gentle-pi 3.7.0 → 4.0.0

package/lib/history-capture-policy.ts

@@ -0,0 +1,95 @@
+import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { gentlePiConfigHome } from "./agent-home.ts";
+
+// Prompt history capture is default-off. An explicit GENTLE_PI_HISTORY_CAPTURE
+// value wins, then the Gentle → Customize preference, then off. Any missing,
+// malformed or unreadable preference fails closed. Turning capture off only
+// stops new captures; stored history is never deleted here.
+export const HISTORY_CAPTURE_POLICY = { ON: "on", OFF: "off" } as const;
+export type HistoryCapturePolicy = (typeof HISTORY_CAPTURE_POLICY)[keyof typeof HISTORY_CAPTURE_POLICY];
+export const HISTORY_CAPTURE_SCHEMA = "gentle-pi.history-capture/v1";
+export const HISTORY_CAPTURE_ENV = "GENTLE_PI_HISTORY_CAPTURE";
+interface HistoryCaptureOptions { gentlePiConfigHome?: string }
+export interface HistoryCapturePolicyResolution {
+	policy: HistoryCapturePolicy;
+	source: "global_file" | "default";
+	malformed: boolean;
+	globalFile: string;
+}
+export interface HistoryCaptureResolution {
+	enabled: boolean;
+	source: "env" | "global_file" | "default";
+	/** The persisted Customize preference, reported even while the env overrides it. */
+	preference: HistoryCapturePolicy;
+	envOverride: HistoryCapturePolicy | undefined;
+	malformed: boolean;
+	globalFile: string;
+}
+
+/** Only explicit on/off values override; anything else defers to the preference. */
+export function historyCaptureEnvOverride(env: NodeJS.ProcessEnv = process.env): HistoryCapturePolicy | undefined {
+	const value = env[HISTORY_CAPTURE_ENV]?.trim().toLowerCase();
+	if (value === "1" || value === "true" || value === "on") return "on";
+	if (value === "0" || value === "false" || value === "off") return "off";
+	return undefined;
+}
+
+export function parseHistoryCaptureFile(raw: string): HistoryCapturePolicy | undefined {
+	try {
+		const value: unknown = JSON.parse(raw);
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return undefined;
+		if (Object.keys(value).length !== 2 || !("schema" in value) || value.schema !== HISTORY_CAPTURE_SCHEMA || !("policy" in value)) return undefined;
+		return value.policy === "on" || value.policy === "off" ? value.policy : undefined;
+	} catch { return undefined; }
+}
+
+export function resolveHistoryCapturePolicy(options: HistoryCaptureOptions = {}): HistoryCapturePolicyResolution {
+	const globalFile = join(options.gentlePiConfigHome ?? gentlePiConfigHome(), "history-capture.json");
+	try {
+		const policy = parseHistoryCaptureFile(readFileSync(globalFile, "utf8"));
+		return { policy: policy ?? "off", source: "global_file", malformed: policy === undefined, globalFile };
+	} catch (error) {
+		const missing = typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+		return { policy: "off", source: missing ? "default" : "global_file", malformed: !missing, globalFile };
+	}
+}
+
+/** Full resolution for status surfaces; always reads the preference. */
+export function resolveHistoryCapture(options: { env?: NodeJS.ProcessEnv; gentlePiConfigHome?: string } = {}): HistoryCaptureResolution {
+	const env = options.env ?? process.env;
+	const saved = resolveHistoryCapturePolicy({ gentlePiConfigHome: options.gentlePiConfigHome ?? gentlePiConfigHome(env) });
+	const envOverride = historyCaptureEnvOverride(env);
+	return {
+		enabled: (envOverride ?? saved.policy) === "on",
+		source: envOverride ? "env" : saved.source,
+		preference: saved.policy,
+		envOverride,
+		malformed: saved.malformed,
+		globalFile: saved.globalFile,
+	};
+}
+
+/** Per-prompt gate: an explicit env value never reads the preference file. */
+export function historyCaptureEnabled(options: { env?: NodeJS.ProcessEnv; gentlePiConfigHome?: string } = {}): boolean {
+	const env = options.env ?? process.env;
+	const override = historyCaptureEnvOverride(env);
+	if (override) return override === "on";
+	return resolveHistoryCapturePolicy({ gentlePiConfigHome: options.gentlePiConfigHome ?? gentlePiConfigHome(env) }).policy === "on";
+}
+
+export function writeHistoryCapturePolicy(policy: HistoryCapturePolicy, options: HistoryCaptureOptions = {}): string {
+	if (policy !== "on" && policy !== "off") throw new TypeError("Invalid history capture policy");
+	const home = options.gentlePiConfigHome ?? gentlePiConfigHome();
+	const path = join(home, "history-capture.json");
+	const temporary = `${path}.${randomUUID()}.tmp`;
+	mkdirSync(home, { recursive: true });
+	try {
+		writeFileSync(temporary, `${JSON.stringify({ schema: HISTORY_CAPTURE_SCHEMA, policy })}\n`, { flag: "wx", mode: 0o600 });
+		renameSync(temporary, path);
+	} finally {
+		try { unlinkSync(temporary); } catch { /* Rename consumed the temporary file. */ }
+	}
+	return path;
+}

package/lib/model-routing-authority.ts

@@ -63,7 +63,11 @@ export function normalizeRoutingEntry(value: unknown): AgentRoutingEntry | undef
 	}
 	if (!isRecord(value)) return undefined;
 	const model = normalizeModelId(value.model);
-	const thinking = isThinkingLevel(value.thinking) ? value.thinking : undefined;
+	const thinking = isThinkingLevel(value.thinking)
+		? value.thinking
+		: isThinkingLevel(value.effort)
+			? value.effort
+			: undefined;
 	if (!model && !thinking) {
 		return Object.keys(value).length === 0 ? {} : undefined;
 	}

package/lib/nan-provider.ts

@@ -0,0 +1,227 @@
+import * as piAi from "@earendil-works/pi-ai";
+import type { Provider, ProviderStreams, RefreshModelsContext } from "@earendil-works/pi-ai";
+import type { ProviderModelConfig } from "@earendil-works/pi-coding-agent";
+
+export const NAN_PROVIDER_ID = "nan";
+export const NAN_PROVIDER_BASE_URL = "https://api.nan.builders/v1";
+export const NAN_MODELS_TIMEOUT_MS = 3_000;
+
+export interface NanProviderOptions {
+	fetchImpl?: typeof fetch;
+	timeoutMs?: number;
+}
+
+type NanChatModelConfig = Extract<ProviderModelConfig, { type?: "chat" }>;
+
+// Pi requires numeric rates; NaN access is quota-based, so zero avoids inventing per-token pricing.
+const ZERO_COST = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+
+// Maintained chat subset from https://nan.builders/docs/models.
+// Decimal bounds conservatively interpret the documented 1M/262K/131K labels.
+// Pi models text/image inputs only; documented audio/video inputs are not advertised.
+// Reasoning shares max_tokens with the answer: 65,536 leaves answer room after a
+// 32,768 reasoning budget; DeepSeek uses NaN's 16,384 floor. Qwen 3.8 retains its
+// published 131K output maximum. The remaining 32,768 caps are configured, not NaN-published limits.
+// Pi requires explicit max mappings to offer that level; missing ordinary levels pass through.
+const FIXED_THINKING_LEVEL_MAP: NanChatModelConfig["thinkingLevelMap"] = {
+	off: null, minimal: null, low: null, high: null, xhigh: null, max: null,
+}; // Only medium remains usable: depth is fixed and reasoning cannot be disabled.
+
+const CHAT_MODELS: NanChatModelConfig[] = ([
+	{
+		id: "glm5.3", name: "GLM 5.3", input: ["text", "image"], contextWindow: 1_000_000,
+		thinkingLevelMap: { off: null, minimal: "low", xhigh: "max", max: "max" },
+	},
+	{
+		id: "deepseek-v4-flash", name: "DeepSeek V4 Flash", input: ["text", "image"], contextWindow: 1_000_000,
+		thinkingLevelMap: FIXED_THINKING_LEVEL_MAP, maxTokens: 16_384,
+	},
+	{
+		id: "glm5.3-flash", name: "GLM 5.3 Flash", input: ["text", "image"], contextWindow: 1_000_000,
+		thinkingLevelMap: { off: null, minimal: "low", xhigh: "max", max: "max" },
+	},
+	{
+		id: "qwen3.8-flash", name: "Qwen 3.8 Flash", input: ["text", "image"], contextWindow: 1_048_576,
+		thinkingLevelMap: FIXED_THINKING_LEVEL_MAP, maxTokens: 131_000,
+	},
+	{
+		id: "mimo-v2.6-flash", name: "MiMo V2.6 Flash", input: ["text", "image"], contextWindow: 1_000_000,
+		thinkingLevelMap: FIXED_THINKING_LEVEL_MAP,
+	},
+	{
+		id: "gemma4", name: "Gemma 4", input: ["text", "image"], contextWindow: 262_000,
+		thinkingLevelMap: { off: "none", xhigh: "max", max: "max" }, maxTokens: 65_536,
+	},
+	{
+		id: "qwen3.6", name: "Qwen 3.6", input: ["text", "image"], contextWindow: 262_000,
+		thinkingLevelMap: { off: "none", xhigh: "max", max: "max" }, maxTokens: 65_536,
+	},
+] satisfies Partial<NanChatModelConfig>[]).map((model) => ({
+	...model,
+	api: "openai-completions",
+	reasoning: true,
+	cost: ZERO_COST,
+	maxTokens: model.maxTokens ?? 32_768,
+}));
+
+// The cold/offline baseline declares documented chat support, not key entitlement.
+// A successful live catalog remains authoritative for the credential that fetched it.
+const OFFLINE_MODELS = CHAT_MODELS;
+
+function cloneModel(model: NanChatModelConfig): NanChatModelConfig {
+	return {
+		...model,
+		input: [...model.input],
+		cost: { ...model.cost },
+		thinkingLevelMap: model.thinkingLevelMap ? { ...model.thinkingLevelMap } : undefined,
+	};
+}
+
+function knownChatModels(ids: readonly string[]): NanChatModelConfig[] {
+	return ids.flatMap((id) => {
+		const known = CHAT_MODELS.find((model) => model.id === id);
+		return known ? [cloneModel(known)] : [];
+	});
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Returns undefined on an unusable response; an empty data array is authoritative. */
+async function fetchLiveModelIds(options: {
+	apiKey?: string;
+	signal: AbortSignal;
+	fetchImpl: typeof fetch;
+	timeoutMs: number;
+}): Promise<string[] | undefined> {
+	const { apiKey, signal, fetchImpl, timeoutMs } = options;
+	if (signal.aborted) return undefined;
+
+	const controller = new AbortController();
+	const abort = () => controller.abort(signal.reason);
+	if (signal.aborted) abort();
+	else signal.addEventListener("abort", abort, { once: true });
+	const timeout = setTimeout(() => controller.abort(), timeoutMs);
+
+	try {
+		const headers: Record<string, string> = { Accept: "application/json" };
+		if (apiKey) headers.Authorization = `Bearer ${apiKey}`;
+		const response = await fetchImpl(`${NAN_PROVIDER_BASE_URL}/models`, {
+			method: "GET",
+			headers,
+			signal: controller.signal,
+			redirect: "error",
+			cache: "no-store",
+		});
+		if (!response.ok) return undefined;
+
+		const payload: unknown = await response.json();
+		if (!isRecord(payload) || !Array.isArray(payload.data)) return undefined;
+		if (payload.data.length === 0) return [];
+
+		const ids = new Set<string>();
+		for (const row of payload.data) {
+			if (!isRecord(row) || typeof row.id !== "string") continue;
+			const id = row.id.trim();
+			if (id) ids.add(id);
+		}
+		return ids.size > 0 ? [...ids] : undefined;
+	} catch {
+		// Discovery is best-effort. Never log request or response data: it may contain credentials.
+		return undefined;
+	} finally {
+		clearTimeout(timeout);
+		signal.removeEventListener("abort", abort);
+	}
+}
+
+function cloneCatalog(models: readonly NanChatModelConfig[]): NanChatModelConfig[] {
+	return models.map(cloneModel);
+}
+
+/** Native auth belongs to the provider; Pi persists only a successful login result. */
+export function createNanProviderConfig(options: NanProviderOptions = {}): Provider<"openai-completions"> {
+	const config = createCatalogConfig(options);
+	// Pi's extension loader aliases the bare root to compat, which exposes this
+	// host-owned lazy API factory. Do not import an SDK implementation subpath.
+	const api = piAi.lazyApi(async () => {
+		const runtime = piAi as typeof piAi & { openAICompletionsApi?: () => ProviderStreams };
+		if (!runtime.openAICompletionsApi) throw new Error("NaN requires Pi's OpenAI completions API factory");
+		return runtime.openAICompletionsApi();
+	});
+	return {
+		id: NAN_PROVIDER_ID,
+		name: "NaN",
+		baseUrl: NAN_PROVIDER_BASE_URL,
+		auth: { apiKey: {
+			name: "NaN API key",
+			async login(interaction) {
+				interaction.signal.throwIfAborted();
+				const entered = await interaction.prompt({
+					type: "secret", message: "Enter API key", signal: interaction.signal,
+				});
+				interaction.signal.throwIfAborted();
+				const key = entered.trim();
+				if (!key) throw new Error("NaN requires a non-empty API key");
+				return { type: "api_key", key };
+			},
+			async resolve({ ctx, credential, signal }) {
+				signal.throwIfAborted();
+				const stored = credential?.key?.trim();
+				const key = stored || (await ctx.env("NAN_API_KEY"))?.trim();
+				signal.throwIfAborted();
+				return key ? { auth: { apiKey: key }, source: stored ? "API key" : "NAN_API_KEY" } : undefined;
+			},
+		} },
+		getModels: () => config.getModels().map((model) => ({
+			...cloneModel(model), provider: NAN_PROVIDER_ID,
+			baseUrl: NAN_PROVIDER_BASE_URL, api: "openai-completions" as const,
+		})),
+		refreshModels: (context) => config.refreshModels(context),
+		stream: api.stream,
+		streamSimple: api.streamSimple,
+	};
+}
+
+function createCatalogConfig(options: NanProviderOptions = {}): {
+	getModels(): NanChatModelConfig[];
+	refreshModels(context: RefreshModelsContext): Promise<void>;
+} {
+	let catalog = cloneCatalog(OFFLINE_MODELS);
+	let catalogKey: string | undefined;
+	let credentialRevision = 0;
+	const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+
+	return {
+		// One source of truth lets Pi snapshot the new catalog inside publish.update.
+		getModels: () => cloneCatalog(catalog),
+		refreshModels: async (context: RefreshModelsContext) => {
+			const apiKey = context.credential?.type === "api_key" ? context.credential.key : undefined;
+			if (apiKey !== catalogKey) {
+				// A live catalog is authoritative only for the credential that discovered it.
+				catalogKey = apiKey;
+				credentialRevision++;
+				catalog = cloneCatalog(OFFLINE_MODELS);
+			}
+			const revision = credentialRevision;
+			if (!context.allowNetwork || context.signal.aborted || typeof fetchImpl !== "function") {
+				return;
+			}
+
+			const ids = await fetchLiveModelIds({
+				apiKey,
+				signal: context.signal,
+				fetchImpl,
+				timeoutMs: options.timeoutMs ?? NAN_MODELS_TIMEOUT_MS,
+			});
+			if (revision !== credentialRevision || ids === undefined || context.signal.aborted) {
+				return;
+			}
+
+			await context.publish({ update: () => {
+				if (revision === credentialRevision && !context.signal.aborted) catalog = knownChatModels(ids);
+			} });
+		},
+	};
+}

package/lib/native-review-cli.ts

@@ -67,8 +67,6 @@ export const NATIVE_REVIEW_OPERATION = {
 	CAPTURE_PROVIDER_ROLE: "review/capture-provider-role",
 	CAPTURE_UNACHIEVABLE: "review/capture-unachievable",
 	ACKNOWLEDGE_APPROVED: "review/acknowledge-approved",
-	SDD_STATUS: "sdd-status",
-	SDD_CONTINUE: "sdd-continue",
 } as const;
 export type NativeReviewOperation = (typeof NATIVE_REVIEW_OPERATION)[keyof typeof NATIVE_REVIEW_OPERATION];
 
@@ -121,11 +119,6 @@ export interface NativeReviewCli {
 	// an older binary without the verb, or any other process/decode failure,
 	// rejects the returned promise -- callers fail closed to `high` risk.
 	assess?(request: NativeReviewAssessRequest): Promise<ReviewAssessmentV1>;
-	// Exact native SDD readiness authority for an explicitly selected phase.
-	// This is intentionally separate from review/RDD gates and carries no
-	// delivery or review-transaction authority.
-	sddStatus?(request: NativeSddStatusRequest): Promise<NativeSddStatusV2>;
-	sddContinue?(request: NativeSddStatusRequest): Promise<NativeSddStatusV2>;
 }
 
 export const NATIVE_REVIEW_MODE_OPERATION = {
@@ -162,35 +155,6 @@ export const NATIVE_REVIEW_MODE_SCOPE = {
 } as const;
 export type NativeReviewModeScope = (typeof NATIVE_REVIEW_MODE_SCOPE)[keyof typeof NATIVE_REVIEW_MODE_SCOPE];
 
-export interface NativeSddStatusRequest {
-	changeName?: string;
-	workspaceRoot: string;
-	signal?: AbortSignal;
-}
-
-export type NativeSddPhase = "apply" | "verify" | "archive";
-export type NativeSddDependencyState = "blocked" | "ready" | "all_done";
-
-/**
- * The native CLI owns this complete v2 record. The decoder validates the fields
- * Pi relies on and returns the original object without adding, omitting, or
- * reconciling local SDD state.
- */
-export interface NativeSddStatusV2 extends Readonly<Record<string, unknown>> {
-	schemaName: "gentle-ai.sdd-status";
-	schemaVersion: 2;
-	changeName: string | null;
-	artifactStore: "openspec" | "engram" | "hybrid" | "none";
-	planningHome: Readonly<Record<string, unknown>> & { mode: "repo-local"; path: string };
-	changeRoot: string | null;
-	actionContext: Readonly<Record<string, unknown>> & { mode: "repo-local"; workspaceRoot: string; allowedEditRoots: readonly string[] };
-	dependencies: Readonly<Record<(typeof NATIVE_SDD_DEPENDENCIES)[number], NativeSddDependencyState>>;
-	phaseInstructions?: Readonly<Record<(typeof NATIVE_SDD_INSTRUCTION_PHASES)[number], readonly string[]> & { remediate?: readonly string[] }>;
-	blockedReasons: readonly string[];
-	nextRecommended: string;
-	remediationState?: { required: boolean; complete: boolean; failedEvidenceRevision: string };
-}
-
 export interface NativeReviewModeRequest {
 	cwd: string;
 	operation: NativeReviewModeOperation;
@@ -747,6 +711,21 @@ function nativeUntrackedSelectionArguments(selection: NativeUntrackedSelection):
 	];
 }
 
+// Fail closed on malformed or duplicate provider selectors before invoking STATUS.
+function providerFlagValue(tokens: readonly string[], flag: string): string | undefined {
+	let found: string | undefined;
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens[index]!;
+		if (token !== `--${flag}` && !token.startsWith(`--${flag}=`)) continue;
+		if (found !== undefined) throw new TypeError(`Native intended-untracked selection repeats --${flag}`);
+		const value = token === `--${flag}` ? tokens[index + 1] : token.slice(`--${flag}=`.length);
+		if (value === undefined || value === "" || value.startsWith("--")) throw new TypeError(`Native intended-untracked selection has an invalid --${flag} value`);
+		found = value;
+		if (token === `--${flag}`) index++;
+	}
+	return found;
+}
+
 const NATIVE_RISK_LEVEL = ["low", "medium", "high"] as const;
 
 // gentle-ai's negotiated `start/v2` envelope is a closed schema
@@ -1048,6 +1027,13 @@ export const NATIVE_CLI_CONTRACTS = Object.freeze({
 	// 547b68e172cc87aa297309d61624e5fc2c24d407a494b53eeb5a2b053904352c
 	// at contract 1.2.0. No new negotiated capability is asserted.
 	"3.7.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v4.0.0 repeats 3.7.0: the published provider-contract tar remains SHA-256
+	// 547b68e172cc87aa297309d61624e5fc2c24d407a494b53eeb5a2b053904352c
+	// at contract 1.2.0, and the published binary still advertises
+	// capabilities/v2.6 under review-integration/v2. The Go module path moved
+	// to /v4 without a review-integration/v2 change. No new negotiated
+	// capability is asserted.
+	"4.0.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
 });
 
 export interface NativeReviewProcessDiagnostics {
@@ -1515,52 +1501,6 @@ interface NativeJsonExecution {
 	process: ExecFileResult;
 }
 
-const NATIVE_SDD_DEPENDENCIES = ["proposal", "specs", "design", "tasks", "apply", "verify", "archive"] as const;
-const NATIVE_SDD_INSTRUCTION_PHASES = ["apply", "verify", "archive"] as const;
-const NATIVE_SDD_NEXT_RECOMMENDATIONS = ["apply", "verify", "remediate", "archive", "archived", "resolve-blockers", "sdd-new", "select-change", "propose", "spec", "design", "tasks"] as const;
-const NATIVE_SDD_DEPENDENCY_STATES = ["blocked", "ready", "all_done"] as const;
-
-/** Strictly validates the native v2 contract while preserving its whole record. */
-export function decodeNativeSddStatusV2(value: unknown, request: Pick<NativeSddStatusRequest, "changeName" | "workspaceRoot">): NativeSddStatusV2 {
-	const status = object(value);
-	if (status.schemaName !== "gentle-ai.sdd-status" || status.schemaVersion !== 2) throw new Error("wrong native SDD status schema");
-	if ((request.changeName !== undefined && status.changeName !== request.changeName) || (status.changeName !== null && !isCanonicalProcessString(status.changeName))) throw new Error("native SDD status change identity mismatch");
-	const artifactStore = enumString(status.artifactStore, ["openspec", "engram", "hybrid", "none"]);
-	const planningHome = object(status.planningHome);
-	if (planningHome.mode !== "repo-local" || !isCanonicalProcessString(planningHome.path)) throw new Error("invalid native SDD planning home");
-	const expectedOpenSpecHome = join(request.workspaceRoot, "openspec");
-	if (planningHome.path !== expectedOpenSpecHome && !((artifactStore === "engram" || artifactStore === "hybrid") && planningHome.path === "engram:sdd")) throw new Error("native SDD planning home escaped its workspace");
-	if (status.changeRoot !== null && !isCanonicalProcessString(status.changeRoot)) throw new Error("invalid native SDD change root");
-	const actionContext = object(status.actionContext);
-	if (actionContext.mode !== "repo-local" || actionContext.workspaceRoot !== request.workspaceRoot || !isCanonicalProcessString(actionContext.workspaceRoot)) throw new Error("native SDD status workspace root mismatch");
-	const allowedEditRoots = stringArray(actionContext.allowedEditRoots);
-	if (!allowedEditRoots.includes(request.workspaceRoot) || allowedEditRoots.some((root) => !isAbsolute(root) || root !== join(root))) throw new Error("invalid native SDD allowed edit roots");
-	const dependencies = object(status.dependencies);
-	for (const phase of NATIVE_SDD_DEPENDENCIES) {
-		if (enumString(dependencies[phase], NATIVE_SDD_DEPENDENCY_STATES) !== dependencies[phase]) throw new Error("invalid native SDD dependency");
-	}
-	if (Object.keys(dependencies).length !== NATIVE_SDD_DEPENDENCIES.length) throw new Error("native SDD dependencies have an unsupported shape");
-	if (status.instructions !== undefined) throw new Error("native SDD status uses phaseInstructions, not instructions");
-	if (status.phaseInstructions !== undefined) {
-		const instructions = object(status.phaseInstructions);
-		for (const phase of NATIVE_SDD_INSTRUCTION_PHASES) stringArray(instructions[phase]);
-		// Classical SDD no longer emits a remediation phase. Keep the published
-		// producer's optional legacy instructions intact without inventing them
-		// for a newer producer or accepting unknown phase keys.
-		const hasRemediation = Object.hasOwn(instructions, "remediate");
-		if (hasRemediation) stringArray(instructions.remediate);
-		if (Object.keys(instructions).length !== NATIVE_SDD_INSTRUCTION_PHASES.length + Number(hasRemediation)) throw new Error("native SDD instructions have an unsupported shape");
-		if (status.nextRecommended === "remediate" && !hasRemediation) throw new Error("native SDD remediation instructions are missing");
-	}
-	if (status.nextRecommended === "remediate" || status.remediationState !== undefined) {
-		const remediation = object(status.remediationState);
-		if (typeof remediation.required !== "boolean" || typeof remediation.complete !== "boolean" || typeof remediation.failedEvidenceRevision !== "string" || (remediation.failedEvidenceRevision !== "" && !/^sha256:[0-9a-f]{64}$/.test(remediation.failedEvidenceRevision)) || (status.nextRecommended === "remediate" && (!remediation.required || remediation.complete || !remediation.failedEvidenceRevision))) throw new Error("Invalid native remediation state");
-	}
-	stringArray(status.blockedReasons);
-	enumString(status.nextRecommended, NATIVE_SDD_NEXT_RECOMMENDATIONS);
-	return status as NativeSddStatusV2;
-}
-
 class NativeReviewPlainCli {
 	private readonly adapter: ExecFileAdapter;
 	private readonly executable: string | (() => string);
@@ -2199,30 +2139,6 @@ export class NativeReviewCliV216 implements NativeReviewCli {
 		return this.invoke(operation, cwd, arguments_, mutating, signal, this.executablePath(operation, mutating), toleratedStderr);
 	}
 
-	async sddStatus(request: NativeSddStatusRequest): Promise<NativeSddStatusV2> {
-		return this.sddProjection(request, false);
-	}
-
-	async sddContinue(request: NativeSddStatusRequest): Promise<NativeSddStatusV2> {
-		if (!isCanonicalProcessString(request.changeName)) throw new TypeError("Native SDD continuation requires an exact selected change");
-		return this.sddProjection(request, true);
-	}
-
-	private async sddProjection(request: NativeSddStatusRequest, mutating: boolean): Promise<NativeSddStatusV2> {
-		if ((request.changeName !== undefined && !isCanonicalProcessString(request.changeName)) || !isCanonicalProcessString(request.workspaceRoot) || !isAbsolute(request.workspaceRoot)) {
-			throw new TypeError("Native SDD status requires a canonical change and absolute workspace root");
-		}
-		const operation = mutating ? NATIVE_REVIEW_OPERATION.SDD_CONTINUE : NATIVE_REVIEW_OPERATION.SDD_STATUS;
-		const execution = await this.negotiated(
-			operation,
-			request.workspaceRoot,
-			[operation, ...(request.changeName === undefined ? [] : [request.changeName]), "--cwd", request.workspaceRoot, "--json", "--instructions"],
-			mutating,
-			request.signal,
-		);
-		return decode(operation, mutating, () => decodeNativeSddStatusV2(execution.body, request));
-	}
-
 	async start(request: NativeStartRequest): Promise<NativeStartResult> {
 		if (request.baseRef !== undefined && !isCanonicalProcessString(request.baseRef)) throw new TypeError("Native START baseRef must be a non-empty, trimmed, NUL-free string");
 		if (request.baseRef !== undefined && request.committedOnly !== true) throw new TypeError("Native START baseRef requires explicit committedOnly acknowledgement");
@@ -2345,7 +2261,32 @@ export class NativeReviewCliV216 implements NativeReviewCli {
 		const selection = nativeUntrackedSelection(request);
 		const submitted = request.intendedUntrackedSelection;
 		if (submitted !== undefined && submitted.argumentTokens.reduce((count, token) => count + token.split("{{value}}").length - 1, 0) !== 1) throw new TypeError("Native intended-untracked selection requires exactly one provider-issued {{value}} token");
-		const statusArguments = submitted === undefined ? [
+		const submittedTokens = submitted === undefined ? undefined : submitted.argumentTokens.map((token) => token.replaceAll("{{value}}", submitted.value));
+		// gentle-ai 3.7.1 submission argument_tokens never carry --base-ref /
+		// --committed-only / --lineage, so a forwarded selector must be appended
+		// after them; only bail if the provider already staked out a conflicting
+		// value for the same flag. providerFlagValue also fails closed on a
+		// dangling `--flag` (last token, no value) or an empty `--flag=`.
+		const submittedBaseRefValue = submittedTokens === undefined ? undefined : providerFlagValue(submittedTokens, "base-ref");
+		if (request.baseRef !== undefined && submittedBaseRefValue !== undefined && submittedBaseRefValue !== request.baseRef) throw new TypeError("Native intended-untracked selection already carries a conflicting base-ref");
+		const submittedLineageValue = submittedTokens === undefined ? undefined : providerFlagValue(submittedTokens, "lineage");
+		if (request.lineageId !== undefined && submittedLineageValue !== undefined && submittedLineageValue !== request.lineageId) throw new TypeError("Native intended-untracked selection already carries a conflicting lineage");
+		let submittedHasCommittedOnly = false;
+		for (const token of submittedTokens ?? []) {
+			if (token !== "--committed-only" && !token.startsWith("--committed-only=")) continue;
+			if (token !== "--committed-only" && token !== "--committed-only=true") throw new TypeError("Native intended-untracked selection has an invalid --committed-only value");
+			if (submittedHasCommittedOnly) throw new TypeError("Native intended-untracked selection repeats --committed-only");
+			submittedHasCommittedOnly = true;
+		}
+		// Append only the half of the base-ref/committed-only pair the provider
+		// did not already carry (a present base-ref already equals
+		// request.baseRef; the throw above ruled out the conflicting case).
+		const forwardedBaseRef = request.baseRef === undefined ? [] : [
+			...(submittedBaseRefValue === undefined ? ["--base-ref", request.baseRef] : []),
+			...(submittedHasCommittedOnly ? [] : ["--committed-only"]),
+		];
+		const forwardedLineage = request.lineageId === undefined || submittedLineageValue !== undefined ? [] : ["--lineage", request.lineageId];
+		const statusArguments = submittedTokens === undefined ? [
 			"review", "status", "--contract", REVIEW_INTEGRATION_CONTRACT, "--cwd", request.cwd,
 			"--projection", request.projection ?? "workspace",
 			...nativeUntrackedSelectionArguments(selection),
@@ -2353,7 +2294,7 @@ export class NativeReviewCliV216 implements NativeReviewCli {
 			...(request.lineageId === undefined ? [] : ["--lineage", request.lineageId]),
 			...(request.agent === undefined ? [] : ["--agent", request.agent]),
 			"--next-transition",
-		] : ["review", "status", "--cwd", request.cwd, ...submitted.argumentTokens.map((token) => token.replaceAll("{{value}}", submitted.value))];
+		] : ["review", "status", "--cwd", request.cwd, ...submittedTokens, ...forwardedBaseRef, ...forwardedLineage];
 		const execution = await this.negotiated(NATIVE_REVIEW_OPERATION.STATUS, request.cwd, statusArguments, false, request.signal);
 		assertSupportedNextTransitionOperation(execution.body);
 		return decode(NATIVE_REVIEW_OPERATION.STATUS, false, () => decodeReviewStatusV3(execution.body));