gentle-pi 3.7.0 → 4.0.0

package/tests/delegated-key-learnings-contract.test.ts

@@ -9,10 +9,6 @@ const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const AGENTS = join(ROOT, "assets", "agents");
 const ASSETS = join(ROOT, "assets");
 
-// SDD phase executors installed to ~/.pi/agent/agents/ by installSddAssets.
-// Each carries its own effective prompt; none inherits the parent workflow.
-const SDD_PREFIX = "sdd-";
-
 // Strict-output agents that must remain untouched by Key Learnings: the
 // Judgment Day roles (`jd-*`) and the review lens roles (`review-*`). Derived
 // from the agents actually on disk rather than hardcoded, so retiring one
@@ -52,53 +48,10 @@ function agentFiles(): string[] {
 	return readdirSync(AGENTS).filter((f) => f.endsWith(".md")).sort();
 }
 
-function sddAgents(): string[] {
-	return agentFiles().filter((f) => f.startsWith(SDD_PREFIX));
-}
-
 function strictJsonAgents(): string[] {
 	return agentFiles().filter((f) => STRICT_JSON_PREFIX.test(f));
 }
 
-test("every SDD phase executor carries an effective `## Key Learnings Closing` section with full semantics", () => {
-	const agents = sddAgents();
-	assert.ok(agents.length >= 12, `expected >=12 SDD agents, found ${agents.length}`);
-	const missing: string[] = [];
-	const failed: string[] = [];
-	for (const file of agents) {
-		const source = readFileSync(join(AGENTS, file), "utf8");
-		const section = readSection(source, "Key Learnings Closing");
-		if (section === null) { missing.push(file); continue; }
-		for (const [label, regex] of KL_SEMANTICS) {
-			if (!regex.test(section)) failed.push(`${file}: ${label}`);
-		}
-	}
-	assert.deepEqual(missing, [], "every SDD agent must carry a `## Key Learnings Closing` section");
-	assert.deepEqual(failed, [], "every section must encode all canonical semantics");
-});
-
-test("no SDD phase executor infers Key Learnings through `standard phase envelope` alone", () => {
-	for (const file of sddAgents()) {
-		const source = readFileSync(join(AGENTS, file), "utf8");
-		const section = readSection(source, "Key Learnings Closing");
-		assert.ok(section, `${file} must have a direct Key Learnings Closing section`);
-	}
-});
-
-test("SDD executor coverage is exhaustive against actual agent files", () => {
-	const actual = sddAgents();
-	// Allowlist: the 13 known phase executors. A new sdd-*.md without a
-	// Key Learnings Closing section fails the first test; this test proves
-	// the allowlist matches reality so coverage cannot silently drift.
-	const expected = [
-		"sdd-apply.md", "sdd-archive.md", "sdd-design.md", "sdd-explore.md",
-		"sdd-init.md", "sdd-onboard.md", "sdd-proposal.md", "sdd-remediate.md", "sdd-research.md",
-		"sdd-spec.md", "sdd-status.md", "sdd-tasks.md",
-		"sdd-verify.md",
-	];
-	assert.deepEqual(actual, expected, "SDD agent set must match the known allowlist");
-});
-
 test("generic delegation contract instructs the same `## Key Learnings` closing block", () => {
 	const delegation = readFileSync(join(ASSETS, "orchestrator-delegation.md"), "utf8");
 	const section = readSection(delegation, "Key Learnings closing block");
@@ -111,14 +64,6 @@ test("generic delegation contract instructs the same `## Key Learnings` closing
 	assert.match(section, /layers on after/, "must state the block layers on after the envelope");
 });
 
-test("sdd-orchestrator-workflow documents routing, not executor authority", () => {
-	const workflow = readFileSync(join(ASSETS, "sdd-orchestrator-workflow.md"), "utf8");
-	const section = readSection(workflow, "Key Learnings closing block (routing)");
-	assert.ok(section, "workflow must document Key Learnings routing");
-	assert.match(section, /installed SDD phase executor agent.*carries the effective.*contract/i);
-	assert.match(section, /documents routing only and is not the executor authority/);
-});
-
 test("provider ownership: no Pi TypeScript runtime parses Key Learnings or invokes passive-capture tools", () => {
 	const roots = ["lib", "extensions", "scripts", "runtime"];
 	const forbidden: Array<[string, RegExp]> = [
@@ -214,27 +159,6 @@ test("strict review and Judgment Day agents do not gain Key Learnings or trailin
 });
 
 test("the canonical Key Learnings heading has no trailing colon in any asset", () => {
-	for (const file of sddAgents()) {
-		const source = readFileSync(join(AGENTS, file), "utf8");
-		assert.match(source, /`## Key Learnings`/, `${file} must reference the canonical heading`);
-		assert.doesNotMatch(source, /`## Key Learnings:`/, `${file} must not use a trailing colon`);
-	}
 	const delegation = readFileSync(join(ASSETS, "orchestrator-delegation.md"), "utf8");
 	assert.doesNotMatch(delegation, /`## Key Learnings:`/);
 });
-
-test("modified SDD agents are packaged and installed by the existing installer", () => {
-	const verifier = readFileSync(join(ROOT, "scripts", "verify-package-files.mjs"), "utf8");
-	const expected = [
-		"assets/agents/sdd-apply.md", "assets/agents/sdd-archive.md",
-		"assets/agents/sdd-design.md", "assets/agents/sdd-explore.md",
-		"assets/agents/sdd-init.md", "assets/agents/sdd-onboard.md",
-		"assets/agents/sdd-proposal.md", "assets/agents/sdd-research.md",
-		"assets/agents/sdd-spec.md", "assets/agents/sdd-status.md",
-		"assets/agents/sdd-tasks.md",
-		"assets/agents/sdd-verify.md",
-	];
-	for (const path of expected) {
-		assert.match(verifier, new RegExp(path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")), `${path} must be in the package verifier`);
-	}
-});

package/tests/destructive-command-guard.test.ts

@@ -0,0 +1,84 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { recognizeDestructiveCommands } from "../lib/destructive-command-guard.ts";
+
+const destructive = [
+	`psql -c 'DROP TABLE users'`,
+	`mysql --execute='TRUNCATE TABLE users'`,
+	`sqlite3 app.db 'DELETE FROM users;'`,
+	`psql -c 'DELETE FROM users WHERE 1=1'`,
+	`echo 'DROP DATABASE app' | psql`,
+	`printf '%s' 'TRUNCATE users' | mysql`,
+	`env MODE=test sudo -u postgres /usr/bin/psql -c 'DROP SCHEMA public CASCADE'`,
+	`sh -c "echo ready; psql -c 'DROP TABLE users'"`,
+	`echo ready && rm -fr -- ./data`,
+	`find ./data -type f -delete`,
+	`find ./data -type f -exec rm -rf {} +`,
+	`find ./data -print0 | xargs -0 rm -rf`,
+	`psql <<'SQL'\nDROP TABLE users;\nSQL`,
+	`sqlite3 app.db 'SELECT 1; /* maintenance */ DROP TABLE users'`,
+	`timeout 30 bash -lc 'rm -r ./data'`,
+	`echo ready || (rm -r ./data)`,
+	`rm -r /var/app/data`,
+	`git -C /repo reset --hard HEAD`,
+	`git clean -fd`,
+	`git push --force-with-lease origin main`,
+	`git branch -D old`,
+	`git restore .`,
+	String.raw`sh -c "psql -c \"DROP TABLE users\""`,
+	String.raw`bash -lc "rm -r \"./data\""`,
+	`psql -c 'DELETE FROM "where"'`,
+	`mysql -e 'DELETE FROM \`where\`'`,
+	`sqlite3 app.db 'DELETE FROM [where]'`,
+	`psql -c 'DROP TABLE "where"'`,
+	String.raw`find cache -exec echo {} \; -exec rm -r {} \;`,
+	String.raw`find cache -execdir echo {} \; -execdir rm -r {} \;`,
+	`sudo -n rm -r ./data`,
+	`command -p psql -c 'DROP TABLE users'`,
+	`env -u MODE sudo -u postgres psql -c 'DROP TABLE users'`,
+];
+for (const command of destructive) {
+	test(`recognizes executable destruction: ${command}`, () => {
+		const matches = recognizeDestructiveCommands(command);
+		assert.ok(matches.length > 0);
+		assert.ok(matches.every((match) => match.triggerIndex >= 0 && match.triggerIndex < command.length));
+	});
+}
+for (const command of [
+	`pnpm test && pnpm run build`, `git status`, `git push origin main`,
+	`psql -c 'SELECT * FROM users'`, `sqlite3 app.db 'DELETE FROM users WHERE id=7'`,
+	`psql -c "SELECT 'DROP TABLE users'"`,
+	`echo 'rm -rf ./data; DROP TABLE users'`, `printf '%s' 'TRUNCATE TABLE users'`,
+	`rg 'DROP TABLE' docs`, `rm ./one-file`, `find . -name '*.ts'`,
+	`psql <<'SQL'\nSELECT 'DROP TABLE users';\nSQL`,
+	`git log --oneline`, `env X=1 echo 'rm -r ./data'`,
+	`find . -exec echo 'DROP TABLE users' {} +`,
+	`git push origin main && printf '%s' '-f'`,
+	`echo ';' rm -r cache`,
+	String.raw`echo \; rm -r cache`,
+	`printf '%s ' ';' rm -r ./data`,
+	`echo '|' rm -r cache`,
+	`echo '&&' rm -r cache`,
+	`echo ')' rm -r cache`,
+	`psql -c 'DELETE FROM "where" WHERE id=7'`,
+	String.raw`psql -c "SELECT \"where\", 'DROP TABLE users'"`,
+	String.raw`find cache -exec echo {} \; -exec echo 'rm -r data' {} \;`,
+]) {
+	test(`leaves ordinary commands and prose unchanged: ${command}`, () => {
+		assert.deepEqual(recognizeDestructiveCommands(command), []);
+	});
+}
+
+test("recognizes later compound destruction and shell wrappers without matching quoted prose", () => {
+	const command = `echo 'rm -rf /'; env X=1 sh -c 'rm --recursive ./data'`;
+	const matches = recognizeDestructiveCommands(command);
+	assert.equal(matches.length, 1);
+	assert.equal(matches[0].kind, "filesystem");
+	assert.equal(matches[0].hardDeny, false);
+});
+
+test("root/home recursive removal and destructive git retain hard denial", () => {
+	for (const command of [`rm -fr /`, `rm -r "$HOME"`, `git -C /repo reset --hard`, `git push -f`, `git push ';' -f main`, `rm -r ';' /`]) {
+		assert.equal(recognizeDestructiveCommands(command)[0]?.hardDeny, true, command);
+	}
+});

package/tests/devbinary/native-review-parity.devtest.ts

@@ -1,10 +1,13 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
-import { __testing } from "../../extensions/gentle-ai.ts";
+import { createAssistantMessageEventStream, type AssistantMessage } from "@earendil-works/pi-ai";
+import { createAgentSession, DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager } from "@earendil-works/pi-coding-agent";
+import { __testing, createGentleAiExtension } from "../../extensions/gentle-ai.ts";
+import { resolveSessionWorktree } from "../../lib/session-worktree-registry.ts";
 import { CandidateViewRegistry } from "../../lib/review-candidate-view.ts";
 import {
 	NATIVE_REVIEW_ERROR_CODE,
@@ -138,6 +141,171 @@ function consentAnswerCall(calls: NativeCall[], answer: "granted" | "declined"):
 	return matching[0]!;
 }
 
+// Development-only counterpart of the published-pin SDK proof. A fixture-only
+// provider drives an actual SDK write; no external model, START or download.
+test("dev-binary: SDK non-Git bootstrap entry preserves files and metadata", { skip: !RUNNABLE }, async (t) => {
+	const root = realpathSync(mkdtempSync(join(tmpdir(), "gentle-pi-dev-bootstrap-")));
+	const home = join(root, "home");
+	const agentDir = join(home, "agent");
+	mkdirSync(agentDir, { recursive: true });
+	const previous: Record<string, string | undefined> = {};
+	const environment = {
+		HOME: home, USERPROFILE: home, XDG_CONFIG_HOME: join(home, ".config"),
+		XDG_DATA_HOME: join(home, ".local", "share"), XDG_CACHE_HOME: join(home, ".cache"),
+		GENTLE_PI_AGENT_HOME: agentDir, PI_CODING_AGENT_DIR: agentDir,
+		GENTLE_PI_CONFIG_HOME: join(home, "pi-config"), PI_OFFLINE: "1",
+		// A poisoned ambient declaration must be replaced by the production
+		// adapter rather than accidentally furnishing the fixture's handshake.
+		GENTLE_PI_REVIEW_RELAY_CONTRACT: "invalid-ambient-relay",
+	};
+	// Disposable Git commands must not follow an ambient repository selector.
+	for (const key of Object.keys(process.env).filter((key) => key.startsWith("GIT_"))) {
+		previous[key] = process.env[key];
+		delete process.env[key];
+	}
+	for (const [key, value] of Object.entries(environment)) {
+		previous[key] = process.env[key];
+		process.env[key] = value;
+	}
+	t.after(() => {
+		for (const [key, value] of Object.entries(previous)) {
+			if (value === undefined) delete process.env[key]; else process.env[key] = value;
+		}
+		rmSync(root, { recursive: true, force: true });
+	});
+	const version = execFileSync(DEV_BINARY!, ["version"], { cwd: root, encoding: "utf8" }).trim();
+	t.diagnostic(`development binary=${DEV_BINARY}; version=${version}; published-pin parity is not established`);
+	const fixture = (name: string) => {
+		const cwd = join(root, name);
+		mkdirSync(cwd, { recursive: true });
+		writeFileSync(join(cwd, "candidate.txt"), "unchanged candidate bytes\n");
+		return cwd;
+	};
+	const modeRoot = fixture("mode-root");
+	git(modeRoot, "init", "--quiet");
+	enableGlobalReview(modeRoot);
+	const modelRuntime = await ModelRuntime.create({
+		authPath: join(agentDir, "empty-auth.json"), modelsPath: null,
+		modelsStorePath: join(agentDir, "models-store.json"), allowModelNetwork: false,
+	});
+	const invocations: Array<{ cwd: string; args: string[] }> = [];
+	const entry = async (cwd: string, operation: "startup" | "source" | "inspect" = "source", workspaceRoot?: string, enabled = true, inspectAfterStartup = false) => {
+		const before = invocations.length;
+		const wasVersioned = resolveSessionWorktree(workspaceRoot ?? cwd, cwd) !== undefined;
+		// A new native client per entry prevents a previous transport refusal
+		// cache from substituting for this scenario's actual invocation.
+		const adapter = createNodeExecFileAdapter();
+		const native = new NativeReviewCliV216(async (request) => {
+			invocations.push({ cwd: request.cwd, args: [...request.arguments] });
+			return adapter(request);
+		}, DEV_BINARY!);
+		const resourceLoader = new DefaultResourceLoader({
+			cwd, agentDir, noExtensions: true, noSkills: true, noPromptTemplates: true, noThemes: true, noContextFiles: true,
+			extensionFactories: [pi => pi.registerProvider("fixture-source", {
+				baseUrl: "http://invalid.invalid", apiKey: "fixture-only", api: "fixture-source" as never,
+				models: [{ id: "write", name: "Offline source writer", reasoning: false, input: ["text"], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, contextWindow: 32000, maxTokens: 1024 }],
+				streamSimple(model, context) {
+					const stream = createAssistantMessageEventStream();
+					queueMicrotask(() => {
+						const write = context.messages.at(-1)?.role === "user";
+						const message: AssistantMessage = { role: "assistant", api: model.api, provider: model.provider, model: model.id, timestamp: Date.now(), content: [], stopReason: write ? "toolUse" : "stop", usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } } };
+						stream.push({ type: "start", partial: message });
+						if (write) {
+							const call = { type: "toolCall" as const, id: "fixture-source-write", name: "write", arguments: { path: "app.ts", content: "export const fixture = true;\n" } };
+							message.content.push(call);
+							stream.push({ type: "toolcall_start", contentIndex: 0, partial: message });
+							stream.push({ type: "toolcall_end", contentIndex: 0, toolCall: call, partial: message });
+						} else message.content.push({ type: "text", text: "source written" });
+						stream.push({ type: "done", reason: write ? "toolUse" : "stop", message });
+						stream.end(message);
+					});
+					return stream;
+				},
+			}), createGentleAiExtension({ nativeReviewCli: native, candidateViews: null, processEnv: {} })],
+		});
+		await resourceLoader.reload();
+		assert.deepEqual(resourceLoader.getExtensions().errors, []);
+		const { session } = await createAgentSession({
+			cwd, agentDir, resourceLoader, modelRuntime, sessionManager: SessionManager.inMemory(cwd), tools: ["write", "gentle_review"],
+			settingsManager: SettingsManager.inMemory({ retry: { enabled: false }, compaction: { enabled: false } }),
+		});
+		try {
+			await session.bindExtensions({ mode: "print" });
+			const beforeAction = invocations.slice(before);
+			assert.equal(beforeAction.some(call => call.args[0] === "review" && call.args[1] === "status"), false, "mere binding cannot prepare non-Git");
+			if (operation === "source") {
+				await session.setModel(modelRuntime.getModel("fixture-source", "write")!);
+				session.setActiveToolsByName(["write"]);
+				await session.prompt("Write the authorized fixture source app.ts.");
+				assert.ok(session.messages.some(message => message.role === "toolResult" && message.toolName === "write" && !message.isError), "actual SDK successful write result");
+				assert.equal(readFileSync(join(cwd, "app.ts"), "utf8"), "export const fixture = true;\n");
+			}
+			assert.ok(session.getAllTools().some((tool) => tool.name === "gentle_review"), "actual SDK registers the facade");
+			session.setActiveToolsByName(["gentle_review"]);
+			const tool = session.agent.state.tools.find((tool) => tool.name === "gentle_review");
+			assert.ok(tool, "actual SDK registers the facade");
+			if (operation === "inspect" || inspectAfterStartup) {
+				const result = await tool.execute("bootstrap-inspect", { operation: "inspect", ...(workspaceRoot === undefined ? {} : { workspaceRoot }) });
+				assert.notEqual((result.details as Record<string, unknown>).outcome, "pi-host-relay-transport-unavailable", "entry must negotiate production-compatible transport");
+			}
+			if (operation !== "source") assert.equal(session.messages.length, 0, "passive/review entry does not invoke a model");
+		} finally { await session.extensionRunner.emit({ type: "session_shutdown", reason: "quit" }); session.dispose(); }
+		const calls = invocations.slice(before);
+		if (operation !== "startup" && !wasVersioned) assert.ok(calls.some(({ args }) => args[0] === "review" && args[1] === "mode"), "every admitted scenario really queries native mode");
+		const statuses = calls.filter(({ args }) => args[0] === "review" && args[1] === "status");
+		assert.equal(statuses.length > 0, enabled, "each on scenario must really invoke native STATUS; off must not");
+		if (enabled) assert.equal(statuses[0]!.cwd, resolveSessionWorktree(workspaceRoot ?? cwd, cwd)?.root ?? workspaceRoot ?? cwd);
+		if (inspectAfterStartup) assert.equal(statuses.length, 2, "the same SDK session recognizes native bootstrap for subsequent facade inspect, without restart");
+		t.diagnostic(`${operation} target=${workspaceRoot ?? cwd}; mode calls=${calls.length - statuses.length}; STATUS calls=${statuses.length}`);
+	};
+	const pristine = (cwd: string) => {
+		assert.equal(readFileSync(join(cwd, "candidate.txt"), "utf8"), "unchanged candidate bytes\n");
+		assert.equal(git(cwd, "ls-files", "--others", "--exclude-standard"), existsSync(join(cwd, "app.ts")) ? "app.ts\ncandidate.txt" : "candidate.txt");
+		assert.throws(() => git(cwd, "rev-parse", "--verify", "HEAD"), "HEAD stays unborn");
+		assert.equal(git(cwd, "remote"), "");
+		assert.equal(existsSync(join(cwd, ".git", "gentle-ai", "reviews")), false, "entry creates no review lineage");
+	};
+	const startupRoot = fixture("startup");
+	await entry(startupRoot, "startup", undefined, false);
+	assert.equal(existsSync(join(startupRoot, ".git")), false);
+	await entry(startupRoot, "source", undefined, true, true);
+	assert.equal(existsSync(join(startupRoot, ".git")), true);
+	pristine(startupRoot);
+	const metadata = statSync(join(startupRoot, ".git"));
+	await entry(startupRoot, "inspect");
+	assert.equal(statSync(join(startupRoot, ".git")).ino, metadata.ino, "repeat entry reuses metadata");
+	pristine(startupRoot);
+	for (const explicit of [false, true]) {
+		const target = fixture(explicit ? "explicit-inspect" : "default-inspect");
+		await entry(explicit ? modeRoot : target, "inspect", explicit ? target : undefined);
+		assert.equal(existsSync(join(target, ".git")), true);
+		pristine(target);
+	}
+	const nested = join(startupRoot, "nested");
+	mkdirSync(nested);
+	await entry(nested, "inspect");
+	assert.equal(existsSync(join(nested, ".git")), false, "valid parent is reused");
+	const broken = fixture("broken");
+	writeFileSync(join(broken, ".git"), "gitdir: missing-metadata\n");
+	await entry(broken);
+	assert.equal(readFileSync(join(broken, ".git"), "utf8"), "gitdir: missing-metadata\n");
+	const brokenChild = join(broken, "child");
+	mkdirSync(brokenChild);
+	await entry(brokenChild);
+	assert.equal(existsSync(join(brokenChild, ".git")), false, "broken ancestor is not bypassed");
+	assert.equal(readFileSync(join(broken, ".git"), "utf8"), "gitdir: missing-metadata\n");
+	assert.equal(readFileSync(join(broken, "candidate.txt"), "utf8"), "unchanged candidate bytes\n");
+	const disabled = JSON.parse(execFileSync(DEV_BINARY!, ["review", "mode", "disable", "--scope", "global", "--cwd", modeRoot, "--json"], { cwd: modeRoot, encoding: "utf8" }));
+	assert.equal(disabled.status.effective, "off");
+	for (const operation of ["startup", "source", "inspect"] as const) {
+		const off = fixture(`off-${operation}`);
+		await entry(off, operation, undefined, false);
+		assert.equal(existsSync(join(off, ".git")), false);
+		assert.equal(readFileSync(join(off, "candidate.txt"), "utf8"), "unchanged candidate bytes\n");
+	}
+	assert.equal(invocations.some(({ args }) => args[0] === "review" && args[1] === "start"), false, "no START authority is requested");
+});
+
 // ---------------------------------------------------------------------------
 // Kill switch round trip.
 // ---------------------------------------------------------------------------

package/tests/devbinary/non-git-subagent-bootstrap.devtest.ts

@@ -0,0 +1,193 @@
+import assert from "node:assert/strict";
+import { execFileSync, spawn, type ChildProcess } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { pathToFileURL, fileURLToPath } from "node:url";
+import test from "node:test";
+import { createAgentSession, DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager } from "@earendil-works/pi-coding-agent";
+import gentleAgents from "../../extensions/gentle-agents.ts";
+import gentleShell from "../../extensions/gentle-shell.ts";
+import { createGentleAiExtension } from "../../extensions/gentle-ai.ts";
+import { createNodeExecFileAdapter, NativeReviewCliV216 } from "../../lib/native-review-cli.ts";
+import { SESSION_WORKTREE_ENTRY } from "../../lib/session-worktree-registry.ts";
+import { requireDevBinary } from "../support/native-binary-gate.ts";
+
+const binary = process.env.GENTLE_AI_DEV_BINARY;
+const gate = requireDevBinary({ devBinaryPath: binary, exists: !!binary && binary.startsWith("/") && existsSync(binary), env: process.env });
+if ("reason" in gate) console.log(`non-git-subagent-bootstrap: ${gate.reason}`);
+
+// This is a fixture-only provider, not a replacement RPC child. The installed
+// Pi CLI still loads the provider, accepts RPC, runs its agent loop and settles.
+// No HTTP transport, credentials, or paid model are involved.
+function offlineProvider(aiModule: string): string {
+	return `import { createAssistantMessageEventStream } from ${JSON.stringify(aiModule)};
+export default function (pi) {
+  globalThis.fetch = async () => { throw new Error("Network forbidden in bootstrap fixture"); };
+  pi.registerProvider("bootstrap-fixture", {
+    baseUrl: "http://invalid.invalid", apiKey: "fixture-only", api: "bootstrap-fixture",
+    models: [{ id: "deterministic", name: "Offline bootstrap fixture", reasoning: false,
+      input: ["text"], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+      contextWindow: 32000, maxTokens: 1024 }],
+    streamSimple(model, _context, options) {
+      const stream = createAssistantMessageEventStream();
+      queueMicrotask(() => {
+        const message = { role: "assistant", api: model.api, provider: model.provider,
+          model: model.id, timestamp: Date.now(), content: [], stopReason: "stop",
+          usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0,
+            cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } } };
+        if (options?.signal?.aborted) {
+          message.stopReason = "aborted"; message.errorMessage = "Fixture aborted";
+          stream.push({ type: "error", reason: "aborted", error: message }); stream.end(message); return;
+        }
+        const text = "OFFLINE_BOOTSTRAP_CHILD " + JSON.stringify({ pid: process.pid, cwd: process.cwd() });
+        stream.push({ type: "start", partial: message });
+        message.content.push({ type: "text", text: "" });
+        stream.push({ type: "text_start", contentIndex: 0, partial: message });
+        message.content[0].text = text;
+        stream.push({ type: "text_delta", contentIndex: 0, delta: text, partial: message });
+        stream.push({ type: "text_end", contentIndex: 0, content: text, partial: message });
+        stream.push({ type: "done", reason: "stop", message }); stream.end(message);
+      });
+      return stream;
+    }
+  });
+}
+`;
+}
+
+for (const explicit of [false, true]) {
+test(`dev-binary: pre-bootstrap SDK session first ${explicit ? "explicit worker" : "implicit gentle-ai-worker"} dispatch completes a real Pi child`, { skip: !gate.run, timeout: 90000 }, async (t) => {
+	const root = realpathSync(mkdtempSync(join(tmpdir(), "gentle-pi-subagent-bootstrap-")));
+	const home = join(root, "home");
+	const agentDir = join(home, "agent");
+	const cwd = join(root, "project");
+	mkdirSync(join(agentDir, "agents"), { recursive: true });
+	mkdirSync(cwd);
+	writeFileSync(join(cwd, "candidate.txt"), "unchanged candidate bytes\n");
+	const role = explicit ? "worker" : "gentle-ai-worker";
+	mkdirSync(join(cwd, ".pi", "agents"), { recursive: true });
+	writeFileSync(join(cwd, ".pi", "agents", `${role}.md`), "---\ndescription: Offline bootstrap proof\nmodel: bootstrap-fixture/deterministic\ntools: [read]\n---\nReturn the offline fixture answer.\n");
+	writeFileSync(join(agentDir, "settings.json"), JSON.stringify({ retry: { enabled: false }, compaction: { enabled: false }, packages: [] }));
+	const env: NodeJS.ProcessEnv = {
+		PATH: process.env.PATH, HOME: home, USERPROFILE: home,
+		XDG_CONFIG_HOME: join(home, ".config"), XDG_DATA_HOME: join(home, ".local", "share"), XDG_CACHE_HOME: join(home, ".cache"),
+		GENTLE_PI_AGENT_HOME: agentDir, PI_CODING_AGENT_DIR: agentDir,
+		GENTLE_PI_CONFIG_HOME: join(home, "pi-config"), PI_OFFLINE: "1",
+		GENTLE_PI_SHELL: "1", GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off",
+		GENTLE_PI_RUNTIME_METRICS: "off",
+	};
+	const previous = new Map<string, string | undefined>();
+	for (const key of new Set([...Object.keys(env), ...Object.keys(process.env).filter(key => key.startsWith("GIT_"))])) {
+		previous.set(key, process.env[key]);
+		if (env[key] === undefined) delete process.env[key]; else process.env[key] = env[key];
+	}
+	const children: ChildProcess[] = [];
+	t.after(async () => {
+		for (const child of children) {
+			if (child.exitCode === null && child.signalCode === null) {
+				const exited = new Promise<void>(resolve => child.once("exit", () => resolve()));
+				child.kill("SIGTERM");
+				await exited;
+			}
+		}
+		for (const [key, value] of previous) {
+			if (value === undefined) delete process.env[key]; else process.env[key] = value;
+		}
+		rmSync(root, { recursive: true, force: true });
+	});
+	const sdkPackage = join(dirname(fileURLToPath(import.meta.resolve("@earendil-works/pi-coding-agent"))), "..", "package.json");
+	const installed = JSON.parse(readFileSync(sdkPackage, "utf8"));
+	const cli = realpathSync(join(dirname(sdkPackage), installed.bin.pi));
+	const provider = join(root, "offline-provider.mjs");
+	writeFileSync(provider, offlineProvider(import.meta.resolve("@earendil-works/pi-ai")));
+	t.diagnostic(`installed Pi SDK/CLI=${installed.version}; cli=${cli}; native=${binary}`);
+	const modeRoot = join(root, "mode-root");
+	mkdirSync(modeRoot);
+	execFileSync("git", ["init", "--quiet", modeRoot], { env, stdio: "pipe" });
+	const enabled = JSON.parse(execFileSync(binary!, ["review", "mode", "enable", "--scope", "global", "--cwd", modeRoot, "--json"], { env, encoding: "utf8" }));
+	assert.equal(enabled.status.effective, "on");
+	const nativeCalls: Array<{ cwd: string; args: string[] }> = [];
+	let preparationCompleted = false;
+	const adapter = createNodeExecFileAdapter();
+	const native = new NativeReviewCliV216(async request => {
+		nativeCalls.push({ cwd: request.cwd, args: [...request.arguments] });
+		const result = await adapter(request);
+		if (request.arguments[0] === "review" && request.arguments[1] === "status") preparationCompleted = existsSync(join(cwd, ".git"));
+		return result;
+	}, binary!);
+	const frames: Array<Array<Record<string, unknown>>> = [];
+	const modelRuntime = await ModelRuntime.create({ authPath: join(agentDir, "empty-auth.json"), modelsPath: null, modelsStorePath: join(agentDir, "models-store.json"), allowModelNetwork: false });
+	const manager = SessionManager.inMemory(cwd);
+	const id = manager.getSessionId();
+	const loader = new DefaultResourceLoader({
+		cwd, agentDir, noExtensions: true, noSkills: true, noPromptTemplates: true, noThemes: true, noContextFiles: true,
+		extensionFactories: [
+			(await import(pathToFileURL(provider).href)).default,
+			pi => gentleAgents(pi, env, {
+				home, agentHome: agentDir, env,
+				pi: { command: process.execPath, args: [cli, "--offline", "--no-extensions", "--extension", provider, "--no-skills", "--no-prompt-templates", "--no-themes", "--no-context-files"] },
+				// Observe real OS spawn and production RPC traffic without replacing it.
+				spawn(command, args, options) {
+					assert.equal(preparationCompleted, true, "native preparation completed BEFORE OS spawn");
+					const child = spawn(command, args, { cwd: options.cwd, env: options.env, stdio: options.stdio ?? ["pipe", "pipe", "pipe"], windowsHide: true, detached: options.detached });
+					children.push(child);
+					const records: Array<Record<string, unknown>> = [];
+					frames.push(records);
+					let buffer = "";
+					child.stdout!.on("data", chunk => {
+						buffer += chunk.toString();
+						const lines = buffer.split("\n"); buffer = lines.pop()!;
+						for (const line of lines) { try { records.push(JSON.parse(line)); } catch { /* production parser also ignores non-JSON lines */ } }
+					});
+					return child as never;
+				},
+			}),
+			pi => gentleShell(pi, env),
+			createGentleAiExtension({ nativeReviewCli: native, candidateViews: null, processEnv: {} }),
+		],
+	});
+	await loader.reload();
+	assert.deepEqual(loader.getExtensions().errors, []);
+	assert.equal(existsSync(join(cwd, ".git")), false, "extensions load before bootstrap");
+	const { session } = await createAgentSession({ cwd, agentDir, resourceLoader: loader, modelRuntime, sessionManager: manager, noTools: "builtin", settingsManager: SettingsManager.inMemory({ retry: { enabled: false }, compaction: { enabled: false } }) });
+	try {
+		await session.bindExtensions({ mode: "print" });
+		assert.equal(existsSync(join(cwd, ".git")), false, "registries are bound while the project is still non-Git");
+		assert.equal(nativeCalls.some(call => call.args[0] === "review" && call.args[1] === "status"), false, "binding never prepares");
+		session.setActiveToolsByName(["session_worktree_register", "subagent_run", "subagent_status"]);
+		const tool = (name: string) => {
+			const selected = session.agent.state.tools.find(tool => tool.name === name);
+			assert.ok(selected, `SDK tool registered: ${name}`);
+			return selected;
+		};
+		const registrations = () => manager.getEntries().filter(entry => entry.type === "custom" && entry.customType === SESSION_WORKTREE_ENTRY);
+		assert.equal(registrations().length, 0);
+		{
+			const result = await tool("subagent_run").execute(explicit ? "explicit" : "implicit", { agent: role, task: "Return offline bootstrap evidence\n## Allowed edit surfaces\nsrc/app.ts\n## Return\nReport", mode: "task", ...(explicit ? { workspace_root: cwd } : {}) });
+			const index = 0;
+			const child = children[index]!;
+			assert.ok(child.pid && child.pid !== process.pid, "real installed Pi child PID");
+			const details = (result.details as { gentleAgents: { status: string; cwd: string; taskId: string } }).gentleAgents;
+			assert.equal(details.status, "completed", JSON.stringify(result));
+			assert.equal(details.cwd, cwd);
+			const answer = result.content.find(part => part.type === "text") as { text: string };
+			assert.equal(answer.text, `OFFLINE_BOOTSTRAP_CHILD ${JSON.stringify({ pid: child.pid, cwd })}`);
+			assert.ok(frames[index]!.some(frame => frame.type === "response" && frame.command === "get_state" && frame.success), "production RPC readiness handshake");
+			assert.ok(frames[index]!.some(frame => frame.type === "agent_settled"), "actual CLI task settled");
+			assert.equal(manager.getSessionId(), id);
+			assert.equal(session.sessionManager, manager, "no manager replacement or Pi reload");
+			assert.equal(registrations().length, 1, "spawn registration dedupes durable entry");
+			t.diagnostic(`${explicit ? "explicit" : "implicit"} child pid=${child.pid}; RPC ready; task=${details.taskId} completed; canonical cwd=${details.cwd}; same session=${id}`);
+		}
+		assert.equal(nativeCalls.filter(call => call.cwd === cwd && call.args[0] === "review" && call.args[1] === "status").length, 1);
+		assert.equal(nativeCalls.some(call => call.args[0] === "review" && call.args[1] === "start"), false);
+		assert.equal(readFileSync(join(cwd, "candidate.txt"), "utf8"), "unchanged candidate bytes\n");
+		assert.equal(session.messages.length, 0, "parent never calls a model");
+		assert.equal(manager.getEntries().some(entry => entry.type === "custom" && /session-change|review-reminder/.test(entry.customType)), false, "registration is not Changes evidence");
+	} finally {
+		await session.extensionRunner.emit({ type: "session_shutdown", reason: "quit" });
+		session.dispose();
+	}
+});
+}

package/tests/fixtures/stats/sessions/--work-alpha--/2026-09-28T10-00-00-000Z_aaa.jsonl

@@ -0,0 +1,7 @@
+{"type":"session","version":3,"id":"aaa","timestamp":"2026-09-28T10:00:00.000Z","cwd":"/work/alpha"}
+{"type":"model_change","id":"m1","parentId":null,"timestamp":"2026-09-28T10:00:01.000Z","provider":"claude-bridge","modelId":"claude-opus-5-5"}
+{"type":"message","id":"u1","parentId":"m1","timestamp":"2026-09-28T10:00:30.000Z","message":{"role":"user","content":"hello"}}
+{"type":"message","id":"a1","parentId":"u1","timestamp":"2026-09-28T10:01:00.000Z","message":{"role":"assistant","provider":"claude-bridge","model":"claude-opus-5-5","usage":{"input":100,"output":50,"cacheRead":1000,"cacheWrite":200,"totalTokens":1350,"cost":{"total":0.5}}}}
+{not json at all
+{"type":"message","id":"a2","parentId":"a1","timestamp":"2026-09-28T10:30:00.000Z","message":{"role":"assistant","provider":"openai-codex","model":"gpt-6.1-sol","usage":{"input":200,"output":100,"cacheRead":0,"cacheWrite":0,"totalTokens":300,"cost":{"total":0.25}}}}
+{"type":"custom","customType":"gentle-pi.session-change/v1","id":"c1","parentId":"a2","timestamp":"2026-09-28T10:30:01.000Z","data":{}}

package/tests/fixtures/stats/sessions/--work-alpha--/2026-09-29T23-00-00-000Z_bbb.jsonl

@@ -0,0 +1,3 @@
+{"type":"session","version":3,"id":"bbb","timestamp":"2026-09-29T23:00:00.000Z","cwd":"/work/alpha"}
+{"type":"message","id":"a1","parentId":null,"timestamp":"2026-09-29T23:10:00.000Z","message":{"role":"assistant","provider":"claude-bridge","model":"claude-opus-5-5","usage":{"input":10,"output":20,"cacheRead":0,"cacheWrite":0,"totalTokens":30,"cost":{"total":0.1}}}}
+{"type":"message","id":"a2","parentId":"a1","timestamp":"2026-09-30T01:00:00.000Z","message":{"role":"assistant","provider":"claude-bridge","model":"claude-opus-5-5","usage":{"input":0,"output":70,"cacheRead":0,"cacheWrite":0,"totalTokens":70,"cost":{"total":0.2}}}}

package/tests/fixtures/stats/sessions/--work-alpha--/2026-09-30T08-00-00-000Z_ddd.jsonl

@@ -0,0 +1,2 @@
+{"type":"session","version":3,"id":"ddd","timestamp":"2026-09-30T08:00:00.000Z","cwd":"/work/alpha"}
+{"type":"message","id":"u1","parentId":null,"timestamp":"2026-09-30T08:00:10.000Z","message":{"role":"user","content":"no reply yet"}}

package/tests/fixtures/stats/sessions/--work-alpha--/2026-09-30T09-00-00-000Z_eee.jsonl

@@ -0,0 +1,3 @@
+garbage line
+
+{"type":"message"

package/tests/fixtures/stats/sessions/--work-alpha--/run-1/session.jsonl

@@ -0,0 +1,2 @@
+{"type":"session","version":3,"id":"nested","timestamp":"2026-09-30T09:00:00.000Z","cwd":"/work/alpha"}
+{"type":"message","id":"a1","parentId":null,"timestamp":"2026-09-30T09:01:00.000Z","message":{"role":"assistant","provider":"x","model":"nested-model","usage":{"input":999999,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":999999,"cost":{"total":99}}}}

package/tests/fixtures/stats/sessions/--work-beta--/2026-09-01T12-00-00-000Z_ccc.jsonl

@@ -0,0 +1,2 @@
+{"type":"session","version":3,"id":"ccc","timestamp":"2026-09-01T12:00:00.000Z","cwd":"/work/beta"}
+{"type":"message","id":"a1","parentId":null,"timestamp":"2026-09-01T12:05:00.000Z","message":{"role":"assistant","provider":"openai-codex","model":"gpt-5.5","usage":{"input":500,"output":500,"cacheRead":0,"cacheWrite":0,"cost":{"total":1}}}}

package/tests/fixtures/stats/user-pi/sessions/--work-alpha--/2026-09-28T10-00-00-000Z_aaa.jsonl

@@ -0,0 +1,2 @@
+{"type":"session","version":3,"id":"aaa","timestamp":"2026-09-28T10:00:00.000Z","cwd":"/work/alpha"}
+{"type":"message","id":"a1","parentId":null,"timestamp":"2026-09-28T10:01:00.000Z","message":{"role":"assistant","provider":"claude-bridge","model":"claude-opus-5-5","usage":{"input":100,"output":50,"cacheRead":1000,"cacheWrite":200,"totalTokens":1350,"cost":{"total":0.5}}}}

package/tests/fixtures/stats/user-pi/sessions/--work-alpha--/2026-09-29T23-00-00-000Z_bbb.jsonl

@@ -0,0 +1,4 @@
+{"type":"session","version":3,"id":"bbb","timestamp":"2026-09-29T23:00:00.000Z","cwd":"/work/alpha"}
+{"type":"message","id":"a1","parentId":null,"timestamp":"2026-09-29T23:10:00.000Z","message":{"role":"assistant","provider":"claude-bridge","model":"claude-opus-5-5","usage":{"input":10,"output":20,"cacheRead":0,"cacheWrite":0,"totalTokens":30,"cost":{"total":0.1}}}}
+{"type":"message","id":"a2","parentId":"a1","timestamp":"2026-09-30T01:00:00.000Z","message":{"role":"assistant","provider":"claude-bridge","model":"claude-opus-5-5","usage":{"input":0,"output":70,"cacheRead":0,"cacheWrite":0,"totalTokens":70,"cost":{"total":0.2}}}}
+{"type":"message","id":"a3","parentId":"a2","timestamp":"2026-09-30T02:00:00.000Z","message":{"role":"assistant","provider":"claude-bridge","model":"claude-opus-5-5","usage":{"input":0,"output":100,"cacheRead":0,"cacheWrite":0,"totalTokens":100,"cost":{"total":0.3}}}}

package/tests/fixtures/stats/user-pi/sessions/--work-gamma--/2026-09-20T09-00-00-000Z_fff.jsonl

@@ -0,0 +1,3 @@
+{"type":"session","version":3,"id":"fff","timestamp":"2026-09-20T09:00:00.000Z","cwd":"/work/gamma"}
+{"type":"model_change","id":"m1","parentId":null,"timestamp":"2026-09-20T09:00:01.000Z","provider":"openai-codex","modelId":"gpt-5.3-codex"}
+{"type":"message","id":"a1","parentId":"m1","timestamp":"2026-09-20T09:05:00.000Z","message":{"role":"assistant","provider":"openai-codex","model":"gpt-5.3-codex","usage":{"input":2000,"output":1000,"cacheRead":0,"cacheWrite":0,"totalTokens":3000,"cost":{"total":1.5}}}}