@junghanacs/entwurf 0.41.2 → 0.50.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-dispatch.js

@@ -1,6 +1,8 @@
 /**
  * fresh-call-dispatch — the ONE place that decides which rail opens a sibling, and the only module
- * allowed to know that there are two.
+ * allowed to know that there are two. Since #157 G1a that rail choice is shared by the two visible
+ * lifecycle verbs, fresh call and same-id visible resume, through two separate entry points; each
+ * verb keeps its own lifecycle policy, and only the rail choice is common.
  *
  * WHY A COMPOSITION ROOT AND NOT A BRANCH IN EACH SURFACE. Two surfaces once registered
  * `entwurf_fresh_call`: pi's own extension and the MCP bridge. Before this file each of them
@@ -21,14 +23,16 @@
  * somewhere the operator cannot see from where they are standing, and the receipt would look fine.
  *
  * WHAT THIS MODULE DOES NOT DO: it never reads the record store, never resolves a garden id, and
- * never turns the direct herdr witness into a second public address. The nonce callback remains
- * the one address path, on both rails.
+ * never turns the direct herdr witness into a second public address. For a FRESH call the nonce
+ * callback remains the one address path, on both rails. A visible resume has no nonce: its address
+ * is the record the v2 composition already resolved, and this module only picks where it reopens.
  */
 import { spawn as spawnChildProcess } from "node:child_process";
 import { ACP_MODEL_NOT_CURATED, isCuratedAcpModelId, PROVIDER_ID } from "./acp/model-ids.js";
 import { codexCallerFreshPreflight, codexFreshPreflight } from "./codex-fresh-preflight.js";
 import { isSafeFreshCallModel, mintNonce } from "./fresh-call-composition.js";
 import { createHerdrRunner, herdrFreshCall, renderHerdrFreshCall, resolveHerdrContext, } from "./herdr-fresh-call.js";
+import { launchHerdrResume } from "./herdr-resume-call.js";
 import { freshCall, renderFreshCall } from "./mux-fresh-call.js";
 import { splitPiDurableModel } from "./pi-durable-fresh-preflight.js";
 /** herdr's own marker, read for its EXACT value. `[측정 2026-09-14]` herdr exports `HERDR_ENV=1`
@@ -98,12 +102,13 @@ export function isUncuratedEntwurfPiModel(backend, model) {
  * backend there, so running a Codex preflight would ask an irrelevant question and could fail for
  * a reason that has nothing to do with why the call is impossible.
  *
- * THE TWO CODEX CALLER INPUTS ARE TMUX-RAIL FACTS and stop at this boundary. #95 lane B/C measured
- * both against a tmux pane and an app-server-hosted bridge: a pane title is what carries the
- * caller's thread-id, and a record cwd exists as an input because THAT process's directory is the
- * app-server's. Inside herdr the tab is created by herdr, there is no pane title to anchor to, and
- * neither fact has been measured — so the herdr rail is handed the request without consulting
- * them rather than inheriting a rule from a topology it does not share.
+ * THE CODEX CALLER'S THREAD ID IS A TMUX-RAIL FACT and stops at this boundary. #95 lane B measured
+ * it against a tmux pane: a pane title is what carries the caller's thread-id, and inside herdr the
+ * tab is created by herdr, with no pane title to anchor to. The herdr rail therefore receives only a
+ * boolean saying the caller IS a record-backed Codex citizen, plus that citizen's record cwd (#95
+ * lane C: an app-server-hosted bridge's own directory is the app-server's). Both herdr branches read
+ * them (layout since #157 A-L1, agent start since A-L1x), to choose a cwd without falling back to
+ * this process's; this is not a Codex-in-herdr placement certification.
  */
 export async function dispatchFreshCall(request, env = process.env, spawn, nonce = mintNonce()) {
     // Before either rail is asked anything: both would open a pane on a provider nobody chose.
@@ -127,7 +132,20 @@ export async function dispatchFreshCall(request, env = process.env, spawn, nonce
             return { rail: "herdr", result: { ok: false, reason: context.reason } };
         }
         const run = createHerdrRunner(context.context.bin, env, spawn ?? spawnChildProcess);
-        return { rail: "herdr", result: await herdrFreshCall(request, run, env, nonce) };
+        // #157 A-L1: an explicit field list, not `...request`, so the Codex thread id STOPS here — it is
+        // a tmux seat input. The herdr rail learns only WHETHER the caller is a record-backed Codex
+        // citizen (one boolean) and that citizen's record cwd; the tmux request below is untouched.
+        const herdrRequest = {
+            backend: request.backend,
+            model: request.model,
+            task: request.task,
+            ...(request.cwd === undefined ? {} : { cwd: request.cwd }),
+            ...(request.placement === undefined ? {} : { placement: request.placement }),
+            callerGardenId: request.callerGardenId,
+            ...(request.callerCwd === undefined ? {} : { callerCwd: request.callerCwd }),
+            callerIsCodex: request.callerNativeSessionId !== undefined,
+        };
+        return { rail: "herdr", result: await herdrFreshCall(herdrRequest, run, env, nonce) };
     }
     // TWO capability axes, in this order, both pre-mutation and neither standing in for the
     // other. The TARGET axis first — "entwurf cannot open a Codex sibling here at all" is the
@@ -166,3 +184,22 @@ export async function dispatchFreshCall(request, env = process.env, spawn, nonce
 export function renderDispatchedFreshCall(dispatched) {
     return dispatched.rail === "herdr" ? renderHerdrFreshCall(dispatched.result) : renderFreshCall(dispatched.result);
 }
+/**
+ * #157 G1a: pick the rail a same-id visible resume reopens on — the SAME capability fact fresh
+ * call reads, through the same `selectFreshCallRail`, never a parameter and never a fallback either
+ * way. This entry point owns that choice and nothing else:
+ *
+ *   the v2 composition   record, dormancy proof, lock, identity, observation — it calls the surface's
+ *                        launcher and never learns that there are rails
+ *   the surface          supplies the fixed tmux launch mapping as `tmuxLaunch`; it reads no rail fact
+ *   herdr-resume-call    owns the herdr behaviour, including refusing a non-pi target before anything
+ *                        is created
+ *
+ * Inside herdr the tmux mapping is never called, so a refused or failed herdr launch stays a herdr
+ * answer. Outside herdr the tmux mapping keeps its own herdr guard for any direct caller.
+ */
+export function dispatchResumeLaunch(input, tmuxLaunch, env = process.env, spawn) {
+    if (selectFreshCallRail(env) !== "herdr")
+        return tmuxLaunch(input);
+    return launchHerdrResume(input, env, spawn ?? spawnChildProcess);
+}