gentle-pi 0.4.5 → 0.5.0

package/assets/orchestrator.md

@@ -27,7 +27,7 @@ Keep synthesis short by default: decision, outcome, next action. Expand only whe
 
 ## Language Boundary
 
-User-facing conversation should stay in the user's language and follow the currently selected persona mode. In `gentleman` mode, Spanish uses natural Rioplatense voseo. In `neutral` mode, Spanish stays neutral/professional without regional expression.
+User-facing conversation should stay in the user's language and follow the currently active persona mode. The active mode is stated in the `Current persona mode:` line in the identity/harness section of this system prompt — always honor it for language style.
 
 Subagent-facing prompts should be written in English by default, even when the user speaks Spanish. Translate the user's request into concise English before delegation. This keeps token usage lower and gives built-in/project subagents a consistent operating language without changing the user-facing persona.
 
@@ -271,6 +271,15 @@ When Engram or another callable memory package is available, the parent owns mem
 - SDD artifact keys: in memory/hybrid mode, phase artifacts should use stable topic keys such as `sdd/<change>/proposal`, `sdd/<change>/spec`, `sdd/<change>/design`, `sdd/<change>/tasks`, `sdd/<change>/apply-progress`, and `sdd/<change>/verify-report`.
 - If memory tools are unavailable, do not pretend persistence exists; return artifacts inline and/or write OpenSpec files.
 
+Memory lifecycle rule (when Engram exposes lifecycle metadata/tooling):
+
+- At session start or before architecture-sensitive work, call `mem_review` with action `list` for the current project when the tool is available.
+- If `mem_review` is unavailable, do not fail the task. Continue with normal `mem_context`/`mem_search`, and still apply lifecycle metadata from any returned observations when present.
+- `active` memories may be used normally.
+- `needs_review` memories are stale context, not trusted facts.
+- When a retrieved memory is marked `needs_review`, surface that stale context to the user and verify it against current evidence before relying on it.
+- Do NOT call `mem_review` with action `mark_reviewed` automatically. Only call `mark_reviewed` after explicit user confirmation or through a dedicated memory maintenance command.
+
 ## Execution Mode
 
 Use the session's SDD preflight choice:

package/extensions/gentle-ai.ts

@@ -149,6 +149,7 @@ const NEUTRAL_PERSONA_PROMPT = `Persona:
 - Be direct, technical, concise, warm, and professional.
 - Always respond in the same language the user writes in.
 - Do not use slang or regional expressions.
+- When the user writes Spanish, use neutral/professional Spanish. Do NOT use voseo (vos tenés, vos querés, hacé, andá, etc.) or any regional conjugations.
 - Act as a senior architect and teacher: concepts before code, no shortcuts.
 - Treat AI as a tool directed by the human; never present yourself as a default chatbot.
 - Push back when the user asks for code without enough context or understanding.
@@ -157,7 +158,14 @@ const NEUTRAL_PERSONA_PROMPT = `Persona:
 function buildGentlePrompt(persona: PersonaMode): string {
 	const personaPrompt =
 		persona === "neutral" ? NEUTRAL_PERSONA_PROMPT : GENTLEMAN_PERSONA_PROMPT;
+	const languageBoundary =
+		persona === "neutral"
+			? "Language: neutral/professional Spanish when the user writes Spanish. Do NOT use voseo or Rioplatense regional expressions."
+			: "Language: natural Rioplatense Spanish with voseo when the user writes Spanish.";
 	return `## el Gentleman Identity and Harness
+
+Current persona mode: ${persona}
+
 You are el Gentleman: a Pi-specific coding-agent harness for controlled development work.
 
 Identity contract:
@@ -169,6 +177,8 @@ Identity contract:
 
 ${personaPrompt}
 
+${languageBoundary}
+
 Harness principles:
 - el Gentleman is not prompt engineering. It is runtime discipline around powerful agents.
 - Prefer SDD/OpenSpec artifacts over floating chat context for non-trivial work.
@@ -182,11 +192,19 @@ Harness principles:
 ${getOrchestratorPrompt()}`;
 }
 
+// Matches `git [global-flags] push` — tolerates flags like -C /repo or --work-tree=/tmp
+// between `git` and the subcommand. Short flags may be followed by a separate value token.
+const GIT_GLOBAL_FLAGS_SRC = String.raw`(?:\s+--?\S+(?:\s+[^-\s]\S*)?)* `;
+const GIT_PUSH_RE = new RegExp(String.raw`\bgit${GIT_GLOBAL_FLAGS_SRC}push\b`);
+
 const DENIED_BASH_PATTERNS: RegExp[] = [
-	/\brm\s+-rf\s+(?:\/|~|\$HOME|\.\.?)(?:\s|$)/,
+	// Block rm -rf targeting /, ~ or ~/subdir, $HOME or $HOME/subdir, .. or .
+	/\brm\s+-rf\s+(?:\/(?:\s|$)|~(?:\/|\s|$)|[$]HOME(?:\/|\s|$)|\.\.?(?:\s|$))/,
 	/\bgit\s+reset\s+--hard\b/,
 	/\bgit\s+clean\b(?=[^\n]*(?:-[^\n]*f|--force))(?=[^\n]*(?:-[^\n]*d|--directories))/,
-	/\bgit\s+push\b(?=[^\n]*\s--force(?:-with-lease)?\b)/,
+	// Force-push deny: tolerates git global flags (e.g. -C /repo) before the subcommand
+	new RegExp(String.raw`\bgit${GIT_GLOBAL_FLAGS_SRC}push\b(?=[^\n]*\s--force(?:-with-lease)?\b)`),
+	new RegExp(String.raw`\bgit${GIT_GLOBAL_FLAGS_SRC}push\b(?=[^\n]*\s-[^\s-]*f)`),
 	/\bchmod\s+-R\s+777\b/,
 	/\bchown\s+-R\b/,
 ];
@@ -194,11 +212,189 @@ const DENIED_BASH_PATTERNS: RegExp[] = [
 const CONFIRM_BASH_PATTERNS: RegExp[] = [
 	/\bgit\s+push\b/,
 	/\bgit\s+rebase\b/,
-	/\bgit\s+branch\s+-D\b/,
+	/\bgit\s+branch\s+(?:-[a-zA-Z]*D[a-zA-Z]*|-[a-zA-Z]*d[a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*d[a-zA-Z]*|--delete\b[^\n]*--force\b|--force\b[^\n]*--delete\b)/,
 	/\bnpm\s+publish\b/,
 	/\bpi\s+remove\b/,
 ];
 
+// ---------------------------------------------------------------------------
+// Autonomous guard — runtime guardrails config
+// ---------------------------------------------------------------------------
+
+const GUARD_ACTION = {
+	ALLOW: "allow",
+	CONFIRM: "confirm",
+	BLOCK: "block",
+} as const;
+
+type GuardAction = (typeof GUARD_ACTION)[keyof typeof GUARD_ACTION];
+type GuardClassification = GuardAction | "not-guarded";
+
+const GUARDED_COMMAND_KEY = {
+	GIT_PUSH: "gitPush",
+	GIT_REBASE: "gitRebase",
+	GIT_BRANCH_DELETE_FORCE: "gitBranchDeleteForce",
+	NPM_PUBLISH: "npmPublish",
+	PI_REMOVE: "piRemove",
+} as const;
+
+type GuardedCommandKey = (typeof GUARDED_COMMAND_KEY)[keyof typeof GUARDED_COMMAND_KEY];
+
+type GuardedCommandsConfig = Partial<Record<GuardedCommandKey, GuardAction>>;
+
+interface RuntimeGuardrailsConfig {
+	autonomousMode: boolean;
+	guardedCommands: GuardedCommandsConfig;
+}
+
+interface LoadGuardrailsOptions {
+	/** Override the config home directory (used in tests to avoid touching ~/.pi). */
+	gentlePiConfigHome?: string;
+}
+
+const GUARDED_KEY_PATTERNS: Record<GuardedCommandKey, RegExp> = {
+	gitPush: GIT_PUSH_RE,
+	gitRebase: /\bgit\s+rebase\b/,
+	gitBranchDeleteForce: /\bgit\s+branch\s+(?:-[a-zA-Z]*D[a-zA-Z]*|-[a-zA-Z]*d[a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*d[a-zA-Z]*|--delete\b[^\n]*--force\b|--force\b[^\n]*--delete\b)/,
+	npmPublish: /\bnpm\s+publish\b/,
+	piRemove: /\bpi\s+remove\b/,
+};
+
+const AUTONOMOUS_DEFAULT_ACTIONS: Record<GuardedCommandKey, GuardAction> = {
+	gitPush: "allow",
+	gitRebase: "confirm",
+	gitBranchDeleteForce: "confirm",
+	npmPublish: "block",
+	piRemove: "confirm",
+};
+
+const SAFE_GUARDRAILS_CONFIG: RuntimeGuardrailsConfig = {
+	autonomousMode: false,
+	guardedCommands: {},
+};
+
+/**
+ * Classify a shell command under the runtime guard policy.
+ *
+ * Ordering (non-negotiable):
+ *   1. Hard-deny patterns → "block" (always, cannot be overridden by config)
+ *   2. If autonomousMode is false → mirror the legacy CONFIRM_BASH_PATTERNS result
+ *   3. If autonomousMode is true → use configured GuardAction for the matched key
+ *      (applying AUTONOMOUS_DEFAULT_ACTIONS for any key not set in guardedCommands)
+ *   4. No match → "not-guarded"
+ */
+function classifyGuardedCommand(
+	command: string,
+	config: RuntimeGuardrailsConfig,
+): GuardClassification {
+	// Step 1: hard-deny always wins, regardless of any config
+	for (const pattern of DENIED_BASH_PATTERNS) {
+		if (pattern.test(command)) return "block";
+	}
+
+	// Step 2 & 3: find which guarded key (if any) this command matches
+	for (const [key, pattern] of Object.entries(GUARDED_KEY_PATTERNS) as [GuardedCommandKey, RegExp][]) {
+		if (!pattern.test(command)) continue;
+
+		// Matched a guarded key
+		if (!config.autonomousMode) {
+			// Legacy behavior: any match → confirm
+			return "confirm";
+		}
+
+		// Autonomous mode: use configured action, fall back to sensible defaults
+		const configuredAction = config.guardedCommands[key];
+		return configuredAction ?? AUTONOMOUS_DEFAULT_ACTIONS[key];
+	}
+
+	return "not-guarded";
+}
+
+function parseGuardrailsConfigFile(
+	raw: string,
+): RuntimeGuardrailsConfig | undefined {
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return undefined;
+	}
+	if (!isRecord(parsed)) return undefined;
+
+	const autonomousMode = parsed.autonomousMode === true;
+
+	const rawCommands = isRecord(parsed.guardedCommands) ? parsed.guardedCommands : {};
+	const guardedCommands: GuardedCommandsConfig = {};
+	const validActions = new Set<string>(["allow", "confirm", "block"]);
+	for (const [key, value] of Object.entries(rawCommands)) {
+		if (
+			typeof value === "string" &&
+			validActions.has(value) &&
+			Object.values(GUARDED_COMMAND_KEY).includes(key as GuardedCommandKey)
+		) {
+			guardedCommands[key as GuardedCommandKey] = value as GuardAction;
+		}
+	}
+
+	return { autonomousMode, guardedCommands };
+}
+
+/**
+ * Load the runtime guardrails config.
+ *
+ * Resolution order (project overrides global):
+ *   1. Check GENTLE_PI_AUTONOMOUS_MODE env var — if "1", forces autonomousMode=true
+ *      and uses default guarded command actions.
+ *   2. Read global config from ${gentlePiConfigHome}/runtime-guardrails.json
+ *   3. Read project config from ${cwd}/.pi/gentle-ai/runtime-guardrails.json
+ *      (project values are merged on top of global)
+ *   4. Any parse/read error anywhere → fail safe (return SAFE_GUARDRAILS_CONFIG)
+ */
+function loadRuntimeGuardrailsConfig(
+	cwd: string,
+	options: LoadGuardrailsOptions = {},
+): RuntimeGuardrailsConfig {
+	try {
+		// Env var override: forces autonomous mode with default actions
+		if (process.env.GENTLE_PI_AUTONOMOUS_MODE === "1") {
+			return { autonomousMode: true, guardedCommands: {} };
+		}
+
+		const configHome = options.gentlePiConfigHome ?? gentleAiConfigHome();
+		const globalConfigPath = join(configHome, "runtime-guardrails.json");
+		const projectConfigPath = join(cwd, ".pi", "gentle-ai", "runtime-guardrails.json");
+
+		let merged: RuntimeGuardrailsConfig = { autonomousMode: false, guardedCommands: {} };
+
+		if (existsSync(globalConfigPath)) {
+			const globalParsed = parseGuardrailsConfigFile(
+				readFileSync(globalConfigPath, "utf8"),
+			);
+			if (!globalParsed) return SAFE_GUARDRAILS_CONFIG;
+			merged = globalParsed;
+		}
+
+		if (existsSync(projectConfigPath)) {
+			const projectParsed = parseGuardrailsConfigFile(
+				readFileSync(projectConfigPath, "utf8"),
+			);
+			if (!projectParsed) return SAFE_GUARDRAILS_CONFIG;
+			// Project values fully override global values
+			merged = {
+				autonomousMode: projectParsed.autonomousMode,
+				guardedCommands: {
+					...merged.guardedCommands,
+					...projectParsed.guardedCommands,
+				},
+			};
+		}
+
+		return merged;
+	} catch {
+		return SAFE_GUARDRAILS_CONFIG;
+	}
+}
+
 const PATH_GUARDED_TOOL_NAMES = new Set(["read", "write", "edit"]);
 const PATH_INPUT_KEYS = new Set([
 	"path",
@@ -329,25 +525,6 @@ function sddPhaseFromAgentStartEvent(event: unknown): SddPhase | undefined {
 	return undefined;
 }
 
-function evaluateDeniedCommand(
-	command: string,
-): ToolCallEventResult | undefined {
-	for (const pattern of DENIED_BASH_PATTERNS) {
-		if (pattern.test(command)) {
-			return {
-				block: true,
-				reason:
-					"Gentle AI safety policy blocked a destructive shell command. Ask the user for an explicit safer plan.",
-			};
-		}
-	}
-	return undefined;
-}
-
-function commandRequiresConfirmation(command: string): boolean {
-	return CONFIRM_BASH_PATTERNS.some((pattern) => pattern.test(command));
-}
-
 function normalizePolicyPath(value: string): string {
 	return value.trim().replace(/^~(?=\/|$)/, homedir()).replace(/\\/g, "/").toLowerCase();
 }
@@ -408,9 +585,23 @@ async function confirmCommand(
 	command: string,
 	ctx: ExtensionContext,
 ): Promise<ToolCallEventResult | undefined> {
-	const denied = evaluateDeniedCommand(command);
-	if (denied) return denied;
-	if (!commandRequiresConfirmation(command)) return undefined;
+	const guardrailsConfig = loadRuntimeGuardrailsConfig(ctx.cwd);
+	const classification = classifyGuardedCommand(command, guardrailsConfig);
+
+	if (classification === "block") {
+		return {
+			block: true,
+			reason:
+				"Gentle AI safety policy blocked a destructive shell command. Ask the user for an explicit safer plan.",
+		};
+	}
+
+	if (classification === "not-guarded") return undefined;
+
+	// classification is "allow" or "confirm" from this point on
+	if (classification === "allow") return undefined;
+
+	// classification === "confirm"
 	if (!ctx.hasUI) {
 		return {
 			block: true,
@@ -1573,6 +1764,9 @@ async function handlePersonaCommand(ctx: ExtensionContext): Promise<void> {
 export const __testing = {
 	listAgentsFromDir,
 	listAgentsFromDirAsync,
+	classifyGuardedCommand,
+	loadRuntimeGuardrailsConfig,
+	buildGentlePrompt,
 };
 
 export default function gentleAi(pi: ExtensionAPI): void {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gentle-pi",
-  "version": "0.4.5",
+  "version": "0.5.0",
   "description": "Turn Pi into el Gentleman: a senior-architect development harness with SDD/OpenSpec, subagents, strict TDD evidence, review guardrails, and skill discovery.",
   "license": "MIT",
   "type": "module",

package/tests/artifact-language.test.ts

@@ -84,6 +84,33 @@ test("rendered SDD preflight prompt is English artifact copy", () => {
 	}
 });
 
+test("orchestrator Memory Contract carries the Engram memory lifecycle rule", async () => {
+	const orchestrator = await readFile(join(ROOT, "assets/orchestrator.md"), "utf8");
+
+	// Mirrors gentle-ai's engram-protocol/engram-convention lifecycle rule (PRs #842 + #844),
+	// in its final availability-gated form: agents must treat needs_review memories as stale,
+	// prefer mem_review when present, fall back safely when it is not, and never auto-mark reviewed.
+	for (const required of [
+		"when Engram exposes lifecycle metadata/tooling",
+		"At session start or before architecture-sensitive work",
+		"call `mem_review` with action `list`",
+		"for the current project when the tool is available",
+		"If `mem_review` is unavailable, do not fail the task",
+		"Continue with normal `mem_context`/`mem_search`",
+		"still apply lifecycle metadata from any returned observations when present",
+		"`active` memories may be used normally",
+		"`needs_review` memories are stale context, not trusted facts",
+		"verify it against current evidence before relying on it",
+		"Do NOT call `mem_review` with action `mark_reviewed` automatically",
+		"Only call `mark_reviewed` after explicit user confirmation or through a dedicated memory maintenance command",
+	]) {
+		assert.ok(
+			orchestrator.includes(required),
+			`orchestrator.md missing memory lifecycle rule: ${required}`,
+		);
+	}
+});
+
 test("SDD proposal questions focus on business and PRD gaps", async () => {
 	const proposalAgent = await readFile(join(ROOT, "assets/agents/sdd-proposal.md"), "utf8");
 

package/tests/autonomous-guard.test.ts

@@ -0,0 +1,537 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import test from "node:test";
+import { __testing } from "../extensions/gentle-ai.ts";
+
+const { classifyGuardedCommand } = __testing;
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function makeTmpDir(): string {
+	return mkdtempSync(join(tmpdir(), "gentle-pi-autonomous-"));
+}
+
+function writeConfig(dir: string, relPath: string, content: unknown): void {
+	const full = join(dir, relPath);
+	mkdirSync(dirname(full), { recursive: true });
+	writeFileSync(full, JSON.stringify(content, null, 2));
+}
+
+// ---------------------------------------------------------------------------
+// classifyGuardedCommand — base contract
+// ---------------------------------------------------------------------------
+
+test("classifyGuardedCommand: git push plain → confirm by default (no autonomous mode)", () => {
+	const result = classifyGuardedCommand("git push origin main", {
+		autonomousMode: false,
+		guardedCommands: {},
+	});
+	assert.equal(result, "confirm");
+});
+
+test("classifyGuardedCommand: git rebase → confirm by default (no autonomous mode)", () => {
+	const result = classifyGuardedCommand("git rebase main", {
+		autonomousMode: false,
+		guardedCommands: {},
+	});
+	assert.equal(result, "confirm");
+});
+
+test("classifyGuardedCommand: npm publish → confirm by default (no autonomous mode)", () => {
+	const result = classifyGuardedCommand("npm publish", {
+		autonomousMode: false,
+		guardedCommands: {},
+	});
+	assert.equal(result, "confirm");
+});
+
+test("classifyGuardedCommand: unknown command → not-guarded", () => {
+	const result = classifyGuardedCommand("echo hello", {
+		autonomousMode: false,
+		guardedCommands: {},
+	});
+	assert.equal(result, "not-guarded");
+});
+
+// ---------------------------------------------------------------------------
+// Hard-deny always blocks regardless of autonomous mode or config
+// ---------------------------------------------------------------------------
+
+test("classifyGuardedCommand: git push --force always blocked even with gitPush=allow", () => {
+	const result = classifyGuardedCommand("git push --force origin main", {
+		autonomousMode: true,
+		guardedCommands: { gitPush: "allow" },
+	});
+	assert.equal(result, "block");
+});
+
+test("classifyGuardedCommand: git push --force-with-lease always blocked", () => {
+	const result = classifyGuardedCommand("git push --force-with-lease origin main", {
+		autonomousMode: true,
+		guardedCommands: { gitPush: "allow" },
+	});
+	assert.equal(result, "block");
+});
+
+test("classifyGuardedCommand: git push -f always blocked even in autonomous mode", () => {
+	const result = classifyGuardedCommand("git push -f origin main", {
+		autonomousMode: true,
+		guardedCommands: { gitPush: "allow" },
+	});
+	assert.equal(result, "block");
+});
+
+test("classifyGuardedCommand: git reset --hard always blocked", () => {
+	const result = classifyGuardedCommand("git reset --hard HEAD~1", {
+		autonomousMode: true,
+		guardedCommands: {},
+	});
+	assert.equal(result, "block");
+});
+
+test("classifyGuardedCommand: rm -rf / always blocked", () => {
+	const result = classifyGuardedCommand("rm -rf /", {
+		autonomousMode: true,
+		guardedCommands: {},
+	});
+	assert.equal(result, "block");
+});
+
+test("classifyGuardedCommand: rm -rf ~ always blocked", () => {
+	const result = classifyGuardedCommand("rm -rf ~", {
+		autonomousMode: true,
+		guardedCommands: {},
+	});
+	assert.equal(result, "block");
+});
+
+test("classifyGuardedCommand: chmod -R 777 always blocked", () => {
+	const result = classifyGuardedCommand("chmod -R 777 /etc", {
+		autonomousMode: true,
+		guardedCommands: {},
+	});
+	assert.equal(result, "block");
+});
+
+// ---------------------------------------------------------------------------
+// Autonomous mode + allow action
+// ---------------------------------------------------------------------------
+
+test("classifyGuardedCommand: git push plain allowed when autonomousMode=true and gitPush=allow", () => {
+	const result = classifyGuardedCommand("git push origin feature/test", {
+		autonomousMode: true,
+		guardedCommands: { gitPush: "allow" },
+	});
+	assert.equal(result, "allow");
+});
+
+test("classifyGuardedCommand: git push plain still confirm when autonomousMode=false even with gitPush=allow in config", () => {
+	const result = classifyGuardedCommand("git push origin feature/test", {
+		autonomousMode: false,
+		guardedCommands: { gitPush: "allow" },
+	});
+	assert.equal(result, "confirm");
+});
+
+// ---------------------------------------------------------------------------
+// Autonomous mode + confirm action (stays gated)
+// ---------------------------------------------------------------------------
+
+test("classifyGuardedCommand: git rebase stays confirm when autonomousMode=true and gitRebase=confirm", () => {
+	const result = classifyGuardedCommand("git rebase main", {
+		autonomousMode: true,
+		guardedCommands: { gitRebase: "confirm" },
+	});
+	assert.equal(result, "confirm");
+});
+
+test("classifyGuardedCommand: git branch -D stays confirm in autonomous mode (gitBranchDeleteForce=confirm)", () => {
+	const result = classifyGuardedCommand("git branch -D old-feature", {
+		autonomousMode: true,
+		guardedCommands: { gitBranchDeleteForce: "confirm" },
+	});
+	assert.equal(result, "confirm");
+});
+
+test("classifyGuardedCommand: git branch -df stays confirm in autonomous mode", () => {
+	const result = classifyGuardedCommand("git branch -df old-feature", {
+		autonomousMode: true,
+		guardedCommands: { gitBranchDeleteForce: "confirm" },
+	});
+	assert.equal(result, "confirm");
+});
+
+test("classifyGuardedCommand: git branch --delete --force stays confirm in autonomous mode", () => {
+	const result = classifyGuardedCommand("git branch --delete --force old-feature", {
+		autonomousMode: true,
+		guardedCommands: { gitBranchDeleteForce: "confirm" },
+	});
+	assert.equal(result, "confirm");
+});
+
+// ---------------------------------------------------------------------------
+// Autonomous mode + block action
+// ---------------------------------------------------------------------------
+
+test("classifyGuardedCommand: npm publish blocked when autonomousMode=true and npmPublish=block", () => {
+	const result = classifyGuardedCommand("npm publish", {
+		autonomousMode: true,
+		guardedCommands: { npmPublish: "block" },
+	});
+	assert.equal(result, "block");
+});
+
+// ---------------------------------------------------------------------------
+// loadRuntimeGuardrailsConfig — file loading
+// ---------------------------------------------------------------------------
+
+test("loadRuntimeGuardrailsConfig: returns off config when no file exists", () => {
+	const dir = makeTmpDir();
+	try {
+		const config = __testing.loadRuntimeGuardrailsConfig(dir, {
+			gentlePiConfigHome: join(dir, "global-config"),
+		});
+		assert.equal(config.autonomousMode, false);
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});
+
+test("loadRuntimeGuardrailsConfig: env var GENTLE_PI_AUTONOMOUS_MODE=1 activates mode", () => {
+	const original = process.env.GENTLE_PI_AUTONOMOUS_MODE;
+	process.env.GENTLE_PI_AUTONOMOUS_MODE = "1";
+	const dir = makeTmpDir();
+	try {
+		const config = __testing.loadRuntimeGuardrailsConfig(dir, {
+			gentlePiConfigHome: join(dir, "global-config"),
+		});
+		assert.equal(config.autonomousMode, true);
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+		if (original === undefined) delete process.env.GENTLE_PI_AUTONOMOUS_MODE;
+		else process.env.GENTLE_PI_AUTONOMOUS_MODE = original;
+	}
+});
+
+test("loadRuntimeGuardrailsConfig: global config file activates autonomous mode", () => {
+	const dir = makeTmpDir();
+	try {
+		const globalConfigDir = join(dir, "global-config");
+		writeConfig(globalConfigDir, "runtime-guardrails.json", {
+			autonomousMode: true,
+			guardedCommands: { gitPush: "allow" },
+		});
+		const config = __testing.loadRuntimeGuardrailsConfig(join(dir, "project"), {
+			gentlePiConfigHome: globalConfigDir,
+		});
+		assert.equal(config.autonomousMode, true);
+		assert.equal(config.guardedCommands.gitPush, "allow");
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});
+
+test("loadRuntimeGuardrailsConfig: project config overrides global config", () => {
+	const dir = makeTmpDir();
+	try {
+		const globalConfigDir = join(dir, "global-config");
+		const projectDir = join(dir, "project");
+
+		writeConfig(globalConfigDir, "runtime-guardrails.json", {
+			autonomousMode: true,
+			guardedCommands: { gitPush: "allow", npmPublish: "confirm" },
+		});
+		writeConfig(projectDir, join(".pi", "gentle-ai", "runtime-guardrails.json"), {
+			autonomousMode: true,
+			guardedCommands: { gitPush: "confirm", npmPublish: "block" },
+		});
+
+		const config = __testing.loadRuntimeGuardrailsConfig(projectDir, {
+			gentlePiConfigHome: globalConfigDir,
+		});
+		assert.equal(config.autonomousMode, true);
+		assert.equal(config.guardedCommands.gitPush, "confirm");
+		assert.equal(config.guardedCommands.npmPublish, "block");
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});
+
+test("loadRuntimeGuardrailsConfig: invalid JSON in config fails safe (autonomousMode=false)", () => {
+	const dir = makeTmpDir();
+	try {
+		const globalConfigDir = join(dir, "global-config");
+		const configPath = join(globalConfigDir, "runtime-guardrails.json");
+		mkdirSync(globalConfigDir, { recursive: true });
+		writeFileSync(configPath, "{ not valid json }");
+
+		const config = __testing.loadRuntimeGuardrailsConfig(join(dir, "project"), {
+			gentlePiConfigHome: globalConfigDir,
+		});
+		assert.equal(config.autonomousMode, false);
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});
+
+test("loadRuntimeGuardrailsConfig: non-object JSON fails safe", () => {
+	const dir = makeTmpDir();
+	try {
+		const globalConfigDir = join(dir, "global-config");
+		writeConfig(globalConfigDir, "runtime-guardrails.json", [1, 2, 3]);
+
+		const config = __testing.loadRuntimeGuardrailsConfig(join(dir, "project"), {
+			gentlePiConfigHome: globalConfigDir,
+		});
+		assert.equal(config.autonomousMode, false);
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});
+
+test("loadRuntimeGuardrailsConfig: invalid project config fails safe (autonomousMode=false)", () => {
+	const dir = makeTmpDir();
+	try {
+		const globalConfigDir = join(dir, "global-config");
+		const projectDir = join(dir, "project");
+
+		writeConfig(globalConfigDir, "runtime-guardrails.json", {
+			autonomousMode: true,
+			guardedCommands: { gitPush: "allow" },
+		});
+		const projectConfigPath = join(
+			projectDir,
+			".pi",
+			"gentle-ai",
+			"runtime-guardrails.json",
+		);
+		mkdirSync(dirname(projectConfigPath), { recursive: true });
+		writeFileSync(projectConfigPath, "{ bad json }");
+
+		const config = __testing.loadRuntimeGuardrailsConfig(projectDir, {
+			gentlePiConfigHome: globalConfigDir,
+		});
+		assert.equal(config.autonomousMode, false);
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});
+
+// ---------------------------------------------------------------------------
+// When autonomous mode is OFF nothing changes vs current behavior
+// ---------------------------------------------------------------------------
+
+test("classifyGuardedCommand: pi remove confirm when autonomousMode=false", () => {
+	const result = classifyGuardedCommand("pi remove my-package", {
+		autonomousMode: false,
+		guardedCommands: { piRemove: "allow" },
+	});
+	assert.equal(result, "confirm");
+});
+
+test("classifyGuardedCommand: pi remove allowed when autonomousMode=true and piRemove=allow", () => {
+	const result = classifyGuardedCommand("pi remove my-package", {
+		autonomousMode: true,
+		guardedCommands: { piRemove: "allow" },
+	});
+	assert.equal(result, "allow");
+});
+
+// ---------------------------------------------------------------------------
+// Fix 1: git global flags bypass — git -C <dir> push / git --work-tree push
+// ---------------------------------------------------------------------------
+
+test("classifyGuardedCommand: git -C /repo push --force → block even with gitPush=allow", () => {
+	const result = classifyGuardedCommand("git -C /repo push --force origin main", {
+		autonomousMode: true,
+		guardedCommands: { gitPush: "allow" },
+	});
+	assert.equal(result, "block");
+});
+
+test("classifyGuardedCommand: git --work-tree=/tmp push --force → block", () => {
+	const result = classifyGuardedCommand("git --work-tree=/tmp push --force origin main", {
+		autonomousMode: true,
+		guardedCommands: { gitPush: "allow" },
+	});
+	assert.equal(result, "block");
+});
+
+test("classifyGuardedCommand: git -C /repo push -f → block", () => {
+	const result = classifyGuardedCommand("git -C /repo push -f origin main", {
+		autonomousMode: true,
+		guardedCommands: { gitPush: "allow" },
+	});
+	assert.equal(result, "block");
+});
+
+test("classifyGuardedCommand: git -C /repo push origin feat → classified as gitPush (allow when configured)", () => {
+	const result = classifyGuardedCommand("git -C /repo push origin feat", {
+		autonomousMode: true,
+		guardedCommands: { gitPush: "allow" },
+	});
+	assert.equal(result, "allow");
+});
+
+test("classifyGuardedCommand: git -C /repo push origin feat → confirm when autonomousMode=false", () => {
+	const result = classifyGuardedCommand("git -C /repo push origin feat", {
+		autonomousMode: false,
+		guardedCommands: {},
+	});
+	assert.equal(result, "confirm");
+});
+
+// ---------------------------------------------------------------------------
+// Fix 2: rm -rf $HOME was not blocked (dead regex branch)
+// ---------------------------------------------------------------------------
+
+test("classifyGuardedCommand: rm -rf $HOME → block", () => {
+	const result = classifyGuardedCommand("rm -rf $HOME", {
+		autonomousMode: true,
+		guardedCommands: {},
+	});
+	assert.equal(result, "block");
+});
+
+test("classifyGuardedCommand: rm -rf $HOME/foo → block", () => {
+	const result = classifyGuardedCommand("rm -rf $HOME/foo", {
+		autonomousMode: true,
+		guardedCommands: {},
+	});
+	assert.equal(result, "block");
+});
+
+// ---------------------------------------------------------------------------
+// Fix 5a: gitBranchDeleteForce allow path is tested
+// ---------------------------------------------------------------------------
+
+test("classifyGuardedCommand: gitBranchDeleteForce=allow in autonomous mode → allow", () => {
+	const result = classifyGuardedCommand("git branch -D old-feature", {
+		autonomousMode: true,
+		guardedCommands: { gitBranchDeleteForce: "allow" },
+	});
+	assert.equal(result, "allow");
+});
+
+// ---------------------------------------------------------------------------
+// Fix 5b: AUTONOMOUS_DEFAULT_ACTIONS fallback — empty guardedCommands in autonomous mode
+// ---------------------------------------------------------------------------
+
+test("classifyGuardedCommand: autonomousMode=true, empty guardedCommands, gitPush defaults to allow", () => {
+	const result = classifyGuardedCommand("git push origin main", {
+		autonomousMode: true,
+		guardedCommands: {},
+	});
+	assert.equal(result, "allow");
+});
+
+// ---------------------------------------------------------------------------
+// Fix 5c: env var negatives — only "1" activates autonomous mode
+// ---------------------------------------------------------------------------
+
+test("loadRuntimeGuardrailsConfig: GENTLE_PI_AUTONOMOUS_MODE=0 does NOT activate autonomous mode", () => {
+	const original = process.env.GENTLE_PI_AUTONOMOUS_MODE;
+	process.env.GENTLE_PI_AUTONOMOUS_MODE = "0";
+	const dir = makeTmpDir();
+	try {
+		const config = __testing.loadRuntimeGuardrailsConfig(dir, {
+			gentlePiConfigHome: join(dir, "global-config"),
+		});
+		assert.equal(config.autonomousMode, false);
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+		if (original === undefined) delete process.env.GENTLE_PI_AUTONOMOUS_MODE;
+		else process.env.GENTLE_PI_AUTONOMOUS_MODE = original;
+	}
+});
+
+test("loadRuntimeGuardrailsConfig: GENTLE_PI_AUTONOMOUS_MODE=true does NOT activate autonomous mode", () => {
+	const original = process.env.GENTLE_PI_AUTONOMOUS_MODE;
+	process.env.GENTLE_PI_AUTONOMOUS_MODE = "true";
+	const dir = makeTmpDir();
+	try {
+		const config = __testing.loadRuntimeGuardrailsConfig(dir, {
+			gentlePiConfigHome: join(dir, "global-config"),
+		});
+		assert.equal(config.autonomousMode, false);
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+		if (original === undefined) delete process.env.GENTLE_PI_AUTONOMOUS_MODE;
+		else process.env.GENTLE_PI_AUTONOMOUS_MODE = original;
+	}
+});
+
+test("loadRuntimeGuardrailsConfig: GENTLE_PI_AUTONOMOUS_MODE='' does NOT activate autonomous mode", () => {
+	const original = process.env.GENTLE_PI_AUTONOMOUS_MODE;
+	process.env.GENTLE_PI_AUTONOMOUS_MODE = "";
+	const dir = makeTmpDir();
+	try {
+		const config = __testing.loadRuntimeGuardrailsConfig(dir, {
+			gentlePiConfigHome: join(dir, "global-config"),
+		});
+		assert.equal(config.autonomousMode, false);
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+		if (original === undefined) delete process.env.GENTLE_PI_AUTONOMOUS_MODE;
+		else process.env.GENTLE_PI_AUTONOMOUS_MODE = original;
+	}
+});
+
+// ---------------------------------------------------------------------------
+// Fix 5d: JSON config autonomousMode strict === true check
+// ---------------------------------------------------------------------------
+
+test("loadRuntimeGuardrailsConfig: autonomousMode:1 (number) in JSON does NOT activate autonomous mode", () => {
+	const dir = makeTmpDir();
+	try {
+		const globalConfigDir = join(dir, "global-config");
+		writeConfig(globalConfigDir, "runtime-guardrails.json", {
+			autonomousMode: 1,
+			guardedCommands: {},
+		});
+		const config = __testing.loadRuntimeGuardrailsConfig(join(dir, "project"), {
+			gentlePiConfigHome: globalConfigDir,
+		});
+		assert.equal(config.autonomousMode, false);
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});
+
+test('loadRuntimeGuardrailsConfig: autonomousMode:"true" (string) in JSON does NOT activate autonomous mode', () => {
+	const dir = makeTmpDir();
+	try {
+		const globalConfigDir = join(dir, "global-config");
+		writeConfig(globalConfigDir, "runtime-guardrails.json", {
+			autonomousMode: "true",
+			guardedCommands: {},
+		});
+		const config = __testing.loadRuntimeGuardrailsConfig(join(dir, "project"), {
+			gentlePiConfigHome: globalConfigDir,
+		});
+		assert.equal(config.autonomousMode, false);
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});
+
+test("loadRuntimeGuardrailsConfig: autonomousMode:{} (object) in JSON does NOT activate autonomous mode", () => {
+	const dir = makeTmpDir();
+	try {
+		const globalConfigDir = join(dir, "global-config");
+		writeConfig(globalConfigDir, "runtime-guardrails.json", {
+			autonomousMode: {},
+			guardedCommands: {},
+		});
+		const config = __testing.loadRuntimeGuardrailsConfig(join(dir, "project"), {
+			gentlePiConfigHome: globalConfigDir,
+		});
+		assert.equal(config.autonomousMode, false);
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});

package/tests/persona-neutral-voseo.test.ts

@@ -0,0 +1,119 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { __testing } from "../extensions/gentle-ai.ts";
+
+// These tests assert that the composed main-agent prompt (built by buildGentlePrompt)
+// does not encourage Rioplatense voseo in neutral mode, and does include the expected
+// voseo/Rioplatense markers in gentleman mode.
+
+test("neutral mode composed prompt does not instruct to use voseo", () => {
+	const prompt = __testing.buildGentlePrompt("neutral");
+	// The neutral prompt must never tell the model to USE voseo
+	assert.doesNotMatch(
+		prompt,
+		/answer in natural Rioplatense Spanish with voseo/i,
+		"neutral prompt must not instruct to use Rioplatense voseo",
+	);
+	assert.doesNotMatch(
+		prompt,
+		/uses natural Rioplatense voseo/i,
+		"neutral prompt must not describe voseo as the language mode to use",
+	);
+});
+
+test("neutral mode composed prompt has no positive voseo/Rioplatense instruction and includes explicit prohibition", () => {
+	const prompt = __testing.buildGentlePrompt("neutral");
+	// Any sentence that affirmatively tells the model to use voseo or natural Rioplatense
+	// must be absent. The prohibition line ("Do NOT use voseo") is the only allowed voseo
+	// mention. We match patterns that indicate a positive directive by requiring the word
+	// "use" (or its inflections) in proximity to "voseo" or "Rioplatense" WITHOUT a
+	// preceding negation — concretely, lines that start/contain "use", "uses", or "with voseo".
+	assert.doesNotMatch(
+		prompt,
+		/\bwith voseo\b/i,
+		"neutral prompt must not contain 'with voseo' (positive directive)",
+	);
+	assert.doesNotMatch(
+		prompt,
+		/\buse(?:s)? (?:natural )?Rioplatense\b/i,
+		"neutral prompt must not instruct to use Rioplatense",
+	);
+	// The prohibition line must remain present so the model knows NOT to use voseo
+	assert.match(
+		prompt,
+		/Do NOT use voseo/i,
+		"neutral prompt must explicitly prohibit voseo",
+	);
+});
+
+test("gentleman mode composed prompt contains voseo reference", () => {
+	const prompt = __testing.buildGentlePrompt("gentleman");
+	assert.match(
+		prompt,
+		/voseo/i,
+		"gentleman prompt must reference voseo",
+	);
+});
+
+test("gentleman mode composed prompt contains Rioplatense reference", () => {
+	const prompt = __testing.buildGentlePrompt("gentleman");
+	assert.match(
+		prompt,
+		/Rioplatense/i,
+		"gentleman prompt must reference Rioplatense",
+	);
+});
+
+test("neutral mode composed prompt explicitly states active mode is neutral", () => {
+	const prompt = __testing.buildGentlePrompt("neutral");
+	assert.match(
+		prompt,
+		/Current persona mode: neutral/i,
+		"neutral prompt must state active mode is neutral",
+	);
+});
+
+test("gentleman mode composed prompt explicitly states active mode is gentleman", () => {
+	const prompt = __testing.buildGentlePrompt("gentleman");
+	assert.match(
+		prompt,
+		/Current persona mode: gentleman/i,
+		"gentleman prompt must state active mode is gentleman",
+	);
+});
+
+test("neutral mode composed prompt explicitly forbids voseo conjugations", () => {
+	const prompt = __testing.buildGentlePrompt("neutral");
+	// The neutral persona prompt must explicitly forbid voseo conjugation forms
+	assert.match(
+		prompt,
+		/Do NOT use voseo/i,
+		"neutral prompt must explicitly forbid voseo",
+	);
+});
+
+test("neutral and gentleman modes produce different language-boundary text", () => {
+	const neutralPrompt = __testing.buildGentlePrompt("neutral");
+	const gentlemanPrompt = __testing.buildGentlePrompt("gentleman");
+
+	// The language-boundary section must differ between modes
+	assert.notEqual(
+		neutralPrompt,
+		gentlemanPrompt,
+		"neutral and gentleman prompts must differ",
+	);
+
+	// Neutral must not include a positive instruction to use Rioplatense
+	assert.doesNotMatch(
+		neutralPrompt,
+		/Language: natural Rioplatense/i,
+		"neutral prompt must not contain positive 'natural Rioplatense' language instruction",
+	);
+
+	// Gentleman must contain the Rioplatense instruction
+	assert.match(
+		gentlemanPrompt,
+		/Language: natural Rioplatense/i,
+		"gentleman prompt must contain 'Language: natural Rioplatense' instruction",
+	);
+});