@junghanacs/entwurf 0.16.0 → 0.16.1

package/AGENTS.md

@@ -182,7 +182,7 @@ implement → affected focused gates → independent review → one amendment bu
 - Every `.ts` file belongs to one typecheck fence: root emit-capable config, MCP strip-types config, or scripts strip-types config. Do not hide files with `exclude`.
 - Root pi extensions import TypeBox through `@earendil-works/pi-ai`; do not mix direct `@sinclair/typebox` types.
 - MCP/scripts use explicit `.ts` imports where Node strip-types requires them. Installed operator surfaces route to compiled JS.
-- pi runtime range is `>=0.84.3 <0.85` with devDep exact `0.84.3`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
+- pi runtime range is `>=0.84.4 <0.85` with devDep exact `0.84.4`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
 - ACP pins are recorded in `package.json` and checked by `check-dep-versions`/`check-acp-sdk-surface`; do not describe a dependency bump as a behavioral fix without evidence.
 
 ## Working Style

package/CHANGELOG.md

@@ -4,6 +4,131 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.16.1 - 2026-09-01
+
+### Verification
+
+Each receipt carries its own scope; none of them is transferable to another commit or host.
+
+- **`pnpm run check:full`** — PASS, exit 0, **454s** inside the gate, on the 0.16.1
+  versioned tree (HEAD `2e7ceb4` + the uncommitted changelog/version edits).
+- **`./run.sh check-gate-qualification`** — **335/335 KILLED, NOT KILLED 0**, as the
+  release-gate MUST step. The first run of this cut reported **334/335**: the single
+  miss was `PACK-INSTALL-PIN-MATCHER-BOUNDED` reading `MUTANT-STALE` because `5c1bda5`
+  moved `run.sh`'s pin matcher to the 0.84.4 floor and left that mutant's anchor on
+  0.84.3, so it matched 0× and the gate had silently stopped asking its question.
+  Repaired in `2e7ceb4` and re-run green. A rotted anchor is recorded here rather than
+  quietly fixed, because "N killed" only means something when N is the whole set.
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.16.1.m0LUjr --cut`** —
+  **MUST: PASS=23 FAIL=0 SKIP=0**, **BEHAVIOR: PASS=1 FAIL=0 SKIP=0**. Log at
+  `/tmp/entwurf-release-gate-0.16.1.m0LUjr/release-gate.log`. `smoke-mux-lifecycle-live`
+  failed the first run on a pi-native nonce callback that never arrived inside its 300s
+  window (the codex rail was measured healthy at the time: 5h 23%, weekly 77%), and
+  passed on re-run — recorded because a LIVE step that needed a retry is not the same
+  evidence as one that passed first time.
+- **#72 launch/observation receipts** — the launcher's two field claims are not
+  unit-provable, so they were measured on the host that produced the failure:
+  `/proc/<pid>/cmdline` carries no vendor name, the janitor's own Phase 1 selector run
+  against the real `ps` row with its age threshold forced to 0 selects nothing, and a
+  real SIGTERM still ends at exit 0 with the frame on stderr. Commands and output in
+  `scripts/raw-acp-child-exit-measure/README.md`.
+
+### Added
+
+- **`setup` composes OMP — the fifth backend is now in the one command.** v0.16.0 admitted OMP
+  as a D6 citizen with installers, doctors and inverses for every unit, but `setup_all` had no
+  `omp` branch: on an operator host the released package printed a **green** setup summary while
+  OMP had nothing installed — no extension, no `mcp.json` entry, no garden id on the status line.
+  Presence-driven now, same shape as Copilot: `omp` on PATH composes four independent named
+  components (birth → MCP hand → the `tools.xdev` operator setting → receiver), absent is one
+  zero-state SKIP, and a detected-but-incomplete unit is a named FAIL owning a nonzero exit.
+  Gate: `smoke-setup-verdict` S-8 drives the real composition against a stub vendor and asserts
+  every install-state, both extension units in the sandbox agent dir, the effective `xdev-off`
+  reading, and idempotence on a second run; S-1 pins `OMP_BIN` absent and requires the SKIP row.
+- **`install-omp-config` / `uninstall-omp-config` — the operator setting is a unit, not a
+  documentation step.** `tools: xdev: false` was a hand-edit in `docs/setup-clean-host.md`, so a
+  host that skipped it registered every entwurf tool behind the vendor's `xd://` wrapper and the
+  doorbell announced a tool the model could not call. The writer owns exactly the lines it adds
+  (recorded in its install-state), refuses a symlinked config, refuses a config it cannot parse,
+  and refuses an EXPLICIT operator `tools: xdev: true` **by name** rather than overwriting a
+  decision — setup surfaces that as a component FAIL for the operator to resolve. The inverse
+  takes back only the recorded lines and refuses when the file changed since install.
+- **`docs/adding-a-harness.md` step 10 — an onboarding is not finished until `setup` composes
+  it.** The rule the OMP gap forced, with the five conditions a new harness owes (presence-only
+  trigger, one independent component row per unit, compose only what an inverse can undo,
+  operator settings are units with a refusing writer, pin the probe seam and add an aggregate
+  cell) and the shape to watch for: two closed parity loops with no gate owning the edge between
+  them.
+
+### Changed
+
+- **pi floor moved to 0.84.4.** devDependency exact pin, the three peer ranges (`>=0.84.4 <0.85`),
+  the `check-pack-install` runtime pins, the pin-leak matcher's version boundary with its synthetic
+  fixture, and the pnpm lockfile all move together — the floor is one fact with several spellings,
+  and a partial bump is how they drift apart.
+
+### Fixed
+
+- **#72 — the ACP Claude child is no longer selected by the host janitor that was killing it, and
+  a caught signal survives the vendor erasing it.** The child was not crashing: it was being **SIGTERMed from outside**. A
+  janitor installed on the operator's host for a *different* harness (openclaw's acpx, upstream
+  PR #245) selects the vendor process name `claude-agent-acp` by **argv substring** and kills
+  anything older than 900s. entwurf **retains** its child across turns, so that child's age is the
+  age of the SESSION, not of a turn — every session past 15 minutes was shot at every 5 minutes.
+  The vendor's own handler then turned the signal into `dispose(); process.exit(0)`, so the death
+  reached entwurf as exit code 0 with no signal, indistinguishable from a clean shutdown. That is
+  why three diagnosis passes retired four candidate causes and still missed it. Measured: **12 of
+  12** anomalous terminations across two boots correlate with a reap, pid- and timestamp-locked —
+  including the sample that opened the issue (2026-07-30) and the original field report
+  (2026-08-16); receipts in `scripts/raw-acp-child-exit-measure/`. Two changes, both inside the
+  issue's repair fence (no timeout, no replay, no watcher/supervisor/hidden retry): (a) the default
+  launch is now an **entwurf-owned launcher** (`pi-extensions/lib/acp/claude-acp-launch.js`) that
+  imports the vendor **in-process** — same process, so there is no child to restart and it cannot
+  become a supervisor — carrying a name no vendor-name scanner matches, consuming no argv (the
+  vendor's own `argv.slice(1)` self-reinvocation still works), standing down if it would otherwise
+  be the only signal listener (an observer that suppressed default termination would make the
+  process signal-immune), and dying nonzero without retry if the import fails; (b) a caught
+  SIGTERM/SIGINT is recorded as a **typed lifecycle fact** on its own line
+  (`launch observed SIGTERM before child exit (sender not attributed)`) via an exact full-line
+  control frame that is consumed out of the vendor stderr tail — the tail stays vendor evidence,
+  the observation is entwurf's, and sender attribution is explicitly NOT claimed (that needs the
+  host journal). `CLAUDE_AGENT_ACP_COMMAND` stays verbatim: an operator who names their own command
+  owns the result. **Known trade:** after the name split a host janitor can no longer collect
+  entwurf's children even when they genuinely leak, so entwurf now owns that cleanup story.
+  **Read the order right: the cause was the host's janitor, and its owner has retired it**
+  (`nixos-config e283d92`, 2026-09-01 — `acp-zombie-reaper.timer` disabled). Measured there:
+  PR #245 is CLOSED, not merged; that deployment runs `acp.enabled=false` with no ACP agent;
+  acpx is not even installed in the running image (`/app/node_modules/acpx` absent, its `.bin`
+  entries dangling symlinks); and every reap since the 2026-06-10 ACP removal was a single-process
+  misfire matching our pid table. So the change here is **not what stops the symptom** — the
+  retirement is. It is defense-in-depth against the class, and that class is wider than this
+  issue: the selector reads the WHOLE `ps` line, so on a harness that puts the prompt in argv, a
+  session merely *discussing* `claude-agent-acp` matched. Measured 2026-09-01 with zero ACP
+  processes alive, the script's own counter read `alive_acp=3` — three ordinary agent sessions,
+  one of them the session investigating it. A launcher whose name we own survives the next such
+  janitor too. Gates:
+  new `check-acp-launch-namespace` (2 mutants) plus `check-acp-prompt-lifecycle` CELLs 12–13,
+  where 13 is the negative sibling holding that vendor prose mentioning `SIGTERM` can never forge
+  the observation (3 mutants). The primary repair still belongs to the janitor's owner — a cleaner
+  should scope by a positive marker it owns, not by a name anyone may share.
+
+- **A vendor-written `config.yml` no longer reads as `unreadable`.** omp's own settings writer
+  emits `modelRoles:` followed by an indented `{}`, and `scripts/omp-tool-surface.py`'s
+  block-only reader returned None for the WHOLE file on that shape — so an untouched operator
+  config classified as unreadable and `doctor-omp-mcp` went RED for a reason unrelated to
+  `tools.xdev` (measured on a real host, omp 18.0.0). The reader now parses flow collections in
+  value position and as a whole child block. `check-omp-fresh-preflight` gains the vendor shapes
+  plus `[QK:OMP-XDEV-VENDOR-SHAPE-READABLE]` direct assertions — agreement between the two
+  readers could never catch this, since both collapse `unreadable` and `true` into "not false".
+- **The Copilot plugin-row grammar admits the vendor's state token.** Copilot CLI 1.0.81 prints
+  `<qualified> (v0.1.0) (enabled)` plus an indented `from <path>` continuation line;
+  `copilot_exact_row_version` read the version as `0.1.0) (enabled`, called the row malformed,
+  and refused the birth install on a host whose plugin was installed and enabled — `entwurf
+  setup` reported `copilot-birth: FAIL`. The grammar now admits exactly one optional
+  `(enabled)`/`(disabled)` token; any other trailing token is still malformed. The fake vendors
+  in `scripts/fake-copilot-vendor.sh` and `check-copilot-birth-hook.ts` emit the 1.0.81 shape,
+  with `[QK:COPILOT-ROW-STATE-TOKEN-ADMITTED]` holding both directions.
+
 ## 0.16.0 - 2026-08-31
 
 This release admits **OMP (`omp`) as the fifth garden backend** and closes the admission

package/README.md

@@ -60,8 +60,8 @@ native Antigravity / agy
 ```
 
 Claude's `install-meta-bridge`, Copilot's four `install-copilot-*` surfaces, agy's
-`install-agy-{bridge,statusline,hooks}` and OMP's three `install-omp-{bridge,mcp,receive}` units
-(each with its own `doctor-omp-*`) are distinct because their lifecycle and delivery transports are
+`install-agy-{bridge,statusline,hooks}` and OMP's four `install-omp-{bridge,mcp,config,receive}`
+units are distinct because their lifecycle and delivery transports are
 genuinely different. Codex remains verified probe evidence, not a shipped managed native-citizen
 lane; see [DELIVERY.md](./DELIVERY.md).
 
@@ -157,7 +157,7 @@ cd ~/repos/gh/entwurf
 
 The full source setup requires Node 24, pnpm, and Python 3 on PATH. Harnesses are
 optional-by-presence: `setup` runs the frozen dependency install, then composes what the operator
-already installed — a compatible `pi` (`>=0.84.3 <0.85`), Claude Code, agy, and the Copilot CLI
+already installed — a compatible `pi` (`>=0.84.4 <0.85`), Claude Code, agy, and the Copilot CLI
 each get their wiring completed when detected, an absent harness is an explicit zero-state SKIP,
 and a detected harness that cannot be completed (including a below-floor `pi`) is a named FAIL
 that makes setup exit nonzero. `setup` never installs a harness binary or touches a credential
@@ -188,7 +188,7 @@ gitignored and may be absent or stale immediately after a checkout or pull.
 ### Pi adapter / ACP plugin lane
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.84.3 <0.85`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.84.4 <0.85`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash
@@ -213,17 +213,14 @@ SKIP while the detected harnesses are composed.
 
 A plain MCP registration exposes the bridge tools; a **garden-native** session also
 needs entwurf's lifecycle hook and identity marker. `setup` already composes all of that
-for every harness it detects — you do not paste this list to install. OMP is the one
-exception and it is deliberate: its units are operator-selectable installs that `setup`
-does not compose, so the three `install-omp-*` commands below are how an omp host gets
-wired. Otherwise this is the repair surface: each unit has its own installer, its own
-doctor with a named refusal, and its own inverse, so a single broken unit can be redone
-without touching the rest.
+for every harness it detects — you do not paste this list to install. This is the repair
+surface: each unit has its own installer, its own doctor with a named refusal, and its own
+inverse, so a single broken unit can be redone without touching the rest.
 
 - **Claude Code** (Linux-certified axis) — `install-meta-bridge`, `doctor-meta-bridge`.
 - **Antigravity / agy** — `install-agy-bridge`, `install-agy-statusline`, `install-agy-hooks`, each with a matching `doctor-agy-*`.
 - **GitHub Copilot CLI** — four independent units, four independent failure modes: `install-copilot-bridge` (birth: garden id + who-sent, on the first prompt), `install-copilot-mcp` (the entwurf tool hand, where `entwurf_inbox_read` lives), `install-copilot-receive` (the receiver extension: doorbell + receiver marker), `install-copilot-statusline` (optional for a manual citizen, required for supported fresh) — each with a matching `doctor-copilot-*` and `uninstall-copilot-*`.
-- **OMP (`omp`)** — three units, all in-process extensions rather than launchers: `install-omp-bridge` (birth: the `mode === "tui"` visible host, its garden id on the status line, and who-sent), `install-omp-mcp` (the omp-native `entwurf-bridge` entry), `install-omp-receive` (the receiver extension: mailbox watch + announce-only doorbell) — each with a matching `doctor-omp-*` and `uninstall-omp-*`. One OPERATOR setting sits beside them and is not ours to write: `tools: xdev: false` in the omp agent config, without which the vendor mounts MCP tools as `xd://` devices the model cannot call.
+- **OMP (`omp`)** — four units, in-process extensions rather than launchers: `install-omp-bridge` (birth: the `mode === "tui"` visible host, its garden id on the status line, and who-sent), `install-omp-mcp` (the omp-native `entwurf-bridge` entry), `install-omp-config` (the one operator setting `tools: xdev: false`, without which the vendor mounts MCP tools as `xd://` devices the model cannot call), `install-omp-receive` (the receiver extension: mailbox watch + announce-only doorbell) — each with a matching `uninstall-omp-*`, and a `doctor-omp-*` for all but the setting, whose runtime axis `doctor-omp-mcp` owns. The setting writer owns exactly the lines it adds and refuses an explicit operator `tools: xdev: true` by name rather than overwriting it.
 
 Run them as `entwurf <command>`. Which unit a doctor's refusal names, and the clean-host
 walk-through for each harness, live in [docs/setup-clean-host.md](./docs/setup-clean-host.md).

package/demo/README.md

@@ -139,7 +139,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.84.3)
+- `pi` on PATH (current floor 0.84.4)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/docs/setup-clean-host.md

@@ -12,10 +12,10 @@ only on Linux because its strict live-owner join uses `/proc`.
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=0.84.3 <0.85` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| pi | optional-by-presence, `>=0.84.4 <0.85` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
-| OMP (`omp`) | optional, operator-installed; three units (birth/MCP/receiver) plus `tools: xdev: false` in the agent config | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
+| OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
 | Antigravity `agy` | optional, operator-installed and authenticated | native-push citizen |
 | Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
 
@@ -72,11 +72,12 @@ cd ~/repos/gh/entwurf
 
 This owns `~/.local/bin/entwurf` as a symlink to that checkout's `run.sh` and fails if the
 link is foreign, outside PATH, or shadowed by another command. It detects and wires
-pi/Claude/agy/Copilot by presence and prints a computed per-component PASS/SKIP/FAIL summary — a
+pi/Claude/agy/Copilot/OMP by presence and prints a computed per-component PASS/SKIP/FAIL summary — a
 detected harness that cannot be completed makes setup exit nonzero. A detected `copilot`
 composes all four native units (birth → MCP → receiver → visible footer) with independent
-per-unit verdicts (#86 C3b); §4 keeps the explicit per-unit install/doctor/inverse surfaces for
-repair.
+per-unit verdicts (#86 C3b), and a detected `omp` composes its own four (birth → MCP →
+`tools.xdev` setting → receiver) the same way; §4 and §4b keep the explicit per-unit
+install/doctor/inverse surfaces for repair.
 
 ### 1.1 User-scope ownership (one shared registration, one recorded owner)
 
@@ -109,7 +110,7 @@ packageRoot↔installerRoot coupling mismatch and a package/provider managed-pat
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.84.3
+npm install -g @earendil-works/pi-coding-agent@0.84.4
 pi --version
 
 cd ~/entwurf-smoke
@@ -117,7 +118,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=0.84.3 <0.85`. It is a hard minimum: installing this
+The supported range is `>=0.84.4 <0.85`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -213,16 +214,26 @@ sibling launched onto a default-config host would start, look healthy, and be un
 the callback tool at all. A refusal there names `omp-callback-tool-uncallable` and opens
 nothing.
 
+`setup` composes all four omp units when `omp` is on PATH, and the setting is one of them —
+`entwurf setup` writes `tools: xdev: false` itself. The verbs below are the REPAIR path, not
+the install:
+
 ```bash
 entwurf install-omp-bridge     # the birth extension, into <omp agent dir>/extensions/
 entwurf install-omp-mcp        # the omp-native entwurf-bridge server
+entwurf install-omp-config     # the operator setting: tools.xdev: false
 entwurf install-omp-receive    # the receiver extension: mailbox watch + doorbell
 
 entwurf doctor-omp-bridge
-entwurf doctor-omp-mcp
+entwurf doctor-omp-mcp         # also owns the tools.xdev runtime axis
 entwurf doctor-omp-receive
 ```
 
+The setting writer owns exactly the lines it adds and records them, so `uninstall-omp-config`
+takes back its own bytes and nothing else. It refuses a symlinked config, a config it cannot
+parse, and — deliberately — an EXPLICIT `tools: xdev: true`: that is your decision, not drift,
+so setup names it as a component FAIL for you to resolve instead of overwriting it.
+
 Order matters only in one direction: the receiver JOINS the citizen birth mints, and
 announces a tool the MCP hand provides. Install it without them and it will log
 `arm-deferred`, give up after ~20s, and `doctor-omp-receive` will name the missing sibling
@@ -234,8 +245,11 @@ retires it. A task subagent arms nothing. While nothing is armed, dispatch to th
 id is the honest `mailbox-undeliverable` refusal — an unarmed receiver is a legible state,
 not a broken one.
 
-The admission work has landed and `setup` still does not compose these: the three omp
-units stay operator-selectable installs, so run them yourself on an omp host.
+`[측정]` This section used to end by saying `setup` did not compose these and the verbs had to
+be run by hand. That is what v0.16.0 actually shipped, and on an operator host it printed a
+green `setup` summary with OMP entirely absent — no extension, no MCP entry, no visible garden
+id. The composition landed afterwards; `docs/adding-a-harness.md` step 10 is the rule that
+keeps the next harness from repeating it.
 
 Both installers resolve the omp agent directory the way omp itself does, and REFUSE rather
 than guess when an inherited `PI_CODING_AGENT_DIR`, `PI_CONFIG_DIR` or `PI_PROFILE` makes it

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -17,10 +17,9 @@
 //
 // Fence: imported by the root program with `.js` suffixes, same as the sibling
 // lib/acp modules — no new strip-types fence.
-import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { enrichMcpServersWithEnvelope } from "./config.js";
 import { loadEngraving } from "./engraving.js";
 import { CORTEX_MODEL_PREFIX, curatedClaudeModels, curatedCortexModels, SUPPORTED_ANTHROPIC_MODEL_IDS, SUPPORTED_CORTEX_MODEL_IDS, } from "./models.js";
@@ -39,19 +38,29 @@ function shellQuote(value) {
 // claude adapter — the first implementation (the rail's reference backend)
 // ---------------------------------------------------------------------------
 const SUPPORTED_CLAUDE_IDS = new Set(SUPPORTED_ANTHROPIC_MODEL_IDS);
-/** Resolve the claude-agent-acp launch — package bin (resolve), env override for debug.
- *  This is the single source for the claude launch spec; backend.ts holds no private copy. */
+/**
+ * Resolve the claude launch — an ENTWURF-OWNED launcher, or the env override for debug.
+ * This is the single source for the claude launch spec; backend.ts holds no private copy.
+ *
+ * The default no longer names the vendor bin directly. `claude-acp-launch.js`
+ * imports it in-process; that file's header carries the reason (#72: a janitor
+ * for another harness selects `claude-agent-acp` by argv substring and SIGTERMs
+ * it by age, and the vendor's own handler erases the signal into exit 0).
+ *
+ * `CLAUDE_AGENT_ACP_COMMAND` is an EXPLICIT operator override and is deliberately
+ * NOT routed through the launcher: an operator who names their own command owns
+ * the result, including the loss of the name split and the signal observation.
+ */
 function resolveClaudeLaunch() {
     const override = process.env.CLAUDE_AGENT_ACP_COMMAND?.trim();
     if (override)
         return { command: "bash", args: ["-lc", override] };
+    // Resolved here (not inside the launcher's own directory lookup) so a missing
+    // vendor package still fails at launch resolution, where it always failed.
     const require = createRequire(import.meta.url);
-    const pkgJsonPath = require.resolve("@agentclientprotocol/claude-agent-acp/package.json");
-    const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
-    const binPath = typeof pkgJson.bin === "string" ? pkgJson.bin : pkgJson.bin?.["claude-agent-acp"];
-    if (!binPath)
-        throw new Error("@agentclientprotocol/claude-agent-acp resolved but exposes no bin entry");
-    return { command: process.execPath, args: [join(dirname(pkgJsonPath), binPath)] };
+    require.resolve("@agentclientprotocol/claude-agent-acp/package.json");
+    const launcher = fileURLToPath(new URL("./claude-acp-launch.js", import.meta.url));
+    return { command: process.execPath, args: [launcher] };
 }
 export const claudeAdapter = {
     backend: "claude",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.16.0",
+	"version": "0.16.1",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -89,16 +89,16 @@
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": ">=0.84.3 <0.85",
-		"@earendil-works/pi-coding-agent": ">=0.84.3 <0.85",
-		"@earendil-works/pi-tui": ">=0.84.3 <0.85",
+		"@earendil-works/pi-ai": ">=0.84.4 <0.85",
+		"@earendil-works/pi-coding-agent": ">=0.84.4 <0.85",
+		"@earendil-works/pi-tui": ">=0.84.4 <0.85",
 		"typebox": "*"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
-		"@earendil-works/pi-ai": "0.84.3",
-		"@earendil-works/pi-coding-agent": "0.84.3",
-		"@earendil-works/pi-tui": "0.84.3",
+		"@earendil-works/pi-ai": "0.84.4",
+		"@earendil-works/pi-coding-agent": "0.84.4",
+		"@earendil-works/pi-tui": "0.84.4",
 		"@types/node": "^24.3.0",
 		"husky": "^9.1.7",
 		"rregex": "1.13.1",
@@ -165,7 +165,7 @@
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface",
 		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment",
-		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
+		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {

package/pi-extensions/lib/acp/backend-adapter.ts

@@ -18,10 +18,9 @@
 // Fence: imported by the root program with `.js` suffixes, same as the sibling
 // lib/acp modules — no new strip-types fence.
 
-import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 
 import type { AcpConnectionLike } from "./acp-client.js";
 import { enrichMcpServersWithEnvelope, type ResolvedAcpConfig } from "./config.js";
@@ -202,17 +201,28 @@ export interface AcpBackendAdapter {
 
 const SUPPORTED_CLAUDE_IDS: ReadonlySet<string> = new Set(SUPPORTED_ANTHROPIC_MODEL_IDS);
 
-/** Resolve the claude-agent-acp launch — package bin (resolve), env override for debug.
- *  This is the single source for the claude launch spec; backend.ts holds no private copy. */
+/**
+ * Resolve the claude launch — an ENTWURF-OWNED launcher, or the env override for debug.
+ * This is the single source for the claude launch spec; backend.ts holds no private copy.
+ *
+ * The default no longer names the vendor bin directly. `claude-acp-launch.js`
+ * imports it in-process; that file's header carries the reason (#72: a janitor
+ * for another harness selects `claude-agent-acp` by argv substring and SIGTERMs
+ * it by age, and the vendor's own handler erases the signal into exit 0).
+ *
+ * `CLAUDE_AGENT_ACP_COMMAND` is an EXPLICIT operator override and is deliberately
+ * NOT routed through the launcher: an operator who names their own command owns
+ * the result, including the loss of the name split and the signal observation.
+ */
 function resolveClaudeLaunch(): AcpLaunchSpec {
 	const override = process.env.CLAUDE_AGENT_ACP_COMMAND?.trim();
 	if (override) return { command: "bash", args: ["-lc", override] };
+	// Resolved here (not inside the launcher's own directory lookup) so a missing
+	// vendor package still fails at launch resolution, where it always failed.
 	const require = createRequire(import.meta.url);
-	const pkgJsonPath = require.resolve("@agentclientprotocol/claude-agent-acp/package.json");
-	const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf8")) as { bin?: string | Record<string, string> };
-	const binPath = typeof pkgJson.bin === "string" ? pkgJson.bin : pkgJson.bin?.["claude-agent-acp"];
-	if (!binPath) throw new Error("@agentclientprotocol/claude-agent-acp resolved but exposes no bin entry");
-	return { command: process.execPath, args: [join(dirname(pkgJsonPath), binPath)] };
+	require.resolve("@agentclientprotocol/claude-agent-acp/package.json");
+	const launcher = fileURLToPath(new URL("./claude-acp-launch.js", import.meta.url));
+	return { command: process.execPath, args: [launcher] };
 }
 
 export const claudeAdapter: AcpBackendAdapter = {