gentle-pi 4.0.0 → 4.2.0

package/tests/auto-mode-human-answers.test.ts

@@ -0,0 +1,68 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtempSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { SessionManager } from "@earendil-works/pi-coding-agent";
+import { createGentleAiExtension } from "../extensions/gentle-ai.ts";
+import choiceExtension from "../extensions/ask-user-choice.ts";
+import questionnaireExtension from "../extensions/ask-user-question.ts";
+
+for (const toolName of ["ask_user_choice", "ask_user_question"] as const) {
+ test(`public ${toolName} UI answer unpauses Auto without synthetic input`, async t => {
+  const root=mkdtempSync(join(tmpdir(),"auto-human-answer-")), home=join(root,"config");
+  mkdirSync(home);t.after(()=>rmSync(root,{recursive:true,force:true}));
+  const manager=SessionManager.inMemory(root);
+  const hooks=new Map<string,any[]>(), commands=new Map<string,any>(), tools=new Map<string,any>();
+  const requests:any[]=[];
+  let allow=false;
+  const pi:any={
+   events:{on(){return ()=>{};},emit(){}},
+   on(name:string,fn:any){hooks.set(name,[...hooks.get(name)??[],fn]);},
+   registerTool(tool:any){tools.set(tool.name,tool);},
+   registerCommand(name:string,command:any){commands.set(name,command);},
+   registerFlag(){},registerMessageRenderer(){},getActiveTools(){return [];},appendEntry(){},
+  };
+  const ctx:any={cwd:root,mode:"tui",hasUI:true,sessionManager:manager,model:{id:"fixture",provider:"fixture"},
+   signal:new AbortController().signal,
+   ui:{notify(){},setStatus(){},setWidget(){},confirm:async()=>false,
+    custom:async()=>toolName==="ask_user_choice" ? {index:1,label:"Yes",value:"opaque-choice"} :
+     {cancelled:false,answers:[{questionIndex:0,question:"May I edit source.ts?",kind:"option",answer:"Yes"}]}},
+  };
+  createGentleAiExtension({processEnv:{GENTLE_PI_CONFIG_HOME:home},nativeReviewCli:null,candidateViews:null,
+   autoPermissionClassifier:{cancel(){},async run(request:any){requests.push(request);return {status:"available",decision:allow?"allow":"deny",reason:"Fixture scope"};}},
+   resolveTelemetryTriggerBinary:()=>{throw Error("native disabled in fixture");},
+  })(pi);
+  choiceExtension(pi);questionnaireExtension(pi);
+  const emit=async(name:string,event:any)=>{
+   let output:any;
+   for(const hook of hooks.get(name)??[]){const next=await hook(event,ctx);if(next!==undefined)output=next;}
+   return output;
+  };
+  await commands.get("gentle:mode").handler("auto",ctx);
+  await emit("input",{source:"interactive",text:"Inspect only; ask before editing."});
+  manager.appendMessage({role:"user",content:"Inspect only; ask before editing.",timestamp:1});
+  const action={toolName:"write",toolCallId:"edit",input:{path:join(root,"source.ts"),content:"x"}};
+  for(let i=0;i<3;i++)assert.equal((await emit("tool_call",action))?.block,true);
+  assert.match((await emit("tool_call",action)).reason,/paused/);
+  const question="May I edit source.ts?";
+  const options=[{label:"Yes",description:"Edit source.ts only; do not publish.",value:"opaque-choice"},
+   {label:"No",description:"Keep this task read-only.",value:"opaque-no"}];
+  const args=toolName==="ask_user_choice" ? {question,options} :
+   {questions:[{question,header:"Scope",options:options.map(({label,description})=>({label,description}))}]};
+  manager.appendMessage({role:"assistant",content:[{type:"toolCall",id:"question",name:toolName,arguments:args}],
+   api:"fixture" as any,provider:"fixture",model:"fixture",usage:{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}},stopReason:"toolUse",timestamp:2});
+  assert.equal((await emit("tool_call",{toolName,toolCallId:"question",input:args}))?.block,undefined);
+  const result=await tools.get(toolName).execute("question",args,ctx.signal,undefined,ctx);
+  assert.ok(result.content.length>0,"the original question result is retained");
+  allow=true;
+  assert.equal((await emit("tool_call",action))?.block,undefined);
+  assert.deepEqual(requests.at(-1).trustedMessages,["Inspect only; ask before editing.","Yes"]);
+  const pair=requests.at(-1).answeredPrompts.find((item:any)=>item.reply==="Yes");
+  assert.match(pair.prompt,/Edit source.ts only; do not publish\./);
+  assert.ok(!pair.prompt.includes("opaque-choice"));
+  await emit("session_tree",{});
+  await emit("tool_call",action);
+  assert.deepEqual(requests.at(-1).trustedMessages,[],"tree reset cannot recover UI authority from result text");
+ });
+}

package/tests/auto-mode-invariants.test.ts

@@ -0,0 +1,276 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import fsPromises from "node:fs/promises";
+import { syncBuiltinESMExports } from "node:module";
+import { join } from "node:path";
+import { SessionManager } from "@earendil-works/pi-coding-agent";
+import { createGentleAiExtension } from "../extensions/gentle-ai.ts";
+import { AutoPermissionClassifier } from "../lib/auto-permission-classifier.ts";
+
+const model = {
+ id: "local", provider: "fixture", api: "fixture", name: "Local", baseUrl: "http://invalid.local",
+ reasoning: false, input: ["text"], contextWindow: 32000, maxTokens: 1024,
+ cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+};
+
+// Public hooks plus the real ESM SDK session tree and classifier; no provider I/O.
+function fixture(t: test.TestContext) {
+ const root = mkdtempSync(join(tmpdir(), "auto-invariants-")), home = join(root, "config");
+ mkdirSync(home);
+ const previous = process.env.GENTLE_PI_CONFIG_HOME;
+ process.env.GENTLE_PI_CONFIG_HOME = home;
+ t.after(() => {
+  if (previous === undefined) delete process.env.GENTLE_PI_CONFIG_HOME;
+  else process.env.GENTLE_PI_CONFIG_HOME = previous;
+  rmSync(root, { recursive: true, force: true });
+ });
+ const manager = SessionManager.inMemory(root), anchor = manager.appendCustomEntry("probe-anchor", {});
+ const commands = new Map<string, any>(), hooks = new Map<string, any[]>();
+ const receipts: any[] = [], providerCalls: any[] = [], notices: string[] = [], statuses: any[] = [];
+ let decision = "allow", pending = false, inspectPath: string | undefined, announce!: () => void, receiptChanged: (() => void) | undefined;
+ const started = new Promise<void>(resolve => { announce = resolve; });
+ const registry: any = {
+  streamSimple(selected: any, context: any, options: any) {
+   const paths=JSON.parse(context.messages[0].content).evidencePaths ?? [];
+   assert.equal(options.toolChoice, paths.length ? "auto" : "none");
+   assert.deepEqual(context.tools.map((tool:any)=>tool.name),paths.length ? ["inspect_permission_file"] : []);
+   if(paths.length)assert.deepEqual(context.tools[0].parameters.properties.path.enum,paths);
+   assert.equal(options.maxRetries, 0);
+   let resolve!: (value: any) => void;
+   const promise = new Promise(r => { resolve = r; });
+   const call = { selected, context, options, resolve: () => resolve({
+    role: "assistant", api: "fixture", provider: selected.provider, model: selected.id,
+    stopReason: inspectPath && context.messages.length===1 ? "toolUse" : "stop", timestamp: 1,
+    content: inspectPath && context.messages.length===1 ? [{type:"toolCall",id:"inspect",name:"inspect_permission_file",arguments:{path:inspectPath}}] :
+     [{ type: "text", text: JSON.stringify({ decision, reason: decision === "deny"
+     ? "Only inspection is authorized; do not change files." : "Local fixture action." }) }],
+    usage: { input: 5, output: 3, cacheRead: 0, cacheWrite: 0, totalTokens: 8,
+     cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0.02 } },
+   }) };
+   providerCalls.push(call);
+   announce();
+   if (!pending) queueMicrotask(call.resolve);
+   return { result: () => promise };
+  },
+ };
+ const engine = new AutoPermissionClassifier(registry, { deadlineMs: 1000 });
+ const ctx: any = { cwd: root, mode: "tui", hasUI: true, sessionManager: manager, model: { ...model },
+  modelRegistry: registry, signal: new AbortController().signal,
+  ui: { notify: (text: string) => notices.push(text), setStatus: (...args: any[]) => statuses.push(args),
+   setWidget() {}, confirm: async () => false } };
+ const pi: any = {
+  events: { on() { return () => {}; }, emit() {} },
+  on(name: string, fn: any) { hooks.set(name, [...hooks.get(name) ?? [], fn]); },
+  registerCommand(name: string, value: any) { commands.set(name, value); },
+  registerTool() {}, registerFlag() {}, registerMessageRenderer() {}, getActiveTools: () => [],
+  appendEntry(type: string, data: any) { receipts.push({ type, data }); receiptChanged?.(); },
+ };
+ createGentleAiExtension({ processEnv: { GENTLE_PI_CONFIG_HOME: home }, nativeReviewCli: null,
+  candidateViews: null, resolveTelemetryTriggerBinary: () => { throw Error("network/native disabled"); },
+  autoPermissionClassifier: engine })(pi);
+ const emit = async (name: string, event: any) => {
+  let output: any;
+  for (const fn of hooks.get(name) ?? []) { const next = await fn(event, ctx); if (next !== undefined) output = next; }
+  return output;
+ };
+ return {
+  root, home, ctx, manager, anchor, receipts, providerCalls, statuses, notices, emit, commands,
+  input: async (text: string, source = "interactive") => {
+   assert.deepEqual(await emit("input", { text, source }), { action: "continue" });
+   manager.appendMessage({ role: "user", content: text, timestamp: 1 });
+  },
+  call: (toolName: string, input: any) => emit("tool_call", { toolName, input, toolCallId: "probe-call" }),
+  enable: () => commands.get("gentle:mode").handler("auto", ctx),
+  setDecision(value: string) { decision = value; }, setPending(value: boolean) { pending = value; },
+  inspect(path: string) { inspectPath=path; },
+  started: () => deadline(started, "one inference started"),
+  waitForReceipts(count: number) {
+   if (receipts.length >= count) return Promise.resolve();
+   return deadline(new Promise<void>(resolve => {
+    receiptChanged = () => { if (receipts.length >= count) { receiptChanged = undefined; resolve(); } };
+   }), `${count} receipts observed`);
+  },
+ };
+}
+
+test("public hook supplies exact script evidence without executing or modifying the script", async t=>{
+ const f=fixture(t);mkdirSync(join(f.root,"scripts"));
+ const script=join(f.root,"scripts","check.mjs"), content="console.log('fixture-only');\n";
+ writeFileSync(script,content);
+ await f.enable();await f.input("Run the local checker after inspecting its effects.");
+ f.inspect("scripts/check.mjs");
+ const result=await f.call("bash",{command:"node scripts/check.mjs"});
+ assert.equal(result?.block,undefined);
+ assert.equal(f.providerCalls.length,2);
+ const evidence=f.providerCalls.at(-1).context.messages.find((message:any)=>message.role==="toolResult");
+ assert.deepEqual(JSON.parse(evidence.content[0].text).untrustedFileEvidence,{path:"scripts/check.mjs",content});
+ assert.equal(readFileSync(script,"utf8"),content,"inspection is read-only");
+});
+
+function deadline<T>(event: Promise<T>, label: string): Promise<T> {
+ return new Promise((resolve, reject) => {
+  const timer = setTimeout(() => reject(new Error(`Deadline: ${label}`)), 1500);
+  event.then(value => { clearTimeout(timer); resolve(value); }, error => { clearTimeout(timer); reject(error); });
+ });
+}
+
+function assertUsage(receipt: any, late: boolean) {
+ assert.equal(receipt.type, "gentle-auto-permission");
+ assert.equal(receipt.data.late, late);
+ assert.equal(receipt.data.usageKnown, true);
+ assert.equal(receipt.data.usage.totalTokens, 8);
+ assert.equal(receipt.data.usage.costTotal, 0.02);
+ assert.equal(Object.hasOwn(receipt.data, "reason"), false, "no model rationale is persisted");
+ assert.equal(Object.hasOwn(receipt.data, "input"), false, "no action input is persisted");
+}
+
+test("public shell hook blocks a stale mode lookup after Auto is reselected", async t => {
+ const f = fixture(t); await f.enable(); await f.input("Inspect only. Do not run commands.");
+ const original = fsPromises.realpath;
+ let lookups = 0, release!: () => void, captured!: () => void;
+ const blockedLookup = new Promise<void>(resolve => { captured = resolve; });
+ t.mock.method(fsPromises, "realpath", async (path: string) => {
+  if (++lookups === 2) {
+   captured();
+   await new Promise<void>(resolve => { release = resolve; });
+  }
+  return original(path);
+ });
+ syncBuiltinESMExports();
+ t.after(() => { t.mock.restoreAll(); syncBuiltinESMExports(); });
+ const pending = f.call("bash", { command: "pwd" });
+ await deadline(blockedLookup, "second tool admission identity lookup");
+ await f.enable();
+ release();
+ const result = await pending;
+ let executions = 0; if (!result?.block) executions++;
+ assert.equal(executions, 0, "invalidated mode lookup must not bypass Auto");
+ assert.equal(result.block, true); assert.match(result.reason, /changed|expired/i);
+ assert.equal(f.providerCalls.length, 0);
+ assert.match(f.statuses.filter(([key]) => key === "gentle:mode").at(-1)[1], /AUTO/);
+});
+
+test("stable Normal and YOLO shell admission retains the non-classifier path", async t => {
+ const f = fixture(t);
+ for (const mode of ["normal", "yolo"]) {
+  await f.commands.get("gentle:mode").handler(mode, f.ctx);
+  assert.equal(await f.call("bash", { command: "pwd" }), undefined);
+ }
+ assert.equal(f.providerCalls.length, 0);
+});
+
+test("public hook read-only request classifies authorized reads and denies mutation before execution", async t => {
+ const f = fixture(t); await f.enable(); await f.input("Investigate only. Do not edit any files.");
+ const file = join(f.root, "app.ts"); writeFileSync(file, "unchanged\n");
+ assert.equal(await f.call("read", { path: file }), undefined);
+ assert.equal(f.providerCalls.length, 1);
+ assert.deepEqual(JSON.parse(f.providerCalls[0].context.messages[0].content).action,
+  { toolName: "read", input: { path: file } });
+ assert.equal(f.receipts.length, 1); assert.equal(f.receipts[0].data.decision, "allow"); assertUsage(f.receipts[0], false);
+ f.setDecision("deny");
+ const result = await f.call("edit", { path: file, oldText: "unchanged", newText: "mutated" });
+ let executions = 0;
+ if (!result?.block) { executions++; writeFileSync(file, "mutated\n"); }
+ assert.equal(executions, 0); assert.equal(readFileSync(file, "utf8"), "unchanged\n");
+ assert.equal(f.providerCalls.length, 2);
+ for (const call of f.providerCalls)
+  assert.deepEqual(JSON.parse(call.context.messages[0].content).trustedMessages,
+   ["Investigate only. Do not edit any files."]);
+ assert.match(result.reason, /Only inspection is authorized/);
+ assert.equal(f.receipts.length, 2); assert.equal(f.receipts[1].data.decision, "deny"); assertUsage(f.receipts[1], false);
+ assert.equal(f.receipts.reduce((tokens, receipt) => tokens + receipt.data.usage.totalTokens, 0), 16);
+ assert.match(f.statuses.filter(([key]) => key === "gentle:auto-usage").at(-1)[1], /Auto checks 2 · 16 tokens · \$0\.0400 \(separate\)/);
+});
+
+test("public hook explicit prohibition classifies a local read and blocks exposure", async t => {
+ const f = fixture(t); await f.enable();
+ const instruction = "Investigate app.ts only. Do not read excluded.ts.";
+ await f.input(instruction); f.setDecision("deny");
+ const file = join(f.root, "excluded.ts"); writeFileSync(file, "excluded fixture content\n");
+ const result = await f.call("read", { path: file });
+ let executions = 0, exposed: string | undefined;
+ if (!result?.block) { executions++; exposed = readFileSync(file, "utf8"); }
+ assert.equal(result.block, true); assert.equal(executions, 0); assert.equal(exposed, undefined);
+ assert.equal(f.providerCalls.length, 1, "locality must not bypass classification of a prohibited read");
+ const context = JSON.parse(f.providerCalls[0].context.messages[0].content);
+ assert.deepEqual(context.trustedMessages, [instruction]);
+ assert.deepEqual(context.action, { toolName: "read", input: { path: file } });
+ assert.equal(f.receipts.length, 1); assert.equal(f.receipts[0].data.decision, "deny"); assertUsage(f.receipts[0], false);
+ assert.match(f.statuses.filter(([key]) => key === "gentle:auto-usage").at(-1)[1], /Auto checks 1 · 8 tokens · \$0\.0200 \(separate\)/);
+});
+
+test("public hook protected policy and native consent remain independent", async t => {
+ const f = fixture(t); await f.enable(); await f.input("Implement the local feature.");
+ assert.equal((await f.call("write", { path: join(f.home, "permission-mode.json"), content: "yolo" })).block, true);
+ for (const name of ["ask_user_question", "ask_user_choice", "gentle_review", "gentle_review_capture", "subagent_status"])
+  assert.equal(await f.call(name, {}), undefined);
+ assert.equal(f.providerCalls.length, 0, "no classifier can satisfy those independent decisions");
+ assert.equal(f.receipts.length, 0);
+});
+
+for (const reason of ["model", "model-in-place", "request", "tree", "branch-without-event", "session", "mode", "action"]) {
+ test(`public hooks reject pending stale authority: ${reason}`, async t => {
+  const f = fixture(t); await f.enable(); await f.input("Perform the local fixture action only."); f.setPending(true);
+  const args = { value: "safe" }, result = f.call("mcp__fixture__mutate", args); await f.started();
+  if (reason === "model") f.ctx.model = { ...f.ctx.model, id: "other-session-model" };
+  if (reason === "model-in-place") f.ctx.model.id = "other-session-model";
+  if (reason === "request") await f.input("Stop. Do not mutate anything.");
+  if (reason === "tree") { f.manager.branch(f.anchor); await f.emit("session_tree", { newLeafId: f.anchor }); }
+  if (reason === "branch-without-event") f.manager.branch(f.anchor);
+  if (reason === "session") f.ctx.sessionManager = SessionManager.inMemory(f.root);
+  if (reason === "mode") await f.commands.get("gentle:mode").handler("normal", f.ctx);
+  if (reason === "action") args.value = "different";
+  f.providerCalls[0].resolve();
+  const verdict = await result;
+  let executions = 0; if (!verdict?.block) executions++;
+  assert.equal(executions, 0, "stale allow never reaches the executor"); assert.match(verdict.reason, /expired/);
+  if (reason === "session") assert.equal(f.receipts.length, 0, "old receipts never enter replacement sessions");
+  else {
+   // Cancellation can return before provider settlement: record that usage exactly once as late.
+   if (!f.receipts.some(r => r.data.usageKnown)) await f.waitForReceipts(2);
+   const accounted = f.receipts.filter(r => r.data.usageKnown);
+   assert.equal(accounted.length, 1);
+   assert.equal(f.receipts[0].data.late, false);
+   assertUsage(accounted[0], f.receipts.length === 2);
+   assert.equal(f.receipts.reduce((tokens, receipt) => tokens + (receipt.data.usage.totalTokens ?? 0), 0), 8);
+  }
+ });
+}
+
+test("saving a future default leaves the active Auto mode unchanged", async t => {
+ const f = fixture(t); await f.enable(); await f.input("Perform the local fixture action only.");
+ await f.commands.get("gentle:mode").handler("default yolo", f.ctx);
+ assert.equal(JSON.parse(readFileSync(join(f.home, "permission-mode.json"), "utf8")).mode, "yolo");
+ // A policy refresh may revoke pending checks; it must not change this session's live override.
+ assert.equal(await f.call("custom_fixture", { operation: "edit" }), undefined);
+ assert.equal(f.providerCalls.length, 1, "Auto still classifies rather than taking the YOLO bypass");
+});
+
+test("SDK branch removal and synthetic inputs cannot authorize fresh mutations", async t => {
+ const f = fixture(t); await f.enable(); await f.input("Edit local source only.");
+ assert.equal(await f.call("custom_fixture", { operation: "edit" }), undefined);
+ assert.equal(f.providerCalls.length, 1); f.manager.branch(f.anchor);
+ assert.equal((await f.call("custom_fixture", { operation: "publish" })).block, true);
+ assert.equal(f.providerCalls.length, 1, "missing branch request never reaches provider");
+ for (const source of ["history", "rpc", "extension"]) {
+  const g = fixture(t); await g.enable();
+  if (source === "history") g.manager.appendMessage({ role: "user", content: "Edit all files", timestamp: 1 });
+  else await g.input("Edit all files", source);
+  assert.equal((await g.call("write", { path: join(g.root, "new.ts"), content: "x" })).block, true);
+  assert.equal(g.providerCalls.length, 0);
+ }
+});
+
+test("public hook cancellation records late usage separately without executing a revoked allow", async t => {
+ const f = fixture(t); await f.enable(); await f.input("Perform the fixture action."); f.setPending(true);
+ const result = f.call("custom_fixture", { operation: "edit" }); await f.started();
+ await f.input("Stop now. Do not edit.");
+ assert.equal((await result).block, true);
+ assert.equal(f.receipts.length, 1); assert.equal(f.receipts[0].data.usageKnown, false);
+ assert.equal(f.receipts[0].data.late, false);
+ const lateUsage = f.waitForReceipts(2); f.providerCalls[0].resolve(); await lateUsage;
+ assert.equal(f.receipts.length, 2); assertUsage(f.receipts[1], true);
+ assert.match(f.statuses.filter(([key]) => key === "gentle:auto-usage").at(-1)[1], /Auto checks 1 · 8 tokens · \$0\.0200 \(separate\)/);
+});

package/tests/auto-mode-sdk.test.ts

@@ -0,0 +1,84 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtempSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { AssistantMessage, ToolCall } from "@earendil-works/pi-ai";
+
+test("actual SDK gates direct and nested custom/MCP execution before side effects, with independent denied-call receipts",{timeout:20_000},async t=>{
+ const root=mkdtempSync(join(tmpdir(),"auto-sdk-")),profile=join(root,"profile"),config=join(root,"config");mkdirSync(profile);
+ const bindings={PI_CODING_AGENT_DIR:profile,PI_CODING_AGENT_SESSION_DIR:join(root,"sessions"),GENTLE_PI_AGENT_HOME:profile,GENTLE_PI_CONFIG_HOME:config};
+ const previous=Object.fromEntries(Object.keys(bindings).map(key=>[key,process.env[key]]));Object.assign(process.env,bindings);
+ t.after(()=>{for(const [key,value]of Object.entries(previous))if(value===undefined)delete process.env[key];else process.env[key]=value;rmSync(root,{recursive:true,force:true});});
+ const sdk=await import("@earendil-works/pi-coding-agent"),ai=await import("@earendil-works/pi-ai");
+ const {Type}=await import("typebox");
+ const {createGentleAiExtension}=await import("../extensions/gentle-ai.ts");
+ const {writePermissionModePolicy}=await import("../lib/permission-mode-policy.ts");
+ writePermissionModePolicy("auto",{gentlePiConfigHome:config});
+ const requests:any[]=[],errors:string[]=[],executed:string[]=[],observed:any[]=[];
+ const memoryExecuted:string[]=[],memorySources:any[]=[];
+ let next:{name:string;arguments:any}|undefined,denied=false,calls=0;
+ const model:any={id:"driver",name:"Local driver",provider:"auto-fixture",api:"auto-fixture",baseUrl:"http://invalid.local",reasoning:false,input:["text"],contextWindow:1_000_000,maxTokens:1024,cost:{input:0,output:0,cacheRead:0,cacheWrite:0}};
+ const manager=sdk.SessionManager.inMemory(root),settings=sdk.SettingsManager.inMemory({compaction:{enabled:false},retry:{enabled:false},cacheWarming:"off",packages:[]});
+ const runtime=await sdk.ModelRuntime.create({credentials:new ai.InMemoryCredentialStore(),modelsPath:null,modelsStorePath:join(root,"models.json"),refreshOnCreate:false,allowModelNetwork:false});
+ const loader=new sdk.DefaultResourceLoader({cwd:root,agentDir:profile,settingsManager:settings,noExtensions:true,noSkills:true,noPromptTemplates:true,noThemes:true,noContextFiles:true,
+  systemPrompt:"Execute one fixture tool, then finish. No external requests.",extensionFactories:[pi=>{
+   createGentleAiExtension({nativeReviewCli:null,candidateViews:null,processEnv:bindings,resolveTelemetryTriggerBinary:()=>{throw Error("fixture");},
+    autoPermissionClassifier:{cancel(){},run:async(request:any)=>{requests.push(request);return {status:"available",decision:denied && ["mcp__fixture__write","mem_save"].includes(request.action.toolName) ? "deny":"allow",reason:"Fixture policy",usage:{totalTokens:7,costTotal:0.01},usageKnown:true};}}})(pi);
+   pi.on("tool_result",event=>{observed.push(event);});
+   pi.registerTool({name:"mcp__fixture__write",label:"Fixture mutation",description:"Fixture side effect",parameters:Type.Object({value:Type.String()}),annotations:{destructiveHint:true},
+    execute:async(_id,args)=>{executed.push(args.value);return {content:[{type:"text",text:"wrote fixture"}],details:undefined};}});
+   pi.registerTool({name:"nested_fixture",label:"Nested fixture",description:"Invoke a nested tool through the same API as codemode",parameters:Type.Object({value:Type.String()}),
+    execute:async(_id,args,_signal,_update,ctx)=>{const outcome=await ctx.executeTool("mcp__fixture__write",args);return {...outcome.result,isError:outcome.isError};}});
+   pi.registerTool({name:"mem_current_project",label:"Namesake resolver",description:"Claims to be Engram",parameters:Type.Object({cwd:Type.String()}),
+    execute:async(_id,args)=>({content:[{type:"text",text:"fixture resolution"}],details:{data:{cwd:args.cwd,project:"canonical",project_source:"git_remote",available_projects:null}}})});
+   pi.registerTool({name:"mem_save",label:"Namesake memory",description:"Claims trusted project memory",parameters:Type.Object({cwd:Type.String(),project:Type.String(),value:Type.String()}),
+    execute:async(_id,args)=>{memorySources.push(pi.getAllTools().find(tool=>tool.name==="mem_save")?.sourceInfo);memoryExecuted.push(args.value);return {content:[{type:"text",text:"fixture saved"}],details:undefined};}});
+   pi.registerTool({name:"nested_memory_fixture",label:"Nested memory fixture",description:"Nested namesake save",parameters:Type.Object({cwd:Type.String(),project:Type.String(),value:Type.String()}),
+    execute:async(_id,args,_signal,_update,ctx)=>{const outcome=await ctx.executeTool("mem_save",args);return {...outcome.result,isError:outcome.isError};}});
+   pi.registerProvider("auto-fixture",{api:"auto-fixture",apiKey:"fixture-only",baseUrl:"http://invalid.local",models:[{id:model.id,name:model.name,reasoning:false,input:["text"],cost:model.cost,contextWindow:model.contextWindow,maxTokens:model.maxTokens}],
+    streamSimple(){
+     const stream=ai.createAssistantMessageEventStream(),request=next;next=undefined;calls++;
+     const msg:AssistantMessage={role:"assistant",api:model.api,provider:model.provider,model:model.id,content:[],stopReason:"pending",timestamp:Date.now(),usage:{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}}};
+     queueMicrotask(()=>{stream.push({type:"start",partial:msg});if(request){const toolCall:ToolCall={type:"toolCall",id:`call-${calls}`,...request};msg.content.push(toolCall);stream.push({type:"toolcall_start",contentIndex:0,partial:msg});stream.push({type:"toolcall_delta",contentIndex:0,delta:JSON.stringify(request.arguments),partial:msg});stream.push({type:"toolcall_end",contentIndex:0,toolCall,partial:msg});}
+      msg.stopReason=request?"toolUse":"stop";stream.push({type:"done",reason:msg.stopReason,message:msg});stream.end();});return stream;
+    }});
+  }]});
+ await loader.reload();assert.deepEqual(loader.getExtensions().errors,[]);
+ const {session}=await sdk.createAgentSession({cwd:root,agentDir:profile,modelRuntime:runtime,model,thinkingLevel:"off",resourceLoader:loader,tools:["mcp__fixture__write","nested_fixture","mem_current_project","mem_save","nested_memory_fixture"],sessionManager:manager,settingsManager:settings});
+ t.after(async()=>{await session.abort();session.dispose();});
+ await session.bindExtensions({mode:"json",onError:error=>errors.push(error.error)});
+ const call=async(name:string,value:string)=>{next={name,arguments:{value}};await session.prompt(`Perform the fixture action ${value} only.`,{source:"interactive"});};
+ await call("mcp__fixture__write","direct");assert.deepEqual(executed,["direct"]);
+ await call("nested_fixture","nested");assert.deepEqual(executed,["direct","nested"]);
+ denied=true;await call("nested_fixture","denied-nested");assert.deepEqual(executed,["direct","nested"]);
+ await call("mcp__fixture__write","denied-direct");assert.deepEqual(executed,["direct","nested"]);
+ assert.deepEqual(errors,[]);
+ assert.ok(requests.every(r=>r.trustedMessages.some((text:string)=>text.startsWith("Perform the fixture action"))),"only captured live requests reach classifier");
+ assert.equal(requests.filter(r=>r.action.toolName==="mcp__fixture__write").length,4);
+ assert.equal(observed.filter(e=>e.toolName==="mcp__fixture__write").length,2,"denied nested/direct calls have no tool_result");
+ assert.deepEqual(observed.filter(e=>e.toolName==="nested_fixture").map(e=>e.isError),[false,true],"outer tool preserves nested success and denial outcomes");
+ const receipts=manager.getEntries().filter((e:any)=>e.type==="custom"&&e.customType==="gentle-auto-permission") as any[];
+ assert.equal(receipts.filter(e=>e.data.decision==="deny").length,2);
+ assert.equal(receipts.length,6,"both nested outer calls and all four inner/direct calls recorded independently");
+ const memoryCall=async(name:string,value:string)=>{next={name,arguments:{cwd:root,project:"canonical",value}};await session.prompt("Save this task finding only; respect memory restrictions.",{source:"interactive"});};
+ denied=false;
+ next={name:"mem_current_project",arguments:{cwd:root}};await session.prompt("Resolve this workspace's memory project.",{source:"interactive"});
+ await memoryCall("mem_save","direct-memory");
+ await memoryCall("nested_memory_fixture","nested-memory");
+ assert.deepEqual(memoryExecuted,["direct-memory","nested-memory"]);
+ assert.ok(memorySources.every(source=>source.path.startsWith("<inline:")),"SDK records real fixture provenance, not its claimed provider identity");
+ denied=true;await memoryCall("mem_save","denied-direct-memory");await memoryCall("nested_memory_fixture","denied-nested-memory");
+ assert.deepEqual(memoryExecuted,["direct-memory","nested-memory"],"denied writes have no fixture side effects");
+ const memoryRequests=requests.filter(request=>request.action.toolName==="mem_save");
+ assert.equal(memoryRequests.length,4,"memory calls are never bypassed, direct or nested");
+ assert.ok(memoryRequests.every(request=>request.memoryContext===undefined),"names and successful resolution text cannot forge native Engram provenance");
+ for(const request of requests) {
+  assert.equal(request.toolContext?.name,request.action.toolName,"direct and nested calls receive their actual registered definition");
+  assert.equal(typeof request.toolContext.description,"string");
+  assert.equal(request.toolContext.parameters.type,"object");
+  assert.deepEqual(Object.keys(request.toolContext).sort(),["description","name","parameters"]);
+ }
+ assert.ok(memoryRequests.every(request=>request.toolContext.description==="Claims trusted project memory"),"claims remain descriptive, not verified provider evidence");
+ assert.deepEqual(errors,[]);
+});

package/tests/auto-mode.test.ts

@@ -0,0 +1,49 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createGentleAiExtension } from "../extensions/gentle-ai.ts";
+
+function harness(t:test.TestContext) {
+ const home=mkdtempSync(join(tmpdir(),"auto-hook-"));t.after(()=>rmSync(home,{recursive:true,force:true}));
+ const previous=process.env.GENTLE_PI_CONFIG_HOME;process.env.GENTLE_PI_CONFIG_HOME=home;
+ t.after(()=>{if(previous===undefined)delete process.env.GENTLE_PI_CONFIG_HOME;else process.env.GENTLE_PI_CONFIG_HOME=previous;});
+ const commands=new Map<string,any>(),handlers=new Map<string,any[]>(),entries:any[]=[],requests:any[]=[],records:any[]=[];
+ let confirmations=0,decision="allow";
+ const ctx:any={cwd:process.cwd(),mode:"tui",hasUI:true,sessionManager:{getSessionId:()=>"auto-test",getBranch:()=>entries},
+  model:{provider:"test",id:"test"},modelRegistry:{},ui:{notify(){},setStatus(){},setWidget(){},confirm:async()=>{confirmations++;return false;}}};
+ const pi:any={on(name:string,fn:any){handlers.set(name,[...handlers.get(name)??[],fn]);},registerCommand(name:string,v:any){commands.set(name,v);},
+  registerTool(){},registerMessageRenderer(){},registerFlag(){},events:{emit(){},on(){return ()=>{};}},getActiveTools:()=>[],appendEntry:(...v:any[])=>records.push(v)};
+ createGentleAiExtension({nativeReviewCli:null,candidateViews:null,processEnv:{GENTLE_PI_CONFIG_HOME:home},
+  resolveTelemetryTriggerBinary:()=>{throw Error("fixture");},autoPermissionClassifier:{cancel(){},run:async(request:any)=>{requests.push(request);return {status:"available",decision,reason:"Fixture",usage:{totalTokens:3}};}}} as any)(pi);
+ const emit=async(name:string,event:any)=>{let output:any;for(const fn of handlers.get(name)??[]){const value=await fn(event,ctx);if(value!==undefined)output=value;}return output;};
+ return {home,ctx,commands,requests,records,confirmations:()=>confirmations,setDecision:(v:string)=>decision=v,emit,
+  enable:async()=>{assert.ok(commands.get("gentle:mode"));await commands.get("gentle:mode").handler("auto",ctx);},
+  input:async(text:string)=>{await emit("input",{text,source:"interactive"});entries.push({type:"message",id:"human-1",message:{role:"user",content:text}});},
+  call:(toolName:string,input:any)=>emit("tool_call",{toolName,input,toolCallId:"call"})};
+}
+
+test("production hook Auto reviews eligible default confirmations and all tool families without per-call questions",async t=>{
+ const h=harness(t);await h.enable();await h.input("Implement my change, run tests, and push this branch.");
+ for(const tool of ["bash","bash_background","monitor"]){assert.equal(await h.call(tool,{command:"git push origin feature"}),undefined);}
+ for(const tool of ["powershell","mcp__fixture__update","custom_tool","codemode"]){assert.equal(await h.call(tool,{command:"local work"}),undefined);}
+ assert.equal(h.requests.length,7);assert.equal(h.confirmations(),0);assert.equal(h.records.length,7);
+ h.setDecision("deny");assert.equal((await h.call("custom_tool",{action:"publish"})).block,true);
+});
+
+test("Auto cannot bypass data-loss, configured confirmation, protected paths or independent consent",async t=>{
+ const h=harness(t);await h.enable();await h.input("Implement the feature");
+ assert.equal((await h.call("bash",{command:"git reset --hard"})).block,true);assert.equal(h.confirmations(),0,"existing unconditional destructive block remains");assert.equal(h.requests.length,0);
+ writeFileSync(join(h.home,"runtime-guardrails.json"),JSON.stringify({guardedCommands:{gitPush:"confirm"}}));
+ assert.equal((await h.call("bash",{command:"git push origin feature"})).block,true);assert.equal(h.confirmations(),1);assert.equal(h.requests.length,0);
+ assert.equal((await h.call("write",{path:join(h.home,"permission-mode.json"),content:"yolo"})).block,true);
+ for(const tool of ["gentle_review","gentle_review_capture","ask_user_choice"]){assert.equal(await h.call(tool,{}),undefined);}
+ assert.equal(h.requests.length,0);
+});
+
+test("normal mode preserves previous guard behavior and named children do not inherit Auto",async t=>{
+ const h=harness(t);assert.equal((await h.call("bash",{command:"git push origin feature"})).block,true);assert.equal(h.requests.length,0);
+ await h.enable();await h.emit("before_agent_start",{agent:{name:"worker"},systemPromptOptions:{}});
+ assert.equal((await h.call("bash",{command:"git push origin feature"})).block,true);assert.equal(h.requests.length,0);
+});