@junghanacs/entwurf 0.22.0 → 0.23.0

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -64,7 +64,6 @@ import * as process from "node:process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { codexCallerFreshPreflight, codexFreshPreflight } from "../../../pi-extensions/lib/codex-fresh-preflight.js";
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
 import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.js";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.js";
@@ -74,9 +73,9 @@ import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contr
 import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/entwurf-v2-decider.js";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
 import { makeVisibleResumeDeps, renderVisibleResume, visibleResume, } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.js";
+import { dispatchFreshCall, renderDispatchedFreshCall } from "../../../pi-extensions/lib/fresh-call-dispatch.js";
 import { probeNativeSenderAlive, reconcileSenderIdentityClaims, resolveCodexRequestSenderIdentity, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
 import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "../../../pi-extensions/lib/meta-session.js";
-import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.js";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
 const HOME = os.homedir();
@@ -598,29 +597,29 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 // its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
 // environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
 // against that answer would call home to a garden id nobody holds.
-server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Five fixed " +
-    "backends only: pi, claude-code, copilot, omp, codex. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
-    "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
-    "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
-    "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
-    "for the callback; if it never arrives the window is visible. For EXISTING " +
-    "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
-    "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code; a model name " +
-    "or `auto` for copilot; a fuzzy model pattern for omp or codex). Copilot, omp, and codex are refused BEFORE " +
-    "any window opens when their required birth, MCP, receive/delivery, or visible-identity units are absent; " +
-    "Codex also requires the operator-owned default app-server socket, which entwurf never starts. An optional " +
-    "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
-    "for a dormant record's cwd. Omitted/empty cwd means the caller's own directory. " +
-    "An optional placement.tmuxSession is an expert override naming ONE EXISTING session on this agent's own " +
-    "tmux server, and it ALWAYS wins. Omitted, the seat follows the CALLER: a CODEX CALLER opens beside its own " +
-    "TUI pane (matched by thread-id in that pane's title; 0 or 2+ matches REFUSE, never fall back), and every " +
-    "other caller opens in its own session. " +
-    "A missing named session is tmux-session-missing and NOTHING is created. " +
-    "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
-    "same-user processes on this host. Requires that this agent itself runs inside tmux.", {
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and hand it a first task. WHERE it opens is decided by where THIS " +
+    "agent runs, never by a parameter: inside herdr (HERDR_ENV=1) it opens a NEW UNFOCUSED TAB in your own " +
+    "herdr workspace, pi and claude-code " +
+    "only; everywhere else it opens in the operator's tmux with all five backends (pi, " +
+    "claude-code, copilot, omp, codex). No fallback: an incomplete herdr context is refused by name, " +
+    "never by a tmux window you cannot see from herdr. The sibling's FIRST action " +
+    "is a callback to you carrying a nonce, whose sender envelope is its garden id — that is how you learn the " +
+    "address of a thing that did not exist a moment ago. This returns a LAUNCH receipt (the owner's " +
+    "coordinates plus that nonce): it does NOT mean the runtime started, the first turn ran, or " +
+    "the task was delivered. Those coordinates are a VIEW, never an address — a herdr tab/pane id can change under " +
+    "a running sibling. Nothing polls. " +
+    "For EXISTING citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and passed to the chosen " +
+    "runtime CLI (`provider/model` for pi, an id/alias for Claude Code, a pattern for the rest). On tmux, copilot/omp/codex are refused BEFORE any window " +
+    "opens when their birth, MCP, receive or visible-identity units are absent, and codex also needs the " +
+    "operator-owned app-server socket entwurf never starts; in herdr they are refused by name first. " +
+    "Optional placement.tmuxSession is a TMUX-ONLY seat naming ONE EXISTING session and " +
+    "ALWAYS wins; omitted, the seat follows the CALLER, never the backend opened: a CODEX CALLER opens beside " +
+    "its own TUI pane, every other caller in its own session; a missing one is tmux-session-missing and " +
+    "NOTHING is created. In herdr the field is refused by name. Do not put secrets in the task — model and task argv are visible to same-user " +
+    "processes.", {
     backend: z
         .enum(["pi", "claude-code", "copilot", "omp", "codex"])
-        .describe("Which fixed runtime to open. Only these five; there is no arbitrary command."),
+        .describe("Which fixed runtime to open. Only these five, and only pi/claude-code when this agent runs inside herdr; there is no arbitrary command."),
     model: z
         .string()
         .min(1)
@@ -643,7 +642,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
     cwd: z
         .string()
         .optional()
-        .describe("Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). Omit or pass \"\" to start where the CALLER is: its own directory, or for a Codex caller its own record directory, because this bridge is the app-server's child and that process's directory is not the caller's. The receipt echoes the directory that was REQUESTED or the caller record it came from, never an observation of where the pane landed."),
+        .describe("Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start where the CALLER is — this agent's own cwd on BOTH rails, or for a Codex caller its own record directory, because this bridge is the app-server's child and that process's directory is not the caller's. Taken exactly as given: no trim, no realpath, no project-name resolution. '#' is refused on the tmux rail only, because tmux format-expands a start directory; inside herdr it is an ordinary path character. The receipt echoes the directory that was REQUESTED or the caller record it came from, never an observation of where the pane landed."),
     placement: z
         .object({
         tmuxSession: z
@@ -651,7 +650,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
             .describe("EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid."),
     })
         .optional()
-        .describe("Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server, and it always wins. When omitted the seat follows the CALLER, never the backend being opened: a Codex CALLER opens beside its own TUI pane, matched by thread-id in that pane's terminal title (0 or 2+ matching panes refuse, never fall back); every other caller opens in its own session. A pane title is a placement input only — never an address, liveness or delivery fact. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name (absent for the caller-pane rule, which observed a session rather than requesting a name), its source, and resolved target session id."),
+        .describe("Optional expert seat override, TMUX ONLY: open the sibling in ONE EXISTING tmux session of this agent's own server, and it always wins. When omitted the seat follows the CALLER, never the backend being opened: a Codex CALLER opens beside its own TUI pane, matched by thread-id in that pane's terminal title (0 or 2+ matching panes refuse, never fall back); every other caller opens in its own session. A pane title is a placement input only — never an address, liveness or delivery fact. Nothing is ever created. Inside herdr this field is refused by name — placement there belongs to herdr, and a tmux session name would silently place the sibling somewhere else. Independent of cwd; neither is inferred from the other. The receipt reports the selected name (absent for the caller-pane rule, which observed a session rather than requesting a name), its source, and resolved target session id."),
 }, async ({ backend, model, task, cwd, placement }, extra) => {
     let callerGardenId = null;
     // Present exactly when the reconciled caller is a record-backed codex citizen. Its ONLY
@@ -685,21 +684,21 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         callerGardenId = null;
     }
     try {
-        // TWO capability axes, in this order, both pre-mutation and neither standing in for
-        // the other. The TARGET axis first — "entwurf cannot open a Codex sibling here at
-        // all" is the more fundamental answer than "and it would not know where to put it".
-        // The CALLER axis second, and only when the seat anchor will actually be consulted:
-        // a codex caller that named an explicit placement never reads a pane title, so
-        // refusing it for a missing `thread-id` would refuse an unused capability.
-        const targetMissing = backend === "codex" ? await codexFreshPreflight(process.env) : null;
-        const callerMissing = targetMissing === null && callerNativeSessionId !== undefined && placement === undefined
-            ? codexCallerFreshPreflight(process.env)
-            : null;
-        const missing = targetMissing ?? callerMissing;
-        const result = missing
-            ? { ok: false, reason: missing }
-            : freshCall({ backend, model, task, cwd, placement, callerGardenId, callerNativeSessionId, callerCwd });
-        const rendered = renderFreshCall(result);
+        // Rail choice, Codex preflight ordering and rendering all live in the composition root,
+        // so this surface and pi's own cannot drift apart on any of them. The two caller-derived
+        // codex inputs ride with the request: the root consults them only on the tmux rail,
+        // which is where #95 lane B/C measured them.
+        const dispatched = await dispatchFreshCall({
+            backend,
+            model,
+            task,
+            cwd,
+            placement,
+            callerGardenId,
+            callerNativeSessionId,
+            callerCwd,
+        });
+        const rendered = renderDispatchedFreshCall(dispatched);
         return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
     }
     catch (err) {