@junghanacs/entwurf 0.21.0 → 0.23.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -1,8 +1,9 @@
 /**
  * mux-fresh-call — open ONE visible sibling in the caller's own tmux server (its own session by
  * default, or one named existing session on that server since #105), hand it its first task in
- * the launch argv, and let it name itself back to the caller. Codex is the one measured topology
- * exception: an omitted seat selects the existing `codex` home session (#95), never a TUI guess.
+ * the launch argv, and let it name itself back to the caller. A Codex CALLER is the one measured
+ * exception to "the caller's own session": it opens beside its own TUI pane, found by that
+ * pane's terminal title (#95 lane B), never by a TUI guess.
  *
  * ── Why this is a third module and not a parameter on the leaf ──
  *
@@ -39,6 +40,14 @@
  *     byte-identical to the pre-#73 shape. Anything else is taken LITERALLY — no trim, no
  *     realpath, no project-name resolution, no store/peers/record lookup. The caller is the
  *     only cwd authority this module knows.
+ *   - when a CODEX caller omits it, the surface supplies that citizen's own record cwd and it
+ *     becomes an explicit `-c` (#95 lane C). This is not a second authority: it is the same
+ *     caller, named more precisely, because a codex caller's PROCESS directory is the
+ *     operator-owned app-server's rather than its own. Every other caller keeps the inherited
+ *     directory and an unchanged argv.
+ *   - the chosen value reaches codex TWICE, and that is one value with two carriers rather than
+ *     two inputs: tmux `-c` places the pane, and codex `-C` places the THREAD, which a
+ *     `--remote` attachment would otherwise take from the app-server (see `buildBackendArgs`).
  *   - the value is classified by the shared `classify-tmux-cwd.ts` leaf BEFORE any mutation
  *     (same four stable reasons as resume; the measured tmux 3.6a facts live on that leaf).
  *     This module's hints phrase them as the REQUESTED cwd; resume's say RECORDED.
@@ -76,21 +85,46 @@
  *     the session the window is actually in. It still reports no `pane_current_path`, and
  *     there is no "session created" field because nothing here creates one.
  */
-import { randomBytes } from "node:crypto";
 import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
-import { CODEX_PREFLIGHT_HINT } from "./codex-fresh-preflight.js";
+import { CODEX_CALLER_SEAT_HINT, resolveCodexCallerSeat, } from "./codex-caller-seat.js";
+import { CODEX_CALLER_PREFLIGHT_HINT, CODEX_LAUNCH_CWD_PREFLIGHT_HINT, CODEX_PREFLIGHT_HINT, codexLaunchCwdFreshPreflight, } from "./codex-fresh-preflight.js";
 import { COPILOT_PREFLIGHT_HINT, copilotFreshPreflight, } from "./copilot-fresh-preflight.js";
+import { buildOmpBootstrapPayload, composeBackendArgs, composeFreshCallPrompt, FRESH_CALL_BACKENDS, FRESH_CALL_CALLBACK_TOOL, isSafeFreshCallModel, MODEL_MAX_CHARS, mintNonce, normalizeFreshCallInputs, OMP_BOOTSTRAP_FLAG, OMP_BOOTSTRAP_VERSION, TASK_MAX_CHARS, } from "./fresh-call-composition.js";
 import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, } from "./mux-launch.js";
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
 import { resolveCodexDefaultSocketPath } from "./native-push/codex-ws-client.js";
 import { OMP_PREFLIGHT_HINT, ompFreshPreflight } from "./omp-fresh-preflight.js";
 import { classifyTmuxSessionName, resolveTmuxSessionId } from "./resolve-tmux-session.js";
-/** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
- * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, and `codex`
- * by #95 after its system birth and app-server rails were measured. The set is joined to the
- * citizen backends by `check-harness-admission-parity`: a harness that mints records but is
- * missing HERE is not an unwired convenience, it is a release blocker. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex"];
+/**
+ * THE COMPOSITION MOVED, THE RAIL DID NOT (#116 S2-a). Backend argv, the first-turn framing and
+ * the nonce now live in `fresh-call-composition.ts`, which knows nothing about tmux, so the herdr
+ * rail can reach them without importing this file and dragging placement behind it. They are
+ * re-exported here unchanged: every existing caller, gate and mutant anchor that reads them from
+ * this module keeps reading the same names.
+ *
+ * The two wrappers below are where this rail states what only it can state — the sentence that
+ * says a sibling was opened in the operator's tmux session, and the Codex socket path. Both are
+ * arguments to the leaf rather than knowledge inside it.
+ */
+export { buildOmpBootstrapPayload, FRESH_CALL_BACKENDS, FRESH_CALL_CALLBACK_TOOL, isSafeFreshCallModel, MODEL_MAX_CHARS, mintNonce, OMP_BOOTSTRAP_FLAG, OMP_BOOTSTRAP_VERSION, TASK_MAX_CHARS, };
+/** What the tmux rail tells a sibling about where it woke up. The resume verb has no equivalent
+ * because it composes no first turn at all; a herdr rail will pass its own sentence here. */
+export const TMUX_FRESH_CALL_OPENING_LINE = "You are a fresh visible citizen that entwurf opened in the operator's tmux session.";
+/** Backend argv for THIS rail: the neutral dialect, with the two Codex facts only a rail can
+ * state — the socket resolved from the caller's env, and the directory this launch chose.
+ *
+ * `launchCwd` defaults to THIS process's own directory, which is what tmux gives a window opened
+ * with no `-c` (`[측정 ×2]`, module header). The default is that inherited fact rather than a
+ * convenience, so a caller that omits it still names the truth to codex. Both facts reach the
+ * leaf lazily, because a host with no Codex home must still be able to open pi and claude
+ * siblings — see `composeBackendArgs`. */
+export function buildBackendArgs(backend, composition, model, env = process.env, launchCwd = process.cwd()) {
+    return composeBackendArgs(backend, composition, model, () => resolveCodexDefaultSocketPath(env), () => launchCwd);
+}
+/** The first turn for THIS rail: the neutral framing under this rail's placement sentence. */
+export function buildFreshCallPrompt(params) {
+    return composeFreshCallPrompt({ ...params, openingLine: TMUX_FRESH_CALL_OPENING_LINE });
+}
 /**
  * The fixed runtime each backend resolves on PATH. Same reason `mux-launch` uses PATH rather
  * than a compiled-in location: the official binary is whatever the operator's environment gives
@@ -121,234 +155,31 @@ export const FRESH_CALL_RUNTIME = {
     codex: "codex",
 };
 /**
- * The callback tool NAME differs per backend and that is not cosmetic: native pi exposes the
- * capability directly (`entwurf_v2`), while an MCP-hosted session reaches it under whatever
- * name that harness composes. Naming the wrong one costs the whole first turn.
- *
- * `[측정]` Copilot CLI 1.0.80 composes `<mcpServerName>-<mcpToolName>` — NOT Claude Code's
- * `mcp__<server>__<tool>`. Read from two independent sessions' own event logs
- * (`~/.copilot/session-state/<id>/events.jsonl`): `assistant.message.toolRequests[].name` and
- * `tool.execution_start.toolName` both carry `entwurf-bridge-entwurf_v2`, with
- * `mcpServerName`/`mcpToolName` beside them as the parts. Derive-and-measure, never copy a
- * sibling's spelling (`docs/adding-a-harness.md` step 5).
- *
- * `[측정]` omp 18.0.0 is the sharpest case for that rule: it mints
- * `mcp__${sanitizedServerName}_${normalizedToolName}` with a sanitizer whose charset is
- * `[a-z_]` (`mcp/tool-bridge.ts:351-357`, `:396`), so the DIGIT IN `entwurf_v2` IS EATEN and the
- * hyphen in the server key becomes an underscore — the model-facing name is
- * `mcp__entwurf_bridge_entwurf_v`, not `..._entwurf_v2` and not Claude's double-underscore form.
- * Confirmed against a live tool dump of all seven bridge tools and a real session transcript
- * (`scripts/raw-omp-measure/README.md` "Tool-name dialect"). Unlike Copilot there is no second
- * permission dialect: omp's approval layer consults the same minted string (`source-audit.md`).
- */
-export const FRESH_CALL_CALLBACK_TOOL = {
-    pi: "entwurf_v2",
-    "claude-code": "mcp__entwurf-bridge__entwurf_v2",
-    copilot: "entwurf-bridge-entwurf_v2",
-    omp: "mcp__entwurf_bridge_entwurf_v",
-    codex: "mcp__entwurf_bridge__entwurf_v2",
-};
-/** Mirrors the `entwurf_v2` message bound. This is an INTERFACE cap for symmetry with the
- * delivery surface, not a claim that a task of this size was measured through tmux. An argv
- * that the OS refuses is a launch failure and fails loud — it never reads as a delivered task. */
-export const TASK_MAX_CHARS = 16000;
-export const MODEL_MAX_CHARS = 200;
-const MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/:[\]-]*$/;
-/** A model is an explicit launch input, not ambient process state. The grammar admits canonical
- * pi provider/model ids, Claude model ids/aliases, and bracketed context variants, while refusing
- * whitespace and tmux control syntax. It is passed without a shell using each runtime's measured
- * CLI dialect: Pi takes `--model`, value; Claude Code takes `--model=value`. */
-export function isSafeFreshCallModel(model) {
-    return model.length > 0 && model.length <= MODEL_MAX_CHARS && MODEL_PATTERN.test(model);
-}
-/**
- * Backend argv AFTER the runtime path. Both orders are MEASURED, and both were measured by
- * getting them wrong first (rail §6-a):
- *
- *   pi          — prompt BEFORE `--entwurf-control`, then `--model`, value as TWO tokens.
- *                 Flag-first submitted no message; Pi rejects the equals form for `--model`.
- *   claude-code — prompt, then `--allowedTools=` and `--model=` as ONE token each. The space form
- *                 for allowedTools is variadic and eats the prompt as an option value.
- *   copilot     — the managed VERB first, then the prompt as the value of `-i/--interactive`,
- *                 `--model`, value as two tokens, and the policy as the explicit `--yolo`
- *                 token. Measured from `copilot --help` (1.0.80).
- *   omp         — NO positional prompt at all. The task rides `--entwurf-bootstrap`, a fixed
- *                 flag the installed birth extension registers, then `--model`, value as two
- *                 tokens, then the policy as `--approval-mode`, `yolo`. `-p/--print` remains
- *                 the flag this argv must never carry — it processes a prompt and EXITS,
- *                 closing the window on a sibling that has to stay open to be delivered to.
- *
- * Both pi/claude failures looked identical from outside: window open, record and socket minted,
- * no turn.
- *
- * For pi and claude-code the equals form is NOT a permission guarantee — on the measured host
- * the tool was already permitted, so the option's effect was unobservable. What was observed is
- * that it does no harm to the argv. Permission stays a documented host precondition there.
- *
- * Copilot is the backend where the policy IS carried explicitly (step 9 clause 2), and three of
- * its argv facts are load-bearing:
- *
- *   - `copilot` is argv[0] of the RUNTIME `entwurf`, i.e. the managed verb — see
- *     `FRESH_CALL_RUNTIME`. Everything after it is forwarded byte-identical by
- *     `scripts/copilot-launch.sh`.
- *   - the prompt rides `--interactive`, never `-p/--prompt`: `-p` runs the prompt and EXITS,
- *     which would close the window on a sibling that is supposed to stay open and be delivered
- *     to. `--interactive <prompt>` is non-variadic, so the space form is safe here.
- *   - the policy token is `--yolo`, STATED HERE rather than left to the launcher: the launcher
- *     injects `--yolo` only when the argv names no policy, and step 9 clause 2 requires the
- *     fresh composition to state its model and permission policy explicitly, never to rely
- *     invisibly on someone else's default.
- *
- * `--yolo` is a GLG operator decision, not a drifted default. The first cut passed a
- * callback-only `--allow-tool=entwurf-bridge(entwurf_v2)` grant, and GLG's 2026-08-25 operator
- * LIVE measured the consequence: the fresh sibling's footer showed no `YOLO`, and every tool
- * its task needed stopped on a confirmation prompt, which made the sibling impractical to work
- * with. GLG then set the policy explicitly: a fresh Copilot sibling carries the same managed
- * `--yolo` profile a human-typed `entwurf copilot` gets. (Copilot 1.0.80 help: `--yolo` = all
- * tools + all paths + all URLs.) The permission GRAMMAR lesson from that first cut — Copilot's
- * `--allow-tool` takes `<mcp-server-name>(tool-name?)`, a different dialect from the
- * model-facing tool name — stays recorded in `docs/adding-a-harness.md` step 9's worked
- * example; it is a measured vendor fact even though this argv no longer uses it.
- *
- * OMP'S POLICY TOKEN IS THE ONE MOST EASILY ARGUED AWAY, SO READ THIS BEFORE DELETING IT.
- * `[측정]` omp 18.0.0's schema default for `tools.approvalMode` IS ALREADY `yolo`
- * (vendor doc `omp://approval-mode.md`; `omp config get tools.approvalMode` → `yolo` on the
- * acceptance host). So dropping `--approval-mode yolo` changes NOTHING observable: the callback
- * still fires, the LIVE smoke still passes, and the argv silently starts depending on a vendor
- * default and on whatever the operator's config happens to say. That is exactly the drift step 9
- * clause 2 forbids — "carry the chosen width as an explicit argv token rather than relying on a
- * launcher's injected default" — and the reason the width is stated here even though the host
- * would have granted it anyway. The width itself (task-wide, not callback-only) is a GLG
- * operator decision of 2026-08-30, taken with the Copilot measurement in hand: a callback-only
- * sibling names itself and then stops at the first tool its TASK needs. omp offers no argv
- * grammar for a narrower grant at all — `tools.approval.<tool>` is a config axis, not a flag —
- * so the honest choice was between `write` and `yolo`, and `yolo` matches what a human-typed
- * `omp` gets on this host. `--approval-mode` takes both the space and equals form (measured);
- * the space form is used for symmetry with `--model`.
- *
- * WHY OMP ALONE CARRIES NO PROMPT, AND WHY THAT IS A MEASUREMENT RATHER THAN A PREFERENCE.
- * `[LIVE 2026-08-30]` the first public fresh call at omp DID pass the full framing as a bare
- * positional. The window opened, the record minted (garden `20260830T181342-452167`), the
- * prompt arrived byte-identical as a user message at `09:13:42.413Z` — and the model answered
- * the literal text `ACK` with ZERO tool calls, because the callback tool did not exist yet.
- * `[source]` the interactive UI defers MCP discovery and only refreshes the tool list once
- * `discoverAndConnect()` settles (`sdk.ts:1847-1855`, `:1881-1905`), while the positional
- * `initialMessage` prompts immediately after `await mode.init()` (`main.ts:540-565`,
- * `595-610`). `[측정]` a `/tmp` observer on the same runtime: `turn_start` at +654ms with the
- * entwurf tools ABSENT, callback tool present only at +1484ms — the turn began ~830ms before
- * the tool it was told to call existed. No argv can close that gap, because the gap is a race
- * inside the host. So the composition hands omp a PAYLOAD instead of a turn, and the
- * in-process birth extension — which can see when the tool becomes callable — owns the first
- * two messages (`pi-extensions/meta-bridge-omp.ts`, "THE TWO-STAGE FRESH BOOTSTRAP").
- *
- * The flag is fixed and one-purpose ON PURPOSE. `[측정 2026-08-30]` a normal discovered
- * extension that registers a flag receives the operator's argv value byte-identical — quotes,
- * `$VAR`, backticks and a semicolon all survived a 137-byte JSON payload — because extensions
- * load before argv classification and the reparse writes the registered map
- * (`main.ts:1799-1810`, `cli/extension-flags.ts:36-43`). An env carrier or a temp file would
- * have needed its own quoting, its own lifetime and its own refusal rules; argv already owns
- * all three. This is deliberately NOT a general `--flag value` passthrough — an arbitrary
- * carrier would hand callers the launch-shaping power this rail exists to refuse.
- */
-export function buildBackendArgs(backend, composition, model, env = process.env) {
-    switch (backend) {
-        case "pi":
-            return [composition.prompt, "--entwurf-control", "--model", model];
-        case "claude-code":
-            return [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]}`, `--model=${model}`];
-        case "copilot":
-            return ["copilot", "--interactive", composition.prompt, "--model", model, "--yolo"];
-        case "omp":
-            return [`--${OMP_BOOTSTRAP_FLAG}`, composition.bootstrapPayload, "--model", model, "--approval-mode", "yolo"];
-        case "codex":
-            return [
-                "--remote",
-                `unix://${resolveCodexDefaultSocketPath(env)}`,
-                "--model",
-                model,
-                "--dangerously-bypass-approvals-and-sandbox",
-                composition.prompt,
-            ];
-    }
-}
-/**
- * The omp bootstrap flag, spelled WITHOUT dashes — the vendor's flag map is keyed by bare
- * name (`extensions/loader.ts:221-228`) and this composition adds the `--` itself.
- *
- * Held equal to the installed extension's own constant by
- * `test/omp-fresh-bootstrap.contract.test.ts`. The two copies exist because the extension
- * ships INSIDE the omp agent dir carrying only its own small closure and cannot import this
- * module; the gate is what keeps the duplication from becoming drift.
- */
-export const OMP_BOOTSTRAP_FLAG = "entwurf-bootstrap";
-/** Payload grammar version, matched exactly by the decoder. A bump means a stale installed
- * unit, which is the one thing `doctor-omp-bridge` exists to say out loud. */
-export const OMP_BOOTSTRAP_VERSION = 1;
-/**
- * The whole of what a fresh omp sibling is launched with.
- *
- * THREE FIELDS, CLOSED. The decoder refuses an unknown key, so this object is the entire
- * contract: who to call back, the nonce that proves it is this call, and the task that is
- * released only after that callback succeeds. There is no command here, no path, no env name
- * and no model — the model is already an explicit argv token, and a second copy of it inside
- * a payload would be a second place for it to disagree with the launch.
- */
-export function buildOmpBootstrapPayload(params) {
-    return JSON.stringify({
-        v: OMP_BOOTSTRAP_VERSION,
-        target: params.callerGardenId,
-        nonce: params.nonce,
-        task: params.task,
-    });
-}
-/**
- * The first-turn framing. Order is the contract: the callback is the FIRST action and the task
- * follows it, so a sibling that gets stuck in the task has already told the caller who it is.
- *
- * The three prohibitions are not politeness. Each names a detour that was measured to produce a
- * confidently wrong answer or a wasted turn.
- */
-export function buildFreshCallPrompt(params) {
-    const tool = FRESH_CALL_CALLBACK_TOOL[params.backend];
-    return [
-        "You are a fresh visible citizen that entwurf opened in the operator's tmux session.",
-        "",
-        `FIRST ACTION, before reading files or anything else: call ${tool} with ` +
-            `target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
-            `message set to exactly ${params.nonce} — that string alone, nothing added.`,
-        "That call is how the agent that opened you learns your address. Do not skip it, do not",
-        "defer it until the task is done, and do not reword the message.",
-        "",
-        "Do not inspect environment variables, do not call entwurf_self, and do not start an MCP",
-        "server yourself. Your own report of your identity is not the address anyone needs.",
-        "",
-        "After the tool receipt, carry out this task:",
-        "",
-        params.task,
-    ].join("\n");
-}
-/**
- * Codex's explicit home topology (#95): the operator provides this one existing tmux session
- * and seats the operator-owned app-server plus supported Codex TUIs there. This is a placement
- * convention, not an address axis — `threadId` remains the native delivery address.
+ * WHICH RULE PICKS THE TARGET SESSION. Three in strict order, and the order is the contract:
+ *
+ *   1. an explicit `placement` — the expert override, and it wins over everything below.
+ *   2. a CODEX CALLER with placement omitted — the sibling opens beside the caller's own TUI
+ *      pane, found by the title anchor (#95 lane B). This one is NOT a named seat and is
+ *      therefore not decided here: it resolves to a native `$id` with no name in between, so
+ *      `freshCall` owns it directly (see the anchor step below) and this function answers
+ *      `null` so the name grammar and the name→id lookup stay out of a path that has neither.
+ *   3. anything else — the caller's own session, with no named seat at all.
+ *
+ * THE SEAT FOLLOWS THE CALLER, NEVER THE BACKEND BEING OPENED. #95 first shipped a fourth rule —
+ * an omitted-placement Codex TARGET selected a fixed existing session named `codex`, where the
+ * operator seated the app-server and their TUIs — and #95 D1 retired it (GLG, 2026-09-16). It
+ * was a workaround for a mapping that did not exist yet: nothing could find the pane a Codex
+ * caller was sitting in, so the operator was asked to keep every Codex in one known room. Rule 2
+ * is that mapping, so the room is no longer load-bearing, and keeping it would have meant Codex
+ * alone answering "where does a sibling open?" differently from every other backend. The
+ * operator-owned app-server keeps its own seat wherever the operator puts it; Entwurf still
+ * never creates, moves or supervises it.
  */
-export const CODEX_HOME_TMUX_SESSION = "codex";
-/** An explicit seat always wins. Only omitted Codex placement gets the fixed home. */
-export function selectFreshCallSeat(backend, placement) {
+export function selectFreshCallSeat(placement) {
     if (placement !== undefined)
         return { tmuxSession: placement.tmuxSession, source: "requested" };
-    if (backend === "codex")
-        return { tmuxSession: CODEX_HOME_TMUX_SESSION, source: "codex-home" };
     return null;
 }
-/** Correlation tag only. Random, never derived from time, cwd or a peer listing — a nonce that
- * encoded any of those would invite exactly the guessing this rail exists to refuse. */
-export function mintNonce(randomHex = defaultRandomHex) {
-    return `mux-fresh-call-${randomHex()}`;
-}
-function defaultRandomHex() {
-    return randomBytes(12).toString("hex");
-}
 /**
  * The pi identity carrier, scrubbed at the launch seam for EVERY backend (#87 Bundle C).
  *
@@ -416,25 +247,48 @@ export function buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cw
  * `callerGardenId` is supplied by the SURFACE that registered this tool, from its own
  * record-backed context. It is not a tool parameter and this module never derives, validates
  * against a store, or guesses it: an empty value is a named refusal, not a lookup.
+ *
+ * `callerNativeSessionId` is supplied by the same surface under the same rule, and its PRESENCE
+ * is the whole signal: it is set exactly when the reconciled sender is a record-backed codex
+ * citizen, and it carries that citizen's `nativeSessionId` (the `_meta.threadId` the vendor put
+ * on this very request). This module never resolves it, never reads `_meta`, and never asks a
+ * store who is calling — it only turns a thread id into a pane, and only for placement.
+ *
+ * `callerCwd` rides the same surface rule and the same condition: it is that codex citizen's
+ * RECORD cwd, and it exists because a codex caller's process directory is NOT its own (the
+ * bridge runs as a child of the operator-owned app-server, so the directory that process
+ * reports is the app-server's — #95 lane C §2). It is consulted only when the caller requested
+ * no cwd, so an
+ * explicit request always wins, and this module never looks a cwd up, resolves it, or infers it
+ * from a seat, a workspace map or a project name.
  */
 export function freshCall(params, env = process.env, nonce = mintNonce()) {
-    if (typeof params.callerGardenId !== "string" || params.callerGardenId.length === 0) {
-        return { ok: false, reason: "caller-identity-unavailable" };
-    }
-    const model = params.model.trim();
-    if (model.length === 0)
-        return { ok: false, reason: "model-empty" };
-    if (!isSafeFreshCallModel(model))
-        return { ok: false, reason: "model-invalid" };
-    const task = params.task.trim();
-    if (task.length === 0)
-        return { ok: false, reason: "task-empty" };
-    if (task.length > TASK_MAX_CHARS)
-        return { ok: false, reason: "task-too-long" };
-    // ONLY `undefined` and the exact empty string mean "no cwd". Everything else is the literal
-    // value — deliberately untrimmed, so a whitespace-mangled path is refused loudly by the
-    // classification below instead of being silently repaired into a different directory.
-    const cwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+    // The caller-facing input contract lives in the composition leaf so BOTH rails answer a
+    // mistyped model or an oversized task with the same words. Order, trimming and the
+    // cwd-omission rule (`undefined` and the exact empty string, and nothing else, mean "no
+    // cwd") are unchanged from when they lived here.
+    const normalized = normalizeFreshCallInputs(params);
+    if (!normalized.ok)
+        return { ok: false, reason: normalized.reason };
+    const { callerGardenId, model, task, cwd: requestedCwd } = normalized.inputs;
+    // The caller's own record directory answers the SAME two-value emptiness rule the leaf
+    // applies to a requested cwd, and is consulted ONLY second: an explicit request always wins,
+    // and a caller that supplies neither leaves the pane to inherit this process's directory
+    // exactly as before — a pi caller's argv is byte-identical, because its process directory IS
+    // its own and a `-c` token would change nothing about where that window lands.
+    const callerCwd = params.callerCwd === undefined || params.callerCwd === "" ? undefined : params.callerCwd;
+    const chosenCwd = requestedCwd !== undefined
+        ? { value: requestedCwd, source: "requested" }
+        : callerCwd !== undefined
+            ? { value: callerCwd, source: "codex-caller-record" }
+            : undefined;
+    const cwd = chosenCwd?.value;
+    // SEAM (#95 lane C): a caller-record directory is classified by the SAME shared leaf and
+    // answers the same four `cwd-*` reasons, whose hint text says REQUESTED. When a codex
+    // caller's recorded directory has since been deleted, the repair that hint points at is
+    // still the right one — that directory does not exist — but the noun belongs to the caller
+    // rather than to the request. Kept shared on purpose: doubling the reason set for a wording
+    // difference would double the refusal contract two surfaces and one leaf already agree on.
     if (cwd !== undefined) {
         const badCwd = classifyTmuxCwd(cwd);
         if (badCwd)
@@ -444,9 +298,10 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
     // without tmux, so an unresolvable name is answered before anything else runs. Whether that
     // session EXISTS is a tmux question and is asked below, after the caller's own context is
     // proven — a name check that needed a live server would refuse for the wrong reason on a
-    // host with no tmux at all. Codex alone selects its fixed home when the caller omitted a seat;
-    // an explicit seat remains an expert override and is reported as such.
-    const selectedSeat = selectFreshCallSeat(params.backend, params.placement);
+    // host with no tmux at all. An explicit seat is an expert override and is reported as such; a
+    // CODEX CALLER's own pane is deliberately not a name at all, so it is absent here and
+    // resolved after the context proof below — see `selectFreshCallSeat` for the three-rule order.
+    const selectedSeat = selectFreshCallSeat(params.placement);
     const seat = selectedSeat?.tmuxSession;
     if (seat !== undefined) {
         const badSeat = classifyTmuxSessionName(seat);
@@ -488,22 +343,67 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
     // native id continues; the name does not travel past this line. STILL PRE-MUTATION: an
     // absent seat refuses with no window anywhere.
     let targetSessionId = placement.sessionId;
+    let anchoredSeat = false;
     if (seat !== undefined) {
         const resolved = resolveTmuxSessionId(seat, (args) => runTmux(args, env));
         if (!resolved.ok)
             return { ok: false, reason: resolved.reason };
         targetSessionId = resolved.sessionId;
     }
+    else if (params.placement === undefined && params.callerNativeSessionId !== undefined) {
+        // Rule 2: the caller is a codex citizen and named no seat, so the sibling belongs beside
+        // the caller's own TUI. The pane is found by the title anchor and ONLY its `$session`
+        // continues — a pane title is forgeable, so it may never become an address, a liveness
+        // claim or a delivery input (Hard Rule 16). `params.placement` is re-read here rather
+        // than inferred from `seat === undefined`: "an explicit seat always wins" is the one
+        // invariant a later edit must not be able to lose by accident.
+        // STILL PRE-MUTATION: 0 or 2+ matching panes refuse with no window anywhere and no
+        // fallback to any other session.
+        const anchor = resolveCodexCallerSeat(params.callerNativeSessionId, (args) => runTmux(args, env));
+        if (!anchor.ok)
+            return { ok: false, reason: anchor.reason };
+        targetSessionId = anchor.seat.sessionId;
+        anchoredSeat = true;
+    }
     const composition = {
         prompt: buildFreshCallPrompt({
             backend: params.backend,
             task,
-            callerGardenId: params.callerGardenId,
+            callerGardenId,
             nonce,
         }),
-        bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId: params.callerGardenId, nonce, task }),
+        bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId, nonce, task }),
     };
-    const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, buildBackendArgs(params.backend, composition, model, env), cwd), env);
+    const backendArgs = buildBackendArgs(params.backend, composition, model, env, cwd);
+    // THE LAUNCH-DIRECTORY NOTE, AND IT IS A DIAGNOSTIC RATHER THAN A GATE. `[측정 2026-09-16]` a
+    // Codex sibling opened into a directory this Codex has no answer for stops on the vendor's
+    // folder-consent screen: no first turn, no rollout, no callback. It is tempting to refuse
+    // that, and refusing is the wrong product. The consent screen is SELF-REPAIRING when a human
+    // is there — one answer and the vendor records the directory, so every later launch runs —
+    // and an operator at the keyboard is exactly who a visible-first rail is built for. A refusal
+    // would replace that one answer with "no window, go run codex yourself, then call again", and
+    // it would have to be right about a decision this process cannot fully see (the vendor merges
+    // system, managed and cloud layers around the file this leaf reads). So the launch proceeds
+    // and says what it saw.
+    //
+    // The UNATTENDED case is not answered here and must not be: a gate with nobody at the keyboard
+    // needs its precondition named before it spends a model turn, which is its own oracle's job —
+    // `smoke-codex-fresh-live` asserts this same leaf up front, so a missing answer reads as a
+    // named precondition instead of a callback timeout.
+    //
+    // The directory asked about is READ BACK off codex's own `-C` token rather than recomputed:
+    // one resolution, one authority, and no way for the note to name a directory the thread will
+    // not start in (this module is deliberately not allowed to resolve the inherited default a
+    // second time — `FRESHCALL-CWD-CALLER-ONLY`).
+    if (params.backend === "codex") {
+        const at = backendArgs.indexOf("-C");
+        const launchCwd = backendArgs[at + 1] ?? "";
+        const unanswered = codexLaunchCwdFreshPreflight(env, launchCwd);
+        if (unanswered) {
+            console.error(`[fresh-call] ${unanswered}: ${launchCwd}\n` + `            ${CODEX_LAUNCH_CWD_PREFLIGHT_HINT[unanswered]}`);
+        }
+    }
+    const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cwd), env);
     assertTmuxOk("new-window", run);
     let fields;
     try {
@@ -523,9 +423,11 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
             ...fields,
             backend: params.backend,
             model,
-            ...(cwd === undefined ? {} : { cwd }),
+            ...(chosenCwd === undefined ? {} : { cwd: chosenCwd.value, cwdSource: chosenCwd.source }),
             ...(selectedSeat === null
-                ? {}
+                ? anchoredSeat
+                    ? { tmuxSessionSource: "codex-title-anchor" }
+                    : {}
                 : { tmuxSession: selectedSeat.tmuxSession, tmuxSessionSource: selectedSeat.source }),
             runtimePath,
             nonce,
@@ -540,6 +442,8 @@ const REJECT_HINT = {
     ...COPILOT_PREFLIGHT_HINT,
     ...OMP_PREFLIGHT_HINT,
     ...CODEX_PREFLIGHT_HINT,
+    ...CODEX_CALLER_PREFLIGHT_HINT,
+    ...CODEX_CALLER_SEAT_HINT,
     "no-tmux-context": "this agent is not running inside tmux, so there is no session to open a sibling beside",
     "anchor-malformed": "TMUX_PANE is not a native pane id",
     "anchor-unresolved": "tmux resolved no pane for this agent's anchor",
@@ -550,7 +454,7 @@ const REJECT_HINT = {
     "cwd-missing": "the requested cwd does not exist; tmux would not report this, it would open the window in $HOME and look successful",
     "cwd-not-directory": "the requested cwd exists but is not a directory",
     "tmux-session-name-invalid": "the requested tmux session name is outside the shape this rail addresses (start with a letter or digit, then letters, digits, '_' or '-') — some other shapes tmux cannot resolve at all ('#' is expanded when the name is stored; '.' and ':' are its own pane/window separators inside a target; a name like '$0' loses to the session id '$0'), and the rest are declined to keep one narrow grammar, so rename the session or open one whose name fits",
-    "tmux-session-missing": "no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again; Codex's omitted-placement home is the exact session name 'codex'",
+    "tmux-session-missing": "no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
     "model-empty": "model is empty after trimming; fresh calls require an explicit model",
     "model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
     "task-empty": "task is empty after trimming",
@@ -583,11 +487,15 @@ export function renderFreshCall(result) {
         text: `[entwurf fresh call →]\n` +
             `  backend:  ${r.backend} (${r.runtimePath})\n` +
             `  model:    ${r.model} (requested on the runtime CLI)\n` +
-            (r.cwd === undefined ? "" : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
-            (r.tmuxSession === undefined
+            (r.cwd === undefined
+                ? ""
+                : r.cwdSource === "codex-caller-record"
+                    ? `  cwd:      ${r.cwd} (the Codex caller's own record directory, used because no cwd was requested — not an observation)\n`
+                    : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
+            (r.tmuxSessionSource === undefined
                 ? ""
-                : r.tmuxSessionSource === "codex-home"
-                    ? `  seat:     ${r.tmuxSession} (Codex home tmux session, resolved to ${r.sessionId})\n`
+                : r.tmuxSessionSource === "codex-title-anchor"
+                    ? `  seat:     ${r.sessionId} (the Codex caller's own pane, found by its thread-id terminal title — an OBSERVED session, not a requested name)\n`
                     : `  seat:     ${r.tmuxSession} (requested tmux session, resolved to ${r.sessionId})\n`) +
             `  window:   ${r.windowId} (index ${r.windowIndex}) in session ${r.sessionId}\n` +
             `  pane:     ${r.paneId} pid ${r.panePid}\n` +

package/mcp/entwurf-bridge/dist/scripts/codex-socket-path.js

@@ -0,0 +1,30 @@
+/**
+ * codex-socket-path — print the Codex app-server default control-socket path for THIS
+ * environment, and nothing else.
+ *
+ * WHY A LEAF EXISTS FOR ONE LINE. `entwurf codex-app-server` is a bash launcher, and bash
+ * cannot import `resolveCodexDefaultSocketPath`. Its first version re-derived the path
+ * instead — `${CODEX_HOME:-$HOME/.codex}` plus a POSIX `[:space:]` trim — and a gate compared
+ * the two spellings over four ASCII-normal inputs, which they agreed on.
+ *
+ * They did not agree everywhere. `[측정 2026-09-16]` with `CODEX_HOME=$''` the TS leaf
+ * trims (JS `String.prototype.trim` strips U+FEFF) and falls back to `$HOME/.codex`, while the
+ * bash trim keeps the byte and yields `<BOM>/app-server-control/app-server-control.sock`. Same
+ * for `path.join`'s normalization of a trailing slash or a `..` segment. Every one of those is
+ * a managed launch starting a server at an address delivery and preflight never look at — a
+ * false success of exactly the kind this repo refuses.
+ *
+ * So the second spelling is gone rather than widened. There is ONE implementation of this
+ * address, this leaf prints it, and the launcher asks. Matching a transcription against its
+ * original can only ever test the inputs somebody thought of.
+ *
+ * Reads `process.env` directly: the resolver's contract is the ambient environment of whoever
+ * is about to launch, and an argv seam here would be a way to redirect the address.
+ */
+import { resolveCodexDefaultSocketPath } from "../pi-extensions/lib/native-push/codex-ws-client.js";
+if (process.argv.length > 2) {
+    console.error("usage: codex-socket-path   (no arguments; the environment is the input)");
+    process.exit(2);
+}
+// No trailing newline: the caller substitutes this straight into an address.
+process.stdout.write(resolveCodexDefaultSocketPath(process.env));