gentle-pi 4.1.0 → 4.3.0

package/lib/selection-engine.ts

@@ -131,7 +131,10 @@ export function withReverseSpan(row: string, startCu: number, endCu: number): st
 			// A nested SGR reset (e.g. the cursor block's own, when the cursor
 			// sits inside the span) clears reverse for everything after it:
 			// re-arm reverse right after it.
-			if (opened && cu < endCu && isSgrReset(seq)) out += "\x1b[7m";
+			// Pi 1.2 resolves the APC fake-cursor end to SGR 27 later in
+			// the host TUI. Preserve the marker for hardware-cursor suppression,
+			// but rearm our selection after it just as after a legacy reset.
+			if (opened && cu < endCu && (isSgrReset(seq) || seq === "\x1b_pi:/fc\x07")) out += "\x1b[7m";
 			i += seq.length;
 			continue;
 		}

package/lib/session-profile-freeze.ts

@@ -16,8 +16,8 @@
 // The live resolution applies only in `follow` mode (GENTLE_PI_PROFILE_FOLLOW=1,
 // for CI and headless runs), in subagent children (their routing comes from the
 // parent through --model), and when no session id is available. In `follow`
-// mode the orchestrator still comes from the startup profile while children
-// follow later defaults: an accepted, documented limitation.
+// mode the orchestrator is still chosen at startup while children follow later
+// defaults: an accepted, documented limitation.
 //
 // The frozen state is in-process only, like the explicit binding of slice 2: it
 // lives on `globalThis` behind a `Symbol.for` key because Pi evaluates this
@@ -27,9 +27,9 @@
 // `gentle-pi.session-profile/v1` entry with origin `local | repo | global` is
 // the integration point with slice 3b-i.
 import { createHash } from "node:crypto";
+import { normalizeModelConfig, type AgentModelConfig } from "./model-routing-authority.ts";
 import { profileRoleEntries, profilesFilePath, readProfilesFileResult } from "./agent-profiles.ts";
 import { readProfilePinStatus, resolveProfilePin, resolveUnversionedProjectProfile } from "./agent-profile-pin.ts";
-import type { AgentModelConfig } from "./model-routing-authority.ts";
 import { readSessionProfileBinding } from "./session-profile-binding.ts";
 import type { WorktreeIdentity, WorktreeResolver } from "./session-worktree-registry.ts";
 
@@ -114,19 +114,14 @@ function isChildSession(env: NodeJS.ProcessEnv): boolean {
  * is never part of the routing. `undefined` means no layer has a profile.
  */
 export function resolveInheritedProfile(options: InheritedProfileOptions): InheritedProfile | undefined {
-	// One worktree lookup serves both the pin layers and the non-Git check.
-	let resolved = false;
-	let identity: WorktreeIdentity | undefined;
-	const resolveWorktree: WorktreeResolver | undefined = options.resolveWorktree === undefined ? undefined : (cwd, base) => {
-		if (!resolved) {
-			resolved = true;
-			identity = options.resolveWorktree!(cwd, base);
-		}
-		return identity;
-	};
-	const pin = resolveProfilePin({ cwd: options.cwd, configHome: options.configHome, resolveWorktree });
-	if (pin !== undefined) return { name: pin.profile, origin: pin.source, modelProfiles: pin.modelProfiles };
-	if (readProfilePinStatus(options.cwd, resolveWorktree) === undefined) {
+	// One worktree lookup serves both the pin layers and the non-Git check,
+	// whether the caller passes a resolver or the pin module's default runs.
+	const status = readProfilePinStatus(options.cwd, options.resolveWorktree);
+	if (status !== undefined) {
+		const identity: WorktreeIdentity = { root: status.root, commonDir: status.commonDir };
+		const pin = resolveProfilePin({ cwd: options.cwd, configHome: options.configHome, resolveWorktree: () => identity });
+		if (pin !== undefined) return { name: pin.profile, origin: pin.source, modelProfiles: pin.modelProfiles };
+	} else {
 		const declaration = resolveUnversionedProjectProfile(options.cwd, options.configHome);
 		if (declaration !== undefined) return { name: declaration.profile, origin: "repo", modelProfiles: declaration.modelProfiles };
 	}
@@ -247,6 +242,7 @@ function describe(profile: InheritedProfile | undefined): string {
  */
 export function inheritedProfileDriftNotice(options: SessionProfileOptions): string | undefined {
 	const resolution = resolveSessionProfile(options);
+	if (resolution.kind === "explicit") return bindingDefinitionDriftNotice(options, resolution);
 	if (resolution.kind !== "inherited") return undefined;
 	const current = resolveInheritedProfile(options);
 	const key = fingerprint(current);
@@ -259,6 +255,34 @@ export function inheritedProfileDriftNotice(options: SessionProfileOptions): str
 	return `el Gentleman: the default profile changed to ${describe(current)}, this session keeps ${describe(resolution.profile)}. Press Enter on a profile in /gentle:profiles to adopt it.`;
 }
 
+// gentle-shell#2228: an explicit binding re-copies the profile definition at
+// selection, so later edits to that entry in profiles.json no-op silently until
+// the operator re-Enters. The same once-per-change fingerprint machine as the
+// inherited notice names the drift; the comparison never adopts the edit.
+function bindingDefinitionDriftNotice(
+	options: SessionProfileOptions,
+	resolution: { kind: "explicit"; name: string; modelProfiles: AgentModelConfig },
+): string | undefined {
+	const file = readProfilesFileResult(profilesFilePath(options.configHome));
+	if (file.status !== "valid") return undefined;
+	const definition = file.file.profiles[resolution.name];
+	if (definition === undefined) return undefined;
+	// Both sides normalize through the store's own route normalizer: a bound
+	// snapshot taken from the panel holds normalized routes, while raw string
+	// forms from other callers must hash equal to the same definition.
+	const normalized = (config: AgentModelConfig) =>
+		Object.fromEntries(Object.entries(config).map(([agent, route]) => [agent, normalizeModelConfig(route)]));
+	const key = createHash("sha256").update(stableJson({ modelProfiles: normalized(definition) })).digest("hex");
+	const current = createHash("sha256").update(stableJson({ modelProfiles: normalized(resolution.modelProfiles) })).digest("hex");
+	if (key === current) return undefined;
+	const notified = registry().notified;
+	const seen = notified.get(options.sessionId!) ?? new Set<string>();
+	if (seen.has(key)) return undefined;
+	seen.add(key);
+	notified.set(options.sessionId!, seen);
+	return `el Gentleman: the profile definition changed to "${resolution.name}" (profiles.json), this session keeps the binding from selection. Press Enter on a profile in /gentle:profiles to adopt it.`;
+}
+
 /** Testing-only reset of every frozen snapshot and drift memory. */
 export function resetFrozenInheritedProfilesForTesting(): void {
 	registry().frozen.clear();

package/lib/session-profile-persistence.ts

@@ -0,0 +1,187 @@
+// Standalone v1 codec and pure active-branch replay (gentle-shell#1064).
+// No Pi API, disk access, shared binding store, or orchestrator application.
+import { isValidProfileName } from "./agent-profiles.ts";
+import {
+	isSafeAgentName,
+	isThinkingLevel,
+	normalizeModelId,
+	normalizeRoutingEntry,
+	type AgentModelConfig,
+	type AgentRoutingEntry,
+} from "./model-routing-authority.ts";
+
+export const SESSION_PROFILE_CUSTOM_TYPE = "gentle-pi.session-profile/v1";
+const SESSION_PROFILE_FAMILY = "gentle-pi.session-profile/";
+
+export type SessionProfileOrigin = "user" | "local" | "repo" | "global";
+
+export interface SessionProfileBindPayload {
+	kind: "bind";
+	origin: SessionProfileOrigin;
+	name: string;
+	modelProfiles: AgentModelConfig;
+}
+
+export interface SessionProfileClearPayload {
+	kind: "clear";
+}
+
+/** Public structural entry shape only; ordinary messages need no custom fields. */
+export interface SessionProfileEntry {
+	type: string;
+	customType?: string;
+	data?: unknown;
+}
+
+export type SessionProfileReadResult =
+	| { status: "absent" }
+	| { status: "bound"; binding: SessionProfileBindPayload }
+	| { status: "cleared" }
+	| { status: "invalid" }
+	| { status: "unsupported" };
+
+export type SessionProfileReplayResult =
+	| { status: "absent" }
+	| (Exclude<SessionProfileReadResult, { status: "absent" }> & {
+			entryIndex: number;
+	  });
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function hasOwn(value: Record<string, unknown>, key: string): boolean {
+	return Object.hasOwn(value, key);
+}
+
+function isOrigin(value: unknown): value is SessionProfileOrigin {
+	return (
+		value === "user" ||
+		value === "local" ||
+		value === "repo" ||
+		value === "global"
+	);
+}
+
+/** Validate known fields before the permissive routing helper can drop them. */
+function readRoute(
+	value: unknown,
+	encoderInput = false,
+): AgentRoutingEntry | undefined {
+	if (typeof value === "string") return normalizeRoutingEntry(value);
+	if (!isRecord(value)) return undefined;
+	// Typed normalized routes can own optional undefined fields. Omit only those
+	// encoder fields; persisted fields and legacy effort retain strict validation.
+	const route = encoderInput
+		? Object.fromEntries(
+				Object.entries(value).filter(
+					([key, field]) =>
+						!((key === "model" || key === "thinking") && field === undefined),
+				),
+			)
+		: value;
+	if (hasOwn(route, "model") && normalizeModelId(route.model) === undefined)
+		return undefined;
+	if (hasOwn(route, "thinking") && !isThinkingLevel(route.thinking))
+		return undefined;
+	if (hasOwn(route, "effort") && !isThinkingLevel(route.effort))
+		return undefined;
+	// Project only own known fields. Unknown extras, even an unknown-only route,
+	// carry no routing meaning. Thinking wins over legacy effort as elsewhere.
+	const known = Object.fromEntries(
+		["model", "thinking", "effort"]
+			.filter((key) => hasOwn(route, key))
+			.map((key) => [key, route[key]]),
+	);
+	const normalized = normalizeRoutingEntry(known);
+	if (!normalized) return undefined;
+	return Object.fromEntries(
+		Object.entries(normalized).filter(([, field]) => field !== undefined),
+	);
+}
+
+function readSnapshot(
+	value: unknown,
+	encoderInput = false,
+): AgentModelConfig | undefined {
+	if (!isRecord(value)) return undefined;
+	const entries: Array<[string, AgentRoutingEntry]> = [];
+	for (const [name, rawRoute] of Object.entries(value)) {
+		// Shared agent-name policy, applied here without the forgiving whole-config
+		// normalization that would silently discard a bad route. Output below uses
+		// own data properties, never prototype setters.
+		if (!isSafeAgentName(name)) return undefined;
+		const route = readRoute(rawRoute, encoderInput);
+		if (route === undefined) return undefined;
+		entries.push([name, route]);
+	}
+	return Object.fromEntries(entries);
+}
+
+function readBind(
+	data: Record<string, unknown>,
+	encoderInput = false,
+): SessionProfileBindPayload | undefined {
+	if (!["origin", "name", "modelProfiles"].every((key) => hasOwn(data, key)))
+		return undefined;
+	if (!isOrigin(data.origin) || !isValidProfileName(data.name)) return undefined;
+	const modelProfiles = readSnapshot(data.modelProfiles, encoderInput);
+	if (modelProfiles === undefined) return undefined;
+	return { kind: "bind", origin: data.origin, name: data.name, modelProfiles };
+}
+
+/** Create a detached user selection payload; never appends or claims durability. */
+export function createSessionProfileBind(
+	name: string,
+	modelProfiles: AgentModelConfig,
+): SessionProfileBindPayload {
+	const binding = readBind({ origin: "user", name, modelProfiles }, true);
+	if (!binding) throw new TypeError("Invalid session profile binding");
+	return binding;
+}
+
+export function createSessionProfileClear(): SessionProfileClearPayload {
+	return { kind: "clear" };
+}
+
+/** Unknown family identifiers are terminal unsupported states, regardless of data. */
+export function readSessionProfileEntry(
+	entry: SessionProfileEntry,
+): SessionProfileReadResult {
+	if (
+		entry.type !== "custom" ||
+		typeof entry.customType !== "string" ||
+		!entry.customType.startsWith(SESSION_PROFILE_FAMILY)
+	)
+		return { status: "absent" };
+	if (entry.customType !== SESSION_PROFILE_CUSTOM_TYPE)
+		return { status: "unsupported" };
+	const data = entry.data;
+	if (!isRecord(data) || !hasOwn(data, "kind")) return { status: "invalid" };
+	if (data.kind === "clear") return { status: "cleared" };
+	if (data.kind !== "bind") return { status: "invalid" };
+	const binding = readBind(data);
+	return binding ? { status: "bound", binding } : { status: "invalid" };
+}
+
+/**
+ * Caller MUST supply ALREADY disk-corroborated active-branch entries, in branch
+ * order (oldest to newest). This function cannot establish that precondition:
+ * it does not read disk, call Pi, enforce append-failure recovery, establish
+ * durability, or update the shared map. In-memory getBranch() alone is NOT
+ * corroboration. Sibling and future paths must be excluded by the caller.
+ *
+ * The newest family entry wins even when invalid or unsupported; never revive
+ * an older binding. Cleared permits current fallback at a later consumer,
+ * whereas invalid/unsupported must remain distinct from absent. entryIndex is
+ * the actual supplied branch offset for a later adapter's location warning.
+ */
+export function replaySessionProfileBranch(
+	entries: readonly SessionProfileEntry[],
+): SessionProfileReplayResult {
+	for (let entryIndex = entries.length - 1; entryIndex >= 0; entryIndex--) {
+		const result = readSessionProfileEntry(entries[entryIndex]);
+		if (result.status !== "absent") return { ...result, entryIndex };
+	}
+	return { status: "absent" };
+}