gentle-pi 3.5.0 → 3.6.0

package/lib/inprocess-reviewer.ts

@@ -9,7 +9,11 @@
 // the caller's "provider/id" selection through pi's live model registry,
 // authenticates through the registry's own resolver, and completes exactly
 // one frozen prompt as a single user message — no systemPrompt, no tools, no
-// session, no extension hooks.
+// session, and none of pi's tool/skill/prompt extension hooks. Extension
+// *providers* are the opposite: they are explicitly in scope. Reading the
+// earlier "no extension hooks" wording as "no extension providers" is what
+// produced gentle-shell#1304, where every extension-registered model was
+// unreachable, so the distinction is stated here rather than implied.
 //
 // Every I/O seam is injected (`registry`, `complete`, `now`), so this module
 // runs under tests with no network and no pi process. gentle-pi#311 P2 wires
@@ -22,18 +26,32 @@ import { SAFE_MODEL_ID_PATTERN } from "./model-routing-authority.ts";
 
 // ---------------------------------------------------------------------------
 // Registry seam — a structural subset of pi's live ModelRegistry
-// (@earendil-works/pi-coding-agent core/model-registry.ts). Only `find` and
-// `getApiKeyAndHeaders` are needed here; the real registry's resolved auth
-// carries extra optional fields (`baseUrl`, `env`) that this narrower shape
-// simply ignores.
+// (@earendil-works/pi-coding-agent core/model-registry.ts). `find` and
+// `getApiKeyAndHeaders` are required. `getProvider` is optional and selects
+// the dispatch path: when present, the completion goes through the composed
+// provider it returns (which is what reaches extension-registered providers);
+// when absent, it falls back to `deps.complete`, so a test double with no
+// composition layer still satisfies the seam. The real registry's resolved
+// auth carries extra optional fields (`baseUrl`, `env`) that this narrower
+// shape simply ignores.
 // ---------------------------------------------------------------------------
 
+/**
+ * The single method this module needs from a resolved provider. pi's
+ * `Provider.streamSimple` returns an `AssistantMessageEventStream`; only its
+ * `result()` is consumed here, so the seam asks for nothing more.
+ */
+export interface InProcessReviewerProvider {
+	streamSimple(model: Model<Api>, context: Context, options?: SimpleStreamOptions): { result(): Promise<AssistantMessage> };
+}
+
 export interface InProcessReviewerRegistry {
 	find(provider: string, modelId: string): Model<Api> | undefined;
 	getApiKeyAndHeaders(model: Model<Api>): Promise<
 		| { readonly ok: true; readonly apiKey?: string; readonly headers?: ProviderHeaders }
 		| { readonly ok: false; readonly error: string }
 	>;
+	getProvider?(provider: string): InProcessReviewerProvider | undefined;
 }
 
 export const INPROCESS_REVIEWER_FAILURE = {
@@ -180,6 +198,33 @@ export async function runInProcessReviewer(request: InProcessReviewerRequest, de
 		);
 	}
 
+	// pi's composed provider is the only layer that honors extension-registered
+	// providers (core/provider-composer.ts: `extension.streamSimple` when
+	// `model.api === extension.api`). pi-ai's `completeSimple` resolves against
+	// its own builtin-only registry and throws for any extension api, so a seam
+	// that carries `getProvider` is always preferred; a seam without it at all
+	// (a test double with no composition layer) still uses `deps.complete`.
+	// A registry that has `getProvider` yet owns no provider for a model its
+	// own `find` just resolved is incoherent: refuse, never route past it.
+	//
+	// The lookup deliberately uses `parsed.provider` — the key `find` was
+	// called with — and not `model.provider`, which is a field of the object
+	// `find` returned. In pi's registry both reads hit one provider map
+	// (core/model-runtime.ts `getProvider`/`getModel` -> pi-ai models.ts, where
+	// `getModels(provider)` returns [] for an unknown id), so a resolved model
+	// always has a provider under its own key and this branch is unreachable by
+	// construction. Keying on the returned field instead would make that
+	// guarantee depend on every provider's `getModels()` echoing its own id,
+	// which a native or OAuth-modified extension provider is free not to do.
+	const provider = deps.registry.getProvider?.(parsed.provider);
+	if (deps.registry.getProvider !== undefined && provider === undefined) {
+		return refuse(
+			INPROCESS_REVIEWER_FAILURE.MODEL_NOT_FOUND,
+			`The model registry resolved ${JSON.stringify(request.selection)} for ${request.routingKey} but owns no provider for ${JSON.stringify(parsed.provider)}; reassign ${request.routingKey} to a model whose provider the interactive pi can actually dispatch.`,
+			{ provider: parsed.provider, api: model.api },
+		);
+	}
+
 	const auth = await deps.registry.getApiKeyAndHeaders(model);
 	// Negation narrowing (`!auth.ok`) does not eliminate the `ok: true` arm of
 	// this discriminated union under this project's `strict: false` tsconfig;
@@ -245,9 +290,12 @@ export async function runInProcessReviewer(request: InProcessReviewerRequest, de
 		return undefined;
 	};
 
+	// `SimpleStreamOptions` is identical on both paths; only the return shape
+	// differs (an event stream versus a promise), hence `.result()` — which is
+	// exactly what pi-ai's own compat layer does with the same stream.
 	let assistant: AssistantMessage;
 	try {
-		assistant = await deps.complete(model, context, options);
+		assistant = provider === undefined ? await deps.complete(model, context, options) : await provider.streamSimple(model, context, options).result();
 	} catch (error) {
 		return abortRefusal() ?? refuse(INPROCESS_REVIEWER_FAILURE.PROVIDER_FAILED, `Reviewer completion failed for ${request.routingKey}: ${sanitizeErrorExcerpt(error)}`);
 	}

package/lib/native-review-cli.ts

@@ -1032,6 +1032,18 @@ export const NATIVE_CLI_CONTRACTS = Object.freeze({
 	// closed START/STATUS fields this row negotiates. riskEvidence and hint
 	// remain dark; neither is proven to reach Pi's negotiated START path.
 	"3.5.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v3.6.0 repeats 3.5.0: the published provider contract bundle is
+	// byte-identical at 1.2.0, both binaries advertise capabilities/v2.6
+	// with only build-identity differences, and no review-integration schema
+	// changed between the v3.5.0 and v3.6.0 tags. riskEvidence and hint
+	// remain dark; neither is proven to reach Pi's negotiated START path.
+	"3.6.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v3.6.1 repeats 3.6.0: published provider-contract archives are byte-identical
+	// (SHA-256 547b68e172cc87aa297309d61624e5fc2c24d407a494b53eeb5a2b053904352c).
+	// The published v3.6.1 binary advertises capabilities/v2.6, and the tag diff
+	// changes no review-integration schema or capability source. riskEvidence and
+	// hint remain dark because neither is proven in Pi's negotiated START path.
+	"3.6.1": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
 });
 
 export interface NativeReviewProcessDiagnostics {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "gentle-pi",
-	"version": "3.5.0",
+	"version": "3.6.0",
 	"description": "Turn Pi into el Gentleman: a senior-architect development harness with SDD/OpenSpec, subagents, strict TDD evidence, review guardrails, and skill discovery.",
 	"license": "MIT",
 	"type": "module",