@junghanacs/entwurf 0.12.6 → 0.12.7

package/pi-extensions/lib/meta-sender-identity.ts

@@ -0,0 +1,154 @@
+/**
+ * meta-sender-identity — WHO is calling this MCP child?
+ *
+ * A native backend (Claude Code, agy) spawns the entwurf-bridge MCP server as a child of the
+ * same process that runs its session hook. The hook writes a sender marker keyed by ITS parent
+ * pid; the child looks a marker up under its own parent. That shared ancestor is the join key —
+ * NOT cwd (one repo can hold many sessions) and not a wire field (neither host carries one).
+ *
+ * Measured 2026-07-13 on both backends: hook.ppid == bridge.ppid == the native host pid, same
+ * start-key. The extra `parentPid(ppid)` candidate covers a host that runs its hook through a
+ * shell wrapper, which shifts the shared ancestor one step up.
+ *
+ * Two guards make a marker an IDENTITY rather than a hint, and a candidate is only trusted after
+ * BOTH pass:
+ *   1. pid + start-key (readMetaSenderMarker): the owner is still the very process that wrote it,
+ *      so a dead session's pid, reused by something else, cannot inherit its garden-id.
+ *   2. the backing meta-record: the record store is the authority — a marker whose record was
+ *      deleted, or whose backend/nativeSessionId drifted from it, names nobody.
+ *
+ * Every candidate is collected and validated BEFORE one is chosen. A first-match loop would make
+ * the answer depend on which pid or backend happened to be read first; here lookup order carries
+ * no meaning, and two live identities are a refusal rather than a race.
+ */
+
+import {
+	type MetaBackend,
+	type MetaIdentity,
+	type MetaSenderMarker,
+	parentPid,
+	readMetaIdentityByGardenId,
+	readMetaSenderMarker,
+} from "./meta-session.ts";
+import { type NativePushAdapter, resolveNativePushAdapter } from "./native-push/adapter.ts";
+
+/** Every native backend that mints a garden-id from its own hook and writes a sender marker. */
+export const META_SENDER_BACKENDS: readonly MetaBackend[] = ["claude-code", "antigravity"];
+
+/** A marker that passed BOTH guards, together with the record that vouches for it. */
+export interface TrustedMetaSender {
+	marker: MetaSenderMarker;
+	identity: MetaIdentity;
+}
+
+/**
+ * Two live native sessions claim this MCP process as their own. We can SEE both identities but
+ * cannot say which one is calling, so we send under neither. Choosing by lookup order, backend
+ * priority, or recency would attribute a message to a citizen that did not write it; falling back
+ * to anonymous would hide an identity we already hold. Both are the SE-1 shape — a layer answering
+ * "yes" where the truth is unknown — so this is a hard refusal, not a warning.
+ *
+ * WHAT THIS CAN AND CANNOT SEE. It fires only when the candidate pids yield MORE THAN ONE marker
+ * FILE naming different citizens — two backends on one pid, or the two candidate pids naming
+ * different citizens. It CANNOT see two conversations of the same backend racing under one host
+ * pid: they share the single marker path `<senders>/<backend>/<pid>.json`, so the later hook write
+ * overwrites the earlier one and only one identity is ever on disk. That case is guarded by a
+ * runtime invariant instead (a native host serializes its model invocations), not by this error —
+ * do not read a green resolver as proof that same-process concurrency is safe.
+ */
+export class EntwurfSenderIdentityAmbiguityError extends Error {
+	readonly gardenIds: string[];
+	constructor(gardenIds: string[]) {
+		super(
+			"entwurf-bridge refused: ambiguous sender identity. This MCP process's owner pid carries live, " +
+				`record-backed sender markers for MORE than one garden citizen (${gardenIds.join(", ")}), so which ` +
+				"one is calling cannot be determined. A send under the wrong identity is worse than no send — one " +
+				"native host process appears to be driving several sessions at once. Report it; do not work around it.",
+		);
+		this.name = "EntwurfSenderIdentityAmbiguityError";
+		this.gardenIds = gardenIds;
+	}
+}
+
+/** The record store is the authority; the marker is only a pid→garden hint it must agree with. */
+function trustMarker(marker: MetaSenderMarker): TrustedMetaSender | null {
+	try {
+		// dual-read (3D-4 commit1): identity-only check, so it survives the v2 cut.
+		const identity = readMetaIdentityByGardenId(marker.gardenId);
+		if (identity.backend !== marker.backend || identity.nativeSessionId !== marker.nativeSessionId) return null;
+		return { marker, identity };
+	} catch {
+		return null;
+	}
+}
+
+export interface ResolveTrustedMetaSenderOptions {
+	/** Explicit marker file (explicit wiring / gates). Wins over the pid scan, same validation. */
+	markerPath?: string;
+	/** Candidate owner pids. Defaults to this process's parent and one step above it. */
+	ownerPids?: number[];
+	/** Marker root (gates isolate it; production reads the ENTWURF_META_SENDERS_DIR SSOT). */
+	sendersDir?: string;
+}
+
+/**
+ * Resolve the ONE identity that owns this MCP process, or refuse.
+ *
+ * 0 trusted → null (anonymous — or a hard refusal upstream under REQUIRE_META_SENDER).
+ * 1 trusted → that identity.
+ * 2+ distinct → throw EntwurfSenderIdentityAmbiguityError.
+ *
+ * Markers that agree on the SAME garden-id are not a conflict: an older release wrote a marker for
+ * the parent AND the grandparent, and both can still sit on disk pointing at one citizen.
+ */
+export function resolveTrustedMetaSenderIdentity(opts: ResolveTrustedMetaSenderOptions = {}): TrustedMetaSender | null {
+	const markers: MetaSenderMarker[] = [];
+	if (opts.markerPath) {
+		const marker = readMetaSenderMarker({ markerPath: opts.markerPath });
+		if (marker) markers.push(marker);
+	} else {
+		const ownerPids = (opts.ownerPids ?? [process.ppid, parentPid(process.ppid) ?? 0]).filter(
+			(p): p is number => typeof p === "number" && p > 0,
+		);
+		for (const ownerPid of [...new Set(ownerPids)]) {
+			for (const backend of META_SENDER_BACKENDS) {
+				const marker = readMetaSenderMarker({ backend, ownerPid, sendersDir: opts.sendersDir });
+				if (marker) markers.push(marker);
+			}
+		}
+	}
+
+	const byGardenId = new Map<string, TrustedMetaSender>();
+	for (const marker of markers) {
+		const trusted = trustMarker(marker);
+		if (trusted) byGardenId.set(trusted.identity.gardenId, trusted);
+	}
+
+	const distinct = [...byGardenId.values()];
+	if (distinct.length === 0) return null;
+	if (distinct.length > 1) throw new EntwurfSenderIdentityAmbiguityError(distinct.map((t) => t.identity.gardenId));
+	return distinct[0];
+}
+
+/**
+ * Can a reply to THIS native-push citizen actually land? Only an adapter probe can say: a reply is
+ * a direct injection into a live app-server conversation, and the route is re-discovered on every
+ * probe. This is the `replyable` fact for a native-push sender — it must never be inferred from the
+ * mailbox axis, which such a backend has no part in (보정①).
+ *
+ * ERROR POLICY (deliberate, and the reason this is not a `try { … } catch { return false }`): the
+ * adapter already expresses every OPERATIONAL outcome as a value — `dead` (no host) and
+ * `indeterminate` (host up, no port served it). So a THROW out of here is never a fact about the
+ * citizen; it is a defect — an unresolvable adapter for a backend we just confirmed is native-push
+ * (a registry bug), or a probe runner that could not run at all (a wiring bug). Folding those into
+ * `replyable:false` would tell the receiver a lie about this sender AND bury the defect, which is
+ * exactly the Crash-Don't-Warn shape this lane exists to remove. Let them propagate.
+ */
+export async function probeNativeSenderAlive(
+	identity: Pick<MetaIdentity, "backend" | "nativeSessionId">,
+	deps: { resolveAdapter?: (id: string) => Pick<NativePushAdapter, "probe"> } = {},
+): Promise<boolean> {
+	const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
+	const probe = await resolveAdapter(identity.backend).probe(identity.nativeSessionId);
+	return probe.status === "alive";
+}

package/pi-extensions/lib/native-push/adapter.ts

@@ -0,0 +1,255 @@
+/**
+ * native-push adapter rail — the transport LEAF by which a native-push backend
+ * (antigravity, the first) is (1) probed for a LIVE conversation and (2) direct-injected
+ * with a message. Mirrors the ACP backend-adapter rail (acp/backend-adapter.ts §ADAPTERS
+ * /resolveAcpBackendAdapter): one interface, one registry, a fail-fast resolver.
+ *
+ * Purity contract (봉인 3):
+ *  - LEAF: this file imports NO entwurf-core / no decider / no meta-session — only node
+ *    builtins + type-only contract types. So the pi-free MCP bridge (entwurf_register_native)
+ *    can reach it at boot without re-coupling to pi, and the decider stays pure.
+ *  - injectable runner: every process call goes through the injected `NativePushRunner`,
+ *    so `check-native-push-adapter` drives probe/send with a fake — no real agy needed.
+ *  - VOLATILE route: a probe's `route` (the live LS address serving the conversation) is
+ *    NEVER stored — every probe re-scans and re-discovers it (the LS port is per-process
+ *    and shifts). `check-native-push-adapter` asserts a repeated probe re-runs the scan.
+ *  - NO retry HERE: `send` is a single attempt that throws on failure. The 1-shot
+ *    re-probe→re-send on failure is the EXECUTOR hand's job (step ⑥ — decider purity /
+ *    control-socket send-fallback mirror), NOT the adapter's.
+ *
+ * The probe corrects raw-agy-send.sh:16's `pgrep -x agy | head -1` single-pid assumption:
+ * it scans EVERY host pid, since the conversation may be served by any live host process.
+ */
+
+import { execFile } from "node:child_process";
+import * as os from "node:os";
+import * as path from "node:path";
+
+import type { NativePushBackend } from "../entwurf-v2-contract.ts";
+
+// ── runner seam (injectable process exec) ───────────────────────────────────
+
+export interface NativePushExecResult {
+	/** Exit code (0 = success). A spawn error (command not found) surfaces as 127. */
+	code: number;
+	stdout: string;
+	stderr: string;
+}
+
+export interface NativePushRunner {
+	/**
+	 * Run `argv[0]` with `argv[1..]`, optionally with an env overlay merged over
+	 * process.env and a `timeoutMs` bound. Resolves with the exit code + captured output; it
+	 * NEVER rejects on a non-zero exit — a non-zero code is DATA the adapter interprets (e.g.
+	 * "no live agy"), not an exception. A genuine spawn failure resolves with code 127; a
+	 * timeout kill resolves with code 124 (the `timeout(1)` convention), so a stalled LS
+	 * route / hung `agy agentapi` call can NEVER wedge an entwurf_v2 dispatch (Q12).
+	 */
+	exec(
+		argv: readonly string[],
+		opts?: { env?: Record<string, string>; timeoutMs?: number },
+	): Promise<NativePushExecResult>;
+}
+
+// The agy agentapi calls are bounded so a dead/stalled LS route cannot hang a dispatch
+// (raw-agy-send.sh used `timeout 8` — production had lost that; Q12 restores it). pgrep/ss
+// are fast local scans and stay unbounded.
+export const AGY_METADATA_TIMEOUT_MS = 8000;
+export const AGY_SEND_TIMEOUT_MS = 8000;
+
+/** The production runner — `execFile` (no shell), env overlay, bounded, output captured. */
+export const realNativePushRunner: NativePushRunner = {
+	exec(argv, opts) {
+		return new Promise((resolve) => {
+			const [cmd, ...args] = argv;
+			execFile(
+				cmd ?? "",
+				args,
+				{
+					env: opts?.env ? { ...process.env, ...opts.env } : process.env,
+					maxBuffer: 8 * 1024 * 1024,
+					timeout: opts?.timeoutMs && opts.timeoutMs > 0 ? opts.timeoutMs : 0,
+				},
+				(err, stdout, stderr) => {
+					const e = err as (NodeJS.ErrnoException & { killed?: boolean }) | null;
+					// A timeout kill surfaces as `killed` — map it to 124 (timeout convention) so
+					// probe reads it as "no serve" (→ indeterminate) and send reads it as failure.
+					const code = e == null ? 0 : e.killed ? 124 : typeof e.code === "number" ? (e.code as number) : 127;
+					resolve({ code, stdout: stdout ?? "", stderr: stderr ?? "" });
+				},
+			);
+		});
+	},
+};
+
+// ── route + probe result ────────────────────────────────────────────────────
+
+/**
+ * A VOLATILE native-push route — the live LS address (`127.0.0.1:PORT`) a probe found
+ * serving the conversation. MUST NOT be stored (봉인 3): it is re-derived every dispatch
+ * by a fresh probe (the LS port is per-process and shifts). Carried only within a single
+ * `send` call, handed straight from a fresh `probe`.
+ */
+export interface NativePushRoute {
+	readonly lsAddress: string;
+}
+
+/**
+ * A probe outcome. `alive` carries the volatile route; `dead`/`indeterminate` carry a
+ * human reason. The three `status` values ARE the NativePushLiveness vocabulary, so the
+ * decider maps `status` → dispatch verdict directly (no re-derivation).
+ */
+export type NativePushProbeResult =
+	| { status: "alive"; route: NativePushRoute }
+	| { status: "dead" | "indeterminate"; reason: string };
+
+// ── the adapter interface ────────────────────────────────────────────────────
+
+export interface NativePushAdapter {
+	/** Backend discriminator (a member of NATIVE_PUSH_BACKENDS). */
+	readonly id: NativePushBackend;
+	/**
+	 * Full-scan probe: find a LIVE route serving `nativeSessionId`, else report
+	 * dead/indeterminate. Scans EVERY host pid (never `head -1`) and re-discovers the
+	 * route on every call (no cache — volatile-route discipline, 봉인 3).
+	 */
+	probe(nativeSessionId: string): Promise<NativePushProbeResult>;
+	/**
+	 * Direct-inject `content` into the conversation over `route`. Single attempt: throws
+	 * on failure (fail-loud). Does NOT probe and does NOT retry — the executor hand owns
+	 * re-probe/retry (봉인 3), so the adapter can never silently paper over a dead route.
+	 */
+	send(route: NativePushRoute, nativeSessionId: string, content: string): Promise<void>;
+}
+
+// ── antigravity adapter ──────────────────────────────────────────────────────
+
+export interface AntigravityAdapterDeps {
+	runner: NativePushRunner;
+	/** Resolved agy binary path (argv[0] for agentapi calls). Default: $AGY_BIN or ~/.local/bin/agy. */
+	binary?: string;
+	/** Host process name to scan for (`pgrep -x`). Default "agy". */
+	processName?: string;
+}
+
+/** Resolve the agy binary — $AGY_BIN, else ~/.local/bin/agy (raw-agy-send.sh:14). */
+export function resolveAgyBinary(): string {
+	const env = process.env.AGY_BIN?.trim();
+	if (env) return env;
+	return path.join(os.homedir(), ".local", "bin", "agy");
+}
+
+/** Parse `ss -lntp` output into a pid → [127.0.0.1:PORT, …] map (localhost listeners). */
+function parseSsListeners(ssStdout: string): Map<number, string[]> {
+	const byPid = new Map<number, string[]>();
+	for (const line of ssStdout.split("\n")) {
+		const addr = line.match(/127\.0\.0\.1:([0-9]+)/);
+		if (!addr) continue;
+		// ss -lntp tags the owner as `pid=<n>,`; a line may carry several `pid=` when the
+		// socket is shared, so collect them all.
+		for (const m of line.matchAll(/pid=([0-9]+),/g)) {
+			const pid = Number(m[1]);
+			const list = byPid.get(pid) ?? [];
+			list.push(`127.0.0.1:${addr[1]}`);
+			byPid.set(pid, list);
+		}
+	}
+	return byPid;
+}
+
+export function createAntigravityAdapter(deps: AntigravityAdapterDeps): NativePushAdapter {
+	const { runner } = deps;
+	const binary = deps.binary ?? resolveAgyBinary();
+	const processName = deps.processName ?? "agy";
+
+	async function scanHostPids(): Promise<number[]> {
+		// pgrep -x <name> — ALL matching pids (raw-agy-send.sh:16 `head -1` corrected here).
+		const r = await runner.exec(["pgrep", "-x", processName]);
+		if (r.code !== 0) return []; // pgrep exit != 0 → no matching process
+		return r.stdout
+			.split("\n")
+			.map((s) => s.trim())
+			.filter((s) => /^[0-9]+$/.test(s))
+			.map((s) => Number(s));
+	}
+
+	async function servesConversation(lsAddress: string, conversationId: string): Promise<boolean> {
+		const r = await runner.exec([binary, "agentapi", "get-conversation-metadata", conversationId], {
+			env: { ANTIGRAVITY_LS_ADDRESS: lsAddress },
+			timeoutMs: AGY_METADATA_TIMEOUT_MS,
+		});
+		// A non-zero code — not-found, error, OR a timeout kill (124) — means this port does not
+		// serve the conversation; the scan moves on (a timeout never blocks the whole probe).
+		return r.code === 0 && r.stdout.includes("conversationMetadata");
+	}
+
+	return {
+		id: "antigravity",
+
+		async probe(nativeSessionId) {
+			const pids = await scanHostPids();
+			if (pids.length === 0) {
+				return { status: "dead", reason: `no live ${processName} process (native-push target has no host)` };
+			}
+			// ONE ss scan per probe (re-derived every call — no cross-dispatch cache).
+			const ss = await runner.exec(["ss", "-lntp"]);
+			const portsByPid = ss.code === 0 ? parseSsListeners(ss.stdout) : new Map<number, string[]>();
+			// Scan EVERY pid's ports — the conversation may be served by any live host, so a
+			// head -1 single-pid assumption (raw-agy-send.sh:16) would misroute.
+			for (const pid of pids) {
+				for (const lsAddress of portsByPid.get(pid) ?? []) {
+					if (await servesConversation(lsAddress, nativeSessionId)) {
+						return { status: "alive", route: { lsAddress } };
+					}
+				}
+			}
+			// Host(s) alive but no LS port served this conversation: INDETERMINATE, not dead
+			// (a WAL/loading race or a different host instance). Never coerce absence-of-proof
+			// into `dead` — that would be a hard reject on a maybe-live conversation.
+			return {
+				status: "indeterminate",
+				reason: `${processName} live (${pids.length} pid(s)) but no LS port served conversation ${nativeSessionId}`,
+			};
+		},
+
+		async send(route, nativeSessionId, content) {
+			const r = await runner.exec([binary, "agentapi", "send-message", nativeSessionId, content], {
+				env: { ANTIGRAVITY_LS_ADDRESS: route.lsAddress },
+				timeoutMs: AGY_SEND_TIMEOUT_MS,
+			});
+			// A non-zero code — including a timeout kill (124) on a stalled route — THROWS
+			// (fail-loud); the executor hand owns the 1-shot re-probe→re-send on that throw.
+			if (r.code !== 0) {
+				throw new Error(
+					`native-push send failed (agentapi send-message exit ${r.code}) via ${route.lsAddress}: ${
+						r.stderr.trim() || "(no stderr)"
+					}`,
+				);
+			}
+		},
+	};
+}
+
+/** The production antigravity adapter (real runner + env-resolved binary). */
+export const antigravityAdapter: NativePushAdapter = createAntigravityAdapter({ runner: realNativePushRunner });
+
+// ── registry + fail-fast resolver (mirror resolveAcpBackendAdapter) ──────────
+
+const ADAPTERS: readonly NativePushAdapter[] = [antigravityAdapter];
+
+/**
+ * Resolve the native-push adapter that owns backend `id`. Fail-fast, like
+ * resolveAcpBackendAdapter: 0 matches → throw (unknown backend, no silent default);
+ * 2+ matches → throw (a startup-visible registry bug). A second native-push backend
+ * appends to ADAPTERS with its own id and this proves no two adapters claim one id.
+ */
+export function resolveNativePushAdapter(id: string): NativePushAdapter {
+	const matches = ADAPTERS.filter((a) => a.id === id);
+	if (matches.length === 0) {
+		throw new Error(`entwurf: no native-push adapter owns backend id ${JSON.stringify(id)}`);
+	}
+	if (matches.length > 1) {
+		throw new Error(`entwurf: backend id ${JSON.stringify(id)} is claimed by multiple native-push adapters`);
+	}
+	return matches[0];
+}

package/pi-extensions/lib/native-push/register.ts

@@ -0,0 +1,99 @@
+/**
+ * native-push/register — the pure-ish core of the `entwurf_register_native` MCP tool
+ * (봉인 5). It REGISTERS an already-running native conversation (antigravity) as a garden
+ * citizen; it does NOT spawn one (that is the deferred v2 fresh-mint capability — kept
+ * distinct so a caller never confuses "bind an existing conversation" with "create a new
+ * sibling").
+ *
+ * Flow (봉인 5):
+ *   1. Resolve the native-push adapter for the backend and PROBE the conversation. Only a
+ *      LIVE, verifiable conversation may be registered — a dead/indeterminate probe throws,
+ *      so we never engrave a garden id onto a pointer that does not resolve to a real host.
+ *   2. Reuse `upsertMetaSession` (scan-by-nativeId → create/attach). Re-registration attaches
+ *      to the SAME garden id and refreshes the cwd; the meta-record authority rules (duplicate
+ *      nativeSessionId / backend↔wakeMode contradiction) are inherited unchanged.
+ *
+ * Receiver-marker abstinence (보정①): this module NEVER writes a receiver marker. That marker
+ * means "idle-wake mailbox watch armed" and is a MAILBOX-only atom; a native-push citizen has
+ * no mailbox and no watch, so arming one would smuggle native-push liveness into the mailbox
+ * deliverability semantics. `check-native-push-register` asserts this file references no
+ * receiver-marker writer. (A dedicated register-provenance slot is a future concern.)
+ *
+ * LEAF-adjacent + pi-free: imports only the native-push adapter (pi-free) and the meta-session
+ * upsert (pi-free), so the harness-neutral MCP bridge can reach it at boot.
+ */
+
+import type { NativePushBackend } from "../entwurf-v2-contract.ts";
+import { type MetaBackendV2, type UpsertAction, upsertMetaSession } from "../meta-session.ts";
+import { type NativePushAdapter, resolveNativePushAdapter } from "./adapter.ts";
+
+export interface RegisterNativeConversationInput {
+	/** The native backend hosting the conversation. Only antigravity is registerable on this
+	 *  lane (codex is a separate lane). */
+	backend: NativePushBackend;
+	/** The backend's native conversation id (antigravity conversationId). */
+	nativeSessionId: string;
+	/** The cwd to record for this citizen — REQUIRED: a native conversation's metadata cannot
+	 *  confirm it, so the caller must state it (봉인 5). */
+	cwd: string;
+}
+
+export interface RegisterNativeConversationDeps {
+	/** Adapter resolver (default: the real native-push registry). Injected so the gate drives
+	 *  the probe with a fake adapter — no live agy. */
+	resolveAdapter?: (backend: string) => NativePushAdapter;
+	/** Meta-record store dir (default: the real one). Injected so the gate writes to a temp dir. */
+	sessionsDir?: string;
+	now?: Date;
+}
+
+export interface RegisterNativeConversationResult {
+	action: UpsertAction;
+	gardenId: string;
+	backend: string;
+	nativeSessionId: string;
+	cwd: string;
+}
+
+/**
+ * Register (or re-attach) a live native conversation as a garden citizen. Throws if the
+ * conversation is not live (probe status !== "alive") — a non-live conversation cannot become
+ * an addressable citizen. On success returns the garden id + the create/attach action.
+ */
+export async function registerNativeConversation(
+	input: RegisterNativeConversationInput,
+	deps: RegisterNativeConversationDeps = {},
+): Promise<RegisterNativeConversationResult> {
+	const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
+	const adapter = resolveAdapter(input.backend);
+	const probe = await adapter.probe(input.nativeSessionId);
+	if (probe.status !== "alive") {
+		throw new Error(
+			`entwurf_register_native: refusing to register ${input.backend} conversation ${JSON.stringify(
+				input.nativeSessionId,
+			)} — it is not live (${probe.status}: ${probe.reason}). Only a live, verifiable conversation can be ` +
+				`registered as a garden citizen; open/resume it, then retry.`,
+		);
+	}
+	// Reuse the meta-record upsert authority (scan-by-nativeId → create/attach). model /
+	// transcriptPath are null: a native app-server conversation exposes neither to us. cwd is
+	// the caller-stated value (refreshed on attach). NO receiver marker is written here (보정①).
+	const result = upsertMetaSession({
+		input: {
+			backend: input.backend satisfies MetaBackendV2,
+			nativeSessionId: input.nativeSessionId,
+			cwd: input.cwd,
+			model: null,
+			transcriptPath: null,
+		},
+		dir: deps.sessionsDir,
+		now: deps.now,
+	});
+	return {
+		action: result.action,
+		gardenId: result.record.gardenId,
+		backend: result.record.backend,
+		nativeSessionId: result.record.nativeSessionId,
+		cwd: result.record.cwd,
+	};
+}