samagotchi 0.102.0 → 0.103.0

data/lib/samagotchi/bridge_client.rb

@@ -5,8 +5,10 @@ require "socket"
 
 require_relative "worker_sidecar"
 require_relative "delivery"
+require_relative "chi_invocation"
 require_relative "bridge_client/sse_parser"
 require_relative "bridge_client/event_stream"
+require_relative "bridge_client/stream_request"
 
 module Samagotchi
   # Client side of a session worker's Bridge: the 127.0.0.1 HTTP + SSE server
@@ -19,7 +21,7 @@ module Samagotchi
   class BridgeClient
     HOST = "127.0.0.1"
     # A reply's status line; its code is group 1.
-    STATUS_LINE = %r{\AHTTP/1\.[01] (\d{3})}
+    STATUS_LINE = StreamRequest::STATUS_LINE
     STREAM_CONNECT_ATTEMPTS = 3
     # Seconds #stream waits for the Bridge's response headers, per attempt:
     # a worker that took the connection and froze must not hold the web's
@@ -54,9 +56,16 @@ module Samagotchi
     # What a UI says when the Bridge answers a route with 404: the worker runs
     # code from before the route. Restarting it picks up the installed chi.
     # @param cant [String] what the old worker can't do, e.g. "run commands"
-    def self.stale_worker_message(session_id, cant:)
-      "this session's worker runs an older chi and can't #{cant}; " \
-        "restart it: chi sessions stop #{session_id} && chi --resume #{session_id} (its turns still work)"
+    # @param via [ChiInvocation] how the commands are spelled (chi --remote
+    #   NAME: no --resume there, a message starts the fresh worker)
+    def self.stale_worker_message(session_id, cant:, via: ChiInvocation::HERE)
+      stop = via.command("sessions stop #{session_id}")
+      restart = if via.remote?
+                  "#{stop}, then a message (#{via.command("send #{session_id} -m …")}) starts a fresh one"
+                else
+                  "#{stop} && chi --resume #{session_id}"
+                end
+      "this session's worker runs an older chi and can't #{cant}; restart it: #{restart} (its turns still work)"
     end
 
     # Port of the live Bridge advertised in +session_dir+'s sidecar, or nil.
@@ -103,6 +112,10 @@ module Samagotchi
 
     attr_reader :session_id, :port, :host
 
+    # Which worker this client talks to, for EventStream: a rediscovered
+    # client with another key is a new worker. A Bridge's port.
+    def worker_key = @port
+
     # @param read_timeout [Numeric] see READ_TIMEOUT
     def initialize(session_id:, port:, host: HOST, read_timeout: READ_TIMEOUT)
       @session_id = session_id
@@ -332,45 +345,16 @@ module Samagotchi
 
     # Open GET /session/:id/stream and read past the response headers.
     # @param timeout [Float, nil] give up when the headers aren't all in by then
-    # @return [Array(TCPSocket, Integer), nil] the socket positioned at the
-    #   body and the HTTP status, or nil when the Bridge can't be reached
+    # @return [Array(TCPSocket, Integer, Hash), nil] the socket positioned
+    #   at the body, the HTTP status and the headers (StreamRequest.open), or
+    #   nil when the Bridge can't be reached
     def connect_stream(query: "", last_event_id: nil, timeout: nil)
-      sock = TCPSocket.new(@host, @port)
-      lei = last_event_id.to_s.strip
-      last_event_line = lei.empty? ? "" : "Last-Event-ID: #{lei}\r\n"
-      sock.write("GET /session/#{@session_id}/stream#{query} HTTP/1.1\r\nHost: #{@host}:#{@port}\r\nAccept: text/event-stream\r\n#{last_event_line}Connection: keep-alive\r\n\r\n")
-      deadline = timeout && (Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout)
-      status = header_line(sock, deadline).to_s[STATUS_LINE, 1].to_i
-      while (line = header_line(sock, deadline))
-        break if line.strip.empty?
-      end
-      [sock, status]
-    rescue SystemCallError, SocketError, IOError
-      sock&.close rescue nil
-      nil
+      StreamRequest.open(host: @host, port: @port, path: "/session/#{@session_id}/stream#{query}",
+                         last_event_id: last_event_id, timeout: timeout)
     end
 
     private
 
-    # One line of the response headers, or nil at EOF; raises
-    # Errno::ETIMEDOUT once +deadline+ (monotonic, nil: none) has passed. A
-    # line read in pieces, so a Bridge that stops mid-line can't hold it.
-    def header_line(sock, deadline)
-      return sock.gets unless deadline
-
-      line = +""
-      loop do
-        remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        raise Errno::ETIMEDOUT unless remaining.positive? && sock.wait_readable(remaining)
-
-        char = sock.getc
-        return line.empty? ? nil : line if char.nil?
-
-        line << char
-        return line if char == "\n"
-      end
-    end
-
     # When this client stops waiting for a reply, as epoch seconds (see
     # DEADLINE_SHARE). Wall clock: the worker runs on this machine and reads
     # the same one.

data/lib/samagotchi/bundles/claude-peer/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: claude-peer
-version: 0.4.1
+version: 0.4.2
 scope: system
 description: "Pair this session with a Claude Code session you work with: the claude_send tool and /claude send it a part of the work (a plan step, a diff, a finding) to validate or as context, and Claude's answer comes back as the claude-outbox context; /claude install-skill installs Claude's chi-peer skill, which pairs"
 trust_level: reviewed
@@ -12,7 +12,7 @@ plugin:
   file: plugin.rb
   sha256: sha256:50f427d3862ae9d0d15693b4d887c528162b96c0320cc663df89d59d830d4660
 scripts:
-  pair: sha256:35f3be2b466a5ba07591d64040bc5780fdd843b9b08737f8ea8a2fccb2102832
+  pair: sha256:2e66103c43fce5eab05f897682ba943f394743c1ad47bf439be3ce529f1b2058
   chi-peer-SKILL.md: sha256:e991a91139a127a60f9a216043eb5864945fb211952a1e3c8db2068c6cc254f1
 # The plugin needs Samagotchi::Plugin::Peer and chi.peer_source (chi 0.67.0).
 # An agreeing answer's closing wake (the skills say an OK wakes chi once)

data/lib/samagotchi/bundles/claude-peer/scripts/pair

@@ -8,7 +8,9 @@
 # is this session's inbox socket (chi's claude_send tool writes there), and
 # claude-outbox, where Claude's answers go. Again after a Claude restart, it
 # only refreshes the socket: the push carries the new hint. CHI names the chi
-# command (default: chi on the PATH).
+# command (default: chi on the PATH). Through a remote (CHI_REMOTE, or
+# --remote NAME in CHI) chi there can't reach this machine's socket: it
+# attaches claude-outbox only, and says so.
 set -eu
 
 usage() {
@@ -33,6 +35,23 @@ if [ -z "$sock" ]; then
 fi
 chi=${CHI:-chi}
 
+# The remote, as SessionAccess::Dispatch names it: a --remote NAME (or
+# --remote=NAME) word in CHI, the last one, beats CHI_REMOTE (trimmed; blank:
+# local). An empty or dash-led name is still a remote: chi refuses it.
+remote=$(printf '%s\n' "${CHI_REMOTE:-}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
+via= take=
+[ -z "$remote" ] || via=env
+for word in $chi; do
+  if [ -n "$take" ]; then
+    remote=$word take=
+    continue
+  fi
+  case "$word" in
+    --remote) remote= via=chi take=1 ;;
+    --remote=*) remote=${word#--remote=} via=chi ;;
+  esac
+done
+
 # A JSON string: backslashes, quotes, tabs and newlines escaped.
 json() {
   printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/	/\\t/g' |
@@ -51,6 +70,16 @@ attach() {
   fi
 }
 
+if [ -n "$via" ]; then
+  attach claude-outbox --why "Claude's answers to what you sent it (claude-peer); Claude runs on another machine: claude_send can't reach it" \
+    --hint "latest Claude reply"
+  ask=$chi
+  [ "$via" = chi ] || ask="CHI_REMOTE=$remote $chi"
+  printf '%s\n' "pair: chi is on $remote, so chi can't send to this Claude session (claude_send needs its socket on chi's machine): paired with chi $id, claude-outbox only. Answer chi with $ask context push claude-outbox $id; chi's replies reach you only when the user relays them (or asks you to run $ask send --wait $id)"
+  $chi context ls "$id"
+  exit 0
+fi
+
 attach claude-inbox --why "the Claude Code session paired with you: send it parts with claude_send" --hint "$sock"
 text="Claude Code peer inbox
 socket: $sock

data/lib/samagotchi/bundles/codex-peer/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: codex-peer
-version: 0.3.2
+version: 0.3.3
 scope: system
 description: "Pair this session with an OpenAI Codex CLI session you work with: the codex_send tool and /codex send it a part of the work (a plan step, a diff, a finding) to validate or as context, with codex queue, and Codex's answer comes back as the codex-outbox context; /codex install-skill installs Codex's chi-peer skill, which pairs"
 trust_level: reviewed
@@ -12,7 +12,7 @@ plugin:
   file: plugin.rb
   sha256: sha256:b03465566272891237ac1906980ff6956579a4703d3a42c414ce50a81de551f6
 scripts:
-  pair: sha256:251448a31959b5c916400eff7909e85c696855d5c16b6b10973ada40915c8051
+  pair: sha256:0830dcb856debea0e4a2a0eb0da8a73b9e9ac2444da957d2928ec734280186a1
   chi-peer-SKILL.md: sha256:7c392ac04c115ea1e762ad562b5c4c44c3eca71558ba5d9dfeaeabdd533b6a82
 # The plugin needs Samagotchi::Plugin::Peer and chi.peer_source (chi 0.67.0).
 # An agreeing answer's closing wake (the skills say an OK wakes chi once)

data/lib/samagotchi/bundles/codex-peer/scripts/pair

@@ -9,12 +9,15 @@
 # `codex queue --thread <id>` with it), and codex-outbox, where Codex's
 # answers go. Again later, it only refreshes the thread id: the push carries
 # the new hint. CHI names the chi command (default: chi on the PATH).
+# Through a remote (CHI_REMOTE, or --remote NAME in CHI) chi there can't
+# queue to this machine's Codex: it attaches codex-outbox only, and says so.
 #
 # chi writes the session's context under its state folder, which Codex's
 # default sandbox doesn't let it write: ~/.codex/config.toml needs
 #   [sandbox_workspace_write]
 #   writable_roots = ["<state>/samagotchi/context"]
-# and a write refused says so.
+# and a write refused says so. Through a remote chi talks HTTP instead,
+# which the sandbox may refuse (no network): a connection that fails says so.
 set -eu
 
 usage() {
@@ -39,14 +42,46 @@ if [ -z "$thread" ]; then
 fi
 chi=${CHI:-chi}
 
-# Prints chi's error, and the writable_roots line when the sandbox refused.
+# The remote, as SessionAccess::Dispatch names it: a --remote NAME (or
+# --remote=NAME) word in CHI, the last one, beats CHI_REMOTE (trimmed; blank:
+# local). An empty or dash-led name is still a remote: chi refuses it.
+remote=$(printf '%s\n' "${CHI_REMOTE:-}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
+via= take=
+[ -z "$remote" ] || via=env
+for word in $chi; do
+  if [ -n "$take" ]; then
+    remote=$word take=
+    continue
+  fi
+  case "$word" in
+    --remote) remote= via=chi take=1 ;;
+    --remote=*) remote=${word#--remote=} via=chi ;;
+  esac
+done
+
+config='~/.codex/config.toml'
+[ -z "${CODEX_HOME:-}" ] || config=$CODEX_HOME/config.toml
+
+# Prints chi's error, and the config line when the sandbox may have refused:
+# writable_roots here, network_access through a remote.
 fail() {
   printf '%s\n' "$1" >&2
+  if [ -n "$via" ]; then
+    case "$1" in
+      *"connection broke"* | *"can't find host"* | *"host unreachable"* | *"no answer within"*)
+        cat >&2 <<MSG
+pair: Codex's sandbox may be keeping chi from reaching $remote (workspace-write has no network by default): if so, add to $config
+  [sandbox_workspace_write]
+  network_access = true
+then restart Codex and pair again.
+MSG
+        ;;
+    esac
+    exit 1
+  fi
   case "$1" in
     *"Operation not permitted"* | *"Read-only file system"* | *"Permission denied"*)
       state=${XDG_STATE_HOME:-$HOME/.local/state}
-      config='~/.codex/config.toml'
-      [ -z "${CODEX_HOME:-}" ] || config=$CODEX_HOME/config.toml
       cat >&2 <<MSG
 pair: Codex's sandbox can't write chi's state: add to $config
   [sandbox_workspace_write]
@@ -75,6 +110,16 @@ attach() {
   fi
 }
 
+if [ -n "$via" ]; then
+  attach codex-outbox --why "Codex's answers to what you sent it (codex-peer); Codex runs on another machine: codex_send can't reach it" \
+    --hint "latest Codex reply"
+  ask=$chi
+  [ "$via" = chi ] || ask="CHI_REMOTE=$remote $chi"
+  printf '%s\n' "pair: chi is on $remote, so chi can't send to this Codex session (codex_send runs codex queue on chi's machine): paired with chi $id, codex-outbox only. Answer chi with $ask context push codex-outbox $id; chi's replies reach you only when the user relays them (or asks you to run $ask send --wait $id)"
+  $chi context ls "$id"
+  exit 0
+fi
+
 attach codex-inbox --why "the Codex session paired with you: send it parts with codex_send" --hint "$thread"
 text="Codex peer inbox
 thread: $thread

data/lib/samagotchi/bundles/guardrails/guardrails/rules.yml

@@ -154,10 +154,12 @@ rules:
   # code). add NAME --push and chi context push don't run anything. Quoted
   # words ("context", '--cmd=…') and backslash-newline continuations still
   # match; xargs chi context add asks whatever it is fed (its arguments
-  # aren't in the command).
+  # aren't in the command). chi's global flag --remote NAME (the only one
+  # that goes before a subcommand) may stand between chi and context;
+  # CHI_REMOTE=NAME leaves the words as they are.
   - id: chi-context-cmd
     tool: shell
-    command: '\bchi["'']?[\s\\]+["'']?context["'']?[\s\\]+["'']?add\b(?:[^\n]|\\\n)*[\s"''\\]--cmd(?:[\s="''\\]|$)|\bxargs\b[^;&|\n]*\bchi["'']?[\s\\]+["'']?context["'']?[\s\\]+["'']?add\b'
+    command: '\bchi["'']?(?:[\s\\]+["'']?--remote(?:=|["'']?[\s\\]+["'']?)[^\s"''\\;&|]+["'']?)*[\s\\]+["'']?context["'']?[\s\\]+["'']?add\b(?:[^\n]|\\\n)*[\s"''\\]--cmd(?:[\s="''\\]|$)|\bxargs\b[^;&|\n]*\bchi["'']?(?:[\s\\]+["'']?--remote(?:=|["'']?[\s\\]+["'']?)[^\s"''\\;&|]+["'']?)*[\s\\]+["'']?context["'']?[\s\\]+["'']?add\b'
     verdict: ask
     scopes: [once]
     reason: attaches a command chi will run every few minutes, outside the guardrails
@@ -165,10 +167,11 @@ rules:
   # ── chi broadcast: for the user, not an agent ─────────────────────────
   # chi broadcast refuses to run inside a session (SAMAGOTCHI_PARENT_SESSION
   # is set there), but an agent can unset that; this asks every time, and
-  # only the user may allow it. Quoted words and continuations still match.
+  # only the user may allow it. Quoted words, continuations and --remote
+  # NAME before the word still match.
   - id: chi-broadcast
     tool: shell
-    command: '\bchi["'']?[\s\\]+["'']?broadcast\b'
+    command: '\bchi["'']?(?:[\s\\]+["'']?--remote(?:=|["'']?[\s\\]+["'']?)[^\s"''\\;&|]+["'']?)*[\s\\]+["'']?broadcast\b'
     verdict: ask
     scopes: [once]
     reason: shares a note with every session it may concern; chi broadcast is for the user, not an agent

data/lib/samagotchi/bundles/guardrails/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: guardrails
-version: 0.9.2
+version: 0.9.3
 scope: system
 description: Optional default guardrail rules (git push/rewrites, rm -rf wide, curl | sh, git hooks, chi's own config and attached context from the shell, chi context add --cmd, chi broadcast, answering chi around chi answer, removing a memory, writing a memory that reaches the system prompt (identity, model notes) or a model overlay; in strict mode also git rebase and writes and git in another checkout outside the session's repo), asks only small models get (git checkout --/restore, git stash drop), and a note for the model
 trust_level: reviewed

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.102.0
+version: 0.103.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/chi_invocation.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  # How the follow-up commands chi prints (ParentReport's chi answer and
+  # chi send --wait, a stop's chi --resume) are spelled so that they work
+  # when pasted: on this machine plain chi, against a remote (chi --remote
+  # NAME, CHI_REMOTE=NAME alike) chi --remote NAME. What runs on this
+  # machine only (--attach, --resume: remote attach is its own phase) has
+  # no remote form: #attach and #resume are nil there, and #open_it and
+  # #shows name the remote's chi web instead.
+  # @!attribute remote [String, nil] the remote's name; nil: this machine
+  ChiInvocation = Data.define(:remote) do
+    def remote? = !remote.nil?
+
+    # The command word: "chi", or "chi --remote NAME".
+    def chi = remote? ? "chi --remote #{remote}" : "chi"
+
+    # +words+ after #chi: command("answer ID …").
+    def command(words) = "#{chi} #{words}"
+
+    # chi --attach ID; nil remotely.
+    def attach(id) = ("chi --attach #{id}" unless remote?)
+
+    # chi --resume ID; nil remotely.
+    def resume(id) = ("chi --resume #{id}" unless remote?)
+
+    # What shows the session ("… shows it"): chi --attach ID, or the
+    # remote's chi web.
+    def shows(id) = attach(id) || web
+
+    # Where the user opens it ("open it: …"): chi --attach ID or the web,
+    # or the remote's chi web.
+    def open_it(id) = remote? ? web : "#{attach(id)} or the web"
+
+    # The remote's chi web, by name.
+    def web = "chi web on #{remote}"
+  end
+
+  class ChiInvocation
+    # This machine's: plain chi.
+    HERE = new(remote: nil)
+  end
+end

data/lib/samagotchi/cli/command.rb

@@ -26,9 +26,10 @@ module Samagotchi
         @stderr.puts(text)
       end
 
+      # @param usage [String, nil] what follows the line (nil: "(see …
+      #   --help)" on it); a one-line error whose fix the line says passes nil
       # @return [Integer] the usage exit status
-      def usage_error(message)
-        usage = usage_on_error
+      def usage_error(message, usage: usage_on_error)
         error_line("#{command_name}: #{message}#{" (see #{command_name} --help)" unless usage}")
         @stderr.puts(usage) if usage
         Exit::USAGE

data/lib/samagotchi/cli/flags.rb

@@ -68,6 +68,11 @@ module Samagotchi
         add(names, Flag.new(refusal: message))
       end
 
+      # Each declared flag's names, in the order declared ([["-m",
+      # "--message"], ["--new"]]); refused flags too.
+      # @return [Array<Array<String>>]
+      def names = @flags.keys.group_by { |name| @flags[name].object_id }.values
+
       # @param defaults [Hash] the options before any flag (not changed)
       # @return [Result]
       def parse(argv, defaults = {})

data/lib/samagotchi/cli/parent_wait.rb

@@ -4,6 +4,7 @@ require_relative "../session"
 require_relative "../reply_wait"
 require_relative "../parent_report"
 require_relative "exit"
+require_relative "../session_access"
 
 module Samagotchi
   module CLI
@@ -12,8 +13,8 @@ module Samagotchi
     # for it, and the wait for what comes next, reported the ParentReport
     # way (Ctrl-C included). The including class (a CLI::Command) defines
     # #parse (options, or an exit status) and #run_parsed(options), sets
-    # @stdout, @stderr and @state_dir, and may override the constants
-    # (specs stub them on the class).
+    # @stdout, @stderr and @access (a SessionAccess backend), and may
+    # override the constants (specs stub them on the class).
     module ParentWait
       POLL_INTERVAL = ReplyWait::POLL_INTERVAL
       # No live worker this long while waiting: it died before it could mark
@@ -30,7 +31,14 @@ module Samagotchi
         # With --format json stdout is one JSON object, whatever the end: a
         # failure before the wait is reported from stderr's last line.
         @stderr = ParentReport::LastLine.new(@stderr) if @json
-        status = run_parsed(options)
+        status = begin
+          run_parsed(options)
+        rescue SessionAccess::RemoteFailed => e
+          # A remote that went away mid-run: the command's line, and with
+          # --format json its object.
+          error_line("#{command_name}: #{e.message}")
+          Exit::FAILED
+        end
         if @json && !@reported && status == 1
           detail = @stderr.last.to_s.delete_prefix("#{command_name}: ")
           @stdout.puts(ParentReport.error_line(detail, session_id: @session_id))
@@ -45,9 +53,7 @@ module Samagotchi
       # error line; nil after the error line.
       # @return [String, nil]
       def resolve(given)
-        id = Session.resolve_id(given, state_dir: @state_dir)
-        Session.load(id, state_dir: @state_dir)
-        @session_id = id
+        @session_id = @access.resolve(given)
       rescue ArgumentError => e
         error_line("#{command_name}: #{e.is_a?(Session::AmbiguousId) ? e.message : "no session #{given}"}")
         nil
@@ -70,16 +76,19 @@ module Samagotchi
       # @return [Integer] the exit status
       def wait_for_reply(id, cursor:, baseline:, timeout:, owner_grace: self.class::WORKER_GONE_AFTER, turn: nil,
                          queued: false, ended_before: false, report_turn_id: turn)
-        result = ReplyWait.call(id, state_dir: @state_dir, cursor: cursor, timeout: timeout, baseline: baseline,
-                                    owner_grace: owner_grace, poll_interval: self.class::POLL_INTERVAL, turn: turn,
-                                    queued: queued, ended_before: ended_before)
+        result = @access.wait_reply(id, cursor: cursor, timeout: timeout, baseline: baseline, owner_grace: owner_grace,
+                                        poll_interval: self.class::POLL_INTERVAL, turn: turn, queued: queued,
+                                        ended_before: ended_before)
         result.turn_id = report_turn_id if report_turn_id && !report_turn_id.to_s.empty?
         result.text = result.text&.dup&.force_encoding(Encoding::UTF_8)&.scrub
         @reported = true
-        # What a parent may pick there: config.yml tightened by the session's own.
-        strategy = ParentReport.strategy_for(id, state_dir: @state_dir)
+        # What a parent may pick there: config.yml tightened by the session's
+        # own. Machine-local (this machine's config.yml): remotely the
+        # server's (P2's wait route).
+        strategy = @access.parent_strategy(id)
         ParentReport.report(result, session_id: id, stdout: @stdout, stderr: @stderr, command: command_name,
-                                    json: @json, timeout: timeout, extra: report_extra, strategy: strategy)
+                                    json: @json, timeout: timeout, extra: report_extra, strategy: strategy,
+                                    via: @access.invocation)
       rescue Interrupt
         if @json
           @stdout.puts(ParentReport.json_line(ReplyWait::Result.new(status: :canceled, turn_id: report_turn_id), session_id: id,
@@ -87,7 +96,7 @@ module Samagotchi
           @stdout.flush
           @reported = true
         end
-        error_line("#{command_name}: still running: chi --attach #{id}")
+        error_line("#{command_name}: still running: #{@access.invocation.shows(id)}")
         Exit::INTERRUPTED
       rescue ArgumentError
         error_line("#{command_name}: the session is gone (deleted while waiting)")