@junghanacs/entwurf 0.14.0 → 0.14.2

package/mcp/entwurf-bridge/dist/scripts/probe-bridge-command.js

@@ -0,0 +1,294 @@
+#!/usr/bin/env node
+// probe-bridge-command — does the EFFECTIVE bridge command actually BOOT and serve MCP?
+//
+// WHY THIS EXISTS (#81): every doctor that judged the bridge wiring asked only whether the
+// configured command RESOLVES — `command -v <bare name>` for pi (doctor-pi-provider) and agy
+// (agy-bridge.sh). Resolvability is not bootability, and the gap is not theoretical: on the
+// reference host `~/.local/bin/entwurf-bridge` was a symlink to the canonical pnpm shim, and
+// that shim derives its target from `$0`. Invoked through the relocated link the derived
+// `../global/...` path does not exist, so the launcher exits 127 and the MCP child never boots
+// — while `command -v` kept answering yes and both doctors kept printing ok. The model in a
+// Pi-hosted ACP turn then had no `mcp__entwurf-bridge__*` tool at all, which is a direct
+// violation of #81's minimum core value (explicit Entwurf bridge connectivity).
+//
+// So this leaf asks the only question that carries the claim: run the command, speak MCP to it,
+// and require the entwurf tool surface back. A green here is about the command the harness
+// actually execs — never a recomputed desired one (the same rule meta-bridge-doctor's delivery
+// self-diagnostic already states for the Claude lane).
+//
+// SIDE EFFECTS: none on operator state. Only `initialize` + `tools/list` are sent — never a
+// `tools/call` — so no lock is taken, no record is written, and no message is delivered. The
+// child is killed as soon as the frame arrives or the deadline passes. This is what makes the
+// probe affordable inside a doctor an operator runs repeatedly.
+//
+// USAGE
+//   library:  const r = await probeBridgeCommand({ command, args });   // doctor-pi-provider.ts
+//   CLI:      node probe-bridge-command.ts <command> [args...]
+//             node probe-bridge-command.ts --invocation-json '{"command":"…","args":[],"env":{}}'
+//             exit 0 = booted and served the entwurf tool surface; 1 = did not (reason on stdout).
+import { spawn } from "node:child_process";
+import { basename } from "node:path";
+// The EXACT public verb set of the current bridge. Identity is the whole set, not one member:
+// the #81 symptom was a session whose schema lacked `entwurf_self` specifically, and a probe that
+// only looked for `entwurf_v2` would have called that host healthy. Exactness also catches the
+// other direction — a STALE build still serving a retired verb, or a foreign binary that happens
+// to expose an `entwurf_v2`. check-entwurf-bridge-boot binds this list to the real runtime
+// tools/list, so a verb added or retired without updating it turns that gate red.
+export const EXPECTED_TOOLS = [
+    "entwurf_v2",
+    "entwurf_self",
+    "entwurf_peers",
+    "entwurf_inbox_read",
+    "entwurf_register_native",
+    "entwurf_fresh_call",
+    "entwurf_resume_call",
+];
+const DEFAULT_TIMEOUT_MS = 10_000;
+/** How long a probed child gets to die politely before it is killed outright. */
+const CLEANUP_GRACE_MS = 500;
+/** Collapse captured stderr into one printable line — a doctor verdict must stay one line. */
+function head(text, limit = 200) {
+    const flat = text.replace(/\s+/g, " ").trim();
+    return flat.length > limit ? `${flat.slice(0, limit)}…` : flat;
+}
+export function probeBridgeCommand(opts) {
+    const { command, args = [], env, timeoutMs = DEFAULT_TIMEOUT_MS } = opts;
+    return new Promise((resolve) => {
+        // No shell: a bare name goes through the normal PATH lookup the harness itself does,
+        // and an argument can never be reinterpreted as shell syntax.
+        const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], env });
+        // `write()` reports a synchronous closed pipe by throwing, but a launcher that dies on exec
+        // closes stdin under us and the resulting EPIPE arrives ASYNCHRONOUSLY, as an 'error' event on
+        // the stream. Unlistened, Node turns that into an uncaught exception, so the probe dies
+        // printing its own stack trace INSTEAD of the launcher's stderr: precisely the diagnosis #81
+        // exists to surface, destroyed in the one cell that needs it. The window is real, not
+        // theoretical — under CPU contention the child can exec, write its stderr and exit between
+        // uv_spawn and our first write, which is how CI saw a doctor verdict with no launcher stderr
+        // in it. The `close` handler owns the verdict for that child (with captured stderr), so this
+        // listener is installed before anything can write and stays deliberately silent — one reason
+        // per failure, never an unhandled probe crash.
+        child.stdin.on("error", () => { });
+        let stdoutPending = "";
+        let stderr = "";
+        let settled = false;
+        let initialized = false;
+        let exited;
+        let stderrEnded = false;
+        // This probe deliberately runs whatever command the operator configured — including a
+        // foreign or broken one — so it owns closing what it opened. Escalate SIGTERM → SIGKILL
+        // once, bounded: cleanup for THIS child, not a supervisor (no retries, no watching, no
+        // process-tree walking).
+        //
+        // The reap is AWAITED before the result resolves, and that ordering is load-bearing: the
+        // callers are doctors that print a verdict and `process.exit()` immediately, which tears
+        // down any still-pending timer. A fire-and-forget SIGTERM plus a deferred SIGKILL would
+        // therefore leave a TERM-ignoring launcher running after the doctor is gone — the probe
+        // would leak exactly the kind of broken process it exists to detect.
+        const reap = () => new Promise((finished) => {
+            if (child.exitCode !== null || child.signalCode !== null)
+                return finished();
+            let reaped = false;
+            let hard;
+            const finish = () => {
+                if (reaped)
+                    return;
+                reaped = true;
+                if (hard)
+                    clearTimeout(hard);
+                finished();
+            };
+            child.once("close", finish);
+            try {
+                child.kill("SIGTERM");
+            }
+            catch {
+                return finish(); // already gone
+            }
+            hard = setTimeout(() => {
+                try {
+                    child.kill("SIGKILL");
+                }
+                catch { }
+                // SIGKILL cannot be trapped, so `close` follows. The outer bound exists only so a
+                // child already reaped by someone else can never hang this promise forever.
+                setTimeout(finish, CLEANUP_GRACE_MS);
+            }, CLEANUP_GRACE_MS);
+        });
+        const done = (reason, detail) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            void reap().then(() => resolve({ ok: reason === "ok", reason, detail }));
+        };
+        const timer = setTimeout(() => {
+            const waitingFor = initialized ? "tools/list" : "initialize";
+            done("timeout", `'${command}' stayed up but never answered ${waitingFor} within ${timeoutMs}ms` +
+                (stderr.trim() ? ` — stderr: ${head(stderr)}` : ""));
+        }, timeoutMs);
+        child.on("error", (err) => {
+            done("spawn-failed", `'${command}' could not be executed: ${String(err)}`);
+        });
+        // `ChildProcess` close is normally after the stdio pipes close, but under nested shell
+        // capture that ordering has raced on this host. Do not mint a no-stderr diagnosis until the
+        // stderr reader ended: the launcher's own final diagnostic is part of the operator verdict.
+        const reportExited = () => {
+            if (!exited || !stderrEnded)
+                return;
+            // Reaching here un-settled means the process died before answering id:2. This is the
+            // cell the relocated pnpm shim lands in (exit 127), and the stderr head is what tells
+            // the operator WHICH launcher hop broke.
+            done("exited-before-tools-list", `'${command}' exited before answering tools/list (code=${exited.code} signal=${String(exited.signal)})` +
+                (stderr.trim() ? ` — stderr: ${head(stderr)}` : " — no stderr"));
+        };
+        child.on("close", (code, signal) => {
+            exited = { code, signal };
+            reportExited();
+        });
+        child.stderr.on("data", (d) => {
+            stderr += String(d);
+        });
+        child.stderr.on("end", () => {
+            stderrEnded = true;
+            reportExited();
+        });
+        child.stdout.on("data", (d) => {
+            const chunk = String(d);
+            stdoutPending += chunk;
+            if (settled)
+                return;
+            // MCP frames are newline-delimited JSON-RPC. Consume each complete frame exactly once:
+            // replaying the accumulated id:1 response on a later data event would send a second
+            // tools/list before the first reply and stop being a sequential handshake.
+            const frames = stdoutPending.split("\n");
+            stdoutPending = frames.pop() ?? "";
+            for (const line of frames) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                let msg;
+                try {
+                    msg = JSON.parse(trimmed);
+                }
+                catch {
+                    continue;
+                }
+                if (msg?.id === 1) {
+                    const result = msg.result;
+                    const valid = msg.error === undefined &&
+                        result?.protocolVersion === "2024-11-05" &&
+                        typeof result.capabilities === "object" &&
+                        result.capabilities !== null &&
+                        typeof result.serverInfo === "object" &&
+                        result.serverInfo !== null;
+                    if (!valid) {
+                        done("initialize-failed", `'${command}' returned an invalid MCP initialize response`);
+                        return;
+                    }
+                    initialized = true;
+                    sendReadyFrames();
+                    continue;
+                }
+                if (msg?.id !== 2)
+                    continue;
+                if (!initialized) {
+                    done("initialize-failed", `'${command}' answered tools/list before MCP initialize completed`);
+                    return;
+                }
+                const tools = msg?.result?.tools;
+                if (!Array.isArray(tools)) {
+                    done("no-tools-array", `'${command}' answered tools/list without result.tools — not an MCP server`);
+                    return;
+                }
+                const names = tools
+                    .map((t) => t?.name)
+                    .filter((n) => typeof n === "string");
+                const served = new Set(names);
+                const missing = EXPECTED_TOOLS.filter((t) => !served.has(t));
+                const unexpected = names.filter((n) => !EXPECTED_TOOLS.includes(n));
+                if (missing.length > 0 || unexpected.length > 0) {
+                    // Name BOTH directions: a missing verb is the #81 symptom (the model had no
+                    // entwurf_self), an unexpected one means this is not the bridge we ship.
+                    const parts = [];
+                    if (missing.length > 0)
+                        parts.push(`missing ${missing.join(", ")}`);
+                    if (unexpected.length > 0)
+                        parts.push(`unexpected ${unexpected.join(", ")}`);
+                    done("tool-set-mismatch", `'${command}' is an MCP server but does not serve this bridge's verb set — ${parts.join("; ")} (served: ${names.join(", ") || "none"})`);
+                    return;
+                }
+                done("ok", `'${command}' booted and served the exact entwurf verb set (${EXPECTED_TOOLS.length} tools)`);
+                return;
+            }
+        });
+        const send = (obj) => {
+            try {
+                child.stdin.write(`${JSON.stringify(obj)}\n`);
+            }
+            catch {
+                // Synchronous throws (a destroyed stream) land here; async EPIPE lands on the
+                // listener above. Both are the same verdict-free silence.
+            }
+        };
+        const sendReadyFrames = () => {
+            send({ jsonrpc: "2.0", method: "notifications/initialized" });
+            send({ jsonrpc: "2.0", id: 2, method: "tools/list" });
+        };
+        send({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "initialize",
+            params: {
+                protocolVersion: "2024-11-05",
+                capabilities: {},
+                clientInfo: { name: "probe-bridge-command", version: "0" },
+            },
+        });
+    });
+}
+// CLI entrypoint. Kept argv-driven (no env carrier) so `./run.sh probe-bridge-command entwurf-bridge`
+// asks about exactly the name an operator typed, and a doctor can shell out to the same verdict.
+// Match the BASENAME exactly. A suffix test would also fire for `check-probe-bridge-command.ts`,
+// which imports this module — the CLI arm would then hijack that gate's argv and exit 2.
+if (process.argv[1] && /^probe-bridge-command\.(ts|js)$/.test(basename(process.argv[1]))) {
+    const argv = process.argv.slice(2);
+    let options;
+    if (argv[0] === "--invocation-json") {
+        let raw;
+        try {
+            raw = JSON.parse(argv[1] ?? "");
+        }
+        catch {
+            console.error("probe-bridge-command: --invocation-json must be valid JSON");
+            process.exit(2);
+        }
+        const obj = raw;
+        if (typeof obj?.command !== "string" ||
+            !obj.command ||
+            !Array.isArray(obj.args) ||
+            !obj.args.every((arg) => typeof arg === "string") ||
+            typeof obj.env !== "object" ||
+            obj.env === null ||
+            Array.isArray(obj.env) ||
+            !Object.values(obj.env).every((value) => typeof value === "string")) {
+            console.error("probe-bridge-command: invocation JSON requires string command, string[] args, string-map env");
+            process.exit(2);
+        }
+        options = {
+            command: obj.command,
+            args: obj.args,
+            env: { ...process.env, ...obj.env },
+        };
+    }
+    else {
+        const [command, ...args] = argv;
+        if (!command) {
+            console.error("usage: probe-bridge-command <command> [args...]");
+            process.exit(2);
+        }
+        options = { command, args };
+    }
+    const result = await probeBridgeCommand(options);
+    console.log(`[probe-bridge-command] ${result.reason}: ${result.detail}`);
+    process.exit(result.ok ? 0 : 1);
+}

package/mcp/entwurf-bridge/src/index.ts

@@ -26,7 +26,8 @@
  *                       this read is the receipt.
  *   - entwurf_register_native — explicit/manual fallback binding an ALREADY-RUNNING native
  *                       conversation (antigravity) to a garden id. Never a spawn.
- *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session;
+ *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session,
+ *                       optionally at ONE literal requested cwd (cross-repo fresh, #73);
  *                       returns a LAUNCH receipt only, and the new address arrives later as the
  *                       sender envelope of the sibling's nonce callback.
  *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
@@ -661,8 +662,10 @@ server.tool(
 		"else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
 		"for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
 		"citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
-		"is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code); there are no " +
-		"arbitrary command/cwd/env knobs. Do not put secrets in the task — model and task argv are visible to " +
+		"is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code). An optional " +
+		"cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
+		"for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
+		"There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
 		"same-user processes on this host. Requires that this agent itself runs " +
 		"inside tmux: without a pane anchor there is no session to open a sibling beside.",
 	{
@@ -690,8 +693,14 @@ server.tool(
 			.describe(
 				"What the sibling should do after it calls you back. Plain instructions; no secrets (see the tool description).",
 			),
+		cwd: z
+			.string()
+			.optional()
+			.describe(
+				"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation.",
+			),
 	},
-	async ({ backend, model, task }) => {
+	async ({ backend, model, task, cwd }) => {
 		let callerGardenId: string | null = null;
 		try {
 			const self = await buildAuthoritativeSelfEnvelope();
@@ -708,7 +717,7 @@ server.tool(
 			callerGardenId = null;
 		}
 		try {
-			const rendered = renderFreshCall(freshCall({ backend, model, task, callerGardenId }));
+			const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, callerGardenId }));
 			return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
 		} catch (err) {
 			return textErr(`entwurf_fresh_call error: ${err instanceof Error ? err.message : String(err)}`);

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -42,13 +42,16 @@
 	//
 	// It is a TYPE closure, not a boot closure, and the difference is shipped bytes.
 	// The retired claim here ("the pi-lane-only acp/* stays out of the tarball") is
-	// FALSE: dist/pi-extensions/lib/acp/ carries 8 modules (acp-client, backend-adapter,
-	// config, context, engraving, models, overlay, tool-surface) that no bridge code
-	// path executes — tsc followed a type reference and emitted them. Dead emit is a
+	// FALSE: dist/pi-extensions/lib/acp/ is not a boot closure. config.js IS reached —
+	// doctor-pi-provider (#81) value-imports it. The other 7 modules (acp-client,
+	// backend-adapter, context, engraving, models, overlay, tool-surface) execute on
+	// no bridge/operator path: tsc followed config.ts's `import type { AcpBackendAdapter }`
+	// and emitted backend-adapter.js, which value-imports the rest. Dead emit is a
 	// correctness question only for anything that reads its own location (see the
-	// registry corpse), but it is dead weight in every consumer's tarball. Cleanup is
+	// registry corpse), but the 7 are dead weight in every consumer's tarball. Cleanup is
 	// tracked as a follow-up, and the choice is one of two: narrow the emit, or ship
-	// the assets those modules expect. Do NOT restore the old sentence.
+	// the assets those modules expect. Do NOT restore the old sentence, and do NOT
+	// put config.js back on the dead list.
 	//
 	// WHY store-doctor rides THIS build: meta-bridge-doctor.sh's full store scan
 	// must run from an INSTALLED package (under node_modules, where strip-types is
@@ -86,6 +89,12 @@
 	// and run_ts refuses them under an installed package rather than emitting 70+
 	// gate leaves into the tarball.
 	//
+	// WHY probe-bridge-command rides this build (#81): doctor-pi-provider IMPORTS it, and that
+	// doctor is one of the three operator commands above — so on an installed host the import
+	// resolves under node_modules where strip-types is refused. Emitting the leaf keeps the
+	// installed doctor's new boot cell alive; a missing twin would kill the doctor before its
+	// first verdict line. Its only imports are node builtins, so it adds ZERO new deps.
+	//
 	// WHY meta-facts rides this build (#65): it is the operator projection external
 	// consumers call INSTEAD of parsing the store, and those consumers live on
 	// INSTALLED hosts — under node_modules, where run_ts needs a compiled twin.
@@ -107,6 +116,7 @@
 		"../../scripts/meta-bridge-store-doctor.ts",
 		"../../scripts/agy-imprint.ts",
 		"../../scripts/doctor-pi-provider.ts",
+		"../../scripts/probe-bridge-command.ts",
 		"../../scripts/new-session-id.ts",
 		"../../scripts/meta-bridge-prune.ts",
 		"../../scripts/meta-bridge-fresh-cut.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.14.0",
+	"version": "0.14.2",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -74,23 +74,23 @@
 		"claudeCodeFloor": ">=2.1.217"
 	},
 	"dependencies": {
-		"@agentclientprotocol/claude-agent-acp": "0.66.0",
+		"@agentclientprotocol/claude-agent-acp": "0.70.0",
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@anthropic-ai/sdk": "0.100.1",
 		"@modelcontextprotocol/sdk": "^1.12.1",
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": ">=0.84.1 <0.85",
-		"@earendil-works/pi-coding-agent": ">=0.84.1 <0.85",
-		"@earendil-works/pi-tui": ">=0.84.1 <0.85",
+		"@earendil-works/pi-ai": ">=0.84.2 <0.85",
+		"@earendil-works/pi-coding-agent": ">=0.84.2 <0.85",
+		"@earendil-works/pi-tui": ">=0.84.2 <0.85",
 		"typebox": "*"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
-		"@earendil-works/pi-ai": "0.84.1",
-		"@earendil-works/pi-coding-agent": "0.84.1",
-		"@earendil-works/pi-tui": "0.84.1",
+		"@earendil-works/pi-ai": "0.84.2",
+		"@earendil-works/pi-coding-agent": "0.84.2",
+		"@earendil-works/pi-tui": "0.84.2",
 		"@types/node": "^24.3.0",
 		"husky": "^9.1.7",
 		"rregex": "1.13.1",
@@ -145,7 +145,7 @@
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface",
 		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment",
-		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
+		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {

package/pi-extensions/entwurf-control.ts

@@ -1489,7 +1489,7 @@ const MUX_FRESH_CALL_MODULE = "./lib/mux-fresh-call.ts";
 
 interface MuxFreshCallModule {
 	freshCall(
-		params: { backend: "pi" | "claude-code"; model: string; task: string; callerGardenId: string | null },
+		params: { backend: "pi" | "claude-code"; model: string; task: string; cwd?: string; callerGardenId: string | null },
 		env?: NodeJS.ProcessEnv,
 	): { ok: boolean };
 	renderFreshCall(result: { ok: boolean }): { text: string; isError: boolean };
@@ -1520,8 +1520,10 @@ not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus tha
 it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls for the
 callback; if it never arrives the window is visible and can be read directly. For EXISTING citizens use
 entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and passed to the
-chosen runtime CLI (provider/model for pi; model id/alias for Claude Code); there are no arbitrary
-command/cwd/env knobs. Do not put secrets in the task — model and task argv are visible to same-user
+chosen runtime CLI (provider/model for pi; model id/alias for Claude Code). An optional cwd starts the
+sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume for a dormant
+record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. There are no
+arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to same-user
 processes on this host.`,
 		parameters: Type.Object({
 			backend: StringEnum(["pi", "claude-code"], {
@@ -1539,10 +1541,16 @@ processes on this host.`,
 				description:
 					"What the sibling should do after it calls you back. Plain instructions; no secrets (see the tool description).",
 			}),
+			cwd: Type.Optional(
+				Type.String({
+					description:
+						"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation.",
+				}),
+			),
 		}),
 		async execute(
 			_toolCallId: string,
-			params: { backend: "pi" | "claude-code"; model: string; task: string },
+			params: { backend: "pi" | "claude-code"; model: string; task: string; cwd?: string },
 			_signal: AbortSignal | undefined,
 			_onUpdate: unknown,
 			_ctx: ExtensionContext,
@@ -1553,6 +1561,7 @@ processes on this host.`,
 					backend: params.backend,
 					model: params.model,
 					task: params.task,
+					cwd: params.cwd,
 					callerGardenId: residentGardenId,
 				});
 				const rendered = mux.renderFreshCall(result);