gentle-pi 4.0.0 → 4.2.0

package/tests/session-profile-persistence.test.ts

@@ -0,0 +1,334 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+	SESSION_PROFILE_CUSTOM_TYPE,
+	createSessionProfileBind,
+	createSessionProfileClear,
+	readSessionProfileEntry,
+	replaySessionProfileBranch,
+} from "../lib/session-profile-persistence.ts";
+
+import { normalizeModelConfig } from "../lib/model-routing-authority.ts";
+import {
+	normalizeProfilesFile,
+	PROFILES_KIND,
+	PROFILES_VERSION,
+} from "../lib/agent-profiles.ts";
+
+const custom = (data: unknown, customType = SESSION_PROFILE_CUSTOM_TYPE) => ({
+	type: "custom",
+	customType,
+	data,
+});
+const bind = (modelProfiles: unknown = {}) => ({
+	kind: "bind",
+	origin: "user",
+	name: "work",
+	modelProfiles,
+});
+
+// These are supplied branch entries, not evidence of persistence on disk.
+test("writer emits only the v1 user binding fields and a minimal clear", () => {
+	assert.equal(SESSION_PROFILE_CUSTOM_TYPE, "gentle-pi.session-profile/v1");
+	assert.deepEqual(createSessionProfileBind("work", {}), bind());
+	assert.deepEqual(createSessionProfileClear(), { kind: "clear" });
+});
+
+test("writer accepts real normalized optional fields without persisting undefined", () => {
+	const raw = {
+		worker: "provider/model",
+		reviewer: { effort: "high" },
+		orchestrator: { model: "provider/main" },
+		inheriting: {},
+	};
+	const routes = normalizeModelConfig(raw);
+	const profiles = normalizeProfilesFile({
+		kind: PROFILES_KIND,
+		version: PROFILES_VERSION,
+		profiles: { work: raw },
+	});
+	assert.ok(routes);
+	assert.ok(profiles);
+	assert.equal(Object.hasOwn(routes.reviewer, "model"), true);
+	assert.equal(Object.hasOwn(routes.reviewer, "thinking"), true);
+	const expected = bind({
+		worker: { model: "provider/model" },
+		reviewer: { thinking: "high" },
+		orchestrator: { model: "provider/main" },
+		inheriting: {},
+	});
+	for (const config of [routes, profiles.file.profiles.work]) {
+		const payload = createSessionProfileBind("work", config);
+		assert.deepEqual(payload, expected);
+		assert.deepEqual(readSessionProfileEntry(custom(payload)), {
+			status: "bound",
+			binding: expected,
+		});
+		assert.notEqual(payload.modelProfiles.reviewer, config.reviewer);
+	}
+	assert.equal(Object.hasOwn(routes.reviewer, "model"), true);
+});
+
+test("decoder stays strict about present undefined known fields", () => {
+	for (const route of [
+		{ model: undefined },
+		{ thinking: undefined },
+		{ effort: undefined },
+	]) {
+		assert.deepEqual(readSessionProfileEntry(custom(bind({ worker: route }))), {
+			status: "invalid",
+		});
+	}
+});
+
+test("bound empty snapshot is distinct from absent and cleared", () => {
+	assert.deepEqual(readSessionProfileEntry(custom(bind())), {
+		status: "bound",
+		binding: bind(),
+	});
+	assert.deepEqual(replaySessionProfileBranch([]), { status: "absent" });
+	assert.deepEqual(readSessionProfileEntry(custom({ kind: "clear" })), {
+		status: "cleared",
+	});
+});
+
+test("reader accepts all four origins and ignores unknown payload fields", () => {
+	for (const origin of ["user", "local", "repo", "global"]) {
+		assert.deepEqual(
+			readSessionProfileEntry(
+				custom({ ...bind(), origin, extra: true, version: 99 }),
+			),
+			{
+				status: "bound",
+				binding: { ...bind(), origin },
+			},
+		);
+	}
+	assert.deepEqual(
+		readSessionProfileEntry(custom({ kind: "clear", extra: true })),
+		{ status: "cleared" },
+	);
+});
+
+test("legacy strings and effort normalize while orchestrator remains in the snapshot", () => {
+	const result = readSessionProfileEntry(
+		custom(
+			bind({
+				worker: " provider/model ",
+				reviewer: { effort: "high", ignored: true },
+				orchestrator: { model: "provider/main", thinking: "low", effort: "max" },
+				inheriting: {},
+			}),
+		),
+	);
+	assert.deepEqual(result, {
+		status: "bound",
+		binding: bind({
+			worker: { model: "provider/model" },
+			reviewer: { thinking: "high" },
+			orchestrator: { model: "provider/main", thinking: "low" },
+			inheriting: {},
+		}),
+	});
+});
+
+test("missing required fields and invalid known meanings fail closed", () => {
+	const invalid: unknown[] = [
+		null,
+		[],
+		{},
+		{ kind: "other" },
+		{ kind: "bind", name: "work", modelProfiles: {} },
+		{ ...bind(), origin: "future" },
+		{ ...bind(), name: "../work" },
+		{ ...bind(), name: "constructor" },
+		{ ...bind(), modelProfiles: undefined },
+		{ ...bind(), modelProfiles: [] },
+	];
+	for (const data of invalid) {
+		assert.deepEqual(readSessionProfileEntry(custom(data)), {
+			status: "invalid",
+		});
+	}
+});
+
+test("one invalid route invalidates the whole snapshot instead of silently dropping it", () => {
+	const routes: unknown[] = [
+		null,
+		[],
+		3,
+		"bad model",
+		{ model: "bad model", thinking: "low" },
+		{ model: "provider/good", thinking: "extreme" },
+		{ effort: "extreme" },
+		{ thinking: "low", effort: "extreme" },
+		{ model: null },
+	];
+	for (const route of routes) {
+		assert.deepEqual(readSessionProfileEntry(custom(bind({ worker: route }))), {
+			status: "invalid",
+		});
+		assert.deepEqual(
+			readSessionProfileEntry(
+				custom(bind({ good: "provider/good", worker: route })),
+			),
+			{ status: "invalid" },
+		);
+	}
+	assert.deepEqual(readSessionProfileEntry(custom(bind({ "bad role": {} }))), {
+		status: "invalid",
+	});
+});
+
+test("unknown route fields are ignored, including an unknown-only route", () => {
+	assert.deepEqual(
+		readSessionProfileEntry(custom(bind({ worker: { future: true } }))),
+		{
+			status: "bound",
+			binding: bind({ worker: {} }),
+		},
+	);
+});
+
+test("hostile record keys remain own data without changing prototypes", () => {
+	const routes = JSON.parse(
+		'{"__proto__":{"model":"provider/safe"},"constructor":{},"prototype":{}}',
+	);
+	const result = readSessionProfileEntry(custom(bind(routes)));
+	assert.equal(result.status, "bound");
+	if (result.status !== "bound") return;
+	assert.equal(
+		Object.getPrototypeOf(result.binding.modelProfiles),
+		Object.prototype,
+	);
+	assert.equal(Object.hasOwn(result.binding.modelProfiles, "__proto__"), true);
+	assert.deepEqual(result.binding.modelProfiles["__proto__"], {
+		model: "provider/safe",
+	});
+	for (const key of ["constructor", "prototype"]) {
+		assert.equal(Object.hasOwn(result.binding.modelProfiles, key), true);
+		assert.deepEqual(result.binding.modelProfiles[key], {});
+	}
+});
+
+test("required fields cannot be supplied by prototypes", () => {
+	assert.deepEqual(readSessionProfileEntry(custom(Object.create(bind()))), {
+		status: "invalid",
+	});
+});
+
+test("writer rejects invalid input rather than manufacturing an empty snapshot", () => {
+	assert.throws(() => createSessionProfileBind("../bad", {}));
+	assert.throws(() =>
+		createSessionProfileBind("work", { worker: { model: "bad model" } }),
+	);
+	for (const route of [
+		{ model: null },
+		{ model: "bad model", thinking: undefined },
+		{ model: undefined, thinking: "extreme" },
+		{ effort: undefined },
+	]) {
+		assert.throws(() =>
+			createSessionProfileBind("work", {
+				good: { model: "provider/good" },
+				worker: route,
+			} as Parameters<typeof createSessionProfileBind>[1]),
+		);
+	}
+});
+
+test("writer and reader return defensive snapshots", () => {
+	const source = { worker: { model: "provider/first" } };
+	const payload = createSessionProfileBind("work", source);
+	source.worker.model = "provider/second";
+	assert.equal(payload.modelProfiles.worker.model, "provider/first");
+	const entry = custom(payload);
+	const first = readSessionProfileEntry(entry);
+	assert.equal(first.status, "bound");
+	if (first.status !== "bound") return;
+	first.binding.modelProfiles.worker.model = "provider/third";
+	const second = readSessionProfileEntry(entry);
+	assert.equal(second.status, "bound");
+	if (second.status === "bound")
+		assert.equal(second.binding.modelProfiles.worker.model, "provider/first");
+});
+
+test("noncustom and unrelated custom entries are absent even with matching payloads", () => {
+	for (const entry of [
+		{ type: "message", customType: SESSION_PROFILE_CUSTOM_TYPE, data: bind() },
+		{ type: "message", message: { role: "user", content: "hello" } },
+		custom(bind(), "other/v1"),
+	])
+		assert.deepEqual(readSessionProfileEntry(entry), { status: "absent" });
+});
+
+test("newest family entry is terminal and retains its actual branch index", () => {
+	const old = custom(bind({ worker: "provider/old" }));
+	const message = {
+		type: "message",
+		message: { role: "user", content: "hello" },
+	};
+	for (const [entry, status] of [
+		[custom({ kind: "clear" }), "cleared"],
+		[custom({ kind: "bind" }), "invalid"],
+		[custom(bind(), "gentle-pi.session-profile/v2"), "unsupported"],
+	] as const) {
+		assert.deepEqual(
+			replaySessionProfileBranch([old, message, entry, custom({}, "other/v1")]),
+			{
+				status,
+				entryIndex: 2,
+			},
+		);
+	}
+});
+
+test("family identifier, not payload version, determines support", () => {
+	for (const customType of [
+		"gentle-pi.session-profile/v0",
+		"gentle-pi.session-profile/v99",
+		"gentle-pi.session-profile/future",
+	]) {
+		assert.deepEqual(readSessionProfileEntry(custom(null, customType)), {
+			status: "unsupported",
+		});
+	}
+	assert.deepEqual(
+		readSessionProfileEntry(custom(bind(), "gentle-pi.session-profile-other/v1")),
+		{ status: "absent" },
+	);
+});
+
+test("branch order selects latest bind; clear and bad entries can be explicitly superseded", () => {
+	const latest = custom(bind({ worker: "provider/new" }));
+	for (const earlier of [
+		custom({ kind: "clear" }),
+		custom(null),
+		custom(null, "gentle-pi.session-profile/v2"),
+	]) {
+		assert.deepEqual(replaySessionProfileBranch([earlier, latest]), {
+			status: "bound",
+			entryIndex: 1,
+			binding: bind({ worker: { model: "provider/new" } }),
+		});
+	}
+});
+
+test("replay sees only caller-supplied active branch, not siblings or later paths", () => {
+	const ancestor = custom(bind());
+	const sibling = custom({ kind: "clear" });
+	const future = custom(null, "gentle-pi.session-profile/v2");
+	assert.equal(
+		replaySessionProfileBranch([ancestor, sibling]).status,
+		"cleared",
+	);
+	assert.equal(
+		replaySessionProfileBranch([ancestor, future]).status,
+		"unsupported",
+	);
+	assert.deepEqual(replaySessionProfileBranch([ancestor, { type: "message" }]), {
+		status: "bound",
+		entryIndex: 0,
+		binding: bind(),
+	});
+});

package/tests/session-subject-routing-contract.test.ts

@@ -0,0 +1,34 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import test from "node:test";
+
+const root = join(import.meta.dirname, "..");
+const source = readFileSync(join(root, "extensions/gentle-agents.ts"), "utf8");
+const match = source.match(/name: "orchestrator_session_id",\s*label: "[^"]+",\s*description: ("(?:[^"\\]|\\.)*")/);
+assert.ok(match, "Registered session tool must expose a public description");
+const description: string = JSON.parse(match[1]);
+const detail = readFileSync(join(root, "assets/orchestrator-delegation.md"), "utf8")
+	.split("## Session subject and display identity\n")[1].split("### Publish and find classified work")[0];
+const docs = readFileSync(join(root, "docs/gentle-agents-activity.md"), "utf8")
+	.split("### Declare a recognizable subject\n")[1].split("### Publish curated state")[0];
+
+// The changed behavior is model-facing metadata/guidance, not a new runtime guard.
+test("session declaration guidance exempts small direct tasks in every public surface", () => {
+	for (const [name, text] of [["tool description", description], ["coordination policy", detail], ["user docs", docs]]) {
+		assert.match(text, /Do not require a subject declaration for small direct tasks/, name);
+		assert.match(text, /before delegation or cross-session coordination/i, name);
+		assert.doesNotMatch(text, /When starting a task or delegation/, name);
+	}
+});
+
+test("existing coordination identity and privacy guidance remains intact", () => {
+	assert.match(description, /Names never authenticate/);
+	assert.match(description, /Existing Pi names and human renames are preserved/);
+	assert.match(description, /Never include credentials, internal instructions, or raw prompts/);
+	assert.match(detail, /short, non-sensitive `subject`/);
+	assert.match(detail, /Batch with setup if possible; no extra model call/);
+	assert.match(detail, /Names display only; stable IDs route/);
+	assert.match(docs, /preserving existing names\s+and later human renames/);
+	assert.match(docs, /Aliases are display hints, never authentication or routing identities/);
+});

package/tests/session-worktree-registry.test.ts

@@ -1,11 +1,13 @@
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
+import childProcess, { execFileSync } from "node:child_process";
+import { syncBuiltinESMExports } from "node:module";
 import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
 import { SessionManager } from "@earendil-works/pi-coding-agent";
-import { SessionWorktreeRegistry, resolveSessionWorktree, resolveSessionWorktreeWithGit, SESSION_WORKTREE_ENTRY, toolWorktreePath, worktreeGitEnvironment } from "../lib/session-worktree-registry.ts";
+import { SessionWorktreeRegistry, clearSessionWorktreeMemo, memoizeWorktreeResolver, resolveSessionWorktree, resolveSessionWorktreeWithGit, SESSION_WORKTREE_ENTRY, toolWorktreePath, worktreeGitEnvironment } from "../lib/session-worktree-registry.ts";
+import { sessionRepositoryAuthority } from "../lib/bounded-writer-admission.ts";
 
 // All Git and session writes belong to unique fixtures, never the live clone.
 function fixture(t: test.TestContext) {
@@ -48,6 +50,8 @@ test("canonical roots include cwd, dedupe aliases immediately and reject unrelat
 	assert.deepEqual(registry.roots(), [f.main, f.linked]);
 	assert.equal(h.session.getEntries().length, 2);
 	assert.throws(() => registry.register(f.other, "explicit"), /same Git clone/);
+	// The refusal names the runnable exit for an independent repository (#1915).
+	assert.throws(() => registry.register(f.other, "explicit"), /subagent_run with repository_root/);
 	assert.throws(() => registry.register(join(f.dir, "missing"), "explicit"), /worktree/);
 	assert.equal(resolveSessionWorktree(f.alias, f.main)?.root, f.linked);
 });
@@ -251,3 +255,54 @@ test("nearest-repository resolution: an inner repo's files never resolve to an o
 	writeFileSync(outerFile, "outer\n");
 	assert.equal(resolveSessionWorktree("README.md", f.outer)?.root, f.outer);
 });
+
+// S4 (odd/tasks/startup-home-repo-and-changes.md): every extension resolves the
+// same (cwd, cwd) identity during startup. Count the real Git children through
+// the public resolver, not through an injected seam.
+function countGitSpawns(t: test.TestContext): () => number {
+	let spawns = 0;
+	const original = childProcess.execFileSync;
+	childProcess.execFileSync = ((...args: Parameters<typeof original>) => { if (args[0] === "git") spawns++; return original(...args); }) as typeof original;
+	syncBuiltinESMExports();
+	t.after(() => { childProcess.execFileSync = original; syncBuiltinESMExports(); });
+	return () => spawns;
+}
+
+test("repeated startup resolutions of one cwd share a single Git resolution", (t) => {
+	const f = fixture(t);
+	clearSessionWorktreeMemo();
+	const spawns = countGitSpawns(t);
+	const first = resolveSessionWorktree(f.main, f.main);
+	for (let i = 0; i < 5; i++) assert.deepEqual(resolveSessionWorktree(f.main, f.main), first);
+	assert.equal(spawns(), 2, "one resolution is two rev-parse children");
+	clearSessionWorktreeMemo();
+	resolveSessionWorktree(f.main, f.main);
+	assert.equal(spawns(), 4, "explicit invalidation forces a fresh resolution");
+});
+
+test("memoized identity still observes removal, nested repositories and expiry", (t) => {
+	const f = fixture(t);
+	let now = 0;
+	const resolver = memoizeWorktreeResolver(resolveSessionWorktreeWithGit, { ttlMs: 1000, now: () => now });
+	const authority = sessionRepositoryAuthority(f.main, resolver);
+	const nested = join(f.main, "nested");
+	mkdirSync(nested);
+	assert.equal(resolver(nested, f.main)?.root, f.main);
+	execFileSync("git", ["init", "--quiet", nested], { env: worktreeGitEnvironment(), stdio: "pipe" });
+	assert.equal(resolver(nested, f.main)?.root, realpathSync(nested), "a new nested .git below the cached root is observed");
+	assert.equal(authority(), true);
+	rmSync(join(f.main, ".git"), { recursive: true, force: true });
+	assert.equal(resolver(f.main, f.main), undefined, "a removed clone is never served from the memo");
+	assert.equal(authority(), false, "drift checks still see the removal");
+	let calls = 0;
+	const counted = memoizeWorktreeResolver((path, cwd) => { calls++; return resolveSessionWorktreeWithGit(path, cwd); }, { ttlMs: 1000, now: () => now });
+	counted(f.other, f.other);
+	counted(f.other, f.other);
+	assert.equal(calls, 1);
+	now = 1001;
+	counted(f.other, f.other);
+	assert.equal(calls, 2, "expired entries resolve again");
+	counted(join(f.dir, "empty"), f.dir);
+	counted(join(f.dir, "empty"), f.dir);
+	assert.equal(calls, 4, "a missing repository is never memoized, so bootstrap is observed at once");
+});

package/tests/shell-bar.test.ts

@@ -107,6 +107,46 @@ test("visual visibility hides only selected optional status segments", () => {
 	assert.doesNotMatch(renderShellHeaderBar(buildShellHeaderModel(data), plainTheme, 160, undefined, settings).text, /gpt-5\.5|ctx|\$9\.49|usage/);
 });
 
+test("Status groups running job descriptions beside RDD without a compact count", () => {
+	const data = model({ jobs: [
+		{ id: "job-2", label: "CI for PR 1860", startedAt: 2 },
+		{ id: "job-1", label: "Build runtime", startedAt: 1 },
+	], review: { state: "reviewing", scope: "first.ts" } });
+	for (const width of [30, 60]) {
+		const lines = renderShellSidebarBar(data, plainTheme, width);
+		const text = lines.join("\n");
+		assert.match(text, /Jobs[\s\S]*CI for PR 1860[\s\S]*Build runtime/);
+		assert.match(text, /🌹 RDD/);
+		assert.doesNotMatch(text, /2 jobs/);
+		assert.ok(lines.every((line) => visibleWidth(line) <= width));
+	}
+	assert.doesNotMatch(renderShellSidebarBar(model({ jobs: [] }), plainTheme, 60).join("\n"), /Jobs/);
+});
+
+test("header shows only the running job count when requested and preserves it at mobile widths", () => {
+	const data = model({ jobs: [{ id: "job-1", label: "CI for PR 1860", startedAt: 1 }] });
+	for (const width of [40, 80, 160]) {
+		const text = renderShellHeaderBar(buildShellHeaderModel(data, true), plainTheme, width).text;
+		assert.match(text, /⧗ 1 job/);
+		assert.doesNotMatch(text, /CI for PR/);
+		assert.ok(visibleWidth(text) <= width);
+	}
+	assert.doesNotMatch(renderShellHeaderBar(buildShellHeaderModel(data), plainTheme, 160).text, /1 job/);
+	assert.doesNotMatch(renderShellHeaderBar(buildShellHeaderModel(model({ jobs: [] }), true), plainTheme, 160).text, /jobs?/);
+});
+
+test("bottom-only and hidden below-input chrome retain a compact jobs count", (t) => {
+	const data = model({ jobs: [{ id: "job-1", label: "CI for PR 1860", startedAt: 1 }] });
+	assert.match(renderShellBottomOnlyBar(data, plainTheme, 80).join("\n"), /⧗ 1 job/);
+	useCardStyle(t, CARD_STYLE.FLOAT);
+	const settings = { ...DEFAULT_VISUAL_SETTINGS, headerPlacement: "below-input" as const, statusPlacement: "hidden" as const };
+	const rows = renderShellBelowInputFloat(data, withBackground(plainTheme), 80, undefined, settings)?.rows;
+	assert.ok(rows);
+	assert.match(rows.join("\n"), /⧗ 1 job/);
+	assert.doesNotMatch(rows.join("\n"), /CI for PR/);
+	assert.ok(rows.every((line) => visibleWidth(line) <= 80));
+});
+
 test("Status title stays plain without an active review", () => {
 	const lines = renderShellSidebarBar(model(), plainTheme, 60);
 	assert.match(lines[0], /^╭─ ✿ Status ─+╮$/);