gentle-pi 2.1.0 → 2.1.2

package/extensions/gentle-ai.ts

@@ -104,7 +104,9 @@ import {
 	nativeReviewLegacyAliasRepairAuthorization,
 	nativeReviewLegacyQuarantineAuthorization,
 	nativeReviewReconcileAuthorization,
+	normalizeNativeReviewCwd,
 	NativeReviewCliError,
+	NativeReviewConsentBindingError,
 	NativeReviewConsentRequiredError,
 	NATIVE_REVIEW_ERROR_CODE,
 	NATIVE_REVIEW_LEGACY_QUARANTINE,
@@ -2872,7 +2874,7 @@ export function resolveReviewLifecycleCommand(
 	}
 	if (words[0] !== "git") return null;
 	const gitGlobalArgs: string[] = [];
-	let resolvedCwd = resolve(defaultCwd);
+	let resolvedCwd = resolve(normalizeNativeReviewCwd(defaultCwd));
 	let index = 1;
 	while (index < words.length) {
 		const option = words[index];
@@ -2880,7 +2882,7 @@ export function resolveReviewLifecycleCommand(
 			const value = words[index + 1];
 			if (value === undefined) return null;
 			gitGlobalArgs.push(option, value);
-			if (option === "-C") resolvedCwd = resolve(resolvedCwd, value);
+			if (option === "-C") resolvedCwd = resolve(resolvedCwd, normalizeNativeReviewCwd(value));
 			else return null;
 			index += 2;
 			continue;
@@ -3917,6 +3919,14 @@ function asNativeReviewCliError(error: unknown): { code: string; diagnostics: Na
 	return diagnostics === undefined || value.code !== diagnostics.error_code ? undefined : { code: value.code, diagnostics };
 }
 
+// Same coexisting-module-instance caveat as asNativeReviewCliError above.
+function asNativeReviewConsentBindingError(error: unknown): { reason: string; message: string } | undefined {
+	if (error instanceof NativeReviewConsentBindingError) return { reason: error.reason, message: error.message };
+	if (!(error instanceof Error) || error.name !== "NativeReviewConsentBindingError") return undefined;
+	const reason = (error as unknown as { reason?: unknown }).reason;
+	return typeof reason !== "string" || reason.length === 0 ? undefined : { reason, message: error.message };
+}
+
 function nativeStatusFailed(operation: ReviewControllerOperation, error: unknown): Record<string, unknown> {
 	const cliError = asNativeReviewCliError(error);
 	if (cliError?.code === NATIVE_REVIEW_ERROR_CODE.VERSION_INCOMPATIBLE) return nativeStatusUnsupported(operation);
@@ -4550,6 +4560,7 @@ const PENDING_REVIEW_CONSENT_TTL_MS = 10 * 60 * 1000;
 interface PendingReviewConsent {
 	id: string;
 	repositoryCwd: string;
+	authorityCwd: string;
 	candidateView: CandidateView;
 	consent: ReviewConsentV2;
 	consentDigest: string;
@@ -4576,6 +4587,19 @@ function reviewConsentDigest(consent: ReviewConsentV2): string {
 	return createHash("sha256").update(JSON.stringify(consent)).digest("hex");
 }
 
+function assertNativeStartCandidateBinding(candidateView: CandidateView, target: ReviewStatusV3): void {
+	candidateView.verify();
+	if (
+		target.projection.projection !== "workspace" ||
+		target.projection.baseTree !== candidateView.baseTree ||
+		target.projection.initialReviewTree !== candidateView.candidateTree ||
+		target.projection.currentCandidateTree !== candidateView.candidateTree ||
+		JSON.stringify([...target.projection.paths].sort()) !== JSON.stringify([...candidateView.paths].sort())
+	) {
+		throw new CandidateViewError("native START workspace target does not match the immutable reviewer candidate view", "candidate-target-projection-drift");
+	}
+}
+
 function completeNativeStart(
 	operation: ReviewControllerOperation,
 	result: NativeStartResult,
@@ -4623,6 +4647,23 @@ function nativeOperationFailure(operation: ReviewControllerOperation, error: unk
 			...(typeof value.failureEnvelope.nextAction === "string" ? { next_action: value.failureEnvelope.nextAction } : {}),
 		};
 	}
+	// Every consent binding guard runs before the provider is launched, so this
+	// is a local mismatch with nothing to reconcile. Reporting it as a native
+	// operation failure hides the one fact that makes it fixable.
+	const consentBinding = asNativeReviewConsentBindingError(error);
+	if (consentBinding !== undefined) {
+		return {
+			operation,
+			status: "blocked",
+			outcome: "consent-binding-invalid",
+			native_invocation_attempted: false,
+			lineage_created: false,
+			mutation_performed: false,
+			mutation_outcome: "none" as const,
+			diagnostics: { code: consentBinding.reason, message: consentBinding.message },
+			next_action: "resolve-consent-binding",
+		};
+	}
 	const mutationOutcome = value.mutationOutcome === "unknown" ? "unknown" : "none";
 	const nativeDiagnostics = asNativeReviewCliError(error)?.diagnostics;
 	const diagnostics = operation === REVIEW_CONTROLLER_OPERATION.START && error instanceof CandidateViewError && value.candidateViewPreNative === true
@@ -5078,7 +5119,7 @@ async function executeReviewControllerOperation(
 		consumePendingReviewConsent(pending, pendingReviewConsents);
 		try {
 			const answered = await nativeReviewCli.answerConsent({
-				cwd: pending.candidateView.root,
+				cwd: pending.authorityCwd,
 				consent: pending.consent,
 				answer: input.answer,
 				...(signal === undefined ? {} : { signal }),
@@ -5098,7 +5139,7 @@ async function executeReviewControllerOperation(
 			const value = error as { mutationOutcome?: unknown };
 			if (value.mutationOutcome === "none") candidateViews?.cleanup(pending.candidateView.token);
 			return await reconcileNativeMutationFailure(parameters.operation, error, nativeReviewCli, {
-				cwd: pending.candidateView.root,
+				cwd: pending.authorityCwd,
 				...(pending.candidateView.committedOnly ? { baseRef: pending.candidateView.baseCommit } : {}),
 				projection: "workspace",
 			});
@@ -5137,8 +5178,9 @@ async function executeReviewControllerOperation(
 					return nativeStartRejection("base-ref-unresolvable");
 				}
 			}
+			let target: ReviewStatusV3;
 			try {
-				const target = await nativeReviewCli.targetStatus({
+				target = await nativeReviewCli.targetStatus({
 					cwd: defaultCwd,
 					...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
 					...(canonicalBaseRef === undefined ? {} : { baseRef: canonicalBaseRef }),
@@ -5153,14 +5195,17 @@ async function executeReviewControllerOperation(
 			let nativeStartAttempted = false;
 			try {
 				candidateView = candidateViews?.createOrReuse({ contributorRoot: defaultCwd, replayKey, ...(canonicalBaseRef === undefined ? {} : { baseRef: canonicalBaseRef, committedOnly: true }) });
-				nativeStartAttempted = true;
+				if (candidateView !== undefined) assertNativeStartCandidateBinding(candidateView, target);
 				let result: NativeStartResult;
 				try {
+					nativeStartAttempted = true;
 					result = await nativeReviewCli.start({
-						cwd: candidateView?.root ?? defaultCwd,
+						cwd: defaultCwd,
 						...(canonicalBaseRef === undefined
 							? {}
 							: { baseRef: candidateView?.baseCommit ?? canonicalBaseRef, committedOnly: true }),
+						targetIdentity: target.targetIdentity,
+						projection: target.projection.projection,
 						...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
 						...(policy.policyPath === undefined ? {} : { policyPath: policy.policyPath }),
 						...(signal === undefined ? {} : { signal }),
@@ -5175,7 +5220,7 @@ async function executeReviewControllerOperation(
 					if (existing === undefined) for (const pending of [...pendingReviewConsents.values()]) if (pending.candidateView.token === consentCandidateView.token) consumePendingReviewConsent(pending, pendingReviewConsents);
 					const id = existing?.id ?? randomUUID();
 					if (existing === undefined) {
-						const pending: PendingReviewConsent = { id, repositoryCwd, candidateView: consentCandidateView, consent: error.consent, consentDigest, expiresAt: Date.now() + PENDING_REVIEW_CONSENT_TTL_MS };
+						const pending: PendingReviewConsent = { id, repositoryCwd, authorityCwd: defaultCwd, candidateView: consentCandidateView, consent: error.consent, consentDigest, expiresAt: Date.now() + PENDING_REVIEW_CONSENT_TTL_MS };
 						pendingReviewConsents.set(id, pending);
 						pending.expiry = setTimeout(() => cleanupPendingReviewConsent(pending, pendingReviewConsents, candidateViews), PENDING_REVIEW_CONSENT_TTL_MS);
 						pending.expiry.unref();
@@ -5205,7 +5250,7 @@ async function executeReviewControllerOperation(
 							nextAction: "review.status",
 						});
 				return reconcileNativeMutationFailure(parameters.operation, failure, nativeReviewCli, {
-					cwd: candidateView?.root ?? defaultCwd,
+					cwd: defaultCwd,
 					...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
 					...(canonicalBaseRef === undefined ? {} : { baseRef: candidateView?.baseCommit ?? canonicalBaseRef }),
 					projection: "workspace",

package/lib/native-review-cli.ts

@@ -371,7 +371,7 @@ export interface NativeReviewVerificationEvidenceV2 {
 	recordDigest: string;
 }
 
-export interface NativeStartRequest { cwd: string; baseRef?: string; committedOnly?: boolean; lineageId?: string; policyPath?: string; focus?: string; projection?: "workspace" | "staged"; signal?: AbortSignal; }
+export interface NativeStartRequest { cwd: string; baseRef?: string; committedOnly?: boolean; lineageId?: string; policyPath?: string; focus?: string; targetIdentity?: string; projection?: "workspace" | "staged"; signal?: AbortSignal; }
 export const NATIVE_REVIEW_CONSENT_ANSWER = { GRANTED: "granted", DECLINED: "declined" } as const;
 export type NativeReviewConsentAnswer = (typeof NATIVE_REVIEW_CONSENT_ANSWER)[keyof typeof NATIVE_REVIEW_CONSENT_ANSWER];
 export interface NativeReviewConsentAnswerRequest { cwd: string; consent: ReviewConsentV2; answer: NativeReviewConsentAnswer; signal?: AbortSignal; }
@@ -480,6 +480,7 @@ export interface NativeReviewAuthorityEntry {
 	status: NativeReviewAuthorityEntryStatus;
 	state?: string;
 	revision?: string;
+	snapshotIdentity?: string;
 	chainIdentity?: string;
 	recovery?: NativeReviewRecovery;
 	problems: readonly string[];
@@ -748,6 +749,7 @@ function exactObject(value: unknown, required: readonly string[], optional: read
 }
 function requiredString(value: unknown): string { if (typeof value !== "string" || value.length === 0) throw new Error("expected string"); return value; }
 function stringValue(value: unknown): string { if (typeof value !== "string") throw new Error("expected string"); return value; }
+function sha256Identity(value: unknown): string { const parsed = requiredString(value); if (!/^sha256:[0-9a-f]{64}$/.test(parsed)) throw new Error("expected canonical SHA-256 identity"); return parsed; }
 function booleanValue(value: unknown): boolean { if (typeof value !== "boolean") throw new Error("expected boolean"); return value; }
 function nonNegativeInteger(value: unknown): number { if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error("expected safe non-negative integer"); return value; }
 function positiveInteger(value: unknown): number { if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error("expected safe positive integer"); return value; }
@@ -957,7 +959,7 @@ function decodeNativeReviewRecovery(value: unknown): NativeReviewRecovery {
 	};
 }
 function decodeNativeReviewStatusEntry(value: unknown): NativeReviewAuthorityEntry {
-	const entry = exactObject(value, ["version", "path", "status", "problems"], ["lineage_id", "state", "revision", "chain_identity", "recovery"]);
+	const entry = exactObject(value, ["version", "path", "status", "problems"], ["lineage_id", "state", "revision", "snapshot_identity", "chain_identity", "recovery"]);
 	return {
 		version: enumString(entry.version, Object.values(NATIVE_REVIEW_AUTHORITY_ENTRY_VERSION)) as NativeReviewAuthorityEntryVersion,
 		...(entry.lineage_id === undefined ? {} : { lineageId: requiredString(entry.lineage_id) }),
@@ -965,6 +967,7 @@ function decodeNativeReviewStatusEntry(value: unknown): NativeReviewAuthorityEnt
 		status: enumString(entry.status, Object.values(NATIVE_REVIEW_AUTHORITY_ENTRY_STATUS)) as NativeReviewAuthorityEntryStatus,
 		...(entry.state === undefined ? {} : { state: requiredString(entry.state) }),
 		...(entry.revision === undefined ? {} : { revision: requiredString(entry.revision) }),
+		...(entry.snapshot_identity === undefined ? {} : { snapshotIdentity: sha256Identity(entry.snapshot_identity) }),
 		...(entry.chain_identity === undefined ? {} : { chainIdentity: requiredString(entry.chain_identity) }),
 		...(entry.recovery === undefined ? {} : { recovery: decodeNativeReviewRecovery(entry.recovery) }),
 		problems: stringArray(entry.problems),
@@ -1037,6 +1040,21 @@ function decodeNativeReviewStatus(value: unknown): NativeReviewStatusResult {
 	};
 }
 function isWindowsRepositoryPath(value: string): boolean { return /^[A-Za-z]:[\\/]/.test(value) || /^\\\\/.test(value); }
+export function normalizeNativeReviewCwd(value: string, platform: NodeJS.Platform = process.platform): string {
+	if (platform !== "win32") return value;
+	const gitBashDrive = /^\/([A-Za-z])(?:\/(.*))?$/.exec(value);
+	const windowsPath = gitBashDrive === null
+		? value
+		: `${gitBashDrive[1]!.toUpperCase()}:/${gitBashDrive[2] ?? ""}`;
+	if (!isWindowsRepositoryPath(windowsPath)) return windowsPath;
+	const normalized = win32.normalize(windowsPath);
+	return normalized.replace(/^([a-z]):/, (_match, drive: string) => `${drive.toUpperCase()}:`);
+}
+async function canonicalNativeReviewCwd(value: string): Promise<string> {
+	const normalized = normalizeNativeReviewCwd(value);
+	try { return await realpath(normalized); }
+	catch { return normalized; }
+}
 async function repositoryPathIdentity(value: string): Promise<string> {
 	const windowsPath = isWindowsRepositoryPath(value);
 	try { return `filesystem:${windowsPath ? (await realpath(value)).toLowerCase() : await realpath(value)}`; }
@@ -1360,12 +1378,13 @@ export class NativeReviewCliV214 {
 	// and always pass `--scope clone` so Pi's own kill-switch command surface
 	// never mutates the operator's global gentle-ai state across other clones.
 	async reviewMode(request: NativeReviewModeRequest): Promise<NativeReviewModeResult> {
-		await this.verifyVersion(request.cwd, request.signal, ["mode"]);
+		const cwd = await canonicalNativeReviewCwd(request.cwd);
+		await this.verifyVersion(cwd, request.signal, ["mode"]);
 		const mutating = request.operation !== NATIVE_REVIEW_MODE_OPERATION.STATUS;
 		const { body } = await this.execute(
 			NATIVE_REVIEW_OPERATION.MODE,
-			request.cwd,
-			["review", "mode", request.operation, "--cwd", request.cwd, ...(mutating ? ["--scope", "clone"] : []), "--json"],
+			cwd,
+			["review", "mode", request.operation, "--cwd", cwd, ...(mutating ? ["--scope", "clone"] : []), "--json"],
 			mutating,
 			request.signal,
 		);
@@ -1654,6 +1673,23 @@ export class NativeReviewConsentRequiredError extends Error {
 	}
 }
 
+// Raised when the provider-issued consent invocation no longer matches the
+// binding Pi is answering for. Every one of these guards runs before the
+// provider is launched, so the failure is local and nothing was mutated. It
+// carries its own identity precisely so callers never report it as a provider
+// outage: an opaque `native-operation-failed` here sent issue #247 chasing a
+// missing `--cwd` that Pi does forward.
+export class NativeReviewConsentBindingError extends Error {
+	readonly reason: string;
+	readonly launchAttempted = false;
+	readonly mutationOutcome = "none";
+	constructor(reason: string, message: string) {
+		super(message);
+		this.name = "NativeReviewConsentBindingError";
+		this.reason = reason;
+	}
+}
+
 function splitNativeConsentInvocation(invocation: string): readonly string[] {
 	const words: string[] = [];
 	let current = "";
@@ -1705,26 +1741,26 @@ function exactConsentOption(arguments_: readonly string[], name: string): string
 		const token = arguments_[index]!;
 		if (token === name) {
 			const value = arguments_[index + 1];
-			if (value === undefined) throw new TypeError(`Native consent invocation ${name} is missing its value`);
+			if (value === undefined) throw new NativeReviewConsentBindingError("consent-invocation-option-invalid", `Native consent invocation ${name} is missing its value`);
 			values.push(value);
 			index += 1;
 		} else if (token.startsWith(`${name}=`)) values.push(token.slice(name.length + 1));
 	}
-	if (values.length !== 1) throw new TypeError(`Native consent invocation requires exactly one ${name}`);
+	if (values.length !== 1) throw new NativeReviewConsentBindingError("consent-invocation-option-invalid", `Native consent invocation requires exactly one ${name}`);
 	return values[0]!;
 }
 
 function consentInvocationArguments(request: NativeReviewConsentAnswerRequest): readonly string[] {
 	const choice = request.consent.choices.find((candidate) => candidate.answer === request.answer);
-	if (choice === undefined) throw new TypeError("Native consent answer must be granted or declined");
+	if (choice === undefined) throw new NativeReviewConsentBindingError("consent-answer-unknown", "Native consent answer must be granted or declined");
 	const words = splitNativeConsentInvocation(choice.invocation);
-	if (words[0] !== "gentle-ai" || words[1] !== "review" || words[2] !== "start") throw new TypeError("Native consent invocation is not a provider review START");
+	if (words[0] !== "gentle-ai" || words[1] !== "review" || words[2] !== "start") throw new NativeReviewConsentBindingError("consent-invocation-not-start", "Native consent invocation is not a provider review START");
 	const arguments_ = words.slice(1);
-	if (exactConsentOption(arguments_, "--contract") !== REVIEW_INTEGRATION_CONTRACT) throw new TypeError("Native consent invocation contract changed");
-	if (exactConsentOption(arguments_, "--cwd") !== request.cwd) throw new TypeError("Native consent invocation repository binding changed");
-	if (exactConsentOption(arguments_, "--target") !== request.consent.targetIdentity) throw new TypeError("Native consent invocation target binding changed");
-	if (exactConsentOption(arguments_, "--projection") !== request.consent.projection) throw new TypeError("Native consent invocation projection binding changed");
-	if (exactConsentOption(arguments_, "--consent") !== request.answer || arguments_.at(-1) !== request.answer) throw new TypeError("Native consent invocation answer binding changed");
+	if (exactConsentOption(arguments_, "--contract") !== REVIEW_INTEGRATION_CONTRACT) throw new NativeReviewConsentBindingError("consent-invocation-contract-changed", "Native consent invocation contract changed");
+	if (exactConsentOption(arguments_, "--cwd") !== request.cwd) throw new NativeReviewConsentBindingError("consent-invocation-cwd-changed", "Native consent invocation repository binding changed");
+	if (exactConsentOption(arguments_, "--target") !== request.consent.targetIdentity) throw new NativeReviewConsentBindingError("consent-invocation-target-changed", "Native consent invocation target binding changed");
+	if (exactConsentOption(arguments_, "--projection") !== request.consent.projection) throw new NativeReviewConsentBindingError("consent-invocation-projection-changed", "Native consent invocation projection binding changed");
+	if (exactConsentOption(arguments_, "--consent") !== request.answer || arguments_.at(-1) !== request.answer) throw new NativeReviewConsentBindingError("consent-invocation-answer-changed", "Native consent invocation answer binding changed");
 	return arguments_;
 }
 
@@ -1937,24 +1973,21 @@ export class NativeReviewCliV216 implements NativeReviewCli {
 		if (request.baseRef !== undefined && !isCanonicalProcessString(request.baseRef)) throw new TypeError("Native START baseRef must be a non-empty, trimmed, NUL-free string");
 		if (request.baseRef !== undefined && request.committedOnly !== true) throw new TypeError("Native START baseRef requires explicit committedOnly acknowledgement");
 		if (request.baseRef === undefined && request.committedOnly !== undefined) throw new TypeError("Native START committedOnly requires an explicit baseRef");
-		// A negotiated START requires exactly one --contract, --target, and
-		// --projection. The target is resolved here, from the same root START is
-		// about to run in, rather than threaded in by the caller: the caller's
-		// root and START's root differ whenever a candidate view is in play, and
-		// a target frozen from the wrong root would name a snapshot this START
-		// never inspects. targetStatus is read-only, so this costs one extra
-		// read and cannot create authority.
+		if (request.targetIdentity !== undefined && !/^sha256:[0-9a-f]{64}$/.test(request.targetIdentity)) throw new TypeError("Native START targetIdentity must be a canonical sha256 identity");
+		// The controller supplies the target it already projected from the
+		// authority workspace after proving its immutable actor view is identical.
+		// Direct adapter callers may omit it and retain the same-root projection.
 		const projection = request.projection ?? "workspace";
-		const target = await this.targetStatus({
+		const targetIdentity = request.targetIdentity ?? (await this.targetStatus({
 			cwd: request.cwd,
 			projection,
 			...(request.baseRef === undefined ? {} : { baseRef: request.baseRef }),
 			...(request.lineageId === undefined ? {} : { lineageId: request.lineageId }),
 			...(request.signal === undefined ? {} : { signal: request.signal }),
-		});
+		})).targetIdentity;
 		const execution = await this.negotiated(NATIVE_REVIEW_OPERATION.START, request.cwd, [
 			"review", "start", "--contract", REVIEW_INTEGRATION_CONTRACT, "--cwd", request.cwd,
-			"--target", target.targetIdentity, "--projection", projection,
+			"--target", targetIdentity, "--projection", projection,
 			...(request.baseRef === undefined ? [] : ["--base-ref", request.baseRef, "--committed-only"]),
 			...(request.lineageId === undefined ? [] : ["--lineage", request.lineageId]),
 			...(request.policyPath === undefined ? [] : ["--policy", request.policyPath]),
@@ -1966,10 +1999,14 @@ export class NativeReviewCliV216 implements NativeReviewCli {
 		// explicit answer it cannot infer. Discriminate before decode and surface
 		// the complete envelope; only the caller can map a human answer.
 		if (execution.body.action === "consent_required") {
-			throw new NativeReviewConsentRequiredError(decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewConsentV2(execution.body)));
+			const consent = decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewConsentV2(execution.body));
+			if (consent.targetIdentity !== targetIdentity || consent.projection !== projection) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native consent target binding mismatch");
+			throw new NativeReviewConsentRequiredError(consent);
 		}
 		const result = decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewStartV3(execution.body));
 		if (request.lineageId !== undefined && result.lineageId !== request.lineageId) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native start lineage mismatch");
+		const resultTarget = result.targetIdentity ?? result.repositoryContext?.targetIdentity;
+		if (resultTarget !== undefined && resultTarget !== targetIdentity) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native start target mismatch");
 		return {
 			lineageId: result.lineageId,
 			state: result.state as NativeStartResult["state"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gentle-pi",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "Turn Pi into el Gentleman: a senior-architect development harness with SDD/OpenSpec, subagents, strict TDD evidence, review guardrails, and skill discovery.",
   "license": "MIT",
   "type": "module",

package/runtime/native-review-cli.mjs

@@ -505,6 +505,7 @@ export const NATIVE_REVIEW_RECOVERY_DISPOSITION = {
 
 
 
+
 
 
 export const NATIVE_START_ACTION = { CREATED: "created", RESUMED: "resumed", REUSE_RECEIPT: "reuse-receipt", BLOCKED_SCOPE_ACTION: "blocked-scope-action" }         ;
@@ -749,6 +750,7 @@ function exactObject(value         , required                   , optional
 }
 function requiredString(value         )         { if (typeof value !== "string" || value.length === 0) throw new Error("expected string"); return value; }
 function stringValue(value         )         { if (typeof value !== "string") throw new Error("expected string"); return value; }
+function sha256Identity(value         )         { const parsed = requiredString(value); if (!/^sha256:[0-9a-f]{64}$/.test(parsed)) throw new Error("expected canonical SHA-256 identity"); return parsed; }
 function booleanValue(value         )          { if (typeof value !== "boolean") throw new Error("expected boolean"); return value; }
 function nonNegativeInteger(value         )         { if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error("expected safe non-negative integer"); return value; }
 function positiveInteger(value         )         { if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error("expected safe positive integer"); return value; }
@@ -958,7 +960,7 @@ function decodeNativeReviewRecovery(value         )                       {
 	};
 }
 function decodeNativeReviewStatusEntry(value         )                             {
-	const entry = exactObject(value, ["version", "path", "status", "problems"], ["lineage_id", "state", "revision", "chain_identity", "recovery"]);
+	const entry = exactObject(value, ["version", "path", "status", "problems"], ["lineage_id", "state", "revision", "snapshot_identity", "chain_identity", "recovery"]);
 	return {
 		version: enumString(entry.version, Object.values(NATIVE_REVIEW_AUTHORITY_ENTRY_VERSION))                                     ,
 		...(entry.lineage_id === undefined ? {} : { lineageId: requiredString(entry.lineage_id) }),
@@ -966,6 +968,7 @@ function decodeNativeReviewStatusEntry(value         )
 		status: enumString(entry.status, Object.values(NATIVE_REVIEW_AUTHORITY_ENTRY_STATUS))                                    ,
 		...(entry.state === undefined ? {} : { state: requiredString(entry.state) }),
 		...(entry.revision === undefined ? {} : { revision: requiredString(entry.revision) }),
+		...(entry.snapshot_identity === undefined ? {} : { snapshotIdentity: sha256Identity(entry.snapshot_identity) }),
 		...(entry.chain_identity === undefined ? {} : { chainIdentity: requiredString(entry.chain_identity) }),
 		...(entry.recovery === undefined ? {} : { recovery: decodeNativeReviewRecovery(entry.recovery) }),
 		problems: stringArray(entry.problems),
@@ -1038,6 +1041,21 @@ function decodeNativeReviewStatus(value         )                           {
 	};
 }
 function isWindowsRepositoryPath(value        )          { return /^[A-Za-z]:[\\/]/.test(value) || /^\\\\/.test(value); }
+export function normalizeNativeReviewCwd(value        , platform                  = process.platform)         {
+	if (platform !== "win32") return value;
+	const gitBashDrive = /^\/([A-Za-z])(?:\/(.*))?$/.exec(value);
+	const windowsPath = gitBashDrive === null
+		? value
+		: `${gitBashDrive[1] .toUpperCase()}:/${gitBashDrive[2] ?? ""}`;
+	if (!isWindowsRepositoryPath(windowsPath)) return windowsPath;
+	const normalized = win32.normalize(windowsPath);
+	return normalized.replace(/^([a-z]):/, (_match, drive        ) => `${drive.toUpperCase()}:`);
+}
+async function canonicalNativeReviewCwd(value        )                  {
+	const normalized = normalizeNativeReviewCwd(value);
+	try { return await realpath(normalized); }
+	catch { return normalized; }
+}
 async function repositoryPathIdentity(value        )                  {
 	const windowsPath = isWindowsRepositoryPath(value);
 	try { return `filesystem:${windowsPath ? (await realpath(value)).toLowerCase() : await realpath(value)}`; }
@@ -1361,12 +1379,13 @@ export class NativeReviewCliV214 {
 	// and always pass `--scope clone` so Pi's own kill-switch command surface
 	// never mutates the operator's global gentle-ai state across other clones.
 	async reviewMode(request                         )                                  {
-		await this.verifyVersion(request.cwd, request.signal, ["mode"]);
+		const cwd = await canonicalNativeReviewCwd(request.cwd);
+		await this.verifyVersion(cwd, request.signal, ["mode"]);
 		const mutating = request.operation !== NATIVE_REVIEW_MODE_OPERATION.STATUS;
 		const { body } = await this.execute(
 			NATIVE_REVIEW_OPERATION.MODE,
-			request.cwd,
-			["review", "mode", request.operation, "--cwd", request.cwd, ...(mutating ? ["--scope", "clone"] : []), "--json"],
+			cwd,
+			["review", "mode", request.operation, "--cwd", cwd, ...(mutating ? ["--scope", "clone"] : []), "--json"],
 			mutating,
 			request.signal,
 		);
@@ -1655,6 +1674,23 @@ export class NativeReviewConsentRequiredError extends Error {
 	}
 }
 
+// Raised when the provider-issued consent invocation no longer matches the
+// binding Pi is answering for. Every one of these guards runs before the
+// provider is launched, so the failure is local and nothing was mutated. It
+// carries its own identity precisely so callers never report it as a provider
+// outage: an opaque `native-operation-failed` here sent issue #247 chasing a
+// missing `--cwd` that Pi does forward.
+export class NativeReviewConsentBindingError extends Error {
+	         reason        ;
+	         launchAttempted = false;
+	         mutationOutcome = "none";
+	constructor(reason        , message        ) {
+		super(message);
+		this.name = "NativeReviewConsentBindingError";
+		this.reason = reason;
+	}
+}
+
 function splitNativeConsentInvocation(invocation        )                    {
 	const words           = [];
 	let current = "";
@@ -1706,26 +1742,26 @@ function exactConsentOption(arguments_                   , name        )
 		const token = arguments_[index] ;
 		if (token === name) {
 			const value = arguments_[index + 1];
-			if (value === undefined) throw new TypeError(`Native consent invocation ${name} is missing its value`);
+			if (value === undefined) throw new NativeReviewConsentBindingError("consent-invocation-option-invalid", `Native consent invocation ${name} is missing its value`);
 			values.push(value);
 			index += 1;
 		} else if (token.startsWith(`${name}=`)) values.push(token.slice(name.length + 1));
 	}
-	if (values.length !== 1) throw new TypeError(`Native consent invocation requires exactly one ${name}`);
+	if (values.length !== 1) throw new NativeReviewConsentBindingError("consent-invocation-option-invalid", `Native consent invocation requires exactly one ${name}`);
 	return values[0] ;
 }
 
 function consentInvocationArguments(request                                  )                    {
 	const choice = request.consent.choices.find((candidate) => candidate.answer === request.answer);
-	if (choice === undefined) throw new TypeError("Native consent answer must be granted or declined");
+	if (choice === undefined) throw new NativeReviewConsentBindingError("consent-answer-unknown", "Native consent answer must be granted or declined");
 	const words = splitNativeConsentInvocation(choice.invocation);
-	if (words[0] !== "gentle-ai" || words[1] !== "review" || words[2] !== "start") throw new TypeError("Native consent invocation is not a provider review START");
+	if (words[0] !== "gentle-ai" || words[1] !== "review" || words[2] !== "start") throw new NativeReviewConsentBindingError("consent-invocation-not-start", "Native consent invocation is not a provider review START");
 	const arguments_ = words.slice(1);
-	if (exactConsentOption(arguments_, "--contract") !== REVIEW_INTEGRATION_CONTRACT) throw new TypeError("Native consent invocation contract changed");
-	if (exactConsentOption(arguments_, "--cwd") !== request.cwd) throw new TypeError("Native consent invocation repository binding changed");
-	if (exactConsentOption(arguments_, "--target") !== request.consent.targetIdentity) throw new TypeError("Native consent invocation target binding changed");
-	if (exactConsentOption(arguments_, "--projection") !== request.consent.projection) throw new TypeError("Native consent invocation projection binding changed");
-	if (exactConsentOption(arguments_, "--consent") !== request.answer || arguments_.at(-1) !== request.answer) throw new TypeError("Native consent invocation answer binding changed");
+	if (exactConsentOption(arguments_, "--contract") !== REVIEW_INTEGRATION_CONTRACT) throw new NativeReviewConsentBindingError("consent-invocation-contract-changed", "Native consent invocation contract changed");
+	if (exactConsentOption(arguments_, "--cwd") !== request.cwd) throw new NativeReviewConsentBindingError("consent-invocation-cwd-changed", "Native consent invocation repository binding changed");
+	if (exactConsentOption(arguments_, "--target") !== request.consent.targetIdentity) throw new NativeReviewConsentBindingError("consent-invocation-target-changed", "Native consent invocation target binding changed");
+	if (exactConsentOption(arguments_, "--projection") !== request.consent.projection) throw new NativeReviewConsentBindingError("consent-invocation-projection-changed", "Native consent invocation projection binding changed");
+	if (exactConsentOption(arguments_, "--consent") !== request.answer || arguments_.at(-1) !== request.answer) throw new NativeReviewConsentBindingError("consent-invocation-answer-changed", "Native consent invocation answer binding changed");
 	return arguments_;
 }
 
@@ -1938,24 +1974,21 @@ export class NativeReviewCliV216                            {
 		if (request.baseRef !== undefined && !isCanonicalProcessString(request.baseRef)) throw new TypeError("Native START baseRef must be a non-empty, trimmed, NUL-free string");
 		if (request.baseRef !== undefined && request.committedOnly !== true) throw new TypeError("Native START baseRef requires explicit committedOnly acknowledgement");
 		if (request.baseRef === undefined && request.committedOnly !== undefined) throw new TypeError("Native START committedOnly requires an explicit baseRef");
-		// A negotiated START requires exactly one --contract, --target, and
-		// --projection. The target is resolved here, from the same root START is
-		// about to run in, rather than threaded in by the caller: the caller's
-		// root and START's root differ whenever a candidate view is in play, and
-		// a target frozen from the wrong root would name a snapshot this START
-		// never inspects. targetStatus is read-only, so this costs one extra
-		// read and cannot create authority.
+		if (request.targetIdentity !== undefined && !/^sha256:[0-9a-f]{64}$/.test(request.targetIdentity)) throw new TypeError("Native START targetIdentity must be a canonical sha256 identity");
+		// The controller supplies the target it already projected from the
+		// authority workspace after proving its immutable actor view is identical.
+		// Direct adapter callers may omit it and retain the same-root projection.
 		const projection = request.projection ?? "workspace";
-		const target = await this.targetStatus({
+		const targetIdentity = request.targetIdentity ?? (await this.targetStatus({
 			cwd: request.cwd,
 			projection,
 			...(request.baseRef === undefined ? {} : { baseRef: request.baseRef }),
 			...(request.lineageId === undefined ? {} : { lineageId: request.lineageId }),
 			...(request.signal === undefined ? {} : { signal: request.signal }),
-		});
+		})).targetIdentity;
 		const execution = await this.negotiated(NATIVE_REVIEW_OPERATION.START, request.cwd, [
 			"review", "start", "--contract", REVIEW_INTEGRATION_CONTRACT, "--cwd", request.cwd,
-			"--target", target.targetIdentity, "--projection", projection,
+			"--target", targetIdentity, "--projection", projection,
 			...(request.baseRef === undefined ? [] : ["--base-ref", request.baseRef, "--committed-only"]),
 			...(request.lineageId === undefined ? [] : ["--lineage", request.lineageId]),
 			...(request.policyPath === undefined ? [] : ["--policy", request.policyPath]),
@@ -1967,10 +2000,14 @@ export class NativeReviewCliV216                            {
 		// explicit answer it cannot infer. Discriminate before decode and surface
 		// the complete envelope; only the caller can map a human answer.
 		if (execution.body.action === "consent_required") {
-			throw new NativeReviewConsentRequiredError(decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewConsentV2(execution.body)));
+			const consent = decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewConsentV2(execution.body));
+			if (consent.targetIdentity !== targetIdentity || consent.projection !== projection) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native consent target binding mismatch");
+			throw new NativeReviewConsentRequiredError(consent);
 		}
 		const result = decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewStartV3(execution.body));
 		if (request.lineageId !== undefined && result.lineageId !== request.lineageId) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native start lineage mismatch");
+		const resultTarget = result.targetIdentity ?? result.repositoryContext?.targetIdentity;
+		if (resultTarget !== undefined && resultTarget !== targetIdentity) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native start target mismatch");
 		return {
 			lineageId: result.lineageId,
 			state: result.state                              ,

package/tests/native-review-cli.test.ts

@@ -668,6 +668,33 @@ test("native review status uses the anticipated v2.1.5 contract, preserves Windo
 	}
 });
 
+test("native review status decodes and retains the v2.2.2 compact snapshot identity", async () => {
+	const snapshotIdentity = "sha256:0586c3d40c3acf3db92214ddaf07afe44ad862518b48d608ae4157377ab2f3cc";
+	const entry = {
+		version: "compact-v2",
+		lineage_id: "issue-136-v2-1-2-final",
+		path: "C:\\repo with spaces\\.git\\gentle-ai\\review-transactions\\v2\\issue-136-v2-1-2-final",
+		status: "active",
+		state: "reviewing",
+		revision: "sha256:8103efb360d10d1717a4d22e38c8b75074f99680ed6a5eb3ab40e0ed9fb69931",
+		snapshot_identity: snapshotIdentity,
+		problems: [],
+	};
+	const status = { ...JSON.parse(REVIEW_STATUS.stdout), status: "active", entries: [entry] };
+	const queue = queuedAdapter([{ stdout: "gentle-ai 2.2.2\n" }, { stdout: JSON.stringify(status) }]);
+	const decoded = await new NativeReviewCliV213(queue.adapter).reviewStatus({ cwd: "C:\\repo with spaces" });
+	assert.equal(decoded.entries[0]?.snapshotIdentity, snapshotIdentity);
+
+	const malformed = queuedAdapter([{ stdout: "gentle-ai 2.2.2\n" }, { stdout: JSON.stringify({ ...status, entries: [{ ...entry, snapshot_identity: snapshotIdentity.slice("sha256:".length) }] }) }]);
+	await assert.rejects(
+		() => new NativeReviewCliV213(malformed.adapter).reviewStatus({ cwd: "C:\\repo with spaces" }),
+		(error: unknown) => error instanceof NativeReviewCliError
+			&& error.code === NATIVE_REVIEW_ERROR_CODE.SCHEMA_INCOMPATIBLE
+			&& error.operation === "review/status"
+			&& error.mutationOutcome === "none",
+	);
+});
+
 test("native review status decodes 2.1.8 released lock residue and keeps unknown lock statuses fail-closed", async () => {
 	// gentle-ai 2.1.8 leaves review-transactions/v2/LOCK behind after ORDINARY
 	// successful operations and reports it as {"status":"released"} without