@junghanacs/entwurf 0.22.0 → 0.23.1

package/scripts/install-herdr-ci.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# install-herdr-ci — put the MEASURED herdr binary on PATH for one CI job, and nothing else.
+#
+# This is not an installer for people. `entwurf setup` does not call it, the package does not
+# ship it as a command, and it never writes outside the runner's temp dir: Hard Rule 17 says
+# Entwurf supplies Entwurf's bytes, never a harness or a placement owner's. A CI job that wants
+# the herdr rail proven fetches the exact asset this repository has measured, checks its digest
+# BEFORE the file is ever made executable, and exposes only that one directory to later steps.
+#
+# What is deliberately NOT here, each for a reason:
+#   - no `curl … | sh`. A pipe to a shell has no version and no digest to check; whatever the
+#     upstream script does today it can do something else tomorrow, and the whole point of this
+#     file is that CI runs a byte we have named.
+#   - no package manager (brew/mise/nix). Each adds a layer whose contents we would then be
+#     asserting about without measuring.
+#   - no `latest`. A mutable URL turns a green run into a claim about a binary nobody chose.
+#   - no `gh attestation verify`. `[측정 2026-09-14, gh 2.97.0]` it cannot close herdr's
+#     predicate (`in-toto release/v0.2`) — default is 404, explicit is "no attestations found",
+#     while the REST API returns the attestation. A check we cannot run is not a check.
+#   - no global install, no ~/.local/bin, no sudo. The binary lives and dies with the job.
+#
+# Every version and digest comes from scripts/fixtures/herdr-supply.json. This file contains
+# none of its own, on purpose: two copies of a digest is how a pin drifts.
+set -euo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+manifest="${repo_dir}/scripts/fixtures/herdr-supply.json"
+
+fail() {
+	echo "[install-herdr-ci] FAIL — $1" >&2
+	exit 1
+}
+
+[ -f "$manifest" ] || fail "the supply manifest is missing: ${manifest}"
+
+# The runner's temp dir in CI; a private mktemp when someone runs this by hand. Never a
+# directory that outlives the job.
+dest_dir="${RUNNER_TEMP:-}"
+if [ -z "$dest_dir" ]; then
+	dest_dir="$(mktemp -d)"
+fi
+mkdir -p "$dest_dir"
+
+read_manifest() {
+	node -e '
+		const fs = require("node:fs");
+		const m = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+		const arch = process.argv[2];
+		const asset = m.assets[arch];
+		if (!asset) {
+			// Fail closed. A machine architecture we have never measured does not get a
+			// "closest" binary — there is no such thing.
+			process.stderr.write(`unsupported architecture ${arch}; measured: ${Object.keys(m.assets).join(", ")}\n`);
+			process.exit(3);
+		}
+		process.stdout.write([m.version, m.releaseUrlPrefix, m.tag, asset.name, asset.sha256].join("\n"));
+	' "$manifest" "$1"
+}
+
+arch="$(uname -m)"
+if ! fields="$(read_manifest "$arch")"; then
+	fail "no measured herdr asset for $(uname -m) — the supply manifest owns that set"
+fi
+version="$(echo "$fields" | sed -n 1p)"
+url_prefix="$(echo "$fields" | sed -n 2p)"
+tag="$(echo "$fields" | sed -n 3p)"
+asset_name="$(echo "$fields" | sed -n 4p)"
+expected_sha="$(echo "$fields" | sed -n 5p)"
+
+url="${url_prefix}/${tag}/${asset_name}"
+target="${dest_dir}/herdr"
+
+echo "[install-herdr-ci] fetching ${asset_name} (${tag}) for ${arch}"
+curl -fsSL --retry 3 --retry-delay 2 -o "$target" "$url" || fail "download failed: ${url}"
+
+# ORDER IS THE SAFETY ARGUMENT: the digest is checked while the file is still inert data.
+# chmod comes after, so a byte we did not choose never becomes a thing this job can run.
+actual_sha="$(sha256sum "$target" | cut -d' ' -f1)"
+if [ "$actual_sha" != "$expected_sha" ]; then
+	rm -f "$target"
+	fail "digest mismatch for ${asset_name}: expected ${expected_sha}, got ${actual_sha}"
+fi
+chmod +x "$target"
+
+reported="$("$target" --version 2>/dev/null || true)"
+case "$reported" in
+*"herdr ${version}"*) ;;
+*) fail "the verified binary reports '${reported}', not 'herdr ${version}' — the manifest and the artifact disagree" ;;
+esac
+
+# Only this directory reaches later steps. Nothing is copied into a shared bin dir.
+if [ -n "${GITHUB_PATH:-}" ]; then
+	echo "$dest_dir" >>"$GITHUB_PATH"
+fi
+echo "[install-herdr-ci] ok — ${reported} at ${target} (sha256 ${expected_sha})"
+echo "$dest_dir"

package/scripts/inventory-verification-surface.ts

@@ -69,7 +69,22 @@ function listWorkSurface(pathspec: string[]): string[] {
 }
 
 const legacyFiles = listWorkSurface(["scripts/"]);
-const frameworkFiles = listWorkSurface(["test/", "vitest.config.ts"]);
+// The framework axis is every vitest-managed lane, and since #119 V2 that is TWO locations:
+// the migration lane under test/, and tests written beside the behaviour they certify. The
+// pathspecs are `:(glob)` so `**` means "at any depth" and nothing but a test file enters —
+// pi-extensions/ and plugins/ are product trees, and pulling them in whole would put 20k lines
+// of product into a VERIFICATION denominator.
+//
+// This is what keeps the combined total honest through the V3 migration: a gate moving from
+// scripts/ to a file beside its subject moves lines BETWEEN axes, and only a drop in the
+// combined number is subtraction. Before this, such a gate left the denominator entirely and
+// every migrated line read as a deletion.
+const frameworkFiles = listWorkSurface([
+	"test/",
+	"vitest.config.ts",
+	":(glob)pi-extensions/**/*.test.ts",
+	":(glob)plugins/herdr/**/*.test.mjs",
+]);
 
 function countLines(rel: string): number {
 	const body = fs.readFileSync(path.join(REPO_DIR, rel), "utf8");
@@ -83,6 +98,20 @@ const H_TEXT = /readFileSync[^\n]*(?:pi-extensions|mcp\/|\.ts["'`]|SOURCE|SRC)|\
 const H_PROC = /\b(?:spawn|spawnSync|execFile|execFileSync|execSync|fork)\s*\(|subprocess\.(?:run|Popen|check_)/;
 const H_NET = /\b(?:http|net)\.createServer|\.listen\(/;
 const H_FS = /from\s+["']node:fs["']|require\(["']node:fs["']\)/;
+// H_IMPORTS asks for an ASCENDING path into a product tree, because every gate under scripts/
+// has to climb to reach one. A test written beside its subject never climbs: it imports
+// `./subject.ts`. The distinction is the file's own location, not its spelling — a lane living
+// inside pi-extensions/ or plugins/ that imports a relative sibling is importing product by
+// construction. Applied ONLY to those lanes: scripts/check-*.ts also import `./lib/*`, and that
+// is the verification surface importing itself, which is a different fact the mutant inventory
+// already counts as infra-subject.
+const H_IMPORTS_SIBLING = /(?:from\s+["']|import\(\s*["'])\.{1,2}\//;
+// Wider than the framework-axis glob (`plugins/herdr/**`) on purpose, and the asymmetry only
+// runs one way: the glob decides what ENTERS the denominator, this decides how a file already
+// in it is read. A test under some other plugins/ package would have to be admitted by the
+// glob first, so the looser shape here cannot inflate a count — it only keeps the classifier
+// from throwing on the day that glob widens.
+const BESIDE_BEHAVIOUR = /^(pi-extensions|plugins)\/.*\.test\.(ts|mjs)$/;
 // H_LIVE asks whether the file's OWN CODE reads the LIVE switch — not whether the
 // three letters appear. The naive `\bLIVE=1\b` form classified
 // scripts/check-release-gate-outcomes.ts as real-live because that gate QUOTES the
@@ -145,6 +174,45 @@ const CLASS_OVERRIDES: Record<string, { cls: SemanticClass; reason: string }> =
 		cls: "source-topology",
 		reason: "asserts the scrubbed parent-transcript fixture's recorded shape — an artifact contract, no product run",
 	},
+	// #119 V1 measured the classifier THROWING on these four at HEAD 5062147 — the
+	// assertion below did its job and named real drift, in three distinct shapes. None
+	// of them is reachable by widening H_IMPORTS: there is no literal `../plugins/`
+	// import anywhere under scripts/ or test/ (measured, 0 matches), so a `plugins`
+	// alternative in that predicate would match nothing and only claim coverage it
+	// does not have.
+	//
+	// Shape 1 — the herdr gates reach their subject through a RUNTIME-ASSEMBLED
+	// dynamic import, `await import(pathToFileURL(LEAF).href)`. H_IMPORTS matches a
+	// literal specifier by design (a computed one cannot be read as text without
+	// executing the gate), so these two are override territory, not predicate
+	// territory.
+	"scripts/check-herdr-plugin-profile.ts": {
+		cls: "behavioral-contract",
+		reason:
+			"dynamically imports plugins/herdr/lib/integration-profile.mjs and source-reads that same leaf — executes product code, no process",
+	},
+	"scripts/check-herdr-runtime-bootstrap.ts": {
+		cls: "behavioral-contract",
+		reason:
+			"dynamically imports the herdr runtime leaf and its plugin re-export and drives them against mkdtemp HOME/XDG fixtures — executes product code, spawns nothing",
+	},
+	// Shape 2 — the reads go through a local `read(rel)` helper, so H_TEXT's
+	// line-level form (readFileSync on the same line as the path literal) cannot see
+	// them. No product is executed: this is a manifest/installer/CI structure gate.
+	"scripts/check-herdr-supply.ts": {
+		cls: "source-topology",
+		reason:
+			"reads the supply manifest, the CI installer and the workflow as text through a read() helper; runs no product",
+	},
+	// Shape 3 — a vitest lane whose SUBJECT is the verification surface itself
+	// (scripts/lib), not pi-extensions/ or mcp/. The mutant inventory below already
+	// counts that as infra-subject; the class axis needs the same honesty rather than
+	// a widened "product import" predicate that would blur the two.
+	"test/tmux-coordinate-row.test.ts": {
+		cls: "pure-unit",
+		reason:
+			"executes the scripts/lib/tmux-coordinate-row leaf — an INFRA-subject lane; no fs, no text read, no process",
+	},
 };
 
 /**
@@ -187,9 +255,13 @@ function classify(rel: string, axis: "legacy" | "framework"): Row {
 	const body = isShell ? fs.readFileSync(path.join(REPO_DIR, rel), "utf8") : effectiveBody(rel);
 	const base = path.basename(rel);
 
+	// One notion of "imports product", used by BOTH axes below so the style table and the class
+	// table can never disagree about the same file.
+	const importsProduct = H_IMPORTS.test(body) || (BESIDE_BEHAVIOUR.test(rel) && H_IMPORTS_SIBLING.test(body));
+
 	const style: Style = (() => {
 		if (isShell) return "shell";
-		const axes = [H_IMPORTS.test(body), H_TEXT.test(body), H_PROC.test(body)];
+		const axes = [importsProduct, H_TEXT.test(body), H_PROC.test(body)];
 		const n = axes.filter(Boolean).length;
 		if (n >= 2) return "mixed";
 		if (axes[0]) return "imports-product";
@@ -207,11 +279,11 @@ function classify(rel: string, axis: "legacy" | "framework"): Row {
 				? "package-install"
 				: isShell || H_PROC.test(body) || H_NET.test(body)
 					? "hermetic-integration"
-					: H_TEXT.test(body) && !H_IMPORTS.test(body)
+					: H_TEXT.test(body) && !importsProduct
 						? "source-topology"
-						: H_IMPORTS.test(body) && (H_TEXT.test(body) || H_FS.test(body))
+						: importsProduct && (H_TEXT.test(body) || H_FS.test(body))
 							? "behavioral-contract"
-							: H_IMPORTS.test(body)
+							: importsProduct
 								? "pure-unit"
 								: null;
 	if (cls === null) {
@@ -224,7 +296,7 @@ function classify(rel: string, axis: "legacy" | "framework"): Row {
 
 // ── buckets ──────────────────────────────────────────────────────────────────
 const legacyGates = legacyFiles.filter((f) => /^scripts\/(check-|smoke-)/.test(f));
-const frameworkGates = frameworkFiles.filter((f) => /^test\/.*\.test\.ts$/.test(f));
+const frameworkGates = frameworkFiles.filter((f) => /\.test\.(ts|mjs)$/.test(f));
 const lib = legacyFiles.filter((f) => f.startsWith("scripts/lib/"));
 const mutantManifests = legacyFiles.filter((f) => f.startsWith("scripts/mutants/") && f.endsWith(".json"));
 const fixtures = legacyFiles.filter((f) => f.startsWith("scripts/fixtures/"));
@@ -254,14 +326,16 @@ rule predicates (re-derive any number from these):
   H_PROC     ${H_PROC}
   H_NET      ${H_NET}
   H_FS       ${H_FS}
+  H_IMPORTS_SIBLING ${H_IMPORTS_SIBLING}   (only for ${BESIDE_BEHAVIOUR})
   H_LIVE     ${H_LIVE}
 H_LIVE is applied to the CODE-ONLY projection (comments and inert literals blanked;
 shell double-quoted expansions kept), so a gate that merely QUOTES "LIVE=1" is not
 real-live. Two-tier gates are listed under the class breakdown.
 semantic classes, first match wins: override → real-live (name -live | H_LIVE on code) →
   package-install (name pack|install) → hermetic-integration (.sh | H_PROC | H_NET) →
-  source-topology (H_TEXT ∧ ¬H_IMPORTS) → behavioral-contract (H_IMPORTS ∧ (H_TEXT ∨ H_FS)) →
-  pure-unit (H_IMPORTS) → ERROR (unclassified is asserted zero)
+  source-topology (H_TEXT ∧ ¬importsProduct) → behavioral-contract (importsProduct ∧ (H_TEXT ∨ H_FS)) →
+  pure-unit (importsProduct) → ERROR (unclassified is asserted zero)
+importsProduct = H_IMPORTS, plus H_IMPORTS_SIBLING for a BESIDE_BEHAVIOUR lane
 test/*.test.ts is classified together with the ./helpers/* bodies it imports.
 `);
 
@@ -275,9 +349,11 @@ console.log(`  scripts/lib/:                    ${lib.length} files, ${total(lib
 console.log(`  scripts/mutants/:                ${mutantManifests.length} manifests`);
 console.log(`  scripts/fixtures/:               ${fixtures.length} files`);
 console.log(`  other:                           ${legacyOther.length} files, ${total(legacyOther)} lines`);
-console.log(`framework axis (test/ + vitest.config.ts): ${frameworkFiles.length} files, ${frameworkTotal} lines`);
 console.log(
-	`  vitest lanes (test/**/*.test.ts):  ${frameworkGates.length} files, ${sum(rows.filter((r) => r.axis === "framework"))} lines`,
+	`framework axis (vitest-managed, both locations):  ${frameworkFiles.length} files, ${frameworkTotal} lines`,
+);
+console.log(
+	`  lanes (test/** + beside behaviour): ${frameworkGates.length} files, ${sum(rows.filter((r) => r.axis === "framework"))} lines`,
 );
 console.log(`  helpers/config:                    ${frameworkSupport.length} files, ${total(frameworkSupport)} lines`);
 console.log(

package/scripts/lib/codex-fresh-live-protocol.ts

@@ -55,11 +55,11 @@ export function buildCodexInstruction(input: CodexInstructionInput): string {
 		'NO cwd parameter and NO placement parameter, and task "After your automatic callback succeeds, answer ACK and ' +
 		'stop. Do not open another sibling."\n' +
 		"2. Stop and wait for the Pi callback delivered into this Codex thread. Accept only a callback whose body " +
-		"repeats the exact nonce from your LAUNCH receipt and whose sender envelope names a garden id.\n" +
+		"repeats the exact nonce from your LAUNCH receipt and whose sender envelope carries a garden id on its `session:` line.\n" +
 		`3. Only after that match, call public mcp__entwurf_bridge__entwurf_v2 once with target ${input.callerGid}, ` +
 		"intent fire-and-forget, wants_reply false, and message:\n" +
 		`${input.finalToken}\nPI_LAUNCH_NONCE=<exact launch nonce>\nPI_CALLBACK_NONCE=<same exact nonce>\n` +
-		"PI_CALLBACK_FROM=<sender-envelope garden id>\nPI_SESSION_ID=<exact $session id from the LAUNCH receipt>\n" +
+		"PI_CALLBACK_FROM=<the garden id on the callback envelope's `session:` line — NOT the model name on its `from:` line>\nPI_SESSION_ID=<exact $session id from the LAUNCH receipt>\n" +
 		"PI_WINDOW_ID=<exact @window id from the LAUNCH receipt>\nDo not claim completion in prose."
 	);
 }

package/scripts/lib/tree-digest.ts

@@ -0,0 +1,97 @@
+/**
+ * tree-digest — one deterministic digest of a whole directory tree, for gates that claim a tree is
+ * UNCHANGED.
+ *
+ * WHY THIS EXISTS. Two #116 M3-b3 oracles compared a sorted list of relative paths (one of them with
+ * sizes) and called the result "byte-identical". A same-length content edit passes both — which is
+ * precisely the shape a refusal-must-not-mutate claim needs to catch, because a transaction that
+ * rewrites a file in place rarely changes its length. So the digest here reads the actual bytes.
+ *
+ * WHAT IS IN IT: every entry's relative path, its node TYPE, and for a regular file its permission
+ * bits, its size and its whole content; for a symlink its target; for a directory its own entry
+ * count, so an emptied directory and a removed one are different facts. That makes the honest claim
+ * "content + mode + topology", which is what the callers now say.
+ *
+ * FRAMING IS LENGTH-PREFIXED. A digest built by concatenating names cannot tell `a/b` + `c` from
+ * `a` + `b/c`; every field is therefore written as `label:<byteLength>:<bytes>\0`, so no boundary
+ * between two fields can be spelled by the contents of one.
+ *
+ * MEMORY IS BOUNDED. A runtime tree here is hundreds of megabytes, so files are hashed in 64 KiB
+ * chunks through one reused buffer rather than read whole. No `sha256sum`, no shell: a gate that
+ * shells out to hash acquires a dependency the hosts it runs on do not owe it.
+ */
+
+import { createHash, type Hash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+const CHUNK_BYTES = 64 * 1024;
+
+function field(hash: Hash, label: string, value: string | number): void {
+	const bytes = Buffer.from(String(value), "utf8");
+	hash.update(`${label}:${bytes.length}:`);
+	hash.update(bytes);
+	hash.update("\0");
+}
+
+function hashFileContent(hash: Hash, file: string): void {
+	const fd = fs.openSync(file, "r");
+	try {
+		const buf = Buffer.allocUnsafe(CHUNK_BYTES);
+		let read = fs.readSync(fd, buf, 0, CHUNK_BYTES, null);
+		while (read > 0) {
+			hash.update(buf.subarray(0, read));
+			read = fs.readSync(fd, buf, 0, CHUNK_BYTES, null);
+		}
+	} finally {
+		fs.closeSync(fd);
+	}
+	hash.update("\0");
+}
+
+/**
+ * The digest of `root`, or the literal `"absent"` when nothing is there.
+ *
+ * @returns `sha256-<hex>` over content + mode + topology, or `absent`.
+ */
+export function treeDigest(root: string): string {
+	const top = fs.lstatSync(root, { throwIfNoEntry: false });
+	if (top === undefined) return "absent";
+	const hash = createHash("sha256");
+	if (!top.isDirectory()) {
+		field(hash, top.isSymbolicLink() ? "root-symlink" : "root-nondir", path.basename(root));
+		if (top.isSymbolicLink()) field(hash, "target", fs.readlinkSync(root));
+		else if (top.isFile()) hashFileContent(hash, root);
+		return `sha256-${hash.digest("hex")}`;
+	}
+	const walk = (dir: string): void => {
+		const entries = fs
+			.readdirSync(dir, { withFileTypes: true })
+			.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+		field(hash, "dir", path.relative(root, dir) || ".");
+		field(hash, "entries", entries.length);
+		for (const entry of entries) {
+			const abs = path.join(dir, entry.name);
+			const rel = path.relative(root, abs);
+			if (entry.isSymbolicLink()) {
+				field(hash, "symlink", rel);
+				field(hash, "target", fs.readlinkSync(abs));
+			} else if (entry.isDirectory()) {
+				field(hash, "subdir", rel);
+			} else if (entry.isFile()) {
+				const stat = fs.statSync(abs);
+				field(hash, "file", rel);
+				field(hash, "mode", (stat.mode & 0o7777).toString(8));
+				field(hash, "size", stat.size);
+				hashFileContent(hash, abs);
+			} else {
+				field(hash, "other", rel);
+			}
+		}
+		for (const entry of entries) {
+			if (entry.isDirectory() && !entry.isSymbolicLink()) walk(path.join(dir, entry.name));
+		}
+	};
+	walk(root);
+	return `sha256-${hash.digest("hex")}`;
+}

package/scripts/meta-bridge-install.sh

@@ -170,7 +170,13 @@ echo "[meta-bridge-install] platform=$(uname -s) node=$NODE_VER ($NODE_BIN) clau
 # settings.json / ~/.claude.json. Re-runs preserve the first snapshot, so
 # uninstall restores the true pre-entwurf state rather than the last install
 # run's already-managed values.
-python3 "$REPO/scripts/meta-bridge-state.py" prepare --repo "$REPO" --asm "$ASM"
+# #116 M3-b2 — decide before writing. An aggregate activation has to be able to say "nothing will
+# fail once I start" before it starts, and that promise is only real if this half can be checked
+# without mutating.
+python3 "$REPO/scripts/meta-bridge-state.py" preflight-install --repo "$REPO" --asm "$ASM" \
+  ${ENTWURF_PLUGIN_RUNTIME:+--plugin-runtime "$ENTWURF_PLUGIN_RUNTIME"}
+python3 "$REPO/scripts/meta-bridge-state.py" prepare --repo "$REPO" --asm "$ASM" \
+  ${ENTWURF_PLUGIN_RUNTIME:+--plugin-runtime "$ENTWURF_PLUGIN_RUNTIME"}
 
 # --- 1. assemble a self-contained, node-baked plugin ------------------------
 rm -rf "$ASM"
@@ -251,6 +257,15 @@ claude mcp remove pi-tools-bridge -s user >/dev/null 2>&1 || true
 # in node_modules/@junghanacs/entwurf) wires the STABLE `entwurf-bridge` bin shim; baking
 # the pnpm store path here would go stale on any peer/version bump. A dev clone pins to
 # this clone's start.sh. Both branches carry the same env desired_mcp() writes.
+# #116 M3-b2 — the explicit plugin mode comes FIRST, and it is derived, not supplied. A Herdr
+# plugin activates where nothing entwurf is on PATH, so the bare shim cannot resolve; the absolute
+# bridge under the certified stable runtime can. `desired_mcp()` above is still the SSOT — this
+# branch mirrors it, as the comment on the block already demanded.
+if [ -n "${ENTWURF_PLUGIN_RUNTIME:-}" ]; then
+  claude mcp add -s user entwurf-bridge \
+    -e ENTWURF_BRIDGE_EXTERNAL_AGENT_ID=external-mcp/claude-code \
+    -- "$ENTWURF_PLUGIN_RUNTIME/node_modules/.bin/entwurf-bridge" >/dev/null
+else
 case "$REPO" in
   */node_modules/@junghanacs/entwurf)
     claude mcp add -s user entwurf-bridge \
@@ -261,6 +276,7 @@ case "$REPO" in
       -e ENTWURF_BRIDGE_EXTERNAL_AGENT_ID=external-mcp/claude-code \
       -- bash "$REPO/mcp/entwurf-bridge/start.sh" >/dev/null ;;
 esac
+fi
 # Capture, THEN match — and require BOTH the exit code and the content.
 # `<cli> | grep -q` under `set -o pipefail` is a race, not a test: grep exits at the
 # first match and closes the pipe, the still-writing CLI dies of SIGPIPE (141), and
@@ -283,7 +299,8 @@ echo "[meta-bridge-install] installed entwurf-bridge MCP (scope: user = global r
 # Re-assert the repo-owned keyset through our stateful manager. The Claude CLI
 # calls above are allowed to maintain their cache/registry files, but the
 # operator-facing JSON keys are owned here so uninstall can be honest.
-python3 "$REPO/scripts/meta-bridge-state.py" apply --repo "$REPO" --asm "$ASM"
+python3 "$REPO/scripts/meta-bridge-state.py" apply --repo "$REPO" --asm "$ASM" \
+  ${ENTWURF_PLUGIN_RUNTIME:+--plugin-runtime "$ENTWURF_PLUGIN_RUNTIME"}
 
 # --- evidence ---------------------------------------------------------------
 echo "--- claude plugin list ---"