gentle-pi 3.3.0 → 3.5.0

package/runtime/gentle-shell-launcher.mjs

@@ -0,0 +1,483 @@
+// Generated by scripts/build-runtime-modules.mjs. Do not edit.
+import { join } from "node:path";
+
+// The gentle-shell launcher: pure, side-effect-free functions over injected
+// env/fs/exec. `bin/gentle-shell.mjs` (T2) wires these into the real process,
+// filesystem and child process so this module stays fully unit-testable.
+
+
+
+// pi's own package-management subcommands (see pi's cli/args.ts printHelp
+// "Commands" list): each is dispatched by pi itself, before pi's own flag
+// parsing, purely on argv[0]. `uninstall` is pi's alias for `remove`.
+export const PI_SUBCOMMANDS = ["install", "remove", "uninstall", "update", "list", "config", "auth"]         ;
+
+
+
+function isPiSubcommand(token        )                        {
+	return (PI_SUBCOMMANDS                     ).includes(token);
+}
+
+
+
+
+
+
+
+
+
+
+
+	                                                                  
+
+
+
+
+
+
+// Home-subcommand parsing is deliberately shallow: `home` only counts as the
+// subcommand when it is argv[0], and everything after it is handed over
+// untouched as commandArgs — T2 owns interpreting `home link|isolated|<path>`.
+export function parseLauncherArgs(argv          )                     {
+	if (argv[0] === "home") {
+		return {
+			link: false,
+			isolated: false,
+			home: undefined,
+			help: false,
+			version: false,
+			command: "home",
+			commandArgs: argv.slice(1),
+			passthrough: [],
+			piSubcommand: undefined,
+			error: undefined,
+		};
+	}
+
+	let link = false;
+	let isolated = false;
+	let home                    ;
+	let help = false;
+	let version = false;
+	let error                    ;
+	let piSubcommand                          ;
+	const passthrough           = [];
+
+	for (let i = 0; i < argv.length; i += 1) {
+		const arg = argv[i];
+		if (arg === "--") {
+			const rest = argv.slice(i + 1);
+			if (passthrough.length === 0 && rest.length > 0 && isPiSubcommand(rest[0])) {
+				piSubcommand = rest[0];
+			}
+			passthrough.push(...rest);
+			break;
+		}
+		if (arg === "--link") {
+			link = true;
+			continue;
+		}
+		if (arg === "--isolated") {
+			isolated = true;
+			continue;
+		}
+		if (arg === "--help" || arg === "-h") {
+			help = true;
+			continue;
+		}
+		if (arg === "--version") {
+			version = true;
+			continue;
+		}
+		if (arg.startsWith("--home=")) {
+			const value = arg.slice("--home=".length);
+			if (value.length === 0) {
+				error = "--home requires a non-empty path argument";
+				continue;
+			}
+			home = value;
+			continue;
+		}
+		if (arg === "--home") {
+			const value = argv[i + 1];
+			if (value === undefined || value.length === 0) {
+				error = "--home requires a non-empty path argument";
+				if (value !== undefined) i += 1;
+				continue;
+			}
+			home = value;
+			i += 1;
+			continue;
+		}
+		if (passthrough.length === 0 && isPiSubcommand(arg)) {
+			piSubcommand = arg;
+		}
+		passthrough.push(arg);
+	}
+
+	if (error === undefined) {
+		if (link && isolated) {
+			error = "--link cannot be combined with --isolated";
+		} else if (link && home !== undefined) {
+			error = "--link cannot be combined with --home";
+		} else if (isolated && home !== undefined) {
+			error = "--isolated cannot be combined with --home";
+		}
+	}
+
+	return { link, isolated, home, help, version, command: undefined, commandArgs: [], passthrough, piSubcommand, error };
+}
+
+// --- home resolution -------------------------------------------------------
+
+
+
+
+
+
+
+
+
+
+// A discriminated union instead of a plain `home: string` field: `resolveHome`
+// switches on `mode` rather than re-parsing the raw on-disk string, and the
+// `path` case carries its `dir` explicitly so a "link"/"isolated" string can
+// never be mistaken for a filesystem path at the call site.
+
+
+
+
+
+
+
+
+
+// Pi Subagents resolves `PI_CODING_AGENT_DIR || ~/.pi/agent`; `--link` reuses
+// that exact home so gentle-shell never diverges from the user's own pi.
+function linkDir(env                                    , homedir        )         {
+	return env.PI_CODING_AGENT_DIR || join(homedir, ".pi", "agent");
+}
+
+function isolatedDir(env                                    , homedir        )         {
+	return env.GENTLE_SHELL_HOME || join(homedir, ".gentle-shell", "agent");
+}
+
+export function resolveHome(input                  )               {
+	const { args, env, homedir, config } = input;
+
+	if (args.link) return { mode: "link", dir: linkDir(env, homedir), source: "flag" };
+	if (args.isolated) return { mode: "isolated", dir: isolatedDir(env, homedir), source: "flag" };
+	if (args.home !== undefined) return { mode: "path", dir: args.home, source: "flag" };
+
+	if (config !== undefined) {
+		if (config.mode === "link") return { mode: "link", dir: linkDir(env, homedir), source: "config" };
+		if (config.mode === "isolated") return { mode: "isolated", dir: isolatedDir(env, homedir), source: "config" };
+		return { mode: "path", dir: config.dir, source: "config" };
+	}
+
+	return { mode: "isolated", dir: isolatedDir(env, homedir), source: "default" };
+}
+
+export function launcherConfigPath(homedir        )         {
+	return join(homedir, ".gentle-shell", "config.json");
+}
+
+// Tolerant on purpose: a malformed or foreign config.json must never crash
+// the launcher, it just falls through to the default isolated home.
+//
+// The on-disk shape stays the flat `{ "home": "link" | "isolated" | "<path>" }`
+// documented in the feature scope; only the parsed, in-memory `LauncherConfig`
+// is a discriminated union. Any non-empty string other than the exact literals
+// "link" or "isolated" is treated as a path, including a near-miss like
+// "linked" — this is deliberate: there is no separate "unrecognised mode"
+// error, a typo just resolves to a (probably nonexistent) path instead.
+export function parseLauncherConfig(text        )                             {
+	let parsed         ;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return undefined;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return undefined;
+	const home = (parsed                           ).home;
+	if (typeof home !== "string" || home.length === 0) return undefined;
+	if (home === "link") return { mode: "link" };
+	if (home === "isolated") return { mode: "isolated" };
+	return { mode: "path", dir: home };
+}
+
+// --- pi runtime resolution ---------------------------------------------------
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+export function resolvePiRuntime(deps               )                        {
+	const envOverride = deps.env.GENTLE_SHELL_PI;
+	if (envOverride !== undefined && envOverride.length > 0) return { kind: "env", command: envOverride, args: [] };
+
+	const bundledCliPath = deps.resolveBundledCli();
+	if (bundledCliPath !== undefined) return { kind: "bundled", command: deps.nodeExecPath, args: [bundledCliPath] };
+
+	const onPath = deps.findOnPath("pi");
+	if (onPath !== undefined) return { kind: "path", command: onPath, args: [] };
+
+	return undefined;
+}
+
+export function missingPiMessage()         {
+	return [
+		"No pi runtime could be found. Pick one of:",
+		"  - Set GENTLE_SHELL_PI to the path of a pi executable.",
+		"  - Install @earendil-works/pi-coding-agent next to gentle-pi (it ships as an optional peer dependency).",
+		"  - Install pi and make sure it is on your PATH.",
+	].join("\n");
+}
+
+// --- pi version gate ---------------------------------------------------------
+
+export const MIN_PI_VERSION = "0.85.1";
+
+
+
+const VERSION_PATTERN = /v?(\d+)\.(\d+)\.(\d+)/;
+
+function compareVersions(a                                   , b                                   )         {
+	for (let i = 0; i < 3; i += 1) {
+		if (a[i] !== b[i]) return a[i] - b[i];
+	}
+	return 0;
+}
+
+export function checkPiVersion(output        , minimum         = MIN_PI_VERSION)                 {
+	const match = VERSION_PATTERN.exec(output);
+	if (!match) {
+		return { ok: false, message: `Could not determine the pi version from "${output.trim()}" (need at least ${minimum}).` };
+	}
+	const version = `${match[1]}.${match[2]}.${match[3]}`;
+	const minimumMatch = VERSION_PATTERN.exec(minimum);
+	if (!minimumMatch) throw new Error(`invalid minimum version "${minimum}"`);
+	const found                           = [Number(match[1]), Number(match[2]), Number(match[3])];
+	const wanted                           = [Number(minimumMatch[1]), Number(minimumMatch[2]), Number(minimumMatch[3])];
+	if (compareVersions(found, wanted) < 0) {
+		return { ok: false, version, message: `pi version ${version} is older than the required minimum ${minimum}.` };
+	}
+	return { ok: true, version };
+}
+
+// --- packaging drift guard -----------------------------------------------------
+
+
+
+
+
+
+
+// Keeps the MIN_PI_VERSION drift-guard test's failure readable: a missing
+// peerDependencies block, a missing peer entry, or a malformed range must
+// fail with a clear assertion message, not a raw TypeError from indexing an
+// undefined value the way a direct `packageJson.peerDependencies[peerName]`
+// lookup would.
+export function checkPeerVersionPin(packageJson                      , peerName        , minVersion        )                      {
+	const peerDependencies = packageJson.peerDependencies;
+	if (peerDependencies === undefined) {
+		return { ok: false, message: "package.json is missing a peerDependencies block" };
+	}
+	const pinned = peerDependencies[peerName];
+	if (typeof pinned !== "string") {
+		return { ok: false, message: `package.json peerDependencies is missing "${peerName}"` };
+	}
+	if (!/^>=\d+\.\d+\.\d+$/.test(pinned)) {
+		return { ok: false, message: `package.json peerDependencies["${peerName}"] ("${pinned}") is not a simple >=x.y.z range` };
+	}
+	const version = pinned.replace(/^>=/, "");
+	if (version !== minVersion) {
+		return { ok: false, message: `MIN_PI_VERSION ("${minVersion}") does not match the pinned peer range ("${pinned}")` };
+	}
+	return { ok: true, pinned };
+}
+
+// --- settings.json detection ---------------------------------------------------
+
+function packageEntryDeclaresGentlePi(entry         )          {
+	const declares = (value         )          => typeof value === "string" && (value === "npm:gentle-pi" || value.startsWith("npm:gentle-pi@"));
+	if (declares(entry)) return true;
+	if (entry !== null && typeof entry === "object") return declares((entry                           ).source);
+	return false;
+}
+
+export function settingsDeclareGentlePi(settingsText                    )          {
+	if (settingsText === undefined) return false;
+	let parsed         ;
+	try {
+		parsed = JSON.parse(settingsText);
+	} catch {
+		return false;
+	}
+	if (typeof parsed !== "object" || parsed === null) return false;
+	const packages = (parsed                           ).packages;
+	if (!Array.isArray(packages)) return false;
+	return packages.some(packageEntryDeclaresGentlePi);
+}
+
+// --- pi invocation builder ---------------------------------------------------
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+// The `-e/--theme/--skill/--prompt-template` injection is skipped when the
+// caller already confirmed the target settings.json declares the package
+// (the `--link` case with a pi-managed install), or when passthrough[0] is
+// one of pi's own subcommands: pi dispatches install/remove/uninstall/
+// update/list/config/auth on argv[0] before it even parses flags, so any
+// injected flag ahead of it stops pi from recognising its subcommand at
+// all — this is exactly the observed 2026-09-22 bug where `gentle-shell
+// install npm:x` opened an interactive pi session instead of running the
+// package manager. Isolated and path homes never declare the package, so
+// callers pass `settingsDeclareGentlePi: false` for those and the
+// injection always happens there, unless a pi subcommand is set.
+export function buildPiInvocation(input                        )               {
+	const args = [...input.runtime.args];
+	if (input.piSubcommand === undefined && !input.settingsDeclareGentlePi) {
+		args.push(
+			"-e",
+			input.packageRoot,
+			"--theme",
+			join(input.packageRoot, "themes"),
+			"--skill",
+			join(input.packageRoot, "skills"),
+			"--prompt-template",
+			join(input.packageRoot, "prompts"),
+		);
+	}
+	args.push(...input.passthrough);
+
+	return {
+		command: input.runtime.command,
+		args,
+		env: { ...input.baseEnv, PI_CODING_AGENT_DIR: input.home.dir, GENTLE_PI_AGENT_HOME: input.home.dir },
+	};
+}
+
+// --- spawn planning ------------------------------------------------------------
+
+// R3-001: `findOnPath` can resolve a PATHEXT candidate such as a .CMD or .BAT
+// shim on win32 (exactly how an npm-installed `pi` lands on PATH), and a
+// GENTLE_SHELL_PI override can point at one too. Current Node releases refuse
+// to spawn a batch file directly without `shell: true` (EINVAL), so both the
+// version probe and the real launch route a batch shim through cmd.exe as one
+// quoted command line instead of spawning it directly.
+const CMD_EXE_SPECIAL_CHARS = /[\s"&|<>^%()]/;
+
+// cmd.exe quoting is deliberately simple, not a full cmd.exe parser: wrap a
+// token in double quotes when it is empty or contains whitespace or any of
+// `"&|<>^%()`, and escape an inner `"` as `\"` — doubling inner quotes is not
+// reliable in cmd.exe, unlike the `\"` convention Node's own Windows spawn
+// helpers use.
+export function quoteForCmdExe(token        )         {
+	if (token.length > 0 && !CMD_EXE_SPECIAL_CHARS.test(token)) return token;
+	return `"${token.replace(/"/g, '\\"')}"`;
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+export function planSpawn(input                )            {
+	const { command, args, platform } = input;
+	if (platform === "win32" && /\.(cmd|bat)$/i.test(command)) {
+		return { command: [command, ...args].map(quoteForCmdExe).join(" "), args: [], shell: true };
+	}
+	return { command, args, shell: false };
+}
+
+// --- reporting ---------------------------------------------------------------
+
+
+
+
+
+
+
+export function describeVersion(input                      )         {
+	return [
+		`gentle-shell ${input.gentlePiVersion}`,
+		`pi ${input.piVersion ?? "not found"}`,
+		`home ${input.home.mode} ${input.home.dir}`,
+	].join("\n");
+}
+
+export function helpText()         {
+	return [
+		"Usage: gentle-shell [options] [-- pi-args...]",
+		"       gentle-shell home [link|isolated|<path>]",
+		"",
+		"Opens pi with the Gentle Shell package loaded, without touching your",
+		"vanilla pi installation.",
+		"",
+		"Options:",
+		"  --link           Use your existing pi agent home (never edits its settings.json).",
+		"  --isolated       Use the dedicated ~/.gentle-shell/agent home (default).",
+		"  --home <path>    Use a custom agent home directory.",
+		"  --help, -h       Show this help text.",
+		"  --version        Show gentle-shell, pi, and home version information.",
+		"",
+		"Commands:",
+		"  home             Print or persist the effective home mode (link, isolated, or a path).",
+		"",
+		"Managing packages:",
+		"  gentle-shell install npm:<pkg>   Run pi's own 'install' against the resolved home.",
+		"  gentle-shell remove <source>     Run pi's own 'remove' against the resolved home.",
+		"  gentle-shell list                Run pi's own 'list' against the resolved home.",
+		"  gentle-shell update [target]     Run pi's own 'update' against the resolved home.",
+		"  gentle-shell config              Run pi's own 'config' against the resolved home.",
+		"  gentle-shell auth <command>      Run pi's own 'auth' against the resolved home.",
+		"  These run pi's own commands, forwarded verbatim, against the --isolated home",
+		"  (or your own pi home with --link). Running 'gentle-shell install npm:gentle-pi'",
+		"  inside the isolated home is unnecessary: gentle-shell already loads the",
+		"  package itself.",
+		"",
+		"Environment variables:",
+		"  GENTLE_SHELL_PI       Path to the pi executable to run.",
+		"  GENTLE_SHELL_HOME     Directory for the isolated home (default: ~/.gentle-shell/agent).",
+		"  PI_CODING_AGENT_DIR   Directory for the --link home, shared with pi itself.",
+		"",
+		"Every other argument is forwarded to pi unchanged.",
+	].join("\n");
+}

package/runtime/native-review-cli.mjs

@@ -706,7 +706,11 @@ function isNativeUntrackedPath(value         )                  {
 		&& value.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
 }
 
-function nativeUntrackedSelection(request                                 )                           {
+export function nativeUntrackedSelection(request
+
+
+
+ )                           {
 	const { untrackedScope, expectedUntrackedInventory, intendedUntracked } = request;
 	const declared = untrackedScope !== undefined || expectedUntrackedInventory !== undefined || intendedUntracked !== undefined;
 	if (!declared) return {};
@@ -717,16 +721,19 @@ function nativeUntrackedSelection(request                                 )
 	) {
 		throw new TypeError("Native untracked selection must declare one scope, one inventory digest, and unique repository-relative paths");
 	}
-	if (untrackedScope === NATIVE_UNTRACKED_SCOPE.EXCLUDE && (intendedUntracked?.length ?? 0) > 0) {
+	// The guard above establishes the array and element types for both typed
+	// native requests and untyped facade input.
+	const paths = intendedUntracked                                 ;
+	if (untrackedScope === NATIVE_UNTRACKED_SCOPE.EXCLUDE && (paths?.length ?? 0) > 0) {
 		throw new TypeError("Native exclude untracked selection cannot include paths");
 	}
-	if (untrackedScope === NATIVE_UNTRACKED_SCOPE.SELECT && (intendedUntracked?.length ?? 0) === 0) {
+	if (untrackedScope === NATIVE_UNTRACKED_SCOPE.SELECT && (paths?.length ?? 0) === 0) {
 		throw new TypeError("Native select untracked selection requires at least one path");
 	}
 	return {
 		untrackedScope,
 		expectedUntrackedInventory,
-		intendedUntracked: intendedUntracked === undefined ? undefined : [...intendedUntracked],
+		intendedUntracked: paths === undefined ? undefined : [...paths],
 	};
 }
 
@@ -1019,6 +1026,13 @@ export const NATIVE_CLI_CONTRACTS = Object.freeze({
 	// and hint remain dark because neither is proven to reach the negotiated
 	// START path Pi consumes.
 	"3.4.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v3.5.0 repeats 3.4.0: the published provider contract bundle is
+	// byte-identical at 1.2.0, both binaries advertise capabilities/v2.6
+	// with only build-identity differences, and no review-integration schema
+	// changed. The v2 preflight failure identity fix does not change the
+	// closed START/STATUS fields this row negotiates. riskEvidence and hint
+	// remain dark; neither is proven to reach Pi's negotiated START path.
+	"3.5.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
 });
 
 
@@ -1103,8 +1117,19 @@ function decodeSelectedLenses(value         , riskLevel        , lensesRequired
 function enumString(value         , allowed                   )         { const parsed = stringValue(value); if (!allowed.includes(parsed)) throw new Error("unsupported enum"); return parsed; }
 const NATIVE_DIAGNOSTIC_TEXT_LIMIT = 4_096;
 
-function sanitizeNativeDiagnosticText(value        , limit = NATIVE_DIAGNOSTIC_TEXT_LIMIT)         {
-	const normalized = value
+function sanitizeNativeDiagnosticText(value        , limit = NATIVE_DIAGNOSTIC_TEXT_LIMIT, operation                        )         {
+	// ASSESS diagnostics are projected into a public verification plan. Retain
+	// native guidance, not local paths or environment assignment values.
+	const input = operation === NATIVE_REVIEW_OPERATION.ASSESS
+		? value
+			.replace(/(?<![\w-])[a-z_][a-z0-9_]*=(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s]+)/gi, "[REDACTED ENV]")
+			.replace(/--(?:password|token|secret|authorization|cookie|private[_-]key|access[_-]token|[a-z0-9_-]+[_-]token|api[_-]?key)[ \t]+(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s]+)/gi, "[REDACTED CREDENTIAL]")
+			// Quoted paths have a clear boundary. For an unquoted path, the
+			// remaining line is ambiguous (spaces may belong to the filename).
+			// Redact that suffix rather than leak trailing path components.
+			.replace(/"(?:[A-Za-z]:[\\/]|\/)[^"\r\n]*"|'(?:[A-Za-z]:[\\/]|\/)[^'\r\n]*'|(?:[A-Za-z]:[\\/]|\/)[^\r\n]*/g, "[REDACTED PATH]")
+		: value;
+	const normalized = input
 		.replace(/\x1b](?:[^\x07\x1b]|\x1b(?!\\))*?(?:\x07|\x1b\\)/g, "[REDACTED CONTROL]")
 		.replace(/\x1b[PX^_][\s\S]*?\x1b\\/g, "[REDACTED CONTROL]")
 		.replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "[REDACTED CONTROL]")
@@ -1138,7 +1163,7 @@ export function sanitizeForeignNativeReviewDiagnostics(value         )
 			timed_out: booleanValue(raw.timed_out),
 			output_limit_exceeded: booleanValue(raw.output_limit_exceeded),
 			...(maxBufferBytes === undefined ? {} : { max_buffer_bytes: maxBufferBytes, configuration_hint: configurationHint  }),
-			...(raw.stderr === undefined ? {} : { stderr: sanitizeNativeDiagnosticText(stringValue(raw.stderr)) }),
+			...(raw.stderr === undefined ? {} : { stderr: sanitizeNativeDiagnosticText(stringValue(raw.stderr), NATIVE_DIAGNOSTIC_TEXT_LIMIT, operation) }),
 		};
 	} catch { return undefined; }
 }
@@ -1155,7 +1180,7 @@ function nativeProcessDiagnostics(operation                       , code
 		...(code === NATIVE_REVIEW_ERROR_CODE.OUTPUT_LIMIT && maxBufferBytes !== undefined
 			? { max_buffer_bytes: maxBufferBytes, configuration_hint: NATIVE_REVIEW_MAX_BUFFER_CONFIGURATION_HINT }
 			: {}),
-		...(result?.stderr.trim() ? { stderr: sanitizeNativeDiagnosticText(result.stderr) } : {}),
+		...(result?.stderr.trim() ? { stderr: sanitizeNativeDiagnosticText(result.stderr, NATIVE_DIAGNOSTIC_TEXT_LIMIT, operation) } : {}),
 	};
 }
 
@@ -2536,6 +2561,7 @@ export class NativeReviewCliV216                            {
 	// rejects -- callers (the `gentle_review` tool's `assess` operation) fail
 	// closed to `high`.
 	async assess(request                           )                              {
+		const selection = nativeUntrackedSelection(request);
 		if (request.baseRef !== undefined && !isCanonicalProcessString(request.baseRef)) throw new TypeError("Native ASSESS baseRef must be a non-empty, trimmed, NUL-free string");
 		if (request.baseRef !== undefined && request.committedOnly !== true) throw new TypeError("Native ASSESS baseRef requires explicit committedOnly acknowledgement");
 		if (request.baseRef === undefined && request.committedOnly !== undefined) throw new TypeError("Native ASSESS committedOnly requires an explicit baseRef");
@@ -2543,7 +2569,7 @@ export class NativeReviewCliV216                            {
 		const execution = await this.invoke(
 			NATIVE_REVIEW_OPERATION.ASSESS,
 			cwd,
-			["review", "assess", "--cwd", cwd, ...(request.baseRef === undefined ? [] : ["--base-ref", request.baseRef, "--committed-only"]), "--json"],
+			["review", "assess", "--cwd", cwd, ...(request.baseRef === undefined ? [] : ["--base-ref", request.baseRef, "--committed-only"]), ...nativeUntrackedSelectionArguments(selection), "--json"],
 			false,
 			request.signal,
 			this.executablePath(NATIVE_REVIEW_OPERATION.ASSESS, false),

package/runtime/review-integration-v2.mjs

@@ -340,6 +340,7 @@ const REQUIRED_MANDATORY_FEATURES = Object.freeze(FEATURE_NAMES.filter((name) =>
 
 
 
+
 
 
 const REPOSITORY_CONTEXT_OUTCOMES = ["applied", "pending", "blocked_conflict", "durability_limited"]         ;
@@ -1151,7 +1152,8 @@ export function decodeReviewArtifactSubjectV2(value         )
 }
 
 function decodeChangedPathEntry(value         , label        )                   {
-	const body = exactRecord(value, label, ["path", "status", "old_mode", "new_mode", "deleted", "type_changed", "mode_only", "intended_untracked"]);
+	const body = exactRecord(value, label, ["path", "status", "old_mode", "new_mode", "deleted", "type_changed", "mode_only", "intended_untracked"], ["generated"]);
+	if (body.generated !== undefined && body.generated !== true) throw new TypeError(`${label}.generated must be true when present`);
 	return {
 		path: nonempty(body.path, `${label}.path`),
 		status: enumeration(body.status, ["A", "D", "M", "T"]         , `${label}.status`),
@@ -1161,6 +1163,7 @@ function decodeChangedPathEntry(value         , label        )
 		typeChanged: boolean(body.type_changed, `${label}.type_changed`),
 		modeOnly: boolean(body.mode_only, `${label}.mode_only`),
 		intendedUntracked: boolean(body.intended_untracked, `${label}.intended_untracked`),
+		...(body.generated === undefined ? {} : { generated: true }),
 	};
 }
 

package/scripts/build-runtime-modules.mjs

@@ -13,6 +13,7 @@ const sources = [
 	"review-risk-assessment",
 	"native-review-cli",
 	"telemetry-trigger",
+	"gentle-shell-launcher",
 ];
 const header = "// Generated by scripts/build-runtime-modules.mjs. Do not edit.\n";
 

package/scripts/gentle-ai-installer.mjs

@@ -36,7 +36,7 @@ const WINDOWS_SYSTEM_ROOT = "C:\\Windows";
 // version check below) derives from this constant instead of repeating the
 // literal, so a pin bump cannot leave a stale copy behind. See
 // scripts/install-gentle-ai.mjs for the incident that motivated this.
-export const INSTALLER_VERSION = "3.4.0";
+export const INSTALLER_VERSION = "3.5.0";
 export const RELEASE_BASE_URL = `https://github.com/Gentleman-Programming/gentle-ai/releases/download/v${INSTALLER_VERSION}/`;
 export const GENTLE_AI_INSTALL_METHOD = Object.freeze({
 	SIGNED_RELEASE_ASSET: "signed-release-asset",
@@ -45,10 +45,10 @@ export const GENTLE_AI_INSTALL_METHOD = Object.freeze({
 export const GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH = "github.com/gentleman-programming/gentle-ai/v3/cmd/gentle-ai";
 export const GENTLE_AI_WINDOWS_SOURCE_MODULE = "github.com/gentleman-programming/gentle-ai/v3";
 export const GENTLE_AI_WINDOWS_SOURCE_TAG = `v${INSTALLER_VERSION}`;
-// `go mod download -json github.com/gentleman-programming/gentle-ai/v3@v3.4.0`
+// `go mod download -json github.com/gentleman-programming/gentle-ai/v3@v3.5.0`
 // with GOSUMDB=sum.golang.org reports this exact module SumDB checksum, and the
-// tag resolves to commit 82a6de96, the published v3.4.0 release head.
-export const GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:bQOM+Xa3WN5+idTagEk15rgEEQQWVhZvq8BPF/FHtSs=";
+// tag resolves to commit 0b335e43, the published v3.5.0 release head.
+export const GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:3y+Nb7CtgGB3ne3bSNxkzV6j19etkOnGDXIiuv7tMp8=";
 export const GENTLE_AI_WINDOWS_SOURCE_PACKAGE = `${GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH}@${GENTLE_AI_WINDOWS_SOURCE_TAG}`;
 export const GENTLE_AI_WINDOWS_MINIMUM_GO_VERSION = "1.25.10";
 export const GENTLE_AI_GO_TOOLCHAIN_UNAVAILABLE_CODE = "GENTLE_AI_GO_TOOLCHAIN_UNAVAILABLE";
@@ -67,7 +67,7 @@ export class GentleAiInstallerError extends Error {
 // Sentinel used while a re-pinned gentle-ai release is not yet published. A
 // sentinel digest can never match a real SHA-256, so installation fails closed,
 // and verify-package-files.mjs refuses to pack/publish while any digest below
-// still holds it. The v3.4.0 digests are pinned from the published release:
+// still holds it. The v3.5.0 digests are pinned from the published release:
 // archive sha256 values verified against the minisign-signed checksums.txt and
 // freshly computed hashes; binary sha256 values computed from the extracted
 // executables.
@@ -109,15 +109,15 @@ async function downloadPinnedGentleAiAsset(asset, destination, options) {
 }
 
 // Windows is absent from signed release archives on purpose. gentle-ai stopped
-// distributing unsigned Windows builds in c4b764d0, so v3.4.0 publishes signed
+// distributing unsigned Windows builds in c4b764d0, so v3.5.0 publishes signed
 // Darwin/Linux archives only. Windows x64/arm64 uses the separately verified
 // exact-tag Go SumDB source-build path below; restore archive rows only when
 // upstream ships signed Windows assets.
 export const GENTLE_AI_RELEASE_ASSETS = Object.freeze({
-	"darwin/amd64": asset("gentle-ai_3.4.0_darwin_amd64.tar.gz", "7d13fa45489098ff9e82dee2232204f72bf1c04ef998ceadfe1ea972697f2e56", "d9096b4bb13e56aae1251dfacd2487821a15c40b7c9397555ad615ede47e658a", "gentle-ai"),
-	"darwin/arm64": asset("gentle-ai_3.4.0_darwin_arm64.tar.gz", "b9052d8dc02923663d4451a4b031c4ef7328cd866c0cb6729e8ff2b9853603f0", "0aca1239cafd87ce63b194ab69da90e762801d82a96418fd6b7b12ea3806dc07", "gentle-ai"),
-	"linux/amd64": asset("gentle-ai_3.4.0_linux_amd64.tar.gz", "c287289a514420381e890991bb3fbea4a2c36d7b4b1774fcf6bc4deb83378915", "309d9aafb48de5ef90ba0a212e8a98e8fdbb82d0852e24015e36a5ce0fe04c06", "gentle-ai"),
-	"linux/arm64": asset("gentle-ai_3.4.0_linux_arm64.tar.gz", "dfd1fe70acfe577d2a36e3a658895f481467518a2923b7200403dbcca0181399", "83ba7d27d250019115690be51664bd356e09085da8858761e362e6053c6290d3", "gentle-ai"),
+	"darwin/amd64": asset("gentle-ai_3.5.0_darwin_amd64.tar.gz", "483b8363cc2b717d224ee7a15c834ed518854c31a1d79d84b6ea0551fd7905cf", "06e5ce2936f0b0579fa382b5cd59cf42c23b07404b162d9ff9a036dd107093a4", "gentle-ai"),
+	"darwin/arm64": asset("gentle-ai_3.5.0_darwin_arm64.tar.gz", "d7a5c233ce23e8fc2ce917ed3e6a2e643655e6e8322fddb3c522324d4cf8ae52", "ec7757fe13f6cd5c9dffa6466d75c5cd68992eac44e684d330c838282c5e2e7e", "gentle-ai"),
+	"linux/amd64": asset("gentle-ai_3.5.0_linux_amd64.tar.gz", "3ea016622981f5e4f4a80632fb9c4673149c98f4e5cecc4b979b41bda758ba4a", "7a4202f75c8b90056f0ecd8fceaaef9efe407abc6f98bb42a3ee1e5ad69eb197", "gentle-ai"),
+	"linux/arm64": asset("gentle-ai_3.5.0_linux_arm64.tar.gz", "aca1997b3ae8439c17883cde39c3ba577ae38352ad6be1d1c4b2c6bc428c4505", "4d81f356f6e221bc5730a280bae049df8315232a2470089993200577e36e97cc", "gentle-ai"),
 });
 
 // A pinned asset is either a signed archive or, for a prerelease pin only,