gentle-pi 2.5.0 → 2.6.0

package/scripts/build-runtime-modules.mjs

@@ -38,6 +38,14 @@ async function main() {
 	if ((mode !== "--write" && mode !== "--check") || process.argv.length !== 3) {
 		throw new Error("usage: build-runtime-modules.mjs --write|--check");
 	}
+	// Pi loads these directly as TypeScript. Check syntax without generating
+	// another runtime copy or expanding the published module boundary.
+	for (const path of ["lib/runtime-metrics-delivery.ts", "lib/runtime-metrics-native.ts",
+		"lib/runtime-metrics-children.ts", "extensions/runtime-metrics.ts"]) {
+		const source = await readFile(join(root, path), "utf8");
+		assertNoTrailingWhitespace(source, path);
+		stripTypeScriptTypes(source, { mode: "strip" });
+	}
 	const runtime = join(root, "runtime");
 	if (mode === "--write") await mkdir(runtime, { recursive: true });
 	const drift = [];
@@ -59,7 +67,7 @@ async function main() {
 	if (drift.length > 0) {
 		throw new Error(`generated runtime is stale: ${drift.join(", ")}`);
 	}
-	process.stdout.write(`runtime ${mode === "--write" ? "generated" : "matches TypeScript sources"} (${sources.length} modules)\n`);
+	process.stdout.write(`runtime ${mode === "--write" ? "generated" : "matches TypeScript sources"} (${sources.length} generated modules; one-shot metrics sources validated)\n`);
 }
 
 main().catch((error) => {

package/scripts/check-types.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+// Type gate for a project that does not compile cleanly yet.
+//
+// `tsc --noEmit` reports a fixed set of diagnostics on this repository today, so
+// the gate is a ratchet rather than a clean pass: it fails when the number of
+// diagnostics grows for any (file, error code) pair, or when the total grows.
+// Fixing diagnostics and refreshing the baseline is the intended way to shrink
+// it.
+//
+// Known blind spot, stated rather than hidden: keying on (file, code) counts is
+// what keeps the baseline stable while files are edited, because line numbers
+// shift. A single change that removes one diagnostic and introduces another of
+// the same code in the same file therefore passes. The total check catches that
+// whenever the counts differ at all.
+//
+// Usage:
+//   node scripts/check-types.mjs            fail on any new diagnostic
+//   node scripts/check-types.mjs --update   rewrite the baseline and exit 0
+
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+const baselinePath = join(packageRoot, "scripts", "types-baseline.json");
+const configPath = join(packageRoot, "tsconfig.json");
+const DIAGNOSTIC = /^(.*?)\((\d+),(\d+)\): error (TS\d+): (.*)$/;
+const REPORT_LIMIT = 20;
+
+function relativeToPackage(file) {
+	return relative(packageRoot, file).split("\\").join("/");
+}
+
+function compile() {
+	let tsc;
+	try {
+		tsc = createRequire(import.meta.url).resolve("typescript/bin/tsc");
+	} catch {
+		console.error("types: cannot resolve the TypeScript compiler. Run `pnpm install` first.");
+		process.exit(1);
+	}
+	try {
+		execFileSync(process.execPath, [tsc, "-p", configPath], {
+			cwd: packageRoot,
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "pipe"],
+		});
+		return "";
+	} catch (error) {
+		// tsc exits non-zero when it reports diagnostics and writes them to stdout.
+		return `${error.stdout ?? ""}${error.stderr ?? ""}`;
+	}
+}
+
+function summarize(output) {
+	const counts = new Map();
+	const samples = new Map();
+	let total = 0;
+	for (const line of output.split(/\r?\n/)) {
+		const match = DIAGNOSTIC.exec(line);
+		if (!match) continue;
+		const key = `${relativeToPackage(match[1])} ${match[4]}`;
+		counts.set(key, (counts.get(key) ?? 0) + 1);
+		if (!samples.has(key)) samples.set(key, match[5].trim());
+		total += 1;
+	}
+	return { counts, samples, total };
+}
+
+function writeBaseline(summary) {
+	const byFileAndCode = Object.fromEntries([...summary.counts].sort(([left], [right]) => left.localeCompare(right)));
+	const payload = {
+		note: "Recorded TypeScript diagnostics. Regenerate with `node scripts/check-types.mjs --update` after fixing or deliberately accepting diagnostics. This file may only shrink without a review decision.",
+		total: summary.total,
+		byFileAndCode,
+	};
+	writeFileSync(baselinePath, `${JSON.stringify(payload, null, 2)}\n`);
+}
+
+const summary = summarize(compile());
+
+if (process.argv.includes("--update")) {
+	writeBaseline(summary);
+	console.log(`types: baseline recorded ${summary.total} diagnostic(s) across ${summary.counts.size} file/code pair(s)`);
+	process.exit(0);
+}
+
+let baseline;
+try {
+	baseline = JSON.parse(readFileSync(baselinePath, "utf8"));
+} catch (error) {
+	console.error(`types: cannot read ${relativeToPackage(baselinePath)}: ${error instanceof Error ? error.message : String(error)}`);
+	process.exit(1);
+}
+
+const regressions = [];
+for (const [key, count] of summary.counts) {
+	const recorded = baseline.byFileAndCode[key] ?? 0;
+	if (count > recorded) regressions.push({ key, added: count - recorded, message: summary.samples.get(key) ?? "" });
+}
+
+const totalGrew = summary.total > baseline.total;
+
+if (regressions.length > 0 || totalGrew) {
+	if (regressions.length > 0) {
+		console.error(`types: ${regressions.length} file/code pair(s) report more diagnostics than recorded:`);
+		for (const regression of regressions.slice(0, REPORT_LIMIT)) {
+			console.error(`  +${regression.added}  ${regression.key}  ${regression.message.slice(0, 100)}`);
+		}
+		if (regressions.length > REPORT_LIMIT) console.error(`  ... and ${regressions.length - REPORT_LIMIT} more`);
+	}
+	if (totalGrew) {
+		console.error(`types: total ${summary.total} exceeds the recorded ${baseline.total}`);
+	}
+	console.error("Fix the new diagnostics, or run `node scripts/check-types.mjs --update` when they are deliberately accepted.");
+	process.exit(1);
+}
+
+const improved = [...Object.entries(baseline.byFileAndCode)].filter(([key, count]) => (summary.counts.get(key) ?? 0) < count).length;
+console.log(
+	`types: ${summary.total} recorded diagnostic(s), no regressions` +
+		(improved > 0 ? `; ${improved} file/code pair(s) improved, run --update to shrink the baseline` : ""),
+);

package/scripts/gentle-ai-installer.mjs

@@ -36,7 +36,7 @@ const WINDOWS_SYSTEM_ROOT = "C:\\Windows";
 // version check below) derives from this constant instead of repeating the
 // literal, so a pin bump cannot leave a stale copy behind. See
 // scripts/install-gentle-ai.mjs for the incident that motivated this.
-export const INSTALLER_VERSION = "2.7.0";
+export const INSTALLER_VERSION = "2.8.0";
 export const RELEASE_BASE_URL = `https://github.com/Gentleman-Programming/gentle-ai/releases/download/v${INSTALLER_VERSION}/`;
 export const GENTLE_AI_INSTALL_METHOD = Object.freeze({
 	SIGNED_RELEASE_ASSET: "signed-release-asset",
@@ -45,10 +45,10 @@ export const GENTLE_AI_INSTALL_METHOD = Object.freeze({
 export const GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH = "github.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai";
 export const GENTLE_AI_WINDOWS_SOURCE_MODULE = "github.com/gentleman-programming/gentle-ai/v2";
 export const GENTLE_AI_WINDOWS_SOURCE_TAG = `v${INSTALLER_VERSION}`;
-// `go mod download -json github.com/gentleman-programming/gentle-ai/v2@v2.7.0`
+// `go mod download -json github.com/gentleman-programming/gentle-ai/v2@v2.8.0`
 // with GOSUMDB=sum.golang.org reports this exact module SumDB checksum, and the
-// tag resolves to commit 4e4470b3, the published v2.7.0 release head.
-export const GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:SE4KCLo3y1qWaTq+7HJKZ1DkAAAl+w+82YY0+qQkFwM=";
+// tag resolves to commit 890ca948, the published v2.8.0 release head.
+export const GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:QNdrYDxq/Bi08o9PCk0jc4r5YObLdFmRCLXjKMqsze8=";
 export const GENTLE_AI_WINDOWS_SOURCE_PACKAGE = `${GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH}@${GENTLE_AI_WINDOWS_SOURCE_TAG}`;
 export const GENTLE_AI_WINDOWS_MINIMUM_GO_VERSION = "1.25.10";
 export const GENTLE_AI_GO_TOOLCHAIN_UNAVAILABLE_CODE = "GENTLE_AI_GO_TOOLCHAIN_UNAVAILABLE";
@@ -67,7 +67,7 @@ export class GentleAiInstallerError extends Error {
 // Sentinel used while a re-pinned gentle-ai release is not yet published. A
 // sentinel digest can never match a real SHA-256, so installation fails closed,
 // and verify-package-files.mjs refuses to pack/publish while any digest below
-// still holds it. The v2.7.0 digests are pinned from the published release:
+// still holds it. The v2.8.0 digests are pinned from the published release:
 // archive sha256 values verified against the minisign-signed checksums.txt and
 // freshly computed hashes; binary sha256 values computed from the extracted
 // executables.
@@ -109,15 +109,15 @@ async function downloadPinnedGentleAiAsset(asset, destination, options) {
 }
 
 // Windows is absent from signed release archives on purpose. gentle-ai stopped
-// distributing unsigned Windows builds in c4b764d0, so v2.7.0 publishes signed
+// distributing unsigned Windows builds in c4b764d0, so v2.8.0 publishes signed
 // Darwin/Linux archives only. Windows x64/arm64 uses the separately verified
 // exact-tag Go SumDB source-build path below; restore archive rows only when
 // upstream ships signed Windows assets.
 export const GENTLE_AI_RELEASE_ASSETS = Object.freeze({
-	"darwin/amd64": asset("gentle-ai_2.7.0_darwin_amd64.tar.gz", "5edf1e38894d6b2c1d257583cf4da23e2471812ed2efd0de33cbeef608339609", "e7aa77701e3cfd8a382a756ff2f257ba1a94ab4699050b3c3ac8e6237eb53950", "gentle-ai"),
-	"darwin/arm64": asset("gentle-ai_2.7.0_darwin_arm64.tar.gz", "a9efa8cf182d853b7d0115efbc73a83465d435ec429f6465bea9181ea8022fde", "497932a73664a958cf46b0b131277da4a41a48f8d7da4f777d1157f8ffa9f646", "gentle-ai"),
-	"linux/amd64": asset("gentle-ai_2.7.0_linux_amd64.tar.gz", "ff765a183247fe31d4739ff6df3d6874740979987ea310de3856c8a6e85375e9", "8748b9f18c05a831692abc0ae560fdc50a4e4c8f492705edcce7f65e067a7b12", "gentle-ai"),
-	"linux/arm64": asset("gentle-ai_2.7.0_linux_arm64.tar.gz", "d8e114cd4d226f6c974813a49fce4d3e2028f4880b87e08f270eadf0a0607561", "65dd6bd7249d5eb7a2c948eebd0aee1bf2e85e1a2123e9b3782e978b167c3875", "gentle-ai"),
+	"darwin/amd64": asset("gentle-ai_2.8.0_darwin_amd64.tar.gz", "9c735e51916c31135926e62b21ac990216d810907a73894f68ec47bb0648d22d", "3880084f118533102a02eb0656a709db9817d330f82de8f533868667e0ac449d", "gentle-ai"),
+	"darwin/arm64": asset("gentle-ai_2.8.0_darwin_arm64.tar.gz", "b62d01aadba484e79869e11878d47e81cd692ebce93a5de454d0889db65fac54", "fed81b2b3dbec02ab5f06ce73364b43d28c532231813a01e2015d585f08cbb2e", "gentle-ai"),
+	"linux/amd64": asset("gentle-ai_2.8.0_linux_amd64.tar.gz", "56378fd47cfee127d5982398e79248194d3c7624d268efda9823a6b061a018b7", "df19c4ac20cfdfc0cc0c98c75cda42106340ca9966009f5dfb61575c1ada27c8", "gentle-ai"),
+	"linux/arm64": asset("gentle-ai_2.8.0_linux_arm64.tar.gz", "41726bffee269206e5fe96d7bd900164d01f478d8916bdfba446a7991903dfc1", "a93fff44ea583546d37ce833cc2a0f14afec118ae4209c305cafcadb91f67bac", "gentle-ai"),
 });
 
 // A pinned asset is either a signed archive or, for a prerelease pin only,

package/scripts/install-gentle-ai.mjs

@@ -4,6 +4,7 @@
 // v2.1.11 while writing v2.2.0 to disk, which is the one moment an operator
 // most needs the number to be true.
 import { INSTALLER_VERSION, installGentleAi } from "./gentle-ai-installer.mjs";
+import { installTuiModeSetting } from "./install-tui-mode-setting.mjs";
 
 if (process.env.GENTLE_PI_SKIP_GENTLE_AI_INSTALL === "1") {
 	console.warn("GENTLE_PI_SKIP_GENTLE_AI_INSTALL=1: skipped package-local Gentle AI installation; native review operations will fail with package-local-binary-missing until gentle-pi is reinstalled.");
@@ -16,3 +17,14 @@ if (process.env.GENTLE_PI_SKIP_GENTLE_AI_INSTALL === "1") {
 		process.exitCode = 1;
 	}
 }
+
+// A native failure never changes settings; the explicit native-only skip does.
+if (!process.exitCode) {
+	try {
+		const result = await installTuiModeSetting();
+		if (result.changed) console.log("gentle-pi enabled fullscreen in global Pi settings; /settings can switch back to regular.");
+	} catch (error) {
+		console.error(`gentle-pi could not enable fullscreen: ${error instanceof Error ? error.message : String(error)}`);
+		process.exitCode = 1;
+	}
+}

package/scripts/install-tui-mode-setting.mjs

@@ -0,0 +1,114 @@
+import { closeSync, constants, fchmodSync, fsyncSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { randomUUID } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+
+function inspect(path) {
+	try { return lstatSync(path); }
+	catch (error) { if (error.code === "ENOENT") return undefined; throw error; }
+}
+
+function sameFile(left, right) {
+	return left && right && left.dev === right.dev && left.ino === right.ino;
+}
+
+function assertDirectories(paths) {
+	for (const path of paths) {
+		const stat = inspect(path);
+		if (!stat?.isDirectory() || stat.isSymbolicLink() || realpathSync(path) !== path) {
+			throw new Error(`Unsafe fullscreen settings installation path: ${path}`);
+		}
+	}
+}
+
+function readSettings(path) {
+	const before = inspect(path);
+	if (!before) return { stat: undefined, text: undefined, value: {} };
+	if (!before.isFile() || before.isSymbolicLink()) throw new Error("settings.json must be a regular, non-symlink file");
+	const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+	try {
+		if (!sameFile(before, fstatSync(fd))) throw new Error("settings.json changed while opening");
+		const text = readFileSync(fd, "utf8");
+		const value = JSON.parse(text.replace(/^\uFEFF/, ""));
+		if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("settings.json must contain a JSON object");
+		return { stat: before, text, value };
+	} finally { closeSync(fd); }
+}
+
+// Pi uses proper-lockfile with realpath:false: its cooperative lock is the
+// settings.json.lock directory. Do not steal stale locks. Keep the synchronous
+// critical section below shorter than proper-lockfile's default stale window.
+async function acquireLock(path) {
+	for (let attempt = 0; attempt < 10; attempt++) {
+		try {
+			mkdirSync(path, { mode: 0o700 });
+			return inspect(path);
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+			if (attempt === 9) throw new Error("Fullscreen settings lock is busy; retry installation when other settings writers finish");
+			await delay(20);
+		}
+	}
+}
+
+/** Only physically owned global Pi npm or exact Git installs may mutate Pi settings.
+ * Atomic rename protects readers from partial JSON, not arbitrary writers or
+ * malicious same-user ancestor swaps. No lifecycle cwd or store symlink grants ownership.
+ */
+export async function installTuiModeSetting(options = {}) {
+	const env = options.env ?? process.env;
+	const requestedHome = resolve(env.GENTLE_PI_AGENT_HOME || env.PI_CODING_AGENT_DIR || join(options.home ?? homedir(), ".pi", "agent"));
+	const packageRoot = resolve(options.packageRoot ?? dirname(dirname(fileURLToPath(import.meta.url))));
+	let home;
+	try { home = realpathSync(requestedHome); }
+	catch (error) { if (error.code === "ENOENT") return { changed: false, recognized: false }; throw error; }
+	const installations = [
+		{
+			packageRoot: join(home, "npm", "node_modules", "gentle-pi"),
+			paths: [home, join(home, "npm"), join(home, "npm", "node_modules"), join(home, "npm", "node_modules", "gentle-pi")],
+		},
+		{
+			packageRoot: join(home, "git", "github.com", "Gentleman-Programming", "gentle-pi"),
+			paths: [home, join(home, "git"), join(home, "git", "github.com"), join(home, "git", "github.com", "Gentleman-Programming"), join(home, "git", "github.com", "Gentleman-Programming", "gentle-pi")],
+		},
+	];
+	// Canonical agent-home aliases (including macOS /var) are supported.
+	// pnpm's physical store, npm links, and Git aliases are not owned global installs.
+	const installation = installations.find(({ packageRoot: expected }) => realpathSync(packageRoot) === expected);
+	if (!installation) return { changed: false, recognized: false };
+	assertDirectories(installation.paths);
+	const settingsPath = join(home, "settings.json");
+	const lockPath = `${settingsPath}.lock`;
+	const lock = await acquireLock(lockPath);
+	const started = Date.now();
+	let staging;
+	try {
+		assertDirectories(installation.paths);
+		const original = readSettings(settingsPath);
+		if (original.value.tuiMode === "fullscreen") return { changed: false, recognized: true };
+		staging = join(home, `.settings-fullscreen-${randomUUID()}.tmp`);
+		const fd = openSync(staging, "wx", original.stat ? original.stat.mode & 0o777 : 0o600);
+		try {
+			if (original.stat) fchmodSync(fd, original.stat.mode & 0o777);
+			writeFileSync(fd, `${JSON.stringify({ ...original.value, tuiMode: "fullscreen" }, null, 2)}\n`, "utf8");
+			fsyncSync(fd);
+		} finally { closeSync(fd); }
+		assertDirectories(installation.paths);
+		const latest = readSettings(settingsPath);
+		if (latest.text !== original.text || (original.stat ? !sameFile(original.stat, latest.stat) : latest.stat !== undefined)) {
+			throw new Error("settings.json changed concurrently; retry installation");
+		}
+		if (!sameFile(lock, inspect(lockPath)) || Date.now() - started >= 5000) throw new Error("Fullscreen settings lock ownership expired; retry installation");
+		renameSync(staging, settingsPath);
+		staging = undefined;
+		return { changed: true, recognized: true };
+	} finally {
+		// Only clean our own artifacts while the original parent remains canonical.
+		if (realpathSync(home) === home) {
+			if (staging) unlinkSync(staging);
+			if (sameFile(lock, inspect(lockPath))) rmdirSync(lockPath);
+		}
+	}
+}

package/scripts/test-packed-runner.mjs

@@ -12,6 +12,10 @@ const root = fileURLToPath(new URL("..", import.meta.url));
 const temporary = mkdtempSync(join(tmpdir(), "gentle-pi-packed-runner-"));
 const packDirectory = join(temporary, "pack");
 const installDirectory = join(temporary, "install");
+// Every child inherits only disposable Pi homes, never the operator's settings.
+const agentHome = join(temporary, "agent");
+const piAgentHome = join(temporary, "pi-agent");
+const isolatedEnv = { ...process.env, GENTLE_PI_AGENT_HOME: agentHome, PI_CODING_AGENT_DIR: piAgentHome };
 
 function windowsNpmInvocation() {
 	const candidates = [];
@@ -32,12 +36,16 @@ function windowsNpmInvocation() {
 
 function runNpm(arguments_, options) {
 	const invocation = process.platform === "win32" ? windowsNpmInvocation() : { file: "npm", prefix: [] };
-	return execFileSync(invocation.file, [...invocation.prefix, ...arguments_], options);
+	return execFileSync(invocation.file, [...invocation.prefix, ...arguments_], { ...options, env: isolatedEnv });
 }
 
 try {
 	mkdirSync(packDirectory);
 	mkdirSync(installDirectory);
+	mkdirSync(agentHome);
+	mkdirSync(piAgentHome);
+	const originalSettings = '{ "tuiMode": "regular", "theme": "packed-fixture" }\n';
+	writeFileSync(join(agentHome, "settings.json"), originalSettings);
 	const packed = JSON.parse(runNpm(["pack", "--ignore-scripts", "--json", "--pack-destination", packDirectory], {
 		cwd: root,
 		encoding: "utf8",
@@ -50,7 +58,13 @@ try {
 		cwd: installDirectory,
 		stdio: "inherit",
 	});
+	// This is an ordinary npm consumer, not Pi's managed global npm directory.
+	assert.equal(readFileSync(join(agentHome, "settings.json"), "utf8"), originalSettings);
+	assert.deepEqual(readdirSync(agentHome), ["settings.json"]);
+	assert.deepEqual(readdirSync(piAgentHome), []);
+	assert.equal(existsSync(join(installDirectory, ".pi", "settings.json")), false);
 	const packageRoot = join(installDirectory, "node_modules", "gentle-pi");
+	assert.ok(existsSync(join(packageRoot, "scripts", "install-tui-mode-setting.mjs")));
 	const { nativeReviewAbandonAuthorization } = await import(pathToFileURL(join(packageRoot, "runtime", "native-review-cli.mjs")).href);
 	const abandonAuthorization = nativeReviewAbandonAuthorization({
 		lineage: "review-abc",
@@ -77,7 +91,7 @@ try {
 	const versions = readdirSync(join(packageRoot, ".gentle-ai"), { withFileTypes: true }).filter((entry) => entry.isDirectory() && /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z][0-9A-Za-z.]*)?$/.test(entry.name));
 	if (versions.length !== 1) throw new Error("packed install did not contain exactly one package-local Gentle AI version");
 	const executable = join(packageRoot, ".gentle-ai", versions[0].name, process.platform === "win32" ? "gentle-ai.exe" : "gentle-ai");
-	const capabilities = JSON.parse(execFileSync(executable, ["review", "capabilities", "--contract", "gentle-ai.review-integration/v2"], { cwd: installDirectory, encoding: "utf8" }));
+	const capabilities = JSON.parse(execFileSync(executable, ["review", "capabilities", "--contract", "gentle-ai.review-integration/v2"], { cwd: installDirectory, encoding: "utf8", env: isolatedEnv }));
 	// Decode with the PACKED consumer's own decoder rather than comparing the
 	// schema string against a list hand-copied into this script. The copy was a
 	// second, silent pin: it accepted only `capabilities/v2`, so the moment the

package/scripts/types-baseline.json

@@ -0,0 +1,99 @@
+{
+  "note": "Recorded TypeScript diagnostics. Regenerate with `node scripts/check-types.mjs --update` after fixing or deliberately accepting diagnostics. This file may only shrink without a review decision.",
+  "total": 205,
+  "byFileAndCode": {
+    "extensions/codegraph-tools.ts TS2339": 1,
+    "extensions/codegraph-tools.ts TS2345": 1,
+    "extensions/gentle-agents.ts TS2322": 3,
+    "extensions/gentle-ai.ts TS2322": 5,
+    "extensions/gentle-ai.ts TS2339": 11,
+    "extensions/gentle-ai.ts TS2345": 15,
+    "extensions/gentle-ai.ts TS2365": 1,
+    "extensions/gentle-ai.ts TS2488": 2,
+    "extensions/gentle-ai.ts TS2554": 1,
+    "extensions/gentle-ai.ts TS2740": 1,
+    "extensions/gentle-shell.ts TS2556": 1,
+    "extensions/quiet-tools.ts TS2339": 1,
+    "extensions/quiet-tools.ts TS2352": 2,
+    "lib/agents-messaging.ts TS2322": 1,
+    "lib/native-review-cli.ts TS2304": 6,
+    "lib/native-review-cli.ts TS2339": 1,
+    "lib/native-review-cli.ts TS2345": 1,
+    "lib/review-candidate-view.ts TS2353": 2,
+    "lib/review-compact-contract.ts TS2322": 2,
+    "lib/review-compact-contract.ts TS2365": 1,
+    "lib/review-integration-v2.ts TS2322": 2,
+    "lib/review-integration-v2.ts TS2352": 2,
+    "lib/review-publication-gate.ts TS2365": 2,
+    "lib/review-transaction.ts TS2322": 1,
+    "lib/review-transaction.ts TS2345": 1,
+    "lib/runtime-metrics-children.ts TS2345": 2,
+    "lib/sdd-preflight.ts TS2352": 1,
+    "lib/sdd-preflight.ts TS2365": 1,
+    "lib/shell-sidebar-layout.ts TS2341": 1,
+    "tests/agents-queries.test.ts TS2322": 1,
+    "tests/agents-queries.test.ts TS2345": 3,
+    "tests/agents-runner-process.test.ts TS2322": 1,
+    "tests/devbinary/native-review-parity.devtest.ts TS2339": 1,
+    "tests/devbinary/pi-host-relay.devtest.ts TS2339": 3,
+    "tests/gentle-agents.test.ts TS2339": 1,
+    "tests/gentle-agents.test.ts TS2352": 2,
+    "tests/gentle-ai-binary.test.ts TS2339": 2,
+    "tests/gentle-ai-installer.test.ts TS2339": 7,
+    "tests/gentle-ai-installer.test.ts TS2556": 1,
+    "tests/gentle-ai-renderer.test.ts TS2345": 6,
+    "tests/gentle-ai.test.ts TS2339": 1,
+    "tests/gentle-ai.test.ts TS2352": 8,
+    "tests/gentle-ai.test.ts TS2353": 1,
+    "tests/gentle-shell.test.ts TS2352": 1,
+    "tests/gentle-shell.test.ts TS2540": 1,
+    "tests/gentle-shell.test.ts TS2554": 1,
+    "tests/maintainer/provider-relay.maintest.ts TS2339": 17,
+    "tests/maintainer/provider-relay.maintest.ts TS2345": 1,
+    "tests/maintainer/provider-relay.maintest.ts TS2540": 2,
+    "tests/native-binary-gate.test.ts TS2339": 2,
+    "tests/native-review-consent.test.ts TS2554": 1,
+    "tests/native-review-parity-runtime.test.ts TS2339": 1,
+    "tests/quiet-tool-rendering.test.ts TS2339": 1,
+    "tests/quiet-tool-rendering.test.ts TS2345": 1,
+    "tests/review-agent-end-preflight.test.ts TS2339": 2,
+    "tests/review-agent-end-preflight.test.ts TS2345": 1,
+    "tests/review-candidate-view.test.ts TS2353": 4,
+    "tests/review-candidate-view.test.ts TS2540": 2,
+    "tests/review-candidate-view.test.ts TS2554": 2,
+    "tests/review-controller-native-recovery.test.ts TS2345": 1,
+    "tests/review-controller-native-routing.test.ts TS2339": 2,
+    "tests/review-controller-workspace-root.test.ts TS2322": 2,
+    "tests/review-correction-lifecycle.test.ts TS2339": 4,
+    "tests/review-gate.test.ts TS2322": 5,
+    "tests/review-gate.test.ts TS2345": 4,
+    "tests/review-gate.test.ts TS2740": 1,
+    "tests/review-graph-schema.test.ts TS2352": 2,
+    "tests/review-host-relay-routing.test.ts TS2345": 1,
+    "tests/review-host-relay-routing.test.ts TS2739": 1,
+    "tests/review-integration-v2-forward.test.ts TS2322": 1,
+    "tests/review-last-event-closure.test.ts TS2322": 1,
+    "tests/review-policy-judgment-day.test.ts TS2345": 1,
+    "tests/review-policy-ordinary.test.ts TS2345": 1,
+    "tests/review-policy-ordinary.test.ts TS2554": 1,
+    "tests/review-risk-assessment.test.ts TS2345": 1,
+    "tests/review-risk-assessment.test.ts TS2352": 1,
+    "tests/review-session-standing-permission-controller.test.ts TS2339": 1,
+    "tests/review-session-standing-permission-controller.test.ts TS2345": 1,
+    "tests/review-session-standing-permission-controller.test.ts TS2352": 1,
+    "tests/review-session-standing-permission-ipc.test.ts TS2322": 4,
+    "tests/review-test-fixtures.ts TS2739": 1,
+    "tests/review-transaction.test.ts TS2339": 1,
+    "tests/runtime-metrics-extension.test.ts TS2345": 1,
+    "tests/sdd-preflight.test.ts TS2352": 1,
+    "tests/sdd-preflight.test.ts TS2554": 2,
+    "tests/sdd-research-capabilities.test.ts TS2339": 1,
+    "tests/sdd-research-capabilities.test.ts TS2698": 1,
+    "tests/sdd-research-live.test.ts TS2322": 1,
+    "tests/shell-sidebar-layout.test.ts TS2339": 1,
+    "tests/shell-sidebar-layout.test.ts TS2345": 1,
+    "tests/shell-usage-view.test.ts TS2322": 1,
+    "tests/skill-registry.test.ts TS2345": 5,
+    "tests/writer-edit-surface-scope.test.ts TS2352": 1
+  }
+}

package/scripts/verify-package-files.mjs

@@ -30,6 +30,7 @@ const requiredPaths = [
   "assets/agents/sdd-init.md",
   "assets/agents/sdd-onboard.md",
   "assets/agents/sdd-proposal.md",
+  "assets/agents/sdd-remediate.md",
   "assets/agents/sdd-research.md",
   "assets/agents/sdd-spec.md",
   "assets/agents/sdd-status.md",
@@ -180,6 +181,7 @@ const contractHashes = {
   "contracts/review-integration/v2/schemas/repair.schema.json": "98a85fd45a8ae7f6211ffeeb3f9c478fa1dd1c17f385751f15f2111e6c3ab167",
   "contracts/review-integration/v2/schemas/start.schema.json": "2991e3fcca672d9257d61b6a336fb34e58b15a8e03f8a09a7adf892cae6a8085",
   "contracts/review-integration/v2/schemas/status.schema.json": "c4dcc736cfc6300560a3c4262d2d982368529d5c49d58d499552a3b0beef9212",
+  "contracts/telemetry/runtime-aggregate-v1.schema.json": "26be905d39fe8274e049e1270553695b7540a3b24571d42eb7d96c5a7deb48b5",
   "docs/review-integration.md": "95a3df92785bc4d9f3b99e702aaf817ae0440bd16c83218d2c3f2aca67c280fb",
 };
 
@@ -338,7 +340,7 @@ async function main() {
   });
 
   if (driftedContracts.length > 0) {
-    console.error("gentle-pi packaged review-integration/v1 and review-integration/v2 contract bytes drifted from the pinned v2.7.0 runtime's vendored Gentle AI contract artifacts:");
+    console.error("gentle-pi packaged review-integration/v1 and review-integration/v2 contract bytes drifted from the pinned v2.8.0 runtime's vendored Gentle AI contract artifacts:");
     for (const drift of driftedContracts) console.error(`- ${drift.relativePath}: expected ${drift.expected}, got ${drift.actual}`);
     process.exit(1);
   }
@@ -383,7 +385,7 @@ async function main() {
     process.exit(1);
   }
 
-  console.log(`gentle-pi package resource check passed (${requiredPaths.length} files; ${Object.keys(contractHashes).length} exact byte-pinned contract artifacts for the v2.7.0 runtime).`);
+  console.log(`gentle-pi package resource check passed (${requiredPaths.length} files; ${Object.keys(contractHashes).length} exact byte-pinned contract artifacts for the v2.8.0 runtime).`);
 }
 
 const isMainModule = process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;

package/skills/_shared/review-ledger-contract.md

@@ -79,7 +79,7 @@ Dangerous-command confirmation/safety and destructive-review-maintenance consent
 
 ## Judgment Day
 
-Judgment Day starts only when explicitly requested and replaces ordinary review for that lineage.
+Judgment Day is independent: it neither enables nor replaces ordinary review; a separately requested ordinary review remains independent.
 
 Judgment Day starts with exactly two blind judges and zero refuters.
 
@@ -87,4 +87,20 @@ Judgment Day alone may iterate discovery and scoped re-judgment, for at most two
 
 Findings surviving round two escalate; no third-round transition exists.
 
+A standalone `jd-fix-agent` dispatch requires no graph-v1 or native review lineage and is accepted only with this exact Markdown shape. The correction batch contains only one round (`1 of 2` or `2 of 2`) and one lowercase SHA-256. The exact frozen finding rows are one JSON object per line, use only the canonical row fields, and exactly match the authorized IDs.
+
+```markdown
+## Judgment Day activation
+User explicitly requested Judgment Day.
+## Exact authorized severe IDs
+- `JD-A-001`
+## Judgment Day correction batch
+Round: 1 of 2.
+Frozen ledger SHA-256: `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa`
+## Exact frozen finding rows
+{"id":"JD-A-001","lens":"judgment-day","location":"path/to/authorized-file.ts:1","severity":"CRITICAL","status_at_freeze":"open","evidence_class":"deterministic","evidence_claim":"Concrete user-impact claim supported by the frozen location."}
+## Allowed edit surfaces
+path/to/authorized-file.ts
+```
+
 Judgment Day stays mutable on graph-v1. Its reducer, replay, object-store, lock, snapshot, and graph receipt-validation dependencies remain live even though ordinary authority is native.

package/skills/issue-creation/SKILL.md

@@ -46,7 +46,7 @@ LABEL_ARGS+=(--label "$LABEL") # Repeat only for each permitted discovered label
    gh issue list --repo "$TARGET" --state all --search "$QUERY" --limit 1000
    ```
 
-   If results are saturated or completeness is uncertain, narrow the read-only search or stop. Comment on a confirmed duplicate instead of creating one. Before commenting on a confirmed duplicate, perform the same privacy scan/redaction on the exact comment body as for publication.
+   The agent must complete the duplicate search proactively and retain evidence of its result. If results are saturated or completeness is uncertain, narrow the read-only search or stop. Comment on a confirmed duplicate instead of creating one. Before commenting on a confirmed duplicate, perform the same privacy scan/redaction on the exact comment body as for publication.
 2. Select one repository-provided form only when its declared purpose matches. If multiple forms match and policy does not distinguish them, stop and request that decision.
 3. For a YAML form, read its schema and establish controls in declared order. Support only `input`, `textarea`, `dropdown`, and `checkboxes`. Markdown controls are non-answer guidance: honor their visible instructions when collecting and materializing adjacent answers, but do not render them as response sections. Fail closed before mutation on malformed, unsupported, missing, or ambiguous required structure or answers. A malformed schema, or missing or ambiguous required answers, fail closed: do not open a browser or mutate. A browser handoff is available only when the user explicitly requests browser completion or a syntactically valid selected form cannot safely/faithfully be represented by the automated path; otherwise report why automation is unsafe and stop.
 
@@ -54,7 +54,7 @@ LABEL_ARGS+=(--label "$LABEL") # Repeat only for each permitted discovered label
 | --- | --- |
 | `input` / `textarea` | Preserve the visible label. Require an answer when `validations.required` is true; otherwise render `_No response_`. |
 | `dropdown` | Preserve visible labels and options. Require exact selected option text; single-select has one selection, and multi-select preserves selections in declared options order. A required dropdown needs at least one valid selection; an optional dropdown with no selection renders `_No response_`. |
-| `checkboxes` | Preserve the visible label and every option as `- [x]` or `- [ ]` in declared order. Enforce individually required checkboxes and require explicit first-person affirmation for first-person option text. |
+| `checkboxes` | Preserve the visible label and every option as `- [x]` or `- [ ]` in declared order. Enforce individually required checkboxes. For agent-verifiable operational options, proactively complete the action and mark it only with retained evidence; the agent may explicitly attest only its own evidence-backed work and must not attribute its actions to the user. Personal facts, consent, legal declarations, and other first-person user assertions require explicit user affirmation; require explicit first-person affirmation for such user declarations. Do not blanket-check checkboxes: a request to publish does not affirm any checkbox. |
 
 For each answer, render `### <visible label>` followed by its materialized value. For `textarea.attributes.render`, fence the answer with the declared language and a fence long enough for its content. Never invent answers, selections, confirmations, or labels.
 
@@ -62,7 +62,7 @@ A Markdown template may be completed only from known evidence into the same priv
 
 ## Review And Publication
 
-Before the single create attempt, review the target, title, selected form or permitted fallback, exact body, and permitted labels. Perform a privacy scan immediately before publication: replace private project names, usernames, hostnames, home paths, credentials, and private network addresses with useful placeholders without removing reproduction structure.
+Before the single create attempt, review the target, title, selected form or permitted fallback, exact body, and permitted labels. The agent must complete the privacy scan/redaction of the exact body immediately before publication and retain evidence of it: replace private project names, usernames, hostnames, home paths, credentials, and private network addresses with useful placeholders without removing reproduction structure.
 
 Create one owner-only temporary directory outside the repository for both private files; restrict it to the current user and clean up both files on every exit/outcome:
 

package/skills/judgment-day/SKILL.md

@@ -11,12 +11,10 @@ metadata:
 
 Load this skill only when the user explicitly requests Judgment Day, Judgement Day, dual/adversarial review, or an equivalent trigger. Resolve one exact target before starting.
 
-Judgment Day is a standalone developer tool: judges run whenever asked, on any runtime, and need no review transaction, runtime identity, or delivery-receipt machinery to start. It neither enables nor replaces an ordinary 4R lifecycle; a separately requested ordinary review remains independent.
+Judgment Day is a standalone developer tool: judges run whenever asked, on any runtime, and need no review transaction, runtime identity, or delivery-receipt machinery to start. Judgment Day is independent: it neither enables nor replaces ordinary review; a separately requested ordinary review remains independent.
 
 Judgment Day starts only when explicitly requested. It does not start, configure, or consume ordinary review for that lineage.
 
-Historical compatibility note (obsolete): Judgment Day starts only when explicitly requested and replaces ordinary review for that lineage. Current behavior is the independent lifecycle above.
-
 ## Transaction Rules
 
 Judgment Day starts with exactly two blind judges and zero refuters.
@@ -57,6 +55,22 @@ WARNING and SUGGESTION candidates become one-time informational rows and never s
 
 ## Fix Boundary
 
+A standalone `jd-fix-agent` dispatch requires no graph-v1 or native review lineage and is accepted only as one standalone agent with this exact Markdown shape. The `## Judgment Day activation` section contains only `User explicitly requested Judgment Day.`. The parent replaces the example ID, frozen ledger hash, row data, and surface with controller-authorized values. The correction batch contains only one round (`1 of 2` or `2 of 2`) and one lowercase SHA-256. The exact frozen finding rows are one JSON object per line, use only the canonical row fields, and exactly match the authorized IDs.
+
+```markdown
+## Judgment Day activation
+User explicitly requested Judgment Day.
+## Exact authorized severe IDs
+- `JD-A-001`
+## Judgment Day correction batch
+Round: 1 of 2.
+Frozen ledger SHA-256: `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa`
+## Exact frozen finding rows
+{"id":"JD-A-001","lens":"judgment-day","location":"path/to/authorized-file.ts:1","severity":"CRITICAL","status_at_freeze":"open","evidence_class":"deterministic","evidence_claim":"Concrete user-impact claim supported by the frozen location."}
+## Allowed edit surfaces
+path/to/authorized-file.ts
+```
+
 Fix only the exact controller-authorized severe IDs in the one supplied batch.
 
 Do not add findings, alter frozen claims, authorize transitions, deliver, publish, or start another actor.