gentle-pi 2.1.2 → 2.3.0

package/tests/native-sdd-attempt-authority.test.ts

@@ -0,0 +1,235 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import test from "node:test";
+
+// ---------------------------------------------------------------------------
+// Native SDD Runtime Attempt Authority contract tests (issue #256 track 3).
+//
+// Locks the Pi-owned lazy-loaded orchestration/status contract that ports the
+// released Gentle AI v2.4.0 compact SDD attempt ledger authority. Pi must NOT
+// implement a local attempt runtime; it must route every runtime-bearing
+// sdd-apply/sdd-verify/remediation launch through the provider compact CLI.
+//
+// Both assets are Markdown contracts consumed by orchestrators; these tests
+// read the real repo files and assert the essential semantics, not merely
+// keyword presence. Negative controls guard against caller-authored
+// counters, OpenSpec/Engram attempt ledgers, automatic reset, and legacy
+// status|begin|finish|reset normal-flow routing.
+// ---------------------------------------------------------------------------
+
+const ROOT = join(import.meta.dirname, "..");
+const WORKFLOW = "assets/sdd-orchestrator-workflow.md";
+const STATUS_CONTRACT = "assets/support/sdd-status-contract.md";
+const SECTION = "Native Runtime Attempt Authority";
+
+function read(path: string): string {
+	return readFileSync(join(ROOT, path), "utf8");
+}
+
+function readMarkdownSection(source: string, heading: string): string {
+	const lines = source.split(/\r?\n/);
+	const matches = lines.flatMap((line, index) => {
+		const match = line.match(/^(#{1,6})\s+(.+?)\s*$/);
+		return match?.[2] === heading ? [{ index, level: match[1].length }] : [];
+	});
+	assert.equal(
+		matches.length,
+		1,
+		`Markdown must contain exactly one "${heading}" section (found ${matches.length})`,
+	);
+	const [{ index: start, level }] = matches;
+	const relativeEnd = lines.slice(start + 1).findIndex((line) => {
+		const match = line.match(/^(#{1,6})\s+/);
+		return match !== null && match[1].length <= level;
+	});
+	const end = relativeEnd === -1 ? lines.length : start + 1 + relativeEnd;
+	return lines.slice(start + 1, end).join("\n").trim();
+}
+
+// Extracts one command line beginning with `commandPrefix` so payload args bind
+// to the correct command shape; `--cwd`, `--change`, `--request-id` appear in
+// both acquire and settle, so a section-wide match stays green on arg removal.
+function extractCommandLine(section: string, commandPrefix: string): string {
+	const escaped = commandPrefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	const re = new RegExp(`^[ \t]*${escaped}.*$`, "gm");
+	const matches = section.match(re) ?? [];
+	assert.equal(
+		matches.length,
+		1,
+		`Native Runtime Attempt Authority section must contain exactly one command line starting with "${commandPrefix}" (found ${matches.length})`,
+	);
+	const [line] = matches;
+	return line;
+}
+
+test("extractCommandLine rejects duplicate matching command lines (negative control)", () => {
+	for (const prefix of [
+		"gentle-ai sdd-attempt acquire ",
+		"gentle-ai sdd-attempt settle ",
+	]) {
+		const duplicate = [
+			`${prefix}--cwd repo --change change --request-id id`,
+			`${prefix}--cwd repo2 --change change2 --request-id id2`,
+		].join("\n");
+		assert.throws(
+			() => extractCommandLine(duplicate, prefix),
+			/exactly one command line/,
+			`duplicate ${prefix.trim()} lines must be rejected`,
+		);
+	}
+});
+
+test("workflow asset has exactly one Native Runtime Attempt Authority section", () => {
+	const section = readMarkdownSection(read(WORKFLOW), SECTION);
+	assert.ok(section.length > 0, "section must be non-empty");
+});
+
+test("status contract asset has exactly one Native Runtime Attempt Authority section", () => {
+	const section = readMarkdownSection(read(STATUS_CONTRACT), SECTION);
+	assert.ok(section.length > 0, "section must be non-empty");
+});
+
+test("workflow names acquire and settle as sole provider authority for OpenSpec and Engram", () => {
+	const section = readMarkdownSection(read(WORKFLOW), SECTION);
+	assert.match(section, /sdd-attempt acquire/);
+	assert.match(section, /sdd-attempt settle/);
+	assert.match(section, /sole attempt and changed-line budget authority/i);
+	assert.match(section, /Git-common-dir/);
+	assert.match(section, /OpenSpec and Engram/);
+});
+
+test("status contract names acquire and settle and forbids OpenSpec/Engram attempt ledgers", () => {
+	const section = readMarkdownSection(read(STATUS_CONTRACT), SECTION);
+	assert.match(section, /acquire/);
+	assert.match(section, /settle/);
+	assert.match(section, /OpenSpec or Engram attempt ledger/i);
+});
+
+test("workflow launches only on proceed; blocked and complete stop the launch", () => {
+	const section = readMarkdownSection(read(WORKFLOW), SECTION);
+	assert.match(section, /proceed/);
+	assert.match(section, /blocked/);
+	assert.match(section, /complete/);
+	assert.match(section, /launch only on `proceed`/i);
+	assert.match(section, /blocked.*do not launch/i);
+	assert.match(section, /complete.*do not launch/i);
+});
+
+test("workflow requires distinct request IDs with own-ID-only idempotent replay", () => {
+	const section = readMarkdownSection(read(WORKFLOW), SECTION);
+	assert.match(section, /distinct from acquire/i);
+	assert.match(section, /own ID only for idempotent replay/i);
+});
+
+test("workflow acquire command line binds every mandatory payload argument", () => {
+	const section = readMarkdownSection(read(WORKFLOW), SECTION);
+	const acquire = extractCommandLine(section, "gentle-ai sdd-attempt acquire ");
+	for (const arg of [
+		"--cwd <repo>",
+		"--change <change>",
+		"--request-id <id>",
+		"--work-unit <label>",
+		"--evidence-goal <goal>",
+		"--max-attempts <count>",
+		"--max-changed-lines <count>",
+	]) {
+		assert.ok(acquire.includes(arg), `acquire command is missing ${arg}; command: ${acquire}`);
+	}
+});
+
+test("workflow settle command line binds mandatory arguments and routing invariants", () => {
+	const section = readMarkdownSection(read(WORKFLOW), SECTION);
+	const settle = extractCommandLine(section, "gentle-ai sdd-attempt settle ");
+	for (const arg of [
+		"--cwd <repo>",
+		"--change <change>",
+		"--token <token>",
+		"--request-id <id>",
+		"--outcome <failed|interrupted|passed>",
+		"--evidence-revision <sha256:...>",
+		"--diagnosis <text>",
+		"--harness-disposition <reused|invalidated>",
+		"--cleanup-evidence <text>",
+		"--process-evidence <text>",
+	]) {
+		assert.ok(settle.includes(arg), `settle command is missing ${arg}; command: ${settle}`);
+	}
+	assert.match(section, /never `none`/);
+	assert.match(section, /proceed\|blocked\|complete/);
+	assert.match(section, /--successor-lineage/);
+	assert.match(section, /--remediates-evidence-revision/);
+});
+
+test("workflow forbids caller-authored counters and Pi-owned attempt state", () => {
+	const section = readMarkdownSection(read(WORKFLOW), SECTION);
+	assert.match(section, /never persist caller-authored/i);
+	assert.match(section, /OpenSpec artifacts, Engram memory/);
+	assert.match(section, /counter|token store|state machine|interception/i);
+});
+
+test("workflow states reset is never automatic and names compatibility surfaces", () => {
+	const section = readMarkdownSection(read(WORKFLOW), SECTION);
+	assert.match(section, /`status`, `begin`, `finish`, and `reset`/);
+	assert.match(section, /diagnostic\/compatibility surfaces/);
+	assert.match(section, /not the normal runtime route/i);
+	assert.match(section, /reset.*never automatic/i);
+	assert.match(section, /explicit maintainer scope decision/);
+});
+
+test("workflow gatekeeper rerun is subordinate to a fresh native acquire", () => {
+	const section = readMarkdownSection(read(WORKFLOW), SECTION);
+	assert.match(section, /rerun never bypasses native attempt authority/i);
+	assert.match(section, /fresh compact acquire/i);
+	// The gatekeeper quality rule is preserved (not deleted).
+	const gatekeeper = readMarkdownSection(read(WORKFLOW), "Automatic Mode Gatekeeper");
+	assert.match(gatekeeper, /rerun the same SDD phase once with corrective feedback/);
+	assert.match(gatekeeper, /Validate the rerun/);
+});
+
+test("workflow does not present status|begin|finish|reset as the primary route", () => {
+	const section = readMarkdownSection(read(WORKFLOW), SECTION);
+	assert.match(section, /not the normal runtime route/i);
+	assert.doesNotMatch(
+		section,
+		/primary route.*sdd-attempt (?:status|begin|finish|reset)/i,
+	);
+});
+
+test("status contract authority is artifact-store agnostic and excluded from SDD v1 status", () => {
+	const section = readMarkdownSection(read(STATUS_CONTRACT), SECTION);
+	assert.match(section, /artifact-store agnostic/i);
+	assert.match(section, /MUST NOT be embedded in the SDD v1 status/i);
+	assert.match(section, /separate from artifact dispatch/i);
+});
+
+test("status contract continuation rule: acquire before launch, settle after run, distinct IDs, provider states route, reset never automatic", () => {
+	const section = readMarkdownSection(read(STATUS_CONTRACT), SECTION);
+	assert.match(section, /before every runtime-bearing/i);
+	assert.match(section, /after the external run completes it MUST settle/i);
+	assert.match(section, /distinct/i);
+	assert.match(section, /proceed\|blocked\|complete/);
+	assert.match(section, /launch only on `proceed`/i);
+	assert.match(section, /reset.*never automatic/i);
+});
+
+test("status contract schema is unchanged (no attempt authority payload added)", () => {
+	const schema = readMarkdownSection(read(STATUS_CONTRACT), "Status Schema");
+	assert.doesNotMatch(
+		schema,
+		/attemptToken|attempt_token|attemptCount|attempt_counter|sddAttempt|sdd_attempt|nativeAttempt/i,
+		"Status Schema must not embed the runtime attempt authority payload",
+	);
+});
+
+test("status contract uses a runtime-safe semantic reference, not a repo-source assets/ path", () => {
+	const section = readMarkdownSection(read(STATUS_CONTRACT), SECTION);
+	assert.doesNotMatch(
+		section,
+		/See `assets\/sdd-orchestrator-workflow\.md`|see `assets\//i,
+		"status contract must not point installed consumers at a repo-source assets/ path; those are package source paths before installation",
+	);
+	assert.match(section, /lazy-loaded `SDD Orchestrator Workflow`/i);
+	assert.match(section, /Native Runtime Attempt Authority/);
+	assert.match(section, /Do not look up `assets\/\.\.\.` paths at runtime/i);
+});

package/tests/opaque-pi-reviewer-adapter.test.ts

@@ -0,0 +1,266 @@
+import assert from "node:assert/strict";
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import {
+	OPAQUE_PI_REVIEWER_ARGV,
+	OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE,
+	OpaquePiReviewerTransportError,
+	resolvePiLaunch,
+	runOpaquePiReviewer,
+} from "../lib/opaque-pi-reviewer-adapter.ts";
+
+const FAKE_PI = `#!/usr/bin/env node
+const fs = require("node:fs");
+const path = require("node:path");
+const argv = process.argv.slice(2);
+const chunks = [];
+process.stdin.on("data", (chunk) => chunks.push(chunk));
+process.stdin.on("end", () => {
+	const stdin = Buffer.concat(chunks);
+	if (process.env.OPAQUE_PI_STDIN_CAPTURE) fs.writeFileSync(process.env.OPAQUE_PI_STDIN_CAPTURE, stdin);
+	const mode = process.env.OPAQUE_PI_MODE || "ok";
+	const log = {
+		argv,
+		cwd: process.cwd(),
+		entries_before: fs.readdirSync(process.cwd()),
+		entries_after: fs.readdirSync(process.cwd()),
+	};
+	if (process.env.OPAQUE_PI_LOG) fs.appendFileSync(process.env.OPAQUE_PI_LOG, JSON.stringify(log) + "\\n");
+	if (mode === "break-cleanup" || process.env.OPAQUE_PI_BREAK_CLEANUP === "true") {
+		fs.chmodSync(path.dirname(process.cwd()), 0o500);
+	}
+	if (mode === "empty") process.exit(0);
+	if (mode === "hang") { setTimeout(() => process.exit(0), 10_000); return; }
+	if (mode === "nonzero") { process.stderr.write("opaque pi failed\\n"); process.exit(7); }
+	process.stdout.write(Buffer.from(process.env.OPAQUE_PI_OUTPUT_B64 || "", "base64"));
+});
+`;
+
+const PROMPT_BYTES = Buffer.concat([
+	Buffer.from("opaque prompt\r\n\u0000", "utf8"),
+	Buffer.from([0x01, 0xff, 0xfe, 0x00]),
+]);
+const OUTPUT_BYTES = Buffer.concat([
+	Buffer.from("opaque output\r\n\u0000", "utf8"),
+	Buffer.from([0x07, 0xff, 0xfe, 0x00]),
+]);
+
+interface OpaqueHarness {
+	directory: string;
+	pi: string;
+	logPath: string;
+	stdinCapturePath: string;
+	environment: NodeJS.ProcessEnv;
+}
+
+interface OpaquePiLog {
+	argv: string[];
+	cwd: string;
+	entries_before: string[];
+	entries_after: string[];
+}
+
+function harness(t: test.TestContext, overrides: Record<string, string> = {}): OpaqueHarness {
+	const directory = mkdtempSync(join(tmpdir(), "gentle-pi-opaque-reviewer-"));
+	t.after(() => rmSync(directory, { recursive: true, force: true }));
+	const pi = join(directory, "pi");
+	writeFileSync(pi, FAKE_PI);
+	chmodSync(pi, 0o755);
+	const logPath = join(directory, "pi.log");
+	const stdinCapturePath = join(directory, "stdin.bin");
+	return {
+		directory,
+		pi,
+		logPath,
+		stdinCapturePath,
+		environment: {
+			...process.env,
+			OPAQUE_PI_LOG: logPath,
+			OPAQUE_PI_STDIN_CAPTURE: stdinCapturePath,
+			OPAQUE_PI_OUTPUT_B64: OUTPUT_BYTES.toString("base64"),
+			...overrides,
+		},
+	};
+}
+
+function readLog(path: string): OpaquePiLog[] {
+	if (!existsSync(path)) return [];
+	return readFileSync(path, "utf8")
+		.split("\n")
+		.filter((line) => line.length > 0)
+		.map((line) => JSON.parse(line) as OpaquePiLog);
+}
+
+async function rejectsWithTransportError(
+	promise: Promise<unknown>,
+	kind: (typeof OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE)[keyof typeof OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE],
+): Promise<OpaquePiReviewerTransportError> {
+	let caught: OpaquePiReviewerTransportError | undefined;
+	await assert.rejects(promise, (error: unknown) => {
+		assert.ok(error instanceof OpaquePiReviewerTransportError, `expected OpaquePiReviewerTransportError, received ${String(error)}`);
+		caught = error;
+		return error.kind === kind;
+	});
+	return caught!;
+}
+
+test("the opaque adapter streams arbitrary prompt and stdout bytes verbatim through the fixed Pi subprocess", async (t) => {
+	const fixture = harness(t);
+	const result = await runOpaquePiReviewer(PROMPT_BYTES, {
+		piExecutable: fixture.pi,
+		environment: fixture.environment,
+		timeoutMs: 10_000,
+	});
+
+	assert.equal(result.promptByteLength, PROMPT_BYTES.length);
+	assert.equal(result.stdoutByteLength, OUTPUT_BYTES.length);
+	assert.deepEqual(result.stdout, OUTPUT_BYTES);
+	assert.deepEqual(readFileSync(fixture.stdinCapturePath), PROMPT_BYTES);
+
+	const calls = readLog(fixture.logPath);
+	assert.equal(calls.length, 1);
+	assert.deepEqual(calls[0]!.argv, [...OPAQUE_PI_REVIEWER_ARGV]);
+	assert.deepEqual(calls[0]!.entries_before, []);
+	assert.deepEqual(calls[0]!.entries_after, []);
+	assert.notEqual(calls[0]!.cwd, process.cwd());
+	assert.equal(existsSync(calls[0]!.cwd), false, "the empty scratch directory is removed after success");
+});
+
+test("the opaque adapter returns typed transport errors for launch, nonzero, empty, timeout, and cancellation", async (t) => {
+	const fixture = harness(t);
+	await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: join(fixture.directory, "missing-pi"), environment: fixture.environment, timeoutMs: 10_000 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.LAUNCH_FAILED,
+	);
+
+	const nonzero = await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: { ...fixture.environment, OPAQUE_PI_MODE: "nonzero" }, timeoutMs: 10_000 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.NONZERO_EXIT,
+	);
+	assert.equal(nonzero.exitCode, 7);
+	assert.deepEqual(nonzero.stderr, Buffer.from("opaque pi failed\n"));
+
+	await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: { ...fixture.environment, OPAQUE_PI_MODE: "empty" }, timeoutMs: 10_000 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.EMPTY_OUTPUT,
+	);
+
+	const timedOut = await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: { ...fixture.environment, OPAQUE_PI_MODE: "hang" }, timeoutMs: 300 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.TIMED_OUT,
+	);
+	assert.equal(timedOut.timedOut, true);
+
+	const controller = new AbortController();
+	const cancellation = runOpaquePiReviewer(PROMPT_BYTES, {
+		piExecutable: fixture.pi,
+		environment: { ...fixture.environment, OPAQUE_PI_MODE: "hang" },
+		timeoutMs: 10_000,
+		signal: controller.signal,
+	});
+	setTimeout(() => controller.abort(), 100).unref();
+	const cancelled = await rejectsWithTransportError(cancellation, OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.CANCELLED);
+	assert.equal(cancelled.cancelled, true);
+});
+
+test("the opaque adapter leaves no prompt or result file in scratch and reports cleanup failure as transport-only", async (t) => {
+	const fixture = harness(t);
+	const scratchParent = mkdtempSync(join(tmpdir(), "gentle-pi-opaque-reviewer-cleanup-"));
+	const originalTmpdir = process.env.TMPDIR;
+	process.env.TMPDIR = scratchParent;
+	try {
+		const error = await rejectsWithTransportError(
+			runOpaquePiReviewer(PROMPT_BYTES, {
+				piExecutable: fixture.pi,
+				environment: { ...fixture.environment, OPAQUE_PI_MODE: "break-cleanup" },
+				timeoutMs: 10_000,
+			}),
+			OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.CLEANUP_FAILED,
+		);
+		assert.match(error.message, /scratch directory/i);
+	} finally {
+		if (originalTmpdir === undefined) delete process.env.TMPDIR;
+		else process.env.TMPDIR = originalTmpdir;
+		chmodSync(scratchParent, 0o700);
+		rmSync(scratchParent, { recursive: true, force: true });
+	}
+});
+
+test("the opaque adapter preserves primary nonzero and timeout errors when scratch cleanup also fails", async (t) => {
+	const fixture = harness(t);
+	const scratchParent = mkdtempSync(join(tmpdir(), "gentle-pi-opaque-reviewer-primary-failure-"));
+	const originalTmpdir = process.env.TMPDIR;
+	process.env.TMPDIR = scratchParent;
+	try {
+		const nonzero = await rejectsWithTransportError(
+			runOpaquePiReviewer(PROMPT_BYTES, {
+				piExecutable: fixture.pi,
+				environment: { ...fixture.environment, OPAQUE_PI_MODE: "nonzero", OPAQUE_PI_BREAK_CLEANUP: "true" },
+				timeoutMs: 10_000,
+			}),
+			OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.NONZERO_EXIT,
+		);
+		assert.equal(nonzero.exitCode, 7);
+		assert.deepEqual(nonzero.stderr, Buffer.from("opaque pi failed\n"));
+		chmodSync(scratchParent, 0o700);
+
+		const timedOut = await rejectsWithTransportError(
+			runOpaquePiReviewer(PROMPT_BYTES, {
+				piExecutable: fixture.pi,
+				environment: { ...fixture.environment, OPAQUE_PI_MODE: "hang", OPAQUE_PI_BREAK_CLEANUP: "true" },
+				timeoutMs: 300,
+			}),
+			OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.TIMED_OUT,
+		);
+		assert.equal(timedOut.timedOut, true);
+	} finally {
+		if (originalTmpdir === undefined) delete process.env.TMPDIR;
+		else process.env.TMPDIR = originalTmpdir;
+		chmodSync(scratchParent, 0o700);
+		rmSync(scratchParent, { recursive: true, force: true });
+	}
+});
+
+test("the opaque adapter has no review lifecycle imports or identifiers", () => {
+	const adapterPath = fileURLToPath(new URL("../lib/opaque-pi-reviewer-adapter.ts", import.meta.url));
+	const source = readFileSync(adapterPath, "utf8");
+	assert.doesNotMatch(source, /review-integration|gentle-ai|materialize|submit/i);
+	for (const identifier of ["lineage", "target", "revision", "receipt", "lens", "order", "subject", "schema", "capture", "submission", "status", "model", "provider", "profile"]) {
+		assert.doesNotMatch(source, new RegExp(`\\b${identifier}\\b`, "i"), `adapter must not contain lifecycle identifier ${identifier}`);
+	}
+});
+
+// #468 / #519: on Windows a bare `pi` resolves to pi.cmd, pi.ps1, or a POSIX
+// shim, none of which Node can spawn with shell:false (EINVAL or ENOENT). The
+// relay already runs inside Pi, so the host's own JavaScript entry is spawned
+// through process.execPath instead. Other platforms keep today's exact shape.
+test("the Pi launch shape spawns the host entry through process.execPath on win32 and stays byte-identical elsewhere", () => {
+	const host = {
+		execPath: "C:\\Program Files\\nodejs\\node.exe",
+		entry: "C:\\Users\\dev\\AppData\\Local\\pnpm\\global\\5\\node_modules\\@earendil-works\\pi-coding-agent\\dist\\bundle\\cli.js",
+	};
+	const windows = resolvePiLaunch(undefined, "win32", host);
+	assert.deepEqual(windows, { file: host.execPath, arguments: [host.entry, ...OPAQUE_PI_REVIEWER_ARGV] });
+	assert.notEqual(windows.file, "pi");
+	assert.equal(windows.arguments.includes("pi"), false);
+	for (const platform of ["linux", "darwin", "freebsd"] as const) {
+		assert.deepEqual(resolvePiLaunch(undefined, platform, host), { file: "pi", arguments: [...OPAQUE_PI_REVIEWER_ARGV] }, platform);
+		assert.deepEqual(resolvePiLaunch("/opt/pi/bin/pi", platform, host), { file: "/opt/pi/bin/pi", arguments: [...OPAQUE_PI_REVIEWER_ARGV] }, platform);
+	}
+	assert.deepEqual(resolvePiLaunch("C:\\tools\\pi.exe", "win32", host), { file: "C:\\tools\\pi.exe", arguments: [...OPAQUE_PI_REVIEWER_ARGV] });
+	for (const entry of [undefined, "", "cli.js", "dist/bundle/cli.js"]) {
+		assert.throws(() => resolvePiLaunch(undefined, "win32", { execPath: host.execPath, entry }), /host entry/, `entry ${JSON.stringify(entry)} must fail closed instead of spawning a bare pi`);
+	}
+});
+
+test("the default Pi launch resolves from the running host process", () => {
+	const launch = resolvePiLaunch(undefined);
+	if (process.platform === "win32") {
+		assert.deepEqual(launch, { file: process.execPath, arguments: [process.argv[1]!, ...OPAQUE_PI_REVIEWER_ARGV] });
+	} else {
+		assert.deepEqual(launch, { file: "pi", arguments: [...OPAQUE_PI_REVIEWER_ARGV] });
+	}
+});