gentle-pi 3.5.0 → 3.6.0

package/runtime/native-review-cli.mjs

@@ -1033,6 +1033,18 @@ export const NATIVE_CLI_CONTRACTS = Object.freeze({
 	// closed START/STATUS fields this row negotiates. riskEvidence and hint
 	// remain dark; neither is proven to reach Pi's negotiated START path.
 	"3.5.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v3.6.0 repeats 3.5.0: the published provider contract bundle is
+	// byte-identical at 1.2.0, both binaries advertise capabilities/v2.6
+	// with only build-identity differences, and no review-integration schema
+	// changed between the v3.5.0 and v3.6.0 tags. riskEvidence and hint
+	// remain dark; neither is proven to reach Pi's negotiated START path.
+	"3.6.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v3.6.1 repeats 3.6.0: published provider-contract archives are byte-identical
+	// (SHA-256 547b68e172cc87aa297309d61624e5fc2c24d407a494b53eeb5a2b053904352c).
+	// The published v3.6.1 binary advertises capabilities/v2.6, and the tag diff
+	// changes no review-integration schema or capability source. riskEvidence and
+	// hint remain dark because neither is proven in Pi's negotiated START path.
+	"3.6.1": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
 });
 
 

package/scripts/gentle-ai-installer.mjs

@@ -36,7 +36,7 @@ const WINDOWS_SYSTEM_ROOT = "C:\\Windows";
 // version check below) derives from this constant instead of repeating the
 // literal, so a pin bump cannot leave a stale copy behind. See
 // scripts/install-gentle-ai.mjs for the incident that motivated this.
-export const INSTALLER_VERSION = "3.5.0";
+export const INSTALLER_VERSION = "3.6.1";
 export const RELEASE_BASE_URL = `https://github.com/Gentleman-Programming/gentle-ai/releases/download/v${INSTALLER_VERSION}/`;
 export const GENTLE_AI_INSTALL_METHOD = Object.freeze({
 	SIGNED_RELEASE_ASSET: "signed-release-asset",
@@ -45,10 +45,10 @@ export const GENTLE_AI_INSTALL_METHOD = Object.freeze({
 export const GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH = "github.com/gentleman-programming/gentle-ai/v3/cmd/gentle-ai";
 export const GENTLE_AI_WINDOWS_SOURCE_MODULE = "github.com/gentleman-programming/gentle-ai/v3";
 export const GENTLE_AI_WINDOWS_SOURCE_TAG = `v${INSTALLER_VERSION}`;
-// `go mod download -json github.com/gentleman-programming/gentle-ai/v3@v3.5.0`
+// `go mod download -json github.com/gentleman-programming/gentle-ai/v3@v3.6.1`
 // with GOSUMDB=sum.golang.org reports this exact module SumDB checksum, and the
-// tag resolves to commit 0b335e43, the published v3.5.0 release head.
-export const GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:3y+Nb7CtgGB3ne3bSNxkzV6j19etkOnGDXIiuv7tMp8=";
+// tag resolves to commit 623624ed, the published v3.6.1 release head.
+export const GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:De+eaJuMPxsaiq8KQzWUKCC5FTaFiA3BqDg9nyh/k9Y=";
 export const GENTLE_AI_WINDOWS_SOURCE_PACKAGE = `${GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH}@${GENTLE_AI_WINDOWS_SOURCE_TAG}`;
 export const GENTLE_AI_WINDOWS_MINIMUM_GO_VERSION = "1.25.10";
 export const GENTLE_AI_GO_TOOLCHAIN_UNAVAILABLE_CODE = "GENTLE_AI_GO_TOOLCHAIN_UNAVAILABLE";
@@ -67,7 +67,7 @@ export class GentleAiInstallerError extends Error {
 // Sentinel used while a re-pinned gentle-ai release is not yet published. A
 // sentinel digest can never match a real SHA-256, so installation fails closed,
 // and verify-package-files.mjs refuses to pack/publish while any digest below
-// still holds it. The v3.5.0 digests are pinned from the published release:
+// still holds it. The v3.6.1 digests are pinned from the published release:
 // archive sha256 values verified against the minisign-signed checksums.txt and
 // freshly computed hashes; binary sha256 values computed from the extracted
 // executables.
@@ -109,15 +109,15 @@ async function downloadPinnedGentleAiAsset(asset, destination, options) {
 }
 
 // Windows is absent from signed release archives on purpose. gentle-ai stopped
-// distributing unsigned Windows builds in c4b764d0, so v3.5.0 publishes signed
+// distributing unsigned Windows builds in c4b764d0, so v3.6.1 publishes signed
 // Darwin/Linux archives only. Windows x64/arm64 uses the separately verified
 // exact-tag Go SumDB source-build path below; restore archive rows only when
 // upstream ships signed Windows assets.
 export const GENTLE_AI_RELEASE_ASSETS = Object.freeze({
-	"darwin/amd64": asset("gentle-ai_3.5.0_darwin_amd64.tar.gz", "483b8363cc2b717d224ee7a15c834ed518854c31a1d79d84b6ea0551fd7905cf", "06e5ce2936f0b0579fa382b5cd59cf42c23b07404b162d9ff9a036dd107093a4", "gentle-ai"),
-	"darwin/arm64": asset("gentle-ai_3.5.0_darwin_arm64.tar.gz", "d7a5c233ce23e8fc2ce917ed3e6a2e643655e6e8322fddb3c522324d4cf8ae52", "ec7757fe13f6cd5c9dffa6466d75c5cd68992eac44e684d330c838282c5e2e7e", "gentle-ai"),
-	"linux/amd64": asset("gentle-ai_3.5.0_linux_amd64.tar.gz", "3ea016622981f5e4f4a80632fb9c4673149c98f4e5cecc4b979b41bda758ba4a", "7a4202f75c8b90056f0ecd8fceaaef9efe407abc6f98bb42a3ee1e5ad69eb197", "gentle-ai"),
-	"linux/arm64": asset("gentle-ai_3.5.0_linux_arm64.tar.gz", "aca1997b3ae8439c17883cde39c3ba577ae38352ad6be1d1c4b2c6bc428c4505", "4d81f356f6e221bc5730a280bae049df8315232a2470089993200577e36e97cc", "gentle-ai"),
+	"darwin/amd64": asset("gentle-ai_3.6.1_darwin_amd64.tar.gz", "75f9839035eb25e2bc8eb324a365154cd6ecf869cc3db7885cbc9892008ac9bd", "fb9c286d58fddb0234660aa71a4ed0850f7d015f21c5f6c2059fdf70dc3bc0ae", "gentle-ai"),
+	"darwin/arm64": asset("gentle-ai_3.6.1_darwin_arm64.tar.gz", "be46c0884f31f485ca9663ee819156e058e1b1e665165a72105f42bb449560a2", "e13779ba1dfa23c31403650d76cceb0d523e56904530426c6bdedca9d7937550", "gentle-ai"),
+	"linux/amd64": asset("gentle-ai_3.6.1_linux_amd64.tar.gz", "251db626a3b774665066eeedfb9edbb1bfe60e874fbe98af1df65587b19b3c2f", "7208d5e3185293b70779f174a9deac4962f503a8873d4b3529ad7d444e1308a2", "gentle-ai"),
+	"linux/arm64": asset("gentle-ai_3.6.1_linux_arm64.tar.gz", "d6acc74454e6135af9714c497bc4791ed7149ee3c52d16f378cc085817274db5", "e0db95f4a7b9837060ba6de599f2ff15460ceb1b550c65d4225aaccc657ca979", "gentle-ai"),
 });
 
 // A pinned asset is either a signed archive or, for a prerelease pin only,

package/scripts/install-tui-mode-setting.mjs

@@ -17,6 +17,23 @@ const PI_MANAGED_SEGMENT_SEQUENCES = [
 	["git", "github.com", "Gentleman-Programming"],
 ];
 
+// Gentle Shell's default theme (themes/Gentleman-Cute.json, "name":
+// "Gentleman-Cute"): applied by withIsolatedHomeDefaults below whenever a
+// home's settings do not already declare one, never overriding a user's own
+// choice.
+export const DEFAULT_THEME_NAME = "Gentleman-Cute";
+
+// Pure merge: returns `value` with fullscreen tuiMode always applied, and —
+// only when `value` does not already declare a "theme" key — the default
+// theme above added too. No filesystem access, so it is unit-testable
+// without a tempdir; installIsolatedTuiModeSetting below is the only caller,
+// applying this to a freshly bootstrapped home's settings.
+export function withIsolatedHomeDefaults(value) {
+	const next = { ...value, tuiMode: "fullscreen" };
+	if (!("theme" in value)) next.theme = DEFAULT_THEME_NAME;
+	return next;
+}
+
 function containsSequence(segments, sequence) {
 	for (let start = 0; start + sequence.length <= segments.length; start += 1) {
 		if (sequence.every((part, offset) => segments[start + offset] === part)) return true;
@@ -147,7 +164,9 @@ export async function installTuiModeSetting(options = {}) {
 	}
 }
 
-/** Writes tuiMode: "fullscreen" into a directory gentle-shell's own isolated-home
+/** Writes tuiMode: "fullscreen" and — when the home has no theme of its own
+ * yet — the default Gentle Shell theme (withIsolatedHomeDefaults,
+ * DEFAULT_THEME_NAME above) into a directory gentle-shell's own isolated-home
  * bootstrap (T2) just created and owns. Unlike installTuiModeSetting, there is no
  * "physically installed under this home's npm/node_modules" ownership check to
  * satisfy: the caller already knows it created `dir` moments ago as gentle-shell's
@@ -170,7 +189,7 @@ export async function installIsolatedTuiModeSetting(dir) {
 		const fd = openSync(staging, "wx", original.stat ? original.stat.mode & 0o777 : 0o600);
 		try {
 			if (original.stat) fchmodSync(fd, original.stat.mode & 0o777);
-			writeFileSync(fd, `${JSON.stringify({ ...original.value, tuiMode: "fullscreen" }, null, 2)}\n`, "utf8");
+			writeFileSync(fd, `${JSON.stringify(withIsolatedHomeDefaults(original.value), null, 2)}\n`, "utf8");
 			fsyncSync(fd);
 		} finally { closeSync(fd); }
 		assertDirectories([home]);

package/scripts/verify-package-files.mjs

@@ -342,7 +342,7 @@ async function main() {
   });
 
   if (driftedContracts.length > 0) {
-    console.error("gentle-pi packaged review-integration/v1 and review-integration/v2 contract bytes drifted from the pinned v3.5.0 runtime's vendored Gentle AI contract artifacts:");
+    console.error("gentle-pi packaged review-integration/v1 and review-integration/v2 contract bytes drifted from the pinned v3.6.1 runtime's vendored Gentle AI contract artifacts:");
     for (const drift of driftedContracts) console.error(`- ${drift.relativePath}: expected ${drift.expected}, got ${drift.actual}`);
     process.exit(1);
   }
@@ -387,7 +387,7 @@ async function main() {
     process.exit(1);
   }
 
-  console.log(`gentle-pi package resource check passed (${requiredPaths.length} files; ${Object.keys(contractHashes).length} exact byte-pinned contract artifacts for the v3.5.0 runtime).`);
+  console.log(`gentle-pi package resource check passed (${requiredPaths.length} files; ${Object.keys(contractHashes).length} exact byte-pinned contract artifacts for the v3.6.1 runtime).`);
 }
 
 const isMainModule = process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;

package/tests/agents-rpc-publisher.test.ts

@@ -185,6 +185,41 @@ test("projectRpcActivity honors a custom maxThreadItems override", () => {
 	assert.deepEqual((activity.tasks[0]!.thread.items as { text: string }[]).map((item) => item.text), ["n3", "n4"]);
 });
 
+// Regression for the desktop app's Helpers tab showing helpers from every
+// session: `TaskStore` restores finished tasks of every session from disk at
+// startup, so an RPC push scoped to `opts.parentSessionId` must project only
+// the current session's tasks, and its `summary` counts must match.
+test("projectRpcActivity with parentSessionId keeps only that session's tasks and computes the summary from them", () => {
+	const store = new TaskStore();
+	store.add(task("mine-running", "s1", { status: TASK_STATUS.RUNNING }));
+	store.add(task("mine-finished", "s1", { status: TASK_STATUS.COMPLETED, endedAt: 100 }));
+	store.add(task("other-running", "s2", { status: TASK_STATUS.RUNNING }));
+	store.add(task("other-finished", "s2", { status: TASK_STATUS.COMPLETED, endedAt: 200 }));
+
+	const activity = projectRpcActivity(store, { parentSessionId: "s1" });
+
+	assert.deepEqual(
+		activity.tasks.map((entry) => entry.summary.id).sort(),
+		["mine-finished", "mine-running"],
+		"only the requested session's tasks are projected",
+	);
+	assert.deepEqual(activity.summary, store.summary("s1"), "summary counts are scoped to the same session filter, not the whole store");
+	assert.notDeepEqual(activity.summary, store.summary(), "an unfiltered summary would have counted the other session's tasks too");
+});
+
+// Tasks restored on demand (e.g. opening an older task from another session
+// in the overlay) can land in the shared store without ever being live in
+// the current session; the RPC projection must still exclude them by id.
+test("projectRpcActivity with parentSessionId excludes a task from another session even when it is the only one in the store", () => {
+	const store = new TaskStore();
+	store.add(task("not-mine", "other-session"));
+
+	const activity = projectRpcActivity(store, { parentSessionId: "current-session" });
+
+	assert.deepEqual(activity.tasks, []);
+	assert.deepEqual(activity.summary, { running: 0, queued: 0, waiting: 0, finished: 0 });
+});
+
 test("encodeActivityLines returns the activity untouched as a single line when it already fits", () => {
 	const activity: RpcActivity = { schema: ACTIVITY_SCHEMA, summary: { running: 0, queued: 0, waiting: 0, finished: 0 }, tasks: [] };
 
@@ -366,6 +401,37 @@ test("createRpcActivityPublisher stop unsubscribes everything and publishes exac
 	assert.equal(calls.length, 1, "no further frame is published after stop");
 });
 
+// `parentSessionId` is a value captured at construction, not a live getter.
+// Honoring a mid-process session switch (a resumed/new/forked session) is
+// the caller's job: stop the old publisher and construct a new one scoped
+// to the new session id, exactly as `extensions/gentle-agents.ts` does on
+// every `session_start`. This locks in that only the newly scoped publisher
+// ever sees the other session's tasks.
+test("createRpcActivityPublisher recreated with a new parentSessionId after a session switch publishes only the new session's tasks", () => {
+	const store = new TaskStore();
+	store.add(task("session-a-task", "session-a"));
+	const scheduler = fakeScheduler();
+	const calls: string[][] = [];
+	const ui = { setWidget: (_key: string, lines: string[]) => calls.push(lines) };
+
+	const first = createRpcActivityPublisher({ store, ui, schedule: scheduler.schedule, parentSessionId: "session-a" });
+	first.start();
+	scheduler.flushAll();
+	const firstActivity = JSON.parse(calls.at(-1)![0]!) as RpcActivity;
+	assert.deepEqual(firstActivity.tasks.map((entry) => entry.summary.id), ["session-a-task"]);
+
+	first.stop();
+	calls.length = 0;
+	store.add(task("session-b-task", "session-b"));
+
+	const second = createRpcActivityPublisher({ store, ui, schedule: scheduler.schedule, parentSessionId: "session-b" });
+	second.start();
+	scheduler.flushAll();
+
+	const secondActivity = JSON.parse(calls.at(-1)![0]!) as RpcActivity;
+	assert.deepEqual(secondActivity.tasks.map((entry) => entry.summary.id), ["session-b-task"], "the publisher scoped to the new session must never carry the old session's task");
+});
+
 test("createRpcActivityPublisher flush publishes immediately and cancels a pending coalescing timer", () => {
 	const store = new TaskStore();
 	store.add(task("t1", "s1"));

package/tests/gentle-agents.test.ts

@@ -469,6 +469,52 @@ test("gentle-agents notifies once, deduplicated, when the RPC activity publisher
 	assert.equal(notify.mock.calls[0]?.arguments[1], "warning");
 });
 
+// Regression for the desktop app's Helpers tab showing helpers from every
+// session: a resumed session's own finished tasks restore from disk into
+// the shared `TaskStore` (see "resuming a session restores its own
+// finished tasks as history, never another session's" above for the
+// overlay-render side of this), and the RPC activity publisher created on
+// `session_start` must scope its `setWidget` payload to the same session,
+// never surfacing another session's restored task.
+test("gentle-agents' RPC activity payload excludes a restored task from another session", async (t) => {
+	const h = fakePi();
+	const runtime = deps();
+	const scheduler = fakeScheduler();
+	runtime.deps.schedule = scheduler.schedule;
+	runtime.deps.env = { PATH: "/bin", GENTLE_SHELL_INTERACTIVE_HOST: "1" };
+	const historyHome = join(root, "rpc-restore-history-home");
+	const own: TaskRecord = { id: "own-1", agent: "explore-a", mode: "background", prompt: "p", label: "p", cwd, parentSessionId: "resumed-session", status: TASK_STATUS.COMPLETED, createdAt: 1, startedAt: 1, endedAt: 100, model: "m", thinking: undefined, sessionPath: null, error: null, result: "done", lastStep: "responded", lastActivityAt: 100, turns: 1, toolCalls: 0, tokens: 0, cost: 0 };
+	const other: TaskRecord = { ...own, id: "not-mine", agent: "explore-other", parentSessionId: "other-session" };
+	await saveTask(historyDir(historyHome), own, emptyThread());
+	await saveTask(historyDir(historyHome), other, emptyThread());
+	runtime.deps.home = historyHome;
+	gentleAgents(h.pi, {}, runtime.deps);
+	const { ctx } = fakeContext();
+	Object.assign(ctx, { mode: "rpc", hasUI: true });
+	ctx.sessionManager.getSessionId = () => "resumed-session";
+	const setWidget = t.mock.method(ctx.ui, "setWidget");
+
+	await h.fire("session_start", ctx, { reason: "resume" });
+
+	// The disk history read behind restoreSessionHistory is fire-and-forget
+	// real async I/O, unrelated to the fake coalescing scheduler; poll both
+	// until the resumed session's own restored task reaches a flushed frame.
+	let activity: { tasks: Array<{ summary: { id: string } }> } | undefined;
+	for (let attempt = 0; attempt < 40 && !activity; attempt += 1) {
+		await new Promise((resolve) => setTimeout(resolve, 25));
+		scheduler.flushAll();
+		const activityCalls = setWidget.mock.calls.filter((call) => call.arguments[0] === "gentle-agents" && Array.isArray(call.arguments[1]));
+		if (activityCalls.length === 0) continue;
+		const [, lines] = activityCalls.at(-1)!.arguments as unknown as [string, string[]];
+		const parsed = JSON.parse(lines[0]!) as { tasks: Array<{ summary: { id: string } }> };
+		if (parsed.tasks.some((entry) => entry.summary.id === "own-1")) activity = parsed;
+	}
+
+	assert.ok(activity, "the RPC activity payload must eventually include the resumed session's own restored task");
+	assert.ok(!activity!.tasks.some((entry) => entry.summary.id === "not-mine"), "another session's restored task must never appear in the RPC activity payload");
+	await h.fire("session_shutdown", ctx);
+});
+
 test("all nine subagent registrations own their transcript shell", () => {
 	const { pi, tools } = fakePi();
 	gentleAgents(pi, {}, deps().deps);

package/tests/gentle-ai-binary.test.ts

@@ -97,7 +97,7 @@ async function writeWindowsSourceBinary(packageRoot: string): Promise<{ binaryPa
 		method: "go-sumdb-source-build",
 		package: "github.com/gentleman-programming/gentle-ai/v3/cmd/gentle-ai",
 		module: "github.com/gentleman-programming/gentle-ai/v3",
-		tag: "v3.5.0",
+		tag: "v3.6.1",
 		architecture: process.arch === "x64" ? "x64" : "arm64",
 		binarySha256: createHash("sha256").update(binary).digest("hex"),
 		moduleChecksum: GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM,