gentle-pi 2.1.2 → 2.3.0

package/tests/review-actor-tool-deny.test.ts

@@ -12,13 +12,15 @@ const ROOT = join(import.meta.dirname, "..");
 const ASSETS_AGENTS_DIR = join(ROOT, "assets", "agents");
 const DENY_ALL_RULE = '"*": false';
 
+// gentle-pi#311 P5: review-refuter.md and review-validator.md are retired —
+// the adversarial roles execute through Go-owned pi processes via
+// provider-rendered self-contained vectors, so no Pi agent definition exists
+// for them to deny tools on.
 const READ_ONLY_REVIEW_ACTORS = [
 	"review-risk.md",
 	"review-reliability.md",
 	"review-resilience.md",
 	"review-readability.md",
-	"review-refuter.md",
-	"review-validator.md",
 	"jd-judge-a.md",
 	"jd-judge-b.md",
 ] as const;
@@ -88,11 +90,15 @@ test("every read-only review actor leads its tool map with the deny-all rule", (
 });
 
 test("a tool absent from the allowlist resolves to denied under the deny-all rule", () => {
+	// Mirrors the tool names a real Pi child session can resolve. `glob` is
+	// deliberately absent: it is not a Pi builtin, so a lens that declares it
+	// silently loses filesystem discovery instead of failing loudly. Keeping
+	// the fiction here is what let that ship green.
 	const registry = [
 		"read",
 		"grep",
-		"glob",
 		"find",
+		"gentle_review_scope",
 		"edit",
 		"write",
 		"bash",
@@ -102,15 +108,8 @@ test("a tool absent from the allowlist resolves to denied under the deny-all rul
 		"subagent_run",
 	] as const;
 
-	const refuterEntries = readToolEntries(join(ASSETS_AGENTS_DIR, "review-refuter.md"));
-	const refuterActive = resolveActiveTools(refuterEntries, registry);
-	assert.deepEqual(refuterActive, ["read", "grep", "find"]);
-	for (const omitted of ["edit", "write", "bash", "mem_save", "codegraph_explore", "mcp__slack__slack_send_message", "subagent_run"]) {
-		assert.ok(!refuterActive.includes(omitted), `review-refuter must deny omitted tool ${omitted}`);
-	}
-
-	// The four lenses deny bash, matching gentle-ai's own Claude-runtime lens
-	// agents (`tools: Read, Grep, Glob`) exactly. Contract v2 is explicit: a
+	// The four lenses deny bash and add only the bounded scope reader required
+	// to consume controller-owned compact manifests. Contract v2 is explicit: a
 	// runtime that cannot enforce a per-command Git shell boundary exposes no
 	// shell and reports incomplete inspection rather than claiming backend
 	// enforcement. Pi has no per-command scoping layer, so unrestricted bash
@@ -124,7 +123,7 @@ test("a tool absent from the allowlist resolves to denied under the deny-all rul
 	// the other half of the same rule, not an exception to it.
 	for (const lens of ["review-risk", "review-resilience", "review-readability", "review-reliability"]) {
 		const lensActive = resolveActiveTools(readToolEntries(join(ASSETS_AGENTS_DIR, `${lens}.md`)), registry);
-		assert.deepEqual(lensActive, ["read", "grep", "glob"], `${lens} must expose exactly read, grep, and glob`);
+		assert.deepEqual(lensActive, ["read", "grep", "find", "gentle_review_scope"], `${lens} must expose only candidate readers and the bounded scope reader`);
 		for (const omitted of ["bash", "edit", "write", "mem_save", "codegraph_explore", "mcp__slack__slack_send_message", "subagent_run"]) {
 			assert.ok(!lensActive.includes(omitted), `${lens} must deny ${omitted}`);
 		}

package/tests/review-authority-recovery-docs.test.ts

@@ -17,11 +17,10 @@ test("recovery guidance documents the narrow published native maintenance contra
 	assert.match(README, /review dispose-result.*unsupported.*pending.*design/i);
 	assert.match(README, /RESET.*RECOVER.*destructive/i);
 	assert.match(README, /typed envelopes/i);
-	assert.match(README, /pre-commit.*pre-push.*pre-PR.*release/is);
 });
 
 test("controller help keeps authorization, blocked outcomes, and recovery boundaries explicit", () => {
-	assert.match(CONTROLLER, /v2\.1\.11 repair-legacy-alias.*fresh native inventory.*fresh UI approval/is);
+	assert.match(CONTROLLER, /REPAIR_LEGACY_ALIAS.*freshly reads native inventory.*interactive approval/is);
 	assert.match(CONTROLLER, /unchanged_target,malformed_recovery_authorization/);
 	assert.match(CONTROLLER, /provider-selected recovery disposition/);
 	assert.match(CONTROLLER, /headlessly|headless/i);