@junghanacs/entwurf 0.35.0 → 0.36.0

package/scripts/check-gate-qualification.ts

@@ -3441,6 +3441,7 @@ let manifestCount: number;
 		"acp-launch-namespace": 2,
 		"acp-overlay": 1,
 		"acp-prompt-lifecycle": 15,
+		"acp-set-model-readback": 2,
 		"acp-stop-reason": 6,
 		"acp-stream-hooks": 10,
 		"acp-usage-accounting": 12,
@@ -3449,10 +3450,10 @@ let manifestCount: number;
 		"bridge-boot-resume": 5,
 		"bridge-command-boot": 12,
 		"capability-cache": 3,
-		"codex-app-server-launch": 9,
+		"codex-app-server-launch": 10,
 		"codex-caller-seat": 28,
 		"control-send-receipt": 19,
-		"codex-native": 82,
+		"codex-native": 83,
 		"compaction-send-guard": 7,
 		"control-socket-disconnect": 4,
 		"demo-reproducibility": 12,
@@ -3463,10 +3464,10 @@ let manifestCount: number;
 		"pi-bridge-sender": 4,
 		"pi-mcp-bridge": 2,
 		"pi-mcp-register": 3,
-		"pi-durable": 58,
+		"pi-durable": 78,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
-		"fresh-call-dispatch": 11,
+		"fresh-call-dispatch": 12,
 		"fresh-cut": 3,
 		"gate-qualification": 10,
 		"herdr-placement": 13,
@@ -3474,6 +3475,7 @@ let manifestCount: number;
 		"herdr-plugin-profile": 14,
 		"herdr-activation": 34,
 		"herdr-plugin-build": 20,
+		"herdr-dev-checkout": 4,
 		"herdr-runtime-bootstrap": 31,
 		"herdr-fresh-call": 38,
 		"herdr-supply": 11,
@@ -3497,13 +3499,13 @@ let manifestCount: number;
 		"release-gate": 24,
 		"retired-sent-surface": 2,
 		"resume-args": 6,
-		"resume-launch-identity": 6,
+		"resume-launch-identity": 7,
 		"self-address": 8,
 		"setup-verdict": 14,
 		"source-install": 2,
 		"typing-call-fence": 1,
 		"v2-surface": 13,
-		"v2-visible-resume": 17,
+		"v2-visible-resume": 18,
 	};
 	const laneTally: Record<string, number> = {};
 	for (const man of manifests) laneTally[man.lane] = (laneTally[man.lane] ?? 0) + man.mutants.length;

package/scripts/check-probe-ordering.ts

@@ -174,7 +174,7 @@ function makeRecordingConnection(calls: RecordedCall[]): AcpConnectionLike {
 		},
 		setSessionConfigOption: async (params) => {
 			calls.push({ method: "setSessionConfigOption", params });
-			return {};
+			return { configOptions: [{ id: "model", currentValue: (params as { value?: unknown }).value }] };
 		},
 		prompt: async (params) => {
 			calls.push({ method: "prompt", params });
@@ -381,12 +381,19 @@ function makeRecordingConnection(calls: RecordedCall[]): AcpConnectionLike {
 		"backend.ts still sends the clientInfo the probe mirrors",
 	);
 	// The claude adapter's enforceModel wire shape — the LIVE probe executes THIS
-	// method (emitted twin), so its shape is pinned where it lives.
+	// method (emitted twin), so its shape is pinned where it lives. Sliced to the claude
+	// adapter: the cortex adapter makes the same call, and must not satisfy this pin.
+	const claudeAdapterSrc = ADAPTER_SRC.slice(
+		ADAPTER_SRC.indexOf("export const claudeAdapter"),
+		ADAPTER_SRC.indexOf("export const cortexAdapter"),
+	);
 	assert.ok(
-		ADAPTER_SRC.includes(
-			'await setConfig.call(connection, { sessionId: acpSessionId, configId: "model", value: nativeModelId });',
-		),
-		'claudeAdapter.enforceModel still sends setSessionConfigOption({configId:"model"})',
+		claudeAdapterSrc.length > 0 &&
+			claudeAdapterSrc.includes(
+				'await setConfig.call(connection, {\n\t\t\tsessionId: acpSessionId,\n\t\t\tconfigId: "model",\n\t\t\tvalue: nativeModelId,\n\t\t});',
+			) &&
+			claudeAdapterSrc.includes("confirmClaudeSetModelAnswer(answer, nativeModelId);"),
+		'claudeAdapter.enforceModel still sends setSessionConfigOption({configId:"model"}) and reads its answer back',
 	);
 
 	// Permission policy: the runner's copy must mirror backend.ts's private

package/scripts/check-resume-launch-identity.ts

@@ -42,6 +42,7 @@ import assert from "node:assert/strict";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { AcpModelNotCuratedError } from "../pi-extensions/lib/acp/model-ids.js";
 import { serializeMetaIdentity, upsertMetaSession } from "../pi-extensions/lib/meta-session.ts";
 import {
 	ResumeBackendUnsupportedError,
@@ -162,6 +163,43 @@ function main(): void {
 			);
 		}
 
+		// 4d. #128 — the second EXPECTED refusal. Under the `entwurf` provider Pi resolves `--model`
+		// by substring, so a retired Claude 5 id would reopen on a Cortex row. The pair judged is the
+		// one the launch would EMIT: a bare Claude id recorded under another provider is routed to
+		// `entwurf` too, so judging the recorded provider alone would let that one through.
+		{
+			const acpModelLine = (provider: string, modelId: string): string =>
+				`${JSON.stringify({ type: "model_change", provider, modelId })}\n`;
+			const settle = (gid: string): { identity?: ReturnType<typeof resolveResumeLaunchIdentity>; err?: unknown } => {
+				try {
+					return { identity: resolveResumeLaunchIdentity(gid) };
+				} catch (err) {
+					return { err };
+				}
+			};
+			const minted = (native: string, name: string, provider: string, modelId: string): string =>
+				mintRecord(native, writeTranscript(name, sessionLine(native) + acpModelLine(provider, modelId)));
+			const retired = settle(
+				minted("0199a5a5-1111-4222-8333-444455556666", "acp-retired.jsonl", "entwurf", "claude-sonnet-5"),
+			);
+			const routed = settle(
+				minted("0199b5b5-1111-4222-8333-444455556666", "acp-routed.jsonl", "anthropic", "claude-opus-5"),
+			);
+			const current = settle(
+				minted("0199c5c5-1111-4222-8333-444455556666", "acp-current.jsonl", "entwurf", "claude-sonnet-5-5"),
+			);
+			ok(
+				"4d: an entwurf-provider resume of a non-curated id is a TYPED refusal — recorded under entwurf, or a bare Claude id the launch would route to entwurf — while the exact 5.5 id resolves unchanged [QK:RESUME-ID-ACP-EXACT-CURATION]",
+				retired.err instanceof AcpModelNotCuratedError &&
+					retired.err.reason === "acp-model-not-curated" &&
+					retired.err.model === "claude-sonnet-5" &&
+					routed.err instanceof AcpModelNotCuratedError &&
+					routed.err.model === "claude-opus-5" &&
+					current.identity?.provider === "entwurf" &&
+					current.identity.model === "claude-sonnet-5-5",
+			);
+		}
+
 		const gidNoFile = mintRecord("0199dddd-1111-4222-8333-444455556666", null);
 		rejects(gidNoFile, "no recorded transcriptPath", "4: transcriptPath null → nothing to resume");
 

package/scripts/codex-app-server-launch.sh

@@ -156,38 +156,53 @@ done
 # --- is somebody already listening there? ----------------------------------
 # Three outcomes, and they are NOT the same repair. A live socket means a second server
 # would either lose the bind race or silently replace the endpoint every citizen's record
-# already points at — refuse and name the holder. An indeterminate path (symlink, not a
-# socket, owned by another uid) is the classification `checkCodexSocketFile` already uses in
-# the product, and a launcher that guessed past it would be clobbering something it cannot
-# identify. A dead socket file is the ordinary leftover of a Ctrl-C, and the vendor replaces
-# it — that one is a fact line, not a refusal.
-probe="$(python3 - "$SOCK" <<'PY'
-import os, socket, stat, sys
-
-path = sys.argv[1]
-try:
-	st = os.lstat(path)
-except FileNotFoundError:
-	print("absent")
-	raise SystemExit(0)
-except OSError as exc:
-	print(f"indeterminate\t{exc.strerror or exc}")
-	raise SystemExit(0)
-
-if stat.S_ISLNK(st.st_mode):
-	print("indeterminate\tthe path is a symlink")
-	raise SystemExit(0)
-if not stat.S_ISSOCK(st.st_mode):
-	print("indeterminate\tthe path exists and is not a socket")
-	raise SystemExit(0)
-if st.st_uid != os.getuid():
-	print(f"indeterminate\tthe socket is owned by uid {st.st_uid}, not {os.getuid()}")
-	raise SystemExit(0)
+# already points at — refuse and name the holder. An indeterminate path (a symlink that is not
+# Codex's own alias, not a socket, owned by another uid) is refused, because a launcher that
+# guessed past it would be clobbering something it cannot identify. A dead socket file is the
+# ordinary leftover of a Ctrl-C, and the vendor replaces it — that one is a fact line, not a
+# refusal. So is a dangling rendezvous alias: from Codex 0.162.1 the advertised path is a
+# symlink into the vendor's own socket directory, and the vendor removes exactly that alias
+# when it starts.
+#
+# WHAT A LAUNCH IS ALLOWED TO TRUST is decided ONCE, by the classifier delivery and preflight
+# use (`checkCodexSocketFile`). This launcher keeps no copy of it: telling Codex's exact alias
+# from any other symlink takes a hash and an exact readlink comparison, and a second
+# implementation here would be the transcription `codex-socket-path` already measured drifting.
+# It runs that classifier's COMPILED twin directly with `node`, in a checkout and in an installed
+# package alike: `build-bridge` emits it (`pnpm install` runs it through `prepare`, and the package
+# ships it through `prepack`), so a missing file is an incomplete installation, refused by name —
+# never a reason to fall back to the TypeScript source. The Python below only CONNECTS to the
+# endpoint the classifier verified, to tell a live server from a stale socket file. An answer the
+# classifier never gives is refused right here, before it can be read as one of the probe's own
+# verdicts.
+#
+# The gate's limit, stated rather than hidden: it executes this launcher on non-alias layouts
+# and on a non-exact symlink, so it proves the launcher accepts no more than the classifier.
+# The exact-alias accept path is proven on `checkCodexSocketFile` itself, with a sandbox socket
+# directory. This launcher's own alias branch is NOT exercised by an existing-server LIVE
+# diagnostic; that launch/refusal path needs its own explicitly authorised LIVE observation.
+CLASSIFIER="$REPO_DIR/mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js"
+[ -f "$CLASSIFIER" ] \
+	|| fail "codex-app-server-classifier-missing: the compiled socket classifier is not at
+  $CLASSIFIER
+  This launcher runs it directly and keeps no other copy of it. Reinstall @junghanacs/entwurf (the
+  package ships it through prepack build-bridge), or run 'pnpm run build-bridge' in a source checkout."
+if ! classified="$(node "$CLASSIFIER")"; then
+	fail "could not classify the control socket at $SOCK.
+  'node $CLASSIFIER' failed; it is the only classification of this socket,
+  and this launcher will not guess past it. Its output above says why."
+fi
+classified_word="${classified%%	*}"
+classified_detail="${classified#*	}"
+case "$classified_word" in
+	socket)
+		probe="$(python3 - "$classified_detail" <<'PY'
+import socket, sys
 
 probe = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
 probe.settimeout(2)
 try:
-	probe.connect(path)
+	probe.connect(sys.argv[1])
 except (ConnectionRefusedError, FileNotFoundError):
 	print("stale")
 except OSError as exc:
@@ -197,7 +212,17 @@ else:
 finally:
 	probe.close()
 PY
-)" || fail "could not classify the control socket at $SOCK (python3 is required by this launcher)."
+)" || fail "could not probe the control socket at $classified_detail (python3 is required by this launcher)."
+		;;
+	absent) probe="absent" ;;
+	dangling) probe="stale	$classified_detail" ;;
+	indeterminate) probe="indeterminate	$classified_detail" ;;
+	*)
+		fail "codex-app-server-socket-probe-unrecognised: the socket classifier answered
+  '$classified_word', which is not one of socket/absent/dangling/indeterminate. Refusing to launch on a
+  reading nothing understands."
+		;;
+esac
 
 probe_status="${probe%%	*}"
 probe_reason="${probe#*	}"

package/scripts/codex-socket-classify.ts

@@ -0,0 +1,46 @@
+/**
+ * codex-socket-classify — classify the Codex app-server default control socket for THIS
+ * environment, through the one product classifier, and print the answer for a shell.
+ *
+ * WHY A LEAF. `entwurf codex-app-server` is a bash launcher, and it has to decide whether a
+ * launch would clobber something. From Codex 0.162.1 the advertised socket path is a
+ * rendezvous alias into a vendor-owned directory, and telling the vendor's exact alias from any
+ * other symlink takes a hash, an exact readlink comparison and ownership/mode checks. Doing that
+ * in the launcher's Python would be a second implementation of a security classification, and
+ * `codex-socket-path.ts` records what a second spelling of this socket did once (it diverged).
+ * So the launcher asks `checkCodexSocketFile`, the classifier delivery and preflight use, and
+ * only connects to what it was told.
+ *
+ * HOW IT IS REACHED. The launcher runs this file's COMPILED twin,
+ * `mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js`, directly with `node` — in a checkout
+ * and in an installed package alike. There is no `run.sh` verb and no `run_ts` crossing for it:
+ * `build-bridge` emits it (`pnpm install` runs that through `prepare`, packing through `prepack`),
+ * and a missing twin is an incomplete installation the launcher refuses by name.
+ *
+ * One line on stdout, a word then a tab-separated detail:
+ *   socket <connectPath>       a verified socket; the launcher connects there to tell live from stale
+ *   absent                     nothing at the advertised path
+ *   dangling <reason>          Codex's own alias whose socket is gone; the vendor removes it on start
+ *   indeterminate <reason>     anything else; the launcher refuses
+ *
+ * Reads `process.env` and takes no argument, for the reason `codex-socket-path.ts` gives: an argv
+ * seam would be a way to redirect the address. It has no daemon-root input either; the gate's
+ * exact-alias cells drive `checkCodexSocketFile` directly with a sandbox root.
+ */
+
+import {
+	checkCodexSocketFile,
+	resolveCodexDefaultSocketPath,
+} from "../pi-extensions/lib/native-push/codex-ws-client.ts";
+
+if (process.argv.length > 2) {
+	console.error("usage: codex-socket-classify   (no arguments; the environment is the input)");
+	process.exit(2);
+}
+
+const oneLine = (text: string): string => text.replace(/[\t\r\n]+/g, " ");
+const check = checkCodexSocketFile(resolveCodexDefaultSocketPath(process.env));
+if (check.ok) process.stdout.write(`socket\t${check.connectPath}`);
+else if (check.status === "dead" && check.layout === "absent") process.stdout.write("absent");
+else if (check.status === "dead") process.stdout.write(`dangling\t${oneLine(check.reason)}`);
+else process.stdout.write(`indeterminate\t${oneLine(check.reason)}`);