@junghanacs/entwurf 0.41.2 → 0.50.0

package/scripts/smoke-agy-install-state.sh

@@ -697,6 +697,72 @@ if bash "$DEVBIN" expose entwurf-bridge >/dev/null 2>&1; then die "dev-bin migra
 ok "dev-bin migrate: foreign legacy refused (linkPath basename != entwurf-bridge)"
 rm -f "$LEGACY" "$DLINK" "$DSTATE"
 bash "$DEVBIN" remove >/dev/null 2>&1
+# J-6 (#153): dev-bin mutation is a SOURCE checkout's authority. The moved-checkout rule lets a
+# developer's link follow its own checkout (D1 → D2); an INSTALLED package must not inherit it —
+# measured before this guard: a node_modules-shaped root's public expose-dev-bin retargeted every
+# managed link and state a dev checkout had made. The installed root is judged by where dev-bin.sh
+# itself lives (symlinks and directory aliases resolved), never by cwd or a target override. The
+# copies below carry THIS checkout's run.sh/dev-bin.sh/package.json bytes, so the cells test them.
+OVERRIDES=(-u ENTWURF_OPERATOR_TARGET -u ENTWURF_BRIDGE_TARGET -u ENTWURF_AGY_STATUSLINE_TARGET -u ENTWURF_AGY_IMPRINT_TARGET -u ENTWURF_COPILOT_STATUSLINE_TARGET)
+make_root() {  # $1 = root dir: the three real files plus no-op helper targets
+  mkdir -p "$1/scripts" "$1/mcp/entwurf-bridge"
+  cp "$REPO_DIR/run.sh" "$1/run.sh"; cp "$DEVBIN" "$1/scripts/dev-bin.sh"; cp "$REPO_DIR/package.json" "$1/package.json"
+  for _t in mcp/entwurf-bridge/start.sh scripts/agy-statusline.sh scripts/agy-imprint.sh scripts/copilot-statusline.sh; do
+    printf '#!/bin/sh\nexit 0\n' > "$1/$_t"; chmod +x "$1/$_t"
+  done
+  chmod +x "$1/run.sh" "$1/scripts/dev-bin.sh"; unset _t
+}
+devbin_world() {  # every link in the bin dir, every dev-bin state body, and the profile bytes
+  { for _f in "$DBIN_DIR"/* "$XDG_DATA_HOME"/entwurf/dev-bin/*; do
+      [ -e "$_f" ] || [ -L "$_f" ] || continue
+      if [ -L "$_f" ]; then printf 'L %s -> %s\n' "$_f" "$(readlink "$_f")"; else printf 'F %s %s\n' "$_f" "$(sha256sum < "$_f")"; fi
+    done
+    printf 'P %s\n' "$(sha256sum < "$HOME/.profile")"; } 2>/dev/null; unset _f
+}
+D1="$SB/src-d1"; D2="$SB/src-d2"; INST="$SB/inst/node_modules/@junghanacs/entwurf"
+make_root "$D1"; make_root "$D2"; make_root "$INST"
+printf '# smoke profile seed\n' > "$HOME/.profile"
+env "${OVERRIDES[@]}" bash "$D1/scripts/dev-bin.sh" expose >/dev/null 2>&1   # a dev checkout's five links + states
+printf '{"schemaVersion":1,"linkPath":"%s","target":"%s","detectMode":"created-new","stampedAt":"x"}\n' \
+  "$DBIN_DIR/entwurf-bridge" "$D1/mcp/entwurf-bridge/start.sh" > "$XDG_DATA_HOME/entwurf/dev-bin/install-state.json"   # a legacy state migration would act on
+ln -s "$INST" "$SB/inst-alias"; ln -s "$INST/scripts/dev-bin.sh" "$SB/dev-bin-link.sh"
+WORLD_BEFORE="$(devbin_world)"
+set +e
+bash "$INST/scripts/dev-bin.sh" expose >"$SB/j6-direct.out" 2>&1; RC_DIRECT=$?   # target overrides still set
+env "${OVERRIDES[@]}" bash "$SB/inst-alias/scripts/dev-bin.sh" expose entwurf >/dev/null 2>&1; RC_ALIAS=$?
+env "${OVERRIDES[@]}" bash "$SB/dev-bin-link.sh" expose entwurf >/dev/null 2>&1; RC_LINK=$?
+set -e
+WORLD_AFTER_EXPOSE="$(devbin_world)"
+# an installed-root link and state that DO match the installed target: remove still refuses
+rm -f "$OLINK"; ln -s "$INST/run.sh" "$OLINK"
+printf '{"schemaVersion":1,"linkPath":"%s","target":"%s","detectMode":"created-new","stampedAt":"x"}\n' "$OLINK" "$INST/run.sh" > "$OSTATE"
+WORLD_BEFORE_REMOVE="$(devbin_world)"
+set +e; env "${OVERRIDES[@]}" bash "$INST/scripts/dev-bin.sh" remove entwurf >/dev/null 2>&1; RC_REMOVE=$?; set -e
+want "installed dev-bin: expose (direct, alias, symlinked script) and remove refuse with 4 before any write — no link, state, legacy migration or profile change, even for a link the installed root's own target matches [QK:INSTALLED-DEVBIN-MUTATION-REFUSED]" \
+  "[ '$RC_DIRECT' -eq 4 ] && [ '$RC_ALIAS' -eq 4 ] && [ '$RC_LINK' -eq 4 ] && [ '$RC_REMOVE' -eq 4 ] && grep -qF 'REFUSE expose: this dev-bin.sh belongs to an installed package' '$SB/j6-direct.out' && [ \"\$WORLD_BEFORE\" = \"\$WORLD_AFTER_EXPOSE\" ] && [ \"\$WORLD_BEFORE_REMOVE\" = \"\$(devbin_world)\" ] && [ -f '$XDG_DATA_HOME/entwurf/dev-bin/install-state.json' ]"
+rm -f "$OLINK"; ln -s "$D1/run.sh" "$OLINK"
+printf '{"schemaVersion":1,"linkPath":"%s","target":"%s","detectMode":"created-new","stampedAt":"x"}\n' "$OLINK" "$D1/run.sh" > "$OSTATE"
+rm -f "$XDG_DATA_HOME/entwurf/dev-bin/install-state.json"
+# the public verbs: the refusal propagates, and nothing after it runs — no verify, no exclusive,
+# no package-manager query (a recording pnpm/npm in front of the fixture ones).
+PM_TRACE="$SB/j6-pm.trace"; : > "$PM_TRACE"; PM_REC="$SB/j6-pm"; mkdir -p "$PM_REC"
+for _pm in pnpm npm; do printf '#!/usr/bin/env bash\necho "%s $*" >> "%s"\nexec "%s/%s" "$@"\n' "$_pm" "$PM_TRACE" "$FAKE_PM" "$_pm" > "$PM_REC/$_pm"; chmod +x "$PM_REC/$_pm"; done; unset _pm
+WORLD_BEFORE="$(devbin_world)"
+set +e
+OUT="$(env "${OVERRIDES[@]}" PATH="$PM_REC:$DBIN_DIR:$PATH" bash "$INST/run.sh" expose-dev-bin 2>&1)"; RC=$?
+env "${OVERRIDES[@]}" PATH="$PM_REC:$DBIN_DIR:$PATH" bash "$INST/run.sh" remove-dev-bin >/dev/null 2>&1; RC_PREMOVE=$?
+set -e
+want "installed public expose-dev-bin/remove-dev-bin exit 4 with the named refusal, and nothing follows it: no verify, no exclusive, no package-manager query, no change [QK:INSTALLED-DEVBIN-PUBLIC-STOPS]" \
+  "[ '$RC' -eq 4 ] && [ '$RC_PREMOVE' -eq 4 ] && printf '%s' \"\$OUT\" | grep -qF 'REFUSE expose: this dev-bin.sh belongs to an installed package' && ! printf '%s' \"\$OUT\" | grep -qE 'dev-bin verify|dev-bin exclusive|PATH winner' && [ ! -s '$PM_TRACE' ] && [ \"\$WORLD_BEFORE\" = \"\$(devbin_world)\" ]"
+# the developer's own authority is kept: a link a source checkout made follows it to another one
+set +e; env "${OVERRIDES[@]}" bash "$D2/scripts/dev-bin.sh" expose entwurf >"$SB/j6-d2.out" 2>&1; RC=$?; set -e
+want "source dev-bin keeps the moved-checkout rule: the D1 link and state move to D2 as refresh-ours [QK:SOURCE-DEVBIN-MOVED-CHECKOUT]" \
+  "[ '$RC' -eq 0 ] && [ \"\$(readlink '$OLINK')\" = '$D2/run.sh' ] && grep -q 'refresh-ours' '$SB/j6-d2.out' && python3 -c 'import json,sys; sys.exit(0 if json.load(open(sys.argv[1]))[\"target\"]==sys.argv[2] else 1)' '$OSTATE' '$D2/run.sh'"
+env "${OVERRIDES[@]}" bash "$D2/scripts/dev-bin.sh" remove entwurf >/dev/null 2>&1
+env "${OVERRIDES[@]}" bash "$D1/scripts/dev-bin.sh" remove >/dev/null 2>&1
+rm -rf "$D1" "$D2" "$SB/inst" "$SB/inst-alias" "$SB/dev-bin-link.sh" "$PM_REC" "$PM_TRACE" "$HOME/.profile"
+want "installed dev-bin cells leave no managed link or state behind" "[ -z \"\$(ls -A '$DBIN_DIR' 2>/dev/null)\" ] && [ ! -d '$XDG_DATA_HOME/entwurf/dev-bin' ]"
+
 unset ENTWURF_DEV_BIN_DIR ENTWURF_OPERATOR_TARGET ENTWURF_BRIDGE_TARGET ENTWURF_AGY_STATUSLINE_TARGET
 export PATH="$DEVBIN_ORIG_PATH"
 unset ENTWURF_AGY_IMPRINT_TARGET ENTWURF_COPILOT_STATUSLINE_TARGET

package/scripts/smoke-meta-prune.sh

@@ -166,6 +166,29 @@ OUT3="$(node --experimental-strip-types "$PRUNE" "$STORE" --ttl-days 100 2>&1)"
 set -e
 echo "$OUT3" | grep -q "STALE recordUpdatedAt>100d (0):" && echo "$OUT3" | grep -q "KEEP (live/recent): 2 record" && ok "--ttl-days widens keep window" || bad "--ttl-days did not move stale boundary"
 
+# the leaf's usage is now only the address of the description (#153): --help keeps exit 0 and an
+# unknown flag keeps exit 2 with its cause line, both with nothing on stdout. These two children get
+# their own scratch HOME, XDG roots, PI dir and store under $TMP, never the operator's.
+PRUNE_HOME="$TMP/help-home"
+prune_env=(HOME="$PRUNE_HOME" XDG_DATA_HOME="$PRUNE_HOME/.local/share" XDG_STATE_HOME="$PRUNE_HOME/.local/state"
+  XDG_CACHE_HOME="$PRUNE_HOME/.cache" XDG_CONFIG_HOME="$PRUNE_HOME/.config" PI_CODING_AGENT_DIR="$PRUNE_HOME/.pi/agent"
+  ENTWURF_META_SESSIONS_DIR="$PRUNE_HOME/store")
+PRUNE_POINTER='meta-bridge-prune: see `entwurf help meta-bridge-prune` (from that checkout'"'"'s root: `./run.sh help meta-bridge-prune`)'
+set +e
+env "${prune_env[@]}" node --experimental-strip-types "$PRUNE" --help >"$TMP/help.out" 2>"$TMP/help.err"
+HELP_CODE=$?
+env "${prune_env[@]}" node --experimental-strip-types "$PRUNE" --bogus >"$TMP/bogus.out" 2>"$TMP/bogus.err"
+BOGUS_CODE=$?
+set -e
+if [ "$HELP_CODE" = "0" ] && [ ! -s "$TMP/help.out" ] && [ "$(cat "$TMP/help.err")" = "$PRUNE_POINTER" ] \
+  && [ "$(wc -l <"$TMP/help.err")" = 1 ] \
+  && [ "$BOGUS_CODE" = "2" ] && [ ! -s "$TMP/bogus.out" ] \
+  && [ "$(cat "$TMP/bogus.err")" = "unknown flag: --bogus"$'\n'"$PRUNE_POINTER" ] && [ "$(wc -l <"$TMP/bogus.err")" = 2 ]; then
+  ok "--help (exit 0) and --bogus (exit 2, after its cause line) print nothing on stdout and point at \`entwurf help meta-bridge-prune\`"
+else
+  bad "[QK:PRUNE-HELP-POINTER] the leaf's usage is not exactly the pointer line: help rc=$HELP_CODE stderr=$(head -c 300 "$TMP/help.err") stdout=$(head -c 200 "$TMP/help.out") | bogus rc=$BOGUS_CODE stderr=$(head -c 300 "$TMP/bogus.err") stdout=$(head -c 200 "$TMP/bogus.out")"
+fi
+
 if [ "$fail" = "0" ]; then
   echo "smoke-meta-prune PASS"
 else

package/scripts/smoke-omp-fresh-live.ts

@@ -221,8 +221,12 @@ ok("the caller is a record-backed citizen with an armed mailbox and a sender mar
 
 const citizensBefore = new Set(
 	(
-		JSON.parse(execFileSync("bash", [path.join(REPO, "run.sh"), "meta-facts"], { encoding: "utf8" }))
-			.citizens as Array<{
+		JSON.parse(
+			execFileSync("bash", [path.join(REPO, "run.sh"), "meta-facts"], {
+				encoding: "utf8",
+				maxBuffer: 64 * 1024 * 1024,
+			}),
+		).citizens as Array<{
 			gardenId: string;
 		}>
 	).map((c) => c.gardenId),
@@ -356,7 +360,12 @@ ok(
 );
 
 // ── 7. that id is a real omp citizen, and the ONLY one this step minted ──────
-const facts = JSON.parse(execFileSync("bash", [path.join(REPO, "run.sh"), "meta-facts"], { encoding: "utf8" }));
+const facts = JSON.parse(
+	execFileSync("bash", [path.join(REPO, "run.sh"), "meta-facts"], {
+		encoding: "utf8",
+		maxBuffer: 64 * 1024 * 1024,
+	}),
+);
 const citizen = (facts.citizens as Array<Record<string, unknown>>).find((c) => c.gardenId === siblingGid);
 ok(
 	"the callback id resolves to a V3 record whose backend is omp",

package/scripts/smoke-omp-receive-live.ts

@@ -279,7 +279,13 @@ ok(
 // This closes a real gap rather than a cosmetic one. `entwurf_inbox_read` takes a
 // CALLER-SUPPLIED garden id and does not verify it against the caller's identity, so
 // `lastReadAt` alone proves a read happened — not that THIS session performed it.
-const record = JSON.parse(sh("bash", [path.join(REPO, "run.sh"), "meta-facts"]));
+const record = JSON.parse(
+	execFileSync("bash", [path.join(REPO, "run.sh"), "meta-facts"], {
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "pipe"],
+		maxBuffer: 64 * 1024 * 1024,
+	}),
+);
 const citizen = (record.citizens as Array<Record<string, unknown>>).find((c) => c.gardenId === gardenId);
 ok("the citizen's V3 record names a transcript for this session", typeof citizen?.transcriptPath === "string");
 const transcriptPath = citizen?.transcriptPath as string;

package/scripts/smoke-pi-durable-fresh-live.ts

@@ -258,7 +258,12 @@ receipts["1-fixture"] = `gardenId=${fixtureGid} backend=claude-code (collector o
 
 const citizensBefore = new Set(
 	(
-		JSON.parse(execFileSync("bash", [path.join(REPO, "run.sh"), "meta-facts"], { encoding: "utf8" })) as {
+		JSON.parse(
+			execFileSync("bash", [path.join(REPO, "run.sh"), "meta-facts"], {
+				encoding: "utf8",
+				maxBuffer: 64 * 1024 * 1024,
+			}),
+		) as {
 			citizens: Array<{ gardenId: string }>;
 		}
 	).citizens.map((c) => c.gardenId),
@@ -453,7 +458,12 @@ ok(
 	JSON.stringify(pdMarker),
 );
 
-const facts = JSON.parse(execFileSync("bash", [path.join(REPO, "run.sh"), "meta-facts"], { encoding: "utf8" })) as {
+const facts = JSON.parse(
+	execFileSync("bash", [path.join(REPO, "run.sh"), "meta-facts"], {
+		encoding: "utf8",
+		maxBuffer: 64 * 1024 * 1024,
+	}),
+) as {
 	citizens: Array<{ gardenId: string }>;
 };
 // Other siblings may mint citizens in the operator's garden meanwhile; this step's are the ones in its scratch cwd.

package/team.json.example

@@ -0,0 +1,39 @@
+{
+	"version": 1,
+	"project": "example-project",
+	"cwd": "/absolute/path/to/project",
+	"notes": [
+		"Illustrative caller-maintained sibling bookmarks, not a runtime standard. All identities below are fictional.",
+		"Copy this file to team.json at the repository root and ignore /team.json in that repository's .gitignore.",
+		"Everyone is a sibling, including the coordinator. Tasks are agreed with the human for each piece of work, not fixed identities.",
+		"The role field is only a descriptive form of address: coordinating sibling or sibling. It assigns no task, standing duty or permission.",
+		"A garden ID marks a sibling's birth and remains its delivery address across supported same-ID returns. The native session ID identifies that harness's conversation.",
+		"The top-level cwd is shared by the members shown in this single-project example; consult each citizen's record for its actual cwd.",
+		"Read both IDs, backend and cwd from Entwurf's current record facts. This bookmark does not replace the record or certify current liveness. If they disagree, the record wins; reconcile the bookmark, never rewrite the record to match it.",
+		"Keep entries after retirement. Membership is not permission to send, resume or retire; use explicit operator requests and the owning lifecycle tools.",
+		"No program loads this example as configuration. It owns no authentication, transcript, model, placement, role assignment or lifecycle automation."
+	],
+	"members": [
+		{
+			"name": "Coordinator",
+			"role": "coordinating sibling",
+			"backend": "pi-durable",
+			"garden_id": "20260101T090000-a1b2c3",
+			"native_session_id": "1767225600000-00000000-0000-4000-8000-000000000001"
+		},
+		{
+			"name": "Sibling A",
+			"role": "sibling",
+			"backend": "pi",
+			"garden_id": "20260101T090100-b2c3d4",
+			"native_session_id": "019b76da-b260-7000-8000-000000000002"
+		},
+		{
+			"name": "Sibling B",
+			"role": "sibling",
+			"backend": "claude-code",
+			"garden_id": "20260101T090200-c3d4e5",
+			"native_session_id": "00000000-0000-4000-8000-000000000003"
+		}
+	]
+}