gentle-pi 2.4.0 → 2.5.0

package/tests/review-integration-v2.test.ts

@@ -184,6 +184,44 @@ test("failure enforces exact keys, enums, and identifiers", () => {
 	assert.throws(() => decodeReviewFailureV2(badCode), /code/);
 });
 
+test("failure with code managed_assets_outdated decodes its continuation, degrades without one, and forbids it elsewhere", () => {
+	const source: JsonObject = {
+		schema: "gentle-ai.review-integration.failure/v2",
+		contract: REVIEW_INTEGRATION_CONTRACT,
+		operation: "review.start",
+		phase: "preflight",
+		code: "managed_assets_outdated",
+		message: "the managed asset set is stale",
+		mutation_outcome: "not_started",
+		authority_applicability: "current_target",
+		retry_safe: true,
+		replayability: "manual_action_required",
+		required_inputs: [],
+		next_action: "explicit-maintainer-action",
+		continuation: { operation: "sync", command: "gentle-ai sync --agent claude-code", agent: "claude-code", stale_assets: ["orchestration/claude-code.md"] },
+	};
+	assert.deepEqual(decodeReviewFailureV2(source).continuation, { operation: "sync", command: "gentle-ai sync --agent claude-code", agent: "claude-code", staleAssets: ["orchestration/claude-code.md"] });
+
+	const missingCommand = clone(source);
+	delete (missingCommand.continuation as JsonObject).command;
+	assert.throws(() => decodeReviewFailureV2(missingCommand), /command.*required|required.*command/);
+
+	// an older gentle-ai may emit managed_assets_outdated with no continuation
+	// at all; decode must not refuse the whole envelope for that
+	const missingContinuation = clone(source);
+	delete missingContinuation.continuation;
+	assert.equal(decodeReviewFailureV2(missingContinuation).continuation, undefined);
+
+	const unexpectedContinuation: JsonObject = { ...clone(source), code: "gate_scope_changed" };
+	assert.throws(() => decodeReviewFailureV2(unexpectedContinuation), /continuation is only valid/);
+
+	// an envelope without continuation, on a code that does not require one, is unchanged
+	const withoutContinuation = clone(source);
+	withoutContinuation.code = "gate_scope_changed";
+	delete withoutContinuation.continuation;
+	assert.equal(decodeReviewFailureV2(withoutContinuation).continuation, undefined);
+});
+
 test("net-new decoders: consent, next-transition, and artifact-subject reject malformed payloads", () => {
 	const consentSource = fixture<JsonObject>("consent.fixture.json");
 	assertRequired(decodeReviewConsentV2, consentSource, ["schema", "contract", "operation", "action", "blocking", "target_identity", "projection", "risk_level", "changed_files", "changed_lines", "headline", "reason", "value", "risk_evidence", "choices", "off_path"]);
@@ -405,6 +443,41 @@ test("next_transition decodes an execute variant and rejects a stop that carries
 	assert.throws(() => decodeReviewNextTransitionV3(stopWithExecute), /stop cannot carry/);
 });
 
+// gentle-pi#627: gentle-ai reports a stale managed-asset set as a typed stop
+// carrying the exact `gentle-ai sync` invocation that resolves it.
+function managedAssetsContinuation(overrides: Partial<JsonObject> = {}): JsonObject {
+	return { operation: "sync", command: "gentle-ai sync --agent claude-code", agent: "claude-code", stale_assets: ["orchestration/claude-code.md"], ...overrides };
+}
+
+test("next_transition stop decodes a managed_assets_outdated continuation and rejects a malformed one", () => {
+	const stop: JsonObject = { kind: "stop", reason_code: "managed_assets_outdated", continuation: managedAssetsContinuation() };
+	const decoded = decodeReviewNextTransitionV3(stop);
+	assert.deepEqual(decoded.continuation, { operation: "sync", command: "gentle-ai sync --agent claude-code", agent: "claude-code", staleAssets: ["orchestration/claude-code.md"] });
+
+	const bare: JsonObject = { kind: "stop", reason_code: "managed_assets_outdated", continuation: { operation: "sync", command: "gentle-ai sync" } };
+	assert.deepEqual(decodeReviewNextTransitionV3(bare).continuation, { operation: "sync", command: "gentle-ai sync" });
+
+	const missingCommand = clone(stop);
+	delete (missingCommand.continuation as JsonObject).command;
+	assert.throws(() => decodeReviewNextTransitionV3(missingCommand), /command.*required|required.*command/);
+
+	const emptyCommand = clone(stop);
+	(emptyCommand.continuation as JsonObject).command = "";
+	assert.throws(() => decodeReviewNextTransitionV3(emptyCommand), /command/);
+
+	// an older gentle-ai may emit this stop with no continuation at all; decode
+	// must not refuse the whole envelope for that
+	const missingForReasonCode = { kind: "stop", reason_code: "managed_assets_outdated" };
+	assert.equal(decodeReviewNextTransitionV3(missingForReasonCode).continuation, undefined);
+
+	const unexpectedOnOtherReasonCode = { kind: "stop", reason_code: "rdd_disabled", continuation: managedAssetsContinuation() };
+	assert.throws(() => decodeReviewNextTransitionV3(unexpectedOnOtherReasonCode), /continuation is only valid/);
+
+	// envelopes without continuation stay unchanged
+	const plainStop = decodeReviewNextTransitionV3({ kind: "stop", reason_code: "rdd_disabled" });
+	assert.equal(plainStop.continuation, undefined);
+});
+
 function approvedAcknowledgementTransition(): JsonObject {
 	return {
 		kind: "execute",
@@ -700,6 +773,40 @@ test("v5 targeted-validator collect inputs carry the exact provider-owned valida
 	assert.throws(() => decodeReviewNextTransitionV3(weakenedRequest, { v5: true }), /policy_content/);
 });
 
+test("status.frozen carries the optional frozen manifest digest", () => {
+	const current = devFixture<JsonObject>("status-v5-repository-context.captured.json");
+	delete current.receipt;
+	if (current.action === "finalize") {
+		current.action = "stop";
+		delete current.next_transition;
+		delete current.forecast;
+	}
+	assert.equal(typeof (current.frozen as JsonObject | undefined)?.tier, "string", "the captured status carries frozen");
+	const digest = `sha256:${"ab".repeat(32)}`;
+	(current.frozen as JsonObject).changed_path_manifest_sha256 = digest;
+	assert.equal(decodeReviewStatusV3(current).frozen?.changedPathManifestSha256, digest);
+	(current.frozen as JsonObject).changed_path_manifest_sha256 = "not-a-digest";
+	assert.throws(() => decodeReviewStatusV3(current), /changed_path_manifest_sha256/);
+	delete (current.frozen as JsonObject).changed_path_manifest_sha256;
+	assert.equal(decodeReviewStatusV3(current).frozen?.changedPathManifestSha256, undefined);
+});
+
+test("a capture-result collect input decodes without changed_path_manifest, which the artifact subject digest already binds", () => {
+	const status = fixture<JsonObject>("status.fixture.json");
+	const transition = clone((status.next_transition ?? {}) as JsonObject);
+	const inputs = ((transition.collect as JsonObject | undefined)?.inputs ?? []) as JsonObject[];
+	const captureInput = inputs.find((input) => input.capture_operation === "review.capture-result");
+	assert.ok(captureInput, "the status fixture carries a capture-result collect input");
+	assert.doesNotThrow(() => decodeReviewNextTransitionV3(transition, { v5: true, v6: true }), "with the manifest");
+	delete captureInput.changed_path_manifest;
+	const decoded = decodeReviewNextTransitionV3(transition, { v5: true, v6: true });
+	const decodedInput = decoded.collect?.inputs.find((input) => input.captureOperation === "review.capture-result");
+	assert.ok(decodedInput?.artifactSubject?.changedPathManifestSha256, "the digest on the artifact subject is the binding");
+	assert.equal(decodedInput?.changedPathManifest, undefined);
+	delete captureInput.artifact_subject;
+	assert.throws(() => decodeReviewNextTransitionV3(transition, { v5: true, v6: true }), /requires artifact_subject, base_tree, and candidate_tree/);
+});
+
 test("status enforces authority/frozen/receipt conditionals and decodes the required repair field", () => {
 	const current = devFixture<JsonObject>("status-v5-repository-context.captured.json");
 	delete current.receipt;
@@ -711,6 +818,11 @@ test("status enforces authority/frozen/receipt conditionals and decodes the requ
 	const decoded = decodeReviewStatusV3(current);
 	assert.equal(decoded.repair.status, "unsupported");
 	assert.equal(decoded.authority?.state, "reviewing");
+	for (const action of ["collect", "execute"]) {
+		const projected = clone(current);
+		projected.action = action;
+		assert.equal(decodeReviewStatusV3(projected).action, action, "a live transaction's root action names its mandated transition kind");
+	}
 
 	const missingAuthority = clone(current);
 	delete missingAuthority.authority;

package/tests/review-last-event-closure.test.ts

@@ -331,7 +331,7 @@ test("terminal capture closes directly, nonterminal capture does not auto-follow
 	assert.equal(statusCalls, 2, "only initial STATUS plus one ambiguity reconciliation");
 });
 
-test("unknown-capture reconciliation validates the target-scoped lineage without replay", async () => {
+test("unknown-capture reconciliation preserves agentless legacy callers and forwards an explicit Pi agent", async () => {
 	const calls: Array<Record<string, unknown>> = [];
 	const native = {
 		targetStatus: async (request: Record<string, unknown>) => {
@@ -342,7 +342,12 @@ test("unknown-capture reconciliation validates the target-scoped lineage without
 	} as unknown as NativeReviewCli;
 	const result = await reconcileUnknownReviewLastEventCapture(native, "/repo", { lineageId: "reconcile-lineage", targetIdentity: SHA });
 	await reconcileUnknownReviewLastEventCapture(native, "/repo", { lineageId: "reconcile-lineage", targetIdentity: SHA }, { baseRef: "refs/heads/main", committedOnly: true });
-	assert.deepEqual(calls, [{ cwd: "/repo", lineageId: "reconcile-lineage" }, { cwd: "/repo", lineageId: "reconcile-lineage", baseRef: "refs/heads/main", committedOnly: true }]);
+	await reconcileUnknownReviewLastEventCapture(native, "/repo", { lineageId: "reconcile-lineage", targetIdentity: SHA }, { agent: "pi" });
+	assert.deepEqual(calls, [
+		{ cwd: "/repo", lineageId: "reconcile-lineage" },
+		{ cwd: "/repo", lineageId: "reconcile-lineage", baseRef: "refs/heads/main", committedOnly: true },
+		{ cwd: "/repo", lineageId: "reconcile-lineage", agent: "pi" },
+	]);
 	assert.equal(result.targetIdentity, SHA);
 	let launches = 0;
 	const strictNative = new nativeReviewCliModule.NativeReviewCliV216(async () => { launches += 1; throw new Error("must not launch"); }, "/package/.gentle-ai/gentle-ai");

package/tests/review-relay-contract.test.ts

@@ -0,0 +1,26 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { createGentleAiExtension } from "../extensions/gentle-ai.ts";
+import { declareReviewRelayHandshake, GENTLE_PI_REVIEW_RELAY_CONTRACT, GENTLE_PI_REVIEW_RELAY_CONTRACT_ENV } from "../lib/review-relay-contract.ts";
+
+// gentle-pi#550: the session shell must inherit the relay handshake, so a
+// `gentle-ai review ... --agent pi` typed in a shell tool is eligible without
+// the operator reading package source for the value.
+
+test("declareReviewRelayHandshake exports the exact contract and reports whether it changed anything", () => {
+	const env: NodeJS.ProcessEnv = {};
+	assert.equal(declareReviewRelayHandshake(env), true);
+	assert.equal(env[GENTLE_PI_REVIEW_RELAY_CONTRACT_ENV], GENTLE_PI_REVIEW_RELAY_CONTRACT);
+	assert.equal(declareReviewRelayHandshake(env), false, "already declared");
+	const stale: NodeJS.ProcessEnv = { [GENTLE_PI_REVIEW_RELAY_CONTRACT_ENV]: "gentle-pi.review-relay/v0" };
+	assert.equal(declareReviewRelayHandshake(stale), true, "a wrong value is replaced: this extension is the host");
+	assert.equal(stale[GENTLE_PI_REVIEW_RELAY_CONTRACT_ENV], GENTLE_PI_REVIEW_RELAY_CONTRACT);
+});
+
+test("loading the extension declares the handshake in the session environment", () => {
+	const processEnv: NodeJS.ProcessEnv = { PATH: "/bin" };
+	createGentleAiExtension({ nativeReviewCli: null, processEnv })({ on() {}, registerTool() {}, registerCommand() {} } as unknown as ExtensionAPI);
+	assert.equal(processEnv[GENTLE_PI_REVIEW_RELAY_CONTRACT_ENV], GENTLE_PI_REVIEW_RELAY_CONTRACT);
+	assert.equal(processEnv.PATH, "/bin");
+});

package/tests/review-repository.test.ts

@@ -4,7 +4,7 @@ import { cpSync, mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import test from "node:test";
-import { resolveRepositoryAuthorityV1, setReviewRepositoryIdentityRetryHookForTesting } from "../lib/review-repository.ts";
+import { resolveRepositoryAuthorityV1, reviewGitEnvironment, setReviewRepositoryIdentityRetryHookForTesting } from "../lib/review-repository.ts";
 import { REVIEW_MODE, ReviewTransactionStore, createReviewState, setReviewMutationLockPlatformForTesting } from "../lib/review-transaction.ts";
 import { REVIEW_LENS, REVIEW_ROUTE } from "../lib/review-triggers.ts";
 import { qualifiedReviewLockPlatform, testSnapshot } from "./review-test-fixtures.ts";
@@ -49,6 +49,33 @@ function addOrphanRoot(root: string, branch: string, file: string): void {
 	git(root, "checkout", "main");
 }
 
+test("review Git environment uses a Git-compatible null config path on Windows", () => {
+	const environment = reviewGitEnvironment();
+	assert.equal(environment.GIT_CONFIG_GLOBAL, "/dev/null");
+	assert.equal(environment.GIT_CONFIG_SYSTEM, "/dev/null");
+});
+
+test("review Git environment runs a real Git authority probe", (t) => {
+	const root = repository(t);
+	const commonDirectory = execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], {
+		cwd: root,
+		encoding: "utf8",
+		env: reviewGitEnvironment(),
+	}).trim();
+	assert.equal(resolve(commonDirectory), resolve(git(root, "rev-parse", "--path-format=absolute", "--git-common-dir")));
+});
+
+test("review Git environment rejects inherited unsafe Git overrides", () => {
+	const prior = process.env.GIT_DIR;
+	try {
+		process.env.GIT_DIR = "/unsafe";
+		assert.throws(() => reviewGitEnvironment(), /REVIEW_GIT_ENV_UNSAFE/);
+	} finally {
+		if (prior === undefined) delete process.env.GIT_DIR;
+		else process.env.GIT_DIR = prior;
+	}
+});
+
 test("a Windows drive-letter Git common directory resolves repository authority", { skip: process.platform !== "win32" }, (t) => {
 	const root = repository(t);
 	const commonDirectory = git(root, "rev-parse", "--path-format=absolute", "--git-common-dir");