@junghanacs/entwurf 0.12.5 → 0.12.7

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -50,8 +50,11 @@ import { receiverMarkerMatchesIdentity } from "../../../pi-extensions/lib/entwur
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.js";
 import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.js";
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.js";
+import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.js";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, parentPid, readMetaIdentityByGardenId, readMetaInbox, readMetaReceiverMarker, readMetaSenderMarker, } from "../../../pi-extensions/lib/meta-session.js";
+import { probeNativeSenderAlive, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
+import { defaultMetaMailboxDir, defaultMetaSessionsDir, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
+import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
 const HOME = os.homedir();
 const DEFAULT_ENTWURF_DIR = path.join(HOME, ".pi", "entwurf-control");
 const ENTWURF_DIR = process.env.ENTWURF_DIR ?? DEFAULT_ENTWURF_DIR;
@@ -115,23 +118,6 @@ class EntwurfSenderIdentityError extends Error {
             "garden-id is registered, then retry.");
     }
 }
-// Resolve the meta-sender marker for THIS MCP process. ENTWURF_META_SENDER_MARKER is an
-// explicit override (test / wiring). Otherwise try the shared ancestor: process.ppid
-// first, then one step up (Claude may run the hook through a shell wrapper, shifting
-// the shared ancestor). readMetaSenderMarker's pid+start-key guard rejects a
-// dead/reused owner, so a wrong marker is never trusted on any candidate.
-function resolveMetaSenderMarker() {
-    const explicit = process.env.ENTWURF_META_SENDER_MARKER?.trim();
-    if (explicit)
-        return readMetaSenderMarker({ markerPath: explicit });
-    const candidates = [process.ppid, parentPid(process.ppid)].filter((p) => typeof p === "number" && p > 0);
-    for (const ownerPid of candidates) {
-        const marker = readMetaSenderMarker({ backend: "claude-code", ownerPid });
-        if (marker)
-            return marker;
-    }
-    return null;
-}
 function buildStrictPiSenderEnvelope() {
     const sessionId = process.env.PI_SESSION_ID?.trim();
     const agentId = process.env.PI_AGENT_ID?.trim();
@@ -164,49 +150,49 @@ function buildStrictPiSenderEnvelope() {
         replyable: self.replyable,
     };
 }
-function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
-    // No pi-session identity. Try the meta-sender marker: a native backend that
-    // minted a garden-id via its SessionStart hook. The marker is keyed by the
-    // shared parent pid — this MCP child's process.ppid IS the Claude Code process
-    // the hook ran under (NOT cwd inference). ENTWURF_META_SENDER_MARKER overrides the
-    // lookup for explicit wiring / tests. A trusted marker promotes this process to
-    // a REPLYABLE meta-session sender addressed by its garden-id.
-    const marker = resolveMetaSenderMarker();
-    if (!marker)
-        return null;
-    // Validate the marker against its backing meta-record: a stale marker (record
-    // deleted, or backend/nativeSessionId drift) must NOT grant a replyable
-    // identity. The record store is the authority; the marker is only a pid→garden
-    // hint.
-    let identity = null;
-    try {
-        // dual-read (3D-4 commit1): identity-only check (backend/nativeSessionId), so
-        // it survives the v2 cut. Reads both v1 and v2 records.
-        const id = readMetaIdentityByGardenId(marker.gardenId);
-        if (id.backend === marker.backend && id.nativeSessionId === marker.nativeSessionId)
-            identity = id;
-    }
-    catch {
-        identity = null;
-    }
-    if (!identity)
-        return null;
-    // SE-2 slice 2e-b: identity is trusted, but `replyable` is a SEPARATE fact — can THIS
-    // session's own receiver inbox actually wake? Read the receiver presence marker (slice
-    // 2b) and require it to match the identity (the same SSOT helper the mailbox guard uses).
-    // recordBacked is true here by construction; ownerAlive+watchArmed BOTH come from the
-    // matched receiver marker (readMetaReceiverMarker's verifyOwner folds a dead/reused owner
-    // to null, so a match means a live, armed receiver — the sender marker only proves
-    // identity, not an armed watch). Inactive → the meta identity is STILL returned (who-sent
-    // must survive; degrading to null would erase the sender) but with replyable:false.
-    const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
-    const active = receiverMarkerMatchesIdentity(receiver, identity);
-    const self = computeSelfAddressability({
-        origin: "meta-session",
-        recordBacked: true,
-        ownerAlive: active,
-        watchArmed: active,
+async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
+    // No pi-session identity. Try the meta-sender marker: a native backend that minted a
+    // garden-id from its own hook (Claude SessionStart / agy PreInvocation). The marker is
+    // keyed by the shared parent pid — this MCP child's process.ppid IS the native host the
+    // hook ran under (NOT cwd inference). A trusted marker promotes this process from
+    // anonymous external-mcp to a meta-session sender addressed by its garden-id.
+    const trusted = resolveTrustedMetaSenderIdentity({
+        markerPath: process.env.ENTWURF_META_SENDER_MARKER?.trim() || undefined,
     });
+    if (!trusted)
+        return null;
+    const { marker, identity } = trusted;
+    // Identity is trusted — but `replyable` is a SEPARATE fact, and WHICH fact depends on the
+    // rail a reply would ride (보정①). The domain comes from nativePushSupported(backend), not
+    // from wakeMode: `direct-inject` also covers codex/pi, which have no native-push adapter.
+    //   self-fetch (claude-code): can this citizen's own inbox wake? → the receiver presence
+    //     marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match means a
+    //     live, ARMED receiver — the sender marker proves identity, never an armed watch).
+    //   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
+    //     live app-server conversation, so only an adapter probe can answer. Composing the
+    //     receiver atom here would demand `watchArmed` from a backend that never arms one, and
+    //     every agy citizen would report replyable:false forever.
+    // Either way an inactive/unreachable citizen STILL returns its identity (who-sent must
+    // survive; degrading to null would erase the sender) — only with replyable:false.
+    const facts = nativePushSupported(identity.backend)
+        ? {
+            origin: "meta-session",
+            metaDeliveryDomain: "native-push",
+            recordBacked: true,
+            probeAlive: await probeNativeSenderAlive(identity),
+        }
+        : (() => {
+            const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
+            const active = receiverMarkerMatchesIdentity(receiver, identity);
+            return {
+                origin: "meta-session",
+                metaDeliveryDomain: "self-fetch",
+                recordBacked: true,
+                ownerAlive: active,
+                watchArmed: active,
+            };
+        })();
+    const self = computeSelfAddressability(facts);
     return {
         sessionId: identity.gardenId,
         agentId: `meta-session/${identity.backend}`,
@@ -216,13 +202,15 @@ function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         replyable: self.replyable,
     };
 }
-function buildAuthoritativeSelfEnvelope() {
+// async only for the native-push branch's adapter probe: a pi sender and a claude-code
+// sender still resolve from files alone, so their cost is unchanged.
+async function buildAuthoritativeSelfEnvelope() {
     const sessionId = process.env.PI_SESSION_ID?.trim();
     const agentId = process.env.PI_AGENT_ID?.trim();
     const cwd = process.cwd();
     if (sessionId && agentId && cwd)
         return buildStrictPiSenderEnvelope();
-    const meta = buildTrustedMetaSenderEnvelope(cwd);
+    const meta = await buildTrustedMetaSenderEnvelope(cwd);
     if (meta)
         return meta;
     const missing = [];
@@ -234,13 +222,13 @@ function buildAuthoritativeSelfEnvelope() {
         missing.push("cwd");
     throw new EntwurfEnvelopeWiringError(missing);
 }
-function buildSendSenderEnvelope() {
+async function buildSendSenderEnvelope() {
     const sessionId = process.env.PI_SESSION_ID?.trim();
     const agentId = process.env.PI_AGENT_ID?.trim();
     const cwd = process.cwd();
     if (sessionId && agentId && cwd)
         return buildStrictPiSenderEnvelope();
-    const meta = buildTrustedMetaSenderEnvelope(cwd);
+    const meta = await buildTrustedMetaSenderEnvelope(cwd);
     if (meta)
         return meta;
     // No marker. Anonymous external is allowed ONLY when not explicitly forbidden.
@@ -326,7 +314,7 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids. When you h
     try {
         // Resolved ONCE so the dispatch-moment timestamp is fixed and the control RPC sender
         // + the mailbox body sender share one envelope. No replyability gate (see above).
-        const sender = buildSendSenderEnvelope();
+        const sender = await buildSendSenderEnvelope();
         const rendered = await runAndRenderEntwurfV2FromSurface({ target, intent, message, mode, wants_reply }, 
         // agentDir / prefixRoots intentionally omitted: runAndRenderEntwurfV2FromSurface falls
         // back to the ENTWURF_PREFIX_ROOTS env SSOT for prefixRoots (5d-4); agentDir stays undefined.
@@ -344,7 +332,7 @@ server.tool("entwurf_self", "Return this caller's authoritative identity envelop
     "(trusted SessionStart sender marker → garden id). Throws for plain anonymous external " +
     "MCP hosts because they have no authoritative reply address.", {}, async () => {
     try {
-        const sender = buildAuthoritativeSelfEnvelope();
+        const sender = await buildAuthoritativeSelfEnvelope();
         const kst = formatKstTimestamp(sender.timestamp);
         const extra = {};
         const lines = [
@@ -441,6 +429,42 @@ server.tool("entwurf_inbox_read", "Read (drain) your own meta-bridge inbox and s
         return textErr(`entwurf_inbox_read error: ${err instanceof Error ? err.message : String(err)}`);
     }
 });
+server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conversation as a garden citizen — it does NOT spawn " +
+    "a new one (that is a separate, deferred capability; do not use this to create a sibling). " +
+    "Give the backend + its native conversation id + the cwd, and this binds them to a garden id " +
+    "so entwurf_v2 can reach the conversation (fire-and-forget → native-push). The conversation " +
+    "must be LIVE: it is probed first, and a dead/indeterminate probe is refused (no garden id is " +
+    "minted for a pointer that does not resolve to a real host). Re-registering the same " +
+    "conversation attaches to the SAME garden id and refreshes the cwd. Only 'antigravity' is " +
+    "registerable on this lane. No mailbox receiver marker is written — native-push has no " +
+    "idle-wake watch; the returned garden id is the reply handle.", {
+    backend: z
+        .enum(["antigravity"])
+        .describe("The native backend hosting the conversation. Only 'antigravity' — codex is a separate lane."),
+    nativeSessionId: z
+        .string()
+        .min(1)
+        .describe("The backend's native conversation id (antigravity conversationId) to bind to a garden id."),
+    cwd: z
+        .string()
+        .min(1)
+        .describe("The working directory to record for this citizen — REQUIRED (a native conversation's metadata cannot confirm it, so you must state it)."),
+}, async ({ backend, nativeSessionId, cwd }) => {
+    try {
+        const result = await registerNativeConversation({ backend, nativeSessionId, cwd });
+        return textOk(`[entwurf register native ⟶]\n` +
+            `  backend:      ${result.backend}\n` +
+            `  conversation: ${result.nativeSessionId}\n` +
+            `  action:       ${result.action}\n` +
+            `  gardenId:     ${result.gardenId}\n` +
+            `  cwd:          ${result.cwd}\n\n` +
+            `Reach it with entwurf_v2 (target=${result.gardenId}, intent=fire-and-forget). No receiver ` +
+            `marker was written (native-push has no idle-wake mailbox watch).`);
+    }
+    catch (err) {
+        return textErr(`entwurf_register_native error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+});
 // ============================================================================
 // Main
 // ============================================================================

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/acp-client.js

@@ -0,0 +1,54 @@
+// ACP client adapter — the ONE place that touches the @agentclientprotocol/sdk
+// 1.1 fluent surface (`client({ name }).connect(stream)`).
+//
+// The wire SDK deprecated the `new ClientSideConnection(toClient, stream)`
+// constructor in favour of the fluent `client()` builder. The two have
+// different shapes: the deprecated class implemented `Agent` directly (so
+// `.initialize()`/`.newSession()`/`.prompt()` were methods on the returned
+// object), while `client(...).connect(stream)` returns a persistent
+// `ClientConnection` whose `.agent` is a `ClientContext` driven by
+// `request(<method>, params)`.
+//
+// `connect()` (NOT `connectWith()`) is the right primitive here: the backend
+// retains the connection on a BridgeSession and reuses it across turns
+// (backend.ts), so the op-scoped close semantics of `connectWith` do not fit.
+//
+// This module owns the `AcpConnectionLike` seam so the backend and the live
+// smokes both drive ONE adapter — the SDK method-name mapping lives here only,
+// and the backend's orchestration + the gate fakes stay untouched.
+import { AGENT_METHODS, CLIENT_METHODS, client } from "@agentclientprotocol/sdk";
+/**
+ * Production factory — wrap the SDK 1.1 fluent `client()` into the
+ * `AcpConnectionLike` seam the backend (and the live smokes) drive.
+ *
+ * Client-side handlers register by ACP method name; agent-side calls go through
+ * the persistent connection's `ClientContext` (`conn.agent`). Both the params a
+ * handler receives (`ctx.params`) and the throw-to-JSON-RPC-error behaviour
+ * match the deprecated `ClientSideConnection`, so this is behaviour-preserving.
+ */
+export function connectAcpClient(stream, handlers) {
+    const conn = client({ name: "entwurf" })
+        .onNotification(CLIENT_METHODS.session_update, (ctx) => handlers.sessionUpdate(ctx.params))
+        .onRequest(CLIENT_METHODS.session_request_permission, (ctx) => handlers.requestPermission(ctx.params))
+        .onRequest(CLIENT_METHODS.fs_read_text_file, (ctx) => handlers.readTextFile(ctx.params))
+        .onRequest(CLIENT_METHODS.fs_write_text_file, (ctx) => handlers.writeTextFile(ctx.params))
+        .connect(stream);
+    const agent = conn.agent;
+    return {
+        initialize: (params) => agent.request(AGENT_METHODS.initialize, params),
+        newSession: (params) => agent.request(AGENT_METHODS.session_new, params),
+        prompt: (params) => agent.request(AGENT_METHODS.session_prompt, params),
+        setSessionConfigOption: (params) => agent.request(AGENT_METHODS.session_set_config_option, params),
+        close: (error) => {
+            // Best-effort by contract (see AcpConnectionLike.close): a teardown-path
+            // close that threw would mask the turn's real error and skip the child
+            // teardown that runs after it.
+            try {
+                conn.close(error);
+            }
+            catch {
+                // connection already closed / SDK teardown race — nothing to recover.
+            }
+        },
+    };
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -0,0 +1,153 @@
+// ACP backend adapter rail — the PRODUCT seam by which a curated model id selects
+// which ACP backend (claude / future backend / …) drives a turn. See docs/acp-backend-rail.md §9.
+//
+// This seam is DISTINCT from `AcpTurnDeps` (backend.ts), which is the test/runtime
+// seam (fake spawn/connection/clock for the gates). The two are kept apart on
+// purpose (GPT-agreed §9-2): merging them would make a fake-deps fixture look like
+// a fake backend and force the adapter to carry clock/sessionDir/createConnection.
+// The wiring is `defaultDeps(adapter)` — the turn loop in backend.ts stays
+// backend-invariant; only these per-backend functions change with `adapter`.
+//
+// STATUS: Step A+B done — backend.ts is wired to this rail. The turn loop in
+// backend.ts delegates every per-backend step through the resolved adapter
+// (resolveLaunch/ensureOverlay/loadCarrier/buildSessionMeta/enforceModel/
+// launchEnvDefaults); there is no private resolveLaunch copy in backend.ts.
+// `resolveClaudeLaunch` below is the single source for the claude launch spec.
+//
+// Fence: imported by the root program with `.js` suffixes, same as the sibling
+// lib/acp modules — no new strip-types fence.
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { loadEngraving } from "./engraving.js";
+import { curatedClaudeModels, SUPPORTED_ANTHROPIC_MODEL_IDS } from "./models.js";
+import { claudeLaunchEnvDefaults, ensureClaudeConfigOverlay } from "./overlay.js";
+import { buildClaudeSessionMeta } from "./tool-surface.js";
+// ---------------------------------------------------------------------------
+// claude adapter — the first implementation (the rail's reference backend)
+// ---------------------------------------------------------------------------
+const SUPPORTED_CLAUDE_IDS = new Set(SUPPORTED_ANTHROPIC_MODEL_IDS);
+/** Resolve the claude-agent-acp launch — package bin (resolve), env override for debug.
+ *  This is the single source for the claude launch spec; backend.ts holds no private copy. */
+function resolveClaudeLaunch() {
+    const override = process.env.CLAUDE_AGENT_ACP_COMMAND?.trim();
+    if (override)
+        return { command: "bash", args: ["-lc", override] };
+    const require = createRequire(import.meta.url);
+    const pkgJsonPath = require.resolve("@agentclientprotocol/claude-agent-acp/package.json");
+    const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+    const binPath = typeof pkgJson.bin === "string" ? pkgJson.bin : pkgJson.bin?.["claude-agent-acp"];
+    if (!binPath)
+        throw new Error("@agentclientprotocol/claude-agent-acp resolved but exposes no bin entry");
+    return { command: process.execPath, args: [join(dirname(pkgJsonPath), binPath)] };
+}
+export const claudeAdapter = {
+    backend: "claude",
+    // Claude owns its UNPREFIXED curated ids only (GPT-agreed §9-1). The native id
+    // equals the curated id — claude carries no curation prefix to strip.
+    routeModel(modelId) {
+        return SUPPORTED_CLAUDE_IDS.has(modelId) ? { nativeModelId: modelId } : undefined;
+    },
+    curatedModels() {
+        return curatedClaudeModels();
+    },
+    // Claude carries no backend-specific settings — its entire surface is common
+    // config (tools/permissions/settingSources/…). undefined → config.adapterSettings
+    // is undefined and no claude method reads it.
+    resolveAdapterSettings() {
+        return undefined;
+    },
+    resolveLaunch() {
+        return resolveClaudeLaunch();
+    },
+    launchEnvDefaults() {
+        return claudeLaunchEnvDefaults();
+    },
+    ensureOverlay() {
+        // Claude's overlay is constant (no settings dependence), so it ignores params.
+        ensureClaudeConfigOverlay();
+        // CLAUDE_CONFIG_DIR rides launchEnvDefaults(); the overlay materialization
+        // itself contributes no extra spawn env.
+        return { envOverrides: {} };
+    },
+    loadCarrier({ mcpServerNames }) {
+        // Claude's carrier is the shipped engraving — it does not read config.
+        return loadEngraving({ backend: "claude", mcpServerNames });
+    },
+    buildSessionMeta({ nativeModelId, config }, carrier) {
+        // buildClaudeSessionMeta always returns an object (it only omits the
+        // systemPrompt KEY when carrier is absent), so claude never yields undefined.
+        return buildClaudeSessionMeta({
+            modelId: nativeModelId,
+            tools: config.tools,
+            permissionAllow: config.permissionAllow,
+            disallowedTools: config.disallowedTools,
+            settingSources: config.settingSources,
+            strictMcpConfig: config.strictMcpConfig,
+            skillPlugins: config.skillPlugins,
+        }, carrier ?? undefined);
+    },
+    async enforceModel({ connection, acpSessionId, nativeModelId, modelId }) {
+        const setConfig = connection.setSessionConfigOption;
+        if (typeof setConfig !== "function") {
+            throw new Error(`setSessionConfigOption unsupported — cannot enforce model ${modelId}`);
+        }
+        await setConfig.call(connection, { sessionId: acpSessionId, configId: "model", value: nativeModelId });
+    },
+    configSignatureFields(_adapterSettings) {
+        // Claude folds no extra backend-specific fields beyond backend + nativeModelId
+        // (which backend.ts adds). A future backend reads its own stable id off
+        // `_adapterSettings` here.
+        return {};
+    },
+};
+// ---------------------------------------------------------------------------
+// Registry — modelId → adapter
+// ---------------------------------------------------------------------------
+/** Registered adapters. Order carries NO routing authority — routeModel decides.
+ *  Step A: claude only. A second backend appends here with its reserved prefix
+ *  (e.g. `<backend>-*`), and the fail-fast below proves no two adapters claim one id. */
+const ADAPTERS = [claudeAdapter];
+/**
+ * Resolve the backend adapter that owns `modelId`.
+ *
+ * GPT-agreed §9-1 fail-fast contract:
+ *  - 0 matches  → throw (unknown model — no silent default).
+ *  - 2+ matches → throw (prefix collision — a startup-visible registry bug).
+ *
+ * The thrown native id is recovered from the single matching adapter's routeModel,
+ * so callers get `{ adapter, nativeModelId }` and never re-parse the id string.
+ */
+export function resolveAcpBackendAdapter(modelId) {
+    const matches = [];
+    for (const adapter of ADAPTERS) {
+        const routed = adapter.routeModel(modelId);
+        if (routed)
+            matches.push({ adapter, nativeModelId: routed.nativeModelId });
+    }
+    if (matches.length === 0) {
+        throw new Error(`entwurf: no ACP backend adapter owns model id ${JSON.stringify(modelId)}`);
+    }
+    if (matches.length > 1) {
+        const owners = matches.map((m) => m.adapter.backend).join(", ");
+        throw new Error(`entwurf: model id ${JSON.stringify(modelId)} is claimed by multiple adapters (${owners})`);
+    }
+    return matches[0];
+}
+/** Every curated model row across all registered adapters — for provider registration.
+ *  GPT-agreed §9-6 registration-time fail-fast: every curated id must route to EXACTLY
+ *  one adapter and no id may be duplicated across adapters. Catching it here means a
+ *  prefix-collision / duplicate surfaces at provider registration, not mid-turn. */
+export function allCuratedModels() {
+    const rows = ADAPTERS.flatMap((adapter) => adapter.curatedModels());
+    const seen = new Set();
+    for (const row of rows) {
+        if (seen.has(row.id)) {
+            throw new Error(`entwurf: duplicate curated model id across ACP backend adapters: ${row.id}`);
+        }
+        seen.add(row.id);
+        // Throws on 0 matches (unowned) or 2+ matches (prefix collision).
+        resolveAcpBackendAdapter(row.id);
+    }
+    return rows;
+}