@junghanacs/entwurf 0.15.0 → 0.16.0

package/scripts/omp-bridge-install.sh

@@ -0,0 +1,221 @@
+#!/usr/bin/env bash
+# omp-bridge-install.sh — operator-grade global installer for the OMP BIRTH extension
+# (#87). The omp sibling of copilot-bridge-install.sh, deliberately NOT a mode of it.
+#
+# WHAT THIS INSTALLS. ONE extension directory whose managed job is to mint the visible
+# omp TUI host as a garden citizen, name it as this host's sender, and show its garden id
+# on omp's own status line. The MCP hand is a separate surface (`install-omp-mcp`), and
+# receive does not exist yet — three facts, three installers, three failure modes.
+#
+# WHY THERE IS NO LAUNCHER AND NO MANIFEST BAKE. `[source]` an omp "hook" is an
+# in-process EXTENSION: `--hook` aliases `--extension`, a module default-exports
+# `(pi) => void`, and there is no spawned hook command and no stdin envelope (oh-my-pi
+# v18.0.0, `docs/hooks.md`; `extensibility/extensions/types.ts:1592`). The Claude and
+# Copilot installers bake a node path and an entry path into a launcher because their
+# payload is a separate process; here the vendor imports the module itself, so the whole
+# install is: assemble a self-contained unit, then place it where omp discovers it.
+#
+# WHERE IT PLACES IT, AND WHY THERE. `<agent-dir>/extensions/<unit>/index.{ts,js}` is one
+# of omp's three native discovery rules (`discovery/builtin.ts:483` →
+# `discovery/helpers.ts:625-712`), and the only one that needs nothing rewritten per
+# install shape. The agent dir is resolved by the shared oracle, which REFUSES rather
+# than guesses when an inherited `PI_*` knob makes it ambiguous (ledger M6).
+#
+# Platform: Linux only, same fence as the Claude and Copilot installers.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/.." && pwd)"
+UNIT="entwurf-meta-omp"
+SRC="$REPO/pi/meta-bridge-omp"
+# `ENTWURF_OMP_ASM` exists for the gate: check-omp-birth-hook drives this script for real,
+# into a temp dir, with --assemble-only. A gate that re-implemented the assembly would be
+# testing its own copy of the logic instead of the shipped one.
+ASM="${ENTWURF_OMP_ASM:-${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge-omp/.assembled}"
+STATE_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/omp-bridge"
+STATE_FILE="$STATE_DIR/install-state.json"
+ASSEMBLE_ONLY=0
+
+die() { echo "[omp-bridge-install] $*" >&2; exit 1; }
+
+for arg in "$@"; do
+  case "$arg" in
+    --assemble-only) ASSEMBLE_ONLY=1 ;;
+    *) die "unknown argument: $arg (--assemble-only)" ;;
+  esac
+done
+
+[ "$(uname -s)" = "Linux" ] || die "Linux only; $(uname -s) is not a certified axis for this install."
+command -v python3 >/dev/null 2>&1 || die "python3 is required and is not on PATH."
+
+# shellcheck source=scripts/omp-bridge-oracle.sh
+. "$HERE/omp-bridge-oracle.sh"
+
+if [ "$ASSEMBLE_ONLY" -eq 1 ]; then
+  # A GATE-ONLY path that writes no ownership state, so it must never touch the LIVE
+  # assembly: without a state, a rebuilt live assembly would drift from what the state
+  # records. Same refusal the Copilot installer carries, for the same reason.
+  DEFAULT_ASM="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge-omp/.assembled"
+  [ -n "${ENTWURF_OMP_ASM:-}" ] \
+    || die "--assemble-only requires an explicit ENTWURF_OMP_ASM (a temp dir): this gate-only path writes no ownership state and must not rebuild the live assembly."
+  if [ "$(python3 -c 'import os,sys;print(os.path.abspath(sys.argv[1]))' "$ENTWURF_OMP_ASM")" = \
+       "$(python3 -c 'import os,sys;print(os.path.abspath(sys.argv[1]))' "$DEFAULT_ASM")" ]; then
+    die "--assemble-only refuses the DEFAULT live assembly path ($DEFAULT_ASM): pass a temp ENTWURF_OMP_ASM instead."
+  fi
+fi
+
+AGENT_DIR=""
+UNIT_DIR=""
+if [ "$ASSEMBLE_ONLY" -eq 0 ]; then
+  command -v omp >/dev/null 2>&1 || die "the 'omp' CLI is not on PATH. entwurf never installs a harness — install omp first, then re-run."
+  AGENT_DIR="$(omp_agent_dir)" || die "refusing: the omp agent directory this host reads is ambiguous (see above)."
+  UNIT_DIR="$AGENT_DIR/extensions/$UNIT"
+fi
+
+UNIT_VERSION="$(python3 -c "import json,sys;print(json.load(open(sys.argv[1]))['version'])" "$SRC/$UNIT/package.json")" \
+  || die "could not read the shipped unit version from $SRC/$UNIT/package.json"
+case "$UNIT_VERSION" in
+  ""|*[![:graph:]]*) die "shipped unit version ${UNIT_VERSION:-<empty>} is empty or carries whitespace/control characters — it travels through space-separated fact transports." ;;
+esac
+
+# Same install-shape split as the Claude and Copilot installers: an installed package
+# lives below node_modules where Node refuses strip-types on `.ts`, so it ships the
+# tsc-emitted closure; a dev clone ships the `.ts` source. omp itself reads both (its
+# discovery prefers index.ts and falls back to index.js, `discovery/helpers.ts:700-710`).
+case "$REPO" in
+  */node_modules/@junghanacs/entwurf)
+    ENTRY_NAME="index.js"
+    ENTRY_SRC="$REPO/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-omp.js"
+    LIB_SRC="$REPO/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
+    LIB_EXT="js" ;;
+  *)
+    ENTRY_NAME="index.ts"
+    ENTRY_SRC="$REPO/pi-extensions/meta-bridge-omp.ts"
+    LIB_SRC="$REPO/pi-extensions/lib/meta-session.ts"
+    LIB_EXT="ts" ;;
+esac
+
+[ -f "$ENTRY_SRC" ] || die "birth entry artifact missing: $ENTRY_SRC (run 'pnpm run build-bridge' in a dev clone, or reinstall the package)."
+[ -f "$LIB_SRC" ]   || die "entry lib artifact missing: $LIB_SRC (same build-bridge dist closure)."
+
+write_state() { # $1 = ownedUnitDir (true|false)
+  mkdir -p "$STATE_DIR"
+  STATE_FILE_ENV="$STATE_FILE" UNIT_DIR_ENV="$UNIT_DIR" ASM_ENV="$ASM" \
+  UNIT_VERSION_ENV="$UNIT_VERSION" ENTRY_NAME_ENV="$ENTRY_NAME" OWNED_ENV="$1" python3 - <<'PY' \
+    || die "could not write the ownership state at $STATE_FILE"
+import datetime, json, os, tempfile
+state_file = os.environ["STATE_FILE_ENV"]
+state = {
+    "schemaVersion": 1,
+    "unitDir": os.path.abspath(os.environ["UNIT_DIR_ENV"]),
+    "assemblyPath": os.path.abspath(os.environ["ASM_ENV"]),
+    "unitVersion": os.environ["UNIT_VERSION_ENV"],
+    "entryName": os.environ["ENTRY_NAME_ENV"],
+    "ownedUnitDir": os.environ["OWNED_ENV"] == "true",
+    "installedAt": datetime.datetime.now(datetime.timezone.utc).isoformat(),
+}
+fd, tmp = tempfile.mkstemp(dir=os.path.dirname(state_file), prefix=".install-state.")
+with os.fdopen(fd, "w") as fh:
+    json.dump(state, fh, indent=2)
+    fh.write("\n")
+os.replace(tmp, state_file)
+PY
+}
+
+# ── 0. ownership preflight (READ-ONLY) ───────────────────────────────────────
+# Every destructive step below is licensed HERE, and the only licence is ownership STATE.
+# Anything that already exists at our path and cannot be proven ours refuses with zero
+# writes — a structural shape is not a proof of ownership (#87 B2). A SYMLINK at the unit
+# path is always a refusal too: writing through it would mutate somebody else's tree.
+if [ "$ASSEMBLE_ONLY" -eq 0 ]; then
+  if [ -L "$STATE_FILE" ]; then
+    die "ownership state $STATE_FILE is a symlink — refusing to trust or overwrite it."
+  fi
+  if [ -L "$UNIT_DIR" ]; then
+    die "$UNIT_DIR is a SYMLINK. entwurf never writes through a link into a tree it does not own — remove it by hand if it is stale, then re-run."
+  fi
+  if [ -f "$STATE_FILE" ]; then
+    omp_state_read "$STATE_FILE" "$UNIT_DIR" "$ASM" >/dev/null \
+      || die "ownership state $STATE_FILE is corrupt or names a different installation (see above) — refusing with zero writes."
+    echo "[omp-bridge-install] ownership state matches this installation (reinstall/repair)"
+  elif [ -e "$UNIT_DIR" ]; then
+    # NO SHAPE-BASED ADOPTION (#87 B2). A structural oracle answers "is this a complete
+    # unit", never "is this OURS": it compares no bytes, rejects no extra files and
+    # establishes no provenance. Adopting on that answer meant moving a stranger's
+    # directory aside, publishing over it and DELETING the preimage — and the inverse
+    # then `rm -rf`s the path on the same unproven claim. A foreign or hand-made
+    # extension with these filenames, or our own unit plus operator files beside it, was
+    # destroyed unrecoverably. Ownership state is the only proof of ownership, so a
+    # no-state path refuses with zero writes.
+    die "$UNIT_DIR already exists and entwurf holds NO ownership state for it. A directory that merely LOOKS like our unit is not proof that it is ours — adopting it would overwrite it and delete the preimage with no inverse. Refusing with zero writes: inspect it, and if it is stale remove it by hand, then re-run."
+  fi
+fi
+
+# ── 1. assemble a self-contained unit ────────────────────────────────────────
+# ATOMIC: assemble beside the live artifact and swap only once it is complete, so a
+# failure never leaves a half-written extension for omp to import on the next launch.
+STAGE="$ASM.staging.$$"
+rm -rf "$STAGE"
+trap 'rm -rf "$STAGE"' EXIT
+mkdir -p "$STAGE/$UNIT/lib"
+cp "$SRC/$UNIT/package.json" "$STAGE/$UNIT/package.json"
+cp "$ENTRY_SRC" "$STAGE/$UNIT/$ENTRY_NAME"
+cp "$LIB_SRC" "$STAGE/$UNIT/lib/meta-session.$LIB_EXT"
+cp "$REPO/pi-extensions/lib/session-id.js" "$STAGE/$UNIT/lib/session-id.js"
+# The capability registry must travel at the unit ROOT: metaCapabilitiesFilePath()
+# resolves it via `../` from lib/ in the bundle layout. Without it every mint throws.
+cp "$REPO/pi/entwurf-capabilities.json" "$STAGE/$UNIT/entwurf-capabilities.json"
+
+omp_assembly_valid "$STAGE" "$UNIT" || die "the freshly staged assembly fails the structural oracle (see above) — refusing to publish it."
+
+PREV=""
+if [ -d "$ASM" ]; then
+  PREV="$ASM.previous.$$"
+  mv "$ASM" "$PREV" || die "could not move the previous assembly aside ($ASM)."
+fi
+mkdir -p "$(dirname "$ASM")"
+if ! mv "$STAGE" "$ASM"; then
+  [ -n "$PREV" ] && mv "$PREV" "$ASM"
+  die "could not publish the staged assembly into $ASM (previous assembly restored)."
+fi
+trap - EXIT
+[ -n "$PREV" ] && rm -rf "$PREV"
+
+echo "[omp-bridge-install] assembled $ASM (birth extension only; the MCP hand is install-omp-mcp)"
+
+if [ "$ASSEMBLE_ONLY" -eq 1 ]; then
+  echo "[omp-bridge-install] --assemble-only: stopping before the omp agent directory is touched"
+  exit 0
+fi
+
+# ── 2. place it where omp discovers it ───────────────────────────────────────
+# Ownership state BEFORE the vendor-directory mutation: once the complete assembly is
+# published, the state exists so a partial failure below still leaves an inverse
+# authority behind. `ownedUnitDir` flips false→true around the placement.
+write_state false
+echo "[omp-bridge-install] ownership state written: $STATE_FILE"
+
+mkdir -p "$(dirname "$UNIT_DIR")"
+PLACE_STAGE="$UNIT_DIR.staging.$$"
+rm -rf "$PLACE_STAGE"
+cp -r "$ASM/$UNIT" "$PLACE_STAGE" || die "could not stage the unit into $(dirname "$UNIT_DIR")."
+PREV_UNIT=""
+if [ -d "$UNIT_DIR" ]; then
+  PREV_UNIT="$UNIT_DIR.previous.$$"
+  mv "$UNIT_DIR" "$PREV_UNIT" || { rm -rf "$PLACE_STAGE"; die "could not move the previous unit aside ($UNIT_DIR)."; }
+fi
+if ! mv "$PLACE_STAGE" "$UNIT_DIR"; then
+  [ -n "$PREV_UNIT" ] && mv "$PREV_UNIT" "$UNIT_DIR"
+  rm -rf "$PLACE_STAGE"
+  die "could not publish the unit into $UNIT_DIR (previous unit restored)."
+fi
+[ -n "$PREV_UNIT" ] && rm -rf "$PREV_UNIT"
+write_state true
+
+omp_assembly_valid "$(dirname "$UNIT_DIR")" "$UNIT" || die "the placed unit fails the structural oracle (see above)."
+
+echo "[omp-bridge-install] installed $UNIT_DIR (entry $ENTRY_NAME, version $UNIT_VERSION)"
+echo "[omp-bridge-install] DONE. An omp TUI session becomes a citizen when it OPENS —"
+echo "the birth edge is the extension's session_start, which fires after first paint and"
+echo "before the first prompt; a task subagent of that session is refused by design."
+echo "Verify with: ./run.sh doctor-omp-bridge · inverse: ./run.sh uninstall-omp-bridge"

package/scripts/omp-bridge-oracle.sh

@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# omp-bridge-oracle.sh — the ONE structural oracle for the OMP birth unit (#87).
+# Sourced by the installer, the inverse and the doctor so "valid assembly", "valid
+# ownership state" and "which agent dir does omp actually read" cannot mean three
+# different things in three files.
+#
+# omp_agent_dir
+#   Resolve the agent directory omp itself would read, or REFUSE. Prints the absolute
+#   path on rc 0; prints the reason on stderr and returns rc 1 when the environment is
+#   ambiguous. See the function header for why an inherited `PI_*` knob is a refusal
+#   rather than a guess.
+#
+# omp_assembly_valid <asm-root> <unit-name>
+#   rc 0 = the assembly is a complete unit (entry + lib + registry + package.json with
+#   `type: module`); rc 1 with the first failing reason on stderr.
+#
+# omp_state_read <state_file> <unit_dir> <asm>
+#   Fail-closed EXACT-schema reader for the ownership state — one validator for all
+#   three surfaces. rc 0 prints `<unitVersion> <entryName>`; any missing/unknown key,
+#   wrong type, empty string, relative path or constant drift is rc 1.
+#
+# Deliberately BOUNDED: environment, structure, one state schema. Records, markers and
+# hook-log truth stay on the doctor's own axes.
+
+# The vendor's own agent-dir resolution, reproduced only as far as this lane needs.
+#
+# `[source]` omp reads `PI_CONFIG_DIR` (default `.omp`) and `PI_CODING_AGENT_DIR`
+# (`packages/utils/src/dirs.ts:23`, `:210`, `:358`), and selects a profile from
+# `OMP_PROFILE` first, `PI_PROFILE` second (`dirs.ts:57`, `:85-91`), which moves the
+# agent dir to `~/.omp/profiles/<name>/agent`.
+#
+# WHY A `PI_*` KNOB IS A REFUSAL AND NOT A LOOKUP (ledger M6). omp is a pi fork and kept
+# pi's env vocabulary, so those three variables now steer TWO harnesses: entwurf's own pi
+# rail sandboxes `PI_CODING_AGENT_DIR` (AGENTS.md Hard Rule 12) and omp reads the same
+# name. A value in the installing shell therefore does not say WHICH harness it is
+# addressing. Installing into a directory chosen by that guess is how an operator ends up
+# with a unit no live omp reads, or a unit written into the pi rail's sandbox. `OMP_PROFILE`
+# is omp's own name and is honoured; the pi-shaped names refuse, and `ENTWURF_OMP_AGENT_DIR`
+# is the explicit override every gate and smoke passes.
+omp_agent_dir() {
+	if [ -n "${ENTWURF_OMP_AGENT_DIR:-}" ]; then
+		python3 -c 'import os,sys;print(os.path.abspath(os.path.expanduser(sys.argv[1])))' "$ENTWURF_OMP_AGENT_DIR"
+		return 0
+	fi
+	if [ -n "${PI_CODING_AGENT_DIR:-}" ]; then
+		echo "PI_CODING_AGENT_DIR is set ($PI_CODING_AGENT_DIR). omp reads it too (utils/src/dirs.ts:358), so it does not say whether it is addressing omp or entwurf's pi rail — refusing to guess. Unset it, or pass ENTWURF_OMP_AGENT_DIR explicitly." >&2
+		return 1
+	fi
+	if [ -n "${PI_CONFIG_DIR:-}" ]; then
+		echo "PI_CONFIG_DIR is set ($PI_CONFIG_DIR). It renames omp's whole config root (utils/src/dirs.ts:23, :210) and is a pi-shaped name — refusing to guess. Unset it, or pass ENTWURF_OMP_AGENT_DIR explicitly." >&2
+		return 1
+	fi
+	if [ -n "${PI_PROFILE:-}" ] && [ -z "${OMP_PROFILE:-}" ]; then
+		echo "PI_PROFILE is set ($PI_PROFILE) with no OMP_PROFILE. omp falls back to it (utils/src/dirs.ts:85-91) but so does pi — refusing to guess which harness this profile addresses. Set OMP_PROFILE explicitly, or pass ENTWURF_OMP_AGENT_DIR." >&2
+		return 1
+	fi
+	local root="$HOME/.omp"
+	if [ -n "${OMP_PROFILE:-}" ]; then
+		case "$OMP_PROFILE" in
+			[a-z0-9]*)
+				case "$OMP_PROFILE" in
+					*[!a-z0-9._-]*)
+						echo "OMP_PROFILE '$OMP_PROFILE' is not a valid omp profile name (utils/src/dirs.ts PROFILE_NAME_RE)." >&2
+						return 1 ;;
+				esac
+				root="$HOME/.omp/profiles/$OMP_PROFILE" ;;
+			*)
+				echo "OMP_PROFILE '$OMP_PROFILE' is not a valid omp profile name (utils/src/dirs.ts PROFILE_NAME_RE)." >&2
+				return 1 ;;
+		esac
+	fi
+	printf '%s\n' "$root/agent"
+}
+
+omp_assembly_valid() {
+	local asm="$1" unit="$2"
+	local dir="$asm/$unit"
+	if [ ! -d "$dir" ]; then
+		echo "assembly has no unit directory: $dir" >&2
+		return 1
+	fi
+	local entry=""
+	if [ -f "$dir/index.ts" ]; then entry="index.ts"; elif [ -f "$dir/index.js" ]; then entry="index.js"; fi
+	if [ -z "$entry" ]; then
+		echo "assembly has no index.ts/index.js entry: $dir (omp discovers a subdirectory extension by that name, discovery/helpers.ts:700-710)" >&2
+		return 1
+	fi
+	local libext="ts"
+	[ "$entry" = "index.js" ] && libext="js"
+	for required in "package.json" "entwurf-capabilities.json" "lib/meta-session.$libext" "lib/session-id.js"; do
+		if [ ! -f "$dir/$required" ]; then
+			echo "assembly is missing $required: $dir/$required" >&2
+			return 1
+		fi
+	done
+	# `type: module` is not cosmetic on the installed-package shape: an ESM `index.js`
+	# under a directory with no nearest package.json type field is read as CommonJS.
+	if ! DIR_ENV="$dir" python3 - <<'PY'
+import json, os, sys
+pkg = json.load(open(os.path.join(os.environ["DIR_ENV"], "package.json")))
+if pkg.get("type") != "module":
+    print(f"assembly package.json type is {pkg.get('type')!r}, want the literal \"module\"", file=sys.stderr)
+    sys.exit(1)
+if not isinstance(pkg.get("version"), str) or not pkg["version"]:
+    print("assembly package.json has no non-empty version", file=sys.stderr)
+    sys.exit(1)
+PY
+	then
+		return 1
+	fi
+	return 0
+}
+
+omp_state_read() {
+	local state_file="$1" unit_dir="$2" asm="$3"
+	STATE_FILE_ENV="$state_file" UNIT_DIR_ENV="$unit_dir" ASM_ENV="$asm" python3 - <<'PY'
+import json, os, sys
+try:
+    state = json.load(open(os.environ["STATE_FILE_ENV"]))
+except (OSError, json.JSONDecodeError) as err:
+    print(f"state parse failed: {err}", file=sys.stderr)
+    sys.exit(1)
+EXACT_KEYS = {"schemaVersion", "unitDir", "assemblyPath", "unitVersion", "entryName", "ownedUnitDir", "installedAt"}
+if not isinstance(state, dict) or set(state) != EXACT_KEYS:
+    got = sorted(state) if isinstance(state, dict) else type(state).__name__
+    print(f"state keyset drifted: {got} != {sorted(EXACT_KEYS)}", file=sys.stderr)
+    sys.exit(1)
+if state["schemaVersion"] != 1:
+    print(f"state schemaVersion is {state['schemaVersion']!r}, want the literal 1", file=sys.stderr)
+    sys.exit(1)
+for key in ("unitDir", "assemblyPath", "unitVersion", "entryName", "installedAt"):
+    if not isinstance(state[key], str) or not state[key]:
+        print(f"state {key} must be a nonempty string, got {state[key]!r}", file=sys.stderr)
+        sys.exit(1)
+if any(ord(c) < 0x21 or ord(c) == 0x7f for c in state["unitVersion"]):
+    print(f"state unitVersion contains whitespace/control characters: {state['unitVersion']!r} — "
+          "the space-separated fact transport would truncate it into a fabricated version", file=sys.stderr)
+    sys.exit(1)
+if state["entryName"] not in ("index.ts", "index.js"):
+    print(f"state entryName is {state['entryName']!r}, want index.ts or index.js", file=sys.stderr)
+    sys.exit(1)
+if not isinstance(state["ownedUnitDir"], bool):
+    print(f"state ownedUnitDir must be a boolean, got {state['ownedUnitDir']!r} — flags are never coerced", file=sys.stderr)
+    sys.exit(1)
+for key, want in (("unitDir", os.environ["UNIT_DIR_ENV"]), ("assemblyPath", os.environ["ASM_ENV"])):
+    if not os.path.isabs(state[key]):
+        print(f"state {key} is not absolute: {state[key]!r}", file=sys.stderr)
+        sys.exit(1)
+    if os.path.abspath(state[key]) != os.path.abspath(want):
+        print(f"state {key} names {state[key]!r}, not this installation's {want!r}", file=sys.stderr)
+        sys.exit(1)
+print(f"{state['unitVersion']} {state['entryName']}")
+PY
+}

package/scripts/omp-bridge-uninstall.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# omp-bridge-uninstall.sh — the honest inverse of install-omp-bridge (#87).
+#
+# HONEST means: remove exactly what the ownership state says this repo installed, and
+# nothing else. No `--force`, no "clean up anything that looks like ours", no removal of
+# a unit directory we cannot prove we placed. A no-state host is NOT an empty host: it is
+# a host whose ownership we cannot establish, so the answer is a named refusal.
+#
+# The state is deleted LAST, so an interrupted inverse leaves the authority to retry.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+UNIT="entwurf-meta-omp"
+ASM="${ENTWURF_OMP_ASM:-${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge-omp/.assembled}"
+STATE_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/omp-bridge"
+STATE_FILE="$STATE_DIR/install-state.json"
+
+die() { echo "[omp-bridge-uninstall] $*" >&2; exit 1; }
+
+# shellcheck source=scripts/omp-bridge-oracle.sh
+. "$HERE/omp-bridge-oracle.sh"
+
+AGENT_DIR="$(omp_agent_dir)" || die "refusing: the omp agent directory this host reads is ambiguous (see above)."
+UNIT_DIR="$AGENT_DIR/extensions/$UNIT"
+
+[ -L "$STATE_FILE" ] && die "ownership state $STATE_FILE is a symlink — refusing to trust it."
+if [ ! -f "$STATE_FILE" ]; then
+  die "no ownership state at $STATE_FILE, so nothing here is provably ours. Refusing with zero writes — if $UNIT_DIR is a stale hand-copied unit, remove it by hand."
+fi
+STATE_FACTS="$(omp_state_read "$STATE_FILE" "$UNIT_DIR" "$ASM")" \
+  || die "ownership state $STATE_FILE is corrupt or names a different installation (see above) — refusing with zero writes."
+STATE_ENTRY="${STATE_FACTS#* }"
+
+if [ -e "$UNIT_DIR" ]; then
+  if [ -L "$UNIT_DIR" ]; then
+    die "$UNIT_DIR is a SYMLINK — this installer never creates one, so it is not ours. Refusing; remove it by hand."
+  fi
+  if [ ! -f "$UNIT_DIR/$STATE_ENTRY" ]; then
+    die "$UNIT_DIR exists but does not carry the entry this install recorded ($STATE_ENTRY) — it is not provably the unit we placed. Refusing with zero writes."
+  fi
+  rm -rf "$UNIT_DIR"
+  echo "[omp-bridge-uninstall] removed the installed unit: $UNIT_DIR"
+else
+  echo "[omp-bridge-uninstall] the installed unit was already absent: $UNIT_DIR"
+fi
+
+if [ -d "$ASM" ]; then
+  rm -rf "$ASM"
+  echo "[omp-bridge-uninstall] removed the assembly: $ASM"
+fi
+
+rm -f "$STATE_FILE"
+rmdir "$STATE_DIR" 2>/dev/null || true
+echo "[omp-bridge-uninstall] ownership state removed: $STATE_FILE"
+echo "[omp-bridge-uninstall] DONE. Existing omp sessions keep the record they already"
+echo "minted — records are preserved, never deleted (AGENTS.md Hard Rule 8); what stops"
+echo "is any FUTURE birth. The MCP hand is a separate inverse: ./run.sh uninstall-omp-mcp"