gentle-pi 3.6.0 → 4.0.0

package/tests/nan-provider.test.ts

@@ -0,0 +1,471 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import type { RefreshModelsContext } from "@earendil-works/pi-ai";
+import { clampThinkingLevel, createModels, getSupportedThinkingLevels, InMemoryCredentialStore } from "@earendil-works/pi-ai";
+import type { Provider } from "@earendil-works/pi-ai";
+import nanProviderExtension from "../extensions/nan-provider.ts";
+import { createNanProviderConfig as createNativeProvider, NAN_PROVIDER_BASE_URL, NAN_PROVIDER_ID } from "../lib/nan-provider.ts";
+
+// Keep catalog assertions independent of the native refresh's void return contract.
+function createNanProviderConfig(options: Parameters<typeof createNativeProvider>[0] = {}) {
+	const provider = createNativeProvider(options);
+	return {
+		...provider,
+		models: provider.getModels(),
+		async refreshModels(context: RefreshModelsContext) {
+			await provider.refreshModels!(context);
+			return provider.getModels();
+		},
+	};
+}
+
+const DOCUMENTED_CHAT_IDS = [
+	"glm5.3", "deepseek-v4-flash", "glm5.3-flash", "qwen3.8-flash",
+	"mimo-v2.6-flash", "gemma4", "qwen3.6",
+];
+
+function jsonResponse(body: unknown, status = 200): Response {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "content-type": "application/json" },
+	});
+}
+
+function refreshContext(credential?: RefreshModelsContext["credential"]): RefreshModelsContext {
+	return {
+		credential,
+		stored: undefined,
+		allowNetwork: true,
+		signal: new AbortController().signal,
+		async publish(publication) {
+			publication.update?.();
+			return true;
+		},
+	};
+}
+
+test("native login rejects an explicitly submitted empty key", async () => {
+	const provider = createNativeProvider();
+	await assert.rejects(async () => provider.auth.apiKey!.login!({
+		signal: new AbortController().signal,
+		prompt: async () => "",
+		notify() {},
+	}), /non-empty/);
+});
+
+test("extension registers NaN with Pi's OpenAI-compatible and native API-key configuration", () => {
+	let registeredConfig: Provider | undefined;
+	nanProviderExtension({
+		registerProvider(provider: Provider) { registeredConfig = provider; },
+	} as never);
+	assert.equal(registeredConfig?.id, NAN_PROVIDER_ID);
+	assert.equal(registeredConfig?.name, "NaN");
+	assert.equal(registeredConfig?.baseUrl, NAN_PROVIDER_BASE_URL);
+	assert.equal(registeredConfig?.getModels()[0]?.api, "openai-completions");
+	assert.equal(typeof registeredConfig?.auth.apiKey?.login, "function");
+	assert.equal(typeof registeredConfig?.streamSimple, "function");
+	assert.equal(typeof registeredConfig?.refreshModels, "function");
+});
+
+test("native login awaits input, trims keys, and rejects whitespace or cancellation", async () => {
+	const login = createNativeProvider().auth.apiKey!.login!;
+	const controller = new AbortController();
+	let submit!: (key: string) => void;
+	let prompted = false;
+	let finished = false;
+	const pending = login({ signal: controller.signal, notify() {}, prompt: async (prompt) => {
+		prompted = true;
+		assert.equal(prompt.type, "secret");
+		assert.equal(prompt.signal, controller.signal);
+		return new Promise<string>((resolve) => { submit = resolve; });
+	} }).then((result) => { finished = true; return result; });
+	assert.equal(prompted, true);
+	assert.equal(finished, false);
+	submit("  synthetic-key \t");
+	assert.deepEqual(await pending, { type: "api_key", key: "synthetic-key" });
+	await assert.rejects(login({ signal: controller.signal, notify() {}, prompt: async () => " \t " }), /non-empty/);
+	await assert.rejects(login({ signal: controller.signal, notify() {}, prompt: async () => { throw new Error("cancelled"); } }), /cancelled/);
+	await assert.rejects(login({ signal: controller.signal, notify() {}, prompt: async () => {
+		controller.abort(); return "synthetic-key";
+	} }), { name: "AbortError" });
+	let calls = 0;
+	await assert.rejects(login({ signal: controller.signal, notify() {}, prompt: async () => { calls++; return "key"; } }), { name: "AbortError" });
+	assert.equal(calls, 0);
+});
+
+test("native Models login never persists blank credentials and uses saved auth for requests", async () => {
+	const credentials = new InMemoryCredentialStore();
+	const models = createModels({ credentials, authContext: {
+		env: async () => "env-key", fileExists: async () => false,
+	} });
+	models.setProvider(createNativeProvider());
+	const interaction = { prompt: async () => "", notify() {} };
+	await assert.rejects(models.login("nan", "api_key", interaction), /non-empty/);
+	assert.equal(await credentials.read("nan"), undefined);
+	await models.login("nan", "api_key", { ...interaction, prompt: async () => " saved-key " });
+	assert.deepEqual((await models.getAuth("nan"))?.auth, { apiKey: "saved-key" });
+	await assert.rejects(models.login("nan", "api_key", interaction), /non-empty/);
+	assert.deepEqual(await credentials.read("nan"), { type: "api_key", key: "saved-key" });
+	await models.logout("nan");
+	assert.deepEqual((await models.getAuth("nan"))?.auth, { apiKey: "env-key" });
+});
+
+test("native auth resolves stored keys before environment and rejects empty configuration", async () => {
+	const resolve = createNativeProvider().auth.apiKey!.resolve;
+	let envCalls = 0;
+	const input = {
+		ctx: { async env(name: string) { envCalls++; assert.equal(name, "NAN_API_KEY"); return " env-key "; }, async fileExists() { return false; } },
+		signal: new AbortController().signal,
+	};
+	assert.deepEqual(await resolve({ ...input, credential: { type: "api_key", key: " stored-key " } }), { auth: { apiKey: "stored-key" }, source: "API key" });
+	assert.equal(envCalls, 0);
+	assert.deepEqual(await resolve({ ...input, credential: { type: "api_key", key: " " } }), { auth: { apiKey: "env-key" }, source: "NAN_API_KEY" });
+	assert.equal(await resolve({ ...input, ctx: { ...input.ctx, env: async () => " " } }), undefined);
+});
+
+test("native publication exposes the new catalog synchronously, including an empty catalog", async () => {
+	for (const ids of [["glm5.3"], []]) {
+		const provider = createNativeProvider({
+			fetchImpl: async () => jsonResponse({ data: ids.map((id) => ({ id })) }),
+		});
+		let publications = 0;
+		await provider.refreshModels!({
+			...refreshContext({ type: "api_key", key: "snapshot-key" }),
+			async publish(publication) {
+				publications++;
+				publication.update?.();
+				assert.deepEqual(provider.getModels().map((model) => model.id), ids);
+				return true;
+			},
+		});
+		assert.equal(publications, 1);
+	}
+});
+
+test("stale and aborted publication updates cannot replace the current key's catalog", async () => {
+	for (const mode of ["changed-key", "aborted"] as const) {
+		const provider = createNativeProvider({
+			fetchImpl: async () => jsonResponse({ data: [{ id: "glm5.3" }] }),
+		});
+		const controller = new AbortController();
+		await provider.refreshModels!({
+			...refreshContext({ type: "api_key", key: "old-key" }), signal: controller.signal,
+			async publish(publication) {
+				if (mode === "changed-key") {
+					await provider.refreshModels!({
+						...refreshContext({ type: "api_key", key: "new-key" }), allowNetwork: false,
+						publish: async () => { assert.fail("offline refresh must not publish"); },
+					});
+				} else controller.abort();
+				publication.update?.();
+				assert.deepEqual(provider.getModels().map((model) => model.id), DOCUMENTED_CHAT_IDS);
+				return false;
+			},
+		});
+		assert.deepEqual(provider.getModels().map((model) => model.id), DOCUMENTED_CHAT_IDS);
+	}
+});
+
+test("offline and already-aborted refreshes invalidate keys without publication", async () => {
+	const provider = createNativeProvider({ fetchImpl: async () => jsonResponse({ data: [{ id: "glm5.3" }] }) });
+	await provider.refreshModels!(refreshContext({ type: "api_key", key: "first" }));
+	for (const mode of ["offline", "aborted"] as const) {
+		const controller = new AbortController();
+		if (mode === "aborted") controller.abort();
+		await provider.refreshModels!({
+			...refreshContext({ type: "api_key", key: mode }),
+			allowNetwork: mode !== "offline", signal: controller.signal,
+			publish: async () => { assert.fail("refresh must not publish"); },
+		});
+		assert.deepEqual(provider.getModels().map((model) => model.id), DOCUMENTED_CHAT_IDS);
+	}
+});
+
+test("initial catalog contains all seven documented chat models with configured output caps", () => {
+	const models = createNanProviderConfig().models;
+	assert.deepEqual(models.map((model) => model.id), DOCUMENTED_CHAT_IDS);
+	const model = models.find((model) => model.id === "deepseek-v4-flash");
+	assert.equal(model?.id, "deepseek-v4-flash");
+	assert.equal(model?.api, "openai-completions");
+	assert.equal(model?.reasoning, true);
+	assert.deepEqual(model?.input, ["text", "image"]);
+	assert.equal(model?.contextWindow, 1_000_000);
+	assert.equal(models.length, 7);
+	assert.equal(model?.maxTokens, 16_384);
+	assert.deepEqual(model?.cost, { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 });
+});
+
+test("adjustable models map Pi thinking levels to accepted NaN efforts", () => {
+	const models = createNativeProvider().getModels();
+	for (const id of ["glm5.3", "glm5.3-flash"]) {
+		const model = models.find((model) => model.id === id);
+		assert.ok(model);
+		assert.deepEqual(model.thinkingLevelMap, { off: null, minimal: "low", xhigh: "max", max: "max" });
+		assert.deepEqual(getSupportedThinkingLevels(model), ["minimal", "low", "medium", "high", "xhigh", "max"]);
+		assert.equal(clampThinkingLevel(model, "off"), "minimal");
+	}
+	for (const id of ["qwen3.6", "gemma4"]) {
+		const model = models.find((model) => model.id === id);
+		assert.ok(model);
+		assert.deepEqual(model.thinkingLevelMap, { off: "none", xhigh: "max", max: "max" });
+		assert.deepEqual(getSupportedThinkingLevels(model), ["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
+		assert.equal(clampThinkingLevel(model, "off"), "off");
+	}
+});
+
+test("fixed-depth models expose only medium and clamp unsupported thinking levels", () => {
+	const models = createNativeProvider().getModels();
+	for (const id of ["deepseek-v4-flash", "qwen3.8-flash", "mimo-v2.6-flash"]) {
+		const model = models.find((model) => model.id === id);
+		assert.ok(model);
+		assert.deepEqual(model.thinkingLevelMap, {
+			off: null, minimal: null, low: null, high: null, xhigh: null, max: null,
+		});
+		assert.deepEqual(getSupportedThinkingLevels(model), ["medium"]);
+		for (const level of ["off", "minimal", "low", "medium", "high", "xhigh", "max"] as const) {
+			assert.equal(clampThinkingLevel(model, level), "medium");
+		}
+	}
+});
+
+test("thinking maps are isolated across snapshots, providers, and live catalog refreshes", async () => {
+	const provider = createNativeProvider({
+		fetchImpl: async () => jsonResponse({ data: DOCUMENTED_CHAT_IDS.map((id) => ({ id })) }),
+	});
+	const baseline = provider.getModels();
+	for (const model of provider.getModels()) {
+		assert.ok(model.thinkingLevelMap);
+		model.thinkingLevelMap.off = "mutated";
+		model.thinkingLevelMap.medium = null;
+	}
+	assert.deepEqual(provider.getModels(), baseline);
+	assert.deepEqual(createNativeProvider().getModels(), baseline);
+	await provider.refreshModels!(refreshContext({ type: "api_key", key: "map-key" }));
+	assert.deepEqual(provider.getModels(), baseline);
+	for (const model of provider.getModels()) {
+		assert.ok(model.thinkingLevelMap);
+		model.thinkingLevelMap.xhigh = "mutated";
+	}
+	assert.deepEqual(provider.getModels(), baseline);
+	await provider.refreshModels!(refreshContext({ type: "api_key", key: "map-key" }));
+	assert.deepEqual(provider.getModels(), baseline);
+});
+
+test("catalog snapshots cannot mutate the offline baseline or another provider", async () => {
+	const provider = createNativeProvider();
+	const snapshot = [...provider.getModels()];
+	snapshot[0].id = "mutated";
+	snapshot[0].input.push("image");
+	snapshot[0].cost.input = 99;
+	snapshot.pop();
+	const fresh = provider.getModels();
+	assert.deepEqual(fresh.map((model) => model.id), DOCUMENTED_CHAT_IDS);
+	assert.deepEqual(fresh[0].input, ["text", "image"]);
+	assert.equal(fresh[0].cost.input, 0);
+	assert.deepEqual(createNativeProvider().getModels(), fresh);
+	await provider.refreshModels!({
+		...refreshContext({ type: "api_key", key: "changed-key" }), allowNetwork: false,
+	});
+	assert.deepEqual(provider.getModels(), fresh);
+});
+
+test("live discovery uses the key-scoped endpoint and replaces the fallback with listed models", async () => {
+	let request: { url: string; init?: RequestInit } | undefined;
+	const config = createNanProviderConfig({
+		fetchImpl: async (input, init) => {
+			request = { url: String(input), init };
+			return jsonResponse({ data: [{ id: " glm5.3 " }, { id: "glm5.3" }, { id: "unknown-chat" }, { id: "embedding" }, { id: "image" }, { id: "speech" }, { id: "rerank" }] });
+		},
+	});
+	const fallbackId = "deepseek-v4-flash";
+	assert.ok(fallbackId);
+
+	const models = await config.refreshModels?.(refreshContext({ type: "api_key", key: "test-secret" }));
+
+	assert.equal(request?.url, `${NAN_PROVIDER_BASE_URL}/models`);
+	assert.equal(request?.init?.method, "GET");
+	assert.equal(new Headers(request?.init?.headers).get("authorization"), "Bearer test-secret");
+	assert.equal(request?.init?.redirect, "error");
+	assert.deepEqual(models?.map((model) => model.id), ["glm5.3"]);
+	assert.ok(!models?.some((model) => model.id === fallbackId));
+
+	const known = models?.[0];
+	assert.equal(known?.api, "openai-completions");
+	assert.equal(known?.reasoning, true);
+	assert.deepEqual(known?.input, ["text", "image"]);
+	assert.equal(known?.contextWindow, 1_000_000);
+	assert.equal(known?.maxTokens, 32_768);
+	assert.deepEqual(known?.cost, { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 });
+});
+
+test("known chat models retain documented capabilities without advertising audio", async () => {
+	const expected = [
+		["glm5.3", 1_000_000, ["text", "image"], 32_768],
+		["deepseek-v4-flash", 1_000_000, ["text", "image"], 16_384],
+		["glm5.3-flash", 1_000_000, ["text", "image"], 32_768],
+		["qwen3.8-flash", 1_048_576, ["text", "image"], 131_000],
+		["mimo-v2.6-flash", 1_000_000, ["text", "image"], 32_768],
+		["gemma4", 262_000, ["text", "image"], 65_536],
+		["qwen3.6", 262_000, ["text", "image"], 65_536],
+	] as const;
+	const config = createNanProviderConfig({
+		fetchImpl: async () => jsonResponse({ data: expected.map(([id]) => ({ id })) }),
+	});
+	const models = await config.refreshModels?.(refreshContext({ type: "api_key", key: "test-key" }));
+	assert.equal(models?.length, expected.length);
+	for (const [index, [id, contextWindow, input, maxTokens]] of expected.entries()) {
+		const model = models?.[index];
+		assert.equal(model?.id, id);
+		assert.equal(model?.reasoning, true);
+		assert.equal(model?.contextWindow, contextWindow);
+		assert.deepEqual(model?.input, input);
+		assert.equal(model?.maxTokens, maxTokens);
+	}
+});
+
+test("a successful list containing only unknown or non-chat IDs stays empty", async () => {
+	const config = createNanProviderConfig({
+		fetchImpl: async () => jsonResponse({ data: ["unknown", "embedding", "image", "speech", "rerank"].map((id) => ({ id })) }),
+	});
+	const context = refreshContext({ type: "api_key", key: "test-key" });
+	assert.deepEqual(await config.refreshModels?.(context), []);
+	assert.deepEqual(await config.refreshModels?.({ ...context, allowNetwork: false }), []);
+});
+
+test("a successful empty key-scoped catalog does not restore offline fallback models", async () => {
+	const config = createNanProviderConfig({ fetchImpl: async () => jsonResponse({ data: [] }) });
+	assert.ok(config.models && config.models.length > 0);
+
+	const models = await config.refreshModels?.(refreshContext({ type: "api_key", key: "test-secret" }));
+
+	assert.deepEqual(models, []);
+	assert.deepEqual(await config.refreshModels({
+		...refreshContext({ type: "api_key", key: "test-secret" }), allowNetwork: false,
+	}), []);
+});
+
+test("failed or malformed discovery preserves the documented baseline or last successful catalog", async () => {
+	const failingFetches: Array<typeof fetch> = [
+		async () => jsonResponse({ error: "unavailable" }, 503),
+		async () => new Response("not-json", { status: 200 }),
+		async () => jsonResponse({ models: [{ id: "not-the-supported-shape" }] }),
+		async () => {
+			throw new Error("network unavailable");
+		},
+	];
+
+	for (const fetchImpl of failingFetches) {
+		const config = createNanProviderConfig({ fetchImpl });
+		const baseline = config.models;
+		const afterFailure = await config.refreshModels?.(refreshContext({ type: "api_key", key: "test-secret" }));
+		assert.deepEqual(afterFailure, baseline);
+	}
+
+	let fail = false;
+	const config = createNanProviderConfig({
+		fetchImpl: async () => fail ? jsonResponse({ error: "unavailable" }, 503) : jsonResponse({ data: [{ id: "glm5.3" }] }),
+	});
+	const live = await config.refreshModels?.(refreshContext({ type: "api_key", key: "test-secret" }));
+	fail = true;
+	assert.deepEqual(await config.refreshModels?.(refreshContext({ type: "api_key", key: "test-secret" })), live);
+	assert.deepEqual(await config.refreshModels({
+		...refreshContext({ type: "api_key", key: "test-secret" }), allowNetwork: false,
+	}), live);
+});
+
+test("offline model refresh does not make a network request", async () => {
+	let calls = 0;
+	const config = createNanProviderConfig({
+		fetchImpl: async () => {
+			calls++;
+			return jsonResponse({ data: [] });
+		},
+	});
+	const context = refreshContext({ type: "api_key", key: "test-secret" });
+	const models = await config.refreshModels?.({ ...context, allowNetwork: false });
+	assert.equal(calls, 0);
+	assert.deepEqual(models, config.models);
+	assert.deepEqual(models.map((model) => model.id), DOCUMENTED_CHAT_IDS);
+	const changed = await config.refreshModels({
+		...refreshContext({ type: "api_key", key: "different-key" }), allowNetwork: false,
+	});
+	assert.deepEqual(changed.map((model) => model.id), DOCUMENTED_CHAT_IDS);
+	assert.equal(calls, 0);
+});
+
+test("credential changes discard previous live models before failed, offline, or cancelled discovery", async () => {
+	for (const mode of ["failure", "offline", "cancelled", "removed"] as const) {
+		let calls = 0;
+		const config = createNanProviderConfig({
+			fetchImpl: async () => ++calls === 1
+				? jsonResponse({ data: [{ id: "glm5.3" }] })
+				: jsonResponse({ error: "denied" }, 401),
+		});
+		await config.refreshModels?.(refreshContext({ type: "api_key", key: "first-key" }));
+		const controller = new AbortController();
+		if (mode === "cancelled") controller.abort();
+		const context = refreshContext(mode === "removed" ? undefined : { type: "api_key", key: "second-key" });
+		const models = await config.refreshModels?.({
+			...context,
+			allowNetwork: mode !== "offline",
+			signal: controller.signal,
+		});
+		assert.deepEqual(models, config.models, mode);
+		assert.equal(calls, mode === "offline" || mode === "cancelled" ? 1 : 2);
+	}
+});
+
+test("same-key failure retains an authoritative empty catalog", async () => {
+	let calls = 0;
+	const config = createNanProviderConfig({
+		fetchImpl: async () => ++calls === 1 ? jsonResponse({ data: [] }) : jsonResponse({}, 503),
+	});
+	const context = refreshContext({ type: "api_key", key: "empty-key" });
+	assert.deepEqual(await config.refreshModels?.(context), []);
+	assert.deepEqual(await config.refreshModels?.(context), []);
+});
+
+test("cancelling discovery aborts fetch and does not restore the previous key's catalog", async () => {
+	let calls = 0;
+	let requestSignal: AbortSignal | undefined;
+	let started!: () => void;
+	const pending = new Promise<void>((resolve) => { started = resolve; });
+	const config = createNanProviderConfig({
+		fetchImpl: async (_input, init) => {
+			if (++calls === 1) return jsonResponse({ data: [{ id: "glm5.3" }] });
+			requestSignal = init?.signal as AbortSignal;
+			return new Promise<Response>((_resolve, reject) => {
+				requestSignal!.addEventListener("abort", () => reject(new Error("cancelled")), { once: true });
+				started();
+			});
+		},
+	});
+	await config.refreshModels?.(refreshContext({ type: "api_key", key: "first-key" }));
+	const controller = new AbortController();
+	const result = config.refreshModels?.({
+		...refreshContext({ type: "api_key", key: "second-key" }), signal: controller.signal,
+	});
+	await pending;
+	controller.abort();
+	assert.deepEqual(await result, config.models);
+	assert.equal(requestSignal?.aborted, true);
+});
+
+test("an old in-flight discovery cannot overwrite a changed credential's catalog", async () => {
+	let resolveOld!: (response: Response) => void;
+	const config = createNanProviderConfig({
+		fetchImpl: async (_input, init) => {
+			if (new Headers(init?.headers).get("authorization") === "Bearer first-key") {
+				return new Promise<Response>((resolve) => { resolveOld = resolve; });
+			}
+			return jsonResponse({ data: [] });
+		},
+	});
+	const old = config.refreshModels?.(refreshContext({ type: "api_key", key: "first-key" }));
+	assert.deepEqual(await config.refreshModels?.(refreshContext({ type: "api_key", key: "second-key" })), []);
+	resolveOld(jsonResponse({ data: [{ id: "glm5.3" }] }));
+	assert.deepEqual(await old, []);
+	assert.deepEqual(await config.refreshModels?.({
+		...refreshContext({ type: "api_key", key: "second-key" }), allowNetwork: false,
+	}), []);
+});

package/tests/native-review-capability-contract.test.ts

@@ -361,11 +361,23 @@ test("3.6.1 explicitly repeats 3.6.0 because the negotiated provider lane is unc
 	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["3.6.0"] as Record<string, boolean>);
 });
 
+test("3.7.0 explicitly repeats 3.6.1 because provider contract 1.2.0 is unchanged", () => {
+	const contract = NATIVE_CLI_CONTRACTS["3.7.0"] as Record<string, boolean>;
+	assert.ok(contract);
+	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["3.6.1"] as Record<string, boolean>);
+});
+
+test("4.0.0 explicitly repeats 3.7.0 because provider contract 1.2.0 and capabilities/v2.6 are unchanged", () => {
+	const contract = NATIVE_CLI_CONTRACTS["4.0.0"] as Record<string, boolean>;
+	assert.ok(contract);
+	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["3.7.0"] as Record<string, boolean>);
+});
+
 test("no shipped version key was added beyond the pin bump", () => {
 	// Rows are promises to consumers, so a new key only ever appears in a
 	// dedicated commit alongside a pin bump, never as a side effect. v2.2.4 and
 	// v2.3.0 shipped upstream while Pi stayed on 2.2.3 and were never pinned,
 	// so they get no row: a row asserts ground truth measured against a binary
 	// Pi actually ran, and the table only has to be ascending, not gapless.
-	assert.deepEqual(Object.keys(NATIVE_CLI_CONTRACTS), [...DARK_VERSIONS, "2.2.0", "2.2.1", "2.2.2", "2.2.3", "2.4.0", "2.5.0-rc.3", "2.5.0", "2.6.0", "2.7.0", "2.8.0", "2.8.1", "2.8.2", "2.9.0", "2.9.1", "3.0.0", "3.0.1", "3.1.0", "3.2.1", "3.4.0", "3.5.0", "3.6.0", "3.6.1"]);
+	assert.deepEqual(Object.keys(NATIVE_CLI_CONTRACTS), [...DARK_VERSIONS, "2.2.0", "2.2.1", "2.2.2", "2.2.3", "2.4.0", "2.5.0-rc.3", "2.5.0", "2.6.0", "2.7.0", "2.8.0", "2.8.1", "2.8.2", "2.9.0", "2.9.1", "3.0.0", "3.0.1", "3.1.0", "3.2.1", "3.4.0", "3.5.0", "3.6.0", "3.6.1", "3.7.0", "4.0.0"]);
 });

package/tests/native-review-cli.test.ts

@@ -7,7 +7,7 @@ import {
 	decodeReviewConsentV3,
 } from "../lib/review-integration-v2.ts";
 import {
-	decodeNativeSddStatusV2,
+	NATIVE_REVIEW_OPERATION,
 	NATIVE_REVIEW_DEFAULT_MAX_BUFFER_BYTES,
 	NATIVE_REVIEW_ERROR_CODE,
 	NativeReviewCliError,
@@ -60,100 +60,6 @@ function client(adapter: ExecFileAdapter): NativeReviewCliV216 {
 	return new NativeReviewCliV216(adapter, "/package/.gentle-ai/gentle-ai", 30_000, 1024 * 1024);
 }
 
-// Structural test data follows the 2026-09-11 native 2.7.1-0.20260911070137-350f31554a4b
-// capture: seven dependencies and four phaseInstructions groups, not a legacy alias.
-function nativeSddStatus(changeName = "complete-native-review-lifecycle", workspaceRoot = "/repo"): Record<string, unknown> {
-	return {
-		schemaName: "gentle-ai.sdd-status",
-		schemaVersion: 2,
-		changeName,
-		artifactStore: "openspec",
-		planningHome: { mode: "repo-local", path: `${workspaceRoot}/openspec` },
-		changeRoot: `${workspaceRoot}/openspec/changes/${changeName}`,
-		actionContext: { mode: "repo-local", workspaceRoot, allowedEditRoots: [workspaceRoot] },
-		dependencies: { proposal: "all_done", specs: "all_done", design: "all_done", tasks: "all_done", apply: "all_done", verify: "all_done", archive: "ready" },
-		phaseInstructions: {
-			apply: ["Apply is complete."],
-			verify: ["Verification is complete."],
-			remediate: ["Bind remediation to failed evidence."],
-			archive: ["Archive the selected change."],
-		},
-		blockedReasons: [],
-		nextRecommended: "archive",
-	};
-}
-
-test("native SDD status executes its exact selected-root argv and returns only a validated v2 authority", async () => {
-	const body = nativeSddStatus();
-	const queue = queuedAdapter([{ stdout: JSON.stringify(body) }]);
-	const status = await (client(queue.adapter) as unknown as {
-		sddStatus(request: { changeName: string; workspaceRoot: string }): Promise<Record<string, unknown>>;
-	}).sddStatus({ changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" });
-
-	assert.deepEqual(status, body);
-	assert.deepEqual(queue.calls, [{
-		file: "/package/.gentle-ai/gentle-ai",
-		arguments: ["sdd-status", "complete-native-review-lifecycle", "--cwd", "/repo", "--json", "--instructions"],
-		cwd: "/repo",
-		timeoutMs: 30_000,
-	}]);
-});
-
-test("native SDD status rejects malformed v2 identities, dependencies, instructions, and blockers", async () => {
-	const invalidInstructions = { apply: ["ok"], verify: ["ok"], remediate: ["ok"], archive: [42] };
-	assert.doesNotThrow(() => decodeNativeSddStatusV2(
-		{ ...nativeSddStatus(), phaseInstructions: { ...invalidInstructions, archive: ["ok"] } },
-		{ changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" },
-	));
-	const malformed = [
-		{ ...nativeSddStatus(), schemaName: "gentle-pi.sdd-status" },
-		{ ...nativeSddStatus(), schemaVersion: 1 },
-		{ ...nativeSddStatus(), changeName: "other-change" },
-		{ ...nativeSddStatus(), artifactStore: "future-store" },
-		{ ...nativeSddStatus(), planningHome: { mode: "future-mode", path: "/repo/openspec" } },
-		{ ...nativeSddStatus(), planningHome: { mode: "repo-local", path: "/outside" } },
-		{ ...nativeSddStatus(), changeRoot: "bad\nroot" },
-		{ ...nativeSddStatus(), actionContext: { mode: "repo-local", workspaceRoot: "/other", allowedEditRoots: ["/other"] } },
-		{ ...nativeSddStatus(), actionContext: { mode: "future-mode", workspaceRoot: "/repo", allowedEditRoots: ["/repo"] } },
-		{ ...nativeSddStatus(), actionContext: { mode: "repo-local", workspaceRoot: "/repo", allowedEditRoots: ["/outside"] } },
-		{ ...nativeSddStatus(), dependencies: { apply: "all_done", verify: "all_done", archive: "future" } },
-		{ ...nativeSddStatus(), phaseInstructions: invalidInstructions },
-		{ ...nativeSddStatus(), blockedReasons: "not-an-array" },
-		{ ...nativeSddStatus(), nextRecommended: "unknown" },
-		{ ...nativeSddStatus(), instructions: {}, phaseInstructions: undefined },
-		{ ...nativeSddStatus(), phaseInstructions: null },
-	];
-	for (const body of malformed) {
-		await assert.rejects(
-			() => (client(queuedAdapter([{ stdout: JSON.stringify(body) }]).adapter) as unknown as {
-				sddStatus(request: { changeName: string; workspaceRoot: string }): Promise<Record<string, unknown>>;
-			}).sddStatus({ changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" }),
-			(error: unknown) => error instanceof NativeReviewCliError && error.code === NATIVE_REVIEW_ERROR_CODE.SCHEMA_INCOMPATIBLE,
-		);
-	}
-});
-
-test("native v2 read-only decoding preserves omitted optional phaseInstructions", () => {
-	const body = nativeSddStatus();
-	delete body.phaseInstructions;
-	assert.equal(decodeNativeSddStatusV2(body, { changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" }), body);
-});
-
-test("native SDD status keeps malformed JSON, timeout, and nonzero execution fail-closed", async () => {
-	for (const [result, code] of [
-		[{ stdout: "not-json" }, NATIVE_REVIEW_ERROR_CODE.MALFORMED_JSON],
-		[{ stdout: "", timedOut: true }, NATIVE_REVIEW_ERROR_CODE.TIMEOUT],
-		[{ stdout: "{}", exitCode: 1 }, NATIVE_REVIEW_ERROR_CODE.NON_ZERO],
-	] as const) {
-		await assert.rejects(
-			() => (client(queuedAdapter([result]).adapter) as unknown as {
-				sddStatus(request: { changeName: string; workspaceRoot: string }): Promise<Record<string, unknown>>;
-			}).sddStatus({ changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" }),
-			(error: unknown) => error instanceof NativeReviewCliError && error.code === code && error.mutationOutcome === "none",
-		);
-	}
-});
-
 test("negotiated STATUS accepts the pinned v5 receipt before routing its transition", async () => {
 	const status = fixture("status-v5.captured.json");
 	const queue = queuedAdapter([{ stdout: JSON.stringify(status) }]);
@@ -786,8 +692,11 @@ test("capture-result receives the controller AbortSignal without an automatic mu
 	assert.equal(receivedTimeout, undefined);
 });
 
-test("native review client exposes native v2 SDD status without adding review lifecycle behavior", () => {
-	assert.equal(typeof (client(queuedAdapter([]).adapter) as unknown as { sddStatus?: unknown }).sddStatus, "function");
+test("native review transport has no SDD operations or methods", () => {
+	assert.equal(Object.values(NATIVE_REVIEW_OPERATION).some((operation) => operation.startsWith("sdd-")), false);
+	const transport = client(queuedAdapter([]).adapter) as unknown as Record<string, unknown>;
+	assert.equal("sddStatus" in transport, false);
+	assert.equal("sddContinue" in transport, false);
 });
 
 test("read-only authority inventory rejects a repository identity mismatch after decoding", async () => {
@@ -1000,26 +909,3 @@ test("acknowledge-approved keeps its fail-closed stderr and typed refusal discip
 		(error: unknown) => error instanceof NativeReviewCliError && error.code === NATIVE_REVIEW_ERROR_CODE.EMPTY_OUTPUT,
 	);
 });
-
-test("native continuation uses a distinct mutating operation and the same v2 decoder", async () => {
-	const queue = queuedAdapter([{ stdout: JSON.stringify(nativeSddStatus()) }, { stdout: "{}" }]);
-	const cli = client(queue.adapter);
-	const request = { changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" };
-	assert.equal((await cli.sddContinue(request)).nextRecommended, nativeSddStatus().nextRecommended);
-	assert.deepEqual(queue.calls[0]!.arguments, ["sdd-continue", request.changeName, "--cwd", "/repo", "--json", "--instructions"]);
-	assert.equal(queue.calls[0]!.timeoutMs, undefined);
-	await assert.rejects(() => cli.sddContinue(request), (error: unknown) => error instanceof NativeReviewCliError && error.mutating === true);
-});
-
-test("native discovery preserves nullable selection and rejects an invented selected identity", () => {
-	const discovery = { ...nativeSddStatus(), changeName: null, changeRoot: null, nextRecommended: "select-change" };
-	assert.equal(decodeNativeSddStatusV2(discovery, { workspaceRoot: "/repo" }).changeName, null);
-	assert.throws(() => decodeNativeSddStatusV2(discovery, { changeName: "alpha", workspaceRoot: "/repo" }), /identity/);
-});
-
-test("all twelve native actions retain their exact tokens without prose routing", () => {
-	for (const nextRecommended of ["apply", "verify", "remediate", "archive", "archived", "resolve-blockers", "sdd-new", "select-change", "propose", "spec", "design", "tasks"]) {
-		const status = { ...nativeSddStatus(), nextRecommended, ...(nextRecommended === "remediate" ? { remediationState: { required: true, complete: false, failedEvidenceRevision: `sha256:${"a".repeat(64)}` } } : {}) };
-		assert.equal(decodeNativeSddStatusV2(status, { workspaceRoot: "/repo" }).nextRecommended, nextRecommended);
-	}
-});