@junghanacs/entwurf 0.12.6 → 0.12.7

package/scripts/smoke-pi-provider-state.sh

@@ -0,0 +1,182 @@
+#!/usr/bin/env bash
+# smoke-pi-provider-state — regression gate for the pi provider install adapter (#46 Task 2):
+# register-pi-provider.py (ownership-classified install/remove, user+project scopes) + the
+# read-only doctor-pi-provider.ts (effective shadow view). Runs in an ISOLATED HOME + XDG with a
+# fake stable bin and isolated settings files (no real ~/.pi). Asserts:
+#   - user install ownership matrix: absent→create+state; managed-legacy(repo start.sh)→bare bin +
+#     state(preimage audit, NOT restored) + siblings preserved; managed-current→idempotent;
+#     user-override→NOT overwritten, NO state (unowned).
+#   - user remove: state-based honest inverse (managed-* → remove OUR key, a legacy repo path is
+#     NOT restored; siblings kept; parent tidied); user-override → no state → nothing to undo.
+#   - legacy bundle prune (session-bridge/pi-tools-bridge repo path) alongside, user my-own kept.
+#   - project scope: NO state; install normalizes the bare bin, remove strips our-managed shapes
+#     (bare bin AND legacy repo path), a user override left in place.
+#   - doctor: effective = project shadows user; user-only/both-bare → ok green; project-STALE
+#     (user bare, project legacy) → effective legacy note (the "doctor green runtime red" guard);
+#     state-owned DRIFT → FAIL; bare-but-dangling → FAIL; malformed settings → FAIL; symlink refuse.
+#   - checkout stays byte-identical (nothing under $REPO).
+# Offline + deterministic (deps: bash + python3 + node --experimental-strip-types).
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+REG="$REPO_DIR/scripts/register-pi-provider.py"
+DOCTOR="$REPO_DIR/scripts/doctor-pi-provider.ts"
+
+pass=0
+ok()   { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
+die()  { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+want() { eval "$2" && ok "$1" || die "$1"; }
+
+REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
+
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/xdg"
+GLOBAL="$SB/global.json"
+PROJECT="$SB/proj/.pi/settings.json"
+STATE="$XDG_DATA_HOME/entwurf/pi-provider/install-state.json"
+mkdir -p "$SB/proj/.pi" "$SB/bin" "$SB/home"
+
+# A fake repo anchor for the managed-legacy predicate (endswith /entwurf/mcp/entwurf-bridge/start.sh).
+FAKE_REPO="$SB/checkout/entwurf"
+LEGACY_CMD="$FAKE_REPO/mcp/entwurf-bridge/start.sh"
+
+# fake stable bin on PATH so the bare command RESOLVES in the doctor. Keep THIS fake
+# authoritative: drop the dir that holds a REAL entwurf-bridge (this dev host exposes one at
+# ~/.local/bin) so the dangling test is not masked by it.
+printf '#!/usr/bin/env bash\necho fake-bridge\n' > "$SB/bin/entwurf-bridge"
+chmod +x "$SB/bin/entwurf-bridge"
+_real_bridge="$(command -v entwurf-bridge 2>/dev/null || true)"
+_real_dir="${_real_bridge%/*}"
+if [ -n "$_real_dir" ]; then
+  PATH="$(printf '%s' "$PATH" | tr ':' '\n' | grep -vFx "$_real_dir" | paste -sd: -)"
+fi
+export PATH="$SB/bin:$PATH"
+
+reg()    { python3 "$REG" "$@"; }
+doctor() { PI_PROVIDER_GLOBAL_SETTINGS="$GLOBAL" PI_PROVIDER_PROJECT_SETTINGS="$PROJECT" PI_PROVIDER_STATE="$STATE" \
+             node --experimental-strip-types "$DOCTOR"; }
+cmd_of() { python3 -c 'import json,sys
+try:
+  d=json.load(open(sys.argv[1])); print(d["entwurfProvider"]["mcpServers"]["entwurf-bridge"]["command"])
+except Exception: print("<none>")' "$1"; }
+
+# ── A: user install — absent → create + state(ownership=absent) ───────────────
+printf '{"defaultProvider":"x"}\n' > "$GLOBAL"
+reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null
+want "user/absent: command is bare stable bin" "[ \"\$(cmd_of '$GLOBAL')\" = entwurf-bridge ]"
+want "user/absent: state ownership=absent" \
+  "python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))[\"ownership\"])' '$STATE' | grep -qx absent"
+
+# ── B: user install — managed-legacy(repo start.sh) → bare bin + preimage + siblings kept ──
+rm -f "$STATE"
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"appendSystemPrompt":False,"skillPlugins":["/p"],"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]}}},"packages":["y"]}, open(sys.argv[1],"w"))' "$GLOBAL" "$LEGACY_CMD"
+OUT="$(reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE")"
+want "user/managed-legacy: reported as managed-legacy" "printf '%s' \"\$OUT\" | grep -q 'managed-legacy'"
+want "user/managed-legacy: normalized to bare bin" "[ \"\$(cmd_of '$GLOBAL')\" = entwurf-bridge ]"
+want "user/managed-legacy: siblings preserved (skillPlugins/appendSystemPrompt)" \
+  "python3 -c 'import json,sys; ep=json.load(open(sys.argv[1]))[\"entwurfProvider\"]; sys.exit(0 if ep.get(\"skillPlugins\")==[\"/p\"] and ep.get(\"appendSystemPrompt\") is False else 1)' '$GLOBAL'"
+want "user/managed-legacy: state ownership=managed-legacy" \
+  "python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))[\"ownership\"])' '$STATE' | grep -qx managed-legacy"
+want "user/managed-legacy: preimage records the repo path (audit, not restored)" \
+  "python3 -c 'import json,sys; p=json.load(open(sys.argv[1]))[\"preimage\"]; sys.exit(0 if p and p.get(\"command\")==sys.argv[2] else 1)' '$STATE' '$LEGACY_CMD'"
+want "user/managed-legacy: timing honesty label emitted" \
+  "printf '%s' \"\$OUT\" | grep -q 'existing pi sessions unaffected until restart'"
+
+# ── C: user install — managed-current(bare) → idempotent ──────────────────────
+OUT="$(reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE")"
+want "user/managed-current: idempotent (stays bare)" "[ \"\$(cmd_of '$GLOBAL')\" = entwurf-bridge ]"
+want "user/managed-current: reported managed-current" "printf '%s' \"\$OUT\" | grep -q 'managed-current'"
+
+# ── D: user install — user-override → NOT overwritten, NO state ───────────────
+rm -f "$STATE"
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"/my/own/thing"}}}}\n' > "$GLOBAL"
+OUT="$(reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE")"
+want "user/override: command left untouched" "[ \"\$(cmd_of '$GLOBAL')\" = /my/own/thing ]"
+want "user/override: NO state written (unowned)" "[ ! -f '$STATE' ]"
+want "user/override: reported preserved user override" "printf '%s' \"\$OUT\" | grep -qi 'user override'"
+
+# ── E: user remove — state-based honest inverse (key removed, siblings kept) ──
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"skillPlugins":["/p"],"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]}}}}, open(sys.argv[1],"w"))' "$GLOBAL" "$LEGACY_CMD"
+reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null
+reg remove "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null
+want "user/remove: our key removed (NOT restored to repo path)" "[ \"\$(cmd_of '$GLOBAL')\" = '<none>' ]"
+want "user/remove: sibling skillPlugins preserved" \
+  "python3 -c 'import json,sys; sys.exit(0 if json.load(open(sys.argv[1]))[\"entwurfProvider\"].get(\"skillPlugins\")==[\"/p\"] else 1)' '$GLOBAL'"
+want "user/remove: state removed" "[ ! -f '$STATE' ]"
+reg remove "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null 2>&1
+ok "user/remove: no-state is idempotent (nothing to undo)"
+
+# ── F: legacy bundle prune alongside, user-authored server kept ───────────────
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]},"session-bridge":{"command":sys.argv[3]},"my-own":{"command":"/custom"}}}}, open(sys.argv[1],"w"))' "$GLOBAL" "$LEGACY_CMD" "$FAKE_REPO/mcp/session-bridge/start.sh"
+reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null
+want "legacy-prune: session-bridge removed" \
+  "python3 -c 'import json,sys; sys.exit(0 if \"session-bridge\" not in json.load(open(sys.argv[1]))[\"entwurfProvider\"][\"mcpServers\"] else 1)' '$GLOBAL'"
+want "legacy-prune: user-authored my-own kept" \
+  "python3 -c 'import json,sys; sys.exit(0 if \"my-own\" in json.load(open(sys.argv[1]))[\"entwurfProvider\"][\"mcpServers\"] else 1)' '$GLOBAL'"
+reg remove "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null; rm -f "$STATE"
+
+# ── G: project scope — NO state; install normalizes, remove strips managed shapes ──
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]}}}}, open(sys.argv[1],"w"))' "$PROJECT" "$LEGACY_CMD"
+reg install "$PROJECT" "$FAKE_REPO" --scope project >/dev/null
+want "project/install: normalized to bare bin" "[ \"\$(cmd_of '$PROJECT')\" = entwurf-bridge ]"
+want "project/install: NO user-scope state created" "[ ! -f '$STATE' ]"
+reg remove "$PROJECT" "$FAKE_REPO" --scope project >/dev/null
+want "project/remove: strips the bare bin (our-managed)" "[ \"\$(cmd_of '$PROJECT')\" = '<none>' ]"
+
+# ── H: doctor — effective shadow view + verdicts ──────────────────────────────
+# H-1: user-only bare → effective user, ok green
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+printf '{}\n' > "$PROJECT"; rm -f "$STATE"
+OUT="$(doctor)"; RC=$?
+want "doctor(user-only bare): exits 0" "[ '$RC' -eq 0 ]"
+want "doctor(user-only bare): ok — bare bin resolves" "printf '%s' \"\$OUT\" | grep -q 'bare stable bin'"
+
+# H-2: project STALE (user bare, project legacy) → effective=project=legacy note (green-runtime-red guard)
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]}}}}, open(sys.argv[1],"w"))' "$PROJECT" "$LEGACY_CMD"
+OUT="$(doctor)"; RC=$?
+want "doctor(project-stale): exits 0 (honest note, not a crash)" "[ '$RC' -eq 0 ]"
+want "doctor(project-stale): EFFECTIVE is project (shadows user)" "printf '%s' \"\$OUT\" | grep -q 'EFFECTIVE (project)'"
+want "doctor(project-stale): flags legacy managed path (not adopted)" "printf '%s' \"\$OUT\" | grep -q 'LEGACY managed repo path'"
+
+# H-3: state-owned DRIFT → FAIL (state says managed but effective is foreign)
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"/foreign/thing"}}}}\n' > "$GLOBAL"
+printf '{}\n' > "$PROJECT"
+python3 -c 'import json,sys; json.dump({"schemaVersion":1,"managedSettingsPath":sys.argv[1],"scope":"user","ownership":"managed-legacy","command":"entwurf-bridge","preimage":None}, open(sys.argv[2],"w"))' "$GLOBAL" "$STATE"
+if doctor >/dev/null 2>&1; then die "doctor(drift): should FAIL (state owns but effective drifted)"; fi
+ok "doctor(drift): FAILS on state-owned + effective-drifted"
+rm -f "$STATE"
+
+# H-4: bare-but-dangling (bin not on PATH) → FAIL
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+printf '{}\n' > "$PROJECT"
+mv "$SB/bin/entwurf-bridge" "$SB/bin/entwurf-bridge.hidden"
+if doctor >/dev/null 2>&1; then die "doctor(dangling): should FAIL (bare bin not resolvable)"; fi
+ok "doctor(dangling): FAILS when the bare bin does not resolve"
+mv "$SB/bin/entwurf-bridge.hidden" "$SB/bin/entwurf-bridge"
+
+# H-5: malformed settings → FAIL (SSOT read throws)
+printf 'not json{{{' > "$GLOBAL"; printf '{}\n' > "$PROJECT"
+if doctor >/dev/null 2>&1; then die "doctor(malformed): should FAIL"; fi
+ok "doctor(malformed): FAILS on malformed settings (SSOT read throws)"
+
+# H-6: none configured → honest '?' note, exits 0
+printf '{}\n' > "$GLOBAL"; printf '{}\n' > "$PROJECT"
+OUT="$(doctor)"; RC=$?
+want "doctor(none): exits 0" "[ '$RC' -eq 0 ]"
+want "doctor(none): honest never-installed '?' note" "printf '%s' \"\$OUT\" | grep -q 'never installed'"
+
+# ── I: symlink target → install REFUSES ───────────────────────────────────────
+printf '{}\n' > "$SB/real.json"; rm -f "$GLOBAL"; ln -s "$SB/real.json" "$GLOBAL"
+if reg install "$GLOBAL" "$FAKE_REPO" --scope user --state "$STATE" >/dev/null 2>&1; then die "symlink: install should REFUSE"; fi
+ok "symlink: install refused (someone else's SSOT)"
+rm -f "$GLOBAL"
+
+# ── checkout purity ───────────────────────────────────────────────────────────
+REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
+want "purity: checkout unchanged (all writes stayed in the sandbox HOME+XDG)" \
+  "[ \"\$REPO_BEFORE\" = \"\$REPO_AFTER\" ]"
+
+printf '\nsmoke-pi-provider-state: %d checks passed\n' "$pass"

package/scripts/smoke-user-scope-citizen.sh

@@ -23,6 +23,18 @@ command -v python3 >/dev/null || { echo "FAIL: python3 not on PATH"; exit 1; }
 
 TMP="$(mktemp -d -t psa-user-citizen.XXXXXX)"
 trap 'rm -rf "$TMP"' EXIT
+
+# Isolation is a property of every root run.sh writes through, not of the one this gate happens
+# to override. `remove-user-scope` today reads PI_CODING_AGENT_DIR (settings) and XDG_DATA_HOME
+# (ownership state) — passing the operator's real XDG_DATA_HOME is what let this gate delete the
+# live MCP key during `pnpm check` (2026-07-14). It does not touch HOME *today*; sandbox HOME and
+# the whole XDG trio anyway, so the next root run.sh reaches for is already fenced (AGENTS rule 11).
+export HOME="$TMP/home"
+export XDG_DATA_HOME="$TMP/xdg"
+export XDG_STATE_HOME="$TMP/state"
+export XDG_CACHE_HOME="$TMP/cache"
+mkdir -p "$HOME" "$XDG_DATA_HOME" "$XDG_STATE_HOME" "$XDG_CACHE_HOME"
+
 S="$TMP/settings.json"
 FAKE_REPO="$TMP/fake/entwurf"; mkdir -p "$FAKE_REPO"
 RESOLVED="$(cd "$FAKE_REPO" && pwd)"
@@ -125,5 +137,55 @@ assert '../../repos/gh/andenken' in p, 'andenken over-removed'
 assert '/home/me/entwurf-notes' in p, 'entwurf-notes over-removed (substring over-delete)'
 " 2>/dev/null; then ok "--remove drops entwurf, preserves unrelated + look-alikes (symmetric with install)"; else bad "--remove over-deleted a look-alike or missed entwurf"; fi
 
+# 9. --dry-run remove REPORTS the count and writes NOTHING (backs run.sh's project
+#    `remove` pointer note that suggests the global inverse only when relevant).
+cat > "$S" <<JSON
+{"packages": ["$RESOLVED", "../../repos/gh/andenken"]}
+JSON
+MT_DR="$(stat -c %Y "$S")"; sleep 1
+OUT_DR="$(python3 "$REG" "$S" "$FAKE_REPO" --remove --dry-run)"
+MT_DR2="$(stat -c %Y "$S")"
+if printf '%s' "$OUT_DR" | grep -q 'would remove 1'; then ok "--dry-run reports 'would remove' count"; else bad "--dry-run did not report the would-remove count: $OUT_DR"; fi
+if [ "$MT_DR" = "$MT_DR2" ] && has_pkg "$RESOLVED"; then ok "--dry-run writes nothing (entry intact, mtime stable)"; else bad "--dry-run mutated settings (mtime $MT_DR -> $MT_DR2)"; fi
+OUT_DR_NONE="$(python3 "$REG" "$TMP/absent.json" "$FAKE_REPO" --remove --dry-run)"
+if printf '%s' "$OUT_DR_NONE" | grep -q 'no entwurf'; then ok "--dry-run on an entwurf-free file reports nothing to remove"; else bad "--dry-run false-positive on absent entry: $OUT_DR_NONE"; fi
+
+# 9b. --dry-run WITHOUT --remove must FAIL LOUD and write nothing. A flag named
+#     "dry-run" that falls through to the register write path and mutates settings
+#     is an install-hygiene footgun (GPT blocker, 2026-07-03).
+cat > "$S" <<'JSON'
+{"packages": ["../../repos/gh/andenken"]}
+JSON
+MT_DRR="$(stat -c %Y "$S")"; sleep 1
+if python3 "$REG" "$S" "$FAKE_REPO" --dry-run >/dev/null 2>&1; then bad "--dry-run without --remove should fail loud, not register"; else ok "--dry-run without --remove fails loud (never a silent write)"; fi
+MT_DRR2="$(stat -c %Y "$S")"
+if [ "$MT_DRR" = "$MT_DRR2" ] && ! has_pkg "$RESOLVED"; then ok "--dry-run without --remove wrote nothing (mtime stable, no entwurf entry added)"; else bad "--dry-run without --remove mutated settings (mtime $MT_DRR -> $MT_DRR2)"; fi
+if python3 "$REG" "$S" "$FAKE_REPO" --bogus >/dev/null 2>&1; then bad "unknown flag should be rejected"; else ok "unknown flag rejected (fail-loud parser)"; fi
+
+# 10. the run.sh SHELL path `remove-user-scope` reaches the SAME SSOT against a
+#     PI_CODING_AGENT_DIR-overridden ~/.pi/agent — proves install's user-scope
+#     inverse is REACHABLE from run.sh, not only from the python SSOT (the gap GPT
+#     flagged: remove symmetry existed at the SSOT but no run.sh path exercised it).
+#     REPO_DIR (run.sh's own dir) is the real checkout, so seed THAT as the entry.
+RUN="$REPO/run.sh"
+AGENT_DIR="$TMP/agent"; mkdir -p "$AGENT_DIR"
+US="$AGENT_DIR/settings.json"
+cat > "$US" <<JSON
+{"defaultProvider": "openai-codex", "packages": ["$REPO", "../../repos/gh/andenken"]}
+JSON
+# remove-user-scope uses BOTH PI_CODING_AGENT_DIR (settings target) and XDG_DATA_HOME
+# (ownership-state authority). Isolating only the former lets the fake inverse consume the
+# operator's real state, follow its recorded managedSettingsPath, and remove the live MCP key.
+XDG_DATA_HOME="$TMP/xdg" PI_CODING_AGENT_DIR="$AGENT_DIR" bash "$RUN" remove-user-scope >/dev/null 2>&1 || bad "run.sh remove-user-scope exited non-zero"
+if python3 -c "
+import json
+d=json.load(open('$US')); p=d['packages']
+assert '$REPO' not in p, 'run.sh remove-user-scope did not drop the global entwurf entry'
+assert '../../repos/gh/andenken' in p, 'run.sh remove-user-scope over-removed an unrelated package'
+assert d['defaultProvider']=='openai-codex', 'run.sh remove-user-scope dropped an unrelated key'
+" 2>/dev/null; then ok "run.sh remove-user-scope drops the global citizen, preserves unrelated (SSOT reached via shell)"; else bad "run.sh remove-user-scope path failed"; fi
+# idempotent: a second remove-user-scope is a clean no-op (no crash on absent entry)
+if XDG_DATA_HOME="$TMP/xdg" PI_CODING_AGENT_DIR="$AGENT_DIR" bash "$RUN" remove-user-scope >/dev/null 2>&1; then ok "run.sh remove-user-scope is idempotent (no-op second run)"; else bad "run.sh remove-user-scope second run crashed"; fi
+
 echo
 if [ "$fail" -eq 0 ]; then echo "smoke-user-scope-citizen: PASS"; else echo "smoke-user-scope-citizen: FAIL (see above)"; exit 1; fi

package/scripts/with-dist-lock.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+#
+# Serialize a command that rebuilds OR reads mcp/entwurf-bridge/dist against every
+# other such command: `with-dist-lock.sh <cmd...>` runs <cmd> holding an atomic
+# lock over the shared dist dir.
+#
+# Why the lock has to wrap the WHOLE command, not just the emit:
+# build-bridge does `rm -rf dist` then a tsc emit; `npm pack` runs build-bridge as
+# its prepack hook and then, AFTER prepack returns, walks the tree to read dist into
+# the tarball. So the window where dist must stay intact is [prepack build ‥ npm's
+# post-build read] — the entire pack, not the emit alone. A lock scoped to just the
+# emit (released when build-bridge exits) is not merely insufficient, it BACKFIRES:
+# it staggers concurrent packs so each run's lock-free read lands squarely inside
+# the next run's `rm -rf dist`, turning an occasional race into a near-deterministic
+# phantom "dist missing" pack failure (measured: 7/8 packs MISSING). Wrapping the
+# whole pack fixes it — the read is now inside the lock (2026-07-03).
+#
+# Reentrancy: the wrapped `npm pack` re-invokes build-bridge as its prepack, which
+# is itself wrapped by this script (package.json). ENTWURF_BUILD_LOCK_HELD, exported
+# once the outer wrapper acquires, tells the nested invocation to run through
+# without re-acquiring, so the prepack never self-deadlocks against its own gate.
+#
+# mkdir is the atomic primitive (POSIX, no `flock` dependency — portable across the
+# npm/pnpm lifecycle on the Linux publish host). Mirrors the entwurf-v2 dispatch
+# lock discipline: atomic acquire, holder pid recorded for human cleanup, same-host
+# stale reclaim (a SIGKILL'd holder never wedges every future build), and a
+# bounded wait that fails loud rather than hanging or building into a half-wiped dir.
+set -euo pipefail
+
+if [ "$#" -eq 0 ]; then
+  echo "usage: with-dist-lock.sh <command> [args...]" >&2
+  exit 2
+fi
+
+# An ancestor already holds the dist lock (e.g. this is `npm pack`'s prepack
+# build-bridge under a gate that wraps the whole pack) — run reentrantly.
+if [ -n "${ENTWURF_BUILD_LOCK_HELD:-}" ]; then
+  exec "$@"
+fi
+
+REPO_DIR=$(cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+LOCK_DIR="$REPO_DIR/.tmp-verify/dist.lock"
+mkdir -p "$REPO_DIR/.tmp-verify"
+
+try_acquire() {
+  if mkdir "$LOCK_DIR" 2>/dev/null; then
+    return 0
+  fi
+  # Same-host stale reclaim: a holder killed with SIGKILL leaves the dir behind.
+  # If its recorded pid is gone, the lock is dead — reclaim it so a crashed build
+  # never wedges every future one. (Builds/packs always run on the local host, so
+  # a same-host pid probe is authoritative.)
+  local holder
+  holder=$(cat "$LOCK_DIR/pid" 2>/dev/null || echo "")
+  if [ -n "$holder" ] && ! kill -0 "$holder" 2>/dev/null; then
+    rm -rf "$LOCK_DIR"
+    mkdir "$LOCK_DIR" 2>/dev/null && return 0
+  fi
+  return 1
+}
+
+# Bounded wait (~120s): a full pack (prepack tsc emit + npm tree walk) is a few
+# seconds, so this clears several serialized contenders with headroom, then fails
+# loud rather than hanging forever.
+acquired=0
+for _ in $(seq 1 1200); do
+  if try_acquire; then acquired=1; break; fi
+  sleep 0.1
+done
+if [ "$acquired" != 1 ]; then
+  echo "[with-dist-lock] could not acquire dist lock after ~120s: $LOCK_DIR" >&2
+  echo "[with-dist-lock] if no other build/pack is running, remove it: rm -rf \"$LOCK_DIR\"" >&2
+  exit 1
+fi
+echo "$$" > "$LOCK_DIR/pid" 2>/dev/null || true
+# Release on ANY exit (incl. the wrapped command failing) so a red run never wedges
+# the next. The nested prepack build-bridge sees this and skips re-acquiring.
+export ENTWURF_BUILD_LOCK_HELD=$$
+trap 'rm -rf "$LOCK_DIR"' EXIT
+
+"$@"