@junghanacs/entwurf 0.22.0 → 0.23.1

package/pi-extensions/lib/mux-fresh-call.ts

@@ -86,7 +86,6 @@
  *     there is no "session created" field because nothing here creates one.
  */
 
-import { randomBytes } from "node:crypto";
 import { classifyTmuxCwd, type TmuxCwdRejectReason } from "./classify-tmux-cwd.ts";
 import {
 	CODEX_CALLER_SEAT_HINT,
@@ -106,6 +105,23 @@ import {
 	type CopilotPreflightRejectReason,
 	copilotFreshPreflight,
 } from "./copilot-fresh-preflight.ts";
+import {
+	buildOmpBootstrapPayload,
+	composeBackendArgs,
+	composeFreshCallPrompt,
+	FRESH_CALL_BACKENDS,
+	FRESH_CALL_CALLBACK_TOOL,
+	type FreshCallBackend,
+	type FreshCallComposition,
+	type FreshCallInputRejectReason,
+	isSafeFreshCallModel,
+	MODEL_MAX_CHARS,
+	mintNonce,
+	normalizeFreshCallInputs,
+	OMP_BOOTSTRAP_FLAG,
+	OMP_BOOTSTRAP_VERSION,
+	TASK_MAX_CHARS,
+} from "./fresh-call-composition.ts";
 import {
 	assertLaunchTarget,
 	LaunchPreconditionError,
@@ -127,13 +143,69 @@ import { resolveCodexDefaultSocketPath } from "./native-push/codex-ws-client.ts"
 import { OMP_PREFLIGHT_HINT, type OmpPreflightRejectReason, ompFreshPreflight } from "./omp-fresh-preflight.ts";
 import { classifyTmuxSessionName, resolveTmuxSessionId, type TmuxSessionRejectReason } from "./resolve-tmux-session.ts";
 
-/** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
- * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, and `codex`
- * by #95 after its system birth and app-server rails were measured. The set is joined to the
- * citizen backends by `check-harness-admission-parity`: a harness that mints records but is
- * missing HERE is not an unwired convenience, it is a release blocker. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex"] as const;
-export type FreshCallBackend = (typeof FRESH_CALL_BACKENDS)[number];
+/**
+ * THE COMPOSITION MOVED, THE RAIL DID NOT (#116 S2-a). Backend argv, the first-turn framing and
+ * the nonce now live in `fresh-call-composition.ts`, which knows nothing about tmux, so the herdr
+ * rail can reach them without importing this file and dragging placement behind it. They are
+ * re-exported here unchanged: every existing caller, gate and mutant anchor that reads them from
+ * this module keeps reading the same names.
+ *
+ * The two wrappers below are where this rail states what only it can state — the sentence that
+ * says a sibling was opened in the operator's tmux session, and the Codex socket path. Both are
+ * arguments to the leaf rather than knowledge inside it.
+ */
+export {
+	buildOmpBootstrapPayload,
+	FRESH_CALL_BACKENDS,
+	FRESH_CALL_CALLBACK_TOOL,
+	type FreshCallBackend,
+	type FreshCallComposition,
+	isSafeFreshCallModel,
+	MODEL_MAX_CHARS,
+	mintNonce,
+	OMP_BOOTSTRAP_FLAG,
+	OMP_BOOTSTRAP_VERSION,
+	TASK_MAX_CHARS,
+};
+
+/** What the tmux rail tells a sibling about where it woke up. The resume verb has no equivalent
+ * because it composes no first turn at all; a herdr rail will pass its own sentence here. */
+export const TMUX_FRESH_CALL_OPENING_LINE =
+	"You are a fresh visible citizen that entwurf opened in the operator's tmux session.";
+
+/** Backend argv for THIS rail: the neutral dialect, with the two Codex facts only a rail can
+ * state — the socket resolved from the caller's env, and the directory this launch chose.
+ *
+ * `launchCwd` defaults to THIS process's own directory, which is what tmux gives a window opened
+ * with no `-c` (`[측정 ×2]`, module header). The default is that inherited fact rather than a
+ * convenience, so a caller that omits it still names the truth to codex. Both facts reach the
+ * leaf lazily, because a host with no Codex home must still be able to open pi and claude
+ * siblings — see `composeBackendArgs`. */
+export function buildBackendArgs(
+	backend: FreshCallBackend,
+	composition: FreshCallComposition,
+	model: string,
+	env: NodeJS.ProcessEnv = process.env,
+	launchCwd: string = process.cwd(),
+): string[] {
+	return composeBackendArgs(
+		backend,
+		composition,
+		model,
+		() => resolveCodexDefaultSocketPath(env),
+		() => launchCwd,
+	);
+}
+
+/** The first turn for THIS rail: the neutral framing under this rail's placement sentence. */
+export function buildFreshCallPrompt(params: {
+	backend: FreshCallBackend;
+	task: string;
+	callerGardenId: string;
+	nonce: string;
+}): string {
+	return composeFreshCallPrompt({ ...params, openingLine: TMUX_FRESH_CALL_OPENING_LINE });
+}
 
 /**
  * The fixed runtime each backend resolves on PATH. Same reason `mux-launch` uses PATH rather
@@ -165,273 +237,11 @@ export const FRESH_CALL_RUNTIME: Record<FreshCallBackend, string> = {
 	codex: "codex",
 };
 
-/**
- * The callback tool NAME differs per backend and that is not cosmetic: native pi exposes the
- * capability directly (`entwurf_v2`), while an MCP-hosted session reaches it under whatever
- * name that harness composes. Naming the wrong one costs the whole first turn.
- *
- * `[측정]` Copilot CLI 1.0.80 composes `<mcpServerName>-<mcpToolName>` — NOT Claude Code's
- * `mcp__<server>__<tool>`. Read from two independent sessions' own event logs
- * (`~/.copilot/session-state/<id>/events.jsonl`): `assistant.message.toolRequests[].name` and
- * `tool.execution_start.toolName` both carry `entwurf-bridge-entwurf_v2`, with
- * `mcpServerName`/`mcpToolName` beside them as the parts. Derive-and-measure, never copy a
- * sibling's spelling (`docs/adding-a-harness.md` step 5).
- *
- * `[측정]` omp 18.0.0 is the sharpest case for that rule: it mints
- * `mcp__${sanitizedServerName}_${normalizedToolName}` with a sanitizer whose charset is
- * `[a-z_]` (`mcp/tool-bridge.ts:351-357`, `:396`), so the DIGIT IN `entwurf_v2` IS EATEN and the
- * hyphen in the server key becomes an underscore — the model-facing name is
- * `mcp__entwurf_bridge_entwurf_v`, not `..._entwurf_v2` and not Claude's double-underscore form.
- * Confirmed against a live tool dump of all seven bridge tools and a real session transcript
- * (`scripts/raw-omp-measure/README.md` "Tool-name dialect"). Unlike Copilot there is no second
- * permission dialect: omp's approval layer consults the same minted string (`source-audit.md`).
- */
-export const FRESH_CALL_CALLBACK_TOOL: Record<FreshCallBackend, string> = {
-	pi: "entwurf_v2",
-	"claude-code": "mcp__entwurf-bridge__entwurf_v2",
-	copilot: "entwurf-bridge-entwurf_v2",
-	omp: "mcp__entwurf_bridge_entwurf_v",
-	codex: "mcp__entwurf_bridge__entwurf_v2",
-};
-
-/** Mirrors the `entwurf_v2` message bound. This is an INTERFACE cap for symmetry with the
- * delivery surface, not a claim that a task of this size was measured through tmux. An argv
- * that the OS refuses is a launch failure and fails loud — it never reads as a delivered task. */
-export const TASK_MAX_CHARS = 16000;
-export const MODEL_MAX_CHARS = 200;
-const MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/:[\]-]*$/;
-
-/** A model is an explicit launch input, not ambient process state. The grammar admits canonical
- * pi provider/model ids, Claude model ids/aliases, and bracketed context variants, while refusing
- * whitespace and tmux control syntax. It is passed without a shell using each runtime's measured
- * CLI dialect: Pi takes `--model`, value; Claude Code takes `--model=value`. */
-export function isSafeFreshCallModel(model: string): boolean {
-	return model.length > 0 && model.length <= MODEL_MAX_CHARS && MODEL_PATTERN.test(model);
-}
-
-/**
- * Backend argv AFTER the runtime path. Both orders are MEASURED, and both were measured by
- * getting them wrong first (rail §6-a):
- *
- *   pi          — prompt BEFORE `--entwurf-control`, then `--model`, value as TWO tokens.
- *                 Flag-first submitted no message; Pi rejects the equals form for `--model`.
- *   claude-code — prompt, then `--allowedTools=` and `--model=` as ONE token each. The space form
- *                 for allowedTools is variadic and eats the prompt as an option value.
- *   copilot     — the managed VERB first, then the prompt as the value of `-i/--interactive`,
- *                 `--model`, value as two tokens, and the policy as the explicit `--yolo`
- *                 token. Measured from `copilot --help` (1.0.80).
- *   omp         — NO positional prompt at all. The task rides `--entwurf-bootstrap`, a fixed
- *                 flag the installed birth extension registers, then `--model`, value as two
- *                 tokens, then the policy as `--approval-mode`, `yolo`. `-p/--print` remains
- *                 the flag this argv must never carry — it processes a prompt and EXITS,
- *                 closing the window on a sibling that has to stay open to be delivered to.
- *
- * Both pi/claude failures looked identical from outside: window open, record and socket minted,
- * no turn.
- *
- * For pi and claude-code the equals form is NOT a permission guarantee — on the measured host
- * the tool was already permitted, so the option's effect was unobservable. What was observed is
- * that it does no harm to the argv. Permission stays a documented host precondition there.
- *
- * Copilot is the backend where the policy IS carried explicitly (step 9 clause 2), and three of
- * its argv facts are load-bearing:
- *
- *   - `copilot` is argv[0] of the RUNTIME `entwurf`, i.e. the managed verb — see
- *     `FRESH_CALL_RUNTIME`. Everything after it is forwarded byte-identical by
- *     `scripts/copilot-launch.sh`.
- *   - the prompt rides `--interactive`, never `-p/--prompt`: `-p` runs the prompt and EXITS,
- *     which would close the window on a sibling that is supposed to stay open and be delivered
- *     to. `--interactive <prompt>` is non-variadic, so the space form is safe here.
- *   - the policy token is `--yolo`, STATED HERE rather than left to the launcher: the launcher
- *     injects `--yolo` only when the argv names no policy, and step 9 clause 2 requires the
- *     fresh composition to state its model and permission policy explicitly, never to rely
- *     invisibly on someone else's default.
- *
- * `--yolo` is a GLG operator decision, not a drifted default. The first cut passed a
- * callback-only `--allow-tool=entwurf-bridge(entwurf_v2)` grant, and GLG's 2026-08-25 operator
- * LIVE measured the consequence: the fresh sibling's footer showed no `YOLO`, and every tool
- * its task needed stopped on a confirmation prompt, which made the sibling impractical to work
- * with. GLG then set the policy explicitly: a fresh Copilot sibling carries the same managed
- * `--yolo` profile a human-typed `entwurf copilot` gets. (Copilot 1.0.80 help: `--yolo` = all
- * tools + all paths + all URLs.) The permission GRAMMAR lesson from that first cut — Copilot's
- * `--allow-tool` takes `<mcp-server-name>(tool-name?)`, a different dialect from the
- * model-facing tool name — stays recorded in `docs/adding-a-harness.md` step 9's worked
- * example; it is a measured vendor fact even though this argv no longer uses it.
- *
- * OMP'S POLICY TOKEN IS THE ONE MOST EASILY ARGUED AWAY, SO READ THIS BEFORE DELETING IT.
- * `[측정]` omp 18.0.0's schema default for `tools.approvalMode` IS ALREADY `yolo`
- * (vendor doc `omp://approval-mode.md`; `omp config get tools.approvalMode` → `yolo` on the
- * acceptance host). So dropping `--approval-mode yolo` changes NOTHING observable: the callback
- * still fires, the LIVE smoke still passes, and the argv silently starts depending on a vendor
- * default and on whatever the operator's config happens to say. That is exactly the drift step 9
- * clause 2 forbids — "carry the chosen width as an explicit argv token rather than relying on a
- * launcher's injected default" — and the reason the width is stated here even though the host
- * would have granted it anyway. The width itself (task-wide, not callback-only) is a GLG
- * operator decision of 2026-08-30, taken with the Copilot measurement in hand: a callback-only
- * sibling names itself and then stops at the first tool its TASK needs. omp offers no argv
- * grammar for a narrower grant at all — `tools.approval.<tool>` is a config axis, not a flag —
- * so the honest choice was between `write` and `yolo`, and `yolo` matches what a human-typed
- * `omp` gets on this host. `--approval-mode` takes both the space and equals form (measured);
- * the space form is used for symmetry with `--model`.
- *
- * WHY OMP ALONE CARRIES NO PROMPT, AND WHY THAT IS A MEASUREMENT RATHER THAN A PREFERENCE.
- * `[LIVE 2026-08-30]` the first public fresh call at omp DID pass the full framing as a bare
- * positional. The window opened, the record minted (garden `20260830T181342-452167`), the
- * prompt arrived byte-identical as a user message at `09:13:42.413Z` — and the model answered
- * the literal text `ACK` with ZERO tool calls, because the callback tool did not exist yet.
- * `[source]` the interactive UI defers MCP discovery and only refreshes the tool list once
- * `discoverAndConnect()` settles (`sdk.ts:1847-1855`, `:1881-1905`), while the positional
- * `initialMessage` prompts immediately after `await mode.init()` (`main.ts:540-565`,
- * `595-610`). `[측정]` a `/tmp` observer on the same runtime: `turn_start` at +654ms with the
- * entwurf tools ABSENT, callback tool present only at +1484ms — the turn began ~830ms before
- * the tool it was told to call existed. No argv can close that gap, because the gap is a race
- * inside the host. So the composition hands omp a PAYLOAD instead of a turn, and the
- * in-process birth extension — which can see when the tool becomes callable — owns the first
- * two messages (`pi-extensions/meta-bridge-omp.ts`, "THE TWO-STAGE FRESH BOOTSTRAP").
- *
- * The flag is fixed and one-purpose ON PURPOSE. `[측정 2026-08-30]` a normal discovered
- * extension that registers a flag receives the operator's argv value byte-identical — quotes,
- * `$VAR`, backticks and a semicolon all survived a 137-byte JSON payload — because extensions
- * load before argv classification and the reparse writes the registered map
- * (`main.ts:1799-1810`, `cli/extension-flags.ts:36-43`). An env carrier or a temp file would
- * have needed its own quoting, its own lifetime and its own refusal rules; argv already owns
- * all three. This is deliberately NOT a general `--flag value` passthrough — an arbitrary
- * carrier would hand callers the launch-shaping power this rail exists to refuse.
- *
- * CODEX ALONE CARRIES A DIRECTORY IN ITS ARGV, AND OMITTING IT IS A WRONG ANSWER RATHER THAN A
- * NEUTRAL ONE. `[source rust-v0.153.4]` an explicit `--remote <endpoint>` — which this argv
- * always passes — resolves to `AppServerTarget::Remote` (`codex-rs/tui/src/lib.rs:875-876`;
- * `LocalDaemon` is only the IMPLICIT no-flag reuse path), and a Remote target takes its new
- * thread's directory from `remote_cwd_override` ALONE: `thread_cwd_from_config`
- * (`codex-rs/tui/src/app_server_session.rs:2022-2033`) answers `None` without it, and the
- * app-server then opens the thread in ITS OWN directory. That override is exactly `-C/--cd`,
- * retained only for a remote target (`codex-rs/tui/src/startup_orchestration.rs:191-194`), and
- * the flag lives on the shared interactive options this argv already uses for
- * `--dangerously-bypass-approvals-and-sandbox` (`codex-rs/utils/cli/src/shared_options.rs:53-68`)
- * — not only on the `agents` subcommand that also spells it (`codex-rs/cli/src/main.rs:334`).
- *
- * `[측정 2026-09-16]` with the flag absent, three citizens of one chain (pi → Codex → Claude
- * Code) all recorded the app-server's `~/repos/gh/entwurf` while the panes themselves sat in
- * `~/repos/gh/agent-config`, and the birth hook wrote that vendor-supplied cwd into each record
- * honestly (#95 lane C §1). So the token is ALWAYS present for codex: ONE directory, TWO
- * CARRIERS — tmux `-c` places the PANE, codex `-C` places the THREAD, and `launchCwd` is the
- * single value both receive. It is not a new input axis: the value is chosen by the cwd rules
- * this module already has, one layer up.
- */
-export function buildBackendArgs(
-	backend: FreshCallBackend,
-	composition: FreshCallComposition,
-	model: string,
-	env: NodeJS.ProcessEnv = process.env,
-	/** Where the sibling will actually start: the directory `freshCall` chose when it chose one,
-	 * and otherwise THIS process's own — which is what tmux gives a window opened with no `-c`
-	 * (`[측정 ×2]`, module header). The default is that inherited fact rather than a
-	 * convenience, so a caller that omits it still names the truth to codex. */
-	launchCwd: string = process.cwd(),
-): string[] {
-	switch (backend) {
-		case "pi":
-			return [composition.prompt, "--entwurf-control", "--model", model];
-		case "claude-code":
-			return [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]}`, `--model=${model}`];
-		case "copilot":
-			return ["copilot", "--interactive", composition.prompt, "--model", model, "--yolo"];
-		case "omp":
-			return [`--${OMP_BOOTSTRAP_FLAG}`, composition.bootstrapPayload, "--model", model, "--approval-mode", "yolo"];
-		case "codex":
-			return [
-				"--remote",
-				`unix://${resolveCodexDefaultSocketPath(env)}`,
-				"-C",
-				launchCwd,
-				"--model",
-				model,
-				"--dangerously-bypass-approvals-and-sandbox",
-				composition.prompt,
-			];
-	}
-}
-
-/**
- * What a launch has to say, in the two shapes the five backends need. Four of them are
- * handed a first-turn PROMPT; omp is handed a bootstrap PAYLOAD its own installed extension
- * unpacks. Both are always built, because building one is cheap and a backend switch must
- * never be able to reach a field that was not composed.
- */
-export interface FreshCallComposition {
-	prompt: string;
-	bootstrapPayload: string;
-}
-
-/**
- * The omp bootstrap flag, spelled WITHOUT dashes — the vendor's flag map is keyed by bare
- * name (`extensions/loader.ts:221-228`) and this composition adds the `--` itself.
- *
- * Held equal to the installed extension's own constant by
- * `test/omp-fresh-bootstrap.contract.test.ts`. The two copies exist because the extension
- * ships INSIDE the omp agent dir carrying only its own small closure and cannot import this
- * module; the gate is what keeps the duplication from becoming drift.
- */
-export const OMP_BOOTSTRAP_FLAG = "entwurf-bootstrap";
-
-/** Payload grammar version, matched exactly by the decoder. A bump means a stale installed
- * unit, which is the one thing `doctor-omp-bridge` exists to say out loud. */
-export const OMP_BOOTSTRAP_VERSION = 1;
-
-/**
- * The whole of what a fresh omp sibling is launched with.
- *
- * THREE FIELDS, CLOSED. The decoder refuses an unknown key, so this object is the entire
- * contract: who to call back, the nonce that proves it is this call, and the task that is
- * released only after that callback succeeds. There is no command here, no path, no env name
- * and no model — the model is already an explicit argv token, and a second copy of it inside
- * a payload would be a second place for it to disagree with the launch.
- */
-export function buildOmpBootstrapPayload(params: { callerGardenId: string; nonce: string; task: string }): string {
-	return JSON.stringify({
-		v: OMP_BOOTSTRAP_VERSION,
-		target: params.callerGardenId,
-		nonce: params.nonce,
-		task: params.task,
-	});
-}
-
-/**
- * The first-turn framing. Order is the contract: the callback is the FIRST action and the task
- * follows it, so a sibling that gets stuck in the task has already told the caller who it is.
- *
- * The three prohibitions are not politeness. Each names a detour that was measured to produce a
- * confidently wrong answer or a wasted turn.
- */
-export function buildFreshCallPrompt(params: {
-	backend: FreshCallBackend;
-	task: string;
-	callerGardenId: string;
-	nonce: string;
-}): string {
-	const tool = FRESH_CALL_CALLBACK_TOOL[params.backend];
-	return [
-		"You are a fresh visible citizen that entwurf opened in the operator's tmux session.",
-		"",
-		`FIRST ACTION, before reading files or anything else: call ${tool} with ` +
-			`target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
-			`message set to exactly ${params.nonce} — that string alone, nothing added.`,
-		"That call is how the agent that opened you learns your address. Do not skip it, do not",
-		"defer it until the task is done, and do not reword the message.",
-		"",
-		"Do not inspect environment variables, do not call entwurf_self, and do not start an MCP",
-		"server yourself. Your own report of your identity is not the address anyone needs.",
-		"",
-		"After the tool receipt, carry out this task:",
-		"",
-		params.task,
-	].join("\n");
-}
-
 /** A launch that was refused, or a placement that could not be established. Every value is a
  * NAMED refusal — this module has no fallback launch and no fallback directory. The cwd members
  * come from the shared classification leaf and their string values are stable contract. */
 export type FreshCallRejectReason =
+	| FreshCallInputRejectReason
 	| PlacementRejectReason
 	| LaunchRejectReason
 	| TmuxCwdRejectReason
@@ -521,16 +331,6 @@ export interface FreshCallReceipt extends WindowHandle {
 
 export type FreshCallResult = { ok: true; receipt: FreshCallReceipt } | { ok: false; reason: FreshCallRejectReason };
 
-/** Correlation tag only. Random, never derived from time, cwd or a peer listing — a nonce that
- * encoded any of those would invite exactly the guessing this rail exists to refuse. */
-export function mintNonce(randomHex: () => string = defaultRandomHex): string {
-	return `mux-fresh-call-${randomHex()}`;
-}
-
-function defaultRandomHex(): string {
-	return randomBytes(12).toString("hex");
-}
-
 /**
  * The pi identity carrier, scrubbed at the launch seam for EVERY backend (#87 Bundle C).
  *
@@ -633,24 +433,18 @@ export function freshCall(
 	env: NodeJS.ProcessEnv = process.env,
 	nonce: string = mintNonce(),
 ): FreshCallResult {
-	if (typeof params.callerGardenId !== "string" || params.callerGardenId.length === 0) {
-		return { ok: false, reason: "caller-identity-unavailable" };
-	}
-	const model = params.model.trim();
-	if (model.length === 0) return { ok: false, reason: "model-empty" };
-	if (!isSafeFreshCallModel(model)) return { ok: false, reason: "model-invalid" };
-	const task = params.task.trim();
-	if (task.length === 0) return { ok: false, reason: "task-empty" };
-	if (task.length > TASK_MAX_CHARS) return { ok: false, reason: "task-too-long" };
-	// ONLY `undefined` and the exact empty string mean "no cwd". Everything else is the literal
-	// value — deliberately untrimmed, so a whitespace-mangled path is refused loudly by the
-	// classification below instead of being silently repaired into a different directory. The
-	// caller's own record directory answers the SAME two-value emptiness rule and is consulted
-	// ONLY second: an explicit request always wins, and a caller that supplies neither leaves the
-	// pane to inherit this process's directory exactly as before — a pi caller's argv is
-	// byte-identical, because its process directory IS its own and a `-c` token would change
-	// nothing about where that window lands.
-	const requestedCwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+	// The caller-facing input contract lives in the composition leaf so BOTH rails answer a
+	// mistyped model or an oversized task with the same words. Order, trimming and the
+	// cwd-omission rule (`undefined` and the exact empty string, and nothing else, mean "no
+	// cwd") are unchanged from when they lived here.
+	const normalized = normalizeFreshCallInputs(params);
+	if (!normalized.ok) return { ok: false, reason: normalized.reason };
+	const { callerGardenId, model, task, cwd: requestedCwd } = normalized.inputs;
+	// The caller's own record directory answers the SAME two-value emptiness rule the leaf
+	// applies to a requested cwd, and is consulted ONLY second: an explicit request always wins,
+	// and a caller that supplies neither leaves the pane to inherit this process's directory
+	// exactly as before — a pi caller's argv is byte-identical, because its process directory IS
+	// its own and a `-c` token would change nothing about where that window lands.
 	const callerCwd = params.callerCwd === undefined || params.callerCwd === "" ? undefined : params.callerCwd;
 	const chosenCwd: { value: string; source: FreshCallCwdSource } | undefined =
 		requestedCwd !== undefined
@@ -739,10 +533,10 @@ export function freshCall(
 		prompt: buildFreshCallPrompt({
 			backend: params.backend,
 			task,
-			callerGardenId: params.callerGardenId,
+			callerGardenId,
 			nonce,
 		}),
-		bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId: params.callerGardenId, nonce, task }),
+		bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId, nonce, task }),
 	};
 	const backendArgs = buildBackendArgs(params.backend, composition, model, env, cwd);
 	// THE LAUNCH-DIRECTORY NOTE, AND IT IS A DIAGNOSTIC RATHER THAN A GATE. `[측정 2026-09-16]` a