@junghanacs/entwurf 0.13.1 → 0.14.1

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -11,7 +11,7 @@
  * Currently exposed tools (scope is deliberately narrow — anything that can live
  * as a local skill should live as a skill, not here):
  *   - entwurf_v2      — canonical delivery surface for existing garden citizens; the decider
- *                       chooses live control-socket send / dormant spawn-bg resume / meta-mailbox.
+ *                       chooses live control-socket send / meta-mailbox enqueue / native-push.
  *   - entwurf_peers   — entwurf fact surface: garden citizens (meta-records) with liveness +
  *                       diagnostics (#50 C4: record-less sockets surface THERE, never as identity).
  *                       Brain = pi-extensions/lib/entwurf-fact-provider (listEntwurfFacts) +
@@ -24,6 +24,19 @@
  *                       garden record may call this — so the surface is "drain the inbox you were
  *                       pointed at", not "drain your own". A rung doorbell is a wake attempt;
  *                       this read is the receipt.
+ *   - entwurf_register_native — explicit/manual fallback binding an ALREADY-RUNNING native
+ *                       conversation (antigravity) to a garden id. Never a spawn.
+ *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session,
+ *                       optionally at ONE literal requested cwd (cross-repo fresh, #73);
+ *                       returns a LAUNCH receipt only, and the new address arrives later as the
+ *                       sender envelope of the sibling's nonce callback.
+ *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
+ *                       window; target-only, runs no turn, LAUNCH and OBSERVATION receipts stay
+ *                       apart.
+ *
+ * That list is the WHOLE public surface — seven verbs — and `check-entwurf-bridge-boot`
+ * (G1f) holds it as an exact set on the runtime tools/list, so a verb added or dropped
+ * here without a decision is red rather than merely undocumented.
  *
  * Removed from this v2-only surface: legacy MCP `entwurf`, `entwurf_resume`, and
  * `entwurf_send`. Use `entwurf_v2` for delivery to existing garden citizens.
@@ -57,8 +70,11 @@ import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-ren
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.js";
 import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.js";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
+import { makeVisibleResumeDeps, renderVisibleResume, visibleResume, } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.js";
 import { probeNativeSenderAlive, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
 import { defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
+import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.js";
+import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
 const HOME = os.homedir();
 // Directory SOURCE is this adapter's own policy — the bridge honours an explicit
@@ -286,13 +302,12 @@ function abbreviateHomeMcp(cwd) {
 }
 // entwurf_v2 — the unified v2 dispatch verb (0.11 step 5d-3b). It hands the
 // target + intent to the 5b decider, which chooses the transport (live
-// control-socket send / spawn-bg resume / meta-mailbox enqueue / native-push
-// direct injection) and reports one outcome. The per-target lock is NOT taken by
-// every rail: the decider locks only a control-socket-domain dispatch, which
-// covers the live send AND the dormant cell's spawn-bg resume; the mailbox and
-// native-push branches carry `lock: null` (entwurf-v2-decider.ts). It runs
+// control-socket send / meta-mailbox enqueue / native-push direct injection) and
+// reports one outcome. The per-target lock is NOT taken by every rail: the decider
+// locks only a control-socket-domain dispatch; the mailbox and native-push branches
+// carry `lock: null` (entwurf-v2-decider.ts). It runs
 // IN-PROCESS here (the same production runner pi-native uses) — NOT a delegating
-// RPC — so control, mailbox, native-push, AND spawn-bg all flow through
+// RPC — so control, mailbox and native-push all flow through
 // `runEntwurfV2`. The sender envelope is
 // `buildSendSenderEnvelope()` verbatim (origin/replyable as resolved) — v2 does
 // NOT gate on replyability (a `wants_reply` from an external/non-replyable caller
@@ -300,11 +315,10 @@ function abbreviateHomeMcp(cwd) {
 // sender replyability).
 server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id " +
     "alone does not say which rail that citizen answers on. Give target + intent; the decider picks transport " +
-    "from liveness (live socket citizen → control-socket send; dormant socket citizen → spawn-bg resume; " +
-    "deliverable self-fetch citizen → meta-bridge mailbox; probe-alive native-push citizen → direct injection " +
-    "into its conversation) and reports ONE outcome (delivered / rejected / lock-retained / " +
-    "delivered-but-lock-dirty). EXISTING targets only; discover with entwurf_peers. INTENT — picking wrong is " +
-    "rejected, never auto-converted. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
+    "from liveness (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge " +
+    "mailbox; probe-alive native-push citizen → direct injection into its conversation) and reports ONE " +
+    "outcome (delivered / rejected / delivered-but-lock-dirty). EXISTING targets only; discover with " +
+    "entwurf_peers. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
     "citizen with NO socket liveness (liveness=unsupported) is ALSO fire-and-forget — unsupported means only " +
     '"no control-socket probe" — and the decider picks its own rail: a self-fetch backend (e.g. Claude Code) ' +
     "gets the mailbox, a native-push backend (e.g. Antigravity) gets direct injection and has NO mailbox at " +
@@ -312,24 +326,25 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
     "session, or a backend with no adapter here (e.g. codex), is mailbox-undeliverable, not queued for an " +
     "inbox nobody drains. The native-push probe is 3-valued: alive → injected; dead → " +
     "native-push-target-dead; indeterminate → native-push-probe-indeterminate (unestablished ≠ gone). " +
-    "owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live target → " +
-    "owned-live-no-autosend, self-fetch → backend-liveness-unsupported, native-push → " +
-    "native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND " +
-    "the dormant cell's spawn-bg resume, a separate transport that still runs under that domain's lock. The " +
+    "DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported " +
+    "— same receiver rule as the mailbox, no active drainer means no delivery. " +
+    "The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child " +
+    "and was withdrawn under the visible-first rule — re-open the session yourself, then dispatch again. " +
+    "LOCK: taken for a control-socket-DOMAIN dispatch. The " +
     "mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode " +
     "applies to a CONTROL-SOCKET send only; other plans carry no mode. wants_reply rides every rail. message " +
     "caps at 16000 chars; send an artifact path + digest for more.", {
     target: z.string().min(1).describe("Target garden id (use entwurf_peers to discover)"),
     intent: z
-        .enum(["fire-and-forget", "owned-outcome"])
+        .enum(["fire-and-forget"])
         .describe("fire-and-forget = send/reply/hand-off to a LIVE socket target or to any citizen with no " +
         "socket liveness — the decider picks its rail, and a rail can also REJECT (self-fetch → " +
         "mailbox when deliverable, else mailbox-undeliverable; native-push → alive: direct injection, " +
         "dead: native-push-target-dead, indeterminate: native-push-probe-indeterminate); set " +
-        "wants_reply for an answer. owned-outcome = " +
-        "wake a DORMANT socket-domain citizen via spawn-bg resume ONLY — on a live target rejected " +
-        "as owned-live-no-autosend, on self-fetch as backend-liveness-unsupported, on native-push as " +
-        "native-push-no-resume-authority, and never auto-converted"),
+        "wants_reply for an answer. This is the ONLY intent: owned-outcome, which resumed a dormant " +
+        "citizen by launching a hidden background child, was withdrawn under the visible-first rule. " +
+        "It is not selectable, not deprecated-but-tolerated; a dormant citizen is currently " +
+        "unreachable by this verb and rejects as dormant-fire-forget-unsupported."),
     message: z
         .string()
         .min(1)
@@ -339,8 +354,8 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
         .enum(["steer", "follow_up"])
         .optional()
         .describe("Injection style for a CONTROL-SOCKET send only: steer (interrupt the current turn) or " +
-        "follow_up (queue after it). The mailbox, native-push, and spawn-bg plans carry no mode, so it " +
-        "has no effect on those rails."),
+        "follow_up (queue after it). The mailbox and native-push plans carry no mode, so it has no " +
+        "effect on those rails."),
     wants_reply: z.boolean().optional().describe("Human-conversation reply hint (default false)"),
 }, async ({ target, intent, message, mode, wants_reply }) => {
     try {
@@ -348,8 +363,9 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
         // + the mailbox body sender share one envelope. No replyability gate (see above).
         const sender = await buildSendSenderEnvelope();
         const rendered = await runAndRenderEntwurfV2FromSurface({ target, intent, message, mode, wants_reply }, 
-        // agentDir / prefixRoots intentionally omitted: runAndRenderEntwurfV2FromSurface falls
-        // back to the ENTWURF_PREFIX_ROOTS env SSOT for prefixRoots (5d-4); agentDir stays undefined.
+        // No trust-preflight inputs are passed, and none exist to pass: the preflight on this
+        // path guarded the resume verdict and left with `owned-outcome`. `senderProvider` is
+        // the whole options surface now (see the pi-native surface for the same note).
         { senderProvider: () => sender });
         return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
     }
@@ -432,7 +448,9 @@ server.tool("entwurf_peers", "List the entwurf fact surface: garden citizens (fr
     "`unsupported` for a backend with no control-socket probe such as claude-code); the dispatch " +
     "decision (send vs resume) is computed LATER by the entwurf_v2 contract from that liveness, " +
     "not here — this surface carries no per-row routing field, so do not read a transport off a " +
-    "row. In particular `unsupported` does NOT mean mailbox: it means this backend has no " +
+    "row. A `dead` row is a REPORTED FACT and nothing more: that citizen is dormant and is " +
+    "currently unreachable by any verb, so listing it grants no action — appearing here is not " +
+    "an invitation to dispatch. In particular `unsupported` does NOT mean mailbox: it means this backend has no " +
     "control-socket probe. Which rail it answers on is a capability the decider resolves at dispatch " +
     "time, and there are THREE possible answers, not two — a self-fetch mailbox (only while that " +
     "mailbox is deliverable), native-push direct injection (only while its adapter probe is alive), " +
@@ -442,8 +460,8 @@ server.tool("entwurf_peers", "List the entwurf fact surface: garden citizens (fr
     "is not a departed host. So " +
     "`unsupported` does not promise reachability either: a record whose backend has no adapter on " +
     "this lane resolves to that reject. " +
-    "Note: this is the *active* world. It is NOT a fresh-sibling creation surface; pass an " +
-    "existing garden id to entwurf_v2.", {}, async () => {
+    "Note: this is the *active* world and it is facts-only — it creates nothing. Pass an " +
+    "existing garden id to entwurf_v2; to open a NEW sibling use entwurf_fresh_call.", {}, async () => {
     try {
         // Meta-store axis: entries WITH their kind (ENOENT = fresh install = empty; any
         // other readdir failure is a real error, not a silent empty). The name-only
@@ -535,6 +553,115 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
         return textErr(`entwurf_register_native error: ${err instanceof Error ? err.message : String(err)}`);
     }
 });
+// The caller identity for THIS surface comes from the same authoritative resolution
+// `entwurf_self` uses — BOTH of its certified paths: the pi carrier this child inherited
+// (PI_SESSION_ID + PI_AGENT_ID, which a record minted at birth), or a trusted meta-sender marker
+// the native host's own hook wrote. Neither is a guess and neither is deprecated here.
+//
+// What is refused is a caller-supplied id. The measured failure mode is exactly that: asked for
+// its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
+// environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
+// against that answer would call home to a garden id nobody holds.
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Two fixed " +
+    "backends only: pi, claude-code. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
+    "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
+    "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
+    "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
+    "for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
+    "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
+    "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code). An optional " +
+    "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
+    "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
+    "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
+    "same-user processes on this host. Requires that this agent itself runs " +
+    "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
+    backend: z
+        .enum(["pi", "claude-code"])
+        .describe("Which fixed runtime to open. Only these two; there is no arbitrary command."),
+    model: z
+        .string()
+        .min(1)
+        .max(200)
+        // The `\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source
+        // text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a
+        // Rust regex engine that rejects an unescaped `[` inside a character class as "unclosed
+        // character class" — a 400 on tools/list that stops EVERY Claude session from opening
+        // (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must
+        // stay on the line DIRECTLY above the expression, or it attaches to nothing and reads
+        // as an unused suppression while the escape goes back to being fixable.
+        // biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above
+        .regex(/^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/)
+        .describe("Required runtime model: canonical provider/model for pi, or a Claude Code model id/alias."),
+    task: z
+        .string()
+        .min(1)
+        .max(16000)
+        .describe("What the sibling should do after it calls you back. Plain instructions; no secrets (see the tool description)."),
+    cwd: z
+        .string()
+        .optional()
+        .describe("Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation."),
+}, async ({ backend, model, task, cwd }) => {
+    let callerGardenId = null;
+    try {
+        const self = await buildAuthoritativeSelfEnvelope();
+        callerGardenId = self.envelope.sessionId;
+    }
+    catch (err) {
+        // ONE error is a legitimate answer here: this host has no authoritative identity at all
+        // (no pi carrier inherited, no trusted marker written), so the sibling would have nowhere
+        // to call home. That normalises to the named refusal.
+        //
+        // Everything else — a corrupt record, an unreadable store, a broken marker — keeps its
+        // own diagnosis and fails loud. Folding those into "you are anonymous" would relabel a
+        // store defect as a wiring choice, and the operator would go looking in the wrong place.
+        if (!(err instanceof EntwurfEnvelopeWiringError))
+            throw err;
+        callerGardenId = null;
+    }
+    try {
+        const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, callerGardenId }));
+        return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
+    }
+    catch (err) {
+        return textErr(`entwurf_fresh_call error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+});
+// The composition root for a visible resume: this surface is the only layer that may know BOTH
+// halves, so it is where the mux launcher is handed to the v2 composition. `entwurf-v2-visible-
+// resume` cannot open a window on its own and `mux-resume-call` cannot read a record — that is
+// the import fence in docs/mux-launch-rail.md §11, expressed as a function argument.
+const visibleResumeLaunch = (input) => {
+    const launched = resumeCall({ cwd: input.cwd, runtimeArgs: input.runtimeArgs });
+    return launched.ok
+        ? { ok: true, handle: launched.receipt }
+        : { ok: false, reason: launched.reason, hint: RESUME_CALL_REJECT_HINT[launched.reason] };
+};
+server.tool("entwurf_resume_call", "Reopen ONE DORMANT pi citizen under its OWN garden id, in a visible window in the operator's own tmux " +
+    "session. The record supplies everything — which transcript, which model, which provider, which cwd — so " +
+    "the only input is the target id: there is no model override, no task, and no prompt. This runs NO turn: " +
+    "the window comes back with the conversation and waits, and talking to it is still entwurf_v2 " +
+    "fire-and-forget on the socket this call stands up. You get TWO receipts and they mean different things: a " +
+    "LAUNCH receipt (tmux made a window and was asked to start pi) and an OBSERVATION receipt (the control " +
+    "socket answered under the same id, or resume-unobserved). Unobserved is a real outcome, not an error to " +
+    "retry — the window is visible, so read it. A citizen that is already LIVE is refused: address it with " +
+    "entwurf_v2 instead. Only pi citizens have a same-id resume, because only they stand a control socket up. " +
+    "Requires that this agent itself runs inside tmux.", {
+    target: z
+        .string()
+        .min(1)
+        .regex(/^\d{8}T\d{6}-[0-9a-f]{6}$/)
+        .describe("Garden id of the DORMANT pi citizen to reopen (discover with entwurf_peers)."),
+}, async ({ target }) => {
+    try {
+        const result = await visibleResume(target, makeVisibleResumeDeps(visibleResumeLaunch));
+        const rendered = renderVisibleResume(result);
+        return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
+    }
+    catch (err) {
+        return textErr(`entwurf_resume_call error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+});
 // ============================================================================
 // Main
 // ============================================================================

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/overlay.js

@@ -2,8 +2,8 @@
 //
 // claude-agent-acp's SettingsManager loads the operator's `~/.claude/settings.json`
 // DIRECTLY (CLAUDE_CONFIG_DIR is the only knob that redirects that read). So the
-// operator's native `permissions.defaultMode` ("auto"), hooks, plugins, and
-// per-cwd memory/projects state would otherwise leak into entwurf ACP
+// operator's native `permissions.defaultMode` (whatever its current value), hooks,
+// plugins, and per-cwd memory/projects state would otherwise leak into entwurf ACP
 // sessions. The overlay redirects SettingsManager at a pi-owned directory whose
 // `settings.json` WE author (minimal, `hooks:{}`), while keeping exactly the
 // operator entries a backend needs (credentials, caches, built-in skills)
@@ -86,9 +86,11 @@ export const OVERLAY_EMPTY_DIRS = new Set(["projects", "sessions"]);
 export const OVERLAY_BINARY_OWNED = new Set([".claude.json", "backups", "settings.json"]);
 /**
  * Minimal overlay settings.json. Only fields with a reason to pin:
- *   - `permissions.defaultMode: "default"` neutralizes the operator's native
- *     "auto"; combined with the explicit `tools`/`permissionAllow` surface,
- *     "default" auto-passes every tool we expose without prompts.
+ *   - `permissions.defaultMode: "bypassPermissions"` is deliberate unattended
+ *     ACP operation: a tool call must never suspend a model turn on an interactive
+ *     permission prompt. This does not widen the callable surface — explicit
+ *     `tools`/`disallowedTools` still shape it, and `permissionAllow` still rides
+ *     the inline Claude settings — or bypass backend authentication.
  *   - `autoMemoryEnabled: false` — SDK opt-out for auto-memory (defense in
  *     depth; the tiny non-empty engraving/preset replacement is the primary
  *     write-containment lever for Claude ACP).
@@ -97,7 +99,7 @@ export const OVERLAY_BINARY_OWNED = new Set([".claude.json", "backups", "setting
  */
 export function overlaySettingsJson() {
     return `${JSON.stringify({
-        permissions: { defaultMode: "default" },
+        permissions: { defaultMode: "bypassPermissions" },
         autoMemoryEnabled: false,
         hooks: {},
     }, null, 2)}\n`;

package/mcp/entwurf-bridge/dist/pi-extensions/lib/classify-tmux-cwd.js

@@ -0,0 +1,47 @@
+/**
+ * classify-tmux-cwd — the ONE classification of a start directory that is about to be handed
+ * to tmux as a `-c` value. Shared leaf of the resume and fresh launch compositions; it owns
+ * the classification and NOTHING else — no hints (each consumer phrases its own: resume says
+ * "recorded cwd", fresh says "requested cwd"), no argv, no tmux, no fallback directory.
+ *
+ * Every rule below is a MEASURED tmux 3.6a behaviour (2026-08-06, private server), and each
+ * one is a way a launch would look successful while being wrong:
+ *
+ *   1. a NONEXISTENT `-c` is silent. tmux exits 0, opens the window, and the child falls back
+ *      to `$HOME`. A launch whose directory has been deleted would therefore open a visible
+ *      window in the wrong project and look successful. Nothing downstream can catch that:
+ *      the launch receipt would be perfectly well-formed.
+ *   2. `-c` is FORMAT-EXPANDED. `#{pane_id}` inside the value silently rewrote the path
+ *      (`<dir>/#{pane_id}` → `<dir>/%0`), and a `#(…)` value was observed running its
+ *      command. A path is data; tmux reads it as a format. So `#` is refused outright.
+ *   3. whitespace is SAFE — argv is an array and nothing re-splits. A dir named `with space`
+ *      arrived intact. So there is no quoting grammar here, and none is owed.
+ *
+ * That is the entire defence: one existence check and one character. No escaping layer, no
+ * sanitiser, no trim, no realpath/symlink policy — a symlinked project dir is a normal thing
+ * to work in, and a value is classified exactly as given.
+ */
+import { statSync } from "node:fs";
+import path from "node:path";
+/**
+ * Classify a candidate start directory. Split into separate reasons rather than one because
+ * the operator's next move differs: an absolute-path bug is a caller defect, a missing
+ * directory is a moved/deleted project, and a `#` is a path tmux would rewrite under us.
+ */
+export function classifyTmuxCwd(cwd) {
+    if (!path.isAbsolute(cwd))
+        return "cwd-not-absolute";
+    // tmux expands formats inside the `-c` VALUE. `#{…}` rewrote the path silently and `#(…)`
+    // was observed executing; neither is something to escape our way out of.
+    if (cwd.includes("#"))
+        return "cwd-format-token";
+    let st;
+    try {
+        st = statSync(cwd);
+    }
+    catch {
+        // tmux would NOT report this — it opens the window and lands the child in $HOME.
+        return "cwd-missing";
+    }
+    return st.isDirectory() ? null : "cwd-not-directory";
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-control-rpc.js

@@ -16,12 +16,14 @@
 import * as net from "node:net";
 /**
  * THE `<sender_info>` synthesis — the one place the sender envelope becomes
- * message text. Two consumers, one shape (#50 C3):
+ * message text. ONE consumer since the visible-first cut (#50 C3):
  *   - the live socket rail's RECEIVER (entwurf-control handleCommand("send")
- *     appends it to the delivered customMessage);
- *   - the dormant spawn-resume rail's SENDER (entwurf-v2-production appends it
- *     to the resume prompt, so a resumed citizen wakes knowing who called in
- *     exactly the shape a live delivery would have rendered).
+ *     appends it to the delivered customMessage).
+ *
+ * The second consumer was the dormant spawn-resume rail's SENDER, which appended
+ * the same shape to a resume prompt so a resumed citizen woke knowing who called.
+ * That rail is gone. The shape stays single-sourced here so a future VISIBLE
+ * resume renders an identical envelope rather than inventing a second one.
  * `wants_reply` is emitted only when explicitly true — an unset/false marker
  * renders nothing (etiquette marker, not transport contract).
  */

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-core.js

@@ -1,19 +1,18 @@
 /**
  * entwurf-core — sync entwurf execution, host-agnostic.
  *
- * DIRECT importers, MEASURED from the import graph (2026-07-27) — not from memory:
+ * DIRECT importers, RE-MEASURED from the import graph (2026-08-06) — not from memory:
  *   - pi-extensions/entwurf-control.ts (the pi adapter)
- *   - pi-extensions/lib/entwurf-v2-spawn-production.ts (v2 spawn-bg launch identity)
- *   - pi-extensions/lib/project-trust-handler.ts · lib/acp/augment.ts ·
- *     lib/native-push/adapter.ts
- *   - plus gates/smokes (check-shell-quote, check-package-source-routing, …)
+ *   - pi-extensions/lib/resume-launch-identity.ts (record-authoritative launch identity,
+ *     itself consumer-zero since the visible-first cut — see its header)
+ *   - plus gates/smokes (check-shell-quote, check-package-source-routing,
+ *     check-entwurf-session-identity, new-session-id, resolve-acp-bridge)
  *
- * The MCP bridge is a TRANSITIVE consumer, not a direct one, and the distinction is the
- * whole point: `mcp/entwurf-bridge/src/index.ts → entwurf-v2-surface.ts →
- * entwurf-v2-production.ts → entwurf-v2-spawn-production.ts → entwurf-core.ts`. So the old
- * header's claim — that the bridge imports this shared implementation the way a v1 tool
- * surface did — was false, but so is "the bridge does not reach it": it reaches it at
- * runtime, only for spawn-bg production.
+ * The MCP bridge does NOT reach this module on any path, and that changed with the cut:
+ * its one edge ran `index.ts → entwurf-v2-surface.ts → entwurf-v2-production.ts →
+ * entwurf-v2-spawn-production.ts → entwurf-core.ts`, and the spawn-production link was
+ * deleted with the `spawn-bg` transport. Do not restate the old "transitive consumer,
+ * for spawn-bg production" line; re-measure before claiming either way.
  *
  * NOT consumers on any path: `pi-extensions/entwurf.ts` (the v1 pi native tool surface) and
  * `pi-extensions/lib/entwurf-async.ts` were REMOVED in the 0.12 cutover. Do not reintroduce
@@ -113,9 +112,9 @@ export function normalizeCodexEntwurfModelForAcp(model) {
 // The Entwurf Target Registry is GONE (#50 C3). `pi/entwurf-targets.json` and its
 // reader chain (loadEntwurfTargets / resolveEntwurfTarget / EntwurfRegistryError +
 // the ~/.pi/agent symlink machinery) were the v1 "narrow door" for spawn-model
-// policy — but v2 never spawns from a model tuple: entwurf_v2 resumes an
-// already-identified record-backed citizen, and the model axis is the citizen's
-// own (Identity Preservation Rule). The last readers were the RT-dead
+// policy — but v2 never spawns at all, from a model tuple or otherwise: entwurf_v2
+// addresses an already-identified record-backed citizen, and the model axis is the
+// citizen's own (Identity Preservation Rule). The last readers were the RT-dead
 // buildSessionName mirror and the v1 spawn guard, both swept with this cut.
 // Bridge-extension routing for provider=entwurf survives below (getRegistryRouting
 // ← scripts/resolve-acp-bridge.ts) and takes a caller-supplied target — no file.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-resume-args.js

@@ -1,53 +1,58 @@
 /**
- * entwurf-resume-args — the SINGLE source of truth for the `pi` argv a resume spawn is
- * launched with (0.11 Stage 0 step 5c-3b). One place owns the
- * `--no-extensions` / `--entwurf-control` decision so the launch shape cannot drift.
- *
- * The shipped posture (A1): a RESIDENT, addressable garden citizen. The resume turn runs via
- * `-p <prompt>` (the prompt-as-turn authority), and the child is launched WITH
- * `--entwurf-control` and WITHOUT `--no-extensions` — the keep-alive is the GOAL here: the
- * resumed session stands its control socket up and stays addressable. The 5c-3a watcher's
- * `socket-alive` is exactly that "resumed citizen is up" observation (→ release the per-gid
- * lock, child lives on); `child-exited` is the early-exit/failure observation.
- * `plan.launchArgs` (`--approve` or empty, from the decider's preflight) rides along as pi
- * flags before the prompt.
- *
- * A second `legacy` one-shot posture (`--no-extensions`, no control socket, so `pi -p` could
- * exit) lived here until 2026-07-27 and was removed with its launcher and the v1 verbs.
- *
- * Provider/model identity is the caller's existing authority (readSessionIdentity /
- * getEntwurfExplicitExtensions) — this builder only LAYS OUT argv, it never resolves
- * identity. `explicitExtensionArgs` is preserved verbatim: a recorded `provider=entwurf`
- * resume needs the bridge re-injected to resolve the provider, and dropping it would
- * re-introduce the "Unknown provider" footgun (#29). (A future slice may dedup against
- * settings-loaded extensions; not here.)
- *
- * This module is import-free on purpose: the v2 adapter and the gate import the same source,
- * and a self-contained string builder keeps both tsconfigs happy.
+ * entwurf-resume-args — the SINGLE source of truth for the `pi` argv that reopens a dormant
+ * citizen, MEASURED against the runtime rather than inherited from the removed transport.
+ *
+ * ── What changed, and why the old shape was not reusable ──
+ *
+ * Until the visible-first cut this builder emitted `--mode json -p … <prompt>`: a headless JSON
+ * child running one prompt-as-turn, which is what `spawn-bg`'s detached `defaultSpawnChild`
+ * needed. The design notes carried that argv forward as "visibility-neutral, reuse verbatim".
+ * It is not. Measured 2026-08-06 (private tmux + fixture, `pi --help`: `--print, -p` =
+ * *non-interactive mode*): dropped into a tmux window, the headless prefix produces a JSON
+ * stream and a turn, not a window an operator can type into. The visible dialect is the one
+ * `mux-fresh-call` already measured for a fresh sibling — no `--mode`, no `-p`.
+ *
+ * So the shipped posture is now one shape, and it is the only one:
+ *
+ *   pi --entwurf-control [-e <bridge> …] --session <file> [--provider <p>] --model <m>
+ *
+ * There is deliberately NO prompt and no `launchArgs`. A resume opens the window; talking to the
+ * citizen afterwards is `entwurf_v2`'s job on the socket this launch stands up. That split is
+ * what makes the resumed turn free: measured, a promptless resume left the transcript
+ * byte-identical (1666 → 1666) and started no model turn at all.
+ *
+ * The one-shot `legacy` variant (removed 2026-07-27) and the headless prefix (removed here) are
+ * not kept behind a variant flag for compatibility. An exported branch no product path takes is
+ * exactly what let this module's prose claim a live consumer for months.
+ *
+ * Provider/model identity is the caller's authority (`resolveResumeLaunchIdentity`) — this
+ * builder only LAYS OUT argv, it never resolves identity. `explicitExtensionArgs` is preserved
+ * verbatim: a recorded `provider=entwurf` resume needs the bridge re-injected or pi cannot
+ * resolve the provider (#29). Measured on that axis: the resolver emits
+ * `["-e", "<bridge>"]`, and the argv carries it exactly once, between `--entwurf-control` and
+ * `--session`.
+ *
+ * The runtime path itself is NOT here. Resolving `pi` on PATH and proving it launchable belongs
+ * to the mux lane (`mux-launch`), so this module emits the flags after the runtime and nothing
+ * more — which is also why it stays import-free and can be read by both tsconfigs.
  */
 /**
- * Build the `pi` argv for a resume spawn. The prefix is `--mode json -p` (headless JSON
- * child, prompt-as-turn); then the resident posture; then
- * `[…ext args] --session <file> [--provider <p>] --model <m> <prompt>`.
+ * Build the `pi` flags for a VISIBLE resume, in the measured order.
  *
  * Invariants the gate pins:
- *   - v2-control carries `--entwurf-control` and NO `--no-extensions`, plus `-p` + prompt.
- *   - `explicitExtensionArgs` appears exactly once.
- *   - `launchArgs` is included before the suffix.
- *   - provider/model/prompt identity layout is fixed.
+ *   - `--entwurf-control` is FIRST: the resumed session must stand its control socket up, or
+ *     the transcript comes back with no address and the citizen is still unreachable.
+ *   - no `--mode`, no `-p`, no positional prompt — the window is interactive and no turn runs.
+ *   - `explicitExtensionArgs` appears exactly once, after the control flag and before
+ *     `--session`.
+ *   - provider is emitted only when recorded; `--model <m>` is the tail.
  */
 export function buildResumePiArgs(input) {
-    const args = ["--mode", "json", "-p"];
-    // Resident citizen: stand the control socket up (A1) and keep extensions loaded. The
-    // keep-alive the removed one-shot launcher had to avoid is precisely the goal here —
-    // the resumed session must stay addressable. `--approve`/launchArgs ride along.
-    args.push("--entwurf-control");
-    args.push(...(input.launchArgs ?? []));
-    // Suffix — the fixed identity layout.
+    const args = ["--entwurf-control"];
     args.push(...input.explicitExtensionArgs);
     args.push("--session", input.sessionFile);
     if (input.provider)
         args.push("--provider", input.provider);
-    args.push("--model", input.model, input.prompt);
+    args.push("--model", input.model);
     return args;
 }