gentle-pi 3.1.1 → 3.2.1

package/tests/opaque-pi-reviewer-adapter.test.ts

@@ -8,6 +8,7 @@ import {
 	OPAQUE_PI_REVIEWER_ARGV,
 	OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE,
 	OpaquePiReviewerTransportError,
+	extractPiAssistantText,
 	resolvePiLaunch,
 	runOpaquePiReviewer,
 } from "../lib/opaque-pi-reviewer-adapter.ts";
@@ -43,10 +44,12 @@ const PROMPT_BYTES = Buffer.concat([
 	Buffer.from("opaque prompt\r\n\u0000", "utf8"),
 	Buffer.from([0x01, 0xff, 0xfe, 0x00]),
 ]);
-const OUTPUT_BYTES = Buffer.concat([
-	Buffer.from("opaque output\r\n\u0000", "utf8"),
-	Buffer.from([0x07, 0xff, 0xfe, 0x00]),
-]);
+const DEFAULT_OUTPUT_TEXT = "opaque output\r\n\u03b5 \u2014 unicode stays intact\n";
+
+const OUTPUT_BYTES = piEventStream(
+	...userTurn("opaque prompt"),
+	...assistantTurn([{ type: "text", text: DEFAULT_OUTPUT_TEXT }]),
+);
 
 interface OpaqueHarness {
 	directory: string;
@@ -94,6 +97,34 @@ function readLog(path: string): OpaquePiLog[] {
 		.map((line) => JSON.parse(line) as OpaquePiLog);
 }
 
+// The reviewer child runs `pi --mode json`, so its stdout is a newline-
+// delimited pi event stream. These helpers build the minimal stream shapes the
+// extraction has to understand, including the shapes behind the empty-output
+// field reports (#1140: a reviewer that answers with a tool call writes zero
+// usable bytes in text mode and exits 0 in silence).
+function piEventStream(...events: readonly unknown[]): Buffer {
+	return Buffer.from(events.map((event) => JSON.stringify(event)).join("\n") + "\n", "utf8");
+}
+
+function userTurn(text: string): unknown[] {
+	const message = { role: "user", content: [{ type: "text", text }] };
+	return [
+		{ type: "message_start", message },
+		{ type: "message_end", message },
+	];
+}
+
+function assistantTurn(parts: readonly Record<string, unknown>[], reviewerModel?: string): unknown[] {
+	const content = parts.map((part) => ({ ...part }));
+	const message: Record<string, unknown> = { role: "assistant", content };
+	if (reviewerModel !== undefined) message.model = reviewerModel;
+	return [
+		{ type: "message_start", message },
+		{ type: "message_end", message },
+		{ type: "agent_end", messages: [message] },
+	];
+}
+
 async function rejectsWithTransportError(
 	promise: Promise<unknown>,
 	kind: (typeof OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE)[keyof typeof OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE],
@@ -107,8 +138,22 @@ async function rejectsWithTransportError(
 	return caught!;
 }
 
-test("the opaque adapter streams arbitrary prompt and stdout bytes verbatim through the fixed Pi subprocess", async (t) => {
-	const fixture = harness(t);
+// #1140/#1156: the child runs `pi --mode json` and the transport emits the
+// final assistant text of that event stream. The prompt side stays byte-
+// verbatim; the output side is pi's own envelope, so a silent or unintelligible
+// run becomes a typed, evidenced failure instead of zero bytes and exit 0.
+const OUTPUT_TEXT = "opaque output\r\n\u03b5 \u2014 unicode stays intact\nsecond assistant text part";
+
+function eventStreamFor(text: string): Buffer {
+	return piEventStream(
+		...userTurn("opaque prompt"),
+		...assistantTurn([{ type: "text", text }], "pi-test-model"),
+		{ type: "agent_settled" },
+	);
+}
+
+test("the opaque adapter streams the prompt verbatim and emits the pi event stream's final assistant text", async (t) => {
+	const fixture = harness(t, { OPAQUE_PI_OUTPUT_B64: eventStreamFor(OUTPUT_TEXT).toString("base64") });
 	const result = await runOpaquePiReviewer(PROMPT_BYTES, {
 		piExecutable: fixture.pi,
 		environment: fixture.environment,
@@ -116,8 +161,8 @@ test("the opaque adapter streams arbitrary prompt and stdout bytes verbatim thro
 	});
 
 	assert.equal(result.promptByteLength, PROMPT_BYTES.length);
-	assert.equal(result.stdoutByteLength, OUTPUT_BYTES.length);
-	assert.deepEqual(result.stdout, OUTPUT_BYTES);
+	assert.equal(result.stdoutByteLength, Buffer.byteLength(OUTPUT_TEXT));
+	assert.deepEqual(result.stdout, Buffer.from(OUTPUT_TEXT, "utf8"));
 	assert.deepEqual(readFileSync(fixture.stdinCapturePath), PROMPT_BYTES);
 
 	const calls = readLog(fixture.logPath);
@@ -129,6 +174,100 @@ test("the opaque adapter streams arbitrary prompt and stdout bytes verbatim thro
 	assert.equal(existsSync(calls[0]!.cwd), false, "the empty scratch directory is removed after success");
 });
 
+test("the extraction mirrors the pi event stream: every assistant text part in order, nothing else", () => {
+	const streamed = piEventStream(
+		...userTurn("prompt"),
+		...assistantTurn([{ type: "thinking", thinking: "hidden" }, { type: "text", text: "first " }], "pi-a"),
+		...assistantTurn([{ type: "text", text: "second" }], "pi-b"),
+	);
+	const extracted = extractPiAssistantText(streamed);
+	assert.equal(extracted.kind, "text");
+	if (extracted.kind === "text") assert.equal(extracted.text, "first second");
+
+	const single = extractPiAssistantText(eventStreamFor("{\"findings\": []}"));
+	assert.equal(single.kind, "text");
+	if (single.kind === "text") assert.equal(single.text, "{\"findings\": []}");
+
+	// A stream pi could not have produced is not silently passed through.
+	assert.equal(extractPiAssistantText(Buffer.from("garbage, not an event stream", "utf8")).kind, "none");
+	assert.equal(extractPiAssistantText(Buffer.alloc(0)).kind, "none");
+});
+
+test("a silent or unintelligible reviewer run fails typed with the evidence the event stream carries", async (t) => {
+	const fixture = harness(t);
+
+	const silent = await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: { ...fixture.environment, OPAQUE_PI_MODE: "empty" }, timeoutMs: 10_000 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.EMPTY_OUTPUT,
+	);
+	assert.equal(silent.evidence?.stdoutKind, "no-output");
+
+	const unintelligible = await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: { ...fixture.environment, OPAQUE_PI_OUTPUT_B64: Buffer.from("not json at all", "utf8").toString("base64") }, timeoutMs: 10_000 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.EMPTY_OUTPUT,
+	);
+	assert.equal(unintelligible.evidence?.stdoutKind, "not-a-pi-event-stream");
+	assert.match(unintelligible.message, /no assistant text|not a pi event stream|no output/i);
+
+	const textless = await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: { ...fixture.environment, OPAQUE_PI_OUTPUT_B64: piEventStream(...userTurn("prompt"), { type: "agent_settled" }).toString("base64") }, timeoutMs: 10_000 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.EMPTY_OUTPUT,
+	);
+	assert.equal(textless.evidence?.stdoutKind, "no-assistant-text");
+});
+
+test("a reviewer run that spent its turn on a tool call reports that in the evidence instead of vanishing", async (t) => {
+	const fixture = harness(t, {
+		OPAQUE_PI_OUTPUT_B64: piEventStream(
+			...userTurn("prompt"),
+			...assistantTurn([{ type: "toolCall", id: "call_1", name: "bash" }], "nan/deepseek-v4-flash"),
+		).toString("base64"),
+	});
+	const error = await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: fixture.environment, timeoutMs: 10_000 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.EMPTY_OUTPUT,
+	);
+	assert.equal(error.evidence?.stdoutKind, "no-assistant-text");
+	assert.equal(error.evidence?.toolCallAttempted, true);
+	assert.equal(error.evidence?.reviewerModel, "nan/deepseek-v4-flash");
+	assert.match(error.message, /tool call/i);
+	assert.match(error.message, /nan\/deepseek-v4-flash/);
+});
+
+test("a tool-call attempt followed by text still yields the text", async (t) => {
+	const fixture = harness(t, {
+		OPAQUE_PI_OUTPUT_B64: piEventStream(
+			...userTurn("prompt"),
+			...assistantTurn([{ type: "toolCall", id: "call_1", name: "bash" }]),
+			...assistantTurn([{ type: "text", text: "{\"verdict\": \"pass\"}" }], "nan/glm5.3-flash"),
+		).toString("base64"),
+	});
+	const result = await runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: fixture.environment, timeoutMs: 10_000 });
+	assert.deepEqual(result.stdout, Buffer.from("{\"verdict\": \"pass\"}", "utf8"));
+});
+
+test("caller-owned launch arguments ride the frozen argv verbatim and are validated before spawn", async (t) => {
+	const fixture = harness(t, { OPAQUE_PI_OUTPUT_B64: eventStreamFor("ok").toString("base64") });
+	await runOpaquePiReviewer(PROMPT_BYTES, {
+		piExecutable: fixture.pi,
+		environment: fixture.environment,
+		timeoutMs: 10_000,
+		extraArguments: ["--model", "nan/glm5.3-flash", "-e", "/abs/auth-adapter.ts"],
+	});
+	const calls = readLog(fixture.logPath);
+	assert.equal(calls.length, 1);
+	assert.deepEqual(calls[0]!.argv, [...OPAQUE_PI_REVIEWER_ARGV, "--model", "nan/glm5.3-flash", "-e", "/abs/auth-adapter.ts"]);
+
+	await assert.rejects(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: fixture.environment, timeoutMs: 10_000, extraArguments: ["--model", ""] }),
+		/non-empty/,
+	);
+	await assert.rejects(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: fixture.environment, timeoutMs: 10_000, extraArguments: [42 as unknown as string] }),
+		/non-empty/,
+	);
+});
+
 test("the opaque adapter returns typed transport errors for launch, nonzero, empty, timeout, and cancellation", async (t) => {
 	const fixture = harness(t);
 	await rejectsWithTransportError(
@@ -228,8 +367,13 @@ test("the opaque adapter has no review lifecycle imports or identifiers", () =>
 	const adapterPath = fileURLToPath(new URL("../lib/opaque-pi-reviewer-adapter.ts", import.meta.url));
 	const source = readFileSync(adapterPath, "utf8");
 	assert.doesNotMatch(source, /review-integration|gentle-ai|materialize|submit/i);
+	// The guard reads source, not strings: the one lifecycle-shaped word the
+	// transport may spell is pi's own quoted wire key for the selection the
+	// child reports in its events (#1140). It is data there, never an
+	// identifier, so it is stripped before the scan.
+	const withoutWireKeys = source.replaceAll('"model"', '""');
 	for (const identifier of ["lineage", "target", "revision", "receipt", "lens", "order", "subject", "schema", "capture", "submission", "status", "model", "provider", "profile"]) {
-		assert.doesNotMatch(source, new RegExp(`\\b${identifier}\\b`, "i"), `adapter must not contain lifecycle identifier ${identifier}`);
+		assert.doesNotMatch(withoutWireKeys, new RegExp(`\\b${identifier}\\b`, "i"), `adapter must not contain lifecycle identifier ${identifier}`);
 	}
 });
 

package/tests/package-manifest.test.ts

@@ -309,20 +309,20 @@ test("package manifest installs pi-pretty through a wrapper without bundling nat
 	);
 });
 
-test("package verification binds the published Gentle AI v3.0.1 runtime pin", () => {
+test("package verification binds the published Gentle AI v3.2.1 runtime pin", () => {
 	const installer = readFileSync(join(PACKAGE_ROOT, "scripts", "gentle-ai-installer.mjs"), "utf8");
 	const binary = readFileSync(join(PACKAGE_ROOT, "lib", "gentle-ai-binary.ts"), "utf8");
 	const verifier = readFileSync(join(PACKAGE_ROOT, "scripts", "verify-package-files.mjs"), "utf8");
 
-	assert.match(installer, /INSTALLER_VERSION = "3\.0\.1"/);
+	assert.match(installer, /INSTALLER_VERSION = "3\.2\.1"/);
 	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_PACKAGE.*GENTLE_AI_WINDOWS_SOURCE_MODULE/);
-	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:r2z8yf0CdL0ZPPkMEKI3km6SitjOIC\/DQDvtipc1Igs="/);
+	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:0QFo0ERv8\/3lgTepEG0E\/P7yD9qXXCx2M7ppQviVHMo="/);
 	assert.match(installer, /GOTOOLCHAIN: "local"/);
 	assert.match(installer, /GOSUMDB: "sum\.golang\.org"/);
 	assert.match(binary, /GENTLE_AI_VERSION = INSTALLER_VERSION/);
 	assert.match(binary, /GO_SUMDB_SOURCE_BUILD/);
 	assert.match(binary, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM/);
-	assert.match(verifier, /v3\.0\.1/);
+	assert.match(verifier, /v3\.2\.1/);
 });
 
 
@@ -1574,9 +1574,9 @@ test("pi-pretty wrapper uses cached ESM loading for compiled and pnpm symlink in
 	assert.match(wrapper, /quietToolsEnabled/);
 });
 
-test("Gentle Shell v3.1.1 package and runtime stop before publication", () => {
+test("Gentle Shell v3.2.1 package and runtime stop before publication", () => {
 	const packageJson = readPackageJson();
-	assert.equal(packageJson.version, "3.1.1", "the release manifest must remain explicitly pinned to v3.1.1");
+	assert.equal(packageJson.version, "3.2.1", "the release manifest must remain explicitly pinned to v3.2.1");
 	assert.equal(
 		packageJson.scripts?.test,
 		"node --experimental-strip-types --test tests/*.test.ts && pnpm run check:provider-contract && pnpm run test:harness",

package/tests/review-base-ref-hint.test.ts

@@ -0,0 +1,39 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { __testing } from "../extensions/gentle-ai.ts";
+import { BASE_REF_ACCEPTED_FORMS } from "../lib/review-candidate-view.ts";
+
+const BASE_REF_REJECTION_REASONS = ["base-ref-unresolvable", "base-ref-ambiguous", "base-ref-moved", "base-ref-invalid"];
+
+test("a blocked native START base-ref rejection carries the accepted-forms hint", () => {
+	for (const reason of BASE_REF_REJECTION_REASONS) {
+		const result = __testing.nativeStartRejection(reason);
+		assert.equal(result.status, "blocked", reason);
+		assert.equal(result.reason, reason, reason);
+		assert.equal(result.hint, BASE_REF_ACCEPTED_FORMS, reason);
+	}
+});
+
+test("a blocked native START rejection for a reason unrelated to base refs carries no hint", () => {
+	const result = __testing.nativeStartRejection("committed-only-required");
+	assert.equal(result.status, "blocked");
+	assert.equal(result.reason, "committed-only-required");
+	assert.equal("hint" in result, false);
+});
+
+test("a blocked native STATUS base-ref rejection carries the accepted-forms hint", () => {
+	for (const reason of BASE_REF_REJECTION_REASONS) {
+		const result = __testing.nativeStatusInputRejection(reason);
+		assert.equal(result.status, "blocked", reason);
+		assert.equal(result.outcome, "native-status-input-invalid", reason);
+		assert.equal(result.reason, reason, reason);
+		assert.equal(result.hint, BASE_REF_ACCEPTED_FORMS, reason);
+	}
+});
+
+test("a blocked native STATUS rejection for a reason unrelated to base refs carries no hint", () => {
+	const result = __testing.nativeStatusInputRejection("committed-only-required");
+	assert.equal(result.status, "blocked");
+	assert.equal(result.reason, "committed-only-required");
+	assert.equal("hint" in result, false);
+});

package/tests/review-candidate-view.test.ts

@@ -10,6 +10,7 @@ import { join, resolve } from "node:path";
 import test from "node:test";
 import { gzipSync } from "node:zlib";
 import {
+	BASE_REF_ACCEPTED_FORMS,
 	CandidateViewRegistry,
 	CandidateViewError,
 	hasExpectedExecutableBits,
@@ -20,6 +21,7 @@ import {
 	digestChangedPathManifest,
 	injectReviewCandidateView,
 	readCandidateContextManifestPage,
+	resolveCanonicalCandidateBase,
 	type NativeCandidateProjectionDescriptor,
 } from "../lib/review-candidate-view.ts";
 import { assertCandidateOwnerParent, assertTrustedWindowsOwner, prepareCandidateOwnerParent, setWindowsAclAuthorityForTesting, validatePrivateWindowsDacl, validatePrivateWindowsOwner, WindowsDaclValidationError, WindowsOwnerValidationError } from "../lib/review-candidate-view-owner.ts";
@@ -653,6 +655,59 @@ test("explicit base resolution preserves structured for-each-ref output-limit di
 	assert.doesNotMatch(failure.message, /sensitive base-reference output/);
 });
 
+test("resolving an abbreviated commit id as an explicit base ref names the accepted forms", (t) => {
+	const contributorRoot = repository(t);
+	const fullId = git(contributorRoot, "rev-parse", "HEAD");
+	const abbreviated = fullId.slice(0, 7);
+	assert.throws(
+		() => resolveCanonicalCandidateBase(contributorRoot, abbreviated),
+		(error: unknown) => {
+			assert.ok(error instanceof CandidateViewError);
+			assert.equal(error.reason, "base-ref-unresolvable");
+			assert.match(error.message, /accepted forms/);
+			assert.ok(error.message.includes(BASE_REF_ACCEPTED_FORMS));
+			assert.match(error.message, /abbreviated commit ids are not accepted/);
+			return true;
+		},
+	);
+});
+
+test("resolving an ambiguous explicit base ref names the accepted forms", (t) => {
+	const contributorRoot = repository(t);
+	git(contributorRoot, "tag", "dupe");
+	git(contributorRoot, "branch", "dupe");
+	assert.throws(
+		() => resolveCanonicalCandidateBase(contributorRoot, "dupe"),
+		(error: unknown) => {
+			assert.ok(error instanceof CandidateViewError);
+			assert.equal(error.reason, "base-ref-ambiguous");
+			assert.match(error.message, /accepted forms/);
+			assert.ok(error.message.includes(BASE_REF_ACCEPTED_FORMS));
+			return true;
+		},
+	);
+});
+
+test("resolving an explicit base ref that names a tree, not a commit, reports it as unresolvable with the accepted forms instead of a generic git failure", (t) => {
+	const contributorRoot = repository(t);
+	const treeId = "b".repeat(40);
+	const executor: CandidateGitExecutor = (file, arguments_, options) => {
+		if (arguments_.at(-1) === `${treeId}^{commit}`) throw Object.assign(new Error("fatal: not a commit"), { status: 128, stdout: Buffer.from("") });
+		return execFileSync(file, arguments_, options);
+	};
+	let failure: unknown;
+	try {
+		new CandidateViewRegistry(executor).create({ contributorRoot, baseRef: treeId });
+	} catch (error) {
+		failure = error;
+	}
+	assert.ok(failure instanceof CandidateViewError);
+	assert.equal(failure.reason, "base-ref-unresolvable");
+	assert.match(failure.message, /it does not name a commit/);
+	assert.match(failure.message, /accepted forms/);
+	assert.ok(failure.message.includes(BASE_REF_ACCEPTED_FORMS));
+});
+
 test("every synchronous candidate-view Git command receives the explicit 64 MiB output limit", (t) => {
 	const calls: Array<{ arguments: readonly string[]; maxBuffer: number | undefined }> = [];
 	const executor: CandidateGitExecutor = (file, arguments_, options) => {

package/tests/review-controller-native-routing.test.ts

@@ -1171,6 +1171,7 @@ for (const statusSchema of [
 
 test("inspect with untrackedScope exclude resolves the intended-untracked stop in one round trip", async (t) => {
 	const { cwd, initial, target, selection } = untrackedStopFixture(t);
+	const baseRef = execFileSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" }).trim();
 	const requests: Array<Record<string, unknown>> = [],
 		retained = new Map();
 	const native = {
@@ -1180,7 +1181,11 @@ test("inspect with untrackedScope exclude resolves the intended-untracked stop i
 		},
 	} as unknown as NativeReviewCli;
 	const result = await __testing.executeReviewControllerOperation(
-		{ operation: "inspect", untrackedScope: "exclude" },
+		{
+			operation: "inspect",
+			input: JSON.stringify({ baseRef: "HEAD", committedOnly: true }),
+			untrackedScope: "exclude",
+		},
 		cwd,
 		native,
 		undefined,
@@ -1191,6 +1196,10 @@ test("inspect with untrackedScope exclude resolves the intended-untracked stop i
 	assert.equal(result.status, "ready");
 	assert.equal("selectionBinding" in result, false);
 	assert.equal(requests.length, 2);
+	for (const request of requests) {
+		assert.equal(request.baseRef, baseRef);
+		assert.equal(request.committedOnly, true);
+	}
 	assert.equal(requests[1]!.untrackedScope, "exclude");
 	assert.equal(requests[1]!.expectedUntrackedInventory, SHA);
 	assert.deepEqual(requests[1]!.intendedUntracked, []);
@@ -1960,6 +1969,56 @@ test("ordinary START transports native focus and safe policy inputs without rebu
 	assert.equal(statusCalls, 0);
 });
 
+test("INSPECT forwards an explicit committed-only base selector to negotiated STATUS", async (t) => {
+	const cwd = repository(t);
+	const baseRef = execFileSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" }).trim();
+	const requests: Array<Record<string, unknown>> = [];
+	const native = {
+		targetStatus: async (request: Record<string, unknown>) => {
+			requests.push(request);
+			return startStatus(cwd, baseRef);
+		},
+	} as unknown as NativeReviewCli;
+
+	const result = await __testing.executeReviewControllerOperation(
+		{ operation: "inspect", input: JSON.stringify({ baseRef, committedOnly: true }) },
+		cwd,
+		native,
+	);
+
+	assert.equal(result.status, "ready");
+	assert.deepEqual(
+		requests.map(({ baseRef: selectedBase, committedOnly }) => ({ baseRef: selectedBase, committedOnly })),
+		[{ baseRef, committedOnly: true }],
+	);
+});
+
+test("INSPECT rejects malformed committed-range selectors before negotiated STATUS", async (t) => {
+	const cwd = repository(t);
+	let targetCalls = 0;
+	const native = {
+		targetStatus: async () => {
+			targetCalls += 1;
+			return startStatus(cwd);
+		},
+	} as unknown as NativeReviewCli;
+
+	for (const input of [
+		{ baseRef: "HEAD", committedOnly: false },
+		{ committedOnly: true },
+		{ baseRef: "HEAD", committedOnly: true, mode: "ordinary" },
+	]) {
+		const rejected = await __testing.executeReviewControllerOperation(
+			{ operation: "inspect", input: JSON.stringify(input) },
+			cwd,
+			native,
+		);
+		assert.equal(rejected.outcome, "native-inspect-input-invalid");
+		assert.equal(rejected.mutation_outcome, "none");
+	}
+	assert.equal(targetCalls, 0);
+});
+
 test("ordinary START keeps default and explicit base selection fail-closed before native mutation", async (t) => {
 	const cwd = repository(t);
 	let targetCalls = 0;

package/tests/review-host-relay.test.ts

@@ -214,10 +214,20 @@ const PROMPT_BYTES = Buffer.concat([
 	Buffer.from('GENTLE_AI_REVIEW_BINDING {"lineage":"review-1d5aadacc600e167"}\n"quotes" \\backslash\r\n\u00e9\u{1F3A9}\n', "utf8"),
 	Buffer.from([0x00, 0x01, 0x07, 0xff, 0xfe, 0x00]),
 ]);
-const PI_OUTPUT_BYTES = Buffer.concat([
-	Buffer.from(`{"subject_hash":"sha256:${"a".repeat(64)}","findings":[]}\n`, "utf8"),
-	Buffer.from([0x00, 0xf0, 0x9f, 0x8e, 0xa9, 0xff, 0x0d, 0x0a]),
-]);
+// The reviewer child runs `pi --mode json` and the transport submits the
+// assistant text of that event stream, so the fixture wraps the reviewer
+// payload in the minimal event shape the extraction understands.
+const PI_REVIEWER_TEXT = `{"subject_hash":"sha256:${"a".repeat(64)}","findings":[]}\n🎉\r\n`;
+const piEventStream = (...events: readonly unknown[]): Buffer => Buffer.from(events.map((event) => JSON.stringify(event)).join("\n") + "\n", "utf8");
+const assistantEnd = (text: string, reviewerModel?: string) => {
+	const message: Record<string, unknown> = { role: "assistant", content: [{ type: "text", text }] };
+	if (reviewerModel !== undefined) message["model"] = reviewerModel;
+	return { type: "message_end", message };
+};
+const PI_OUTPUT_BYTES = piEventStream(
+	{ type: "message_start", message: { role: "user", content: [] } },
+	assistantEnd(PI_REVIEWER_TEXT),
+);
 
 function relayRequest(fixture: RelayHarness, overrides: Record<string, unknown> = {}) {
 	return {
@@ -293,18 +303,18 @@ test("relay contract constants are the compiled gentle-ai handshake values", ()
 // Happy path
 // ---------------------------------------------------------------------------
 
-test("relay happy path moves prompt and result bytes verbatim through a fresh empty scratch pi subprocess", async (t) => {
+test("relay happy path moves prompt bytes verbatim and the pi event stream's assistant text through a fresh empty scratch pi subprocess", async (t) => {
 	const fixture = harness(t);
 	const result = await runReviewHostRelaySlot(relayRequest(fixture));
 
 	assert.equal(result.promptByteLength, PROMPT_BYTES.length);
-	assert.equal(result.resultByteLength, PI_OUTPUT_BYTES.length);
+	assert.equal(result.resultByteLength, Buffer.byteLength(PI_REVIEWER_TEXT));
 	assert.equal(JSON.parse(result.submission).admission_decision, "completed");
 
 	// Prompt bytes reached pi stdin verbatim.
 	assert.deepEqual(readFileSync(fixture.stdinCapturePath), PROMPT_BYTES);
-	// Submission --input file bytes are EXACTLY the pi stdout bytes.
-	assert.deepEqual(readFileSync(fixture.submitCapturePath), PI_OUTPUT_BYTES);
+	// Submission --input file bytes are EXACTLY the reviewer's assistant text.
+	assert.deepEqual(readFileSync(fixture.submitCapturePath), Buffer.from(PI_REVIEWER_TEXT, "utf8"));
 
 	const gentleAiCalls = readLog(fixture.logPath);
 	assert.equal(gentleAiCalls.length, 2);
@@ -335,13 +345,13 @@ test("relay happy path moves prompt and result bytes verbatim through a fresh em
 	assert.equal(existsSync(piCalls[0]!.cwd!), false);
 });
 
-test("the pi lockdown argv is pinned exactly with no model or provider selection", async (t) => {
+test("the pi lockdown argv is pinned exactly with no default model or provider selection", async (t) => {
 	const fixture = harness(t);
 	await runReviewHostRelaySlot(relayRequest(fixture));
 	const piCalls = readLog(fixture.piLogPath);
 	const expected = [
 		"--print",
-		"--mode", "text",
+		"--mode", "json",
 		"--no-session",
 		"--no-tools",
 		"--no-extensions",
@@ -353,6 +363,8 @@ test("the pi lockdown argv is pinned exactly with no model or provider selection
 	];
 	assert.deepEqual([...REVIEW_HOST_RELAY_PI_ARGV], expected);
 	assert.deepEqual(piCalls[0]!.argv, expected);
+	// The default launch carries no selection; a caller-owned selection may only
+	// ride the validated forwarding path, never the pinned argv.
 	assert.equal(piCalls[0]!.argv.some((token) => token.startsWith("--model") || token.startsWith("--provider") || token.startsWith("--profile")), false);
 });
 
@@ -382,7 +394,7 @@ test("preparation snapshots mutable submission tokens and values before material
 	const result = await prepared;
 	assert.deepEqual(result.request.submission, SUBMISSION);
 	await submitReviewHostRelayPreparedResult(result);
-	assert.deepEqual(readFileSync(fixture.submitCapturePath), PI_OUTPUT_BYTES);
+	assert.deepEqual(readFileSync(fixture.submitCapturePath), Buffer.from(PI_REVIEWER_TEXT, "utf8"));
 });
 
 test("preparation keeps reviewer bytes private through deferred submission", async (t) => {
@@ -430,7 +442,7 @@ test("four reviewers cross a shared barrier before any result submission can beg
 	const prepared = await runReviewHostRelayReviewerGroup(requests);
 
 	assert.equal(prepared.length, REVIEWER_GROUP_LENSES.length);
-	assert.ok(prepared.every((result) => result.resultByteLength === PI_OUTPUT_BYTES.length));
+	assert.ok(prepared.every((result) => result.resultByteLength === Buffer.byteLength(PI_REVIEWER_TEXT)));
 	assert.equal(readLog(fixture.piLogPath).length, REVIEWER_GROUP_LENSES.length);
 	assert.equal(readLog(fixture.logPath).length, REVIEWER_GROUP_LENSES.length, "preparation materializes only; it does not submit");
 });
@@ -527,9 +539,65 @@ test("pi nonzero exit fails closed with a typed error and no submission", async
 
 test("empty pi stdout fails closed with a typed error and no submission", async (t) => {
 	const fixture = harness(t, { RELAY_FAKE_PI_MODE: "empty" });
-	await rejectsWithRelayError(runReviewHostRelaySlot(relayRequest(fixture)), REVIEW_HOST_RELAY_FAILURE.PI_EMPTY_OUTPUT, "pi");
+	const error = await rejectsWithRelayError(runReviewHostRelaySlot(relayRequest(fixture)), REVIEW_HOST_RELAY_FAILURE.PI_EMPTY_OUTPUT, "pi");
 	assert.equal(readLog(fixture.logPath).length, 1);
 	assert.equal(existsSync(fixture.submitCapturePath), false);
+	// #1156: the envelope carries what the child's stream revealed, not just a
+	// bare kind code.
+	assert.match(error.message, /no assistant text|no output|not a pi event stream/);
+});
+
+test("a reviewer run that only attempted a tool call fails typed with the child's own evidence", async (t) => {
+	const fixture = harness(t);
+	const error = await rejectsWithRelayError(runReviewHostRelaySlot(relayRequest(fixture, {
+		environment: {
+			...fixture.environment,
+			RELAY_FAKE_PROMPT_B64: PROMPT_BYTES.toString("base64"),
+			RELAY_FAKE_PI_OUTPUT_B64: piEventStream(
+				{ type: "message_end", message: { role: "assistant", content: [{ type: "toolCall", id: "call_1", name: "bash" }] } },
+				assistantEnd("", "nan/deepseek-v4-flash"),
+			).toString("base64"),
+		},
+	})), REVIEW_HOST_RELAY_FAILURE.PI_EMPTY_OUTPUT, "pi");
+	assert.equal(existsSync(fixture.submitCapturePath), false);
+	assert.match(error.message, /no assistant text/);
+	assert.ok((error as unknown as { reviewerEvidence?: { stdoutKind?: string } }).reviewerEvidence !== undefined, "the failure report must carry the reviewer evidence");
+});
+
+test("the relay forwards the caller-owned reviewer selection and extension allowlist to the child argv", async (t) => {
+	const fixture = harness(t);
+	const adapterPath = join(fixture.directory, "auth-adapter.ts");
+	writeFileSync(adapterPath, "export default () => {};");
+	await runReviewHostRelaySlot(relayRequest(fixture, {
+		reviewerModel: "minimax/MiniMax-M3",
+		reviewerExtensionPaths: [adapterPath],
+	}));
+	const calls = readLog(fixture.piLogPath);
+	assert.equal(calls.length, 1);
+	assert.deepEqual(calls[0]!.argv.slice(-4), ["--model", "minimax/MiniMax-M3", "-e", adapterPath]);
+});
+
+test("a malformed reviewer selection or a relative extension path is refused typed before anything launches", async (t) => {
+	const fixture = harness(t);
+	for (const broken of [
+		{ reviewerModel: "minimax / MiniMax M3" },
+		{ reviewerModel: "" },
+		{ reviewerExtensionPaths: ["relative/auth.ts"] },
+		{ reviewerExtensionPaths: [join(fixture.directory, "missing-adapter.ts")] },
+	]) {
+		let caught: unknown;
+		try {
+			await runReviewHostRelaySlot(relayRequest(fixture, broken));
+		} catch (error) {
+			caught = error;
+		}
+		assert.ok(caught instanceof ReviewHostRelayError, `expected a typed relay error for ${JSON.stringify(broken)}`);
+		const error = caught as ReviewHostRelayError;
+		assert.equal(error.kind, "reviewer-config-invalid");
+		assert.equal(error.stage, "pi");
+		assert.equal(readLog(fixture.piLogPath).length, 0, "no reviewer may launch on a broken selection");
+		assert.equal(readLog(fixture.logPath).length, 0, "no materialization may run on a broken selection");
+	}
 });
 
 test("pi timeout fails closed with a typed error and no submission", async (t) => {
@@ -653,7 +721,8 @@ function admittingRequest(fixture: RelayHarness, reviewerOutput: Buffer) {
 		environment: {
 			...fixture.environment,
 			RELAY_FAKE_PROMPT_B64: PROMPT_BYTES.toString("base64"),
-			RELAY_FAKE_PI_OUTPUT_B64: reviewerOutput.toString("base64"),
+			// The reviewer's payload arrives as the event stream's assistant text.
+			RELAY_FAKE_PI_OUTPUT_B64: piEventStream(assistantEnd(reviewerOutput.toString("utf8"))).toString("base64"),
 		},
 	});
 }