gentle-pi 2.3.0 → 2.5.0

package/tests/review-session-standing-permission-ipc.test.ts

@@ -0,0 +1,233 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { PassThrough, Writable } from "node:stream";
+import test from "node:test";
+
+const REPOSITORY_ID = `sha256:${"a".repeat(64)}`;
+const OTHER_REPOSITORY_ID = `sha256:${"b".repeat(64)}`;
+
+import {
+	CHILD_STANDING_REVIEW_PERMISSION_REGISTRY_SYMBOL,
+	ChildStandingReviewPermissionClient,
+	createChildStandingReviewPermissionClient,
+	ParentStandingReviewPermissionBroker,
+} from "../lib/review-session-standing-permission-ipc.ts";
+
+function pair() {
+	const childToParent = new PassThrough();
+	const parentToChild = new PassThrough();
+	return {
+		child: { readable: parentToChild, writable: childToParent },
+		parent: { readable: childToParent, writable: parentToChild },
+		close() {
+			childToParent.destroy();
+			parentToChild.destroy();
+		},
+	};
+}
+
+async function productionChild(requests: number, authorize: () => boolean, options: { maxRequests?: number; closeChannel?: boolean; withoutChannel?: boolean } = {}): Promise<boolean[]> {
+	const moduleUrl = new URL("../lib/review-session-standing-permission-ipc.ts", import.meta.url).href;
+	const source = `
+		import { createChildStandingReviewPermissionClient } from ${JSON.stringify(moduleUrl)};
+		const client = createChildStandingReviewPermissionClient();
+		const answers = [];
+		for (let index = 0; index < ${requests}; index += 1) answers.push(await client?.requestAuthorization(${JSON.stringify(REPOSITORY_ID)}) ?? false);
+		client?.close();
+		process.stdout.write(JSON.stringify(answers));
+	`;
+	const child = spawn(process.execPath, ["--experimental-strip-types", "--input-type=module", "--eval", source], {
+		env: { ...process.env, GENTLE_PI_AGENTS_CHILD: "1", GENTLE_PI_AGENTS_PARENT_PERMISSION_FD: "3" },
+		stdio: options.withoutChannel ? ["ignore", "pipe", "pipe"] : ["ignore", "pipe", "pipe", "pipe"],
+	});
+	const pipe = child.stdio[3];
+	const broker = pipe === null || pipe === undefined
+		? undefined
+		: new ParentStandingReviewPermissionBroker({ readable: pipe, writable: pipe }, authorize, options);
+	if (options.closeChannel && pipe !== null && pipe !== undefined) {
+		broker?.close();
+		pipe.destroy();
+	}
+	let stdout = "";
+	let stderr = "";
+	child.stdout.on("data", (chunk: Buffer) => { stdout += chunk.toString("utf8"); });
+	child.stderr.on("data", (chunk: Buffer) => { stderr += chunk.toString("utf8"); });
+	return new Promise((resolve, reject) => child.once("exit", (code) => {
+		broker?.close();
+		if (code !== 0) reject(new Error(`child exited ${code}: ${stderr}`));
+		else resolve(JSON.parse(stdout) as boolean[]);
+	}));
+}
+
+test("the production child fd3 client gets grant, revocation, closure, denial, and request bounds from its parent broker", async () => {
+	let calls = 0;
+	assert.deepEqual(await productionChild(2, () => ++calls === 1), [true, false], "the parent rechecks authorization for each request");
+	assert.deepEqual(await productionChild(1, () => false), [false], "a child without a grant is denied");
+	assert.deepEqual(await productionChild(2, () => true, { maxRequests: 1 }), [true, false], "the parent caps requests per child channel");
+	assert.deepEqual(await productionChild(1, () => true, { closeChannel: true }), [false], "a closed fd3 channel fails closed without crashing the child");
+	assert.deepEqual(await productionChild(1, () => true, { withoutChannel: true }), [false], "a marked normal process without fd3 fails closed without crashing");
+});
+
+test("fresh Jiti moduleCache:false reloads share fd3 structurally and reject stale terminal callbacks", async () => {
+	const ipcUrl = new URL("../lib/review-session-standing-permission-ipc.ts", import.meta.url).href;
+	const extensionUrl = new URL("../extensions/gentle-ai.ts", import.meta.url).href;
+	const source = `
+		import { createJiti } from "jiti";
+		import { fileURLToPath } from "node:url";
+		const ipcPath = fileURLToPath(${JSON.stringify(ipcUrl)});
+		const extensionPath = fileURLToPath(${JSON.stringify(extensionUrl)});
+		const firstLoader = createJiti(import.meta.url, { moduleCache: false });
+		const firstExtension = await firstLoader.import(extensionPath, { default: true });
+		const firstIpc = await firstLoader.import(ipcPath, { default: false });
+		const shutdowns = [];
+		const pi = { on(name, handler) { if (name === "session_shutdown") shutdowns.push(handler); }, registerTool() {}, registerCommand() {}, events: { emit() {} } };
+		const context = { cwd: process.cwd(), sessionManager: { getSessionId: () => "child" }, ui: { setStatus() {} } };
+		firstExtension(pi);
+		const staleShutdown = shutdowns.at(-1);
+		const client = firstIpc.createChildStandingReviewPermissionClient();
+		const answers = [await client?.requestAuthorization(${JSON.stringify(REPOSITORY_ID)}) ?? false];
+		staleShutdown({ reason: "reload" }, context);
+		const secondLoader = createJiti(import.meta.url, { moduleCache: false });
+		const secondExtension = await secondLoader.import(extensionPath, { default: true });
+		const secondIpc = await secondLoader.import(ipcPath, { default: false });
+		secondExtension(pi);
+		const activeShutdown = shutdowns.at(-1);
+		answers.push(await secondIpc.createChildStandingReviewPermissionClient()?.requestAuthorization(${JSON.stringify(REPOSITORY_ID)}) ?? false);
+		staleShutdown({ reason: "new" }, context);
+		answers.push(await client?.requestAuthorization(${JSON.stringify(REPOSITORY_ID)}) ?? false);
+		activeShutdown({ reason: "new" }, context);
+		answers.push(await client?.requestAuthorization(${JSON.stringify(REPOSITORY_ID)}) ?? false);
+		process.stdout.write(JSON.stringify({ answers, classIdentityDiffers: firstIpc.ChildStandingReviewPermissionClient !== secondIpc.ChildStandingReviewPermissionClient }));
+	`;
+	const child = spawn(process.execPath, ["--experimental-strip-types", "--input-type=module", "--eval", source], {
+		env: { ...process.env, GENTLE_PI_AGENTS_CHILD: "1", GENTLE_PI_AGENTS_PARENT_PERMISSION_FD: "3" },
+		stdio: ["ignore", "pipe", "pipe", "pipe"],
+	});
+	const pipe = child.stdio[3];
+	assert.ok(pipe);
+	const broker = new ParentStandingReviewPermissionBroker({ readable: pipe, writable: pipe }, () => true);
+	let stdout = "";
+	let stderr = "";
+	child.stdout.on("data", (chunk: Buffer) => { stdout += chunk.toString("utf8"); });
+	child.stderr.on("data", (chunk: Buffer) => { stderr += chunk.toString("utf8"); });
+	const result = await new Promise<{ answers: boolean[]; classIdentityDiffers: boolean }>((resolve, reject) => child.once("exit", (code) => {
+		broker.close();
+		if (code !== 0) reject(new Error(`Jiti reload child exited ${code}: ${stderr}`));
+		else resolve(JSON.parse(stdout) as { answers: boolean[]; classIdentityDiffers: boolean });
+	}));
+	assert.equal(result.classIdentityDiffers, true, "fresh Jiti loaders must re-evaluate the IPC class");
+	assert.deepEqual(result.answers, [true, true, true, false], "reload shares one client, stale owners cannot close it, and terminal shutdown closes it");
+});
+
+test("an incompatible process registry fails closed rather than replacing ownership", () => {
+	const globalRegistry = globalThis as Record<symbol, unknown>;
+	const previous = globalRegistry[CHILD_STANDING_REVIEW_PERMISSION_REGISTRY_SYMBOL];
+	try {
+		globalRegistry[CHILD_STANDING_REVIEW_PERMISSION_REGISTRY_SYMBOL] = { schema: "wrong" };
+		assert.equal(createChildStandingReviewPermissionClient({ GENTLE_PI_AGENTS_CHILD: "1", GENTLE_PI_AGENTS_PARENT_PERMISSION_FD: "3" }), undefined);
+	} finally {
+		if (previous === undefined) delete globalRegistry[CHILD_STANDING_REVIEW_PERMISSION_REGISTRY_SYMBOL];
+		else globalRegistry[CHILD_STANDING_REVIEW_PERMISSION_REGISTRY_SYMBOL] = previous;
+	}
+});
+
+test("a package-owned child receives one parent-session authorization only after the parent checks its live task", async () => {
+	const channel = pair();
+	let live = true;
+	const broker = new ParentStandingReviewPermissionBroker(channel.parent, async (repositoryIdentity) => live && repositoryIdentity === REPOSITORY_ID);
+	const child = new ChildStandingReviewPermissionClient(channel.child, { timeoutMs: 25 });
+	assert.equal(await child.requestAuthorization(REPOSITORY_ID), true);
+	assert.equal(await child.requestAuthorization(OTHER_REPOSITORY_ID), false, "the task broker rejects a child target outside its repository");
+	assert.equal(await child.requestAuthorization("sha256:malformed"), false, "a malformed identity cannot reach the parent broker");
+	live = false;
+	assert.equal(await child.requestAuthorization(REPOSITORY_ID), false, "each request rechecks the live parent task and grant");
+	child.close();
+	broker.close();
+	channel.close();
+});
+
+test("the parent bounds each child channel before an untrusted request stream can keep asking", async () => {
+	const channel = pair();
+	const broker = new ParentStandingReviewPermissionBroker(channel.parent, async () => true, { maxRequests: 1 });
+	const child = new ChildStandingReviewPermissionClient(channel.child, { timeoutMs: 25 });
+	assert.equal(await child.requestAuthorization(REPOSITORY_ID), true);
+	assert.equal(await child.requestAuthorization(REPOSITORY_ID), false, "the broker rejects requests beyond its fixed per-task bound");
+	child.close();
+	broker.close();
+	channel.close();
+});
+
+test("a broken, timed-out, or malformed parent-owned channel fails closed", async () => {
+	const channel = pair();
+	const broker = new ParentStandingReviewPermissionBroker(channel.parent, async () => true);
+	const child = new ChildStandingReviewPermissionClient(channel.child, { timeoutMs: 1 });
+	broker.close();
+	assert.equal(await child.requestAuthorization(REPOSITORY_ID), false, "a closed broker cannot grant");
+	channel.close();
+	assert.equal(await child.requestAuthorization(REPOSITORY_ID), false, "an orphaned channel cannot grant");
+	child.close();
+});
+
+test("the authorization wire carries no candidate data or provider consent vectors", async () => {
+	const channel = pair();
+	const seen: string[] = [];
+	channel.parent.readable.on("data", (chunk: Buffer) => seen.push(chunk.toString("utf8")));
+	const broker = new ParentStandingReviewPermissionBroker(channel.parent, async () => true);
+	const child = new ChildStandingReviewPermissionClient(channel.child, { timeoutMs: 25 });
+	assert.equal(await child.requestAuthorization(REPOSITORY_ID), true);
+	assert.equal(seen.length, 1);
+	assert.match(seen[0]!, /"type":"standing-review-permission-request"/);
+	assert.match(seen[0]!, new RegExp(REPOSITORY_ID));
+	assert.doesNotMatch(seen[0]!, /consent|candidate|lineage|workspace|commonDir|path/i);
+	child.close();
+	broker.close();
+	channel.close();
+});
+
+test("a child disconnect during a pending parent response cannot crash the broker process", async () => {
+	class ChildDisconnectedOutput extends Writable {
+		private disconnected = false;
+
+		disconnect(): void {
+			this.disconnected = true;
+		}
+
+		_write(_chunk: Buffer, _encoding: BufferEncoding, callback: (error?: Error | null) => void): void {
+			callback(this.disconnected ? Object.assign(new Error("child pipe reset"), { code: "ECONNRESET" }) : null);
+		}
+	}
+
+	const childToParent = new PassThrough();
+	const parentToChild = new ChildDisconnectedOutput();
+	let calls = 0;
+	let releaseAuthorization: ((granted: boolean) => void) | undefined;
+	let signalAuthorizationStarted: () => void = () => {};
+	const authorizationStarted = new Promise<void>((resolve) => { signalAuthorizationStarted = resolve; });
+	const broker = new ParentStandingReviewPermissionBroker(
+		{ readable: childToParent, writable: parentToChild },
+		() => new Promise<boolean>((resolve) => {
+			calls += 1;
+			releaseAuthorization = resolve;
+			signalAuthorizationStarted();
+		}),
+	);
+	let uncaught: Error | undefined;
+	const observeUncaught = (error: Error) => { uncaught = error; };
+	process.on("uncaughtException", observeUncaught);
+	try {
+		childToParent.write(`${JSON.stringify({ type: "standing-review-permission-request", id: "disconnect", repositoryIdentity: REPOSITORY_ID })}\n`);
+		await authorizationStarted;
+		parentToChild.disconnect();
+		releaseAuthorization?.(true);
+		await new Promise((resolve) => setTimeout(resolve, 25));
+		childToParent.write(`${JSON.stringify({ type: "standing-review-permission-request", id: "after-disconnect", repositoryIdentity: REPOSITORY_ID })}\n`);
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		assert.equal(calls, 1, "the closed broker does not accept more work after a child pipe error");
+		assert.equal(uncaught, undefined, "the parent's late write error is handled by the broker, not process-wide");
+	} finally {
+		process.off("uncaughtException", observeUncaught);
+		broker.close();
+		childToParent.destroy();
+		parentToChild.destroy();
+	}
+});

package/tests/review-session-standing-permission-runtime.test.ts

@@ -0,0 +1,212 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { pathToFileURL } from "node:url";
+import type { ExtensionUIContext } from "@earendil-works/pi-coding-agent";
+import {
+	createAgentSessionFromServices,
+	createAgentSessionRuntime,
+	createAgentSessionServices,
+	SessionManager,
+	type CreateAgentSessionRuntimeFactory,
+} from "@earendil-works/pi-coding-agent";
+import {
+	captureReviewSessionIdentity,
+	grantReviewSessionPermission,
+	hasReviewSessionPermission,
+} from "../lib/review-session-standing-permission.ts";
+
+const LIFECYCLE_SYMBOL = Symbol.for("gentle-pi.test.review-session-permission-lifecycle");
+
+interface LifecycleEvent {
+	instance: number;
+	type: "start" | "shutdown";
+	reason: string;
+	manager: object;
+}
+
+interface LifecycleState {
+	nextInstance: number;
+	events: LifecycleEvent[];
+}
+
+function scratch(t: test.TestContext) {
+	const root = realpathSync(mkdtempSync(join(tmpdir(), "gentle-pi-permission-runtime-")));
+	t.after(() => {
+		try { execFileSync("chmod", ["-R", "u+w", root], { stdio: "ignore" }); } catch { /* best effort */ }
+		rmSync(root, { recursive: true, force: true });
+	});
+	const cwd = join(root, "repo");
+	const agentDir = join(root, "agent");
+	const sessionDir = join(root, "sessions");
+	mkdirSync(cwd, { recursive: true });
+	mkdirSync(join(agentDir, "extensions"), { recursive: true });
+	mkdirSync(sessionDir, { recursive: true });
+	execFileSync("git", ["init", "-b", "main"], { cwd, stdio: "ignore" });
+	writeFileSync(join(cwd, "app.ts"), "export const value = 1;\n");
+	execFileSync("git", ["add", "app.ts"], { cwd, stdio: "ignore" });
+	execFileSync("git", ["-c", "user.name=Runtime Test", "-c", "user.email=runtime@example.invalid", "commit", "-m", "base"], { cwd, stdio: "ignore" });
+	return { root, cwd: realpathSync(cwd), agentDir, sessionDir };
+}
+
+function testUi(statuses: Array<{ key: string; text?: string }>): ExtensionUIContext {
+	return {
+		select: async () => undefined,
+		confirm: async () => false,
+		input: async () => undefined,
+		editor: async () => undefined,
+		notify() {},
+		onTerminalInput: () => () => {},
+		setStatus(key, text) { statuses.push({ key, text }); },
+		setWorkingMessage() {},
+		setWorkingVisible() {},
+		setWorkingIndicator() {},
+		setHiddenThinkingLabel() {},
+		setWidget() {},
+		setFooter() {},
+		setHeader() {},
+		setTitle() {},
+		custom: async () => undefined,
+		pasteToEditor() {},
+		setEditorText() {},
+		getEditorText: () => "",
+		addAutocompleteProvider() {},
+		setEditorComponent() {},
+		getEditorComponent: () => undefined,
+		get theme() { return { fg: (_color: string, text: string) => text, bold: (text: string) => text } as never; },
+		getAllThemes: () => [{ name: "runtime-test", path: undefined } as never],
+		getTheme: () => undefined,
+		setTheme: () => ({ success: false, error: "not used" }),
+		getToolsExpanded: () => false,
+		setToolsExpanded() {},
+	} as ExtensionUIContext;
+}
+
+async function identity(cwd: string, manager: SessionManager) {
+	const captured = await captureReviewSessionIdentity({ cwd, mode: "tui", hasUI: true, sessionManager: manager }, {});
+	assert.ok(captured);
+	return captured;
+}
+
+test("actual Pi SDK loader preserves permission only across reload and disposes it on replacement lifecycles", async (t) => {
+	const { cwd, agentDir, sessionDir } = scratch(t);
+	const state: LifecycleState = { nextInstance: 0, events: [] };
+	const globalState = globalThis as Record<symbol, unknown>;
+	const previousLifecycle = globalState[LIFECYCLE_SYMBOL];
+	globalState[LIFECYCLE_SYMBOL] = state;
+	t.after(() => {
+		if (previousLifecycle === undefined) delete globalState[LIFECYCLE_SYMBOL];
+		else globalState[LIFECYCLE_SYMBOL] = previousLifecycle;
+	});
+
+	const extensionSource = pathToFileURL(join(import.meta.dirname, "..", "extensions", "gentle-ai.ts")).href;
+	const extensionPath = join(agentDir, "extensions", "runtime-permission.ts");
+	writeFileSync(extensionPath, `
+import { createGentleAiExtension } from ${JSON.stringify(extensionSource)};
+const lifecycle = globalThis[Symbol.for("gentle-pi.test.review-session-permission-lifecycle")];
+const instance = ++lifecycle.nextInstance;
+export default function (pi) {
+  pi.on("session_start", (event, ctx) => lifecycle.events.push({ instance, type: "start", reason: event.reason, manager: ctx.sessionManager }));
+  pi.on("session_shutdown", (event, ctx) => lifecycle.events.push({ instance, type: "shutdown", reason: event.reason, manager: ctx.sessionManager }));
+  createGentleAiExtension({ nativeReviewCli: null, candidateViews: null, processEnv: {} })(pi);
+}
+`, "utf8");
+
+	const previousAgentHome = process.env.GENTLE_PI_AGENT_HOME;
+	process.env.GENTLE_PI_AGENT_HOME = agentDir;
+	t.after(() => {
+		if (previousAgentHome === undefined) delete process.env.GENTLE_PI_AGENT_HOME;
+		else process.env.GENTLE_PI_AGENT_HOME = previousAgentHome;
+	});
+	const statuses: Array<{ key: string; text?: string }> = [];
+	const uiContext = testUi(statuses);
+	const bindings = { uiContext, mode: "tui" as const };
+	const createRuntime: CreateAgentSessionRuntimeFactory = async ({ cwd: runtimeCwd, sessionManager, sessionStartEvent }) => {
+		const services = await createAgentSessionServices({
+			cwd: runtimeCwd,
+			agentDir,
+			resourceLoaderOptions: {
+				additionalExtensionPaths: [extensionPath],
+				noSkills: true,
+				noPromptTemplates: true,
+				noThemes: true,
+				noContextFiles: true,
+			},
+		});
+		return {
+			...(await createAgentSessionFromServices({ services, sessionManager, sessionStartEvent, noTools: "all" })),
+			services,
+			diagnostics: services.diagnostics,
+		};
+	};
+	const initialManager = SessionManager.create(cwd, sessionDir);
+	const runtime = await createAgentSessionRuntime(createRuntime, { cwd, agentDir, sessionManager: initialManager });
+	runtime.setRebindSession(async (session) => session.bindExtensions(bindings));
+	await runtime.session.bindExtensions(bindings);
+	const originalSessionFile = runtime.session.sessionFile;
+	assert.ok(originalSessionFile);
+	const initialIdentity = await identity(cwd, initialManager);
+	assert.equal(grantReviewSessionPermission(initialIdentity), true);
+
+	await runtime.session.reload();
+	assert.equal(runtime.session.sessionManager, initialManager, "Pi reload must preserve the exact live SessionManager object");
+	assert.equal(hasReviewSessionPermission(initialIdentity), true, "the global Symbol registry reconnects the new extension closure");
+	assert.deepEqual(state.events.slice(0, 3).map(({ instance, type, reason }) => ({ instance, type, reason })), [
+		{ instance: 1, type: "start", reason: "startup" },
+		{ instance: 1, type: "shutdown", reason: "reload" },
+		{ instance: 2, type: "start", reason: "reload" },
+	]);
+	assert.ok(statuses.some(({ text }) => text === "reviews allowed for this session"), "reload startup restores the visible nonblocking status");
+
+	const firstEntry = initialManager.appendMessage({ role: "user", content: "first", timestamp: Date.now() });
+	initialManager.appendMessage({ role: "user", content: "second", timestamp: Date.now() });
+	await runtime.session.navigateTree(firstEntry, { summarize: false });
+	assert.equal(runtime.session.sessionManager, initialManager);
+	assert.equal(hasReviewSessionPermission(initialIdentity), true, "/tree stays inside the same session and retains permission");
+
+	await runtime.newSession();
+	assert.equal(hasReviewSessionPermission(initialIdentity), false);
+	const newManager = runtime.session.sessionManager;
+	const newIdentity = await identity(cwd, newManager);
+	assert.equal(hasReviewSessionPermission(newIdentity), false);
+	assert.equal(state.events.some(({ type, reason }) => type === "shutdown" && reason === "new"), true);
+	assert.equal(state.events.some(({ type, reason }) => type === "start" && reason === "new"), true);
+
+	grantReviewSessionPermission(newIdentity);
+	await runtime.switchSession(originalSessionFile);
+	assert.equal(hasReviewSessionPermission(newIdentity), false);
+	const resumedIdentity = await identity(cwd, runtime.session.sessionManager);
+	assert.equal(hasReviewSessionPermission(resumedIdentity), false);
+	assert.equal(state.events.some(({ type, reason }) => type === "shutdown" && reason === "resume"), true);
+	assert.equal(state.events.some(({ type, reason }) => type === "start" && reason === "resume"), true);
+
+	runtime.session.sessionManager.resetLeaf();
+	const resumedEntry = runtime.session.sessionManager.appendMessage({ role: "user", content: "fork point", timestamp: Date.now() });
+	grantReviewSessionPermission(resumedIdentity);
+	await runtime.fork(resumedEntry);
+	assert.equal(hasReviewSessionPermission(resumedIdentity), false);
+	const forkedIdentity = await identity(cwd, runtime.session.sessionManager);
+	assert.equal(hasReviewSessionPermission(forkedIdentity), false);
+	assert.equal(state.events.some(({ type, reason }) => type === "shutdown" && reason === "fork"), true);
+	assert.equal(state.events.some(({ type, reason }) => type === "start" && reason === "fork"), true);
+
+	grantReviewSessionPermission(forkedIdentity);
+	await runtime.dispose();
+	assert.equal(hasReviewSessionPermission(forkedIdentity), false);
+	assert.equal(state.events.some(({ type, reason }) => type === "shutdown" && reason === "quit"), true);
+});
+
+test("a fresh Node process has no standing permission registry authority", async (t) => {
+	const { cwd } = scratch(t);
+	const moduleUrl = pathToFileURL(join(import.meta.dirname, "..", "lib", "review-session-standing-permission.ts")).href;
+	const script = `
+import { hasReviewSessionPermission } from ${JSON.stringify(moduleUrl)};
+const manager = {};
+process.stdout.write(String(hasReviewSessionPermission({ sessionManager: manager, sessionId: "restart", worktreeRoot: ${JSON.stringify(cwd)} })));
+`;
+	const output = execFileSync(process.execPath, ["--experimental-strip-types", "--input-type=module", "--eval", script], { cwd, encoding: "utf8" });
+	assert.equal(output, "false");
+});

package/tests/review-session-standing-permission.test.ts

@@ -0,0 +1,126 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import {
+	REVIEW_SESSION_PERMISSION_REGISTRY_SCHEMA,
+	REVIEW_SESSION_PERMISSION_REGISTRY_SYMBOL,
+	captureReviewSessionIdentity,
+	grantReviewSessionPermission,
+	hasReviewSessionPermission,
+	reviewSessionPermissionEpoch,
+	revokeReviewSessionPermission,
+	revokeReviewSessionPermissionsForSession,
+	type ReviewSessionContext,
+} from "../lib/review-session-standing-permission.ts";
+
+function repository(t: test.TestContext): string {
+	const cwd = realpathSync(mkdtempSync(join(tmpdir(), "gentle-pi-session-permission-")));
+	t.after(() => rmSync(cwd, { recursive: true, force: true }));
+	execFileSync("git", ["init", "-b", "main"], { cwd, stdio: "ignore" });
+	writeFileSync(join(cwd, "README.md"), "test repository\n");
+	execFileSync("git", ["add", "README.md"], { cwd, stdio: "ignore" });
+	execFileSync("git", ["-c", "user.name=Test", "-c", "user.email=test@example.invalid", "commit", "-m", "base"], { cwd, stdio: "ignore" });
+	return cwd;
+}
+
+function siblingWorktree(t: test.TestContext, parentRoot: string): string {
+	const cwd = realpathSync(mkdtempSync(join(tmpdir(), "gentle-pi-session-permission-worktree-")));
+	t.after(() => rmSync(cwd, { recursive: true, force: true }));
+	execFileSync("git", ["worktree", "add", "--detach", cwd, "HEAD"], { cwd: parentRoot, stdio: "ignore" });
+	return cwd;
+}
+
+function context(cwd: string, manager: object, sessionId: string, overrides: Partial<ReviewSessionContext> = {}): ReviewSessionContext {
+	return {
+		cwd,
+		mode: "tui",
+		hasUI: true,
+		sessionManager: Object.assign(manager, { getSessionId: () => sessionId }),
+		...overrides,
+	};
+}
+
+test("standing permission is process-memory-only and bound to one live manager, session, and Git common directory", async (t) => {
+	const firstRoot = repository(t);
+	const siblingRoot = siblingWorktree(t, firstRoot);
+	const unrelatedRoot = repository(t);
+	const manager = {};
+	const identity = await captureReviewSessionIdentity(context(firstRoot, manager, "session-a"), {});
+	assert.ok(identity);
+	assert.equal(identity.worktreeRoot, firstRoot);
+	assert.equal(grantReviewSessionPermission(identity), true);
+	assert.equal(hasReviewSessionPermission(identity), true);
+
+	const wrongManager = await captureReviewSessionIdentity(context(firstRoot, {}, "session-a"), {});
+	const wrongSession = await captureReviewSessionIdentity(context(firstRoot, manager, "session-b"), {});
+	const sibling = await captureReviewSessionIdentity(context(siblingRoot, manager, "session-a"), {});
+	const unrelated = await captureReviewSessionIdentity(context(unrelatedRoot, manager, "session-a"), {});
+	assert.ok(wrongManager && wrongSession && sibling && unrelated);
+	assert.equal(sibling.repositoryIdentity, identity.repositoryIdentity, "sibling worktrees share one common-directory identity");
+	assert.notEqual(unrelated.repositoryIdentity, identity.repositoryIdentity, "independent repositories have distinct identities");
+	assert.equal(hasReviewSessionPermission(wrongManager), false);
+	assert.equal(hasReviewSessionPermission(wrongSession), false);
+	assert.equal(hasReviewSessionPermission(sibling), true, "a grant follows sibling worktrees of the same clone");
+	assert.equal(hasReviewSessionPermission(unrelated), false, "an unrelated repository requires its own human grant");
+
+	assert.equal(revokeReviewSessionPermission(identity), true);
+	assert.equal(hasReviewSessionPermission(sibling), false);
+});
+
+test("headless, child, empty-session, and non-Git contexts cannot offer or consume standing permission", async (t) => {
+	const root = repository(t);
+	const manager = {};
+	assert.equal(await captureReviewSessionIdentity(context(root, manager, "session", { mode: "print", hasUI: false }), {}), undefined);
+	assert.equal(await captureReviewSessionIdentity(context(root, manager, "session", { mode: "rpc", ui: { getAllThemes: () => [{}] } }), {}), undefined);
+	assert.equal(await captureReviewSessionIdentity(context(root, manager, "session", { mode: undefined }), {}), undefined, "an omitted mode with no verified TUI surface fails closed");
+	assert.ok(await captureReviewSessionIdentity(context(root, manager, "session", { mode: undefined, ui: { getAllThemes: () => [{}] } }), {}), "Pi 0.85 compatibility contexts prove TUI support through their nonempty theme surface");
+	assert.equal(await captureReviewSessionIdentity(context(root, manager, "session"), { GENTLE_PI_AGENTS_CHILD: "1" }), undefined);
+	assert.equal(await captureReviewSessionIdentity(context(root, manager, ""), {}), undefined);
+	assert.equal(await captureReviewSessionIdentity(context(tmpdir(), manager, "session"), {}), undefined);
+});
+
+test("revocation advances an epoch that prevents an older awaited UI from re-granting", async (t) => {
+	const root = repository(t);
+	const identity = await captureReviewSessionIdentity(context(root, {}, "session"), {});
+	assert.ok(identity);
+	const epoch = reviewSessionPermissionEpoch(identity);
+	assert.equal(epoch, 0);
+	revokeReviewSessionPermissionsForSession(identity.sessionManager, identity.sessionId);
+	assert.equal(reviewSessionPermissionEpoch(identity), 1);
+	assert.equal(grantReviewSessionPermission(identity, epoch), false);
+	assert.equal(hasReviewSessionPermission(identity), false);
+});
+
+test("session revocation removes only the exact manager and session partition", async (t) => {
+	const root = repository(t);
+	const manager = {};
+	const first = await captureReviewSessionIdentity(context(root, manager, "first"), {});
+	const second = await captureReviewSessionIdentity(context(root, manager, "second"), {});
+	assert.ok(first && second);
+	grantReviewSessionPermission(first);
+	grantReviewSessionPermission(second);
+	revokeReviewSessionPermissionsForSession(manager, "first");
+	assert.equal(hasReviewSessionPermission(first), false);
+	assert.equal(hasReviewSessionPermission(second), true);
+});
+
+test("an incompatible Symbol.for registry fails closed instead of being replaced", async (t) => {
+	const root = repository(t);
+	const globalRegistry = globalThis as Record<symbol, unknown>;
+	const previous = globalRegistry[REVIEW_SESSION_PERMISSION_REGISTRY_SYMBOL];
+	globalRegistry[REVIEW_SESSION_PERMISSION_REGISTRY_SYMBOL] = {
+		schema: `${REVIEW_SESSION_PERMISSION_REGISTRY_SCHEMA}-future`,
+		permissions: new WeakMap(),
+	};
+	t.after(() => {
+		if (previous === undefined) delete globalRegistry[REVIEW_SESSION_PERMISSION_REGISTRY_SYMBOL];
+		else globalRegistry[REVIEW_SESSION_PERMISSION_REGISTRY_SYMBOL] = previous;
+	});
+	const identity = await captureReviewSessionIdentity(context(root, {}, "session"), {});
+	assert.ok(identity);
+	assert.equal(grantReviewSessionPermission(identity), false);
+	assert.equal(hasReviewSessionPermission(identity), false);
+});

package/tests/runtime-harness.mjs

@@ -314,6 +314,7 @@ async function run() {
 		const capture = lastEventPi.tools.get("gentle_review_capture");
 		assert.ok(controller, "runtime must register the public status controller");
 		assert.ok(capture, "runtime must register the one-slot capture tool");
+		assert.equal(lastEventPi.tools.get("gentle_review_capture_group")?.executionMode, "sequential", "runtime must register grouped capture with bounded foreground concurrency");
 		assert.equal(controller.parameters.properties.operation.enum.includes("finalize"), false);
 		assert.equal(controller.parameters.properties.operation.enum.includes("validate"), false);