@junghanacs/entwurf 0.14.0 → 0.14.2

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -26,7 +26,8 @@
  *                       this read is the receipt.
  *   - entwurf_register_native — explicit/manual fallback binding an ALREADY-RUNNING native
  *                       conversation (antigravity) to a garden id. Never a spawn.
- *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session;
+ *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session,
+ *                       optionally at ONE literal requested cwd (cross-repo fresh, #73);
  *                       returns a LAUNCH receipt only, and the new address arrives later as the
  *                       sender envelope of the sibling's nonce callback.
  *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
@@ -568,8 +569,10 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
     "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
     "for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
     "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
-    "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code); there are no " +
-    "arbitrary command/cwd/env knobs. Do not put secrets in the task — model and task argv are visible to " +
+    "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code). An optional " +
+    "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
+    "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
+    "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
     "same-user processes on this host. Requires that this agent itself runs " +
     "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
     backend: z
@@ -594,7 +597,11 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         .min(1)
         .max(16000)
         .describe("What the sibling should do after it calls you back. Plain instructions; no secrets (see the tool description)."),
-}, async ({ backend, model, task }) => {
+    cwd: z
+        .string()
+        .optional()
+        .describe("Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation."),
+}, async ({ backend, model, task, cwd }) => {
     let callerGardenId = null;
     try {
         const self = await buildAuthoritativeSelfEnvelope();
@@ -613,7 +620,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         callerGardenId = null;
     }
     try {
-        const rendered = renderFreshCall(freshCall({ backend, model, task, callerGardenId }));
+        const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, callerGardenId }));
         return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
     }
     catch (err) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/classify-tmux-cwd.js

@@ -0,0 +1,47 @@
+/**
+ * classify-tmux-cwd — the ONE classification of a start directory that is about to be handed
+ * to tmux as a `-c` value. Shared leaf of the resume and fresh launch compositions; it owns
+ * the classification and NOTHING else — no hints (each consumer phrases its own: resume says
+ * "recorded cwd", fresh says "requested cwd"), no argv, no tmux, no fallback directory.
+ *
+ * Every rule below is a MEASURED tmux 3.6a behaviour (2026-08-06, private server), and each
+ * one is a way a launch would look successful while being wrong:
+ *
+ *   1. a NONEXISTENT `-c` is silent. tmux exits 0, opens the window, and the child falls back
+ *      to `$HOME`. A launch whose directory has been deleted would therefore open a visible
+ *      window in the wrong project and look successful. Nothing downstream can catch that:
+ *      the launch receipt would be perfectly well-formed.
+ *   2. `-c` is FORMAT-EXPANDED. `#{pane_id}` inside the value silently rewrote the path
+ *      (`<dir>/#{pane_id}` → `<dir>/%0`), and a `#(…)` value was observed running its
+ *      command. A path is data; tmux reads it as a format. So `#` is refused outright.
+ *   3. whitespace is SAFE — argv is an array and nothing re-splits. A dir named `with space`
+ *      arrived intact. So there is no quoting grammar here, and none is owed.
+ *
+ * That is the entire defence: one existence check and one character. No escaping layer, no
+ * sanitiser, no trim, no realpath/symlink policy — a symlinked project dir is a normal thing
+ * to work in, and a value is classified exactly as given.
+ */
+import { statSync } from "node:fs";
+import path from "node:path";
+/**
+ * Classify a candidate start directory. Split into separate reasons rather than one because
+ * the operator's next move differs: an absolute-path bug is a caller defect, a missing
+ * directory is a moved/deleted project, and a `#` is a path tmux would rewrite under us.
+ */
+export function classifyTmuxCwd(cwd) {
+    if (!path.isAbsolute(cwd))
+        return "cwd-not-absolute";
+    // tmux expands formats inside the `-c` VALUE. `#{…}` rewrote the path silently and `#(…)`
+    // was observed executing; neither is something to escape our way out of.
+    if (cwd.includes("#"))
+        return "cwd-format-token";
+    let st;
+    try {
+        st = statSync(cwd);
+    }
+    catch {
+        // tmux would NOT report this — it opens the window and lands the child in $HOME.
+        return "cwd-missing";
+    }
+    return st.isDirectory() ? null : "cwd-not-directory";
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -25,8 +25,27 @@
  *      caller's own inbound surface. Merging them would claim knowledge this module cannot have.
  *   4. A launch with no callback is a REAL outcome, not an error to retry. No watcher, no poll,
  *      no timeout supervisor. The window is visible; the operator can look.
+ *
+ * ── The optional REQUESTED cwd (issue #73) ──
+ *
+ * A fresh sibling starts wherever the caller happens to be — unless the caller names ONE
+ * literal start directory. That input exists so a cross-repo fresh consultation never has to
+ * ride `entwurf_resume_call` for a dormant record's recorded cwd: resume stays a continuity
+ * verb, and placement pressure stays here. The rules are deliberately narrow:
+ *
+ *   - `undefined` and the exact empty string mean OMIT: no `-c` reaches tmux and the argv is
+ *     byte-identical to the pre-#73 shape. Anything else is taken LITERALLY — no trim, no
+ *     realpath, no project-name resolution, no store/peers/record lookup. The caller is the
+ *     only cwd authority this module knows.
+ *   - the value is classified by the shared `classify-tmux-cwd.ts` leaf BEFORE any mutation
+ *     (same four stable reasons as resume; the measured tmux 3.6a facts live on that leaf).
+ *     This module's hints phrase them as the REQUESTED cwd; resume's say RECORDED.
+ *   - the receipt echoes what was REQUESTED, exactly as `runtimePath` does. It never reports
+ *     `pane_current_path`: proving where the pane actually landed belongs to acceptance, not
+ *     to the launch receipt.
  */
 import { randomBytes } from "node:crypto";
+import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
 import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, } from "./mux-launch.js";
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
 /** The two backends this rail can open. Fixed set, not a profile — a third one is a decision,
@@ -118,16 +137,24 @@ export function mintNonce(randomHex = defaultRandomHex) {
 function defaultRandomHex() {
     return randomBytes(12).toString("hex");
 }
-/** Launch argv: the leaf's detached-append shape, the runtime, then the backend's dialect. */
-export function buildFreshCallArgs(placement, runtimePath, backendArgs) {
+/** Launch argv: the leaf's detached-append shape, optionally `-c` at the resume-symmetric token
+ * position (after `-t`, before `-P -F`), the runtime, then the backend's dialect. An omitted cwd
+ * yields the exact pre-#73 argv — no carrier at all. */
+export function buildFreshCallArgs(placement, runtimePath, backendArgs, cwd) {
     assertSelector("session", placement.sessionId);
     assertLaunchTarget(runtimePath);
+    if (cwd !== undefined) {
+        const bad = classifyTmuxCwd(cwd);
+        if (bad)
+            throw new Error(`mux-fresh-call: refusing to build argv with an unusable cwd (${bad}): ${cwd}`);
+    }
     return [
         "new-window",
         "-d",
         "-a",
         "-t",
         `${placement.sessionId}:{end}`,
+        ...(cwd === undefined ? [] : ["-c", cwd]),
         "-P",
         "-F",
         APPEND_FORMAT,
@@ -159,6 +186,15 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         return { ok: false, reason: "task-empty" };
     if (task.length > TASK_MAX_CHARS)
         return { ok: false, reason: "task-too-long" };
+    // ONLY `undefined` and the exact empty string mean "no cwd". Everything else is the literal
+    // value — deliberately untrimmed, so a whitespace-mangled path is refused loudly by the
+    // classification below instead of being silently repaired into a different directory.
+    const cwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+    if (cwd !== undefined) {
+        const badCwd = classifyTmuxCwd(cwd);
+        if (badCwd)
+            return { ok: false, reason: badCwd };
+    }
     let runtimePath;
     try {
         runtimePath = resolveRuntimeOnPath(FRESH_CALL_RUNTIME[params.backend], env);
@@ -179,7 +215,7 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         callerGardenId: params.callerGardenId,
         nonce,
     });
-    const run = runTmux(buildFreshCallArgs(placement, runtimePath, buildBackendArgs(params.backend, prompt, model)), env);
+    const run = runTmux(buildFreshCallArgs(placement, runtimePath, buildBackendArgs(params.backend, prompt, model), cwd), env);
     assertTmuxOk("new-window", run);
     let fields;
     try {
@@ -199,6 +235,7 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
             ...fields,
             backend: params.backend,
             model,
+            ...(cwd === undefined ? {} : { cwd }),
             runtimePath,
             nonce,
         },
@@ -212,6 +249,10 @@ const REJECT_HINT = {
     "anchor-unresolved": "tmux resolved no pane for this agent's anchor",
     "anchor-mismatch": "tmux answered about a different pane than the one asked about",
     "caller-identity-unavailable": "this surface has no record-backed garden id for the caller, so the sibling would have no address to call back to",
+    "cwd-not-absolute": "the requested cwd is not an absolute path (the value is taken literally — nothing trims or resolves it)",
+    "cwd-format-token": "the requested cwd contains '#', which tmux expands as a format inside -c — it would silently rewrite the path or run a command",
+    "cwd-missing": "the requested cwd does not exist; tmux would not report this, it would open the window in $HOME and look successful",
+    "cwd-not-directory": "the requested cwd exists but is not a directory",
     "model-empty": "model is empty after trimming; fresh calls require an explicit model",
     "model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
     "task-empty": "task is empty after trimming",
@@ -244,6 +285,7 @@ export function renderFreshCall(result) {
         text: `[entwurf fresh call →]\n` +
             `  backend:  ${r.backend} (${r.runtimePath})\n` +
             `  model:    ${r.model} (requested on the runtime CLI)\n` +
+            (r.cwd === undefined ? "" : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
             `  window:   ${r.windowId} (index ${r.windowIndex}) in session ${r.sessionId}\n` +
             `  pane:     ${r.paneId} pid ${r.panePid}\n` +
             `  nonce:    ${r.nonce}\n` +

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-resume-call.js

@@ -4,12 +4,13 @@
  *
  * ── Why this is a module and not a parameter on fresh-call ──
  *
- * `mux-fresh-call` carries a TASK to a runtime it names; the sibling starts wherever the caller
- * happens to be. A resume carries neither: the argv comes from the record (`entwurf-v2-visible-
- * resume` builds it) and the cwd comes from the record too — it is the directory the citizen's
- * own transcript header remembers. Those are different inputs with a different risk, so they get
- * a different module rather than a fourth parameter on a composition whose contract is
- * "identity is an OUTPUT".
+ * `mux-fresh-call` carries a TASK to a runtime it names, and starts the sibling wherever the
+ * caller happens to be unless the caller REQUESTS one literal start directory (#73). A resume
+ * carries neither a task nor a caller choice: the argv comes from the record (`entwurf-v2-
+ * visible-resume` builds it) and the cwd comes from the record too — it is the directory the
+ * citizen's own transcript header remembers, never something the caller picks. Those are
+ * different inputs with a different risk, so they get a different module rather than a fourth
+ * parameter on a composition whose contract is "identity is an OUTPUT".
  *
  *   visible-resume composition → resume-call → placement leaf (unchanged, carrier-free)
  *   resume-call               -X-> garden identity, records, locks, delivery
@@ -20,22 +21,15 @@
  *
  * `mux-placement`'s `buildAppendArgs` deliberately emits no `-c` ("default shell only"), and it
  * stays that way — a resume must not widen the leaf's grammar for the three other callers. So
- * the `-c` shape lives here, with the three refusals MEASURED on tmux 3.6a (2026-08-06, private
- * server):
+ * the `-c` SHAPE lives here, while the classification of the value lives in the shared
+ * `classify-tmux-cwd.ts` leaf (fresh-call hands tmux the same flag, and a twin copy of the
+ * measured rules would rot apart on the next tmux hazard). The measured tmux 3.6a facts —
+ * a nonexistent `-c` silently lands the child in `$HOME`, `#` is format-expanded, whitespace
+ * is safe — are documented on that leaf. `|` is fine too: the cwd never enters the `-F` row
+ * (see `APPEND_FORMAT` below).
  *
- *   1. a NONEXISTENT `-c` is silent. tmux exits 0, opens the window, and the child falls back to
- *      `$HOME`. A resume whose recorded cwd has been deleted would therefore open a visible
- *      window in the wrong project and look successful. Nothing downstream can catch that: the
- *      launch receipt would be perfectly well-formed.
- *   2. `-c` is FORMAT-EXPANDED. `#{pane_id}` inside the value silently rewrote the path
- *      (`<dir>/#{pane_id}` → `<dir>/%0`), and a `#(…)` value was observed running its command.
- *      A path is data; tmux reads it as a format. So `#` is refused outright.
- *   3. whitespace is SAFE — argv is an array and nothing re-splits. A dir named `with space`
- *      arrived intact. So there is no quoting grammar here, and none is owed. `|` is fine too:
- *      the cwd never enters the `-F` row (see `APPEND_FORMAT` below).
- *
- * That is the entire defence: one existence check and one character. No escaping layer, no
- * sanitiser, no symlink policy — a symlinked project dir is a normal thing to work in.
+ * What stays HERE is the phrasing: this module's hints say "recorded cwd", because a resume's
+ * directory comes from the record — fresh-call's say "requested cwd" for the same reasons.
  *
  * ── What the receipt does NOT say ──
  *
@@ -46,36 +40,13 @@
  * where the pane actually landed is a separate query against the stable pane id, and it belongs
  * to acceptance, not to the product's launch receipt.
  */
-import { statSync } from "node:fs";
-import path from "node:path";
+import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
 import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, } from "./mux-launch.js";
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
 /** The fixed runtime a resume reopens. Only pi stands a control socket up, so only pi has a
  * same-id resume at all — the backend boundary is enforced upstream by
  * `resolveResumeLaunchIdentity`, and this constant is the mux half of the same fact. */
 export const RESUME_CALL_RUNTIME = "pi";
-/**
- * Classify a candidate start directory. Split into three reasons rather than one because the
- * operator's next move differs: an absolute-path bug is a caller defect, a missing directory is
- * a moved/deleted project, and a `#` is a path tmux would rewrite under us.
- */
-export function classifyResumeCwd(cwd) {
-    if (!path.isAbsolute(cwd))
-        return "cwd-not-absolute";
-    // tmux expands formats inside the `-c` VALUE. `#{…}` rewrote the path silently and `#(…)`
-    // was observed executing; neither is something to escape our way out of.
-    if (cwd.includes("#"))
-        return "cwd-format-token";
-    let st;
-    try {
-        st = statSync(cwd);
-    }
-    catch {
-        // tmux would NOT report this — it opens the window and lands the child in $HOME.
-        return "cwd-missing";
-    }
-    return st.isDirectory() ? null : "cwd-not-directory";
-}
 /**
  * Launch argv: the leaf's detached-append shape plus `-c`, the runtime, then the caller's flags.
  * `--` is what keeps tmux from reading the runtime or its flags as tmux options.
@@ -83,7 +54,7 @@ export function classifyResumeCwd(cwd) {
 export function buildResumeCallArgs(placement, cwd, runtimePath, runtimeArgs) {
     assertSelector("session", placement.sessionId);
     assertLaunchTarget(runtimePath);
-    const bad = classifyResumeCwd(cwd);
+    const bad = classifyTmuxCwd(cwd);
     if (bad)
         throw new Error(`mux-resume-call: refusing to build argv with an unusable cwd (${bad}): ${cwd}`);
     return [
@@ -110,7 +81,7 @@ export function buildResumeCallArgs(placement, cwd, runtimePath, runtimeArgs) {
  * `runtimeArgs` is passed through untouched. This module does not know what `--session` means.
  */
 export function resumeCall(params, env = process.env) {
-    const badCwd = classifyResumeCwd(params.cwd);
+    const badCwd = classifyTmuxCwd(params.cwd);
     if (badCwd)
         return { ok: false, reason: badCwd };
     let runtimePath;

package/mcp/entwurf-bridge/dist/scripts/doctor-pi-provider.js

@@ -1,10 +1,23 @@
 #!/usr/bin/env node
 // doctor-pi-provider — fail-loud doctor for the pi provider (entwurfProvider.mcpServers.
-// entwurf-bridge) ownership (#46 Task 2). Side-effect FREE (read-only). Uses the config.ts SSOT
+// entwurf-bridge) ownership (#46 Task 2). A BOUNDED BOOT PROBE, not a static inspector: it writes
+// no operator state, but it does exec the configured command on this host (#81). Uses the config.ts SSOT
 // `readProviderSettingsFile` so the effective (shadow-resolved) view matches what pi actually
 // loads — NOT a re-implemented merge (GPT D: a python re-impl drifts into "doctor green, runtime
 // red"). Reports user / project / EFFECTIVE command (project shadows user per-name, the
-// resolveProviderConfig rule), plus install-state ownership, and gates on stable-bin resolvability.
+// resolveProviderConfig rule), plus install-state ownership, and gates on the stable bin actually
+// BOOTING (#81) — not merely resolving. `command -v` answering yes is not evidence that pi gets a
+// bridge: on the reference host the bare name resolved through a relocated pnpm shim whose $0-derived
+// target did not exist, so the launcher exited 127, the ACP turn had no mcp__entwurf-bridge__* tool,
+// and THIS doctor still printed ok. Resolvability is kept as the first, cheaper cell so the two
+// failures stay distinguishable (nothing on PATH vs. on PATH but dead).
+//
+// The probe sends `initialize` + `tools/list` only — never a `tools/call` — so it takes no lock,
+// writes no record and delivers nothing. That bounds OUR bridge tightly (start.sh is an `exec node`,
+// so there is no grandchild). It does not make the doctor side-effect free in general: whatever the
+// operator configured is what gets executed, and a foreign launcher's own startup is its own
+// business. Running this doctor is therefore a decision to run that command. See
+// probe-bridge-command.ts, which owns the bounded reap of the child it spawns.
 //
 // Env overrides (for the hermetic smoke):
 //   PI_PROVIDER_GLOBAL_SETTINGS   default: $PI_CODING_AGENT_DIR/settings.json or ~/.pi/agent/settings.json
@@ -12,12 +25,13 @@
 //   PI_PROVIDER_STATE             default: $XDG_DATA_HOME/entwurf/pi-provider/install-state.json
 //
 // Exit: 0 ok (incl. honest "never installed / unowned" notes) · 1 hard fail (malformed settings /
-// state-owned-but-drifted / stable bin dangling).
-import { execSync } from "node:child_process";
-import { existsSync, constants as FS, readFileSync, statSync } from "node:fs";
+// state-owned-but-drifted / stable bin dangling / stable bin present but does NOT boot).
+import { execFileSync } from "node:child_process";
+import { accessSync, existsSync, constants as FS, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { readProviderSettingsFile } from "../pi-extensions/lib/acp/config.js";
+import { normalizeMcpServers, readProviderSettingsFile } from "../pi-extensions/lib/acp/config.js";
+import { probeBridgeCommand } from "./probe-bridge-command.js";
 const BARE = "entwurf-bridge";
 const KEY = "entwurf-bridge";
 const home = homedir();
@@ -28,29 +42,64 @@ const xdg = process.env.XDG_DATA_HOME || join(home, ".local", "share");
 const statePath = process.env.PI_PROVIDER_STATE || join(xdg, "entwurf", "pi-provider", "install-state.json");
 let hardFail = 0;
 const log = (s) => process.stdout.write(s + "\n");
-function commandOf(settings) {
-    const entry = settings.mcpServers?.[KEY];
-    if (entry && typeof entry === "object" && typeof entry.command === "string") {
-        return entry.command;
-    }
-    return undefined;
+// Build the effective entry EXACTLY the way production does (config.ts `resolveProviderConfig`):
+// a shallow PER-NAME merge of the two `mcpServers` maps, then ONE `normalizeMcpServers` over the
+// merged map. Hand-parsing command/args (this doctor's first shape) dropped a malformed arg
+// silently and probed an invocation production never runs.
+//
+// The ORDER is load-bearing too. Normalizing each file separately validates entries production
+// never sees: a malformed server in the global map that the project map shadows is gone by the time
+// pi normalizes, yet a per-file doctor throws on it and calls a session red that in fact starts
+// fine. That is the same "the doctor's subject differs from the runtime's" defect as the silent
+// arg-drop, pointed the other way — and it is not confined to our key, since any unrelated global
+// server could trip it.
+//
+// THROWS (McpServerConfigError) when the MERGED map is malformed — the fail-loud path, caught by
+// the caller. That error names the offending SERVER and reason, not a file: after the merge an
+// entry no longer belongs to one scope, so claiming a filename here would be a guess. A non-stdio
+// (http/sse) entry is returned as `null` so the caller can say WHY it cannot be probed instead of
+// pretending it is absent.
+function mergedBridgeEntry(globalSettings, projectSettings) {
+    const mergedRaw = { ...(globalSettings.mcpServers ?? {}), ...(projectSettings.mcpServers ?? {}) };
+    const { servers } = normalizeMcpServers(mergedRaw);
+    const entry = servers.find((srv) => srv.name === KEY);
+    if (entry === undefined)
+        return undefined; // not configured in either scope
+    if ("url" in entry)
+        return null; // http/sse — a real config, but nothing to spawn
+    return {
+        command: entry.command,
+        args: entry.args,
+        // The ACP wire shape is a name/value list; collapse it to the env map a spawn wants.
+        env: Object.fromEntries(entry.env.map((kv) => [kv.name, kv.value])),
+    };
+}
+// Per-scope DISPLAY only — never validation. The scope lines exist so an operator can see which
+// file supplied the effective entry; judging shape here would re-introduce the per-file validation
+// the merge rule above exists to avoid.
+function describeScope(settings) {
+    const raw = settings.mcpServers?.[KEY];
+    if (raw === undefined)
+        return "entwurf-bridge NOT configured";
+    const cmd = raw?.command;
+    return typeof cmd === "string" ? `'${cmd}'` : "configured (shape judged in the merged view)";
 }
 // Does the command resolve in the environment (best local proxy for "where pi/agy runs")?
 // A bare name is looked up on PATH; a path must be an executable file.
 function resolvable(cmd) {
     if (cmd.includes("/")) {
         try {
-            statSync(cmd);
-            // eslint-disable-next-line no-bitwise
-            return (statSync(cmd).mode & FS.S_IXUSR) !== 0;
+            accessSync(cmd, FS.X_OK);
+            return true;
         }
         catch {
             return false;
         }
     }
     try {
-        // `command -v` is a POSIX sh builtin; use the default /bin/sh (NixOS has no /bin/bash).
-        execSync(`command -v ${cmd}`, { stdio: "ignore" });
+        // `command -v` is a POSIX sh builtin. Pass the configured name as argv, never shell text:
+        // an unowned override is still operator data and must not become a doctor injection surface.
+        execFileSync("sh", ["-c", 'command -v -- "$1" >/dev/null 2>&1', "sh", cmd], { stdio: "ignore" });
         return true;
     }
     catch {
@@ -59,23 +108,39 @@ function resolvable(cmd) {
 }
 log("[pi-provider doctor]");
 // Read via the SSOT — a malformed settings file THROWS here (fail-loud, named file).
-let userCmd;
-let projCmd;
+let effectiveEntry;
+let userScopeDesc = "";
+let projScopeDesc = "";
+let effectiveScope = "none";
 try {
-    userCmd = commandOf(readProviderSettingsFile(globalPath).settings);
-    projCmd = commandOf(readProviderSettingsFile(projectPath).settings);
+    const userSettings = readProviderSettingsFile(globalPath).settings;
+    const projSettings = readProviderSettingsFile(projectPath).settings;
+    userScopeDesc = describeScope(userSettings);
+    projScopeDesc = describeScope(projSettings);
+    // EFFECTIVE = project shadows user per-NAME. The whole ENTRY shadows, not a field of it, so
+    // command, args and env always come from one scope; the scope label is decided by which map
+    // owns the key, which is exactly what the merge spread resolves.
+    effectiveEntry = mergedBridgeEntry(userSettings, projSettings);
+    const ownsKey = (m) => m !== undefined && Object.hasOwn(m, KEY);
+    effectiveScope = ownsKey(projSettings.mcpServers)
+        ? "project"
+        : ownsKey(userSettings.mcpServers)
+            ? "user(global)"
+            : "none";
 }
 catch (err) {
     log(`  FAIL: ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
 }
-// EFFECTIVE = project shadows user per-name (the resolveProviderConfig merge rule).
-const effectiveCmd = projCmd ?? userCmd;
-const effectiveScope = projCmd !== undefined ? "project" : userCmd !== undefined ? "user(global)" : "none";
+const effectiveDesc = effectiveEntry === undefined
+    ? "entwurf-bridge NOT configured"
+    : effectiveEntry === null
+        ? "configured as an http/sse server"
+        : `'${effectiveEntry.command}'`;
 log("── scopes (project shadows user per-name)");
-log(`  user(global) ${globalPath}: ${userCmd ? `'${userCmd}'` : "entwurf-bridge NOT configured"}`);
-log(`  project      ${projectPath}: ${projCmd ? `'${projCmd}'` : "entwurf-bridge NOT configured"}`);
-log(`  EFFECTIVE (${effectiveScope}): ${effectiveCmd ? `'${effectiveCmd}'` : "none"}`);
+log(`  user(global) ${globalPath}: ${userScopeDesc}`);
+log(`  project      ${projectPath}: ${projScopeDesc}`);
+log(`  EFFECTIVE (${effectiveScope}): ${effectiveDesc}`);
 // install-state ownership (user scope). absent state on a configured effective is either a
 // pre-Task-2 install or a user-override we deliberately did not own.
 let ownership;
@@ -94,33 +159,60 @@ else {
     log("  state: no user-scope install-state.");
 }
 log("── verdict");
-if (effectiveCmd === undefined) {
+if (effectiveEntry === undefined) {
     log("  note: no entwurfProvider.mcpServers.entwurf-bridge in any scope (never installed — this is the '?'; run ./run.sh setup).");
 }
-else if (effectiveCmd === BARE) {
-    if (resolvable(effectiveCmd)) {
-        log(`  ok: effective command is the bare stable bin '${BARE}' and it RESOLVES.`);
-    }
-    else {
-        log(`  FAIL: effective command is '${BARE}' but it does NOT resolve (run ./run.sh expose-dev-bin / npm bin-link).`);
-        hardFail = 1;
-    }
+else if (effectiveEntry === null) {
+    // A real, well-formed config that this bridge cannot be: entwurf-bridge is a stdio server, so
+    // an http/sse entry under our key means pi would connect to something that is not us. Nothing
+    // here is spawnable, so there is no boot to prove — say that plainly rather than reporting the
+    // absence of a failure as ok.
+    log(`  FAIL: entwurf-bridge is configured as an http/sse server in ${effectiveScope} scope. This bridge is a stdio server — pi would reach something that is not entwurf, and no boot evidence is possible. Restore a stdio entry with ./run.sh setup, or remove the key if the override is deliberate.`);
+    hardFail = 1;
 }
 else {
-    // effective is NOT the bare bin. If state says we own it → drift (FAIL). Otherwise classify
-    // the effective command honestly: our OWN legacy repo start.sh (not yet adopted) is NOT a
-    // user override — say so distinctly so "run setup" is the clear next step. A truly foreign
-    // command is an unowned override left as the operator's choice. Neither is a hard fail.
-    const isLegacyManaged = effectiveCmd.endsWith("/entwurf/mcp/entwurf-bridge/start.sh");
-    if (ownership && ownership !== "user-override") {
-        log(`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${effectiveCmd}'.`);
+    const cmd = effectiveEntry.command;
+    const isBare = cmd === BARE;
+    const isLegacyManaged = cmd.endsWith("/entwurf/mcp/entwurf-bridge/start.sh");
+    // Runtime truth is independent of ownership truth. An unowned override remains the operator's
+    // choice, but it still shadows the stable bridge in production; calling a dead override green
+    // repeats #81 under a different spelling. Probe the exact normalized command + args + env for
+    // EVERY effective stdio entry, then classify who owns that entry separately below.
+    if (!resolvable(cmd)) {
+        log(`  FAIL: effective command '${cmd}' does NOT resolve or is not executable.`);
         hardFail = 1;
     }
-    else if (isLegacyManaged) {
-        log(`  note: effective is our LEGACY managed repo path ('${effectiveCmd}'), not yet adopted to the bare stable bin. Run ./run.sh setup to normalize (this is the pre-Task-2 '?').`);
-    }
     else {
-        log(`  note: entwurf-bridge is an UNOWNED override ('${effectiveCmd}') — effective is not the stable bin. Left as the operator's choice (run ./run.sh setup to adopt the bare bin).`);
+        log(`  effective command '${cmd}' RESOLVES — probing the exact configured invocation…`);
+        const probe = await probeBridgeCommand({
+            command: cmd,
+            args: effectiveEntry.args,
+            env: { ...process.env, ...effectiveEntry.env },
+        });
+        if (probe.ok) {
+            log(isBare
+                ? `  ok: effective command is the bare stable bin '${BARE}' and it BOOTS — ${probe.detail}`
+                : `  runtime: configured override BOOTS — ${probe.detail}`);
+        }
+        else {
+            log(`  FAIL: effective invocation does NOT serve MCP [${probe.reason}] — ${probe.detail}`);
+            log(`         Diagnose its launcher and configured args/env; entwurf will not overwrite an unowned command.`);
+            hardFail = 1;
+        }
+    }
+    if (!isBare) {
+        // Ownership classification never rounds a broken runtime up to green. It only says who may
+        // repair the non-canonical entry after the independent boot verdict above.
+        if (ownership && ownership !== "user-override") {
+            log(`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${cmd}'.`);
+            hardFail = 1;
+        }
+        else if (isLegacyManaged) {
+            log(`  note: effective is our LEGACY managed repo path ('${cmd}'), not yet adopted to the bare stable bin. Run ./run.sh setup to normalize.`);
+        }
+        else {
+            log(`  note: entwurf-bridge is an UNOWNED override ('${cmd}'). Runtime was judged above; run ./run.sh setup only if you choose to adopt the bare stable bin.`);
+        }
     }
 }
 if (hardFail) {