gentle-pi 2.0.0 → 2.1.0

package/tests/review-controller-native-routing.test.ts

@@ -40,9 +40,14 @@ type ToolCallHandler = (
 	ctx: ExtensionContext,
 ) => Promise<unknown>;
 
+interface RegisteredCommandFixture {
+	handler: (args: string, ctx: ExtensionContext) => Promise<void>;
+}
+
 interface Runtime {
 	controller: RegisteredTool;
 	toolCall: ToolCallHandler;
+	commands: Map<string, RegisteredCommandFixture>;
 }
 
 interface PublicationProbeRequestFixture {
@@ -74,6 +79,7 @@ function runtime(
 	candidateViews: CandidateViewRegistry | null = null,
 ): Runtime {
 	const tools = new Map<string, RegisteredTool>();
+	const commands = new Map<string, RegisteredCommandFixture>();
 	let toolCall: ToolCallHandler | undefined;
 	const dependencies = { nativeReviewCli, publicationProbe, publicationProbeTimeoutMs, bashTimeRevalidationTimeoutMs, candidateViews } as unknown as Parameters<typeof createGentleAiExtension>[0];
 	createGentleAiExtension(dependencies)({
@@ -81,12 +87,12 @@ function runtime(
 		if (name === "tool_call") toolCall = handler;
 	},
 		registerTool(definition: RegisteredTool & { name: string }) { tools.set(definition.name, definition); },
-		registerCommand() {},
+		registerCommand(name: string, definition: RegisteredCommandFixture) { commands.set(name, definition); },
 	} as unknown as ExtensionAPI);
 	const controller = tools.get("gentle_review");
 	assert.ok(controller);
 	assert.ok(toolCall);
-	return { controller, toolCall };
+	return { controller, toolCall, commands };
 }
 
 function context(cwd: string, signal?: AbortSignal): ExtensionContext {
@@ -287,6 +293,7 @@ function targetStatusFixture(options: {
 	baseTree?: string;
 	currentCandidateTree?: string;
 	paths?: readonly string[];
+	projection?: "workspace" | "staged";
 } = {}): ReviewStatusV3 {
 	const applicability = options.applicability ?? "current_target";
 	const action = options.action ?? (applicability === "current_target" ? "finalize" : applicability === "unrelated" ? "start" : applicability === "ambiguous" ? "select_lineage" : "repair_authority");
@@ -302,7 +309,7 @@ function targetStatusFixture(options: {
 	const projection = {
 		schema: "gentle-ai.review-integration.projection/v1" as const,
 		kind: "current-changes" as const,
-		projection: "workspace" as const,
+		projection: options.projection ?? "workspace",
 		baseTree,
 		initialReviewTree: tree,
 		currentCandidateTree: tree,
@@ -1896,7 +1903,181 @@ test("native allow registers one authorization and bash-time revalidation consum
 	assert.equal(await toolCall({ toolName: "bash", input: { command } }, interactiveContext(cwd)), undefined);
 	const replay = await toolCall({ toolName: "bash", input: { command } }, context(cwd)) as { block: boolean };
 	assert.equal(replay.block, true);
-	assert.equal(validates, 2);
+	assert.equal(validates, 3, "the replay discovers but cannot remint the consumed binding");
+});
+
+test("fresh pre-commit consumes an exact approved native receipt without START or projection restoration", async (t) => {
+	const cwd = repository(t);
+	writeFileSync(join(cwd, "app.ts"), "export const value = 2;\n");
+	git(cwd, "add", "--", "app.ts");
+	const tree = git(cwd, "write-tree");
+	let starts = 0;
+	const requests: Parameters<NativeReviewCli["validate"]>[0][] = [];
+	const { toolCall } = runtime(fakeNative({
+		start: async () => {
+			starts += 1;
+			throw new Error("an approved exact candidate must not start another review");
+		},
+		validate: async (request) => {
+			requests.push(request);
+			return { allowed: true, result: "allow", action: "continue", reason: "approved receipt binds the index", gateContext: nativeGateContext("approved-lineage", "r1", tree) };
+		},
+		targetStatus: async () => { throw new Error("approved receipt consumption must not reconstruct an unrelated projection"); },
+	}), undefined, undefined, undefined, new CandidateViewRegistry());
+	const command = "git commit -m approved";
+	const input = { command };
+
+	assert.equal(await toolCall({ toolName: "bash", input }, context(cwd)), undefined);
+	assert.equal(starts, 0);
+	assert.equal(requests.length, 2, "authorization and bash-time TOCTOU validation must both run");
+	assert.equal(requests[0]?.lineageId, undefined, "fresh receipt discovery is candidate-bound, not caller-selected");
+	assert.equal(requests[1]?.lineageId, "approved-lineage");
+	assert.notEqual(input.command, command, "the approved pre-commit must use the durable commit transaction");
+});
+
+test("a consumed native receipt binding cannot remint authorization for the same exact command", async (t) => {
+	const cwd = repository(t);
+	writeFileSync(join(cwd, "app.ts"), "export const value = 2;\n");
+	git(cwd, "add", "--", "app.ts");
+	const tree = git(cwd, "write-tree");
+	let validations = 0;
+	const { toolCall } = runtime(fakeNative({
+		validate: async () => {
+			validations += 1;
+			return { allowed: true, result: "allow", action: "continue", reason: "same approved receipt", gateContext: nativeGateContext("same-lineage", "same-revision", tree) };
+		},
+	}));
+	const command = "git commit -m same-binding";
+
+	assert.equal(await toolCall({ toolName: "bash", input: { command } }, context(cwd)), undefined);
+	const replayInput = { command };
+	const replay = await toolCall({ toolName: "bash", input: replayInput }, context(cwd)) as { block: boolean };
+	assert.equal(replay.block, true);
+	assert.equal(replayInput.command, command);
+	assert.equal(validations, 3, "the replay may discover the binding once but must not revalidate or authorize it");
+});
+
+test("a new approved candidate binding may authorize the same command and cwd later in the session", async (t) => {
+	const cwd = repository(t);
+	const command = "git commit -m reusable-command";
+	const requests: Parameters<NativeReviewCli["validate"]>[0][] = [];
+	const { toolCall } = runtime(fakeNative({
+		validate: async (request) => {
+			requests.push(request);
+			const tree = git(cwd, "write-tree");
+			const suffix = tree.slice(0, 8);
+			return { allowed: true, result: "allow", action: "continue", reason: "candidate-bound receipt", gateContext: nativeGateContext(`lineage-${suffix}`, `revision-${suffix}`, tree) };
+		},
+	}));
+	writeFileSync(join(cwd, "app.ts"), "export const value = 2;\n");
+	git(cwd, "add", "--", "app.ts");
+	const firstInput = { command };
+	assert.equal(await toolCall({ toolName: "bash", input: firstInput }, context(cwd)), undefined);
+	assert.notEqual(firstInput.command, command);
+
+	writeFileSync(join(cwd, "app.ts"), "export const value = 3;\n");
+	git(cwd, "add", "--", "app.ts");
+	const secondInput = { command };
+	assert.equal(await toolCall({ toolName: "bash", input: secondInput }, context(cwd)), undefined);
+	assert.notEqual(secondInput.command, command);
+	assert.equal(requests.length, 4);
+	assert.equal(requests[0]?.lineageId, undefined);
+	assert.equal(requests[1]?.lineageId?.startsWith("lineage-"), true);
+	assert.equal(requests[2]?.lineageId, undefined);
+	assert.equal(requests[3]?.lineageId?.startsWith("lineage-"), true);
+});
+
+test("a denied native discovery does not prevent a later valid receipt for the same command", async (t) => {
+	const cwd = repository(t);
+	writeFileSync(join(cwd, "app.ts"), "export const value = 2;\n");
+	git(cwd, "add", "--", "app.ts");
+	const tree = git(cwd, "write-tree");
+	let validations = 0;
+	const { toolCall } = runtime(fakeNative({
+		validate: async () => {
+			validations += 1;
+			return validations === 1
+				? { allowed: false, result: "scope-changed", action: "create-new-lineage", reason: "not approved yet", gateContext: nativeGateContext("", "denied", tree) }
+				: { allowed: true, result: "allow", action: "continue", reason: "now approved", gateContext: nativeGateContext("later-lineage", "later-revision", tree) };
+		},
+	}));
+	const command = "git commit -m later-approved";
+
+	assert.equal((await toolCall({ toolName: "bash", input: { command } }, context(cwd)) as { block: boolean }).block, true);
+	const approvedInput = { command };
+	assert.equal(await toolCall({ toolName: "bash", input: approvedInput }, context(cwd)), undefined);
+	assert.notEqual(approvedInput.command, command);
+	assert.equal(validations, 3);
+});
+
+test("a blocked bash-time native gate does not consume its receipt binding", async (t) => {
+	const cwd = repository(t);
+	writeFileSync(join(cwd, "app.ts"), "export const value = 2;\n");
+	git(cwd, "add", "--", "app.ts");
+	const tree = git(cwd, "write-tree");
+	let validations = 0;
+	const { toolCall } = runtime(fakeNative({
+		validate: async () => {
+			validations += 1;
+			if (validations === 2) return { allowed: false, result: "invalidated", action: "explicit-maintainer-action", reason: "transient authority block", gateContext: nativeGateContext("retry-lineage", "retry-revision", tree) };
+			return { allowed: true, result: "allow", action: "continue", reason: "approved", gateContext: nativeGateContext("retry-lineage", "retry-revision", tree) };
+		},
+	}));
+	const command = "git commit -m retry-binding";
+
+	assert.equal((await toolCall({ toolName: "bash", input: { command } }, context(cwd)) as { block: boolean }).block, true);
+	const retryInput = { command };
+	assert.equal(await toolCall({ toolName: "bash", input: retryInput }, context(cwd)), undefined);
+	assert.notEqual(retryInput.command, command);
+	assert.equal(validations, 4);
+});
+
+test("fresh pre-commit rejects an approved receipt for a different index tree", async (t) => {
+	const cwd = repository(t);
+	writeFileSync(join(cwd, "app.ts"), "export const value = 2;\n");
+	git(cwd, "add", "--", "app.ts");
+	let validations = 0;
+	const { toolCall } = runtime(fakeNative({
+		validate: async () => {
+			validations += 1;
+			return { allowed: true, result: "allow", action: "continue", reason: "stale receipt", gateContext: nativeGateContext("stale-lineage", "r1", "f".repeat(40)) };
+		},
+	}));
+	const command = "git commit -m stale";
+	const input = { command };
+
+	const result = await toolCall({ toolName: "bash", input }, context(cwd)) as { block: boolean; reason: string };
+	assert.equal(result.block, true);
+	assert.match(result.reason, /does not bind the exact current pre-commit tree/);
+	assert.equal(validations, 1);
+	assert.equal(input.command, command);
+});
+
+test("fresh pre-commit honors native disabled/unmanaged delivery without restoring stale authority", async (t) => {
+	const cwd = repository(t);
+	writeFileSync(join(cwd, "app.ts"), "export const value = 2;\n");
+	git(cwd, "add", "--", "app.ts");
+	let validations = 0;
+	const { toolCall } = runtime(fakeNative({
+		validate: async () => {
+			validations += 1;
+			return {
+				allowed: false,
+				result: "invalidated",
+				action: "repository-policy",
+				reason: "receipt-driven development is disabled",
+				gateContext: nativeGateContext("", "r1", git(cwd, "write-tree")),
+				delivery: "disabled/unmanaged",
+			};
+		},
+		targetStatus: async () => { throw new Error("disabled delivery must not restore stale authority"); },
+	}));
+	const command = "git commit -m unmanaged";
+	const input = { command };
+
+	assert.equal(await toolCall({ toolName: "bash", input }, context(cwd)), undefined);
+	assert.equal(validations, 1);
+	assert.equal(input.command, command, "unmanaged delivery must remain an ordinary repository command");
 });
 
 test("native VALIDATE delivery disabled/unmanaged renders as a successful skipped envelope before the maintainer-exception check, minting no authorization", async (t) => {
@@ -1965,7 +2146,7 @@ test("native pre-commit after reload delegates exact-tree validation when no loc
 			validations += 1;
 			return { allowed: true, result: "allow", action: "continue", reason: "native receipt matches", gateContext: nativeGateContext("reloaded-lineage", "r1", git(cwd, "write-tree")) };
 		},
-		targetStatus: async () => targetStatusFixture({ lineageId: "reloaded-lineage", baseTree: git(cwd, "rev-parse", "HEAD^{tree}"), currentCandidateTree: git(cwd, "write-tree"), paths: ["app.ts"] }),
+		targetStatus: async () => targetStatusFixture({ lineageId: "reloaded-lineage", baseTree: git(cwd, "rev-parse", "HEAD^{tree}"), currentCandidateTree: git(cwd, "write-tree"), paths: ["app.ts"], projection: "staged" }),
 	}), undefined, undefined, undefined, new CandidateViewRegistry());
 	const validated = await controller.execute("reload-pre-commit", { operation: "validate", lineageId: "reloaded-lineage", idempotencyKey: "reload", command: "git commit -m reload", input: "{}" }, undefined, undefined, context(cwd));
 	assert.equal(validations, 1);
@@ -3236,7 +3417,7 @@ test("native deny, target drift, and bash-time errors never restore an authoriza
 	await drifting.controller.execute("allow", { operation: "validate", lineageId: "native-lineage", idempotencyKey: "key", command, input: "{}" }, undefined, undefined, context(cwd));
 	assert.equal((await drifting.toolCall({ toolName: "bash", input: { command } }, context(cwd)) as { block: boolean }).block, true);
 	assert.equal((await drifting.toolCall({ toolName: "bash", input: { command } }, context(cwd)) as { block: boolean }).block, true);
-	assert.equal(calls, 2);
+	assert.equal(calls, 3, "a blocked gate is not consumed, so the retry performs one fresh fail-closed discovery");
 
 	const failing = runtime(fakeNative({
 		validate: async () => { throw new Error("native connection lost"); },
@@ -3877,3 +4058,63 @@ test("RECOVER rechecks a committed range against its frozen base instead of the
 	assert.equal(recovers.length, 1);
 	candidateViews.cleanupTerminal("native-lineage", "approved");
 });
+
+test("dangerous push confirmation precedes mode reconsult outside a repository", async (t) => {
+	const cwd = mkdtempSync(join(tmpdir(), "gentle-pi-non-repository-push-"));
+	t.after(() => rmSync(cwd, { recursive: true, force: true }));
+	let modeCalls = 0;
+	const { toolCall } = runtime(fakeNative({
+		reviewMode: async () => {
+			modeCalls += 1;
+			throw new Error("mode lookup must not precede dangerous-command confirmation");
+		},
+	}));
+	const interactive = interactiveContext(cwd);
+	const deniedContext = { ...interactive, ui: { ...interactive.ui, confirm: async () => false } };
+	const result = await toolCall(
+		{ toolName: "bash", input: { command: "git push" } },
+		deniedContext,
+	) as { block: boolean; reason: string };
+	assert.equal(result.block, true);
+	assert.match(result.reason, /not confirmed/);
+	assert.equal(modeCalls, 0);
+});
+
+test("out-of-band review-mode disable discards stale lifecycle authorization and proceeds organically", async (t) => {
+	const cwd = repository(t);
+	let effective: "on" | "off" = "on";
+	let validations = 0;
+	const command = "git commit -m native";
+	const { controller, toolCall } = runtime(fakeNative({
+		reviewMode: async () => ({ operation: "status", scope: "both", status: { global: effective, cloneLocal: "", effective, source: effective === "off" ? "global" : "default" } }),
+		validate: async () => { validations += 1; return { allowed: true, result: "allow", action: "continue", reason: "ok", gateContext: nativeGateContext() }; },
+		targetStatus: async () => targetStatusFixture({ lineageId: "native-lineage", baseTree: git(cwd, "rev-parse", "HEAD^{tree}"), currentCandidateTree: git(cwd, "write-tree"), paths: [] }),
+	}));
+	const authorized = await controller.execute("authorize-before-disable", { operation: "validate", lineageId: "native-lineage", idempotencyKey: "disable-race", command, input: "{}" }, undefined, undefined, context(cwd));
+	assert.notEqual((authorized.details as Record<string, unknown>).authorization, undefined);
+	effective = "off";
+	assert.equal(await toolCall({ toolName: "bash", input: { command } }, context(cwd)), undefined);
+	assert.equal(validations, 1, "disabled organic delivery must not reuse or revalidate stale review authority");
+});
+
+test("successful /gentle:review-mode disable clears pending authorizations even after mode is re-enabled", async (t) => {
+	const cwd = repository(t);
+	let effective: "on" | "off" = "on";
+	const command = "git commit -m native";
+	const { controller, toolCall, commands } = runtime(fakeNative({
+		reviewMode: async (request) => {
+			if (request.operation === "disable") effective = "off";
+			if (request.operation === "enable") effective = "on";
+			return { operation: request.operation, scope: "clone", status: { global: "", cloneLocal: effective === "off" ? "off" : "", effective, source: effective === "off" ? "clone_local" : "default" } };
+		},
+		validate: async () => ({ allowed: true, result: "allow", action: "continue", reason: "ok", gateContext: nativeGateContext() }),
+		targetStatus: async () => targetStatusFixture({ lineageId: "native-lineage", baseTree: git(cwd, "rev-parse", "HEAD^{tree}"), currentCandidateTree: git(cwd, "write-tree"), paths: [] }),
+	}));
+	await controller.execute("authorize-before-command-disable", { operation: "validate", lineageId: "native-lineage", idempotencyKey: "command-disable", command, input: "{}" }, undefined, undefined, context(cwd));
+	const commandContext = { ...interactiveContext(cwd), ui: { confirm: async () => true, notify: () => {} } } as unknown as ExtensionContext;
+	await commands.get("gentle:review-mode")!.handler("disable", commandContext);
+	await commands.get("gentle:review-mode")!.handler("enable", commandContext);
+	const result = await toolCall({ toolName: "bash", input: { command } }, context(cwd)) as { block: boolean; reason: string };
+	assert.equal(result.block, true);
+	assert.match(result.reason, /receipt consumption failed closed/, "re-enabled delivery must perform fresh receipt discovery rather than reuse the pre-disable authorization");
+});

package/tests/review-controller.test.ts

@@ -482,7 +482,7 @@ test("shipped controller and orchestrator contracts specify inspect-first compac
 	assert.match(toolContract, /RESET.*reclaim.*RECOVER.*recover/s);
 	assert.match(toolContract, /native-input-required.*never.*invent/is);
 	assert.match(toolContract, /output.*lost|response.*lost|ambiguous.*START/is);
-	assert.match(toolContract, /ambiguous START or FINALIZE.*target-scoped native status.*declared action/is);
+	assert.match(toolContract, /ambiguous START, answer-consent, or FINALIZE.*target-scoped native status.*declared action/is);
 	assert.doesNotMatch(toolContract, /START throws.*lineage does not exist/is);
 
 	for (const path of ["assets/orchestrator-delegation.md", "skills/gentle-ai/SKILL.md"]) {

package/tests/review-integration-v2.test.ts

@@ -387,15 +387,24 @@ test("failure context accepts scope_change or binding_revision but rejects both
 	assert.throws(() => decodeReviewFailureV2(both), /exactly one|not allowed/);
 });
 
-test("consent rejects a swapped choice order and an invocation missing the exact answer suffix", () => {
+test("consent rejects a swapped choice order, invalid answer domain, or invocation outside the frozen target", () => {
 	const source = fixture<JsonObject>("consent.fixture.json");
 	const swapped = clone(source);
 	swapped.choices = [(source.choices as JsonObject[])[1], (source.choices as JsonObject[])[0]];
 	assert.throws(() => decodeReviewConsentV2(swapped), /answer/);
 
+	const badAnswer = clone(source);
+	(badAnswer.choices as JsonObject[])[0].answer = "yes";
+	assert.throws(() => decodeReviewConsentV2(badAnswer), /answer/);
+
 	const badInvocation = clone(source);
 	(badInvocation.choices as JsonObject[])[0].invocation = "gentle-ai review start --contract gentle-ai.review-integration/v1 --consent granted";
 	assert.throws(() => decodeReviewConsentV2(badInvocation), /invocation/);
+
+	const differentTarget = clone(source);
+	(differentTarget.choices as JsonObject[])[0].invocation = String((differentTarget.choices as JsonObject[])[0].invocation)
+		.replace(String(differentTarget.target_identity), `sha256:${"b".repeat(64)}`);
+	assert.throws(() => decodeReviewConsentV2(differentTarget), /target|invocation/);
 });
 
 test("next_transition decodes an execute variant and rejects a stop that carries a transition", () => {

package/tests/runtime-harness.mjs

@@ -364,13 +364,19 @@ async function run() {
 	const toolCwd = await tempWorkspace();
 	try {
 		const toolHook = hooks.get("tool_call")[0];
+		const ghPrCwd = await tempWorkspace();
+		try {
+			execFileSync("git", ["init"], { cwd: ghPrCwd, stdio: "ignore" });
+			const receiptGate = await toolHook(
+				{ toolName: "bash", input: { command: "gh pr create --draft" } },
+				createCtx(ghPrCwd, true, "receipt-gate-session"),
+			);
+			assert.equal(receiptGate.block, true);
+			assert.match(receiptGate.reason, /exactly derive.*--base/i);
+		} finally {
+			await rm(ghPrCwd, { recursive: true, force: true });
+		}
 		assert.equal(await toolHook({ toolName: "bash", input: { command: "git status" } }, createCtx(toolCwd)), undefined);
-		const receiptGate = await toolHook(
-			{ toolName: "bash", input: { command: "gh pr create --draft" } },
-			createCtx(toolCwd, true, "receipt-gate-session"),
-		);
-		assert.equal(receiptGate.block, true);
-		assert.match(receiptGate.reason, /exactly derive.*--base/i);
 		const denied = await toolHook({ toolName: "bash", input: { command: "rm -rf /" } }, createCtx(toolCwd));
 		assert.equal(denied.block, true);
 		assert.match(denied.reason, /destructive/);
@@ -399,12 +405,18 @@ async function run() {
 			0,
 			"receipt validation must not launch or announce review actors",
 		);
-		const commitGate = await toolHook(
-			{ toolName: "bash", input: { command: "git commit -m bounded" } },
-			createCtx(toolCwd),
-		);
-		assert.equal(commitGate.block, true);
-		assert.match(commitGate.reason, /exactly derive/i);
+		const commitCwd = await tempWorkspace();
+		try {
+			execFileSync("git", ["init"], { cwd: commitCwd, stdio: "ignore" });
+			const commitGate = await toolHook(
+				{ toolName: "bash", input: { command: "git commit -m bounded tracked.txt" } },
+				createCtx(commitCwd),
+			);
+			assert.equal(commitGate.block, true);
+			assert.match(commitGate.reason, /exactly derive/i);
+		} finally {
+			await rm(commitCwd, { recursive: true, force: true });
+		}
 	} finally {
 		await rm(toolCwd, { recursive: true, force: true });
 	}