samagotchi 0.11.0 → 0.13.0

data/lib/samagotchi/guardrails/parent_approvals.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+require_relative "../config"
+require_relative "../paths"
+require_relative "../hooks/loader"
+require_relative "approval"
+require_relative "protected_paths"
+
+module Samagotchi
+  module Guardrails
+    # What a parent agent may allow on an approval (guardrails.parent_approvals,
+    # config.yml only): off, a deny only; once, "Allow once" too, never a
+    # wider scope. `chi answer` checks it before it posts; the worker checks
+    # it again for an answer marked as chi answer's (CLIENT_ID), with its own
+    # config. A convention for an honest but eager parent, not a security
+    # boundary: any local process can post to the Bridge, with or without
+    # the marker.
+    #
+    # An option allows when Approval.settle would allow it: its index is
+    # below the approval's scopes. The scope is read by index, never by
+    # label. When the scopes are missing or don't fit the options, it fails
+    # closed: only a last option labelled Deny denies.
+    #
+    # Whatever the setting, an approval for a call on chi's own config dir
+    # (config.yml, memories/.bundles' rules), the hooks dir or the approval
+    # store is the user's alone (:protected): "Allow once" on a config.yml
+    # rewrite would be "allow everything" from then on.
+    module ParentApprovals
+      KEY = "guardrails.parent_approvals"
+      # The client id chi answer posts its answers with.
+      CLIENT_ID = "cli:answer"
+      # Set by chi's execute and task_create for the commands they run: a
+      # chi started there answers as a parent (#parent_process?).
+      PARENT_SESSION_ENV = "SAMAGOTCHI_PARENT_SESSION"
+      # Environment variables that say an agent runs this process: Claude
+      # Code's, and chi's own. They survive a PTY wrapper (script, expect).
+      AGENT_MARKERS = ["CLAUDECODE", "AI_AGENT", PARENT_SESSION_ENV].freeze
+      # Rules that ask about chi's own config and hooks: the core
+      # ProtectedPaths asks and the guardrails bundle's shell rule.
+      PROTECTED_RULES = %w[chi-config chi-hooks shell-touches-chi].freeze
+      # A shell command naming chi's config, hooks or guardrails (the
+      # guardrails bundle's shell-touches-chi, less .git/hooks).
+      CHI_TEXT = %r{\.config/samagotchi|samagotchi/config\.yml|samagotchi/hooks|samagotchi/guardrails|memories/\.bundles}
+
+      module_function
+
+      # Whether an answer typed into this process is a parent agent's (so
+      # this setting applies to it): stdin isn't a terminal (a pipe, a file,
+      # /dev/null), or an agent marker is set. A person at chi --attach or
+      # the REPL has a terminal and no marker.
+      def parent_process?(env: ENV, stdin: $stdin)
+        return true if AGENT_MARKERS.any? { |key| !env.fetch(key, "").to_s.strip.empty? }
+
+        !(stdin.respond_to?(:tty?) && stdin.tty?)
+      end
+
+      # This process's setting: "once" or "off" (anything else is off).
+      def setting
+        Config.get(KEY).to_s == "once" ? "once" : "off"
+      end
+
+      # Why a parent may not give this answer, or nil.
+      # @param pending [Hash] the pending question (symbol or string keys)
+      # @param indices [Array<Integer, nil>] the selected options' places
+      # @param setting [String, nil] "off" or "once"
+      # @return [Symbol, nil] :protected (chi's own config: the user's
+      #   alone), :off (no allow at all), :once_only, or nil
+      def refusal(pending, indices, setting:)
+        return nil unless approval?(pending)
+
+        scopes = scopes(pending)
+        allows = Array(indices).reject { |index| deny?(pending, scopes, index) }
+        return nil if allows.empty?
+        return :protected if protected?(pending)
+        return :off unless setting.to_s == "once"
+        return nil if scopes && allows.all? { |index| index.is_a?(Integer) && index >= 0 && scopes[index] == "once" }
+
+        :once_only
+      end
+
+      # Whether +pending+ asks about a call on chi's own config, hooks,
+      # guardrail rules or approvals: by its rule, its paths or its command
+      # (the dirs as this process's environment and config.yml name them).
+      def protected?(pending)
+        facts = fetch(pending, :approval)
+        return false unless facts.is_a?(Hash)
+        return true if PROTECTED_RULES.include?(fetch(facts, :rule).to_s)
+        return true if fetch(facts, :source).to_s == ProtectedPaths::SOURCE
+
+        dirs = chi_dirs
+        paths = Array(fetch(facts, :paths)).map(&:to_s).reject(&:empty?)
+        return true if paths.any? { |path| dirs.any? { |dir| ProtectedPaths.within?(ProtectedPaths.real(path), dir) } }
+
+        command = fetch(facts, :command).to_s
+        return false if command.empty?
+
+        command.match?(CHI_TEXT) || dirs.any? { |dir| command.include?(dir) || command.include?(ProtectedPaths.real(dir)) }
+      end
+
+      # chi's config dir, the hooks dir and the approval store's dir.
+      def chi_dirs
+        hooks = begin Hooks::Loader.hooks_dir rescue nil end
+        [ConfigFile.config_dir, hooks, File.join(Paths.state_dir, "guardrails")]
+          .compact.map { |dir| dir.to_s.chomp("/") }.reject(&:empty?).uniq
+      end
+
+      # The refusal as a line for the parent: deny, and tell the user.
+      # Never how to allow it (the web, chi --attach): that is the user's.
+      # @param reason [Symbol] what #refusal returned
+      # @param typed [Boolean] the answer was typed at a ? prompt (the
+      #   REPL), not given to chi answer
+      def message(reason, typed: false)
+        deny = typed ? "deny it (n; WHY), and tell your user" : "deny it (--option Deny --text WHY), and tell your user"
+        case reason
+        when :protected then "this call changes chi's own config, hooks or guardrails, and only the user can allow it: #{deny}"
+        when :off then "allowing a tool call is up to the user: #{deny}"
+        else "only Allow once (#{KEY}: once) can be given here: #{deny}"
+        end
+      end
+
+      # An approval: its kind says so, or it carries approval facts.
+      def approval?(pending)
+        fetch(pending, :kind).to_s == Approval::KIND || !fetch(pending, :approval).nil?
+      end
+
+      # The offered scopes, in option order, or nil when they are missing,
+      # empty, not strings, or leave no option after them for Deny.
+      def scopes(pending)
+        facts = fetch(pending, :approval)
+        scopes = facts.is_a?(Hash) ? fetch(facts, :scopes) : nil
+        return nil unless scopes.is_a?(Array) && !scopes.empty? && scopes.all?(String)
+        return nil unless scopes.size < options(pending).size
+
+        scopes
+      end
+
+      def deny?(pending, scopes, index)
+        return false unless index.is_a?(Integer) && index >= 0
+
+        options = options(pending)
+        return index >= scopes.size && index < options.size if scopes
+
+        index == options.size - 1 && options[index].to_s == Approval::DENY
+      end
+
+      def options(pending) = Array(fetch(pending, :options))
+
+      def fetch(hash, key)
+        return nil unless hash.is_a?(Hash)
+
+        hash.key?(key) ? hash[key] : hash[key.to_s]
+      end
+    end
+  end
+end

data/lib/samagotchi/hooks/bundle_loader.rb

@@ -4,6 +4,8 @@ require_relative "registry"
 require "digest"
 require_relative "../log"
 require_relative "../memory_bundle/provenance"
+require_relative "../memory_bundle/manifest"
+require_relative "../version"
 
 module Samagotchi
   # Namespace that wraps hook plugin classes per-bundle. Each bundle's hooks are
@@ -28,7 +30,8 @@ module Samagotchi
     # fails to load, or its file's sha256 differs from the one recorded at
     # install, the failure is reported and the gate denies every tool call.
     # Any hook whose sha256 differs is not loaded (reinstall the bundle
-    # after editing a hook by hand).
+    # after editing a hook by hand), nor any of a bundle whose requires_chi
+    # this chi doesn't meet.
     #
     # The +on_error+ policy is applied per hook at fire time (Hooks.wrap):
     #   - "fail_closed" (on :before_tool_call): a raising guardrail denies
@@ -48,10 +51,14 @@ module Samagotchi
         # @param settings [Hash] the bundle's section of config.yml
         #   `bundles:` (string keys); a hook class whose initialize takes an
         #   argument gets it
+        # @param requires_chi [String, nil] the bundle's requirement; when
+        #   this chi doesn't meet it no hook loads (each is reported, as the
+        #   plugin loader does)
         # @return [Integer] number of hooks successfully registered
-        def load(bundle_name:, hooks_dir:, metadata:, registry:, failures: nil, settings: {})
+        def load(bundle_name:, hooks_dir:, metadata:, registry:, failures: nil, settings: {}, requires_chi: nil)
           return 0 unless metadata.is_a?(Hash)
 
+          too_old = MemoryBundle::Manifest.requires_chi_failure(requires_chi, Samagotchi::VERSION)
           loaded = 0
           metadata.each do |raw_basename, raw_meta|
             basename = raw_basename.to_s
@@ -72,7 +79,7 @@ module Samagotchi
               failures&.add(what, "the file is missing", required: true) if fail_closed
               next
             end
-            if (mismatch = sha_mismatch(file, meta.(:sha256), required: fail_closed))
+            if (mismatch = too_old || sha_mismatch(file, meta.(:sha256), required: fail_closed))
               Log.warn(:hooks, "bundle_hook_mismatch", echo: "[samagotchi:hooks] bundle '#{bundle_name}' hook '#{basename}' not loaded: #{mismatch}", bundle: bundle_name, hook: basename.to_s)
               failures&.add(what, mismatch, required: fail_closed)
               next

data/lib/samagotchi/host_registry.rb

@@ -21,7 +21,6 @@ module Samagotchi
   class HostRegistry
     CACHE_TTL_SECONDS = 60
     REMOTE_CACHE_TTL_SECONDS = 600
-    LIST_TIMEOUT_SECONDS = 3
     # Seconds a remote host's stream may take to show something (a queued
     # free model on OpenRouter can send only keep-alives for minutes).
     REMOTE_FIRST_TOKEN_TIMEOUT = 120
@@ -229,7 +228,14 @@ module Samagotchi
     # Returns { host_name => { host:, port:, transport:, models: [LLM::ModelInfo], error: nil|String } }
     # Also populates the model index. Unless forced, a host's list is reused
     # for its TTL (60s; 10 minutes for a remote host).
-    def list_all_models(force: true)
+    #
+    # With +wait+ (seconds), answers by one shared deadline: a host still
+    # listing then gets the error "no answer in S s" and its thread is left
+    # running (only for a short-lived process: `chi models`). Such a partial
+    # listing is not stored as the cache or the model index, so a later
+    # resolve doesn't miss the slow host's ids; finished hosts' lists are
+    # kept for their TTL as usual.
+    def list_all_models(force: true, wait: nil)
       results = {}
       results_mutex = Mutex.new
       threads = @entries.map do |name, entry|
@@ -247,7 +253,24 @@ module Samagotchi
           results_mutex.synchronize { results[name] = data }
         end
       end
-      threads.each { |thread| thread.join if thread.is_a?(Thread) }
+      if wait
+        deadline = @clock.call + wait
+        threads.each { |thread| thread.join([deadline - @clock.call, 0].max) if thread.is_a?(Thread) }
+        partial = false
+        # a new hash: the threads keep writing into +results+ (their closure's)
+        snapshot = results_mutex.synchronize do
+          @entries.each_with_object({}) do |(name, entry), acc|
+            acc[name] = results.fetch(name) do
+              partial = true
+              { host: entry.host, port: entry.port, transport: entry.transport, models: [],
+                error: "no answer in #{wait == wait.to_i ? wait.to_i : wait} s" }
+            end
+          end
+        end
+        return snapshot if partial
+      else
+        threads.each { |thread| thread.join if thread.is_a?(Thread) }
+      end
 
       # Model index: model_id downcased -> the hosts listing it, in hosts:
       # order (not the order the threads answered in).

data/lib/samagotchi/idle_reminders.rb

@@ -1,64 +1,42 @@
 # frozen_string_literal: true
 
-require "monitor"
-
-require_relative "reminder_store"
+require_relative "reminder_queue"
 
 module Samagotchi
   # Idle job for periodic reminders — polled by the shared IdleScheduler
   # (one background thread for the whole idle layer).
   #
   # Two delivery paths cooperate:
-  #   1. Pull-based: Engine#collect_due_reminders
-  #      reads ReminderStore#due_reminders at turn start → injects
-  #      [SYSTEM: REMINDERS DUE] → marks all as fired atomically.
+  #   1. Every turn injects what is due (ReminderQueue#inject!, from
+  #      Engine#run_turn) as [SYSTEM: REMINDERS DUE] and marks it fired.
   #   2. Synthetic turns: when this job's tick finds due reminders while
-  #      idle, it latches @due_reminder_name and fires @auto_turn_callback
-  #      (the TUI/SessionManager queue a synthetic turn from the latch).
+  #      idle, it fires @auto_turn_callback, which queues their names
+  #      (Engine#note_due_reminders) for the worker's or the REPL's
+  #      reminder turn. While names are queued the tick waits; whoever
+  #      clears them (a turn's injection, the reminder turn's consumer)
+  #      re-arms it. The queue is the only "already due" state.
   class IdleReminders
     DEFAULT_MIN_INACTIVITY_SECONDS = 60.0 # Minimum idle time before checking for reminders
 
     attr_reader :inactivity
 
     def initialize(engine:, inactivity: DEFAULT_MIN_INACTIVITY_SECONDS,
-                   reminder_store: nil,
+                   queue: nil,
                    clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) },
                    callback: nil)
       raise ArgumentError, "IdleReminders requires an engine" unless engine
 
       @engine = engine
       @inactivity = inactivity
-      @reminder_store = reminder_store || engine.instance_variable_get(:@reminder_store)
+      @queue = queue
       @clock = clock
       @auto_turn_callback = callback
-
-      @mutex = Monitor.new
-      @due_reminder_name = nil
-    end
-
-    # Get all due reminders (from ReminderStore). Called by Engine#collect_due_reminders.
-    # Thread-safe. Returns all due reminders, not just one.
-    # @return [Array<Hash>] [{name:, description:, interval_minutes:}, ...]
-    def due_reminders
-      @reminder_store&.due_reminders || []
-    end
-    # Get the names of all due reminders. Called by the background thread to
-    # determine which reminders need a synthetic turn.
-    # @return [Array<String>] reminder names that are due
-    def due_reminder_names
-      due_reminders.map { |r| r[:name] }
-    end
-
-    # Clear the pending due reminder (after it has been delivered).
-    # Called by Engine after injecting the reminder into the system prompt.
-    def clear_due
-      @mutex.synchronize { @due_reminder_name = nil }
     end
 
     # One detector step, called by the shared IdleScheduler. Public so specs
     # can drive it deterministically.
     def tick
-      return if @due_reminder_name # already due, waiting for engine to deliver
+      return if @queue&.pending? # already queued, waiting for a turn to deliver it
       return unless should_check?
 
       check_due_reminders
@@ -78,14 +56,13 @@ module Samagotchi
     end
 
     def check_due_reminders
-      return unless @reminder_store
-      due_names = @reminder_store.due_reminders.map { |r| r[:name] }
+      return unless @queue
+      due_names = @queue.due.map { |r| r[:name] }
       return if due_names.empty?
       # Signal the engine to create a synthetic turn via callback.
       # The callback is responsible for triggering a turn (e.g. SessionManager
       # writes a file, TerminalUI queues input). The engine's run_turn or
       # REPL injection point then picks up and delivers the reminders.
-      @mutex.synchronize { @due_reminder_name = due_names.first }
       if @auto_turn_callback
         @auto_turn_callback.call(due_names)
       end