gentle-pi 4.2.0 → 4.4.0

package/lib/session-profile-disk-reader.ts

@@ -0,0 +1,182 @@
+// Observable selected-record authority only, not conversation durability.
+import { readFileSync } from "node:fs";
+import { isDeepStrictEqual } from "node:util";
+import {
+	isSessionProfileFamilyEntry,
+	readSessionProfileEntry,
+	type SessionProfileReadResult,
+} from "./session-profile-persistence.ts";
+
+export interface SessionProfileSource {
+	getSessionId(): string;
+	getSessionFile(): string | undefined;
+	getBranch(): readonly unknown[];
+}
+export type DiskProfileIndeterminateReason =
+	| "missing-source"
+	| "invalid-candidate-metadata"
+	| "unreadable-file"
+	| "source-changed"
+	| "invalid-record"
+	| "session-header-mismatch"
+	| "duplicate-id"
+	| "missing-header"
+	| "selected-record-missing"
+	| "selected-record-mismatch"
+	| "unserializable-source";
+export type DiskProfileResult =
+	| {
+			status: "indeterminate";
+			reason: DiskProfileIndeterminateReason;
+			entryIndex?: never;
+			lineNumber?: number;
+	  }
+	| (SessionProfileReadResult & { entryIndex?: number; lineNumber?: number });
+
+export interface DiskProfileOptions {
+	readFile?: (path: string) => string;
+	/** Trusted caller evidence ONLY: exclude known failed appends, never arbitrary
+	 * invalid/future entries. This reader owns no quarantine or append controller.
+	 * Failed IDs remain excluded even if they subsequently appear on disk. */
+	knownFailedEntryIds?: ReadonlySet<string>;
+}
+
+function record(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Own required metadata of a profile-family candidate, before serialization. */
+export function hasSessionProfileCandidateMetadata(value: unknown): boolean {
+	return (
+		record(value) && metadata(value) && Object.hasOwn(value, "customType")
+	);
+}
+function metadata(value: Record<string, unknown>): boolean {
+	return (
+		["type", "id", "parentId", "timestamp"].every((key) =>
+			Object.hasOwn(value, key),
+		) &&
+		typeString(value.type) &&
+		typeString(value.id) &&
+		typeString(value.timestamp) &&
+		(value.parentId === null || typeString(value.parentId))
+	);
+}
+function typeString(value: unknown): value is string {
+	return typeof value === "string" && value.length > 0;
+}
+function snapshot(value: unknown): unknown {
+	// Same undefined omission/toJSON behavior as Pi's JSONL serialization. Throws
+	// on cycles/BigInt; decoded copies cannot retain mutable memory references.
+	try {
+		return JSON.parse(JSON.stringify(value));
+	} catch {
+		throw new TypeError("Unserializable source snapshot");
+	}
+}
+function unavailable(
+	reason: DiskProfileIndeterminateReason,
+	lineNumber?: number): DiskProfileResult {
+	return lineNumber === undefined
+		? { status: "indeterminate", reason }
+		: { status: "indeterminate", reason, lineNumber };
+}
+
+/**
+ * Stateless synchronous read of the captured public active branch and file.
+ * No writes, SDK imports, UI, fallback policy, cache, ancestry repair or fsync.
+ * An orphan selected record can be corroborated: complete disk ancestry is NOT
+ * required. No external-writer/TOCTOU guarantee is implied by source checks.
+ * Missing disk is conservative and does not decide future memory-only activation.
+ */
+export function readSessionProfileDisk(
+	source: SessionProfileSource,
+	options: DiskProfileOptions = {},
+): DiskProfileResult {
+	try {
+		const sessionId = source.getSessionId();
+		const path = source.getSessionFile();
+		const rawBranch = source.getBranch();
+		if (!typeString(sessionId) || !typeString(path) || !Array.isArray(rawBranch))
+			return unavailable("missing-source");
+		// Validate own required candidate metadata before serialization can hide
+		// missing/inherited fields. Ordinary branch entries have no profile meaning.
+		for (const raw of rawBranch) {
+			if (
+				isSessionProfileFamilyEntry(raw) &&
+				!hasSessionProfileCandidateMetadata(raw)
+			)
+				return unavailable("invalid-candidate-metadata");
+		}
+		const branch = snapshot(rawBranch) as unknown[];
+		const failed = new Set(options.knownFailedEntryIds);
+		let entryIndex = -1;
+		for (let index = branch.length - 1; index >= 0; index--) {
+			const candidate = branch[index];
+			if (
+				isSessionProfileFamilyEntry(candidate) &&
+				!failed.has((candidate as { id?: unknown }).id as string)
+			) {
+				entryIndex = index;
+				break;
+			}
+		}
+		let text: string;
+		try {
+			text = (options.readFile ?? ((file) => readFileSync(file, "utf8")))(path);
+		} catch {
+			return unavailable("unreadable-file");
+		}
+		if (
+			source.getSessionId() !== sessionId ||
+			source.getSessionFile() !== path ||
+			!isDeepStrictEqual(snapshot(source.getBranch()), branch)
+		)
+			return unavailable("source-changed");
+		const disk = new Map<
+			string,
+			{ value: Record<string, unknown>; lineNumber: number }
+		>();
+		let foundHeader = false;
+		const lines = text.split("\n");
+		for (let index = 0; index < lines.length; index++) {
+			if (!lines[index].trim()) continue;
+			const lineNumber = index + 1;
+			let value: unknown;
+			try {
+				value = JSON.parse(lines[index]);
+			} catch {
+				// Pi's session parser skips malformed lines, so a file Pi opens must
+				// not become permanently indeterminate here.
+				continue;
+			}
+			if (!record(value)) return unavailable("invalid-record", lineNumber);
+			if (!foundHeader) {
+				if (value.type !== "session" || value.id !== sessionId)
+					return unavailable("session-header-mismatch", lineNumber);
+				foundHeader = true;
+				continue;
+			}
+			if (!metadata(value) || value.type === "session")
+				return unavailable("invalid-record", lineNumber);
+			if (disk.has(value.id as string) || value.id === sessionId)
+				return unavailable("duplicate-id", lineNumber);
+			disk.set(value.id as string, { value, lineNumber });
+		}
+		if (!foundHeader) return unavailable("missing-header");
+		if (entryIndex < 0) return { status: "absent" };
+		const selected = branch[entryIndex] as Record<string, unknown>;
+		const saved = disk.get(selected.id as string);
+		if (!saved) return unavailable("selected-record-missing");
+		if (!isDeepStrictEqual(selected, saved.value))
+			return unavailable("selected-record-mismatch", saved.lineNumber);
+		const semantic = readSessionProfileEntry({
+			type: selected.type as string,
+			customType: selected.customType as string,
+			data: selected.data,
+		});
+		return { ...semantic, entryIndex, lineNumber: saved.lineNumber };
+	} catch {
+		// Never expose exception messages or record contents (including getters).
+		return unavailable("unserializable-source");
+	}
+}

package/lib/session-profile-freeze.ts

@@ -27,9 +27,9 @@
 // `gentle-pi.session-profile/v1` entry with origin `local | repo | global` is
 // the integration point with slice 3b-i.
 import { createHash } from "node:crypto";
+import { normalizeModelConfig, type AgentModelConfig } from "./model-routing-authority.ts";
 import { profileRoleEntries, profilesFilePath, readProfilesFileResult } from "./agent-profiles.ts";
 import { readProfilePinStatus, resolveProfilePin, resolveUnversionedProjectProfile } from "./agent-profile-pin.ts";
-import type { AgentModelConfig } from "./model-routing-authority.ts";
 import { readSessionProfileBinding } from "./session-profile-binding.ts";
 import type { WorktreeIdentity, WorktreeResolver } from "./session-worktree-registry.ts";
 
@@ -242,6 +242,7 @@ function describe(profile: InheritedProfile | undefined): string {
  */
 export function inheritedProfileDriftNotice(options: SessionProfileOptions): string | undefined {
 	const resolution = resolveSessionProfile(options);
+	if (resolution.kind === "explicit") return bindingDefinitionDriftNotice(options, resolution);
 	if (resolution.kind !== "inherited") return undefined;
 	const current = resolveInheritedProfile(options);
 	const key = fingerprint(current);
@@ -254,6 +255,34 @@ export function inheritedProfileDriftNotice(options: SessionProfileOptions): str
 	return `el Gentleman: the default profile changed to ${describe(current)}, this session keeps ${describe(resolution.profile)}. Press Enter on a profile in /gentle:profiles to adopt it.`;
 }
 
+// gentle-shell#2228: an explicit binding re-copies the profile definition at
+// selection, so later edits to that entry in profiles.json no-op silently until
+// the operator re-Enters. The same once-per-change fingerprint machine as the
+// inherited notice names the drift; the comparison never adopts the edit.
+function bindingDefinitionDriftNotice(
+	options: SessionProfileOptions,
+	resolution: { kind: "explicit"; name: string; modelProfiles: AgentModelConfig },
+): string | undefined {
+	const file = readProfilesFileResult(profilesFilePath(options.configHome));
+	if (file.status !== "valid") return undefined;
+	const definition = file.file.profiles[resolution.name];
+	if (definition === undefined) return undefined;
+	// Both sides normalize through the store's own route normalizer: a bound
+	// snapshot taken from the panel holds normalized routes, while raw string
+	// forms from other callers must hash equal to the same definition.
+	const normalized = (config: AgentModelConfig) =>
+		Object.fromEntries(Object.entries(config).map(([agent, route]) => [agent, normalizeModelConfig(route)]));
+	const key = createHash("sha256").update(stableJson({ modelProfiles: normalized(definition) })).digest("hex");
+	const current = createHash("sha256").update(stableJson({ modelProfiles: normalized(resolution.modelProfiles) })).digest("hex");
+	if (key === current) return undefined;
+	const notified = registry().notified;
+	const seen = notified.get(options.sessionId!) ?? new Set<string>();
+	if (seen.has(key)) return undefined;
+	seen.add(key);
+	notified.set(options.sessionId!, seen);
+	return `el Gentleman: the profile definition changed to "${resolution.name}" (profiles.json), this session keeps the binding from selection. Press Enter on a profile in /gentle:profiles to adopt it.`;
+}
+
 /** Testing-only reset of every frozen snapshot and drift memory. */
 export function resetFrozenInheritedProfilesForTesting(): void {
 	registry().frozen.clear();

package/lib/session-profile-persistence.ts

@@ -11,7 +11,20 @@ import {
 } from "./model-routing-authority.ts";
 
 export const SESSION_PROFILE_CUSTOM_TYPE = "gentle-pi.session-profile/v1";
-const SESSION_PROFILE_FAMILY = "gentle-pi.session-profile/";
+export const SESSION_PROFILE_FAMILY = "gentle-pi.session-profile/";
+
+/** True for any custom entry in the session-profile family, known version or not. */
+export function isSessionProfileFamilyEntry(entry: unknown): boolean {
+	return (
+		typeof entry === "object" &&
+		entry !== null &&
+		(entry as { type?: unknown }).type === "custom" &&
+		typeof (entry as { customType?: unknown }).customType === "string" &&
+		(entry as { customType: string }).customType.startsWith(
+			SESSION_PROFILE_FAMILY,
+		)
+	);
+}
 
 export type SessionProfileOrigin = "user" | "local" | "repo" | "global";
 
@@ -148,12 +161,7 @@ export function createSessionProfileClear(): SessionProfileClearPayload {
 export function readSessionProfileEntry(
 	entry: SessionProfileEntry,
 ): SessionProfileReadResult {
-	if (
-		entry.type !== "custom" ||
-		typeof entry.customType !== "string" ||
-		!entry.customType.startsWith(SESSION_PROFILE_FAMILY)
-	)
-		return { status: "absent" };
+	if (!isSessionProfileFamilyEntry(entry)) return { status: "absent" };
 	if (entry.customType !== SESSION_PROFILE_CUSTOM_TYPE)
 		return { status: "unsupported" };
 	const data = entry.data;