entwurf/meta-bridge/.assembled/.sentinel" ]; then ok "uninstall leaves the current-env XDG (B) untouched (no env recompute)"; else bad "uninstall wrongly removed the current-env XDG B"; fi
+else
+  bad "wrapper uninstall (recorded-path mismatch case) failed"
+fi
+
+# GPT hardening: a corrupt recorded assembledMarketplacePath must fail the wrapper
+# uninstall LOUD and BEFORE any side effect — no Claude removal, state file intact
+# (honest inverse never guesses / never partially uninstalls / never WARN-then-DONE).
+# Two corrupt shapes: a trivially-bad "/" AND the basename-corrupt case that a
+# PARENT-ONLY guard would silently pass (…/entwurf/meta-bridge/not-assembled) — the
+# rm targets the parent meta-bridge dir, so that shape must be refused by the FULL
+# suffix guard or it nukes the real artifact + Claude registrations (2026-07-03).
+for CORRUPT in "/" "$XDG_DATA_HOME/entwurf/meta-bridge/not-assembled"; do
+  python3 "$STATE" prepare --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+  python3 "$STATE" apply   --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+  # seed the real artifact so an over-broad rm would be observable as its removal
+  mkdir -p "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled"; : > "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled/.sentinel"
+  CORRUPT="$CORRUPT" python3 - <<'PY'
+import json, os
+p = os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
+s = json.load(open(p)); s['assembledMarketplacePath'] = os.environ['CORRUPT']
+json.dump(s, open(p, 'w'), indent=2)
+PY
+  FAKE_CLAUDE_LOG="$TMP/fake-claude-corrupt.log"; : > "$FAKE_CLAUDE_LOG"
+  if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
+    bad "wrapper uninstall with corrupt recorded path '$CORRUPT' should fail loud"
+  elif [ -s "$FAKE_CLAUDE_LOG" ] || [ ! -f "$STATE_FILE" ] || [ ! -e "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled/.sentinel" ]; then
+    bad "corrupt-path uninstall '$CORRUPT' leaked side effects/removed artifact: claude_log=[$(cat "$FAKE_CLAUDE_LOG")] state_exists=$([ -f "$STATE_FILE" ] && echo yes || echo no) artifact=$([ -e "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled/.sentinel" ] && echo intact || echo REMOVED)"
+  else
+    ok "corrupt recorded path '$CORRUPT' → uninstall fails BEFORE side effects (no Claude removal, state + artifact intact)"
+  fi
+  rm -f "$STATE_FILE"; rm -rf "$XDG_DATA_HOME/entwurf/meta-bridge"
+done
+
+# GPT hardening: state.py check must compare the RECORDED marketplace path, not the
+# --asm handed in. Install/apply with A, then check with a DIFFERENT --asm B: it must
+# still PASS (Claude settings + state both hold A; only the caller's XDG differs).
+CKA="$TMP/ck-xdgA/entwurf/meta-bridge/.assembled"
+CKB="$TMP/ck-xdgB/entwurf/meta-bridge/.assembled"
+python3 "$STATE" prepare --repo "$REPO" --asm "$CKA" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$CKA" >/dev/null
+if python3 "$STATE" check --repo "$REPO" --asm "$CKB" >/dev/null 2>&1; then ok "state.py check passes when --asm differs from the recorded path (compares recorded, no XDG false-fail)"; else bad "state.py check false-FAILed on a recorded≠--asm mismatch"; fi
+rm -f "$STATE_FILE"
+
+# GPT hardening: check must shape-validate the recorded path, not just compare it to
+# settings. Corrupt BOTH state + settings to the same basename-bad value: a pure
+# consistency compare would PASS (both agree) and greenlight a bogus marketplace
+# source. The suffix guard must FAIL it instead.
+python3 "$STATE" prepare --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 - <<'PY'
+import json, os
+xdg = os.environ['XDG_DATA_HOME']; corrupt = xdg + '/entwurf/meta-bridge/not-assembled'
+sp = os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
+s = json.load(open(sp)); s['assembledMarketplacePath'] = corrupt; json.dump(s, open(sp, 'w'), indent=2)
+cp = os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'
+c = json.load(open(cp)); c['extraKnownMarketplaces']['meta-bridge-local'] = {'source': {'source': 'directory', 'path': corrupt}}; json.dump(c, open(cp, 'w'), indent=2)
+PY
+if python3 "$STATE" check --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null 2>&1; then bad "state.py check greenlit a both-corrupt (state+settings) malformed marketplace path"; else ok "state.py check fails a malformed recorded path even when settings agree (shape guard, not just consistency)"; fi
+rm -f "$STATE_FILE"
+
+# GPT hardening: a MISSING/empty recorded path is corruption too — every state our
+# code writes carries the field, so check must NOT fall back to --asm and PASS.
+# Delete the field with settings still valid; the shape guard must FAIL, not greenlight.
+python3 "$STATE" prepare --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 - <<'PY'
+import json, os
+sp = os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
+s = json.load(open(sp)); s.pop('assembledMarketplacePath', None); json.dump(s, open(sp, 'w'), indent=2)
+PY
+if python3 "$STATE" check --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null 2>&1; then bad "state.py check PASSed with a MISSING recorded assembledMarketplacePath (fell back to --asm)"; else ok "state.py check fails a missing/empty recorded path (no --asm fallback greenlight)"; fi
+rm -f "$STATE_FILE"
+
 # Doctor hook-log recovery predicate: only a later `INFO armed watch` clears an
 # ERROR. A UserPromptSubmit `INFO attach record` is degraded backfill, not wake
 # recovery.
@@ -365,7 +509,7 @@ if node --experimental-strip-types "$STORE_DOCTOR" "$STORE" >/dev/null 2>&1; the
 # chain to its final summary line — i.e. no early set -e death anywhere.
 DOC_HOME="$TMP/doctor-home"; DOC_CFG="$DOC_HOME/.claude"
 DOC_AGENT="$TMP/doctor-agent"; DOC_STORE="$DOC_AGENT/meta-sessions"
-DOC_BIN="$TMP/doctor-bin"; DOC_ASM="$REPO/pi/meta-bridge/.assembled"  # SAME asm the doctor's check uses, so only the MCP drifts
+DOC_BIN="$TMP/doctor-bin"; DOC_ASM="$XDG_DATA_HOME/entwurf/meta-bridge/.assembled"  # SAME asm the doctor computes (XDG), so only the MCP drifts
 mkdir -p "$DOC_CFG" "$DOC_STORE" "$DOC_BIN"
 echo '{}' > "$DOC_CFG/settings.json"
 echo '{}' > "$DOC_HOME/.claude.json"
@@ -375,6 +519,14 @@ valid_record "20260606T120000-eeeeee" "doctor-native" > "$DOC_STORE/20260606T120
 # Fake claude: a healthy toolchain so the doctor sails past every other section.
 cat > "$DOC_BIN/claude" <<'SH'
 #!/usr/bin/env bash
+if [ "${1:-} ${2:-} ${3:-}" = "plugin list --json" ]; then
+  if [ "${FAKE_PLUGIN_CACHE_MISS:-0}" = 1 ]; then
+    printf '%s\n' '[{"id":"entwurf-meta-receive@meta-bridge-local","enabled":true,"errors":["Marketplace meta-bridge-local failed to load: cache-miss"]}]'
+  else
+    printf '%s\n' '[{"id":"entwurf-meta-receive@meta-bridge-local","enabled":true}]'
+  fi
+  exit 0
+fi
 case "$1${2:+ $2}" in
   "--version") echo "2.1.167 (Claude Code)" ;;
   "plugin list") printf '%s\n' "entwurf-meta-receive@meta-bridge-local" "  Status: enabled" ;;
@@ -405,5 +557,23 @@ if printf '%s\n' "$DOC_OUT" | grep -q 'user MCP entwurf-bridge'; then ok "doctor
 if printf '%s\n' "$DOC_OUT" | grep -q '\[plugin install'; then ok "doctor continues to a later section after the drift (no early set -e death)"; else bad "doctor did not reach a later section header after the drift:"$'\n'"$DOC_OUT"; fi
 if printf '%s\n' "$DOC_OUT" | grep -q 'meta-bridge doctor: FAIL'; then ok "doctor runs the whole chain to its final summary line"; else bad "doctor did not reach its final summary line (mid-run death):"$'\n'"$DOC_OUT"; fi
 
+# A plugin can be configured enabled while Claude refuses to load its missing marketplace
+# source. Text-only `grep enabled` called that healthy and let `🪛 ? cc` look mysterious.
+set +e
+DOC_CACHE_OUT="$(env HOME="$DOC_HOME" CLAUDE_CONFIG_DIR="$DOC_CFG" PI_CODING_AGENT_DIR="$DOC_AGENT" ENTWURF_META_SESSIONS_DIR="$DOC_STORE" FAKE_PLUGIN_CACHE_MISS=1 PATH="$DOC_BIN:$PATH" bash "$REPO/scripts/meta-bridge-doctor.sh" 2>&1)"
+DOC_CACHE_CODE=$?
+set -e
+if [ "$DOC_CACHE_CODE" -eq 1 ] && printf '%s\n' "$DOC_CACHE_OUT" | grep -q 'enabled=true but FAILED TO LOAD:.*cache-miss'; then
+  ok "doctor distinguishes configured-enabled from loadable (cache-miss is a hard failure)"
+else
+  bad "doctor did not surface enabled-but-cache-miss as a hard load failure:"$'\n'"$DOC_CACHE_OUT"
+fi
+
+# ⓪ 경계 종료 단언: 이 smoke 전체(install 조립 + state + wrapper-uninstall + doctor)가
+# 끝난 뒤에도 checkout 안에는 live marketplace source가 생기지 않았다 — source
+# origin(repo)과 live artifact(XDG)가 구조적으로 분리됐다는 최종 증명. 미래 회귀가
+# repo 내부 ASM을 되살리거나 덮어쓰면(내용 해시 변화 포함) 여기서 잡힌다.
+if [ "$(asm_fingerprint)" = "$REPO_ASM_FP_START" ]; then ok "checkout-internal marketplace source is byte-identical before/after — no op created or mutated \$REPO/.assembled (source origin ≠ live artifact)"; else bad "a meta-bridge operation created/mutated \$REPO/pi/meta-bridge/.assembled — repo boundary breached"; fi
+
 echo
 if [ "$fail" -eq 0 ]; then echo "smoke-meta-install-state: PASS"; else echo "smoke-meta-install-state: FAIL (see above)"; exit 1; fi

package/scripts/smoke-pi-provider-state.sh

@@ -0,0 +1,182 @@
+#!/usr/bin/env bash
+# smoke-pi-provider-state — regression gate for the pi provider install adapter (#46 Task 2):
+# register-pi-provider.py (ownership-classified install/remove, user+project scopes) + the
+# read-only doctor-pi-provider.ts (effective shadow view). Runs in an ISOLATED HOME + XDG with a
+# fake stable bin and isolated settings files (no real ~/.pi). Asserts:
+#   - user install ownership matrix: absent→create+state; managed-legacy(repo start.sh)→bare bin +
+#     state(preimage audit, NOT restored) + siblings preserved; managed-current→idempotent;
+#     user-override→NOT overwritten, NO state (unowned).
+#   - user remove: state-based honest inverse (managed-* → remove OUR key, a legacy repo path is
+#     NOT restored; siblings kept; parent tidied); user-override → no state → nothing to undo.
+#   - legacy bundle prune (session-bridge/pi-tools-bridge repo path) alongside, user my-own kept.
+#   - project scope: NO state; install normalizes the bare bin, remove strips our-managed shapes
+#     (bare bin AND legacy repo path), a user override left in place.
+#   - doctor: effective = project shadows user; user-only/both-bare → ok green; project-STALE
+#     (user bare, project legacy) → effective legacy note (the "doctor green runtime red" guard);
+#     state-owned DRIFT → FAIL; bare-but-dangling → FAIL; malformed settings → FAIL; symlink refuse.
+#   - checkout stays byte-identical (nothing under $REPO).
+# Offline + deterministic (deps: bash + python3 + node --experimental-strip-types).
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+REG="$REPO_DIR/scripts/register-pi-provider.py"
+DOCTOR="$REPO_DIR/scripts/doctor-pi-provider.ts"
+
+pass=0
+ok()   { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
+die()  { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+want() { eval "$2" && ok "$1" || die "$1"; }
+
+REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
+
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/xdg"
+GLOBAL="$SB/global.json"
+PROJECT="$SB/proj/.pi/settings.json"
+STATE="$XDG_DATA_HOME/entwurf/pi-provider/install-state.json"
+mkdir -p "$SB/proj/.pi" "$SB/bin" "$SB/home"
+
+# A fake repo anchor for the managed-legacy predicate (endswith /entwurf/mcp/entwurf-bridge/start.sh).
+FAKE_REPO="$SB/checkout/entwurf"
+LEGACY_CMD="$FAKE_REPO/mcp/entwurf-bridge/start.sh"
+
+# fake stable bin on PATH so the bare command RESOLVES in the doctor. Keep THIS fake
+# authoritative: drop the dir that holds a REAL entwurf-bridge (this dev host exposes one at
+# ~/.local/bin) so the dangling test is not masked by it.
+printf '#!/usr/bin/env bash\necho fake-bridge\n' > "$SB/bin/entwurf-bridge"
+chmod +x "$SB/bin/entwurf-bridge"
+_real_bridge="$(command -v entwurf-bridge 2>/dev/null || true)"
+_real_dir="${_real_bridge%/*}"
+if [ -n "$_real_dir" ]; then
+  PATH="$(printf '%s' "$PATH" | tr ':' '\n' | grep -vFx "$_real_dir" | paste -sd: -)"
+fi
+export PATH="$SB/bin:$PATH"
+
+reg()    { python3 "$REG" "$@"; }
+doctor() { PI_PROVIDER_GLOBAL_SETTINGS="$GLOBAL" PI_PROVIDER_PROJECT_SETTINGS="$PROJECT" PI_PROVIDER_STATE="$STATE" \
+             node --experimental-strip-types "$DOCTOR"; }
+cmd_of() { python3 -c 'import json,sys
+try:
+  d=json.load(open(sys.argv[1])); print(d["entwurfProvider"]["mcpServers"]["entwurf-bridge"]["command"])
+except Exception: print("<none>")' "$1"; }
+
+# ── A: user install — absent → create + state(ownership=absent) ───────────────
+printf '{"defaultProvider":"x"}\n' > "$GLOBAL"
+reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null
+want "user/absent: command is bare stable bin" "[ \"\$(cmd_of '$GLOBAL')\" = entwurf-bridge ]"
+want "user/absent: state ownership=absent" \
+  "python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))[\"ownership\"])' '$STATE' | grep -qx absent"
+
+# ── B: user install — managed-legacy(repo start.sh) → bare bin + preimage + siblings kept ──
+rm -f "$STATE"
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"appendSystemPrompt":False,"skillPlugins":["/p"],"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]}}},"packages":["y"]}, open(sys.argv[1],"w"))' "$GLOBAL" "$LEGACY_CMD"
+OUT="$(reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE")"
+want "user/managed-legacy: reported as managed-legacy" "printf '%s' \"\$OUT\" | grep -q 'managed-legacy'"
+want "user/managed-legacy: normalized to bare bin" "[ \"\$(cmd_of '$GLOBAL')\" = entwurf-bridge ]"
+want "user/managed-legacy: siblings preserved (skillPlugins/appendSystemPrompt)" \
+  "python3 -c 'import json,sys; ep=json.load(open(sys.argv[1]))[\"entwurfProvider\"]; sys.exit(0 if ep.get(\"skillPlugins\")==[\"/p\"] and ep.get(\"appendSystemPrompt\") is False else 1)' '$GLOBAL'"
+want "user/managed-legacy: state ownership=managed-legacy" \
+  "python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))[\"ownership\"])' '$STATE' | grep -qx managed-legacy"
+want "user/managed-legacy: preimage records the repo path (audit, not restored)" \
+  "python3 -c 'import json,sys; p=json.load(open(sys.argv[1]))[\"preimage\"]; sys.exit(0 if p and p.get(\"command\")==sys.argv[2] else 1)' '$STATE' '$LEGACY_CMD'"
+want "user/managed-legacy: timing honesty label emitted" \
+  "printf '%s' \"\$OUT\" | grep -q 'existing pi sessions unaffected until restart'"
+
+# ── C: user install — managed-current(bare) → idempotent ──────────────────────
+OUT="$(reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE")"
+want "user/managed-current: idempotent (stays bare)" "[ \"\$(cmd_of '$GLOBAL')\" = entwurf-bridge ]"
+want "user/managed-current: reported managed-current" "printf '%s' \"\$OUT\" | grep -q 'managed-current'"
+
+# ── D: user install — user-override → NOT overwritten, NO state ───────────────
+rm -f "$STATE"
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"/my/own/thing"}}}}\n' > "$GLOBAL"
+OUT="$(reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE")"
+want "user/override: command left untouched" "[ \"\$(cmd_of '$GLOBAL')\" = /my/own/thing ]"
+want "user/override: NO state written (unowned)" "[ ! -f '$STATE' ]"
+want "user/override: reported preserved user override" "printf '%s' \"\$OUT\" | grep -qi 'user override'"
+
+# ── E: user remove — state-based honest inverse (key removed, siblings kept) ──
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"skillPlugins":["/p"],"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]}}}}, open(sys.argv[1],"w"))' "$GLOBAL" "$LEGACY_CMD"
+reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null
+reg remove "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null
+want "user/remove: our key removed (NOT restored to repo path)" "[ \"\$(cmd_of '$GLOBAL')\" = '<none>' ]"
+want "user/remove: sibling skillPlugins preserved" \
+  "python3 -c 'import json,sys; sys.exit(0 if json.load(open(sys.argv[1]))[\"entwurfProvider\"].get(\"skillPlugins\")==[\"/p\"] else 1)' '$GLOBAL'"
+want "user/remove: state removed" "[ ! -f '$STATE' ]"
+reg remove "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null 2>&1
+ok "user/remove: no-state is idempotent (nothing to undo)"
+
+# ── F: legacy bundle prune alongside, user-authored server kept ───────────────
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]},"session-bridge":{"command":sys.argv[3]},"my-own":{"command":"/custom"}}}}, open(sys.argv[1],"w"))' "$GLOBAL" "$LEGACY_CMD" "$FAKE_REPO/mcp/session-bridge/start.sh"
+reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null
+want "legacy-prune: session-bridge removed" \
+  "python3 -c 'import json,sys; sys.exit(0 if \"session-bridge\" not in json.load(open(sys.argv[1]))[\"entwurfProvider\"][\"mcpServers\"] else 1)' '$GLOBAL'"
+want "legacy-prune: user-authored my-own kept" \
+  "python3 -c 'import json,sys; sys.exit(0 if \"my-own\" in json.load(open(sys.argv[1]))[\"entwurfProvider\"][\"mcpServers\"] else 1)' '$GLOBAL'"
+reg remove "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null; rm -f "$STATE"
+
+# ── G: project scope — NO state; install normalizes, remove strips managed shapes ──
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]}}}}, open(sys.argv[1],"w"))' "$PROJECT" "$LEGACY_CMD"
+reg install "$PROJECT" "$FAKE_REPO" --scope project >/dev/null
+want "project/install: normalized to bare bin" "[ \"\$(cmd_of '$PROJECT')\" = entwurf-bridge ]"
+want "project/install: NO user-scope state created" "[ ! -f '$STATE' ]"
+reg remove "$PROJECT" "$FAKE_REPO" --scope project >/dev/null
+want "project/remove: strips the bare bin (our-managed)" "[ \"\$(cmd_of '$PROJECT')\" = '<none>' ]"
+
+# ── H: doctor — effective shadow view + verdicts ──────────────────────────────
+# H-1: user-only bare → effective user, ok green
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+printf '{}\n' > "$PROJECT"; rm -f "$STATE"
+OUT="$(doctor)"; RC=$?
+want "doctor(user-only bare): exits 0" "[ '$RC' -eq 0 ]"
+want "doctor(user-only bare): ok — bare bin resolves" "printf '%s' \"\$OUT\" | grep -q 'bare stable bin'"
+
+# H-2: project STALE (user bare, project legacy) → effective=project=legacy note (green-runtime-red guard)
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]}}}}, open(sys.argv[1],"w"))' "$PROJECT" "$LEGACY_CMD"
+OUT="$(doctor)"; RC=$?
+want "doctor(project-stale): exits 0 (honest note, not a crash)" "[ '$RC' -eq 0 ]"
+want "doctor(project-stale): EFFECTIVE is project (shadows user)" "printf '%s' \"\$OUT\" | grep -q 'EFFECTIVE (project)'"
+want "doctor(project-stale): flags legacy managed path (not adopted)" "printf '%s' \"\$OUT\" | grep -q 'LEGACY managed repo path'"
+
+# H-3: state-owned DRIFT → FAIL (state says managed but effective is foreign)
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"/foreign/thing"}}}}\n' > "$GLOBAL"
+printf '{}\n' > "$PROJECT"
+python3 -c 'import json,sys; json.dump({"schemaVersion":1,"managedSettingsPath":sys.argv[1],"scope":"user","ownership":"managed-legacy","command":"entwurf-bridge","preimage":None}, open(sys.argv[2],"w"))' "$GLOBAL" "$STATE"
+if doctor >/dev/null 2>&1; then die "doctor(drift): should FAIL (state owns but effective drifted)"; fi
+ok "doctor(drift): FAILS on state-owned + effective-drifted"
+rm -f "$STATE"
+
+# H-4: bare-but-dangling (bin not on PATH) → FAIL
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+printf '{}\n' > "$PROJECT"
+mv "$SB/bin/entwurf-bridge" "$SB/bin/entwurf-bridge.hidden"
+if doctor >/dev/null 2>&1; then die "doctor(dangling): should FAIL (bare bin not resolvable)"; fi
+ok "doctor(dangling): FAILS when the bare bin does not resolve"
+mv "$SB/bin/entwurf-bridge.hidden" "$SB/bin/entwurf-bridge"
+
+# H-5: malformed settings → FAIL (SSOT read throws)
+printf 'not json{{{' > "$GLOBAL"; printf '{}\n' > "$PROJECT"
+if doctor >/dev/null 2>&1; then die "doctor(malformed): should FAIL"; fi
+ok "doctor(malformed): FAILS on malformed settings (SSOT read throws)"
+
+# H-6: none configured → honest '?' note, exits 0
+printf '{}\n' > "$GLOBAL"; printf '{}\n' > "$PROJECT"
+OUT="$(doctor)"; RC=$?
+want "doctor(none): exits 0" "[ '$RC' -eq 0 ]"
+want "doctor(none): honest never-installed '?' note" "printf '%s' \"\$OUT\" | grep -q 'never installed'"
+
+# ── I: symlink target → install REFUSES ───────────────────────────────────────
+printf '{}\n' > "$SB/real.json"; rm -f "$GLOBAL"; ln -s "$SB/real.json" "$GLOBAL"
+if reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null 2>&1; then die "symlink: install should REFUSE"; fi
+ok "symlink: install refused (someone else's SSOT)"
+rm -f "$GLOBAL"
+
+# ── checkout purity ───────────────────────────────────────────────────────────
+REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
+want "purity: checkout unchanged (all writes stayed in the sandbox HOME+XDG)" \
+  "[ \"\$REPO_BEFORE\" = \"\$REPO_AFTER\" ]"
+
+printf '\nsmoke-pi-provider-state: %d checks passed\n' "$pass"