samagotchi 0.115.0 → 0.117.0

data/lib/samagotchi/guardrails/verdict.rb

@@ -19,8 +19,10 @@ module Samagotchi
       # parent model would be writing a model's prompt); and the bundle's
       # asks before answering chi's questions around chi answer (a parent
       # allowing one would answer a grandchild's question as the user).
-      # Only the user may allow them (ParentApprovals.protected?,
-      # ParentPolicy's user_only).
+      # A parent agent may never allow them (ParentApprovals.protected?,
+      # ParentPolicy's user_only); System 1 may, only if the user lists the
+      # rule by name in guardrails.system_one.rules, and never for the
+      # chi-answer/chi-broadcast ones (SystemOne::SelfProtect::NEVER_AUTO).
       PROTECTED_RULES = %w[chi-config chi-hooks shell-touches-chi chi-context-cmd chi-broadcast prompt-memory-write
                            model-overlay-write chi-answer-piped chi-answer-http].freeze
       SCOPES = %w[once session repo rule].freeze
@@ -33,6 +35,8 @@ module Samagotchi
       attr_accessor :context, :targets
       # The scope the user allowed an ask for ("once", "session", …).
       attr_accessor :scope
+      # System 1's judgment that decided an ask, when it did: {id:, p:}.
+      attr_accessor :judgment
 
       def initialize(call:)
         @call = call
@@ -121,8 +125,11 @@ module Samagotchi
       end
 
       # For the activity entry; an allowed ask notes how ("approved (repo)",
-      # "approved earlier (session)").
+      # "approved earlier (session)"), one System 1 answered notes that and
+      # carries the judgment (docs/guardrails.md, "System 1").
       def to_activity
+        return system_one_activity if @decided_by == "system one"
+
         note = if allow? && @scope
                  "approved#{" earlier" if @decided_by == "approval"} (#{@scope})"
                end
@@ -131,6 +138,19 @@ module Samagotchi
 
       private
 
+      # The auto-allow's activity: who decided, for how long, and the
+      # judgment behind it (the p and the judgment's id), so a UI can show
+      # why the call was never asked about.
+      def system_one_activity
+        facts = @judgment || {}
+        p = facts[:p]
+        activity = { rule: @rule, verdict: @decision.to_s, decided_by: @decided_by, scope: @scope,
+                     note: p ? "auto-allowed by System 1 (p=#{format("%.2f", p.to_f)})" : "auto-allowed by System 1" }
+        activity[:judgment_id] = facts[:id] if facts[:id]
+        activity[:p] = p if p
+        activity.compact
+      end
+
       def decider
         return [("rule #{@rule}" if @rule), @source].compact.join(", ") if @rule || @source
 

data/lib/samagotchi/guardrails_command.rb

@@ -0,0 +1,329 @@
+# frozen_string_literal: true
+
+require "json"
+
+require_relative "cli/command"
+require_relative "cli/exit"
+require_relative "cli/flags"
+require_relative "config"
+require_relative "bridge/card_store"
+require_relative "guardrails/approvals"
+require_relative "guardrails/parent_policy"
+require_relative "host_registry"
+require_relative "session"
+require_relative "system_one"
+
+module Samagotchi
+  # `chi guardrails`: the guardrails' own maintenance commands, on this
+  # machine only (docs/guardrails.md, "System 1"). `replay` is the record
+  # seed: System 1 judges every approval this machine's sessions already
+  # answered, and the judgment and the user's answer go to the log as they
+  # would live. A rule's record then starts with the asks the user really
+  # decided on, instead of waiting for a few days of live ones.
+  class GuardrailsCommand
+    include CLI::Command
+
+    USAGE = <<~TEXT
+      Usage: chi guardrails <subcommand> [options]
+        replay [--dry-run] [--threshold T] [--model M]
+          Judge every approval this machine's sessions have already answered
+          (their cards, $XDG_STATE_HOME/samagotchi/sessions/<id>/cards.json)
+          through System 1 and write the judgment and the user's answer to
+          guardrails/judgments.jsonl, so a rule's record starts with the asks
+          the user really decided on. Asks with no approval card, unanswered
+          ones, and question ids a previous replay already logged are skipped.
+          A parent agent's answer is not the user's: only its deny is logged,
+          and only when the parent could have allowed (the session's
+          guardrails.parent_answers allows "permit" and the ask is not
+          user-only). --threshold overrides guardrails.system_one.threshold
+          for the table; --model overrides the configured model for this run.
+          --dry-run judges and prints the table without writing a line. Needs
+          guardrails.system_one.mode audit or on and a guardrails.system_one.host
+          (exit 2 without one).
+    TEXT
+
+    SUBCOMMANDS = %w[replay].freeze
+    FLAGS = {
+      "replay" => CLI::Flags.new(help: HELP_WORDS, args: false) do |f|
+        f.switch "--dry-run"
+        f.value "--threshold"
+        f.value "--model"
+      end
+    }.freeze
+    # The labels that mean the user let the call through.
+    ALLOW_LABELS = %w[allow_once allow_wide].freeze
+    # replay's table, in column order: the rule, how many asks it had, how
+    # many the user allowed, how many they denied, how many System 1 would
+    # have auto-allowed at the threshold, the false allows among them (the
+    # model said allow, the user did not), and the asks with no judgment.
+    COLUMNS = %w[rule asks allowed denied auto false_allows no_judgment].freeze
+    # Why an ask in a cards file was not replayed, in the words the summary
+    # uses.
+    SKIP_WORDS = {
+      already_replayed: "already replayed",
+      answered_by_parent: "answered by a parent agent",
+      parent_cannot_allow: "answered by a parent that could not allow",
+      unanswered: "unanswered",
+      no_approval: "no approval card",
+      no_question_id: "no question id"
+    }.freeze
+
+    # One ask a replay judges: the card's question id, the session it came
+    # from, its approval as the card saved it, the label its answer gives,
+    # and when the user was asked.
+    Ask = Data.define(:question_id, :session_id, :approval, :label, :asked_at)
+
+    # @param argv [Array<String>] the arguments after "guardrails"
+    # @param client [SystemOne::Client, nil] the judgment client; nil: the
+    #   one config.yml describes (the seam the specs pass a fake through)
+    # @param sessions_dir [String, nil] where the sessions are; nil: this
+    #   machine's ($XDG_STATE_HOME/samagotchi/sessions)
+    # @param log [SystemOne::Log, nil] the judgments log; nil: the one beside
+    #   the approvals store
+    def initialize(argv, stdout: $stdout, stderr: $stderr, client: nil, sessions_dir: nil, log: nil)
+      @argv = argv.dup
+      @stdout = stdout
+      @stderr = stderr
+      @client = client
+      @sessions_dir = sessions_dir
+      @log = log
+    end
+
+    # @return [Integer] exit status: 0 done, 2 a usage error or no System 1
+    #   client to judge with
+    def run
+      @sub = @argv[0]
+      if @sub.nil? || HELP_WORDS.include?(@sub)
+        @stdout.puts(USAGE)
+        return CLI::Exit::OK
+      end
+      return usage_error("unknown subcommand #{@sub}") unless SUBCOMMANDS.include?(@sub)
+
+      parsed = parse_flags(FLAGS.fetch(@sub), @argv[1..])
+      return parsed if parsed.is_a?(Integer)
+
+      replay(parsed.options)
+    end
+
+    private
+
+    def command_name = @sub ? "chi guardrails #{@sub}" : "chi guardrails"
+
+    def replay(options)
+      threshold = threshold(options[:threshold])
+      return usage_error(threshold) if threshold.is_a?(String)
+
+      client = @client || SystemOne::Client.from_config(host_registry: HostRegistry.new, model: options[:model])
+      if client.nil?
+        error_line("chi guardrails replay: no System 1 client — set guardrails.system_one.mode to audit or on " \
+                   "and guardrails.system_one.host in config.yml")
+        return CLI::Exit::USAGE
+      end
+
+      sessions_dir = @sessions_dir || Session.default_state_dir
+      log = @log || SystemOne::Log.new(dir: Guardrails::Approvals.dir_for(sessions_dir))
+      replayed = File.exist?(log.path) ? log.entries.filter_map { |entry| entry["question_id"] if entry["origin"] == "replay" }.to_set : Set.new
+      @dry_run = options[:dry_run] ? true : false
+
+      asks = []
+      skipped = Hash.new(0)
+      malformed = 0
+      if Dir.exist?(sessions_dir)
+        Dir.children(sessions_dir).sort.each do |name|
+          path = File.join(sessions_dir, name, Bridge::CardStore::FILE)
+          next unless File.file?(path)
+
+          entries = sidecar(path)
+          if entries.nil?
+            malformed += 1
+            next
+          end
+
+          entries.each do |entry|
+            ask = ask_of(entry, name, replayed, sessions_dir)
+            next if ask.nil?
+
+            ask.is_a?(Symbol) ? skipped[ask] += 1 : asks << ask
+          end
+        end
+      end
+
+      stats = asks.map { |ask| judge(ask, client, log, threshold, sessions_dir) }
+      print_table(stats, threshold, client, skipped, malformed)
+      CLI::Exit::OK
+    end
+
+    # The asks of one session's cards file, or nil when it isn't one: a
+    # sidecar that doesn't parse costs one warning line, never the run.
+    def sidecar(path)
+      return nil unless File.file?(path)
+
+      data = JSON.parse(File.read(path), symbolize_names: true)
+      return nil unless data.is_a?(Hash) && data[:entries].is_a?(Array)
+
+      data[:entries]
+    rescue StandardError => e
+      error_line("chi guardrails replay: #{path}: unreadable cards (#{e.class}: #{e.message}); skipped")
+      nil
+    end
+
+    # One card entry as an ask to judge: an Ask, a skip reason (:already_replayed,
+    # :answered_by_parent, :parent_cannot_allow, :unanswered, :no_approval,
+    # :no_question_id), or nil for an entry that is not a question at all.
+    def ask_of(entry, session_id, replayed, sessions_dir)
+      return nil unless entry.is_a?(Hash) && entry[:type] == "question"
+
+      pending = entry[:pending_question]
+      return :no_approval unless pending.is_a?(Hash) && pending[:approval].is_a?(Hash)
+
+      question_id = pending[:id].to_s
+      return :no_question_id if question_id.empty?
+      return :already_replayed if replayed.include?(question_id)
+
+      answer = entry[:answer]
+      label = if entry[:cancelled]
+                "none"
+              elsif answer.nil?
+                return :unanswered
+              elsif answer[:by] == "parent_agent"
+                # A parent's allow is not the user's decision. Its deny is a
+                # label only where the parent could have allowed: a parent
+                # that was not allowed to permit says nothing about the user
+                # (docs/guardrails.md, "System 1").
+                return :answered_by_parent unless label_for(answer, pending[:approval][:scopes]) == "deny"
+                return :parent_cannot_allow unless parent_may_permit?(pending, session_id, sessions_dir)
+
+                "deny"
+              else
+                label_for(answer, pending[:approval][:scopes])
+              end
+
+      Ask.new(question_id: question_id, session_id: session_id, approval: pending[:approval],
+              label: label, asked_at: pending[:created_at])
+    end
+
+    # Whether this session's parent could have allowed the ask: not a
+    # user-only ask, and a parent level that permits one. No session file:
+    # not permitted.
+    def parent_may_permit?(pending, session_id, sessions_dir)
+      return false if pending[:user_only] == true
+
+      session = session_of(session_id, sessions_dir)
+      return false if session.nil?
+
+      Guardrails::ParentPolicy.for_session(session).allow?("permit")
+    end
+
+    # The session a card belongs to, or nil when there is no session file;
+    # read once per session for the run.
+    def session_of(session_id, sessions_dir)
+      return nil unless Session.valid_id?(session_id)
+      return nil unless File.exist?(Session.session_file(session_id, state_dir: sessions_dir))
+
+      (@sessions ||= {})[session_id] ||= begin
+        Session.load(session_id, state_dir: sessions_dir)
+      rescue StandardError
+        nil
+      end
+    end
+
+    # What the user did, as the log's label: the scope they took, a denial
+    # when the answer is not one of the offered scopes, none for an ask that
+    # was cancelled (docs/guardrails.md, "System 1").
+    def label_for(answer, scopes)
+      index = answer[:selected_indices]&.first
+      return "deny" if index.nil?
+
+      scopes = Array(scopes)
+      if index < scopes.size
+        scopes[index] == "once" ? "allow_once" : "allow_wide"
+      else
+        "deny"
+      end
+    end
+
+    # Judge one ask, write its two lines unless this is a dry run, and return
+    # what the table counts. A judgment that never came is written with p
+    # null, exactly as the live audit writes it.
+    def judge(ask, client, log, threshold, sessions_dir)
+      started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      answers = begin
+        client.ask(state: SystemOne::ApprovalQuestion.state(ask.approval, session_title: session_title(ask, sessions_dir)),
+                   questions: { SystemOne::ApprovalQuestion::ID => SystemOne::ApprovalQuestion.question })
+      rescue StandardError => e
+        Samagotchi::Log.warn(:guardrails, "system_one_replay_ask_failed", error: "#{e.class}: #{e.message}")
+        nil
+      end
+      latency_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round
+      p = answers && answers[SystemOne::ApprovalQuestion::ID]&.noul
+
+      unless @dry_run
+        id = log.judgment(session_id: ask.session_id, rule: ask.approval[:rule], source: ask.approval[:source],
+                          tool: ask.approval[:tool], **SystemOne::ApprovalQuestion.call_fields(ask.approval),
+                          repo_name: ask.approval[:repo_name], p: p, threshold: threshold, model: client.model,
+                          latency_ms: latency_ms, decision: "replay", origin: "replay",
+                          question_id: ask.question_id, asked_at: ask.asked_at)
+        log.label(id, ask.label)
+      end
+
+      { rule: ask.approval[:rule].to_s, label: ask.label, p: p, session: ask.session_id }
+    end
+
+    # The session's title, as the ask's state carries it; nil when there is
+    # no session file (the cards alone are enough to replay).
+    def session_title(ask, sessions_dir)
+      session_of(ask.session_id, sessions_dir)&.display_title
+    end
+
+    # The threshold for this run: --threshold, or guardrails.system_one.threshold.
+    # @return [Float, String] the number, or the usage error's message
+    def threshold(value)
+      return Config.get("guardrails.system_one.threshold").to_f if value.nil?
+
+      number = Float(value.to_s.strip)
+      return "--threshold takes a number between 0 and 1, got #{value}" if number.negative? || number > 1.0
+
+      number
+    rescue ArgumentError, TypeError
+      "--threshold takes a number between 0 and 1, got #{value}"
+    end
+
+    def print_table(stats, threshold, client, skipped, malformed)
+      rows = stats.group_by { |row| row[:rule] }.map { |rule, asks| rule_row(rule, asks, threshold) }
+      rows.sort_by! { |rule, count, _| [-count, rule] }
+      totals = ["total", *COLUMNS[1..].each_with_index.map { |_column, offset| rows.sum { |row| row[offset + 1] } }]
+      all = rows + [totals]
+      widths = COLUMNS.each_with_index.map { |column, index| [column.size, all.map { |row| row[index].to_s.size }.max].max }
+
+      @stdout.puts(row_line(COLUMNS, widths))
+      @stdout.puts(widths.map { |width| "-" * width }.join("  "))
+      rows.each { |row| @stdout.puts(row_line(row, widths)) }
+      @stdout.puts(row_line(totals, widths))
+
+      sessions = stats.map { |row| row[:session] }.uniq.size
+      @stdout.puts("#{stats.size} asks replayed from #{sessions} session#{"s" unless sessions == 1} " \
+                   "· threshold #{threshold} · model #{client.model || "the host's default"}")
+      notes = skipped.map { |reason, count| "#{count} #{SKIP_WORDS[reason] || reason}" }
+      notes << "#{malformed} unreadable cards file#{"s" unless malformed == 1}" if malformed.positive?
+      @stdout.puts("skipped: #{notes.sort.join(", ")}") unless notes.empty?
+      @stdout.puts("dry run: nothing was written") if @dry_run
+    end
+
+    # One table row, columns left-aligned to their width.
+    def row_line(values, widths)
+      values.each_with_index.map { |value, index| value.to_s.ljust(widths[index]) }.join("  ").rstrip
+    end
+
+    # One rule's row: asks, allowed, denied, auto-allowed at the threshold,
+    # false allows, asks with no judgment.
+    def rule_row(rule, rows, threshold)
+      allowed = rows.count { |row| ALLOW_LABELS.include?(row[:label]) }
+      denied = rows.count { |row| row[:label] == "deny" }
+      high = rows.select { |row| row[:p] && row[:p] >= threshold }
+      [rule, rows.size, allowed, denied,
+       high.count { |row| ALLOW_LABELS.include?(row[:label]) },
+       high.count { |row| row[:label] == "deny" },
+       rows.count { |row| row[:p].nil? }]
+    end
+  end
+end

data/lib/samagotchi/hold_stop.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require_relative "log"
+require_relative "session_manager"
+require_relative "tools/task_runtime"
+
+module Samagotchi
+  # Stops what a session's user can stop themselves when they ask its worker
+  # to exit: the reminders its Engine holds, the background tasks it watches
+  # for a finish wake that still run, and its delegate children with a live
+  # worker (docs/sessions.md, "Worker idle exit"). Called by the exit ask's
+  # "stop them and exit" (Worker#exit_request with stop: true), and the same
+  # step the web's Stop will use.
+  #
+  # What the user can't stop from here (a turn running, prompts queued, a
+  # continue offer, another UI attached) is never touched: WorkerIdleExit
+  # refuses the exit for those before this is called.
+  class HoldStop
+    # What was stopped, by kind: reminder names, task commands, children's
+    # short ids. The 200's +stopped+ is this as JSON.
+    Stopped = Data.define(:reminders, :tasks, :delegates) do
+      def initialize(reminders: [], tasks: [], delegates: []) = super
+
+      def any? = reminders.any? || tasks.any? || delegates.any?
+    end
+
+    # @param engine [Engine] #reminder_store
+    # @param task_watch [TaskWatch, nil] this session's finish-wake watch
+    #   (nil with session.task_wakes: off)
+    # @param delegates [#call] the children to stop (ChildrenStatus::Child)
+    # @param state_dir [String] where the child sessions live
+    def initialize(engine:, task_watch:, delegates:, state_dir:)
+      @engine = engine
+      @task_watch = task_watch
+      @delegates = delegates
+      @state_dir = state_dir
+    end
+
+    # Stop every hold the user can stop, read again as it is done (one may
+    # have ended in the meantime). A stop that fails is logged and left out
+    # of the report.
+    # @return [Stopped]
+    def stop_all
+      Stopped.new(reminders: stop_reminders, tasks: stop_tasks, delegates: stop_delegates)
+    end
+
+    private
+
+    # Reminders live only in this process, so clearing the store ends them;
+    # the names go to the report before it is emptied.
+    def stop_reminders
+      store = @engine.reminder_store
+      return [] unless store
+
+      names = store.reminders.values.map { |reminder| reminder[:name] }
+      store.clear_all
+      names
+    end
+
+    # The watched tasks still running, stopped the way task_stop and the
+    # web's stop-task button do (TaskRuntime.stop_task, by: "user").
+    def stop_tasks
+      return [] unless @task_watch
+
+      @task_watch.running.filter_map do |task|
+        record, error = Tools::TaskRuntime.stop_task(task.id, by: "user")
+        if record.nil?
+          Log.warn(:worker, "exit_stop_task_failed", task_id: task.id, error: error.to_s)
+          next nil
+        end
+
+        task.command
+      end
+    end
+
+    # The delegate children, stopped as `chi sessions stop` stops a session
+    # (SessionManager.stop_session: its turn canceled, its worker TERMed).
+    # One owned by another terminal is left running and said so in the log.
+    def stop_delegates
+      @delegates.call.filter_map do |child|
+        SessionManager.stop_session(child.id, state_dir: @state_dir)
+        child.short_id
+      rescue StandardError => e
+        Log.warn(:worker, "exit_stop_delegate_failed", child: child.short_id, error: e.class.name, msg: e.message)
+        nil
+      end
+    end
+  end
+end

data/lib/samagotchi/memory_bundle/index_updater.rb

@@ -88,6 +88,19 @@ module Samagotchi
         end
       end
 
+      # +entry_name+'s description in +scope+'s index.md — the text after the
+      # " — " on its managed line — or nil when the index has no line for it
+      # or that line carries no description. One small file read.
+      def self.description_for(scope, entry_name)
+        index_path = index_path_for(scope)
+        return nil unless index_path && File.exist?(index_path)
+
+        match = File.read(index_path, encoding: "UTF-8").match(managed_pattern(entry_name))
+        match ? extract_description(match[0].chomp) : nil
+      rescue StandardError
+        nil
+      end
+
       # The bundle a managed line names ("· from <bundle>", before any
       # " — description"), or nil.
       def self.extract_source(line)

data/lib/samagotchi/prompt_warmup.rb

@@ -29,6 +29,10 @@ module Samagotchi
   #   restores the state. When /slots can't say, the warm-up runs.
   class PromptWarmup
     MODES = %w[auto off].freeze
+    # The words cache.warmup takes, in the shape YAML hands them: an unquoted
+    # on/off arrives as true/false.
+    AUTO_WORDS = %w[auto on true 1].freeze
+    OFF_WORDS = %w[off false no 0].freeze
     # Seconds #take_pin waits for the busy-slot check (Client#slot_status
     # gives up within 3 s).
     DECIDE_TIMEOUT = 3
@@ -36,12 +40,13 @@ module Samagotchi
     STOP_JOIN_SECONDS = 1
 
     # Whether cache.warmup allows a warm-up (auto, the default; off, false,
-    # no or 0 turn it off; anything else warns once and is auto).
+    # no or 0 turn it off; on/true/1 (YAML's unquoted on) are auto; anything
+    # else warns once and is auto).
     def self.enabled?
       value = Config.get("cache.warmup").to_s.strip.downcase
-      return false if %w[off false no 0].include?(value)
+      return false if OFF_WORDS.include?(value)
 
-      unless value.empty? || value == "auto" || @warned
+      unless value.empty? || AUTO_WORDS.include?(value) || @warned
         @warned = true
         Log.warn(:config, "invalid_value", echo: "Warning: invalid value for cache.warmup: #{value.inspect} (allowed: auto, off) — using auto",
                                            key: "cache.warmup")

data/lib/samagotchi/session_access/contract.rb

@@ -26,7 +26,7 @@ module Samagotchi
       # bin/chi subcommands that act on this machine: never sessions. chi
       # remote (this machine's list of remotes) runs here under a remote too
       # (Dispatch); the others are refused there.
-      MACHINE = %w[bootstrap update models desktop memory bundle remote].freeze
+      MACHINE = %w[bootstrap update models desktop memory bundle guardrails remote].freeze
 
       # "command", "command sub" or either with a flag (its long name) →
       # SUPPORTED or LOCAL_ONLY. A LOCAL_ONLY command or subcommand lists

data/lib/samagotchi/session_access/web_bridge_client.rb

@@ -139,12 +139,17 @@ module Samagotchi
       end
 
       # POST …/exit: the worker asked to exit (chi web passes client_id on
-      # only when it is an attached TUI's).
-      # @return [BridgeClient::Response] 200 {status: exiting, discard}, 409
-      #   held {reason, tasks}, 408 late, 404 an older worker's
-      def request_exit(client_id:, delete: false)
+      # only when it is an attached TUI's), stop: true first stopping what
+      # the user can stop, ask: false leaving the delegate children out of
+      # the list (a UI that can't ask about them).
+      # @return [BridgeClient::Response] 200 {status: exiting, discard,
+      #   stopped}, 409 held {reason, tasks, holds}, 408 late, 404 an older
+      #   worker's
+      def request_exit(client_id:, delete: false, stop: false, ask: true)
         body = { client_id: client_id }
         body[:delete] = true if delete
+        body[:stop] = "all" if stop
+        body[:ask] = false unless ask
         post(:exit, "exit", body)
       end
 

data/lib/samagotchi/session_commands.rb

@@ -19,6 +19,8 @@ require_relative "reasoning_history_command"
 require_relative "working_set_command"
 require_relative "recap_command"
 require_relative "guardrails/parent_policy"
+require_relative "system_one/log"
+require_relative "system_one/record"
 
 module Samagotchi
   # The session commands a REPL and a session worker both run: /model,
@@ -91,7 +93,7 @@ module Samagotchi
       registry.register(MODELS_COMMAND, "list the hosts' models (/models <text> filters)", anytime: true) do |text|
         reply(models_listing(text.delete_prefix(MODELS_COMMAND).strip))
       end
-      registry.register(GUARDRAILS_COMMAND, "list the guardrail rules and approvals (/guardrails revoke N)",
+      registry.register(GUARDRAILS_COMMAND, "list guardrails, revoke an approval or flag a System 1 auto-allow",
                         mid_turn: show_mid_turn(GUARDRAILS_COMMAND)) do |text|
         guardrails(text.delete_prefix(GUARDRAILS_COMMAND).strip)
       end
@@ -418,11 +420,85 @@ module Samagotchi
 
     def guardrails(args)
       return guardrails_revoke(args.delete_prefix("revoke").strip) if args.start_with?("revoke")
-      return reply("usage: /guardrails [revoke N]", status: :error) unless args.empty?
+      return guardrails_wrong(args.sub(/\Awrong\b/, "").strip) if args.match?(/\Awrong(?:\s|\z)/)
+      return reply("usage: /guardrails [revoke N | wrong [N]]", status: :error) unless args.empty?
 
       reply(guardrails_listing)
     end
 
+    def guardrails_wrong(arg)
+      unless arg.empty? || arg.match?(/\A[1-9]\d*\z/)
+        return reply("usage: /guardrails wrong [N] (N from /guardrails)", status: :error)
+      end
+
+      index = arg.empty? ? 1 : arg.to_i
+      entry = system_one_auto_allows[index - 1]
+      return reply("no unlabelled System 1 auto-allows in this session (see /guardrails)") unless entry
+      unless system_one_log.label(entry["id"], "should_have_asked")
+        return reply("could not label System 1 auto-allow #{index} (see the guardrails log)", status: :error)
+      end
+
+      call = shorten_call(entry["call"].to_s.gsub(/\s+/, " "))
+      probability = entry["p"].nil? ? "unknown" : format("%.2f", entry["p"].to_f)
+      reply("labelled auto-allow #{index}: #{entry["rule"]}: #{call} (p=#{probability}); " \
+            "the rule will ask again until its record is rebuilt")
+    end
+
+    def system_one_log
+      SystemOne::Log.new(dir: File.dirname(@engine.guardrail_approvals.path))
+    end
+
+    def system_one_auto_allows(entries = system_one_entries)
+      session_id = @engine.session&.id
+      return [] unless session_id
+
+      entries.select do |entry|
+        entry["session_id"] == session_id && entry["decision"] == "auto" && entry["answer"].nil?
+      end.last(20).reverse
+    end
+
+    def system_one_entries
+      log = system_one_log
+      File.file?(log.path) ? log.entries : []
+    end
+
+    def system_one_listing(lines)
+      entries = system_one_entries
+      mode = Config.get("guardrails.system_one.mode").to_s
+      return if mode == "off" && entries.empty?
+
+      lines << "System 1 (#{mode}):"
+      auto_allows = system_one_auto_allows(entries)
+      lines << "  auto-allows (this session, newest first; /guardrails wrong N):"
+      if auto_allows.empty?
+        lines << "    (none)"
+      else
+        auto_allows.each_with_index do |entry, index|
+          call = shorten_call(entry["call"].to_s.gsub(/\s+/, " "))
+          probability = entry["p"].nil? ? "unknown" : format("%.2f", entry["p"].to_f)
+          lines << "    #{index + 1}. #{entry["rule"]}: #{call} (p=#{probability})"
+        end
+      end
+
+      rules = entries.filter_map { |entry| entry["rule"] }.uniq.sort
+      lines << "  records:"
+      if rules.empty?
+        lines << "    (none)"
+      else
+        rules.each do |rule|
+          summary = SystemOne::Record.new(entries, rule: rule).summary
+          counts = summary.reject { |key, _| key == :rule }.map { |key, value| "#{key}=#{value}" }.join(", ")
+          lines << "    #{rule}: #{counts}"
+        end
+      end
+    end
+
+    CALL_SHOWN = 100
+
+    def shorten_call(call)
+      call.length > CALL_SHOWN ? "#{call[0, CALL_SHOWN - 1]}…" : call
+    end
+
     def guardrails_listing
       rules = @engine.guardrail_rules
       approvals = @engine.guardrail_approvals.entries
@@ -467,6 +543,7 @@ module Samagotchi
       lines << "  (none)" if approvals.empty?
       approvals.each_with_index { |entry, idx| lines << "  #{idx + 1}. #{approval_line(entry)}" }
       lines << "revoke one with /guardrails revoke N" unless approvals.empty?
+      system_one_listing(lines)
       lines.join("\n")
     end