envoy_ai 0.0.1 → 0.0.2

data/app/controllers/envoy/conversations_controller.rb

@@ -13,9 +13,6 @@ module Envoy
       @conversation.actor = envoy_current_actor
       @conversation.model_id ||= Envoy.config.default_model
       @conversation.provider = Envoy.config.provider.to_s
-      if (pid = params.dig(:conversation, :system_prompt_id)).present?
-        @conversation.system_prompt_version = Envoy::SystemPrompt.find(pid).latest_version
-      end
       if @conversation.save
         redirect_to conversation_path(@conversation)
       else
@@ -30,7 +27,7 @@ module Envoy
     private
 
     def conversation_params
-      params.require(:conversation).permit(:title, :model_id, :toolset_key, :system_prompt)
+      params.require(:conversation).permit(:title, :model_id, :toolset_key, :system_prompt, :prompt_key)
     end
   end
 end

data/app/controllers/envoy/panels_controller.rb

@@ -0,0 +1,30 @@
+module Envoy
+  class PanelsController < ApplicationController
+    # POST, not GET behind a lazy frame: this creates a record. The semantics
+    # genuinely are "create or resume", so one path serves open and reopen and a
+    # reopen always re-fetches a current transcript.
+    def create
+      surface = Envoy.surface(params.require(:surface))
+      conversation = find_or_resume(surface)
+      render partial: "envoy/panels/panel", locals: { conversation: conversation }
+    rescue Envoy::UnknownSurface
+      # surface and context_key arrive from the browser; only registered
+      # surfaces are addressable. Whether this ACTOR may see this SUBJECT is the
+      # surface's context block to enforce.
+      head :not_found
+    end
+
+    private
+
+    def find_or_resume(surface)
+      Conversation.find_or_create_by!(
+        actor: envoy_current_actor,
+        surface_key: surface.key,
+        context_key: params[:context_key].presence
+      ) do |conversation|
+        conversation.provider = Envoy.config.provider.to_s
+        conversation.model_id = surface.model_id || Envoy.config.default_model
+      end
+    end
+  end
+end

data/app/javascript/envoy/controllers/autoscroll_controller.js

@@ -1,46 +1,40 @@
 import { Controller } from "@hotwired/stimulus"
 
-// Wraps the message region. Keeps the window scrolled to the newest content as
-// it streams in. If the user scrolls away from the bottom, autoscroll pauses;
-// it resumes when they scroll back to the bottom or send a new message.
+// Sticks the transcript to the bottom as messages stream in, unless the reader
+// has scrolled up to read back.
+//
+// Scrolls its own log container rather than the window: in an embedded panel
+// the window is the host page, so scrolling it jumps the page the user is
+// reading AND never moves the panel.
 export default class extends Controller {
-  connect() {
-    this.stick = true
-
-    // Content changes (appends + streaming replaces) trigger a scroll-to-bottom.
-    this.observer = new MutationObserver(() => {
-      if (this.stick) this.toBottom()
-    })
-    this.observer.observe(this.element, {
-      childList: true, subtree: true, characterData: true
-    })
-
-    // wheel/touch are unambiguously user-initiated (our own scrollTo doesn't
-    // fire them), so use them to decide whether to keep sticking to the bottom.
-    this.onUserScroll = () => { this.stick = this.atBottom() }
-    window.addEventListener("wheel", this.onUserScroll, { passive: true })
-    window.addEventListener("touchmove", this.onUserScroll, { passive: true })
+  static targets = ["log"]
 
-    // A new message re-enables autoscroll for that response.
-    this.onSubmit = () => { this.stick = true; this.toBottom() }
-    document.addEventListener("turbo:submit-end", this.onSubmit)
-
-    this.toBottom()
+  connect() {
+    this.observer = new MutationObserver(() => this.stick())
+    this.observer.observe(this.scroller, { childList: true, subtree: true, characterData: true })
+    this.scrollToBottom()
   }
 
   disconnect() {
     this.observer?.disconnect()
-    window.removeEventListener("wheel", this.onUserScroll)
-    window.removeEventListener("touchmove", this.onUserScroll)
-    document.removeEventListener("turbo:submit-end", this.onSubmit)
   }
 
-  atBottom() {
-    const doc = document.documentElement
-    return window.innerHeight + window.scrollY >= doc.scrollHeight - 48
+  stick() {
+    if (this.atBottom) this.scrollToBottom()
+  }
+
+  scrollToBottom() {
+    this.scroller.scrollTop = this.scroller.scrollHeight
+  }
+
+  // A tolerance, because a streaming reply grows under the reader; without it
+  // one stray pixel would strand them mid-transcript for the rest of the turn.
+  get atBottom() {
+    const { scrollTop, clientHeight, scrollHeight } = this.scroller
+    return scrollHeight - (scrollTop + clientHeight) < 48
   }
 
-  toBottom() {
-    window.scrollTo({ top: document.documentElement.scrollHeight })
+  get scroller() {
+    return this.hasLogTarget ? this.logTarget : this.element
   }
 }

data/app/jobs/envoy/run_job.rb

@@ -1,6 +1,12 @@
 module Envoy
   class RunJob < ApplicationJob
-    STREAM_TARGET = "envoy_streaming_reply"
+    extend ActionView::RecordIdentifier
+
+    # Scoped per conversation: a flat constant meant two panels — or a panel and
+    # a console tab — would fight over the same target on one page.
+    def self.stream_target(conversation)
+      dom_id(conversation, :streaming)
+    end
 
     # GlobalID serialization of the Conversation (and its polymorphic actor)
     # is handled by ActiveJob automatically.
@@ -14,6 +20,12 @@ module Envoy
         stream(conversation, event)
       end
       finalize(conversation)
+    rescue StandardError
+      # Without this the panel sits on "working…" forever: nothing else ever
+      # replaces the streaming target. Re-raise so the queue still records the
+      # failure and any retry policy applies.
+      broadcast_error(conversation)
+      raise
     end
 
     private
@@ -28,9 +40,9 @@ module Envoy
       @streamed << payload.to_s
       Turbo::StreamsChannel.broadcast_replace_to(
         conversation, "messages",
-        target: STREAM_TARGET,
+        target: self.class.stream_target(conversation),
         partial: "envoy/messages/streaming",
-        locals: { content: @streamed }
+        locals: { content: @streamed, conversation: conversation }
       )
     end
 
@@ -44,7 +56,7 @@ module Envoy
 
       Turbo::StreamsChannel.broadcast_replace_to(
         conversation, "messages",
-        target: STREAM_TARGET,
+        target: self.class.stream_target(conversation),
         partial: "envoy/messages/message",
         collection: messages,
         as: :message
@@ -61,5 +73,14 @@ module Envoy
       scope = scope.where("id > ?", last_user_id) if last_user_id
       scope.to_a
     end
+
+    def broadcast_error(conversation)
+      Turbo::StreamsChannel.broadcast_replace_to(
+        conversation, "messages",
+        target: self.class.stream_target(conversation),
+        partial: "envoy/messages/error",
+        locals: { conversation: conversation }
+      )
+    end
   end
 end

data/app/models/envoy/conversation.rb

@@ -3,18 +3,45 @@ module Envoy
     acts_as_chat message_class: "Envoy::Message", tool_call_class: "Envoy::ToolCall"
 
     belongs_to :actor, polymorphic: true
-    belongs_to :system_prompt_version, class_name: "Envoy::SystemPromptVersion", optional: true
 
-    validates :model_id, :toolset_key, presence: true
+    validates :model_id, presence: true
+    validate :toolset_or_surface_present
+
+    # Embed conversations resolve everything through their surface, so editing a
+    # surface reaches chats that already exist. Console conversations have no
+    # surface and fall back to their own columns.
+    def surface
+      surface_key.present? ? Envoy.surface(surface_key) : nil
+    end
 
     def toolset
-      Envoy.toolset(toolset_key)
+      Envoy.toolset(surface&.toolset_key || toolset_key)
+    end
+
+    def resolved_model_id
+      surface&.model_id || model_id || Envoy.config.default_model
+    end
+
+    def prompt_body
+      return surface.prompt_body if surface
+      prompt_key.present? ? Envoy.prompt(prompt_key).full_body : nil
     end
 
-    # Version body (if pinned) is primary; custom text (if any) is appended as
-    # chat-specific context. Either stands alone; both compose; neither -> nil.
+    # A surface may pin a chat read-only; so may the conversation's own status.
+    def read_only?
+      status == "read_only" || !!surface&.read_only?
+    end
+
+    # Per-conversation ad-hoc instructions, appended last by Runner.
     def effective_system_prompt
-      [ system_prompt_version&.body, system_prompt ].compact_blank.join("\n\n").presence
+      system_prompt.presence
+    end
+
+    private
+
+    def toolset_or_surface_present
+      return if toolset_key.present? || surface_key.present?
+      errors.add(:base, "toolset_key or surface_key must be present")
     end
   end
 end

data/app/views/envoy/conversations/_composer_input.html.erb

@@ -1,4 +1,4 @@
 <%= text_area_tag "message[content]", nil,
-      id: "envoy_composer_input", rows: 2, autofocus: true,
+      id: dom_id(conversation, :composer), rows: 2, autofocus: true,
       class: "envoy-input",
       data: { controller: "envoy-composer", action: "keydown.enter->envoy-composer#submit" } %>

data/app/views/envoy/conversations/index.html.erb

@@ -1,8 +1,6 @@
 <div class="envoy-header-row envoy-mb-4">
   <h1 class="envoy-title">Envoy chats</h1>
   <div class="envoy-btn-group">
-    <%= link_to "System prompts", system_prompts_path,
-          class: "envoy-btn envoy-btn--secondary" %>
     <%= link_to "New chat", new_conversation_path,
           class: "envoy-btn" %>
   </div>

data/app/views/envoy/conversations/new.html.erb

@@ -5,14 +5,8 @@
     <%= f.text_field :title, placeholder: "Title (optional)", class: field %>
     <%= f.select :toolset_key, Envoy.toolsets.keys, {}, class: field %>
     <%= f.select :model_id, Envoy.config.available_models, {}, class: field %>
-    <div>
-      <label class="envoy-label">Saved system prompt</label>
-      <%= select_tag "conversation[system_prompt_id]",
-            options_for_select([["None", ""]] + Envoy::SystemPrompt.order(:name).map { |p| [p.name, p.id] }),
-            class: field %>
-    </div>
     <%= f.text_area :system_prompt, rows: 4,
-          placeholder: "Additional instructions (optional) — appended to the selected saved prompt, or used alone as a custom prompt",
+          placeholder: "Additional instructions (optional)",
           class: field %>
     <%= f.submit "Start", class: "envoy-btn" %>
   </div>

data/app/views/envoy/conversations/show.html.erb

@@ -1,18 +1,2 @@
-<%= turbo_stream_from @conversation, "messages" %>
 <h1 class="envoy-title--sm envoy-mb-3"><%= @conversation.title.presence || "Chat ##{@conversation.id}" %></h1>
-
-<div data-controller="envoy-autoscroll">
-  <div id="envoy_messages" class="envoy-stack envoy-mb-4">
-    <% @conversation.messages.where(role: %w[user assistant]).each do |message| %>
-      <%= render "envoy/messages/message", message: message %>
-    <% end %>
-  </div>
-</div>
-
-<%= form_with url: conversation_messages_path(@conversation), method: :post do |f| %>
-  <div class="envoy-composer">
-    <%= render "envoy/conversations/composer_input" %>
-    <%= f.submit "Send", class: "envoy-btn" %>
-  </div>
-  <p class="envoy-hint">Enter to send · Shift/Option+Enter for a new line</p>
-<% end %>
+<%= render "envoy/panels/transcript", conversation: @conversation %>

data/app/views/envoy/messages/_error.html.erb

@@ -0,0 +1,6 @@
+<div id="<%= Envoy::RunJob.stream_target(conversation) %>">
+  <div class="envoy-msg envoy-msg--assistant envoy-error">
+    <div class="envoy-msg__role">assistant</div>
+    <div class="envoy-md">Something went wrong on my side — your message was not answered. Try again.</div>
+  </div>
+</div>

data/app/views/envoy/messages/_streaming.html.erb

@@ -1,4 +1,4 @@
-<div id="envoy_streaming_reply">
+<div id="<%= Envoy::RunJob.stream_target(conversation) %>">
   <div class="envoy-msg envoy-msg--assistant">
     <div class="envoy-msg__role">assistant</div>
     <div class="envoy-md"><%= Envoy::Markdown.render(content) %></div>

data/app/views/envoy/messages/create.turbo_stream.erb

@@ -1,7 +1,7 @@
 <%# Append the user message, then a fresh streaming target — both into the ordered
     message list so the assistant reply commits in place and the next turn appends
     after it (fixes cross-turn ordering). %>
-<%= turbo_stream.append "envoy_messages" do %>
+<%= turbo_stream.append dom_id(@conversation, :messages) do %>
   <div class="envoy-msg">
     <div class="envoy-msg__role">user</div>
     <div class="envoy-md"><%= Envoy::Markdown.render(@user_content) %></div>
@@ -10,8 +10,8 @@
 <%# The streaming target starts with a subtle "working…" indicator so there is a
     live sign of activity before the first token (e.g. during tool calls, which
     emit no text deltas). The first delta / finalize replaces this. %>
-<%= turbo_stream.append "envoy_messages" do %>
-  <div id="envoy_streaming_reply">
+<%= turbo_stream.append dom_id(@conversation, :messages) do %>
+  <div id="<%= Envoy::RunJob.stream_target(@conversation) %>">
     <div class="envoy-msg envoy-msg--assistant">
       <div class="envoy-msg__role">assistant</div>
       <div class="envoy-working envoy-muted">working…</div>
@@ -20,6 +20,6 @@
 <% end %>
 <%# Clear the composer by replacing it with a fresh, empty textarea (server-driven,
     so it works even if the Stimulus controller didn't load). %>
-<%= turbo_stream.replace "envoy_composer_input" do %>
-  <%= render "envoy/conversations/composer_input" %>
+<%= turbo_stream.replace dom_id(@conversation, :composer) do %>
+  <%= render "envoy/conversations/composer_input", conversation: @conversation %>
 <% end %>

data/app/views/envoy/panels/_panel.html.erb

@@ -0,0 +1,3 @@
+<%= turbo_frame_tag "envoy_panel" do %>
+  <%= render "envoy/panels/transcript", conversation: conversation %>
+<% end %>

data/app/views/envoy/panels/_transcript.html.erb

@@ -0,0 +1,21 @@
+<%# The single definition of a chat transcript, used by both the embedded panel
+    and the full-page console. Ids are conversation-scoped so more than one may
+    live on a page. Styling is CSS-var driven — the host owns the chrome. %>
+<%= turbo_stream_from conversation, "messages" %>
+
+<div class="envoy-chat" data-controller="envoy-autoscroll">
+  <div id="<%= dom_id(conversation, :messages) %>" class="envoy-stack envoy-chat__log"
+       data-envoy-autoscroll-target="log">
+    <% conversation.messages.where(role: %w[user assistant]).each do |message| %>
+      <%= render "envoy/messages/message", message: message %>
+    <% end %>
+  </div>
+
+  <%= form_with url: conversation_messages_path(conversation), method: :post do |f| %>
+    <div class="envoy-composer">
+      <%= render "envoy/conversations/composer_input", conversation: conversation %>
+      <%= f.submit "Send", class: "envoy-btn" %>
+    </div>
+    <p class="envoy-hint">Enter to send · Shift/Option+Enter for a new line</p>
+  <% end %>
+</div>

data/config/routes.rb

@@ -1,7 +1,7 @@
 Envoy::Engine.routes.draw do
+  resource :panel, only: :create
   resources :conversations, only: %i[index new create show] do
     resources :messages, only: :create
   end
-  resources :system_prompts, except: :destroy
   root to: "conversations#index"
 end

data/db/migrate/20260716000001_drop_envoy_system_prompts.rb

@@ -0,0 +1,12 @@
+class DropEnvoySystemPrompts < ActiveRecord::Migration[8.1]
+  def change
+    # The DB-backed prompt store never held a row and its controller was the one
+    # unscoped surface in the engine. Prompts are program behaviour and now live
+    # in the DSL registry, versioned by git.
+    remove_reference :envoy_conversations, :system_prompt_version, foreign_key: false, index: true
+    add_column :envoy_conversations, :prompt_key, :string
+
+    drop_table :envoy_system_prompt_versions
+    drop_table :envoy_system_prompts
+  end
+end

data/db/migrate/20260716000002_add_surface_to_envoy_conversations.rb

@@ -0,0 +1,15 @@
+class AddSurfaceToEnvoyConversations < ActiveRecord::Migration[8.1]
+  def change
+    add_column :envoy_conversations, :surface_key, :string
+    add_column :envoy_conversations, :context_key, :string
+    change_column_null :envoy_conversations, :toolset_key, true
+
+    # Resumption is a uniqueness rule, so let the database hold it rather than a
+    # racy find_or_create_by. Partial: console conversations have no surface and
+    # must stay unconstrained.
+    add_index :envoy_conversations,
+              %i[actor_type actor_id surface_key context_key],
+              unique: true, where: "surface_key IS NOT NULL",
+              name: "index_envoy_conversations_on_surface_subject"
+  end
+end

data/lib/envoy/engine.rb

@@ -15,5 +15,11 @@ module Envoy
       app.config.assets.paths << root.join("app/javascript") if app.config.respond_to?(:assets)
       app.config.assets.paths << root.join("app/assets/stylesheets") if app.config.respond_to?(:assets)
     end
+
+    initializer "envoy.page_surface" do
+      ActiveSupport.on_load(:action_controller_base) do
+        include Envoy::PageSurface
+      end
+    end
   end
 end

data/lib/envoy/errors.rb

@@ -3,4 +3,8 @@ module Envoy
   class Forbidden < Error; end
   class UnknownToolset < Error; end
   class ToolsetCycle < Error; end
+  class UnknownPrompt < Error; end
+  class PromptCycle < Error; end
+  class UnknownSurface < Error; end
+  class UnknownLibrary < Error; end
 end

data/lib/envoy/guard.rb

@@ -5,7 +5,9 @@ module Envoy
     # Runs a tool definition's perform block, translating exceptions into
     # model-legible results. Never raises for expected failures.
     def run(definition, actor:, args:)
-      value = definition.perform_block.call(actor: actor, **args.symbolize_keys)
+      args = args.symbolize_keys
+      validate_enums!(definition, args)
+      value = definition.perform_block.call(actor: actor, **args)
       if value.is_a?(Hash) && value[:error]
         { value: value, status: :failed }
       else
@@ -24,5 +26,15 @@ module Envoy
     def failure(type, message, status)
       { value: { error: message, type: type }, status: status }
     end
+
+    # A closed vocabulary is a contract: reject an unknown value with the valid
+    # list rather than letting the perform block improvise on a hallucinated key.
+    def validate_enums!(definition, args)
+      args.each do |name, value|
+        allowed = definition.enum_for(name)
+        next if allowed.nil? || allowed.include?(value.to_s)
+        raise ArgumentError, "#{name} must be one of: #{allowed.join(', ')} (got #{value.inspect})"
+      end
+    end
   end
 end

data/lib/envoy/library.rb

@@ -0,0 +1,82 @@
+module Envoy
+  # A set of reference documents the model can pull on demand.
+  #
+  # Progressive disclosure: preloading every reference doc costs thousands of
+  # tokens on turns that never need them. A library puts a short index in the
+  # instructions and hands the model one tool to fetch a document when the task
+  # actually calls for it.
+  #
+  # Compiles to an ordinary Toolset, so it composes via `use`, merges its
+  # description into instructions, and honours read_only — all for free.
+  class Library
+    attr_reader :key
+
+    def initialize(key)
+      @key = key.to_s
+      @description = ""
+      @documents = {} # slug => { summary:, body: callable }
+    end
+
+    def description(text = nil)
+      return rendered_description if text.nil?
+      @description = text
+    end
+
+    # Register one document. The block is the lazy body.
+    def document(slug, summary = nil, &block)
+      @documents[slug.to_s] = { summary: summary, body: block }
+    end
+
+    # Ingest a directory of markdown: README.md becomes the description, every
+    # other *.md becomes a document keyed by its slug. Flat, non-recursive.
+    #
+    # No markdown parsing: a README that documents its own directory already
+    # carries the human-written index, and the tool's enum carries the
+    # machine-readable key list. Explicit `document` calls win over files.
+    def directory(path)
+      path = Pathname(path)
+      readme = path.join("README.md")
+      @description = readme.read if readme.exist?
+
+      path.glob("*.md").sort.each do |file|
+        slug = file.basename(".md").to_s
+        next if slug.casecmp("README").zero?
+        @documents[slug] ||= { summary: nil, body: -> { file.read } }
+      end
+    end
+
+    def document_keys
+      @documents.keys.sort
+    end
+
+    def read(slug)
+      entry = @documents[slug.to_s]
+      raise ArgumentError, "no document #{slug.inspect}" unless entry
+      entry[:body].call
+    end
+
+    # The description plus an index of any documents that carry their own
+    # summary. Directory-ingested docs are indexed by the README itself, so
+    # listing them again would just duplicate it.
+    def rendered_description
+      summarised = @documents.select { |_, entry| entry[:summary].present? }
+      return @description if summarised.empty?
+
+      index = summarised.map { |slug, entry| "  #{slug} — #{entry[:summary]}" }
+      [ @description, "Also available:", *index ].compact_blank.join("\n")
+    end
+
+    def to_toolset
+      library = self
+      toolset = Envoy::Toolset.new(key)
+      toolset.description(rendered_description)
+      toolset.tool("read_#{key}") do
+        description "Read one #{library.key} reference document in full."
+        access :read
+        param :key, "Which document to read.", enum: library.document_keys
+        perform { |actor:, key:| library.read(key) }
+      end
+      toolset
+    end
+  end
+end

data/lib/envoy/llm.rb

@@ -11,7 +11,7 @@ module Envoy
     # (lib/ruby_llm/active_record/chat_methods.rb and lib/ruby_llm/chat.rb).
     def run(content:, tools:, instructions:)
       chat = @conversation
-        .with_model(@conversation.model_id,
+        .with_model(@conversation.resolved_model_id,
                     provider: Envoy.config.provider,
                     assume_exists: true)
         .with_instructions(instructions)

data/lib/envoy/page_surface.rb

@@ -0,0 +1,34 @@
+module Envoy
+  # Declares which surface a page opens a chat against.
+  #
+  #   class TodayController < ApplicationController
+  #     envoy_surface :today, context_key: -> { "day:#{@date.to_fs(:iso8601)}" }
+  #   end
+  #
+  # The context_key lambda is instance_exec'd in the controller, so instance
+  # variables set by the action are in scope. Pages that do not declare a
+  # surface get no bubble — opt-in by default.
+  module PageSurface
+    extend ActiveSupport::Concern
+
+    included do
+      class_attribute :envoy_surface_config, instance_writer: false, default: nil
+      helper_method :envoy_page_surface
+    end
+
+    class_methods do
+      def envoy_surface(key, context_key: nil)
+        self.envoy_surface_config = { key: key.to_s, context_key: context_key }
+      end
+    end
+
+    # Nil when the controller never declared one — the layout renders nothing.
+    def envoy_page_surface
+      config = envoy_surface_config
+      return nil if config.nil?
+
+      { surface: config[:key],
+        context_key: config[:context_key] && instance_exec(&config[:context_key]) }
+    end
+  end
+end

data/lib/envoy/prompt.rb

@@ -0,0 +1,55 @@
+module Envoy
+  # A named block of system-prompt text, composable like a Toolset.
+  #
+  # Prompts are code, not data: git is the version store. Bodies may be a String
+  # or a block; a block stays lazy so a host reading from disk picks up edits on
+  # `to_prepare` reload without a boot.
+  class Prompt
+    attr_reader :key
+
+    def initialize(key)
+      @key = key.to_s
+      @body = nil
+      @composed_keys = []
+    end
+
+    # Setter with text or a block; reader (no args) returns this prompt's own
+    # resolved body only. Use #full_body for the composed result.
+    def body(text = nil, &block)
+      return own_body if text.nil? && block.nil?
+      @body = block || text
+    end
+
+    # Compose other prompts into this one. Keys resolve lazily (at full_body
+    # time), so definition load order does not matter.
+    def use(*keys)
+      @composed_keys.concat(keys.map(&:to_s))
+    end
+
+    # Composed bodies first, then this prompt's own — so shared framing (safety
+    # rules, draft status) precedes the specialisation that builds on it.
+    def full_body
+      collect_bodies.compact_blank.join("\n\n").presence
+    end
+
+    protected
+
+    def collect_bodies(seen = [])
+      guard_cycle!(seen)
+      bodies = @composed_keys.flat_map { |k| Envoy.prompt(k).collect_bodies(seen + [ key ]) }
+      bodies << own_body
+      bodies
+    end
+
+    private
+
+    def own_body
+      @body.respond_to?(:call) ? @body.call : @body
+    end
+
+    def guard_cycle!(seen)
+      return unless seen.include?(key)
+      raise Envoy::PromptCycle, "prompt composition cycle: #{(seen + [ key ]).join(' -> ')}"
+    end
+  end
+end