@junghanacs/entwurf 0.14.2 → 0.15.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -46,26 +46,47 @@
  */
 import { randomBytes } from "node:crypto";
 import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
+import { COPILOT_PREFLIGHT_HINT, copilotFreshPreflight, } from "./copilot-fresh-preflight.js";
 import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, } from "./mux-launch.js";
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
-/** The two backends this rail can open. Fixed set, not a profile — a third one is a decision,
- * not a config entry. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code"];
-/** The fixed runtime each backend resolves on PATH. Same reason `mux-launch` uses PATH rather
+/** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
+ * not a config entry. `copilot` was added by #82 RAIL 9 under the step 9 admission contract. */
+export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot"];
+/**
+ * The fixed runtime each backend resolves on PATH. Same reason `mux-launch` uses PATH rather
  * than a compiled-in location: the official binary is whatever the operator's environment gives
- * when they type the name. */
+ * when they type the name.
+ *
+ * `copilot` resolves `entwurf`, NOT the vendor CLI, and that is the contract rather than a
+ * convenience. Step 9 clause 1 requires ONE fixed MANAGED runtime path, and a bare `copilot`
+ * is not one: it would start without the `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` token
+ * whose absence skips the extension scan SILENTLY, so the sibling would look launched and could
+ * never be delivered to. `entwurf copilot` is the accepted managed invocation that owns that
+ * flag, its recursion fence and its receiver precondition; fresh call reaches Copilot only
+ * through it. The cost is named: a Copilot fresh call needs a current `entwurf` on PATH, the
+ * way a pi fresh call needs `pi`.
+ */
 export const FRESH_CALL_RUNTIME = {
     pi: "pi",
     "claude-code": "claude",
+    copilot: "entwurf",
 };
 /**
  * The callback tool NAME differs per backend and that is not cosmetic: native pi exposes the
- * capability directly (`entwurf_v2`), while a Claude Code session reaches it through the MCP
- * bridge under its namespaced name. Naming the wrong one costs the whole first turn.
+ * capability directly (`entwurf_v2`), while an MCP-hosted session reaches it under whatever
+ * name that harness composes. Naming the wrong one costs the whole first turn.
+ *
+ * `[측정]` Copilot CLI 1.0.80 composes `<mcpServerName>-<mcpToolName>` — NOT Claude Code's
+ * `mcp__<server>__<tool>`. Read from two independent sessions' own event logs
+ * (`~/.copilot/session-state/<id>/events.jsonl`): `assistant.message.toolRequests[].name` and
+ * `tool.execution_start.toolName` both carry `entwurf-bridge-entwurf_v2`, with
+ * `mcpServerName`/`mcpToolName` beside them as the parts. Derive-and-measure, never copy a
+ * sibling's spelling (`docs/adding-a-harness.md` step 5).
  */
 export const FRESH_CALL_CALLBACK_TOOL = {
     pi: "entwurf_v2",
     "claude-code": "mcp__entwurf-bridge__entwurf_v2",
+    copilot: "entwurf-bridge-entwurf_v2",
 };
 /** Mirrors the `entwurf_v2` message bound. This is an INTERFACE cap for symmetry with the
  * delivery surface, not a claim that a task of this size was measured through tmux. An argv
@@ -88,12 +109,41 @@ export function isSafeFreshCallModel(model) {
  *                 Flag-first submitted no message; Pi rejects the equals form for `--model`.
  *   claude-code — prompt, then `--allowedTools=` and `--model=` as ONE token each. The space form
  *                 for allowedTools is variadic and eats the prompt as an option value.
+ *   copilot     — the managed VERB first, then the prompt as the value of `-i/--interactive`,
+ *                 `--model`, value as two tokens, and the policy as the explicit `--yolo`
+ *                 token. Measured from `copilot --help` (1.0.80).
  *
- * Both failures looked identical from outside: window open, record and socket minted, no turn.
+ * Both pi/claude failures looked identical from outside: window open, record and socket minted,
+ * no turn.
  *
- * The equals form is NOT a permission guarantee — on the measured host the tool was already
- * permitted, so the option's effect was unobservable. What was observed is that it does no harm
- * to the argv. Permission stays a documented host precondition.
+ * For pi and claude-code the equals form is NOT a permission guarantee — on the measured host
+ * the tool was already permitted, so the option's effect was unobservable. What was observed is
+ * that it does no harm to the argv. Permission stays a documented host precondition there.
+ *
+ * Copilot is the backend where the policy IS carried explicitly (step 9 clause 2), and three of
+ * its argv facts are load-bearing:
+ *
+ *   - `copilot` is argv[0] of the RUNTIME `entwurf`, i.e. the managed verb — see
+ *     `FRESH_CALL_RUNTIME`. Everything after it is forwarded byte-identical by
+ *     `scripts/copilot-launch.sh`.
+ *   - the prompt rides `--interactive`, never `-p/--prompt`: `-p` runs the prompt and EXITS,
+ *     which would close the window on a sibling that is supposed to stay open and be delivered
+ *     to. `--interactive <prompt>` is non-variadic, so the space form is safe here.
+ *   - the policy token is `--yolo`, STATED HERE rather than left to the launcher: the launcher
+ *     injects `--yolo` only when the argv names no policy, and step 9 clause 2 requires the
+ *     fresh composition to state its model and permission policy explicitly, never to rely
+ *     invisibly on someone else's default.
+ *
+ * `--yolo` is a GLG operator decision, not a drifted default. The first cut passed a
+ * callback-only `--allow-tool=entwurf-bridge(entwurf_v2)` grant, and GLG's 2026-08-25 operator
+ * LIVE measured the consequence: the fresh sibling's footer showed no `YOLO`, and every tool
+ * its task needed stopped on a confirmation prompt, which made the sibling impractical to work
+ * with. GLG then set the policy explicitly: a fresh Copilot sibling carries the same managed
+ * `--yolo` profile a human-typed `entwurf copilot` gets. (Copilot 1.0.80 help: `--yolo` = all
+ * tools + all paths + all URLs.) The permission GRAMMAR lesson from that first cut — Copilot's
+ * `--allow-tool` takes `<mcp-server-name>(tool-name?)`, a different dialect from the
+ * model-facing tool name — stays recorded in `docs/adding-a-harness.md` step 9's worked
+ * example; it is a measured vendor fact even though this argv no longer uses it.
  */
 export function buildBackendArgs(backend, prompt, model) {
     switch (backend) {
@@ -101,6 +151,8 @@ export function buildBackendArgs(backend, prompt, model) {
             return [prompt, "--entwurf-control", "--model", model];
         case "claude-code":
             return [prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]}`, `--model=${model}`];
+        case "copilot":
+            return ["copilot", "--interactive", prompt, "--model", model, "--yolo"];
     }
 }
 /**
@@ -204,6 +256,17 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
             return { ok: false, reason: err.reason };
         throw err;
     }
+    // Backend capability, still PRE-MUTATION (step 9 clause 3). It runs AFTER the runtime is
+    // proven, because "entwurf is not on PATH" is the more fundamental answer — telling an
+    // operator to run `entwurf install-copilot-bridge` when they have no `entwurf` at all sends
+    // them to the wrong repair. It runs BEFORE placement for the reason this whole ordering
+    // exists: a refusal here cannot leave a window behind, while the launcher's own equivalent
+    // check (receiver only, manual `entwurf copilot`) necessarily runs after one is open.
+    if (params.backend === "copilot") {
+        const missing = copilotFreshPreflight(env);
+        if (missing)
+            return { ok: false, reason: missing };
+    }
     const inspected = inspectPlacement(env);
     if (!inspected.ok)
         return { ok: false, reason: inspected.reason };
@@ -244,6 +307,9 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
 /** Why each refusal happened, in the caller's terms. A reason a caller cannot act on is a reason
  * they will guess about. */
 const REJECT_HINT = {
+    // The Copilot capability reasons keep their repair text on the leaf that decides them, so
+    // the sentence an operator reads cannot drift away from the predicate that produced it.
+    ...COPILOT_PREFLIGHT_HINT,
     "no-tmux-context": "this agent is not running inside tmux, so there is no session to open a sibling beside",
     "anchor-malformed": "TMUX_PANE is not a native pane id",
     "anchor-unresolved": "tmux resolved no pane for this agent's anchor",

package/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook-copilot.js

@@ -0,0 +1,288 @@
+/**
+ * meta-bridge-hook-copilot — the GitHub Copilot CLI native-session BIRTH entry (#82).
+ *
+ * WHAT THIS IS, AND WHAT IT DELIBERATELY IS NOT
+ *
+ * It mints, then names the minted citizen as this host's SENDER:
+ *
+ *   stdin {sessionId|session_id, cwd}   (Copilot hook envelope, either shape)
+ *     -> upsertMetaSession(copilot)     idempotent create/attach the record
+ *        -> gardenId                    the session's garden address
+ *     -> writeMetaSenderMarker(ppid)    who-sent join for this host's MCP children
+ *
+ * No receiver marker, no mailbox arm, no watchPaths — and that is still the contract now
+ * that Copilot HAS a doorbell (#82 RAIL 5). The reason changed, the rule did not. A
+ * receiver marker is a claim that a LIVE process holds a watch, and the process that holds
+ * Copilot's watch is the forked extension (`pi/copilot-receive/`), not this hook. Minted
+ * here it would name the Copilot host pid as the owner of a watch that pid does not hold,
+ * and the citizen would read deliverable, wired to nothing, for as long as the TUI stayed
+ * open. Arming belongs to the watcher; birth belongs here.
+ *
+ * THE SENDER MARKER IS A DIFFERENT FACT, AND THIS UNIT USED TO CONFLATE THEM. Until
+ * #82 RAIL 5b this file wrote no marker of EITHER kind, and gave the doorbell's
+ * absence as the reason for both. That reasoning is only valid for the receiver:
+ *
+ *   receiver marker = "a live session is ARMED to be woken"  -> needs a doorbell
+ *   sender  marker  = "who owns this MCP child process"      -> needs a shared parent
+ *
+ * `lib/meta-sender-identity.ts` states the sender join in one line — the hook writes a
+ * marker keyed by ITS parent pid, the bridge child looks one up under its own parent,
+ * and that shared ancestor IS the join key. Nothing in it consults a doorbell. So a
+ * Copilot citizen with the MCP hand installed could read (`entwurf_peers`) but never
+ * send: the bridge held the owner pid and found no marker to look up. Writing one is
+ * what closes that, and it changes exactly one thing for the receiver of a message —
+ * it learns WHO sent it.
+ *
+ * IT DOES NOT MAKE THIS CITIZEN REPLYABLE, and must never be described as if it did.
+ * `mcp/entwurf-bridge/src/index.ts` picks the reply rail from `nativePushSupported`;
+ * copilot is not native-push, so it lands in the self-fetch domain, where `replyable`
+ * comes from a RECEIVER marker written by the extension when it joins the session. A
+ * citizen that is born but whose receiver has not armed is `replyable: false` with a real
+ * garden identity — the honest answer, and it becomes true on its own once the extension
+ * binds. What this file must never do is anticipate that answer.
+ *
+ * WHY A SECOND ENTRY FILE. `meta-bridge-hook.ts` hardcodes `backend: "claude-code"`
+ * at mint and then does the marker/watch work above, and two gates pin that unit to
+ * Claude's exec form and its four PascalCase events. Copilot's schema has no `args`
+ * key at all, its exec form is a single `exec` string and its events are camelCase,
+ * so the two units cannot share a manifest — and once the manifests are separate,
+ * sharing an entry would only buy a runtime branch that the gates would then have to
+ * unpick. The shared half lives where it belongs: `lib/meta-session.ts`.
+ *
+ * BIRTH IS ON THE FIRST PROMPT, NOT AT SESSION OPEN. Measured: opening the TUI
+ * registers a session and fires NO hook (11:17:19.920Z registration, three idle
+ * minutes, zero hook lines, `Session: 0 AIC used`). The first prompt then fires
+ * `userPromptSubmitted` (11:20:29.476Z) -> `sessionStart` (11:20:32.102Z). Both are
+ * wired to this entry and the upsert is idempotent, so the earlier of the two mints
+ * and the later attaches. Do not describe a Copilot citizen as born when its window
+ * opens; it is born when it is first spoken to.
+ *
+ * ENVELOPE SHAPE — TWO ACCEPTED, ON PURPOSE. Copilot ships a Claude-compat envelope
+ * translator: a Claude-form hook declaration receives `{hook_event_name, session_id,
+ * cwd, ...}` (measured), while its native declarations carry `{sessionId, timestamp,
+ * cwd, source, ...}`. This unit declares the NATIVE form, and which of the two shapes
+ * a native declaration puts on stdin was not measured. Reading both is not sloppiness
+ * about which is true — it is refusing to bet a citizen's existence on an unmeasured
+ * key name when the two shapes are trivially distinguishable and the log line records
+ * which one actually arrived. That log line is how the doctor turns the guess into a
+ * measurement on the first real session.
+ *
+ * FAILURE POLICY, inherited from the Claude unit: BEST-EFFORT + LOG. Never scream
+ * into the operator's terminal, never block the turn. On any error, append a level-
+ * tagged line to `<pi-agent-dir>/meta-bridge-hook.log` and exit 0 with `{}` on
+ * stdout. The fail-loud surface is the doctor, which reads that log.
+ *
+ * LAUNCH: never invoked directly by Copilot. `hooks/hooks.json` declares
+ * `exec: <baked abspath of scripts/copilot-hook-launch.sh>` and that launcher `exec`s
+ * this payload. See copilot-hook-launch.sh for why it cannot be the Claude launcher.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { defaultMetaSessionsDir, isPlausibleOwnerPid, upsertMetaSession, writeMetaSenderMarker, } from "./lib/meta-session.js";
+/**
+ * The launch-provenance handshake, held as LOCAL literals on purpose.
+ *
+ * The Claude payload declares the same pair privately, and `check-meta-receiver-marker`
+ * asserts the literal is present in THAT source — so hoisting the two strings into a
+ * shared module would drag a sibling rail's production file and its gate into this lane
+ * for no behavioral gain (PM decision, 2026-08-21).
+ *
+ * This is not an unguarded copy. The value already exists on both sides of a shell/TS
+ * boundary anyway (`copilot-hook-launch.sh` exports it), and `check-copilot-birth-hook`
+ * fires the REAL assembled launcher, so a drift between the two spellings shows up as a
+ * refused marker in that gate rather than as a silent mismatch.
+ */
+const META_HOOK_LAUNCH_ENV = "ENTWURF_META_HOOK_LAUNCH";
+const META_HOOK_LAUNCH_TOKEN = "hook-launch/v1";
+/** Append a best-effort diagnostic line; swallow even its own failure. Same log file
+ * and same LEVEL vocabulary as the Claude unit, so one doctor grep covers both. */
+function logLine(level, message) {
+    try {
+        const file = path.join(path.dirname(defaultMetaSessionsDir()), "meta-bridge-hook.log");
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.appendFileSync(file, `${new Date().toISOString()} ${level} [copilot] ${message}\n`);
+    }
+    catch {
+        /* logging is best-effort; a broken log must not break the session */
+    }
+}
+/** Emit the neutral hook response and leave. Copilot has no watchPaths to arm, so
+ * there is never anything else to say. */
+function emit() {
+    process.stdout.write("{}\n");
+    process.exit(0);
+}
+/**
+ * Reduce either envelope shape to the two fields birth needs, or refuse.
+ *
+ * ACCEPTING TWO SHAPES IS NOT THE SAME AS PREFERRING ONE. `sessionId ?? session_id`
+ * would silently pick a winner when the two disagree, and a disagreement is exactly
+ * the case worth refusing: it means the compat translator produced two different
+ * identities for one session, or something hand-built the envelope. A record minted
+ * from the loser would be a citizen no live session can be joined back to. So both
+ * present + equal is fine (`agreeing-both`); both present + different is a REFUSAL
+ * (cross-review, terra, 2026-08-20).
+ *
+ * `cwd` has NO process.cwd() fallback, unlike the Claude entry. There the hook runs
+ * in the session's own cwd, so the fallback is the same value by another route; here
+ * the record is the ONLY thing this unit ever writes and a guessed cwd would be a
+ * fact nothing later can correct. Both measured Copilot shapes carry `cwd`.
+ */
+export function readBirthEnvelope(env) {
+    const nativeRaw = env.sessionId;
+    const compatRaw = env.session_id;
+    const native = typeof nativeRaw === "string" ? nativeRaw : "";
+    const compat = typeof compatRaw === "string" ? compatRaw : "";
+    if (nativeRaw !== undefined && native.length === 0)
+        return { refusal: "sessionId present but not a non-empty string" };
+    if (compatRaw !== undefined && compat.length === 0)
+        return { refusal: "session_id present but not a non-empty string" };
+    if (native && compat && native !== compat) {
+        return { refusal: `sessionId and session_id disagree (${native} vs ${compat})` };
+    }
+    const sessionId = native || compat;
+    if (!sessionId)
+        return { refusal: "no sessionId/session_id" };
+    const shape = native && compat ? "agreeing-both" : native ? "copilot-native" : "claude-compat";
+    if (typeof env.cwd !== "string" || env.cwd.length === 0)
+        return { refusal: "cwd missing or not a non-empty string" };
+    const cwd = env.cwd;
+    const eventLabel = typeof env.hook_event_name === "string" && env.hook_event_name.length > 0
+        ? env.hook_event_name
+        : typeof env.source === "string" && env.source.length > 0
+            ? `native(source=${env.source})`
+            : "unlabeled";
+    return { sessionId, cwd, shape, eventLabel };
+}
+/**
+ * Which pid does a sender marker written here belong to — or NONE.
+ *
+ * `copilot-hook-launch.sh` `exec`s this payload, so on the shipped path this process IS
+ * the launcher and its parent is the Copilot host that ran the hook. Two things that
+ * form cannot promise are asked anyway, and both fail CLOSED:
+ *
+ *   1. LAUNCH PROVENANCE. `process.ppid` only names the Copilot host when this payload
+ *      was reached THROUGH the shipped launcher. A session still holding an older cached
+ *      hook command, or a hand-run of the entry file, has some other parent — so the
+ *      launcher stamps a token and this reads it. No token, no claim.
+ *   2. A PLAUSIBLE LIVE PARENT. `isPlausibleOwnerPid` is the predicate shared with every
+ *      marker writer, reader and the generation cut. A marker naming init outlives every
+ *      process that could refute it, and one such leftover once blocked a host's
+ *      fresh-cut until it was deleted by hand (#53 A).
+ *
+ * Failing closed costs only who-sent, which this backend did not have five minutes ago,
+ * and the doctor reads the WARN. Claiming a transient wrapper as the owner would instead
+ * attribute a citizen's messages to a pid that never sent them.
+ *
+ * MEASUREMENT STATE OF THE JOIN ITSELF. `[측정]` Closed end to end on Copilot CLI 1.0.80,
+ * 2026-08-21, through the PRODUCTION events this unit wires: a live session's marker owner
+ * was the running Copilot native process, that same pid was the parent of the running
+ * entwurf MCP child, and a send from that session arrived carrying its own garden id with
+ * `origin: "meta-session"`. Marker owner == native host == MCP child's parent is therefore
+ * an observed fact on this backend, not an assumption inherited from the other two.
+ *
+ * The claim is still BOUNDED, and the bound is the vendor version: one CLI release is not a
+ * promise about the next, and this join is the only thing standing between a marker and the
+ * child that must find it. That is why the success line below prints the owner pid — it
+ * keeps the join re-checkable from the log alone, with no probe to re-run.
+ */
+/**
+ * Arm who-sent for this host's MCP children, or say in the log why it could not be.
+ *
+ * BEST-EFFORT + LOG, exactly like the mint above it: a Copilot turn must never be broken
+ * or spammed by our bookkeeping, so nothing here throws and nothing reaches the terminal.
+ * The three outcomes get three distinct tokens because they need three different fixes,
+ * and the doctor greps this log:
+ *
+ *   `sender marker <pid> -> <gid>`  armed. The pid is printed because it is the join key
+ *                                   AND the production-event measurement that is still
+ *                                   open (see resolveCopilotHookOwnerPid).
+ *   `sender-marker-refused`         we declined to claim an owner: no launch provenance
+ *                                   (reinstall + restart that session) or an implausible
+ *                                   parent (a reparented orphan). Not an error — a
+ *                                   fail-closed answer, so WARN.
+ *   `sender-marker-failed`          we tried and the write itself broke (permissions, a
+ *                                   full disk, a refused owner pid). ERROR.
+ *
+ * Either non-success costs only who-sent: the citizen still exists, still appears in
+ * `entwurf_peers`, and can still be addressed BY others. Only its own outbound sends fall
+ * back to the bridge's default refusal.
+ */
+function writeCopilotSenderMarker(gardenId, envelope) {
+    const ownerPid = resolveCopilotHookOwnerPid();
+    if (ownerPid === null) {
+        logLine("WARN", process.env[META_HOOK_LAUNCH_ENV] !== META_HOOK_LAUNCH_TOKEN
+            ? `sender-marker-refused garden=${gardenId}: exec-launch provenance missing (${META_HOOK_LAUNCH_ENV}); this hook was NOT reached through copilot-hook-launch.sh, so its parent is not a trustworthy owner. Reinstall the Copilot bridge and RESTART that session. This citizen exists but cannot send (event=${envelope.eventLabel})`
+            : `sender-marker-refused garden=${gardenId}: parent pid ${process.ppid} is not a plausible owner (reparented orphan?); this citizen exists but cannot send (event=${envelope.eventLabel})`);
+        return;
+    }
+    try {
+        writeMetaSenderMarker({
+            backend: "copilot",
+            gardenId,
+            nativeSessionId: envelope.sessionId,
+            cwd: envelope.cwd,
+            ownerPid,
+        });
+        logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${envelope.eventLabel})`);
+    }
+    catch (err) {
+        logLine("ERROR", `sender-marker-failed pid=${ownerPid} garden=${gardenId}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+function resolveCopilotHookOwnerPid() {
+    if (process.env[META_HOOK_LAUNCH_ENV] !== META_HOOK_LAUNCH_TOKEN)
+        return null;
+    const ownerPid = process.ppid;
+    if (!isPlausibleOwnerPid(ownerPid))
+        return null;
+    return ownerPid;
+}
+function main() {
+    let raw;
+    try {
+        raw = fs.readFileSync(0, "utf8"); // fd 0 = stdin (the Copilot hook envelope)
+    }
+    catch (err) {
+        logLine("ERROR", `stdin read failed: ${err instanceof Error ? err.message : String(err)}`);
+        emit();
+    }
+    let env;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null)
+            throw new Error("envelope is not an object");
+        env = parsed;
+    }
+    catch (err) {
+        logLine("ERROR", `envelope parse failed: ${err instanceof Error ? err.message : String(err)}`);
+        emit();
+    }
+    const envelope = readBirthEnvelope(env);
+    if ("refusal" in envelope) {
+        // A record keyed to a guess would be a citizen nobody can join back to a real
+        // session, so refuse — and make it ERROR, because this session did NOT become a
+        // garden citizen. The doctor reads this line.
+        logLine("ERROR", `degraded envelope: ${envelope.refusal} (keys=${Object.keys(env).sort().join(",")})`);
+        emit();
+    }
+    try {
+        // transcriptPath and model are omitted, not guessed: Copilot's envelope carries
+        // neither, and both axes are nullable at mint by design.
+        const result = upsertMetaSession({
+            input: { backend: "copilot", nativeSessionId: envelope.sessionId, cwd: envelope.cwd },
+        });
+        logLine("INFO", `${result.action} record ${path.basename(result.path)} (event=${envelope.eventLabel}, shape=${envelope.shape}, native=${envelope.sessionId})`);
+        // RECORD AUTHORITY FIRST: the marker is only a pid->garden hint that the record
+        // must vouch for, so it is written INSIDE the success branch. A marker minted
+        // after a failed upsert would name a garden id with no record behind it — the
+        // resolver would read it, find nothing, and report "names nobody" for a citizen
+        // whose real failure was the mint. Same order as the agy writer.
+        writeCopilotSenderMarker(result.record.gardenId, envelope);
+    }
+    catch (err) {
+        logLine("ERROR", `upsert failed (event=${envelope.eventLabel}, native=${envelope.sessionId}): ${err instanceof Error ? err.message : String(err)}`);
+    }
+    emit();
+}
+main();

package/mcp/entwurf-bridge/src/index.ts

@@ -655,14 +655,16 @@ server.tool(
 // against that answer would call home to a garden id nobody holds.
 server.tool(
 	"entwurf_fresh_call",
-	"Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Two fixed " +
-		"backends only: pi, claude-code. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
+	"Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Three fixed " +
+		"backends only: pi, claude-code, copilot. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
 		"sender envelope of that callback is its garden id — that is how you learn the address of something that " +
 		"did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
 		"else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
 		"for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
 		"citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
-		"is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code). An optional " +
+		"is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code; a model name " +
+		"or `auto` for copilot). A copilot launch goes through entwurf's own managed invocation and is refused " +
+		"BEFORE any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units. An optional " +
 		"cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
 		"for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
 		"There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
@@ -670,8 +672,8 @@ server.tool(
 		"inside tmux: without a pane anchor there is no session to open a sibling beside.",
 	{
 		backend: z
-			.enum(["pi", "claude-code"])
-			.describe("Which fixed runtime to open. Only these two; there is no arbitrary command."),
+			.enum(["pi", "claude-code", "copilot"])
+			.describe("Which fixed runtime to open. Only these three; there is no arbitrary command."),
 		model: z
 			.string()
 			.min(1)
@@ -685,7 +687,9 @@ server.tool(
 			// as an unused suppression while the escape goes back to being fixable.
 			// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above
 			.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/)
-			.describe("Required runtime model: canonical provider/model for pi, or a Claude Code model id/alias."),
+			.describe(
+				"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot model name (or auto).",
+			),
 		task: z
 			.string()
 			.min(1)

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -121,6 +121,7 @@
 		"../../scripts/meta-bridge-prune.ts",
 		"../../scripts/meta-bridge-fresh-cut.ts",
 		"../../scripts/meta-facts.ts",
-		"../../pi-extensions/meta-bridge-hook.ts"
+		"../../pi-extensions/meta-bridge-hook.ts",
+		"../../pi-extensions/meta-bridge-hook-copilot.ts"
 	]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.14.2",
+	"version": "0.15.0",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -56,6 +56,11 @@
 		"pi/meta-bridge/entwurf-meta-receive/hooks/hooks.json",
 		"pi/meta-bridge/entwurf-meta-receive/scripts/doorbell.sh",
 		"pi/meta-bridge/entwurf-meta-receive/scripts/hook-launch.sh",
+		"pi/meta-bridge-copilot/.claude-plugin/marketplace.json",
+		"pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json",
+		"pi/meta-bridge-copilot/entwurf-meta-receive-copilot/hooks/hooks.json",
+		"pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh",
+		"pi/copilot-receive/entwurf-receive/extension.mjs",
 		"pi/skill-plugin-example/",
 		"run.sh",
 		"AGENTS.md",
@@ -81,16 +86,16 @@
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": ">=0.84.2 <0.85",
-		"@earendil-works/pi-coding-agent": ">=0.84.2 <0.85",
-		"@earendil-works/pi-tui": ">=0.84.2 <0.85",
+		"@earendil-works/pi-ai": ">=0.84.3 <0.85",
+		"@earendil-works/pi-coding-agent": ">=0.84.3 <0.85",
+		"@earendil-works/pi-tui": ">=0.84.3 <0.85",
 		"typebox": "*"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
-		"@earendil-works/pi-ai": "0.84.2",
-		"@earendil-works/pi-coding-agent": "0.84.2",
-		"@earendil-works/pi-tui": "0.84.2",
+		"@earendil-works/pi-ai": "0.84.3",
+		"@earendil-works/pi-coding-agent": "0.84.3",
+		"@earendil-works/pi-tui": "0.84.3",
 		"@types/node": "^24.3.0",
 		"husky": "^9.1.7",
 		"rregex": "1.13.1",
@@ -122,6 +127,11 @@
 		"check-dep-versions": "./run.sh check-dep-versions",
 		"check-node-floor-coherence": "./run.sh check-node-floor-coherence",
 		"check-claude-floor-coherence": "./run.sh check-claude-floor-coherence",
+		"check-copilot-birth-hook": "./run.sh check-copilot-birth-hook",
+		"check-copilot-statusline": "./run.sh check-copilot-statusline",
+		"check-copilot-launch": "./run.sh check-copilot-launch",
+		"smoke-copilot-statusline-state": "./run.sh smoke-copilot-statusline-state",
+		"smoke-copilot-mcp-state": "./run.sh smoke-copilot-mcp-state",
 		"check-hook-launch-topology": "./run.sh check-hook-launch-topology",
 		"check-acp-carrier-augment": "./run.sh check-acp-carrier-augment",
 		"check-agy-permission-matrix": "./run.sh check-agy-permission-matrix",
@@ -144,9 +154,9 @@
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface",
-		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment",
-		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
-		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
+		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment",
+		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
+		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh check-pack-pin-matcher && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {
 		"extensions": [
@@ -161,7 +171,8 @@
 		"entwurf-bridge": "./mcp/entwurf-bridge/start.sh",
 		"entwurf-statusline": "./scripts/meta-bridge-statusline.sh",
 		"entwurf-agy-statusline": "./scripts/agy-statusline.sh",
-		"entwurf-agy-imprint": "./scripts/agy-imprint.sh"
+		"entwurf-agy-imprint": "./scripts/agy-imprint.sh",
+		"entwurf-copilot-statusline": "./scripts/copilot-statusline.sh"
 	},
 	"peerDependenciesMeta": {
 		"@earendil-works/pi-ai": {