samagotchi 0.115.0 → 0.116.0

data/lib/samagotchi/system_one/log.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "securerandom"
+require "time"
+
+require_relative "../log"
+
+module Samagotchi
+  module SystemOne
+    # The judgments log: one JSON line per System 1 judgment, and a later
+    # line for the user's answer to the ask it judged (docs/guardrails.md,
+    # "System 1"). It sits beside the approvals store,
+    # `$XDG_STATE_HOME/samagotchi/guardrails/judgments.jsonl`, and is written
+    # append-only under an exclusive flock: several workers judge at once,
+    # and a line is never rewritten to add its label. Past 5 MB the file is
+    # rewritten, under the same lock, keeping the newest half of its lines.
+    #
+    # Nothing here can break an approval: every write that fails is one
+    # Log.warn and a nil, and the ask reaches the user as it would have.
+    class Log
+      FILE = "judgments.jsonl"
+      # Above this the file is rewritten keeping the newest half of the lines.
+      MAX_BYTES = 5 * 1024 * 1024
+      MODE = 0o600
+      # What a label's answer can be (P2a writes the first four;
+      # "should_have_asked" comes with `/guardrails wrong`).
+      ANSWERS = %w[allow_once allow_wide deny none should_have_asked].freeze
+
+      attr_reader :dir, :path
+
+      # @param dir [String] the guardrails store dir (Guardrails::Approvals.dir_for)
+      # @param warn [#call] (reason) — the record for a failed write
+      def initialize(dir:, warn: nil)
+        @dir = dir
+        @path = File.join(dir, FILE)
+        @warn = warn || ->(reason) { Samagotchi::Log.warn(:guardrails, "system_one_log_failed", echo: "[samagotchi:guardrails] #{reason}") }
+      end
+
+      # @param fields [Hash] the judgment's own fields (rule, tool, p, …)
+      # @return [String, nil] the judgment's id, nil when nothing was written
+      def judgment(fields)
+        id = SecureRandom.uuid
+        append({ "kind" => "judgment", "id" => id, "at" => Time.now.utc.iso8601 }.merge(fields)) ? id : nil
+      end
+
+      # @param id [String] a judgment's id
+      # @param answer [String] one of ANSWERS
+      # @return [Boolean] whether the line was written
+      def label(id, answer)
+        return false if id.to_s.strip.empty?
+
+        append({ "kind" => "label", "id" => id.to_s, "at" => Time.now.utc.iso8601, "answer" => answer.to_s })
+      end
+
+      # The judgments, oldest first, each joined with its LAST label
+      # (answer: nil when it has none). Lines that don't parse are skipped;
+      # labels of a judgment that isn't there are dropped.
+      # @return [Array<Hash>]
+      def entries
+        judgments = {}
+        labels = {}
+        with_lock(File::LOCK_SH) do |file|
+          file.each_line do |line|
+            data = parse(line)
+            next if data.nil?
+
+            case data["kind"]
+            when "judgment" then judgments[data["id"]] = data
+            when "label" then labels[data["id"]] = data["answer"] if data.key?("id")
+            end
+          end
+        end
+        judgments.map { |id, judgment| judgment.merge("answer" => labels[id]) }
+      rescue StandardError => e
+        warn_about(e)
+        []
+      end
+
+      private
+
+      def append(line)
+        with_lock(File::LOCK_EX) do |file|
+          # The handle is read-write (not O_APPEND) so #trim can rewrite the
+          # file: write at the end, under the lock nobody else holds.
+          file.seek(file.size)
+          file.puts(JSON.generate(line))
+          trim(file)
+        end
+        true
+      rescue StandardError => e
+        warn_about(e)
+        false
+      end
+
+      # @param mode [Integer] File::LOCK_EX for a write, LOCK_SH to read
+      def with_lock(mode)
+        FileUtils.mkdir_p(@dir)
+        File.open(@path, File::RDWR | File::CREAT, MODE) do |file|
+          file.flock(mode)
+          yield file
+        end
+      end
+
+      # Past MAX_BYTES, keep the newest half of the lines (whole, so a
+      # judgment and its labels stay together as far as the cut reaches).
+      def trim(file)
+        file.flush
+        return if file.size <= MAX_BYTES
+
+        file.rewind
+        lines = file.readlines
+        keep = lines.last([lines.size / 2, 1].max).join
+        file.rewind
+        file.write(keep)
+        file.flush
+        file.truncate(keep.bytesize)
+      end
+
+      def parse(line)
+        data = JSON.parse(line)
+        data.is_a?(Hash) ? data : nil
+      rescue JSON::ParserError
+        nil
+      end
+
+      def warn_about(error)
+        @warn.call("system one log: #{path}: #{error.class}: #{error.message}")
+      end
+    end
+  end
+end

data/lib/samagotchi/system_one/question.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  module SystemOne
+    # The question types the judgment contract has.
+    QUESTION_TYPES = %i[noul choice score].freeze
+
+    # The questions of one ask, as an Array of Question: a Hash of
+    # id => Question (or of wire fields), or an Array of Questions.
+    def self.normalize_questions(questions)
+      case questions
+      when Hash then questions.map { |id, value| Question.coerce(id, value) }
+      when Array then questions.map { |value| value.is_a?(Question) ? value : Question.coerce(value.to_s, value) }
+      else raise ArgumentError, "questions must be a hash of id => question, got #{questions.class}"
+      end
+    end
+
+    # One question of a System One request: id, type (:noul a yes/no
+    # judgment, :choice one of the named criteria, :score one of the listed
+    # levels), the instruction the model reads, and the criteria a :choice
+    # (name => description or nil) or :score (a list of level names) needs.
+    #
+    #   Question.new(id: "git-push", type: "noul", instructions: "Would the user allow this git push?")
+    Question = Data.define(:id, :type, :instructions, :criteria) do
+      def initialize(id:, type:, instructions:, criteria: nil)
+        id = id.to_s.strip
+        raise ArgumentError, "SystemOne::Question needs an id" if id.empty?
+
+        type = type.to_s.strip.downcase.to_sym
+        unless QUESTION_TYPES.include?(type)
+          raise ArgumentError, "question #{id}: type must be one of #{QUESTION_TYPES.join(", ")}, got #{type.inspect}"
+        end
+
+        instructions = instructions.to_s
+        raise ArgumentError, "question #{id}: instructions are required" if instructions.strip.empty?
+
+        super(id: id, type: type, instructions: instructions, criteria: criteria_for(id, type, criteria))
+      end
+
+      # The entry of the request's questions map.
+      def to_wire
+        wire = { "type" => type.to_s, "instructions" => instructions }
+        wire["criteria"] = criteria unless criteria.nil?
+        wire
+      end
+
+      # A Question as given, or a {type:, instructions:, criteria:} hash
+      # (string or symbol keys) — what a caller has on hand.
+      def self.coerce(id, value)
+        return value if value.is_a?(Question)
+
+        unless value.is_a?(Hash)
+          raise ArgumentError, "question #{id}: expected a SystemOne::Question or a hash, got #{value.class}"
+        end
+
+        field = ->(name) { value.key?(name) ? value[name] : value[name.to_sym] }
+        new(id: id, type: field.call("type"), instructions: field.call("instructions"), criteria: field.call("criteria"))
+      end
+
+      private
+
+      def criteria_for(id, type, criteria)
+        case type
+        when :noul
+          raise ArgumentError, "question #{id}: an noul question takes no criteria" unless criteria.nil?
+
+          nil
+        when :choice
+          unless criteria.is_a?(Hash) && !criteria.empty? &&
+                 criteria.all? { |name, description| !name.to_s.strip.empty? && (description.nil? || description.is_a?(String)) }
+            raise ArgumentError, "question #{id}: a choice question takes criteria as {name => description or nil}"
+          end
+
+          criteria.to_h { |name, description| [name.to_s, description] }
+        else
+          unless criteria.is_a?(Array) && !criteria.empty? &&
+                 criteria.all? { |level| level.is_a?(String) && !level.strip.empty? }
+            raise ArgumentError, "question #{id}: a score question takes criteria as a list of level names"
+          end
+
+          criteria.map(&:to_s)
+        end
+      end
+    end
+  end
+end

data/lib/samagotchi/system_one/record.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  module SystemOne
+    # One rule's record: what System 1 has judged for it and what the user
+    # did about those asks. Built from `SystemOne::Log#entries` (judgments
+    # joined with their last label), filtered to one rule. The gate before
+    # System 1 answers for the user: enough clean allows at the threshold,
+    # and no false allow among the rule's last 20 labelled asks
+    # (docs/guardrails.md, "System 1").
+    #
+    # An ask with no label, no probability, or a `none` label counts for
+    # neither side: only a judgment the user actually answered teaches
+    # anything.
+    class Record
+      # The labels that mean the user let the call through.
+      ALLOW_LABELS = %w[allow_once allow_wide].freeze
+      # A judgment at the threshold that the user did not allow: System 1
+      # was wrong, and the rule's record is not clean.
+      FALSE_ALLOW_LABELS = %w[deny should_have_asked].freeze
+      # How many of the rule's labelled asks the false-allow check looks at.
+      WINDOW = 20
+
+      attr_reader :rule, :entries
+
+      # @param entries [Array<Hash>] SystemOne::Log#entries, oldest first
+      # @param rule [String] the rule the record is for
+      def initialize(entries, rule:)
+        @rule = rule.to_s
+        @entries = Array(entries).select { |entry| entry["rule"].to_s == @rule }
+      end
+
+      # @param threshold [Float] the probability an auto-allow needs
+      # @param min_record [Integer] how many clean allows the rule needs
+      # @return [Boolean] whether System 1 may answer this rule for the user
+      def qualifies?(threshold:, min_record:)
+        clean = high(threshold).count { |entry| ALLOW_LABELS.include?(entry["answer"].to_s) }
+        return false if clean < min_record.to_i
+
+        !false_allow?(labeled.last(WINDOW), threshold)
+      end
+
+      # The counts a `/guardrails` listing shows: how many asks the rule has,
+      # how many were answered, and how each was answered.
+      # @return [Hash]
+      def summary
+        labeled_entries = labeled
+        {
+          rule: rule,
+          asks: entries.size,
+          labelled: labeled_entries.size,
+          allow_once: count("allow_once"),
+          allow_wide: count("allow_wide"),
+          deny: count("deny"),
+          should_have_asked: count("should_have_asked"),
+          none: count("none"),
+          no_label: entries.size - labeled_entries.size,
+          no_p: entries.count { |entry| entry["p"].nil? }
+        }
+      end
+
+      private
+
+      # The asks of the rule the user answered.
+      def labeled
+        entries.reject { |entry| entry["answer"].nil? }
+      end
+
+      # The asks judged at or above +threshold+.
+      def high(threshold)
+        entries.select { |entry| entry["p"] && entry["p"].to_f >= threshold.to_f }
+      end
+
+      def false_allow?(list, threshold)
+        list.any? { |entry| entry["p"] && entry["p"].to_f >= threshold.to_f && FALSE_ALLOW_LABELS.include?(entry["answer"].to_s) }
+      end
+
+      def count(label)
+        entries.count { |entry| entry["answer"].to_s == label }
+      end
+    end
+  end
+end

data/lib/samagotchi/system_one/self_protect.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require_relative "../paths"
+require_relative "../config"
+require_relative "../memory_paths"
+require_relative "../hooks/loader"
+require_relative "../guardrails/protected_paths"
+
+module Samagotchi
+  module SystemOne
+    # The calls System 1 may never answer for, whatever the rule's record
+    # says: one that changes chi itself. An auto-allow on config.yml, the
+    # hooks, the installed bundles or the guardrails store would let the
+    # agent widen its own guardrails without the user (docs/guardrails.md,
+    # "System 1"). The memories dir is deliberately not one of them:
+    # reading and appending a memory file stays eligible.
+    #
+    # Pure: it only reads the paths as this process's environment names them,
+    # and answers on the approval's own facts (Guardrails::Approval.payload's
+    # approval:), the same shape ParentApprovals.protected_facts? takes.
+    module SelfProtect
+      # The rules that let one agent answer chi's questions: an auto-allow
+      # there is one agent approving another's, so the user decides them even
+      # when they are listed in `guardrails.system_one.rules`.
+      NEVER_AUTO = %w[chi-answer-piped chi-answer-http chi-broadcast].freeze
+      # chi's config file, however the user names it in config.yml.
+      CONFIG_FILE = /\Aconfig[\w-]*\.ya?ml\z/i
+      # The dirs as a shell command may spell them when the settings point
+      # elsewhere: chi's default config dir and default state dir. A path
+      # into the memories dir is not a control file.
+      DEFAULT_CONFIG_TEXT = %r{\B~/\.config/samagotchi(?!/memories)}
+      DEFAULT_STATE_TEXT = %r{\B~/\.local/state/samagotchi}
+
+      module_function
+
+      # @param approval [Hash, nil] the ask's approval facts (rule, tool,
+      #   paths, command)
+      # @return [Boolean] whether System 1 must not answer this ask
+      def refuse?(approval)
+        return false unless approval.is_a?(Hash)
+        return true if NEVER_AUTO.include?(fetch(approval, :rule).to_s)
+
+        dirs = control_dirs
+        paths = Array(fetch(approval, :paths)).map(&:to_s).reject(&:empty?)
+        return true if paths.any? { |path| control_path?(path, dirs) }
+
+        command = fetch(approval, :command).to_s
+        !command.empty? && control_text?(command, dirs)
+      end
+
+      # The dirs whose files are chi's own: its hooks, its installed bundles,
+      # the guardrails store (approvals.json and judgments.jsonl).
+      # @return [Array<String>]
+      def control_dirs
+        [Hooks::Loader.hooks_dir, MemoryPaths.bundles_dir, File.join(Paths.state_dir, "guardrails")]
+          .compact.map { |dir| dir.to_s.chomp("/") }.reject(&:empty?)
+      end
+
+      def control_path?(path, dirs)
+        real = Guardrails::ProtectedPaths.real(path)
+        return true if dirs.any? { |dir| Guardrails::ProtectedPaths.within?(real, dir) }
+        return true if config_file?(real)
+
+        control_text?(path, dirs)
+      end
+
+      # config.yml in chi's config dir — not the memories beside it.
+      def config_file?(path)
+        Guardrails::ProtectedPaths.within?(path, ConfigFile.config_dir) && File.basename(path).match?(CONFIG_FILE)
+      end
+
+      # A command or path naming one of those dirs, in the spelling this
+      # process uses or the default `~/.config/samagotchi` one.
+      def control_text?(text, dirs)
+        dirs.any? { |dir| text.include?(dir) || text.include?(File.expand_path(dir)) } ||
+          text.match?(config_text) || text.match?(DEFAULT_CONFIG_TEXT) || text.match?(DEFAULT_STATE_TEXT)
+      end
+
+      # chi's config dir as text — everything under it except the memories,
+      # which the model works with.
+      def config_text
+        Regexp.new("#{Regexp.escape(ConfigFile.config_dir)}(?![/]memories)")
+      end
+
+      def fetch(hash, key)
+        hash.key?(key) ? hash[key] : hash[key.to_s]
+      end
+    end
+  end
+end

data/lib/samagotchi/system_one/similar.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  module SystemOne
+    # The few-shot examples an ask carries beside its own facts: the earlier
+    # asks the user actually answered, the most alike first — this rule in
+    # this repository, then this rule, then whatever shares the most words
+    # with this call. No embeddings: a word overlap, with the newer ask first
+    # when two tie, so the same log always gives the same five
+    # (docs/guardrails.md, "System 1").
+    module Similar
+      # How many examples the state can carry.
+      MAX = 5
+      # A "token" of a call, for the overlap: a word, lower-cased.
+      TOKEN = /[a-z0-9_]+/
+
+      module_function
+
+      # @param entries [Array<Hash>] SystemOne::Log#entries, oldest first —
+      #   the same read the record gate uses
+      # @param rule [String, nil] the rule asking now
+      # @param repo_name [String, nil] the repository this ask is in
+      # @param call_text [String] the call to approve (ApprovalQuestion.call_text)
+      # @return [Array<Hash>] at most MAX examples, most alike first; [] when
+      #   the log has nothing labelled to offer
+      def select(entries:, rule:, repo_name:, call_text:)
+        words = tokens(call_text)
+        ranked = Array(entries).each_with_index.select { |entry, _index| labelled?(entry) }
+        ranked = ranked.sort_by { |entry, index| [tier(entry, rule, repo_name), -overlap(entry["call"], words), -index] }
+        ranked.first(MAX).map { |entry, _index| example(entry) }
+      end
+
+      # A judgment teaches something only when the user answered it: no label
+      # or a `none` says nothing, and a line with no rule cannot be matched.
+      def labelled?(entry)
+        answer = entry["answer"].to_s
+        !answer.empty? && answer != "none" && !entry["rule"].to_s.strip.empty?
+      end
+
+      # 0: this rule in this repository. 1: this rule anywhere. 2: any other
+      # ask the user answered.
+      def tier(entry, rule, repo_name)
+        same_rule = entry["rule"].to_s == rule.to_s
+        return 0 if same_rule && !repo_name.to_s.strip.empty? && entry["repo_name"].to_s == repo_name.to_s
+        return 1 if same_rule
+
+        2
+      end
+
+      # How many of this call's words the logged call shares.
+      def overlap(call, words)
+        return 0 if words.empty?
+
+        (tokens(call) & words).size
+      end
+
+      def tokens(text)
+        text.to_s.downcase.scan(TOKEN).uniq
+      end
+
+      # What the judge is shown about an ask: how it was judged and what the
+      # user did, as the log holds it.
+      def example(entry)
+        { "rule" => entry["rule"].to_s, "repo" => entry["repo_name"], "call" => entry["call"],
+          "answer" => entry["answer"].to_s }.compact
+      end
+    end
+  end
+end

data/lib/samagotchi/system_one.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require_relative "system_one/errors"
+require_relative "system_one/question"
+require_relative "system_one/answer"
+require_relative "system_one/fake_backend"
+require_relative "system_one/http_backend"
+require_relative "system_one/client"
+require_relative "system_one/log"
+require_relative "system_one/record"
+require_relative "system_one/similar"
+require_relative "system_one/self_protect"
+require_relative "system_one/approval_question"
+
+module Samagotchi
+  # System 1: the cheap judgment model that will, one phase at a time,
+  # answer the guardrail asks a user always allows. P1 is the client and its
+  # settings; P2a judges every ask a user is about to see and logs the
+  # judgment and their answer (SystemOne::Log); P3a is `on` mode: a judgment
+  # that passes every gate allows the call once, without asking
+  # (SystemOne::Record, SystemOne::SelfProtect). The line a UI shows for an
+  # auto-allow is P3b (docs/guardrails.md, "System 1").
+  module SystemOne
+  end
+end

data/lib/samagotchi/terminal_ui/attached_loop.rb

@@ -1550,7 +1550,8 @@ module Samagotchi
               record = join_record(records, part)
               duration = record&.dig("duration_ms")
               @screen.commit(join_tool_line(part, duration_ms: duration.is_a?(Numeric) ? duration : nil,
-                                                  saved_status: record&.dig("status")))
+                                                  saved_status: record&.dig("status"),
+                                                  auto_allowed: record&.dig("guardrail")))
             end
           end
         end
@@ -1594,8 +1595,10 @@ module Samagotchi
       # A saved call's row; "no result" for a call the turn never answered
       # (it ended first). Its status is the saved record's, as live and the
       # web's reload (a guardrail's "blocked" is no error), else read from
-      # its result (a guardrail's deny text reads blocked too).
-      def join_tool_line(part, duration_ms: nil, saved_status: nil)
+      # its result (a guardrail's deny text reads blocked too). A record that
+      # System 1 allowed once (+auto_allowed+, its saved {rule, p}) says so,
+      # as the live row does.
+      def join_tool_line(part, duration_ms: nil, saved_status: nil, auto_allowed: nil)
         output = part[:output]
         command = part.dig(:view, :truncated) ? nil : part.dig(:view, :command)
         text = ToolActivity.saved_result_text(output) unless output.nil?
@@ -1612,7 +1615,15 @@ module Samagotchi
                      params: part[:params], status: status,
                      description: ToolView.description_title(part[:view] || {}) }
         "#{format_tool_activity_line(activity, duration_ms: duration_ms)}" \
-          "#{format_tool_image_suffix(part[:images])}#{format_tool_diff_suffix(part[:diff])}#{format_tool_cut_suffix(part[:output_truncated])}"
+          "#{format_tool_image_suffix(part[:images])}#{format_tool_diff_suffix(part[:diff])}#{format_tool_cut_suffix(part[:output_truncated])}" \
+          "#{auto_allowed_suffix(auto_allowed)}"
+      end
+
+      # The live row's System 1 suffix for a saved record's {rule, p}.
+      def auto_allowed_suffix(saved)
+        return "" unless saved.is_a?(Hash)
+
+        format_tool_guardrail_suffix({ decided_by: "system one", p: saved["p"] || saved[:p] })
       end
 
       # The context notes that came since the last prompt (all of them in a

data/lib/samagotchi/terminal_ui/event_renderer.rb

@@ -221,6 +221,7 @@ module Samagotchi
         line += @view.format_tool_image_suffix(images) if images&.any?
         line += @view.format_tool_diff_suffix(diff) if diff
         line += @view.format_tool_cut_suffix(output_truncated) if output_truncated
+        line += @view.format_tool_guardrail_suffix(activity[:guardrail]) if activity[:guardrail]
         @view.print_line(line)
       end
 

data/lib/samagotchi/terminal_ui/formatting.rb

@@ -202,6 +202,20 @@ module Samagotchi
         output_truncated ? " #{paint("[cut]", 90)}" : ""
       end
 
+      # A call System 1 allowed once instead of asking: " · auto-allowed
+      # (System 1, p=0.97)", yellow, from the activity's guardrail (symbol or
+      # string keys: live, snapshot). Any other guardrail data adds nothing.
+      def format_tool_guardrail_suffix(guardrail)
+        return "" unless guardrail.is_a?(Hash)
+
+        get = ->(key) { guardrail[key] || guardrail[key.to_s] }
+        return "" unless get.call(:decided_by) == "system one"
+
+        p_value = get.call(:p)
+        detail = p_value.nil? ? "System 1" : format("System 1, p=%.2f", p_value.to_f)
+        " #{paint("\u00b7 auto-allowed (#{detail})", 33)}"
+      end
+
       # Prompt labels by the sender's client_id: a whole id, or a prefix
       # (ending in ":") it starts with (turn_events.js CLIENT_LABELS;
       # spec/shared/labels_matrix.json).

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.115.0"
+  VERSION = "0.116.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -247,6 +247,7 @@ module Samagotchi
         ["GET", %r{\A/api/sessions/([^/]+)/worker\z}, :handle_worker, :owner, :session],
         ["POST", %r{\A/api/sessions/([^/]+)/exit\z}, :handle_exit, :owner, :session],
         ["POST", %r{\A/api/sessions/([^/]+)/recap\z}, :handle_recap, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/guardrails/wrong\z}, :handle_system_one_wrong, :owner, :session],
         ["GET", %r{\A/api/sessions/([^/]+)/stats\z}, :handle_stats, :owner, :session],
         ["GET", %r{\A/api/sessions/([^/]+)/children/counts\z}, :handle_children_counts, :owner, :session],
         ["GET", %r{\A/api/sessions/([^/]+)/turns/([^/]+)/records\z}, :handle_turn_records, :owner, :session],

data/lib/samagotchi/web/public/activity.js

@@ -144,6 +144,16 @@ export function addCompleted(model, event = {}, now = null) {
   Object.assign(row, pickFields(event.activity, ACTIVITY_FIELDS));
   // A grep that found nothing (status ok): the row says "no match".
   if (event.activity?.no_match) row.no_match = true;
+  // System 1 allowed the call once instead of asking (the row's label); any
+  // other guardrail verdict draws nothing.
+  const guardrail = event.activity?.guardrail;
+  if (guardrail?.decided_by === "system one") {
+    row.guardrail = {
+      rule: guardrail.rule,
+      p: guardrail.p,
+      ...(guardrail.judgment_id ? { judgment_id: guardrail.judgment_id } : {}),
+    };
+  }
   // The images the tool returned (a reload in the turn view draws them from
   // the saved parts, turn_html.js toolRowTemplate).
   if (event.images?.length) row.images = event.images;

data/lib/samagotchi/web/public/app.js

@@ -50,6 +50,7 @@ import { createGapClock, lastActivity } from "./time_gaps.js";
 import { createMarkdownPlace } from "./markdown_place.js";
 import { openerFill, openTitle, restoredComposer } from "./chains.js";
 import { createTaskStopper } from "./task_stop.js";
+import { createSystemOneWrongAction } from "./system_one_wrong.js";
 import { appendQuote } from "./annotations.js";
 import { applyComposerText, applyRowTemplate, fetchApply } from "./review_apply.js";
 import { authorBadge, nameUnnamedBadges } from "./participant_names.js";
@@ -299,6 +300,8 @@ const { placeToast } = createDockReserve({
 function turnRoots() {
   return turnDom.root ? [historyEl, turnDom.root] : [historyEl];
 }
+const systemOneWrongAction = createSystemOneWrongAction({ sessionId: () => selected });
+turnRoots().forEach((root) => root.addEventListener("click", systemOneWrongAction));
 function findInTurnRoots(selector) {
   return turnRoots().flatMap((root) => [...root.querySelectorAll(selector)]);
 }

data/lib/samagotchi/web/public/composer_fold.js

@@ -14,17 +14,17 @@ export function composerFolded({ saved, archivedVisit, visitOpen }) {
   return !!saved || !!archivedVisit;
 }
 
-// The composer's grip while it is the fold's handle. Expanded it only says
-// how to resize and hide; folded it is drawn as the handle on the info
-// bar's top edge, pulled up or clicked to open, and marked: `draft` (the
-// box holds text or images: folding never clears them: the accent),
-// `waiting` (the attention colour: the session waits on the user, and its
-// card may not take the focus while a draft is there). The title carries
-// the words.
+// The composer's grip while it is the fold's handle. Expanded it says how to
+// resize it and that a click hides it (a double-click resets the height);
+// folded it is drawn as the handle on the info bar's top edge, pulled up or
+// clicked to open, and marked: `draft` (the box holds text or images: folding
+// never clears them: the accent), `waiting` (the attention colour: the session
+// waits on the user, and its card may not take the focus while a draft is
+// there). The title carries the words.
 // @return {title, folded, draft, waiting}
 export function foldHandle({ folded, draft, waiting }) {
   if (!folded) {
-    return { title: "Drag to make the message box taller, down to hide it (double-click resets)", folded: false, draft: false, waiting: false };
+    return { title: "Drag to resize, click to hide (double-click resets)", folded: false, draft: false, waiting: false };
   }
   const marked = !!draft;
   let title = "Pull up or click to write";