gentle-pi 3.3.0 → 3.4.0

package/tests/gentle-shell.test.ts

@@ -7,6 +7,7 @@ import test from "node:test";
 import { initTheme, type ExtensionAPI, type ExtensionContext, type SlashCommandInfo, type SourceInfo } from "@earendil-works/pi-coding-agent";
 import type { TUI, TuiMouseEvent } from "@earendil-works/pi-tui";
 import installGentleShell, { buildShellBarModel, createActiveProfileReader, changesShortcut, devBinaryCard, extractQueuedText, fetchCodexUsage, fetchNanUsage, loadFileDiff, shellGitRunner, openInExternalEditor, usageShortcut, type GentlePromptEditor } from "../extensions/gentle-shell.ts";
+import { USAGE_SOURCE_EVENT, USAGE_SOURCE_SCHEMA } from "../lib/shell-usage.ts";
 import { CHANGE_STATUS } from "../lib/shell-changes.ts";
 import { sidebarState, type SidebarRail } from "../lib/shell-sidebar.ts";
 import type { ShellBarTheme } from "../lib/shell-bar.ts";
@@ -129,7 +130,7 @@ async function fire(handlers: Map<string, Array<(event: unknown, ctx: ExtensionC
 	for (const handler of handlers.get(event) ?? []) await handler({}, ctx);
 }
 
-function fakeContext(options: { hasUI?: boolean; entries?: unknown[]; oauth?: boolean; pending?: boolean; idle?: boolean; editorFactory?: unknown; token?: string } = {}): { ctx: ExtensionContext; ui: FakeUi; overlayReady: Promise<void> } {
+function fakeContext(options: { hasUI?: boolean; entries?: unknown[]; oauth?: boolean; pending?: boolean; idle?: boolean; editorFactory?: unknown; token?: string; select?: (title: string, options: string[]) => Promise<string | undefined> } = {}): { ctx: ExtensionContext; ui: FakeUi; overlayReady: Promise<void> } {
 	const ui: FakeUi = { footerFactory: undefined, editorFactory: options.editorFactory, widgets: new Map(), widgetSets: 0, workingVisible: undefined, notices: [], overlay: undefined, overlayView: undefined, closeOverlay: undefined };
 	let resolveOverlay: () => void;
 	const overlayReady = new Promise<void>((resolve) => { resolveOverlay = resolve; });
@@ -150,6 +151,9 @@ function fakeContext(options: { hasUI?: boolean; entries?: unknown[]; oauth?: bo
 		getContextUsage: () => ({ tokens: 122_400, contextWindow: 272_000, percent: 45 }),
 		ui: {
 			theme: plainTheme,
+			// Added only when requested: an absent select keeps the no-menu fallback
+			// that every pre-existing test relies on.
+			...(options.select ? { select: options.select } : {}),
 			setFooter(factory: unknown) {
 				ui.footerFactory = factory;
 			},
@@ -475,7 +479,122 @@ test("gentleShell shows working while the agent runs and queued when messages wa
 	editor.dispose();
 });
 
+test("animations command reports without writing and switches the live pulse", async (t) => {
+	const configHome = scopedDoubleEscCancelConfigHome(t);
+	const delays: number[] = [];
+	let active = 0;
+	t.mock.method(globalThis, "setInterval", (_callback: () => void, delay: number) => {
+		delays.push(delay); active++; return { unref() {} };
+	});
+	t.mock.method(globalThis, "clearInterval", () => { active--; });
+	const { pi, handlers, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: configHome });
+	const { ctx, ui } = fakeContext();
+	const editor = installedPrompt(ctx, ui, handlers);
+	const command = commands.get("gentle:animations");
+	assert.ok(command);
+	await command.handler("", ctx);
+	assert.match(ui.notices.at(-1)!, /animations: quality/);
+	assert.equal(existsSync(join(configHome, "animations.json")), false);
+	for (const handler of handlers.get("agent_start") ?? []) handler({}, ctx);
+	assert.deepEqual(delays, [80]);
+	await command.handler("performance", ctx);
+	assert.deepEqual(delays, [80, 1000]);
+	assert.equal(active, 1);
+	await command.handler("potato", ctx);
+	assert.equal(active, 0);
+	assert.match(stripAnsi(editor.render(60)[0]), /working/);
+	assert.equal(JSON.parse(readFileSync(join(configHome, "animations.json"), "utf8")).policy, "potato");
+	await command.handler("invalid", ctx);
+	assert.equal(JSON.parse(readFileSync(join(configHome, "animations.json"), "utf8")).policy, "potato");
+	await command.handler("quality", ctx);
+	assert.deepEqual(delays, [80, 1000, 80]);
+	for (const handler of handlers.get("agent_settled") ?? []) handler({}, ctx);
+	assert.equal(active, 0);
+	editor.dispose();
+});
+
+test("potato repaints start/settle and shows queued state on the host's next render without intervals", async (t) => {
+	const configHome = scopedDoubleEscCancelConfigHome(t);
+	writeFileSync(join(configHome, "animations.json"), '{"schema":"gentle-pi.animations/v1","policy":"potato"}');
+	const intervals = t.mock.method(globalThis, "setInterval", () => { throw new Error("potato must not animate"); });
+	const renders = t.mock.method(fakeTui, "requestRender", () => {});
+	const { pi, handlers, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: configHome });
+	const { ctx, ui } = fakeContext();
+	const pending = { value: false };
+	(ctx as unknown as { hasPendingMessages(): boolean }).hasPendingMessages = () => pending.value;
+	const editor = installedPrompt(ctx, ui, handlers);
+	let before = renders.mock.callCount();
+	for (const handler of handlers.get("agent_start") ?? []) handler({}, ctx);
+	assert.ok(renders.mock.callCount() > before);
+	assert.match(stripAnsi(editor.render(60)[0]), /✿ working/);
+	before = renders.mock.callCount();
+	pending.value = true;
+	assert.equal(renders.mock.callCount(), before, "changing the queue flag is not a Gentle repaint event");
+	// Pi owns enqueue and its repaint scheduling; this fake context exposes only
+	// hasPendingMessages, not Pi's enqueue path. Simulate the host's render request:
+	// this proves next-render visibility, not real Pi enqueue-to-paint latency.
+	fakeTui.requestRender();
+	assert.equal(renders.mock.callCount(), before + 1);
+	assert.match(stripAnsi(editor.render(60)[0]), /✿ queued/);
+	before = renders.mock.callCount();
+	for (const handler of handlers.get("agent_settled") ?? []) handler({}, ctx);
+	assert.ok(renders.mock.callCount() > before);
+	assert.doesNotMatch(stripAnsi(editor.render(60)[0]), /working|queued/);
+	await commands.get("gentle:animations")!.handler("status", ctx);
+	assert.match(ui.notices.at(-1)!, /animations: potato/);
+	for (const handler of handlers.get("session_shutdown") ?? []) handler({}, ctx);
+	assert.equal(intervals.mock.callCount(), 0);
+});
+
+test("animations status attributes malformed files and reports a failed write", async (t) => {
+	const configHome = scopedDoubleEscCancelConfigHome(t);
+	const path = join(configHome, "animations.json");
+	writeFileSync(path, "broken");
+	const { pi, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: configHome });
+	const { ctx, ui } = fakeContext();
+	await commands.get("gentle:animations")!.handler("", ctx);
+	assert.match(ui.notices.at(-1)!, /animations: quality.*global file.*malformed/);
+	assert.equal(readFileSync(path, "utf8"), "broken");
+	rmSync(path);
+	mkdirSync(path);
+	await commands.get("gentle:animations")!.handler("potato", ctx);
+	assert.match(ui.notices.at(-1)!, /EISDIR|ENOTEMPTY|EPERM/);
+});
+
+test("animations with no argument opens a selectable menu and applies the chosen policy", async (t) => {
+	const configHome = scopedDoubleEscCancelConfigHome(t);
+	const path = join(configHome, "animations.json");
+	const { pi, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: configHome });
+	// No editor/prompt is installed: the handler's `prompt?.setAnimationPolicy`
+	// optional chain must tolerate the interactive menu without one.
+	const chosen = fakeContext({
+		select: async (title, options) => {
+			assert.match(title, /Gentle animations/);
+			assert.deepEqual(options, ["quality", "performance", "potato", "status"]);
+			return "potato";
+		},
+	});
+	await commands.get("gentle:animations")!.handler("", chosen.ctx);
+	assert.equal(JSON.parse(readFileSync(path, "utf8")).policy, "potato");
+	assert.match(chosen.ui.notices.at(-1)!, /animations: potato/);
+
+	// A dismissed menu (undefined selection) reports nothing and writes nothing.
+	const dismissHome = scopedDoubleEscCancelConfigHome(t);
+	const { pi: dismissPi, commands: dismissCommands } = fakePi();
+	gentleShell(dismissPi, { GENTLE_PI_CONFIG_HOME: dismissHome });
+	const dismissed = fakeContext({ select: async () => undefined });
+	await dismissCommands.get("gentle:animations")!.handler("", dismissed.ctx);
+	assert.equal(dismissed.ui.notices.length, 0);
+	assert.equal(existsSync(join(dismissHome, "animations.json")), false);
+});
+
 test("prompt uses the compact banner cadence and releases its unref timer at settlement", (t) => {
+	const configHome = scopedDoubleEscCancelConfigHome(t);
+	writeFileSync(join(configHome, "animations.json"), '{"schema":"gentle-pi.animations/v1","policy":"quality"}');
 	const delays: number[] = [];
 	let active = 0;
 	let unrefs = 0;
@@ -486,7 +605,7 @@ test("prompt uses the compact banner cadence and releases its unref timer at set
 	});
 	t.mock.method(globalThis, "clearInterval", () => { active--; });
 	const { pi, handlers } = fakePi();
-	gentleShell(pi, {});
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: configHome });
 	const { ctx, ui } = fakeContext();
 	const editor = installedPrompt(ctx, ui, handlers);
 	assert.equal(active, 0);
@@ -1594,6 +1713,240 @@ test("a provider switch refreshes the new provider inside the same window", asyn
 	assert.equal(calls[1].url, "https://cloud-api.nan.builders/api/usage/quota");
 });
 
+// A generic hook: any extension can register a usage source for its own
+// provider on `pi.events`, and gentle-shell dispatches to it exactly like it
+// dispatches to the built-in Codex/NaN fetchers, without knowing the
+// provider's name ahead of time.
+
+function acmeSource(onFetch: (apiKey: string | undefined) => void, plan = "Acme cloud"): unknown {
+	return {
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async (apiKey: string | undefined) => {
+			onFetch(apiKey);
+			return {
+				provider: "acme-cloud",
+				plan,
+				limits: [{ name: "acme-cloud", windows: [{ label: "week", usedPercent: 40, windowSeconds: 604_800, resetAt: null }], limitReached: false }],
+				fetchedAt: 0,
+			};
+		},
+	};
+}
+
+test("gentleShell fetches usage through a source registered before session start", async () => {
+	const { pi, handlers } = fakePi();
+	const seen: Array<string | undefined> = [];
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	pi.events.emit(USAGE_SOURCE_EVENT, acmeSource((apiKey) => seen.push(apiKey)));
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.deepEqual(seen, ["acme-token"], "the registered fetch gets the api key modelRegistry resolves for its provider");
+	assert.match(renderFooter(ui), /acme-cloud week ▰▰▰▱▱▱▱▱ 40%/);
+});
+
+test("gentleShell forces one refresh when a usage source registers after session start for the active provider", async () => {
+	const { pi, handlers } = fakePi();
+	let calls = 0;
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "no source registered yet, nothing to show");
+
+	pi.events.emit(USAGE_SOURCE_EVENT, acmeSource(() => { calls += 1; }));
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.equal(calls, 1, "late registration for the active provider triggers one forced refresh, not a wait for the next turn");
+	assert.match(renderFooter(ui), /acme-cloud week ▰▰▰▱▱▱▱▱ 40%/);
+});
+
+test("a usage source registered for a different provider does not force a refresh", async () => {
+	const { pi, handlers } = fakePi();
+	let calls = 0;
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "openai-codex";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+
+	pi.events.emit(USAGE_SOURCE_EVENT, acmeSource(() => { calls += 1; }));
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.equal(calls, 0, "the active provider is codex, so an acme-cloud registration fetches nothing yet");
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/);
+});
+
+test("gentleShell shows the unsupported note for a provider with no built-in or registered source", async () => {
+	const { pi, handlers, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: undefined });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	await fire(handlers, "session_start", ctx);
+	const opened = commands.get("gentle:usage")!.handler("", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	const plain = ui.overlayView!.render(90).map(stripAnsi);
+	assert.match(plain[1], /✿ acme-cloud · no subscription usage for this provider/);
+	ui.closeOverlay?.();
+	await opened;
+});
+
+test("gentleShell ignores a malformed usage-source registration payload", async () => {
+	const { pi, handlers } = fakePi();
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	pi.events.emit(USAGE_SOURCE_EVENT, { schema: "wrong-schema", provider: "acme-cloud", fetch: async () => undefined });
+	pi.events.emit(USAGE_SOURCE_EVENT, { schema: USAGE_SOURCE_SCHEMA, provider: "acme-cloud", fetch: "not-a-function" });
+	pi.events.emit(USAGE_SOURCE_EVENT, "not-an-object");
+	pi.events.emit(USAGE_SOURCE_EVENT, undefined);
+	const { ctx, ui } = fakeContext({ token: undefined });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "no malformed payload registered a usable source");
+});
+
+// A registered source is foreign code running inside a fire-and-forget
+// refresh (`void refreshUsage(...)`, both at session_start and on a late
+// registration): if its fetch rejects and nothing catches it, the rejection
+// is unhandled and, under Node's default policy, takes the whole process
+// down. The doc promises a foreign source is "ignored rather than crashing
+// the shell", so a throw must degrade exactly like a built-in fetcher's.
+test("a registered source's rejecting fetch never crashes the shell or poisons the store", async () => {
+	const { pi, handlers, commands } = fakePi();
+	let calls = 0;
+	const rejectingSource = () => ({
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async () => {
+			calls += 1;
+			throw new Error("acme is down");
+		},
+	});
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+
+	const unhandled: unknown[] = [];
+	const onUnhandled = (reason: unknown) => unhandled.push(reason);
+	process.on("unhandledRejection", onUnhandled);
+	try {
+		// Registered before session start: session_start's own fire-and-forget
+		// refresh dispatches straight to the rejecting fetch.
+		pi.events.emit(USAGE_SOURCE_EVENT, rejectingSource());
+		await fire(handlers, "session_start", ctx);
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		assert.equal(calls, 1);
+		assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "a rejecting fetch must never be recorded as a snapshot");
+
+		// A second, late registration for the already-active provider dispatches
+		// through the USAGE_SOURCE_EVENT handler's own fire-and-forget refresh.
+		pi.events.emit(USAGE_SOURCE_EVENT, rejectingSource());
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		assert.equal(calls, 2);
+		assert.doesNotMatch(renderFooter(ui), /acme-cloud/);
+	} finally {
+		process.off("unhandledRejection", onUnhandled);
+	}
+	assert.deepEqual(unhandled, [], "a foreign source's rejection must never surface as an unhandled rejection");
+
+	// The panel still explains itself with the pending note, never a crash,
+	// even through the awaited refresh openUsage runs on open.
+	const opened = commands.get("gentle:usage")!.handler("", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	const plain = ui.overlayView!.render(90).map(stripAnsi);
+	assert.match(plain[1], /✿ acme-cloud · no usage yet · r to fetch/);
+	ui.closeOverlay?.();
+	await opened;
+});
+
+// A registered source's resolved value is foreign code's own object: it must
+// be validated like any other parsed payload (never trusted to name the
+// provider it actually is, never trusted to be well-formed), and a source
+// that gets replaced mid-flight must never let its late, stale answer land
+// after the replacement already recorded its own.
+
+test("a registered source resolving usage for another provider is rejected without overwriting that provider's snapshot", async () => {
+	const { pi, handlers } = fakePi();
+	const { fetchFn } = fakeFetch(NAN_QUOTA_PAYLOAD);
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { fetch: fetchFn, now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: "sk-nan-secret" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "nan";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.match(renderFooter(ui), /nan total ▰+▱+/, "the real nan snapshot recorded first");
+
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	pi.events.emit(USAGE_SOURCE_EVENT, {
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async () => ({ provider: "nan", plan: undefined, limits: [], fetchedAt: 0 }),
+	});
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "a resolution naming another provider must not surface as the active one");
+
+	(ctx as unknown as { model: { provider: string } }).model.provider = "nan";
+	assert.match(renderFooter(ui), /nan total ▰+▱+/, "the real nan snapshot must survive a mismatched acme-cloud resolution untouched");
+});
+
+test("gentleShell leaves the pending note when a registered source resolves a malformed usage", async () => {
+	const { pi, handlers, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	pi.events.emit(USAGE_SOURCE_EVENT, {
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async () => ({ provider: "acme-cloud", plan: "Acme", fetchedAt: 0, limits: "nope" }),
+	});
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "a malformed result must never be recorded");
+
+	const opened = commands.get("gentle:usage")!.handler("", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	const plain = ui.overlayView!.render(90).map(stripAnsi);
+	assert.match(plain[1], /✿ acme-cloud · no usage yet · r to fetch/);
+	ui.closeOverlay?.();
+	await opened;
+});
+
+test("a slow fetch from a replaced source never records after its replacement resolves", async () => {
+	const { pi, handlers } = fakePi();
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+
+	let resolveSlow!: (value: unknown) => void;
+	const slow = new Promise((resolve) => { resolveSlow = resolve; });
+	pi.events.emit(USAGE_SOURCE_EVENT, {
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async () => {
+			await slow;
+			return { provider: "acme-cloud", plan: "Stale", fetchedAt: 0, limits: [{ name: "acme-cloud", limitReached: false, windows: [{ label: "week", usedPercent: 10, windowSeconds: 604_800, resetAt: null }] }] };
+		},
+	});
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "the slow fetch has not resolved yet");
+
+	// Replace the source before the slow fetch resolves; the late registration
+	// forces its own refresh, which resolves immediately.
+	pi.events.emit(USAGE_SOURCE_EVENT, {
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async () => ({ provider: "acme-cloud", plan: "Fresh", fetchedAt: 0, limits: [{ name: "acme-cloud", limitReached: false, windows: [{ label: "week", usedPercent: 40, windowSeconds: 604_800, resetAt: null }] }] }),
+	});
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.match(renderFooter(ui), /acme-cloud week ▰▰▰▱▱▱▱▱ 40%/, "the replacement's own refresh recorded first");
+
+	// Now let the stale fetch resolve; it must never overwrite the fresh record.
+	resolveSlow(undefined);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.match(renderFooter(ui), /acme-cloud week ▰▰▰▱▱▱▱▱ 40%/, "the stale refresh must never record after being replaced");
+});
+
 test("gentleShell records SSE rate-limit headers from provider responses", async () => {
 	const { pi, handlers } = fakePi();
 	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { fetch: fakeFetch({}, false).fetchFn, now: () => 0 });

package/tests/inprocess-reviewer.test.ts

@@ -6,6 +6,7 @@ import {
 	INPROCESS_REVIEWER_FAILURE,
 	INPROCESS_REVIEWER_OUTPUT_MAX_BYTES,
 	runInProcessReviewer,
+	openCodeSessionAttributionHeaders,
 	type InProcessReviewerOutcome,
 	type InProcessReviewerRegistry,
 	type InProcessReviewerRequest,
@@ -345,6 +346,97 @@ test("omits reasoning for a non-reasoning model even with a valid label", async
 	assert.ok(!("reasoning" in (calls[0]!.options ?? {})));
 });
 
+// ---------------------------------------------------------------------------
+// OpenCode session attribution headers
+//
+// Pi adds OpenCode attribution headers inside the main agent loop
+// (provider-attribution.js#getSessionHeaders). This completion is an extension
+// side-call that bypasses that loop, so it must add the same headers itself:
+// provider opencode / opencode-go, or a baseUrl whose host is opencode.ai,
+// carrying the live session id — and nothing for any other provider.
+// ---------------------------------------------------------------------------
+
+const OPENCODE_ATTRIBUTION_TESTS: Array<{ readonly name: string; readonly model: Partial<Model<Api>>; readonly selection: string }> = [
+	{ name: "an opencode provider model", model: { provider: "opencode", id: "sonnet-4", baseUrl: "https://opencode.ai" }, selection: "opencode/sonnet-4" },
+	{ name: "an opencode-go provider model", model: { provider: "opencode-go", id: "gpt-5", baseUrl: "https://opencode.ai" }, selection: "opencode-go/gpt-5" },
+	{ name: "a custom provider whose baseUrl host is opencode.ai", model: { provider: "custom", id: "relay-model", baseUrl: "https://opencode.ai/v1" }, selection: "custom/relay-model" },
+];
+
+for (const { name, model, selection } of OPENCODE_ATTRIBUTION_TESTS) {
+	test(`${name} receives both attribution headers carrying the live session id`, async () => {
+		const { complete, calls } = capturingComplete(assistantText("ok"));
+		const outcome = await runInProcessReviewer(baseRequest({ selection, sessionId: "ses-live-1" }), {
+			registry: fakeRegistry([fakeModel(model)]),
+			complete,
+		});
+		expectText(outcome);
+		assert.equal(calls.length, 1);
+		assert.equal(calls[0]!.options?.headers?.["x-opencode-session"], "ses-live-1");
+		assert.equal(calls[0]!.options?.headers?.["x-opencode-client"], "pi");
+	});
+}
+
+for (const { name, model, selection } of OPENCODE_ATTRIBUTION_TESTS) {
+	test(`${name} without a session id adds no attribution header and still completes`, async () => {
+		const { complete, calls } = capturingComplete(assistantText("ok"));
+		const outcome = await runInProcessReviewer(baseRequest({ selection }), {
+			registry: fakeRegistry([fakeModel(model)]),
+			complete,
+		});
+		expectText(outcome);
+		assert.equal(calls.length, 1);
+		assert.ok(!("headers" in (calls[0]!.options ?? {})), "a missing session id must never invent a header");
+	});
+}
+
+test("a non-OpenCode model adds no attribution headers and leaves the options unchanged", async () => {
+	const { complete, calls } = capturingComplete(assistantText("ok"));
+	const outcome = await runInProcessReviewer(baseRequest({ selection: "anthropic/claude-sonnet-4", sessionId: "ses-live-1" }), {
+		registry: fakeRegistry([fakeModel({ provider: "anthropic", id: "claude-sonnet-4", baseUrl: "https://api.anthropic.com" })]),
+		complete,
+	});
+	expectText(outcome);
+	assert.equal(calls.length, 1);
+	assert.ok(!("headers" in (calls[0]!.options ?? {})));
+});
+
+test("registry auth headers win over the attribution defaults and both survive the merge", async () => {
+	const { complete, calls } = capturingComplete(assistantText("ok"));
+	const outcome = await runInProcessReviewer(baseRequest({ selection: "opencode/sonnet-4", sessionId: "ses-live-1" }), {
+		registry: fakeRegistry([fakeModel({ provider: "opencode", id: "sonnet-4" })], async () => ({
+			ok: true,
+			headers: { "x-api-key": "registry-key", "x-opencode-session": "registry-session" },
+		})),
+		complete,
+	});
+	expectText(outcome);
+	const headers = calls[0]!.options?.headers;
+	assert.equal(headers?.["x-api-key"], "registry-key", "registry auth headers must survive");
+	assert.equal(headers?.["x-opencode-session"], "registry-session", "explicit registry headers must not be clobbered by the attribution default");
+	assert.equal(headers?.["x-opencode-client"], "pi");
+});
+
+test("an unparseable baseUrl never throws: attribution follows the provider condition only", async () => {
+	const { complete, calls } = capturingComplete(assistantText("ok"));
+	const outcome = await runInProcessReviewer(baseRequest({ selection: "custom/relay-model", sessionId: "ses-live-1" }), {
+		registry: fakeRegistry([fakeModel({ provider: "custom", id: "relay-model", baseUrl: "not-a-url" })]),
+		complete,
+	});
+	expectText(outcome);
+	assert.ok(!("headers" in (calls[0]!.options ?? {})));
+});
+
+test("openCodeSessionAttributionHeaders mirrors pi's condition exactly", () => {
+	const opencode = fakeModel({ provider: "opencode", baseUrl: "https://example.com" });
+	assert.deepEqual(openCodeSessionAttributionHeaders(opencode, "ses-1"), { "x-opencode-session": "ses-1", "x-opencode-client": "pi" });
+	assert.deepEqual(openCodeSessionAttributionHeaders(fakeModel({ provider: "opencode-go" }), "ses-1"), { "x-opencode-session": "ses-1", "x-opencode-client": "pi" });
+	assert.deepEqual(openCodeSessionAttributionHeaders(fakeModel({ provider: "custom", baseUrl: "https://opencode.ai/v1" }), "ses-1"), { "x-opencode-session": "ses-1", "x-opencode-client": "pi" });
+	assert.equal(openCodeSessionAttributionHeaders(fakeModel({ provider: "custom", baseUrl: "https://api.opencode.ai" }), "ses-1"), undefined, "a subdomain host is not opencode.ai");
+	assert.equal(openCodeSessionAttributionHeaders(fakeModel(), "ses-1"), undefined);
+	assert.equal(openCodeSessionAttributionHeaders(opencode, undefined), undefined, "no session id, no header");
+	assert.equal(openCodeSessionAttributionHeaders(opencode, ""), undefined, "an empty session id is no session id");
+});
+
 // ---------------------------------------------------------------------------
 // Text concatenation ignoring thinking parts
 // ---------------------------------------------------------------------------

package/tests/native-review-capability-contract.test.ts

@@ -319,11 +319,26 @@ test("3.4.0 repeats 3.2.1 because the negotiated lane Pi consumes is unchanged",
 	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["3.2.1"] as Record<string, boolean>);
 });
 
+test("3.5.0 repeats 3.4.0 because the negotiated lane Pi consumes is unchanged", () => {
+	// Published v3.4.0 and v3.5.0 provider bundles are byte-identical at
+	// contract 1.2.0, both with archive SHA-256:
+	// 547b68e172cc87aa297309d61624e5fc2c24d407a494b53eeb5a2b053904352c.
+	// Both binaries advertise capabilities/v2.6; only build-identity fields
+	// differ. No review-integration schema changed between the tags. The v2
+	// preflight failure identity fix changes no closed START/STATUS field
+	// this row negotiates, so it repeats 3.4.0. riskEvidence and hint remain
+	// dark because neither is proven to reach Pi's negotiated START path.
+	const contract = NATIVE_CLI_CONTRACTS["3.5.0"] as Record<string, boolean>;
+	assert.equal(contract.riskEvidence, false);
+	assert.equal(contract.hint, false);
+	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["3.4.0"] as Record<string, boolean>);
+});
+
 test("no shipped version key was added beyond the pin bump", () => {
 	// Rows are promises to consumers, so a new key only ever appears in a
 	// dedicated commit alongside a pin bump, never as a side effect. v2.2.4 and
 	// v2.3.0 shipped upstream while Pi stayed on 2.2.3 and were never pinned,
 	// so they get no row: a row asserts ground truth measured against a binary
 	// Pi actually ran, and the table only has to be ascending, not gapless.
-	assert.deepEqual(Object.keys(NATIVE_CLI_CONTRACTS), [...DARK_VERSIONS, "2.2.0", "2.2.1", "2.2.2", "2.2.3", "2.4.0", "2.5.0-rc.3", "2.5.0", "2.6.0", "2.7.0", "2.8.0", "2.8.1", "2.8.2", "2.9.0", "2.9.1", "3.0.0", "3.0.1", "3.1.0", "3.2.1", "3.4.0"]);
+	assert.deepEqual(Object.keys(NATIVE_CLI_CONTRACTS), [...DARK_VERSIONS, "2.2.0", "2.2.1", "2.2.2", "2.2.3", "2.4.0", "2.5.0-rc.3", "2.5.0", "2.6.0", "2.7.0", "2.8.0", "2.8.1", "2.8.2", "2.9.0", "2.9.1", "3.0.0", "3.0.1", "3.1.0", "3.2.1", "3.4.0", "3.5.0"]);
 });

package/tests/native-review-parity.test.ts

@@ -344,6 +344,25 @@ function assertStaleConsentBinding(outcome: Record<string, unknown>, binding: un
 	assert.equal(outcome.next_action, "restart-for-fresh-consent");
 }
 
+test("synthetic default-ON status reaches review consent without changing RDD mode", async (t) => {
+	const cwd = repository(t);
+	const fixture = consentNative(cwd);
+	const operations: string[] = [];
+	fixture.native.reviewMode = async ({ operation }) => {
+		operations.push(operation);
+		return {
+			operation: "status",
+			scope: "clone",
+			status: { global: "", cloneLocal: "", effective: "on", source: "default" },
+		};
+	};
+	await beginConsent(parityRuntime(fixture.native), cwd);
+	assert.equal(fixture.starts.count, 1, "default ON must not skip native review START");
+	assert.ok(operations.length > 0);
+	assert.ok(operations.every((operation) => operation === "status"), "automation must only read RDD mode");
+	assert.deepEqual(fixture.answers, [], "default ON does not grant candidate consent");
+});
+
 test("review-mode gate retains every off-source continuation and fails closed on native errors", async () => {
 	for (const [source, expected] of [
 		["clone_local", /clear this clone-local override/],

package/tests/package-manifest.test.ts

@@ -142,7 +142,6 @@ test("package verification names the native review runtime boundary and packaged
 
 test("npm publication is bound to the exact package tag and triggering commit", () => {
 	const workflow = readFileSync(join(PACKAGE_ROOT, ".github", "workflows", "publish.yml"), "utf8");
-	const releaseSkill = readFileSync(join(PACKAGE_ROOT, "skills", "release", "SKILL.md"), "utf8");
 	const packageJson = readPackageJson();
 	const dispatchBlock = workflow.match(
 		/^ {2}workflow_dispatch:\n([\s\S]*?)^\npermissions:/m,
@@ -189,16 +188,6 @@ test("npm publication is bound to the exact package tag and triggering commit",
 	);
 	assert.match(workflow, /npm publish --provenance --access public/);
 	assert.doesNotMatch(workflow, /pnpm publish|--no-git-checks|NODE_AUTH_TOKEN/);
-
-	assert.match(releaseSkill, /tag="v\$\{version\}"/);
-	assert.match(releaseSkill, /release_sha="\$\(git rev-parse 'origin\/main\^\{commit\}'\)"/);
-	assert.match(releaseSkill, /git rev-parse "\$\{tag\}\^\{commit\}"/);
-	assert.match(releaseSkill, /git fetch --no-tags origin "refs\/tags\/\$\{tag\}"/);
-	assert.match(releaseSkill, /gh release create "\$\{tag\}"[\s\S]*--verify-tag/);
-	assert.match(releaseSkill, /--ref main/);
-	assert.match(releaseSkill, /-f tag="\$\{tag\}"/);
-	assert.match(releaseSkill, /trusted OIDC with provenance/);
-	assert.doesNotMatch(releaseSkill, /--ref "\$\{tag\}"|-f dist-tag=/);
 });
 
 test("Pi delivery relay is absent from the packaged extension", () => {
@@ -309,20 +298,20 @@ test("package manifest installs pi-pretty through a wrapper without bundling nat
 	);
 });
 
-test("package verification binds the published Gentle AI v3.4.0 runtime pin", () => {
+test("package verification binds the published Gentle AI v3.5.0 runtime pin", () => {
 	const installer = readFileSync(join(PACKAGE_ROOT, "scripts", "gentle-ai-installer.mjs"), "utf8");
 	const binary = readFileSync(join(PACKAGE_ROOT, "lib", "gentle-ai-binary.ts"), "utf8");
 	const verifier = readFileSync(join(PACKAGE_ROOT, "scripts", "verify-package-files.mjs"), "utf8");
 
-	assert.match(installer, /INSTALLER_VERSION = "3\.4\.0"/);
+	assert.match(installer, /INSTALLER_VERSION = "3\.5\.0"/);
 	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_PACKAGE.*GENTLE_AI_WINDOWS_SOURCE_MODULE/);
-	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:bQOM\+Xa3WN5\+idTagEk15rgEEQQWVhZvq8BPF\/FHtSs="/);
+	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:3y\+Nb7CtgGB3ne3bSNxkzV6j19etkOnGDXIiuv7tMp8="/);
 	assert.match(installer, /GOTOOLCHAIN: "local"/);
 	assert.match(installer, /GOSUMDB: "sum\.golang\.org"/);
 	assert.match(binary, /GENTLE_AI_VERSION = INSTALLER_VERSION/);
 	assert.match(binary, /GO_SUMDB_SOURCE_BUILD/);
 	assert.match(binary, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM/);
-	assert.match(verifier, /v3\.4\.0/);
+	assert.match(verifier, /v3\.5\.0/);
 });
 
 
@@ -1574,9 +1563,9 @@ test("pi-pretty wrapper uses cached ESM loading for compiled and pnpm symlink in
 	assert.match(wrapper, /quietToolsEnabled/);
 });
 
-test("Gentle Shell v3.3.0 package and runtime stop before publication", () => {
+test("Gentle Shell v3.4.0 package and runtime stop before publication", () => {
 	const packageJson = readPackageJson();
-	assert.equal(packageJson.version, "3.3.0", "the release manifest must remain explicitly pinned to v3.3.0");
+	assert.equal(packageJson.version, "3.4.0", "the release manifest must remain explicitly pinned to v3.4.0");
 	assert.equal(
 		packageJson.scripts?.test,
 		"node --experimental-strip-types --test tests/*.test.ts && pnpm run check:provider-contract && pnpm run test:harness",