gentle-pi 2.1.2 → 2.2.0

package/tests/gentle-ai-installer.test.ts

@@ -19,14 +19,14 @@ import {
 	trustedSystemExtractor,
 } from "../scripts/gentle-ai-installer.mjs";
 
-// v2.2.2 digests pinned from the published release: archive sha256 values match
+// v2.4.0 digests pinned from the published release: archive sha256 values match
 // checksums.txt and freshly computed hashes; binary sha256 values were computed
 // from the extracted executables of each verified archive.
 const EXPECTED_ASSETS = {
-	"darwin/amd64": { name: "gentle-ai_2.2.2_darwin_amd64.tar.gz", sha256: "5ca67829903bf4c6b14665664f80f9d8216c84b10c8e50870d297f452cefb9dc", binarySha256: "9b239423450562d026384f482bbd2f1e3f2820431a84f0921743ac3df9d632de" },
-	"darwin/arm64": { name: "gentle-ai_2.2.2_darwin_arm64.tar.gz", sha256: "0193e1a284444dccee2863d31b8dbb76a982e8f9111955908d6a9131c1a5490e", binarySha256: "149b97248552c5e03ebc4d991f86b1360fb847a40fc315555a8aa256f95baca0" },
-	"linux/amd64": { name: "gentle-ai_2.2.2_linux_amd64.tar.gz", sha256: "b85bbb20eb2236de97b261df16cfc8d8394dfd07a137e885c4889b62d0c20fa1", binarySha256: "00d5732e8dd3945956800217a4f60213c2d9ca63351092a2cb7f4e5f9ece54f9" },
-	"linux/arm64": { name: "gentle-ai_2.2.2_linux_arm64.tar.gz", sha256: "61e7077342448273f0c43af49ce4d182594bab5e4f86f812975af2fbe69e3b0b", binarySha256: "a92685aa7dbea0cc4297d016569b3defe9bb30a7374a620021e245b74f50eb68" },
+	"darwin/amd64": { name: "gentle-ai_2.4.0_darwin_amd64.tar.gz", sha256: "c3f5a4251e927c41864e7a9a5670ac3fce97c6282755ec8e9b2e7e064067f750", binarySha256: "c4d25b98bae0d06b33baa23ba997cb64ab63c2e93e97983bcb9c239139bceaba" },
+	"darwin/arm64": { name: "gentle-ai_2.4.0_darwin_arm64.tar.gz", sha256: "2240ae797119dd1dc5a0dd2fd2711077ce6712e66ab0b67461344c983478f7f4", binarySha256: "54a8a5957ce4f10f36b46ef818c888f484a3e213a71faca6b7783af6c029eb77" },
+	"linux/amd64": { name: "gentle-ai_2.4.0_linux_amd64.tar.gz", sha256: "517eb8420cf966b74be1413a7ea1036119a5ccbb376e0778aa9f4d4d283e2e9a", binarySha256: "0be446737f8f1a9458fd2891d488beb2d72786578afead9bbf2d6ddddc9ec113" },
+	"linux/arm64": { name: "gentle-ai_2.4.0_linux_arm64.tar.gz", sha256: "1badec9cad1f2bbeb22b5c6804c3a88c601d844abae231264e416e8095f2a15f", binarySha256: "cdd8fa43c3417e844cc11d2e436d4667edb0a54f086e0eb1d6cd3f7493bfee5a" },
 } as const;
 
 test("default installer package root is the package containing scripts, not its parent", () => {
@@ -37,15 +37,15 @@ test("default installer package root is the package containing scripts, not its
 	assert.notEqual(resolveGentleAiInstallerPackageRoot(), dirname(expectedPackageRoot));
 });
 
-test("release mapping selects only the supported official v2.2.2 archive and pinned digests", () => {
+test("release mapping selects only the supported official v2.4.0 archive and pinned digests", () => {
 	assert.deepEqual(
 		Object.fromEntries(Object.entries(GENTLE_AI_RELEASE_ASSETS).map(([key, asset]) => [key, { name: asset.name, sha256: asset.sha256, binarySha256: asset.binarySha256 }])),
 		EXPECTED_ASSETS,
 	);
-	assert.equal(resolveGentleAiReleaseAsset("linux", "x64").name, "gentle-ai_2.2.2_linux_amd64.tar.gz");
-	assert.equal(resolveGentleAiReleaseAsset("darwin", "arm64").name, "gentle-ai_2.2.2_darwin_arm64.tar.gz");
+	assert.equal(resolveGentleAiReleaseAsset("linux", "x64").name, "gentle-ai_2.4.0_linux_amd64.tar.gz");
+	assert.equal(resolveGentleAiReleaseAsset("darwin", "arm64").name, "gentle-ai_2.4.0_darwin_arm64.tar.gz");
 	for (const asset of Object.values(GENTLE_AI_RELEASE_ASSETS)) {
-		assert.match(asset.url, /^https:\/\/github\.com\/Gentleman-Programming\/gentle-ai\/releases\/download\/v2\.2\.2\//);
+		assert.match(asset.url, /^https:\/\/github\.com\/Gentleman-Programming\/gentle-ai\/releases\/download\/v2\.4\.0\//);
 	}
 });
 
@@ -66,7 +66,7 @@ test("release digests are all-or-none and install fails closed while any digest
 			}),
 			/checksum mismatch/,
 		);
-		assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.2.2", "gentle-ai")), false);
+		assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.4.0", "gentle-ai")), false);
 	}
 });
 
@@ -95,7 +95,7 @@ function windowsGoFixture(fixtureOptions: WindowsGoFixtureOptions = {}) {
 	const metadata = [
 		"gentle-ai.exe: go1.25.10",
 		"\tpath\tgithub.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai",
-		`\tmod\tgithub.com/gentleman-programming/gentle-ai/v2\tv2.2.2\t${GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM}`,
+		`\tmod\tgithub.com/gentleman-programming/gentle-ai/v2\tv2.4.0\t${GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM}`,
 		"\tbuild\t-buildmode=exe", "\tbuild\t-compiler=gc", "\tbuild\tCGO_ENABLED=0", `\tbuild\tGOARCH=${fixtureOptions.goArchitecture ?? "amd64"}`, "\tbuild\tGOOS=windows",
 	].join("\n");
 	const run = async (file: string, arguments_: string[], options: WindowsGoCall["options"]) => {
@@ -113,7 +113,7 @@ function windowsGoFixture(fixtureOptions: WindowsGoFixtureOptions = {}) {
 			return { stdout: "", stderr: "" };
 		}
 		if (file === goExecutable && arguments_[0] === "version" && arguments_[1] === "-m") return { stdout: metadata, stderr: "" };
-		if (arguments_.length === 1 && arguments_[0] === "version") return { stdout: fixtureOptions.reportedVersion ?? "gentle-ai 2.2.2\n", stderr: "" };
+		if (arguments_.length === 1 && arguments_[0] === "version") return { stdout: fixtureOptions.reportedVersion ?? "gentle-ai 2.4.0\n", stderr: "" };
 		throw new Error(`unexpected command: ${file} ${arguments_.join(" ")}`);
 	};
 	return { calls, run, setGoExecutable: (path: string) => { goExecutable = path; } };
@@ -129,7 +129,7 @@ test("win32 x64 and arm64 install the exact Go SumDB source tag without archive
 		const result = await installGentleAi({ packageRoot, platform: "win32", arch, execFile: fixture.run, resolveGoExecutable: async () => goPath });
 		assert.equal(result.installed, true);
 		assert.deepEqual(fixture.calls.filter((call) => call.file === goPath).map((call) => call.arguments_.slice(0, 2)), [
-			["version"], ["install", "github.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai@v2.2.2"], ["version", "-m"],
+			["version"], ["install", "github.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai@v2.4.0"], ["version", "-m"],
 		]);
 	}
 });
@@ -148,7 +148,7 @@ test("Windows source install reports missing or too-old Go without publishing a
 			() => installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: fixture.run, resolveGoExecutable: async () => goPath }),
 			(error: unknown) => error instanceof Error && "code" in error && error.code === fixtureOptions.expectedCode,
 		);
-		assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.2.2", "gentle-ai.exe")), false);
+		assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.4.0", "gentle-ai.exe")), false);
 		assert.deepEqual((await readdir(packageRoot)).filter((entry) => entry.includes("install-")), []);
 	}
 });
@@ -167,7 +167,7 @@ test("Windows source install cleans staging after Go failure or wrong built vers
 			() => installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: fixture.run, resolveGoExecutable: async () => goPath }),
 			(error: unknown) => error instanceof Error && "code" in error && error.code === fixtureOptions.expectedCode,
 		);
-		const runtimeDirectory = join(packageRoot, ".gentle-ai", "v2.2.2");
+		const runtimeDirectory = join(packageRoot, ".gentle-ai", "v2.4.0");
 		assert.ok(fixture.calls.some((call) => call.arguments_[0] === "install"));
 		assert.equal(existsSync(join(runtimeDirectory, "gentle-ai.exe")), false);
 		assert.equal(existsSync(runtimeDirectory) && (await readdir(runtimeDirectory)).some((entry) => entry.startsWith(".go-install-") || entry.endsWith(".tmp")), false);
@@ -188,7 +188,7 @@ test("Windows source installs reuse only a fully verified package-local binary",
 	assert.equal(reused.installed, false);
 	assert.ok(reuse.calls.every((call) => call.file !== "gentle-ai"), "the installer must never fall back to ambient gentle-ai on PATH");
 
-	await writeFile(join(packageRoot, ".gentle-ai", "v2.2.2", "integrity.json"), "{}\n");
+	await writeFile(join(packageRoot, ".gentle-ai", "v2.4.0", "integrity.json"), "{}\n");
 	const repaired = windowsGoFixture();
 	repaired.setGoExecutable(goPath);
 	assert.equal((await installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: repaired.run, resolveGoExecutable: async () => goPath })).installed, true);
@@ -230,7 +230,7 @@ async function hardenedWindowsGoFixture(packageRoot: string, fixtureOptions: Har
 	const metadata = fixtureOptions.metadataOverride ?? [
 		"gentle-ai.exe: go1.25.10",
 		"\tpath\tgithub.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai",
-		`\tmod\tgithub.com/gentleman-programming/gentle-ai/v2\tv2.2.2\t${GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM}`,
+		`\tmod\tgithub.com/gentleman-programming/gentle-ai/v2\tv2.4.0\t${GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM}`,
 		"\tbuild\t-buildmode=exe",
 		"\tbuild\t-compiler=gc",
 		"\tbuild\tCGO_ENABLED=0",
@@ -250,7 +250,7 @@ async function hardenedWindowsGoFixture(packageRoot: string, fixtureOptions: Har
 			return { stdout: "", stderr: "" };
 		}
 		if (file === goPath && arguments_[0] === "version" && arguments_[1] === "-m") return { stdout: metadata, stderr: "" };
-		if (arguments_.length === 1 && arguments_[0] === "version") return { stdout: "gentle-ai 2.2.2\n", stderr: "" };
+		if (arguments_.length === 1 && arguments_[0] === "version") return { stdout: "gentle-ai 2.4.0\n", stderr: "" };
 		throw new Error(`unexpected command: ${file} ${arguments_.join(" ")}`);
 	};
 	return {
@@ -292,7 +292,7 @@ test("Windows source installation resolves one validated Go executable and seals
 	const goCalls = fixture.calls.filter((call) => call.file === fixture.goPath);
 	assert.deepEqual(goCalls.map((call) => call.arguments_.slice(0, 2)), [
 		["version"],
-		["install", "github.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai@v2.2.2"],
+		["install", "github.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai@v2.4.0"],
 		["version", "-m"],
 	]);
 	for (const call of goCalls) {
@@ -318,14 +318,14 @@ test("Windows source manifest binds verified Go metadata and architecture", asyn
 	const packageRoot = await mkdtemp(join(tmpdir(), "gentle-pi-installer-provenance-"));
 	const fixture = await hardenedWindowsGoFixture(packageRoot, { architecture: "arm64" });
 	const result = await installGentleAi({ packageRoot, platform: "win32", arch: "arm64", execFile: fixture.run, resolveGoExecutable: fixture.resolveGoExecutable });
-	const manifest = JSON.parse(await readFile(join(packageRoot, ".gentle-ai", "v2.2.2", "integrity.json"), "utf8")) as Record<string, string>;
+	const manifest = JSON.parse(await readFile(join(packageRoot, ".gentle-ai", "v2.4.0", "integrity.json"), "utf8")) as Record<string, string>;
 	assert.equal(result.installed, true);
 	assert.deepEqual(manifest, {
-		version: "2.2.2",
+		version: "2.4.0",
 		method: "go-sumdb-source-build",
 		package: "github.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai",
 		module: "github.com/gentleman-programming/gentle-ai/v2",
-		tag: "v2.2.2",
+		tag: "v2.4.0",
 		architecture: "arm64",
 		binarySha256: createHash("sha256").update("trusted Windows source build").digest("hex"),
 		moduleChecksum: GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM,
@@ -345,12 +345,12 @@ test("Windows source installation rejects Go metadata for a different architectu
 		() => installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: fixture.run, resolveGoExecutable: fixture.resolveGoExecutable }),
 		(error: unknown) => error instanceof Error && "code" in error && error.code === "GENTLE_AI_GO_INSTALL_FAILED",
 	);
-	assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.2.2", "gentle-ai.exe")), false);
+	assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.4.0", "gentle-ai.exe")), false);
 });
 
 test("Windows source installation treats a fresh ownerless lock as active", async () => {
 	const packageRoot = await mkdtemp(join(tmpdir(), "gentle-pi-installer-ownerless-lock-"));
-	const lockPath = join(packageRoot, ".gentle-ai", ".v2.2.2.install.lock");
+	const lockPath = join(packageRoot, ".gentle-ai", ".v2.4.0.install.lock");
 	await mkdir(lockPath, { recursive: true });
 	const fixture = await hardenedWindowsGoFixture(packageRoot);
 	await assertManualLockRecoveryRequired(packageRoot, fixture);
@@ -358,7 +358,7 @@ test("Windows source installation treats a fresh ownerless lock as active", asyn
 
 test("Windows source installation preserves a lock whose owner nonce changed before release", async () => {
 	const packageRoot = await mkdtemp(join(tmpdir(), "gentle-pi-installer-owner-lock-"));
-	const lockOwnerPath = join(packageRoot, ".gentle-ai", ".v2.2.2.install.lock", "owner.json");
+	const lockOwnerPath = join(packageRoot, ".gentle-ai", ".v2.4.0.install.lock", "owner.json");
 	const fixture = await hardenedWindowsGoFixture(packageRoot);
 	let replacedOwner = false;
 	const run = async (...arguments_: Parameters<typeof fixture.run>) => {
@@ -375,7 +375,7 @@ test("Windows source installation preserves a lock whose owner nonce changed bef
 });
 
 async function assertManualLockRecoveryRequired(packageRoot: string, fixture: Awaited<ReturnType<typeof hardenedWindowsGoFixture>>, options: Record<string, unknown> = {}) {
-	const lockPath = join(packageRoot, ".gentle-ai", ".v2.2.2.install.lock");
+	const lockPath = join(packageRoot, ".gentle-ai", ".v2.4.0.install.lock");
 	await assert.rejects(
 		() => installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: fixture.run, resolveGoExecutable: fixture.resolveGoExecutable, ...options }),
 		(error: unknown) => error instanceof Error && error.message.includes(lockPath) && /confirm no installer is active.*remove.*manually/i.test(error.message),
@@ -385,18 +385,18 @@ async function assertManualLockRecoveryRequired(packageRoot: string, fixture: Aw
 }
 
 function tombstonePath(packageRoot: string, nonce: string): string {
-	return join(packageRoot, ".gentle-ai", `.v2.2.2.install.tombstone-${nonce}`);
+	return join(packageRoot, ".gentle-ai", `.v2.4.0.install.tombstone-${nonce}`);
 }
 
 async function tombstones(packageRoot: string): Promise<string[]> {
 	const runtimeRoot = join(packageRoot, ".gentle-ai");
 	return existsSync(runtimeRoot)
-		? (await readdir(runtimeRoot)).filter((entry) => entry.startsWith(".v2.2.2.install.tombstone-"))
+		? (await readdir(runtimeRoot)).filter((entry) => entry.startsWith(".v2.4.0.install.tombstone-"))
 		: [];
 }
 
 function backupBundlePath(packageRoot: string, nonce: string): string {
-	return join(packageRoot, ".gentle-ai", `.v2.2.2.backup-${nonce}`);
+	return join(packageRoot, ".gentle-ai", `.v2.4.0.backup-${nonce}`);
 }
 
 async function copyWindowsBundle(source: string, destination: string): Promise<void> {
@@ -407,7 +407,7 @@ async function copyWindowsBundle(source: string, destination: string): Promise<v
 
 test("Windows source installation fails closed for an ownerless lock even after the stale threshold", async () => {
 	const packageRoot = await mkdtemp(join(tmpdir(), "gentle-pi-installer-ownerless-stale-lock-"));
-	const lockPath = join(packageRoot, ".gentle-ai", ".v2.2.2.install.lock");
+	const lockPath = join(packageRoot, ".gentle-ai", ".v2.4.0.install.lock");
 	await mkdir(lockPath, { recursive: true });
 	const fixture = await hardenedWindowsGoFixture(packageRoot);
 	await assertManualLockRecoveryRequired(packageRoot, fixture, { now: () => Date.now() + 10 * 60_000 });
@@ -415,7 +415,7 @@ test("Windows source installation fails closed for an ownerless lock even after
 
 test("Windows source installation fails closed for a stale owner lock", async () => {
 	const packageRoot = await mkdtemp(join(tmpdir(), "gentle-pi-installer-stale-lock-"));
-	const lockPath = join(packageRoot, ".gentle-ai", ".v2.2.2.install.lock");
+	const lockPath = join(packageRoot, ".gentle-ai", ".v2.4.0.install.lock");
 	await mkdir(lockPath, { recursive: true });
 	await writeFile(join(lockPath, "owner.json"), `${JSON.stringify({ createdAt: 0, nonce: "0".repeat(64) })}\n`);
 	const fixture = await hardenedWindowsGoFixture(packageRoot);
@@ -467,7 +467,7 @@ test("Windows source acquisition fails closed when a tombstone appears after its
 		(error: unknown) => error instanceof Error && error.message.includes(foreignTombstone),
 	);
 	assert.equal(existsSync(foreignTombstone), true);
-	assert.equal(existsSync(join(packageRoot, ".gentle-ai", ".v2.2.2.install.lock")), false);
+	assert.equal(existsSync(join(packageRoot, ".gentle-ai", ".v2.4.0.install.lock")), false);
 	assert.equal(fixture.calls.some((call) => call.arguments_[0] === "install"), false);
 });
 
@@ -475,7 +475,7 @@ test("Windows source release deletes its matching tombstone and allows reuse", a
 	const packageRoot = await mkdtemp(join(tmpdir(), "gentle-pi-installer-owned-lock-release-"));
 	const fixture = await hardenedWindowsGoFixture(packageRoot);
 	await installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: fixture.run, resolveGoExecutable: fixture.resolveGoExecutable });
-	assert.equal(existsSync(join(packageRoot, ".gentle-ai", ".v2.2.2.install.lock")), false);
+	assert.equal(existsSync(join(packageRoot, ".gentle-ai", ".v2.4.0.install.lock")), false);
 	assert.deepEqual(await tombstones(packageRoot), []);
 	const reuse = await hardenedWindowsGoFixture(packageRoot);
 	assert.equal((await installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: reuse.run, resolveGoExecutable: reuse.resolveGoExecutable })).installed, false);
@@ -485,7 +485,7 @@ test("Windows source recovers a valid backup after a crash between publication r
 	const packageRoot = await mkdtemp(join(tmpdir(), "gentle-pi-installer-backup-crash-"));
 	const initial = await hardenedWindowsGoFixture(packageRoot);
 	await installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: initial.run, resolveGoExecutable: initial.resolveGoExecutable });
-	const live = join(packageRoot, ".gentle-ai", "v2.2.2");
+	const live = join(packageRoot, ".gentle-ai", "v2.4.0");
 	const backup = backupBundlePath(packageRoot, "crash");
 	await rename(live, backup);
 	const recovery = await hardenedWindowsGoFixture(packageRoot);
@@ -521,7 +521,7 @@ test("Windows source cleans one validated backup only when the live bundle is va
 	const packageRoot = await mkdtemp(join(tmpdir(), "gentle-pi-installer-backup-valid-live-"));
 	const initial = await hardenedWindowsGoFixture(packageRoot);
 	await installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: initial.run, resolveGoExecutable: initial.resolveGoExecutable });
-	const live = join(packageRoot, ".gentle-ai", "v2.2.2");
+	const live = join(packageRoot, ".gentle-ai", "v2.4.0");
 	const backup = backupBundlePath(packageRoot, "valid");
 	await copyWindowsBundle(live, backup);
 	const reuse = await hardenedWindowsGoFixture(packageRoot);
@@ -534,7 +534,7 @@ test("Windows source preserves a valid backup when the live bundle is invalid",
 	const packageRoot = await mkdtemp(join(tmpdir(), "gentle-pi-installer-backup-invalid-live-"));
 	const initial = await hardenedWindowsGoFixture(packageRoot);
 	await installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: initial.run, resolveGoExecutable: initial.resolveGoExecutable });
-	const live = join(packageRoot, ".gentle-ai", "v2.2.2");
+	const live = join(packageRoot, ".gentle-ai", "v2.4.0");
 	const backup = backupBundlePath(packageRoot, "valid");
 	await copyWindowsBundle(live, backup);
 	await writeFile(join(live, "integrity.json"), "{}\n");
@@ -552,7 +552,7 @@ test("Windows concurrent installs fail closed until normal release, then reuse t
 	const fixture = await hardenedWindowsGoFixture(packageRoot, { blockInstall: true });
 	const first = installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: fixture.run, resolveGoExecutable: fixture.resolveGoExecutable });
 	await fixture.waitForInstall();
-	const lockPath = join(packageRoot, ".gentle-ai", ".v2.2.2.install.lock");
+	const lockPath = join(packageRoot, ".gentle-ai", ".v2.4.0.install.lock");
 	await assert.rejects(
 		() => installGentleAi({ packageRoot, platform: "win32", arch: "x64", execFile: fixture.run, resolveGoExecutable: fixture.resolveGoExecutable }),
 		(error: unknown) => error instanceof Error && error.message.includes(lockPath),
@@ -566,7 +566,7 @@ test("Windows concurrent installs fail closed until normal release, then reuse t
 
 test("Windows source publication rolls back a prior bundle when final directory swap fails", async () => {
 	const packageRoot = await mkdtemp(join(tmpdir(), "gentle-pi-installer-rollback-"));
-	const versionDirectory = join(packageRoot, ".gentle-ai", "v2.2.2");
+	const versionDirectory = join(packageRoot, ".gentle-ai", "v2.4.0");
 	await mkdir(versionDirectory, { recursive: true });
 	await writeFile(join(versionDirectory, "old.txt"), "previous bundle");
 	const fixture = await hardenedWindowsGoFixture(packageRoot);
@@ -590,7 +590,7 @@ test("Windows source publication rolls back a prior bundle when final directory
 test("Darwin/Linux signed bundles retain their four-field manifest and reusable compatibility", async () => {
 	const packageRoot = await mkdtemp(join(tmpdir(), "gentle-pi-installer-signed-compatibility-"));
 	const payload = Buffer.from("signed archive fixture");
-	const asset = { name: "gentle-ai_2.2.2_linux_amd64.tar.gz", sha256: createHash("sha256").update(payload).digest("hex"), url: "https://example.invalid/gentle-ai.tar.gz", executable: "gentle-ai" };
+	const asset = { name: "gentle-ai_2.4.0_linux_amd64.tar.gz", sha256: createHash("sha256").update(payload).digest("hex"), url: "https://example.invalid/gentle-ai.tar.gz", executable: "gentle-ai" };
 	const options = {
 		packageRoot,
 		platform: "linux",
@@ -603,7 +603,7 @@ test("Darwin/Linux signed bundles retain their four-field manifest and reusable
 		},
 	};
 	await installGentleAi(options);
-	const manifestPath = join(packageRoot, ".gentle-ai", "v2.2.2", "integrity.json");
+	const manifestPath = join(packageRoot, ".gentle-ai", "v2.4.0", "integrity.json");
 	const manifest = JSON.parse(await readFile(manifestPath, "utf8")) as Record<string, string>;
 	assert.deepEqual(Object.keys(manifest), ["version", "asset", "assetSha256", "binarySha256"]);
 	assert.equal((await installGentleAi({ ...options, download: async () => { throw new Error("signed bundle must be reused"); } })).installed, false);
@@ -680,7 +680,7 @@ test("checksum mismatch cleans temporary state without promoting a binary", asyn
 		}),
 		/checksum mismatch/,
 	);
-	assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.2.2", "gentle-ai")), false);
+	assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.4.0", "gentle-ai")), false);
 	assert.deepEqual((await readdir(packageRoot)).filter((entry) => entry.startsWith(".gentle-ai-install-")), []);
 });
 
@@ -702,7 +702,7 @@ test("installer promotes only the expected regular executable with executable PO
 			await chmod(extracted, 0o700);
 		},
 	});
-	const binary = join(packageRoot, ".gentle-ai", "v2.2.2", "gentle-ai");
+	const binary = join(packageRoot, ".gentle-ai", "v2.4.0", "gentle-ai");
 	assert.equal(existsSync(binary), true);
 	assert.equal(await readFile(binary, "utf8"), "native executable");
 	assert.ok(((await stat(binary)).mode & 0o111) !== 0);
@@ -733,7 +733,7 @@ test("installer rejects an extracted binary that differs from its pinned digest"
 		}),
 		/binary checksum mismatch/,
 	);
-	assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.2.2", "gentle-ai")), false);
+	assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.4.0", "gentle-ai")), false);
 });
 
 test("installer repairs a valid non-executable POSIX binary instead of reusing it", async (t) => {
@@ -756,7 +756,7 @@ test("installer repairs a valid non-executable POSIX binary instead of reusing i
 		},
 	};
 	await installGentleAi(options);
-	const binary = join(packageRoot, ".gentle-ai", "v2.2.2", "gentle-ai");
+	const binary = join(packageRoot, ".gentle-ai", "v2.4.0", "gentle-ai");
 	await chmod(binary, 0o600);
 	const repaired = await installGentleAi(options);
 	assert.equal(repaired.installed, true);
@@ -793,7 +793,7 @@ test("installer rejects archives with multiple expected executable entries", asy
 		}),
 		/exactly one regular gentle-ai/,
 	);
-	assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.2.2", "gentle-ai")), false);
+	assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.4.0", "gentle-ai")), false);
 });
 
 test("installer rejects an archive without the expected regular executable", async () => {
@@ -811,5 +811,5 @@ test("installer rejects an archive without the expected regular executable", asy
 		}),
 		/non-regular gentle-ai/,
 	);
-	assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.2.2", "gentle-ai")), false);
+	assert.equal(existsSync(join(packageRoot, ".gentle-ai", "v2.4.0", "gentle-ai")), false);
 });

package/tests/git-commit-transaction.test.ts

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
@@ -8,12 +9,14 @@ import { setTimeout as delay } from "node:timers/promises";
 import {
 	COMMIT_TRANSACTION_STATE,
 	assertNoUnresolvedCommitTransaction,
+	abandonCommitTransaction,
 	inspectCommitTransaction,
 	prepareCommitTransactionInvocation,
 	reconcileCommitTransaction,
 	runGitCommitTransaction,
 	verifyCommitTransactionResult,
 } from "../lib/git-commit-transaction.ts";
+import type { CommitTransactionInvocation } from "../lib/git-commit-transaction.ts";
 import type { NativeReviewCli, NativeValidateResult } from "../lib/native-review-cli.ts";
 
 function git(cwd: string, ...arguments_: string[]): string {
@@ -300,3 +303,228 @@ test("cancellation cannot strand a commit after HEAD advances", async (t) => {
 	assert.equal(result.status, "committed");
 	assert.deepEqual(inspectCommitTransaction(cwd), { status: "clean" });
 });
+
+function unbornRepository(t: test.TestContext): string {
+	const cwd = mkdtempSync(join(tmpdir(), "gentle-pi-commit-transaction-unborn-"));
+	t.after(() => rmSync(cwd, { recursive: true, force: true }));
+	git(cwd, "init", "-b", "main");
+	git(cwd, "config", "user.name", "Commit Transaction Test");
+	git(cwd, "config", "user.email", "commit-transaction@example.invalid");
+	writeFileSync(join(cwd, "initial.txt"), "first commit\n");
+	git(cwd, "add", "initial.txt");
+	return cwd;
+}
+
+test("an unborn repository creates its first reviewed commit without a prior HEAD", async (t) => {
+	const cwd = unbornRepository(t);
+	const intendedTree = git(cwd, "write-tree");
+	const command = `git commit ${JSON.stringify("-m")} ${JSON.stringify("initial")}`;
+	const invocation = prepareCommitTransactionInvocation({
+		command,
+		cwd,
+		arguments: ["-m", "initial"],
+		authorization: {
+			lineageId: "unborn-first",
+			storeRevision: "sha256:" + "a".repeat(64),
+			fingerprint: "sha256:" + "b".repeat(64),
+			intendedTree,
+		},
+	});
+	const result = await runGitCommitTransaction(invocation, { nativeReviewCli: native(cwd, "unborn-first") });
+	assert.equal(result.status, "committed");
+	assert.equal(result.tree, intendedTree);
+	assert.equal(result.head, git(cwd, "rev-parse", "HEAD"));
+	assert.equal(git(cwd, "rev-parse", "HEAD^{tree}"), intendedTree);
+	assert.deepEqual(inspectCommitTransaction(cwd), { status: "clean" });
+	const verified = verifyCommitTransactionResult(cwd, result.transactionId);
+	assert.equal(verified.tree, intendedTree);
+});
+
+test("an unborn repository that fails to commit leaves no HEAD and allows exact retry", async (t) => {
+	const cwd = unbornRepository(t);
+	const intendedTree = git(cwd, "write-tree");
+	const command = `git commit ${JSON.stringify("-m")} ${JSON.stringify("initial")}`;
+	const invocation = prepareCommitTransactionInvocation({
+		command,
+		cwd,
+		arguments: ["-m", "initial"],
+		authorization: {
+			lineageId: "unborn-retry",
+			storeRevision: "sha256:" + "a".repeat(64),
+			fingerprint: "sha256:" + "b".repeat(64),
+			intendedTree,
+		},
+	});
+	await assert.rejects(
+		runGitCommitTransaction(invocation, { nativeReviewCli: native(cwd, "unborn-retry", "invalidated") }),
+		/native pre-commit validation denied/,
+	);
+	assert.throws(() => git(cwd, "rev-parse", "--verify", "HEAD"), /fatal|Needed/i);
+	assert.equal(inspectCommitTransaction(cwd).record?.state, COMMIT_TRANSACTION_STATE.VALIDATION_FAILED);
+	// A denied attempt leaves the index intact and HEAD unborn, so the exact
+	// commit command can be retried. The failed transaction requires explicit
+	// recovery: abandon archives it (HEAD never moved, so abandon is allowed),
+	// then a fresh invocation authorizes the same tree and commits successfully.
+	abandonCommitTransaction(cwd);
+	assert.equal(inspectCommitTransaction(cwd).status, "clean");
+	const retry = prepareCommitTransactionInvocation({
+		command,
+		cwd,
+		arguments: ["-m", "initial"],
+		authorization: {
+			lineageId: "unborn-retry",
+			storeRevision: "sha256:" + "a".repeat(64),
+			fingerprint: "sha256:" + "b".repeat(64),
+			intendedTree,
+		},
+	});
+	const result = await runGitCommitTransaction(retry, { nativeReviewCli: native(cwd, "unborn-retry") });
+	assert.equal(result.status, "committed");
+	assert.equal(result.tree, intendedTree);
+	assert.equal(result.head, git(cwd, "rev-parse", "HEAD"));
+	assert.equal(git(cwd, "rev-parse", "HEAD^{tree}"), intendedTree);
+	assert.deepEqual(inspectCommitTransaction(cwd), { status: "clean" });
+	const verified = verifyCommitTransactionResult(cwd, result.transactionId);
+	assert.equal(verified.tree, intendedTree);
+});
+
+function unbornInvocation(cwd: string, lineageId: string): CommitTransactionInvocation {
+	return prepareCommitTransactionInvocation({
+		command: "git commit -m initial",
+		cwd,
+		arguments: ["-m", "initial"],
+		authorization: {
+			lineageId,
+			storeRevision: "sha256:" + "a".repeat(64),
+			fingerprint: "sha256:" + "b".repeat(64),
+			intendedTree: git(cwd, "write-tree"),
+		},
+	});
+}
+
+// Mirrors lib/git-commit-transaction.ts canonicalJson + sha256 so tests can
+// prove the durable repository identity is byte-for-byte compatible with the
+// previous formula `sha256(canonicalJson({ common_directory: commonDir, roots }))`.
+function canonicalJson(value: unknown): string {
+	if (value === null || typeof value !== "object") return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	const object = value as Record<string, unknown>;
+	return `{${Object.keys(object).filter((key) => object[key] !== undefined).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(",")}}`;
+}
+function identitySha256(value: string): string {
+	return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+
+test("a born repository keeps the durable transaction identity formula with sorted root commits across the unborn-handling upgrade", async (t) => {
+	const cwd = repository(t);
+	stage(cwd);
+	installHook(cwd, "pre-commit", "exit 23");
+	const commonDir = realpathSync(git(cwd, "rev-parse", "--path-format=absolute", "--git-common-dir"));
+	const roots = git(cwd, "rev-list", "--max-parents=0", "HEAD").split(/\r?\n/).filter(Boolean).sort();
+	const expected = identitySha256(canonicalJson({ common_directory: commonDir, roots }));
+	await assert.rejects(
+		runGitCommitTransaction(invocation(cwd, "born-identity"), { nativeReviewCli: native(cwd, "born-identity") }),
+		/pre-commit hook failed/,
+	);
+	const record = inspectCommitTransaction(cwd).record;
+	assert.ok(record, "a failing hook leaves an active transaction record carrying the repository identity");
+	assert.equal(record!.repository_id, expected);
+	assert.equal(record!.common_directory, commonDir);
+	abandonCommitTransaction(cwd);
+	assert.equal(inspectCommitTransaction(cwd).status, "clean");
+});
+
+test("an unborn repository derives a deterministic repository identity without rev-list HEAD and without masking errors", async (t) => {
+	const cwd = unbornRepository(t);
+	const commonDir = realpathSync(git(cwd, "rev-parse", "--path-format=absolute", "--git-common-dir"));
+	// Unborn has no root commits reachable from HEAD; the identity uses the
+	// empty roots set, which is deterministic and avoids `rev-list HEAD`.
+	const expected = identitySha256(canonicalJson({ common_directory: commonDir, roots: [] }));
+	const intendedTree = git(cwd, "write-tree");
+	const command = `git commit ${JSON.stringify("-m")} ${JSON.stringify("initial")}`;
+	const invocation = prepareCommitTransactionInvocation({
+		command,
+		cwd,
+		arguments: ["-m", "initial"],
+		authorization: {
+			lineageId: "unborn-identity",
+			storeRevision: "sha256:" + "a".repeat(64),
+			fingerprint: "sha256:" + "b".repeat(64),
+			intendedTree,
+		},
+	});
+	await assert.rejects(
+		runGitCommitTransaction(invocation, { nativeReviewCli: native(cwd, "unborn-identity", "invalidated") }),
+		/native pre-commit validation denied/,
+	);
+	const record = inspectCommitTransaction(cwd).record;
+	assert.ok(record, "a denied unborn attempt leaves an active transaction record carrying the repository identity");
+	assert.equal(record!.repository_id, expected);
+	assert.equal(record!.common_directory, commonDir);
+	abandonCommitTransaction(cwd);
+	assert.equal(inspectCommitTransaction(cwd).status, "clean");
+});
+
+// Resolves the canonical absolute git common directory for asserting the
+// absence of the transaction state root without assuming a literal `.git`.
+function transactionStateRoot(cwd: string): string {
+	const commonDir = realpathSync(git(cwd, "rev-parse", "--path-format=absolute", "--git-common-dir"));
+	return join(commonDir, "gentle-pi", "commit-transactions");
+}
+
+test("preparation fails closed for a corrupt HEAD ref without writing transaction state and reports corruption", (t) => {
+	const cwd = unbornRepository(t);
+	// A garbage ref (not a valid SHA) makes HEAD unresolvable. Resolving root
+	// commits during repository binding rethrows, so preparation must throw,
+	// no transaction state may be written, and inspection reports corruption
+	// (repository identity itself cannot be resolved while HEAD is corrupt).
+	mkdirSync(join(cwd, ".git", "refs", "heads"), { recursive: true });
+	writeFileSync(join(cwd, ".git", "refs", "heads", "main"), "z".repeat(40));
+	assert.throws(() => unbornInvocation(cwd, "corrupt-head"));
+	assert.equal(existsSync(transactionStateRoot(cwd)), false, "no transaction state root is written for a corrupt HEAD");
+	const inspection = inspectCommitTransaction(cwd);
+	assert.equal(inspection.status, "corrupted", "repository corruption makes inspection corrupted even with no transaction state written");
+	assert.ok(typeof inspection.reason === "string" && inspection.reason.length > 0, "inspection reason is present and actionable");
+});
+
+test("preparation fails closed for a symbolic HEAD pointing at a missing object instead of classifying it as unborn", (t) => {
+	const cwd = unbornRepository(t);
+	// A valid-format SHA with no object: rev-parse --verify HEAD succeeds, so
+	// resolveHead returns a commit id rather than classifying HEAD as unborn.
+	// Resolving root commits then fails on the missing object, so preparation
+	// must throw, no transaction state may be written, and inspection reports
+	// corruption. This must never be classified as an unborn empty-roots repo.
+	mkdirSync(join(cwd, ".git", "refs", "heads"), { recursive: true });
+	writeFileSync(join(cwd, ".git", "refs", "heads", "main"), "0123456789abcdef0123456789abcdef01234567\n");
+	assert.throws(() => unbornInvocation(cwd, "missing-object-head"));
+	assert.equal(existsSync(transactionStateRoot(cwd)), false, "no transaction state root is written for a missing-object HEAD");
+	const inspection = inspectCommitTransaction(cwd);
+	assert.equal(inspection.status, "corrupted", "a missing-object HEAD is repository corruption, not a clean or unborn repo");
+	assert.ok(typeof inspection.reason === "string" && inspection.reason.length > 0, "inspection reason is present and actionable");
+});
+
+test("resolveHead propagates a probe timeout instead of masking it as an unborn HEAD", (t) => {
+	const cwd = unbornRepository(t);
+	const wrapperDir = mkdtempSync(join(tmpdir(), "gentle-pi-commit-transaction-timeout-"));
+	t.after(() => rmSync(wrapperDir, { recursive: true, force: true }));
+	const realGit = execFileSync("which", ["git"], { encoding: "utf8" }).trim();
+	writeFileSync(join(wrapperDir, "git"), `#!/bin/sh\nif [ "$1" = "rev-parse" ] && [ "$2" = "--verify" ] && [ "$3" = "HEAD" ] && [ $# -eq 3 ]; then\nsleep 30\nelse\nexec ${realGit} "$@"\nfi\n`);
+	chmodSync(join(wrapperDir, "git"), 0o755);
+	const originalPath = process.env.PATH;
+	process.env.PATH = `${wrapperDir}:${originalPath}`;
+	try {
+		// The probe wrapper sleeps past GIT_TIMEOUT_MS (10s), so execFileSync
+		// kills the process and resolveHead rethrows the raw timeout error
+		// rather than classifying it as an unborn HEAD. Accept only a failure
+		// that genuinely represents a timeout, not any arbitrary error.
+		assert.throws(
+			() => unbornInvocation(cwd, "timeout-head"),
+			(error: unknown) => error !== null && typeof error === "object"
+				&& ((error as { code?: unknown }).code === "ETIMEDOUT" || (error as { killed?: unknown }).killed === true),
+			"resolveHead must propagate a probe timeout instead of masking it as an unborn HEAD",
+		);
+	} finally {
+		process.env.PATH = originalPath;
+	}
+	assert.equal(inspectCommitTransaction(cwd).status, "clean");
+});