gentle-pi 3.2.1 → 3.4.0

package/lib/shell-usage-view.ts

@@ -1,5 +1,6 @@
-import { Key, matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
-import { renderUsagePanel, type ActiveProvider, type UsageStore, type UsageTheme } from "./shell-usage.ts";
+import { Key, matchesKey, truncateToWidth, visibleWidth, type TuiMouseEvent, type TuiMouseEventResult } from "@earendil-works/pi-tui";
+import { renderUsagePanel, type ActiveProvider, type UsageSourceRegistry, type UsageStore, type UsageTheme } from "./shell-usage.ts";
+import { paintHoverable } from "./shell-hover.ts";
 
 // Gentle Shell subscriptions overlay: a framed panel over the usage store.
 // It reads the store on every render, so a refresh only needs to record.
@@ -8,6 +9,9 @@ export interface UsageViewDeps {
 	theme: UsageTheme;
 	now(): number;
 	active(): ActiveProvider | undefined;
+	// Optional: lets the panel resolve the pending note of a provider whose
+	// usage source was registered at runtime instead of built in.
+	registry?(): UsageSourceRegistry | undefined;
 	onRefresh(): Promise<void>;
 	onClose(): void;
 	requestRender(): void;
@@ -33,10 +37,32 @@ function fit(text: string, width: number): string {
 	return clipped + " ".repeat(Math.max(0, width - visibleWidth(clipped)));
 }
 
+// Column offset of the footer's hint text within the rendered line: the
+// frame draws "│ " before the fitted content starts.
+const HINT_CONTENT_OFFSET = 2;
+const HINT_GAP = "   ";
+
+type HintAction = "refresh" | "close";
+
+interface HintSpan {
+	start: number;
+	end: number;
+	action: HintAction;
+}
+
+interface PointerLayout {
+	width: number;
+	height: number;
+	row: number;
+	spans: HintSpan[];
+}
+
 export class UsageView {
 	private readonly store: UsageStore;
 	private readonly deps: UsageViewDeps;
 	private refreshing = false;
+	private pointer: PointerLayout | undefined;
+	private hoveredHint: HintAction | undefined;
 
 	constructor(store: UsageStore, deps: UsageViewDeps) {
 		this.store = store;
@@ -48,13 +74,25 @@ export class UsageView {
 			this.deps.onClose();
 			return;
 		}
-		if (data === "r" && !this.refreshing) {
-			this.refreshing = true;
+		if (data === "r") this.refresh();
+	}
+
+	// A failing usage fetch is the store's problem to report (its rows already
+	// carry the last error); the panel only clears its "refreshing" state. The
+	// rejection must never leave this method: an unhandled rejection is fatal
+	// to the whole shell on current Node.
+	private refresh(): void {
+		if (this.refreshing) return;
+		this.refreshing = true;
+		this.deps.requestRender();
+		const settle = () => {
+			this.refreshing = false;
 			this.deps.requestRender();
-			void this.deps.onRefresh().finally(() => {
-				this.refreshing = false;
-				this.deps.requestRender();
-			});
+		};
+		try {
+			this.deps.onRefresh().then(settle, settle);
+		} catch {
+			settle();
 		}
 	}
 
@@ -63,14 +101,67 @@ export class UsageView {
 		const inner = width - 2;
 		const title = this.refreshing ? REFRESHING : TITLE;
 		const top = theme.fg(FRAME_ROLE, "╭─ ") + theme.fg(TITLE_ROLE, title) + theme.fg(FRAME_ROLE, ` ${rule(inner - visibleWidth(title) - 3)}╮`);
-		const body = renderUsagePanel(this.store.all(), theme, inner - 2, this.deps.now(), this.deps.active()).map(
+		const body = renderUsagePanel(this.store.all(), theme, inner - 2, this.deps.now(), this.deps.active(), this.deps.registry?.()).map(
 			(line) => `${theme.fg(FRAME_ROLE, "│")} ${fit(line, inner - 2)} ${theme.fg(FRAME_ROLE, "│")}`,
 		);
-		const keys = KEYS.map(([key, label]) => `${theme.fg(KEY_ROLE, key)} ${theme.fg(KEY_TEXT_ROLE, label)}`).join("   ");
+		const hints = KEYS.map(([key, label]) => ({ key, label, text: `${key} ${label}`, action: (key === "r" ? "refresh" : "close") as HintAction }));
+		// The hovered hint paints entirely in the shared hover role (key and
+		// label together, one color) instead of its ordinary two-role split --
+		// the same treatment every other clickable surface uses.
+		const keys = hints
+			.map(({ key, label, action }) =>
+				this.hoveredHint === action ? paintHoverable(theme, `${key} ${label}`, true) : `${theme.fg(KEY_ROLE, key)} ${theme.fg(KEY_TEXT_ROLE, label)}`,
+			)
+			.join(HINT_GAP);
 		const keysLine = `${theme.fg(FRAME_ROLE, "│")} ${fit(keys, inner - 2)} ${theme.fg(FRAME_ROLE, "│")}`;
 		const bottom = theme.fg(FRAME_ROLE, `╰${rule(inner)}╯`);
-		return [top, ...body, keysLine, bottom];
+		const lines = [top, ...body, keysLine, bottom];
+		this.pointer = this.hintLayout(width, lines.length, body.length + 1, hints, inner - 2);
+		return lines;
 	}
 
-	invalidate(): void {}
+	handleMouse(event: TuiMouseEvent): TuiMouseEventResult | undefined {
+		if (event.type === "move" && event.button === "none") {
+			const layout = this.pointer;
+			const action = layout && event.width === layout.width && event.height === layout.height && event.y === layout.row
+				? layout.spans.find((candidate) => event.x >= candidate.start && event.x < candidate.end)?.action
+				: undefined;
+			if (action === this.hoveredHint) return action ? { handled: true } : undefined;
+			this.hoveredHint = action;
+			return { handled: true, render: true };
+		}
+		if (event.type !== "click" || event.button !== "left") return undefined;
+		const layout = this.pointer;
+		if (!layout || event.width !== layout.width || event.height !== layout.height || event.y !== layout.row) return undefined;
+		const span = layout.spans.find((candidate) => event.x >= candidate.start && event.x < candidate.end);
+		if (!span) return undefined;
+		if (span.action === "close") {
+			this.deps.onClose();
+			return { handled: true, render: true };
+		}
+		this.refresh();
+		return { handled: true, render: true };
+	}
+
+	invalidate(): void {
+		this.pointer = undefined;
+		this.hoveredHint = undefined;
+	}
+
+	// Spans are only registered when the hints text fits without truncation:
+	// past that point `fit` clips it with an ellipsis and per-hint columns no
+	// longer line up with the plain "key label" text used here.
+	private hintLayout(width: number, height: number, row: number, hints: Array<{ text: string; action: HintAction }>, contentWidth: number): PointerLayout | undefined {
+		const plainWidth = hints.reduce((total, hint) => total + hint.text.length, 0) + HINT_GAP.length * Math.max(0, hints.length - 1);
+		if (plainWidth > contentWidth) return undefined;
+		const spans: HintSpan[] = [];
+		let cursor = HINT_CONTENT_OFFSET;
+		for (const hint of hints) {
+			const start = cursor;
+			const end = start + hint.text.length;
+			spans.push({ start, end, action: hint.action });
+			cursor = end + HINT_GAP.length;
+		}
+		return { width, height, row, spans };
+	}
 }

package/lib/shell-usage.ts

@@ -117,9 +117,10 @@ const ROLE = {
 } as const;
 export const USAGE_EMPTY_MESSAGE = "No subscription usage yet. Usage arrives with the next response, or press r to fetch it.";
 export const SUPPORTED_USAGE_PROVIDERS: readonly string[] = [CODEX_PROVIDER, ANTHROPIC_PROVIDER, NAN_PROVIDER];
+const DEFAULT_PENDING_NOTE = "no usage yet · r to fetch";
 const PENDING_NOTE: Record<string, string> = {
-	[CODEX_PROVIDER]: "no usage yet · r to fetch",
-	[NAN_PROVIDER]: "no usage yet · r to fetch",
+	[CODEX_PROVIDER]: DEFAULT_PENDING_NOTE,
+	[NAN_PROVIDER]: DEFAULT_PENDING_NOTE,
 	[ANTHROPIC_PROVIDER]: "usage arrives with the first response",
 };
 const UNSUPPORTED_NOTE = "no subscription usage for this provider";
@@ -129,8 +130,121 @@ export interface ActiveProvider {
 	provider: string;
 }
 
-export function providerNote(provider: string): string {
-	return PENDING_NOTE[provider] ?? UNSUPPORTED_NOTE;
+// A generic hook so an extension holding its own provider (its own API token,
+// its own usage endpoint) can plug a usage source into the shell without the
+// shell ever knowing that provider's name. Emitted on `pi.events` as payload
+// under `USAGE_SOURCE_EVENT`; gentle-shell validates the shape below and
+// ignores anything else, so a malformed or foreign event never reaches a
+// fetch call. Re-registration for the same provider replaces the previous
+// source, so a second `session_start` emitting the same payload is a no-op
+// in effect, not an accumulation.
+export const USAGE_SOURCE_EVENT = "gentle-pi:usage-source/v1";
+export const USAGE_SOURCE_SCHEMA = "gentle-pi.usage-source/v1";
+const USAGE_SOURCE_PROVIDER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+export interface UsageSource {
+	schema: typeof USAGE_SOURCE_SCHEMA;
+	provider: string;
+	pendingNote?: string;
+	fetch(apiKey: string | undefined, fetchFn: typeof fetch, now: number): Promise<ProviderUsage | undefined>;
+}
+
+// Pure and defensive: the payload crosses an event bus from another
+// extension, so nothing here is trusted until every field is checked. Any
+// mismatch returns undefined rather than throwing, exactly like the other
+// payload parsers in this file.
+export function parseUsageSource(value: unknown): UsageSource | undefined {
+	if (!value || typeof value !== "object") return undefined;
+	const raw = value as Record<string, unknown>;
+	if (raw.schema !== USAGE_SOURCE_SCHEMA) return undefined;
+	if (typeof raw.provider !== "string" || !USAGE_SOURCE_PROVIDER_PATTERN.test(raw.provider)) return undefined;
+	if (typeof raw.fetch !== "function") return undefined;
+	if (raw.pendingNote !== undefined && typeof raw.pendingNote !== "string") return undefined;
+	const source: UsageSource = { schema: USAGE_SOURCE_SCHEMA, provider: raw.provider, fetch: raw.fetch as UsageSource["fetch"] };
+	if (typeof raw.pendingNote === "string") source.pendingNote = raw.pendingNote;
+	return source;
+}
+
+// One source per provider, most recent registration wins. Nothing here fetches
+// or touches the network; it only remembers who to ask.
+export class UsageSourceRegistry {
+	private readonly sources = new Map<string, UsageSource>();
+
+	register(source: UsageSource): void {
+		this.sources.set(source.provider, source);
+	}
+
+	get(provider: string): UsageSource | undefined {
+		return this.sources.get(provider);
+	}
+
+	has(provider: string): boolean {
+		return this.sources.has(provider);
+	}
+
+	note(provider: string): string | undefined {
+		const source = this.sources.get(provider);
+		return source ? (source.pendingNote ?? DEFAULT_PENDING_NOTE) : undefined;
+	}
+}
+
+export function providerNote(provider: string, registry?: UsageSourceRegistry): string {
+	return PENDING_NOTE[provider] ?? registry?.note(provider) ?? UNSUPPORTED_NOTE;
+}
+
+function isFiniteNumber(value: unknown): value is number {
+	return typeof value === "number" && Number.isFinite(value);
+}
+
+function parseSourceUsageWindow(value: unknown): UsageWindow | undefined {
+	if (!value || typeof value !== "object") return undefined;
+	const raw = value as Record<string, unknown>;
+	if (typeof raw.label !== "string") return undefined;
+	if (!isFiniteNumber(raw.usedPercent)) return undefined;
+	if (!isFiniteNumber(raw.windowSeconds)) return undefined;
+	if (raw.resetAt !== null && !isFiniteNumber(raw.resetAt)) return undefined;
+	if (raw.used !== undefined && !isFiniteNumber(raw.used)) return undefined;
+	if (raw.budget !== undefined && !isFiniteNumber(raw.budget)) return undefined;
+	const window: UsageWindow = { label: raw.label, usedPercent: raw.usedPercent, windowSeconds: raw.windowSeconds, resetAt: raw.resetAt as number | null };
+	if (raw.used !== undefined) window.used = raw.used as number;
+	if (raw.budget !== undefined) window.budget = raw.budget as number;
+	return window;
+}
+
+function parseSourceUsageLimit(value: unknown): UsageLimit | undefined {
+	if (!value || typeof value !== "object") return undefined;
+	const raw = value as Record<string, unknown>;
+	if (typeof raw.name !== "string") return undefined;
+	if (typeof raw.limitReached !== "boolean") return undefined;
+	if (!Array.isArray(raw.windows)) return undefined;
+	const windows: UsageWindow[] = [];
+	for (const entry of raw.windows) {
+		const window = parseSourceUsageWindow(entry);
+		if (!window) return undefined;
+		windows.push(window);
+	}
+	return { name: raw.name, limitReached: raw.limitReached, windows };
+}
+
+// A registered source's resolved value crosses the same trust boundary a
+// parsed HTTP payload does: it is foreign code's own object, so it is
+// validated field by field and never recorded by reference. Every accepted
+// shape is rebuilt from scratch, so a source mutating its own object after
+// returning it can never reach a snapshot gentle-shell already recorded.
+export function parseProviderUsage(value: unknown, expectedProvider: string): ProviderUsage | undefined {
+	if (!value || typeof value !== "object") return undefined;
+	const raw = value as Record<string, unknown>;
+	if (raw.provider !== expectedProvider) return undefined;
+	if (raw.plan !== undefined && typeof raw.plan !== "string") return undefined;
+	if (!isFiniteNumber(raw.fetchedAt)) return undefined;
+	if (!Array.isArray(raw.limits)) return undefined;
+	const limits: UsageLimit[] = [];
+	for (const entry of raw.limits) {
+		const limit = parseSourceUsageLimit(entry);
+		if (!limit) return undefined;
+		limits.push(limit);
+	}
+	return { provider: raw.provider, plan: typeof raw.plan === "string" ? raw.plan : undefined, limits, fetchedAt: raw.fetchedAt };
 }
 
 export function windowLabel(seconds: number): string {
@@ -415,13 +529,13 @@ function updatedAgo(fetchedAt: number, now: number): string {
 
 // The active provider comes first, marked with the petal, and explains
 // itself when it has no data yet. Other providers seen this session follow.
-export function renderUsagePanel(usages: ProviderUsage[], theme: UsageTheme, width: number, now: number, active?: ActiveProvider): string[] {
+export function renderUsagePanel(usages: ProviderUsage[], theme: UsageTheme, width: number, now: number, active?: ActiveProvider, registry?: UsageSourceRegistry): string[] {
 	const activeUsage = active ? usages.find((usage) => usage.provider === active.provider) : undefined;
 	const others = usages.filter((usage) => usage !== activeUsage);
 	if (!active && usages.length === 0) return [truncateToWidth(USAGE_EMPTY_MESSAGE, width, "…")];
 	const lines: string[] = [];
 	if (active && !activeUsage) {
-		lines.push(`${theme.fg(ROLE.LIMIT, ACTIVE_MARK)} ${theme.fg(ROLE.PROVIDER, active.provider)} ${theme.fg(ROLE.SEPARATOR, "·")} ${theme.fg(ROLE.RESET, providerNote(active.provider))}`);
+		lines.push(`${theme.fg(ROLE.LIMIT, ACTIVE_MARK)} ${theme.fg(ROLE.PROVIDER, active.provider)} ${theme.fg(ROLE.SEPARATOR, "·")} ${theme.fg(ROLE.RESET, providerNote(active.provider, registry))}`);
 	}
 	for (const usage of [...(activeUsage ? [activeUsage] : []), ...others]) {
 		const mark = usage === activeUsage ? `${theme.fg(ROLE.LIMIT, ACTIVE_MARK)} ` : "";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "gentle-pi",
-	"version": "3.2.1",
+	"version": "3.4.0",
 	"description": "Turn Pi into el Gentleman: a senior-architect development harness with SDD/OpenSpec, subagents, strict TDD evidence, review guardrails, and skill discovery.",
 	"license": "MIT",
 	"type": "module",

package/runtime/native-review-cli.mjs

@@ -706,7 +706,11 @@ function isNativeUntrackedPath(value         )                  {
 		&& value.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
 }
 
-function nativeUntrackedSelection(request                                 )                           {
+export function nativeUntrackedSelection(request
+
+
+
+ )                           {
 	const { untrackedScope, expectedUntrackedInventory, intendedUntracked } = request;
 	const declared = untrackedScope !== undefined || expectedUntrackedInventory !== undefined || intendedUntracked !== undefined;
 	if (!declared) return {};
@@ -717,16 +721,19 @@ function nativeUntrackedSelection(request                                 )
 	) {
 		throw new TypeError("Native untracked selection must declare one scope, one inventory digest, and unique repository-relative paths");
 	}
-	if (untrackedScope === NATIVE_UNTRACKED_SCOPE.EXCLUDE && (intendedUntracked?.length ?? 0) > 0) {
+	// The guard above establishes the array and element types for both typed
+	// native requests and untyped facade input.
+	const paths = intendedUntracked                                 ;
+	if (untrackedScope === NATIVE_UNTRACKED_SCOPE.EXCLUDE && (paths?.length ?? 0) > 0) {
 		throw new TypeError("Native exclude untracked selection cannot include paths");
 	}
-	if (untrackedScope === NATIVE_UNTRACKED_SCOPE.SELECT && (intendedUntracked?.length ?? 0) === 0) {
+	if (untrackedScope === NATIVE_UNTRACKED_SCOPE.SELECT && (paths?.length ?? 0) === 0) {
 		throw new TypeError("Native select untracked selection requires at least one path");
 	}
 	return {
 		untrackedScope,
 		expectedUntrackedInventory,
-		intendedUntracked: intendedUntracked === undefined ? undefined : [...intendedUntracked],
+		intendedUntracked: paths === undefined ? undefined : [...paths],
 	};
 }
 
@@ -1005,6 +1012,27 @@ export const NATIVE_CLI_CONTRACTS = Object.freeze({
 	// remain dark because neither is proven to reach the negotiated START
 	// path Pi consumes.
 	"3.2.1": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v3.4.0 (gentle-pi never pinned the intervening v3.3.0 tag, so it gets no
+	// row here) added capabilities/v2.6 and status/v8-v9, and extended
+	// `review assess` with review_due/review_due_reason/next_transition
+	// (gentle-ai #4714 follow-up). Ground-truthed by diffing
+	// contracts/review-integration/v2 and contracts/review-provider-contract
+	// between the v3.2.1 and v3.4.0 tags in the gentle-ai source tree: the
+	// provider contract stays byte-identical at 1.2.0, and every
+	// review-integration/v2 change is an additive superset (new optional
+	// schema/fields) that decodeReviewStatusV3 and the capabilities
+	// negotiator already accept without touching the closed START/STATUS
+	// fields this row negotiates, so it repeats 3.2.1 exactly. riskEvidence
+	// and hint remain dark because neither is proven to reach the negotiated
+	// START path Pi consumes.
+	"3.4.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v3.5.0 repeats 3.4.0: the published provider contract bundle is
+	// byte-identical at 1.2.0, both binaries advertise capabilities/v2.6
+	// with only build-identity differences, and no review-integration schema
+	// changed. The v2 preflight failure identity fix does not change the
+	// closed START/STATUS fields this row negotiates. riskEvidence and hint
+	// remain dark; neither is proven to reach Pi's negotiated START path.
+	"3.5.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
 });
 
 
@@ -1089,8 +1117,19 @@ function decodeSelectedLenses(value         , riskLevel        , lensesRequired
 function enumString(value         , allowed                   )         { const parsed = stringValue(value); if (!allowed.includes(parsed)) throw new Error("unsupported enum"); return parsed; }
 const NATIVE_DIAGNOSTIC_TEXT_LIMIT = 4_096;
 
-function sanitizeNativeDiagnosticText(value        , limit = NATIVE_DIAGNOSTIC_TEXT_LIMIT)         {
-	const normalized = value
+function sanitizeNativeDiagnosticText(value        , limit = NATIVE_DIAGNOSTIC_TEXT_LIMIT, operation                        )         {
+	// ASSESS diagnostics are projected into a public verification plan. Retain
+	// native guidance, not local paths or environment assignment values.
+	const input = operation === NATIVE_REVIEW_OPERATION.ASSESS
+		? value
+			.replace(/(?<![\w-])[a-z_][a-z0-9_]*=(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s]+)/gi, "[REDACTED ENV]")
+			.replace(/--(?:password|token|secret|authorization|cookie|private[_-]key|access[_-]token|[a-z0-9_-]+[_-]token|api[_-]?key)[ \t]+(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s]+)/gi, "[REDACTED CREDENTIAL]")
+			// Quoted paths have a clear boundary. For an unquoted path, the
+			// remaining line is ambiguous (spaces may belong to the filename).
+			// Redact that suffix rather than leak trailing path components.
+			.replace(/"(?:[A-Za-z]:[\\/]|\/)[^"\r\n]*"|'(?:[A-Za-z]:[\\/]|\/)[^'\r\n]*'|(?:[A-Za-z]:[\\/]|\/)[^\r\n]*/g, "[REDACTED PATH]")
+		: value;
+	const normalized = input
 		.replace(/\x1b](?:[^\x07\x1b]|\x1b(?!\\))*?(?:\x07|\x1b\\)/g, "[REDACTED CONTROL]")
 		.replace(/\x1b[PX^_][\s\S]*?\x1b\\/g, "[REDACTED CONTROL]")
 		.replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "[REDACTED CONTROL]")
@@ -1124,7 +1163,7 @@ export function sanitizeForeignNativeReviewDiagnostics(value         )
 			timed_out: booleanValue(raw.timed_out),
 			output_limit_exceeded: booleanValue(raw.output_limit_exceeded),
 			...(maxBufferBytes === undefined ? {} : { max_buffer_bytes: maxBufferBytes, configuration_hint: configurationHint  }),
-			...(raw.stderr === undefined ? {} : { stderr: sanitizeNativeDiagnosticText(stringValue(raw.stderr)) }),
+			...(raw.stderr === undefined ? {} : { stderr: sanitizeNativeDiagnosticText(stringValue(raw.stderr), NATIVE_DIAGNOSTIC_TEXT_LIMIT, operation) }),
 		};
 	} catch { return undefined; }
 }
@@ -1141,7 +1180,7 @@ function nativeProcessDiagnostics(operation                       , code
 		...(code === NATIVE_REVIEW_ERROR_CODE.OUTPUT_LIMIT && maxBufferBytes !== undefined
 			? { max_buffer_bytes: maxBufferBytes, configuration_hint: NATIVE_REVIEW_MAX_BUFFER_CONFIGURATION_HINT }
 			: {}),
-		...(result?.stderr.trim() ? { stderr: sanitizeNativeDiagnosticText(result.stderr) } : {}),
+		...(result?.stderr.trim() ? { stderr: sanitizeNativeDiagnosticText(result.stderr, NATIVE_DIAGNOSTIC_TEXT_LIMIT, operation) } : {}),
 	};
 }
 
@@ -2522,6 +2561,7 @@ export class NativeReviewCliV216                            {
 	// rejects -- callers (the `gentle_review` tool's `assess` operation) fail
 	// closed to `high`.
 	async assess(request                           )                              {
+		const selection = nativeUntrackedSelection(request);
 		if (request.baseRef !== undefined && !isCanonicalProcessString(request.baseRef)) throw new TypeError("Native ASSESS baseRef must be a non-empty, trimmed, NUL-free string");
 		if (request.baseRef !== undefined && request.committedOnly !== true) throw new TypeError("Native ASSESS baseRef requires explicit committedOnly acknowledgement");
 		if (request.baseRef === undefined && request.committedOnly !== undefined) throw new TypeError("Native ASSESS committedOnly requires an explicit baseRef");
@@ -2529,7 +2569,7 @@ export class NativeReviewCliV216                            {
 		const execution = await this.invoke(
 			NATIVE_REVIEW_OPERATION.ASSESS,
 			cwd,
-			["review", "assess", "--cwd", cwd, ...(request.baseRef === undefined ? [] : ["--base-ref", request.baseRef, "--committed-only"]), "--json"],
+			["review", "assess", "--cwd", cwd, ...(request.baseRef === undefined ? [] : ["--base-ref", request.baseRef, "--committed-only"]), ...nativeUntrackedSelectionArguments(selection), "--json"],
 			false,
 			request.signal,
 			this.executablePath(NATIVE_REVIEW_OPERATION.ASSESS, false),