samagotchi 0.12.0 → 0.13.0

data/lib/samagotchi/bundle_command.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "cli/flags"
+require_relative "cli/exit"
 require_relative "memory_bundle"
 
 module Samagotchi
@@ -109,7 +110,7 @@ module Samagotchi
       when "build" then build(@argv[1..])
       else
         @stderr.puts "Unknown bundle subcommand: #{sub}. Use: install, upgrade, uninstall, status, diff, list, build"
-        return 2
+        return CLI::Exit::USAGE
       end
     end
 
@@ -124,7 +125,7 @@ module Samagotchi
       force = opts.fetch(:force, false)
       if source.nil? || source.empty?
         @stderr.puts "Usage: chi bundle install <source> [--scope system|project] [--force]"
-        return 2
+        return CLI::Exit::USAGE
       end
       expanded_source = expand_source(source)
       if Samagotchi::MemoryBundle::Profile.shipped_meta?(expanded_source)
@@ -148,7 +149,7 @@ module Samagotchi
       agent = opts[:agent]
       if source.nil? || source.empty?
         @stderr.puts "Usage: chi bundle upgrade <source> [--scope system|project] [--force] [--dry-run]"
-        return 2
+        return CLI::Exit::USAGE
       end
       expanded_source = expand_source(source)
       if Samagotchi::MemoryBundle::Profile.shipped_meta?(expanded_source)
@@ -217,7 +218,11 @@ module Samagotchi
 
     # An upgrade that kept edited files: launch an agent to merge them
     # (--agent, or yes on a terminal), or say how to take the bundle's.
-    # @return [Integer] 0 resolved, 2 kept the edits
+    # An upgrade that kept edited files exits 2, as a usage error does
+    # (scripts already read it so): not CLI::Exit::USAGE by meaning.
+    CONFLICTS_KEPT = 2
+
+    # @return [Integer] 0 resolved, CONFLICTS_KEPT kept the edits
     def upgrade_conflicts(installer, bundle_name, expanded_source, agent)
       @stdout.puts "\n#{installer.conflicts.size} conflict(s) need resolution."
       installer.conflicts.each { |k, _| @stdout.puts "  conflict: #{k}" }
@@ -227,13 +232,13 @@ module Samagotchi
                  ans && ans.strip.downcase.start_with?("y")
                elsif agent.nil?
                  @stdout.puts "Non-interactive terminal: kept your edits in the file(s) above; the rest is upgraded. Re-run with --force to take the bundle's version, or --agent in a TTY to merge."
-                 return 2
+                 return CONFLICTS_KEPT
                else
                  agent
                end
       unless launch
         @stdout.puts "Kept your edits in the file(s) above; the rest is upgraded. chi bundle diff #{bundle_name} FILE shows the base; re-run with --force to take the bundle's version."
-        return 2
+        return CONFLICTS_KEPT
       end
 
       prompt = build_conflict_prompt(bundle_name, installer.conflicts, expanded_source)
@@ -258,7 +263,7 @@ module Samagotchi
       force = opts.fetch(:force, false)
       if bundle_name.nil? || bundle_name.empty?
         @stderr.puts "Usage: chi bundle uninstall <bundle> [--scope system|project] [--force]"
-        return 2
+        return CLI::Exit::USAGE
       end
       data = Samagotchi::MemoryBundle::Provenance.new(name: bundle_name).read
       return uninstall_profile(bundle_name, force: force) if Samagotchi::MemoryBundle::Profile.installed_meta?(bundle_name, data)
@@ -355,6 +360,8 @@ module Samagotchi
             exists = File.exist?(hook_path) ? "ok" : "missing"
             @stdout.puts "    #{hk}: event=#{event} on_error=#{on_error} priority=#{prio} [#{exists}]"
           end
+          @stdout.puts "    requires_chi: #{st[:provenance][:requires_chi]}" if st[:hooks_requires_failure]
+          @stdout.puts "    not loaded: #{st[:hooks_requires_failure]}" if st[:hooks_requires_failure]
         end
         if (plugin = st[:plugin])
           note = plugin[:state] == "modified" ? " (edited after install: not loaded; reinstall the bundle)" : ""
@@ -379,6 +386,7 @@ module Samagotchi
           hook_info = hooks_count > 0 ? " hooks=#{hooks_count}" : ""
           plugin = st[:plugin]
           mods += 1 if plugin && (plugin[:state] != "ok" || plugin[:requires_failure])
+          mods += 1 if st[:hooks_requires_failure]
           plugin_info = plugin ? " plugin=#{plugin[:file]}" : ""
           includes = st[:provenance][:includes]
           includes_info = includes ? " includes=#{includes.join(",")}" : ""
@@ -393,7 +401,7 @@ module Samagotchi
       bname = args[0]
       file_arg = args[1]
       if bname.nil? || bname.empty?
-        @stderr.puts "Usage: chi bundle diff <bundle> [file]"; return 2
+        @stderr.puts "Usage: chi bundle diff <bundle> [file]"; return CLI::Exit::USAGE
       end
       prov = Samagotchi::MemoryBundle::Provenance.new(name: bname)
       data = prov.read
@@ -534,7 +542,7 @@ module Samagotchi
       # Validate scope if given
       if scope && !%w[system project].include?(scope.to_s.strip.downcase)
         @stderr.puts "Invalid scope '#{scope}', expected system or project"
-        return 2
+        return CLI::Exit::USAGE
       end
       begin
         builder = Samagotchi::MemoryBundle::Builder.new(
@@ -573,7 +581,7 @@ module Samagotchi
       end
       if parsed.error
         @stderr.puts "Unknown bundle #{sub} flag: #{parsed.error.arg}"
-        return 2
+        return CLI::Exit::USAGE
       end
       parsed
     end

data/lib/samagotchi/bundles/guardrails/guardrails/rules.yml

@@ -80,3 +80,22 @@ rules:
     command: '(\.config/samagotchi|samagotchi/config\.yml|samagotchi/hooks|samagotchi/guardrails|memories/\.bundles|\.git/hooks)'
     verdict: ask
     reason: the command names chi's config, hooks, guardrails or git hooks
+
+  # ── answering chi's own questions around chi answer ───────────────────
+  # A parent agent answers a child's approval with chi answer, which holds it
+  # to guardrails.parent_approvals. These shapes go around that: chi --attach
+  # or chi -p with stdin from a pipe, a here-string or a file (a chi after 0.12 treats
+  # those as a parent too, but an older child doesn't), and a POST to the
+  # Bridge's or the web's answer route.
+  - id: chi-answer-piped
+    tool: shell
+    command: '(\|[^;&|\n]*\bchi\s([^;&|\n]*\s)?(--attach|--prompt|-p)\b|\bchi\s([^;&|\n]*\s)?(--attach|--prompt|-p)\b[^;&|\n]*<)'
+    verdict: ask
+    scopes: [once, session]
+    reason: answers chi's questions from a pipe or a file, around chi answer
+  - id: chi-answer-http
+    tool: shell
+    command: '\b(curl|wget|http|xh)\b[^;&|\n]*/answer\b'
+    verdict: ask
+    scopes: [once, session]
+    reason: posts an answer to a chi session's question directly, around chi answer

data/lib/samagotchi/bundles/guardrails/manifest.yml

@@ -1,8 +1,8 @@
 ---
 name: guardrails
-version: 0.2.0
+version: 0.3.0
 scope: system
-description: Optional default guardrail rules (git push/rewrites, rm -rf wide, curl | sh, writes outside the repo, git hooks), asks only small models get (git checkout --/restore, git stash drop), and a note for the model
+description: Optional default guardrail rules (git push/rewrites, rm -rf wide, curl | sh, writes outside the repo, git hooks, answering chi around chi answer), asks only small models get (git checkout --/restore, git stash drop), and a note for the model
 trust_level: reviewed
 # models: in small-models.yml (guardrails.small_models)
 requires_chi: ">= 0.8.1"

data/lib/samagotchi/bundles/system/config_modification_protocol.md

@@ -60,7 +60,7 @@ Only the nested form is read. An env name used as a top-level key (`SAMAGOTCHI_D
 - `hosts:` map of `name → {host, port | url, transport, api, api_key_env, profile, first_token_timeout, vision, sampling, thinking, enabled}` (`ConfigFile.hosts_config`, `host_registry.rb` `HostEntry`). Names lowercased; `url:` (http/https, optional path) replaces host/port, never both; `api_key_env:` names the env var holding the API key (never write a key into config.yml); `transport` overrides `server.transport`; `first_token_timeout` (seconds, `0` = off; a negative or non-number warns and is ignored) overrides `server.first_token_timeout` for that host; workers inherit via `SAMAGOTCHI_HOSTS_JSON` (`hosts_json_for_env`, `session_manager.rb`).
 - `models:` map of model id or alias → `{profile, vision, sampling, thinking}` (`ConfigFile.model_settings`). `thinking:` (here, on a host, or `thinking.level` for every model) is `off|low|medium|high|default` (`Thinking`; unquoted `off` works, `on` is not a level; `default` = send nothing). Precedence: `--thinking`/`SAMAGOTCHI_THINKING_LEVEL` > `models:` > `hosts.<name>.thinking` > `thinking.level` in config.yml > `default`. A `sampling:` key wins over the fields a level sends (`null` drops one); `docs/configuration.md` "Thinking". `sampling:` (here or on a host) is a map of request fields passed to the provider as written (`temperature`, `top_p`, `presence_penalty`, `repeat_penalty`, …; a model's fields win over its host's per field; `null` = don't send; chi's own fields like `max_tokens`/`stream` are refused with a warning; `docs/configuration.md` "Sampling"). Keys match case-insensitively. `profile` (here or on a host) is `qwen36|gemma4`: the raw prompt format for native hosts. Precedence: `--profile`/`SAMAGOTCHI_MODEL_PROFILE` > `models:` > `hosts.<name>.profile` > the llama.cpp server's chat template > the name (`qwen`/`gemma`) > `qwen36` (`ModelProfile.resolve`). Set one when a model's name hides its family (e.g. a Qwen fine-tune under another name on mlx, which has no template to read).
 - `hooks:` map of `hooks_dir` + per-event lists `{path, on_error}` (`Hooks::Loader.load`). `hooks_dir` may start with `~`.
-- `guardrails:` tool-call rules (`docs/guardrails.md`; read in `Engine#guardrail_rules`, parsed by `Guardrails::Rules.parse`): `enabled` (bool, default true; `false` drops rules and hooks' asks, a deny still applies; env `SAMAGOTCHI_GUARDRAILS_ENABLED`), `rules:` (list), `disable:` (list of rule ids, `id` or `bundle:id`, switching off a bundle's or config rule without editing it). A rule takes only `id`, `tool`, `command`, `path`, `verdict`, `reason`, `scopes`: `id` required; at least one of `tool` (a name, `shell` = execute + task_create, a `File.fnmatch` glob like `"mcp_*"`, or a list), `command` (a Ruby regex on the shell command), `path` (a glob, or `outside_repo`); `verdict` `ask|deny`; `scopes` (for `ask`) a subset of `once, session, repo, rule`. **Any parse error (an unknown key, a bad regex, no verdict) makes chi deny every tool call** until fixed, so validate with `YAML.safe_load` and keep the list shape. Rules load when a session starts: restart the worker/REPL after an edit. Installed bundles' rule files (`chi bundle install guardrails`) add to them; `/guardrails` lists what loaded.
+- `guardrails:` tool-call rules (`docs/guardrails.md`; read in `Engine#guardrail_rules`, parsed by `Guardrails::Rules.parse`): `enabled` (bool, default true; `false` drops rules and hooks' asks, a deny still applies; config.yml only, like every `guardrails` setting: no env variable), `parent_approvals` (`off`, the default: a parent agent's `chi answer` can only deny an approval; `once`: it may give "Allow once" too; a convention for an honest parent, not a security boundary, and the user's choice: set it only when the user asks), `rules:` (list), `disable:` (a rule id or a list of them, `id` or `bundle:id`, switching off a bundle's or config rule without editing it), `small_models` (`auto`, the default: small = 32B or less read from the name; a glob or list of globs; `[]` for none). A rule takes only `id`, `tool`, `command`, `path`, `models`, `verdict`, `reason`, `scopes`: `id` required; at least one of `tool` (a name, `shell` = execute + task_create, a `File.fnmatch` glob like `"mcp_*"`, or a list), `command` (a Ruby regex on the shell command), `path` (a glob, or `outside_repo`); `models` (optional: `small`, a model-name glob, or a list; without it the rule is for every model); `verdict` `ask|deny`; `scopes` (for `ask`) a subset of `once, session, repo, rule`. **Any parse error (an unknown key, a bad regex, no verdict) makes chi deny every tool call** until fixed, so validate with `YAML.safe_load` and keep the list shape. Rules are read again on the next tool call after config.yml or a bundle's rules change: no restart needed. Installed bundles' rule files (`chi bundle install guardrails`) add to them; `/guardrails` lists what loaded.
 
 ```yaml
 guardrails:
@@ -122,7 +122,7 @@ A guardrail rule's `tool:` may be a glob (`tool: "mcp_*"`, verdict `ask`) to cov
 3. Mutate the intended **nested** key in the raw hash. Preserve all other keys byte-for-byte where possible. Example for default model: `raw_data["default"] ||= {}; raw_data["default"]["model"] = "new-model"`.
 4. **Validate** (see below) before writing. Also run `Samagotchi::Config.validate_yaml_sections` — it returns one `config: unknown key '…' (did you mean '…'?)` per key chi doesn't read (every config-exposed `Config::ENTRIES` key is known as written, including the section-less `max_tool_output_chars` and `skip_agent_md`; names under `hosts:`/`models:`/`model_aliases:`/`hooks:`/`bundles:`/`memories:` are free-form, host and model entries are checked against `Config::MAP_ENTRY_KEYS`). An empty list means no warning at start.
 5. **Write**: change only the lines you mean to, with the edit tool, so the user's comments and layout stay; `YAML.dump` of the whole hash drops every comment, so rewrite the file only when it has none worth keeping. From Ruby, write atomically with `Samagotchi::AtomicFile.write(path, text)` (a unique temp file renamed over it), never through a fixed `"#{path}.tmp"` that another chi may be writing at the same time.
-6. Nothing else to update: config.yml values are never copied into `ENV`, and every `Config.get` reads the file again when it changed, so the next read (and every worker started after the write) sees the new value with origin `:file`. What a running worker set up at its start (`hosts:`, guardrail rules, bundle settings) waits for its restart. CLI overrides (`--model`, `--recap-model`, …) win over the file until the process exits; a worker gets its spawner's CLI settings through its env (`Config.cli_env`).
+6. Nothing else to update: config.yml values are never copied into `ENV`, and every `Config.get` reads the file again when it changed, so the next read (and every worker started after the write) sees the new value with origin `:file`. What a running worker set up at its start (`hosts:`, bundle settings) waits for its restart; guardrail rules and `model_aliases:` are read again live. CLI overrides (`--model`, `--recap-model`, …) win over the file until the process exits; a worker gets its spawner's CLI settings through its env (`Config.cli_env`).
 
 ## Validations
 
@@ -136,8 +136,8 @@ A guardrail rule's `tool:` may be a glob (`tool: "mcp_*"`, verdict `ask`) to cov
   - must not point to itself (case-insensitive)
   - keys are normalized to downcase on write — `Qwen` and `qwen` collide
 - **Alias target**: non-empty string (model id).
-- **Hosts**: each entry needs `host`, `port` 1-65535, `transport` and `api` optional (a raw `api` must match `transport`), name must match `/\A[a-z0-9][a-z0-9._-]*\z/i`.
-- **Hooks**: each entry must have `path` (relative to `hooks_dir`), `on_error` is `skip` (default) or `log`. Class name must match file basename snake→Pascal.
+- **Hosts**: each entry needs `host` (or `url:`, an http(s) URL with an optional path, replacing `host`/`port`; never both), `port` 1-65535 (default 8080), `enabled: false` skips the entry, `transport` and `api` optional (a raw `api` must match `transport`), name must match `/\A[a-z0-9][a-z0-9._-]*\z/i`.
+- **Hooks**: each entry must have `path` (relative to `hooks_dir`), `on_error` is `skip` (default) or `log`; `required: true` on a `before_tool_call` hook denies the call when the hook raises. Class name must match file basename snake→Pascal.
 - **Scalars via registry**: `Config.coerce` validates `String/Numeric/true/false` per `type: :string/:integer/:float/:bool/:enum`; invalid values warn and fall back to entry `default`.
 - **Keys**: `validate_yaml_sections` flags unknown keys (with a suggestion), a registry section that isn't a mapping, and env/CLI-only keys (`model.profile`).
 
@@ -151,5 +151,5 @@ A guardrail rule's `tool:` may be a glob (`tool: "mcp_*"`, verdict `ask`) to cov
 
 - Precedence is `CLI > ENV > file > default` (`Config.resolve`; `Config.get_with_origin` names the layer). `ENV` holds only what the user (or a spawning chi's CLI flags) set, and CLI (`--recap-base-url`) wins over both via `Config.reload!(cli_overrides:)`.
 - `--recap_base_url` (underscore) is rejected as unknown — use `--recap-base-url` (kebab). Same for all registry flags.
-- `model_aliases` require restart or `/model` reload to take effect; document the change.
+- `model_aliases` are read again at each model resolution: an edit applies to the next `--model`, `/model`, new session or delegate, no restart. A running session keeps the model it already resolved.
 - Keep edits minimal: touch only the key you intend to change; preserve `hosts:`/`hooks:`/`guardrails:`/`bundles:` maps. Adding a `bundles: <name>:` entry does not install the bundle (`chi bundle install <name>`).

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.12.0
+version: 0.13.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:29c2f7df9f6c5acbc5ec17000a4490741e55e426af15ca0d81c8706edd9bd027
   self_map.md: sha256:93c788fadaf98adeb8946b4a357d2372bd6ebb439042d7cef8dda8fb44187315
-  config_modification_protocol.md: sha256:dddd083d6f419674e6e0cc39118ca9785583a557e4950af1a9b028e52e8a3e0c
+  config_modification_protocol.md: sha256:d0e9d4a84652bf54ec2fd664f61c536637af9decdd22fcd982f52195bf9f5fb4
   memory_guide.md: sha256:81b911b9a015f0924c48162b3dc4b6376309e743765074419a99fab46e480858
   delegated.md: sha256:0a71d5dfa7127df2d51cb5f0e7214240ed88777e36559430a8724c796d7ae561

data/lib/samagotchi/cli/command.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "exit"
+
 module Samagotchi
   module CLI
     # The usage side of a subcommand: its error lines, usage errors (exit 2)
@@ -7,7 +9,6 @@ module Samagotchi
     # #command_name ("chi send"); its usage text is USAGE unless it
     # overrides #usage_text.
     module Command
-      USAGE_EXIT = 2
       HELP_WORDS = %w[-h --help help].freeze
 
       private
@@ -30,7 +31,7 @@ module Samagotchi
         usage = usage_on_error
         error_line("#{command_name}: #{message}#{usage ? "" : " (see #{command_name} --help)"}")
         @stderr.puts(usage) if usage
-        USAGE_EXIT
+        Exit::USAGE
       end
 
       # +argv+ through +flags+ (a Flags), help and usage errors done.

data/lib/samagotchi/cli/exit.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  module CLI
+    # chi's exit statuses, one table for every subcommand (docs/cli.md,
+    # docs/sub-agent.md): a script or a parent agent branches on them.
+    module Exit
+      OK = 0
+      # Anything that went wrong at run time: a refusal, a failed turn, a
+      # worker gone, a file that isn't there.
+      FAILED = 1
+      # The command line itself: an unknown flag, a missing argument, an
+      # option the question doesn't offer.
+      USAGE = 2
+      # A question waits for an answer (chi send --wait, chi answer, chi -p).
+      QUESTION = 3
+      # Still running after --timeout.
+      RUNNING = 4
+      # Ctrl-C: what a shell gives a command it interrupted.
+      INTERRUPTED = 130
+    end
+  end
+end

data/lib/samagotchi/cli/parent_wait.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require_relative "../session"
+require_relative "../reply_wait"
+require_relative "../parent_report"
+require_relative "exit"
+
+module Samagotchi
+  module CLI
+    # The parent-agent side shared by `chi send --wait` and `chi answer`:
+    # --format json's one object whatever the end, the session id resolved
+    # for it, and the wait for what comes next, reported the ParentReport
+    # way (Ctrl-C included). The including class (a CLI::Command) defines
+    # #parse (options, or an exit status) and #run_parsed(options), sets
+    # @stdout, @stderr and @state_dir, and may override the constants
+    # (specs stub them on the class).
+    module ParentWait
+      POLL_INTERVAL = ReplyWait::POLL_INTERVAL
+      # No live worker this long while waiting: it died before it could mark
+      # the session (a worker takes well under a second to start).
+      WORKER_GONE_AFTER = 5
+      FORMATS = %w[text json].freeze
+
+      # @return [Integer] the exit status
+      def run
+        options = parse
+        return options if options.is_a?(Integer)
+
+        @json = options[:format] == "json"
+        # With --format json stdout is one JSON object, whatever the end: a
+        # failure before the wait is reported from stderr's last line.
+        @stderr = ParentReport::LastLine.new(@stderr) if @json
+        status = run_parsed(options)
+        if @json && !@reported && status == 1
+          detail = @stderr.last.to_s.delete_prefix("#{command_name}: ")
+          @stdout.puts(ParentReport.error_line(detail, session_id: @session_id))
+          @stdout.flush
+        end
+        status
+      end
+
+      private
+
+      # The full id of +given+ (an id or a prefix), kept for the JSON
+      # error line; nil after the error line.
+      # @return [String, nil]
+      def resolve(given)
+        id = Session.resolve_id(given, state_dir: @state_dir)
+        Session.load(id, state_dir: @state_dir)
+        @session_id = id
+      rescue ArgumentError => e
+        error_line("#{command_name}: #{e.is_a?(Session::AmbiguousId) ? e.message : "no session #{given}"}")
+        nil
+      end
+
+      # Wait for the session's next reply past +cursor+ (ReplyWait) and
+      # report it. Ctrl-C leaves the turn running (130).
+      # @param owner_grace [Numeric, nil] seconds with no live worker before
+      #   it counts as gone; nil waits for whatever wakes one
+      # @return [Integer] the exit status
+      def wait_for_reply(id, cursor:, baseline:, timeout:, owner_grace: self.class::WORKER_GONE_AFTER)
+        result = ReplyWait.call(id, state_dir: @state_dir, cursor: cursor, timeout: timeout, baseline: baseline,
+                                    owner_grace: owner_grace, poll_interval: self.class::POLL_INTERVAL)
+        result.text = result.text&.dup&.force_encoding(Encoding::UTF_8)&.scrub
+        @reported = true
+        ParentReport.report(result, session_id: id, stdout: @stdout, stderr: @stderr, command: command_name,
+                                    json: @json, timeout: timeout)
+      rescue Interrupt
+        if @json
+          @stdout.puts(ParentReport.json_line(ReplyWait::Result.new(status: :canceled), session_id: id))
+          @stdout.flush
+          @reported = true
+        end
+        error_line("#{command_name}: still running: chi --attach #{id}")
+        Exit::INTERRUPTED
+      rescue ArgumentError
+        error_line("#{command_name}: the session is gone (deleted while waiting)")
+        Exit::FAILED
+      end
+    end
+  end
+end

data/lib/samagotchi/config.rb

@@ -104,10 +104,14 @@ module Samagotchi
       Entry.new(key: "image.max_bytes",          yaml_path: %w[image max_bytes],          type: :integer, default: 3_750_000,       expose: %i[env config]),
       Entry.new(key: "image.max_per_request",    yaml_path: %w[image max_per_request],    type: :integer, default: 20,              expose: %i[env config]),
 
-      Entry.new(key: "guardrails.enabled",       yaml_path: %w[guardrails enabled],       type: :bool,   default: true,             expose: %i[env config]),
+      # The guardrails settings are config.yml only: a parent agent must not switch a child's guardrails off from its
+      # own environment (SAMAGOTCHI_GUARDRAILS_ENABLED=false). SessionManager.spawn_options unsets them for a worker too.
+      Entry.new(key: "guardrails.enabled",       yaml_path: %w[guardrails enabled],       type: :bool,   default: true,             expose: %i[config]),
       # Which models get the rules with `models: small` (Guardrails::ModelSize): auto (32B or less by the name's size, an MoE's
       # active size counting), globs on the bare model name or its key, "|"-separated (a YAML list works too), or "" ([]) for none.
-      Entry.new(key: "guardrails.small_models",  yaml_path: %w[guardrails small_models],  type: :string, default: "auto",           expose: %i[env config]),
+      Entry.new(key: "guardrails.small_models",  yaml_path: %w[guardrails small_models],  type: :string, default: "auto",           expose: %i[config]),
+      # What `chi answer` lets a parent agent allow on an approval: off (deny only) or once ("Allow once", never a wider scope).
+      Entry.new(key: "guardrails.parent_approvals", yaml_path: %w[guardrails parent_approvals], type: :enum, default: "off", expose: %i[config], enum_values: %w[off once]),
 
       Entry.new(key: "log.file",                 yaml_path: %w[log file],                 type: :string, default: nil,              expose: %i[env config cli]),
       Entry.new(key: "log.disable",              yaml_path: %w[log disable],              type: :bool,   default: false,            expose: %i[env config cli]),
@@ -156,6 +160,8 @@ module Samagotchi
       Entry.new(key: "execute.truncate_at_bytes",       yaml_path: %w[execute truncate_at_bytes],       type: :integer, default: 65_536, expose: %i[env config cli]),
       Entry.new(key: "execute.preview_bytes",           yaml_path: %w[execute preview_bytes],           type: :integer, default: 12_288, expose: %i[env config cli]),
       Entry.new(key: "execute.telemetry_threshold_pct", yaml_path: %w[execute telemetry_threshold_pct], type: :integer, default: 80,     expose: %i[env config cli]),
+      # Seconds one execute command may run before it is stopped (Tools::Execute::TIMEOUT_SEC).
+      Entry.new(key: "execute.timeout_sec",             yaml_path: %w[execute timeout_sec],             type: :integer, default: 30,     expose: %i[env config cli]),
 
       Entry.new(key: "web.port",                 yaml_path: %w[web port],                 type: :integer, default: 4567,            expose: %i[env config cli]),
       Entry.new(key: "web.host",                 yaml_path: %w[web host],                 type: :string, default: "127.0.0.1",     expose: %i[env config cli]),
@@ -695,18 +701,7 @@ module Samagotchi
 
     def hosts_config(env: ENV, path: global_path(env: env))
       data = read_yaml(env: env, path: path)
-      raw_hosts = data[HOSTS_KEY] if data.is_a?(Hash)
-
-      # ENV override: SAMAGOTCHI_HOSTS_JSON (used to propagate to workers)
-      env_json = env["SAMAGOTCHI_HOSTS_JSON"].to_s.strip
-      unless env_json.empty?
-        begin
-          parsed_env = JSON.parse(env_json)
-          raw_hosts = parsed_env if parsed_env.is_a?(Hash)
-        rescue StandardError
-          nil
-        end
-      end
+      raw_hosts = hosts_source(data, env)
 
       normalized = {}
       if raw_hosts.is_a?(Hash)
@@ -726,10 +721,8 @@ module Samagotchi
           port = raw_cfg["port"] || raw_cfg[:port]
           transport = raw_cfg["transport"] || raw_cfg[:transport]
           api = raw_cfg["api"] || raw_cfg[:api]
-          enabled = raw_cfg.key?("enabled") ? raw_cfg["enabled"] : (raw_cfg.key?(:enabled) ? raw_cfg[:enabled] : true)
-          if enabled == false || enabled.to_s.strip.downcase == "false"
-            next
-          end
+          next if host_disabled?(raw_cfg)
+
           url = (raw_cfg["url"] || raw_cfg[:url]).to_s.strip
           api_key_env = (raw_cfg["api_key_env"] || raw_cfg[:api_key_env]).to_s.strip
           # Kept as written; ModelProfile.resolve warns about an unknown one.
@@ -822,6 +815,42 @@ module Samagotchi
       {}
     end
 
+    # The names (lowercased) of the hosts entries with enabled: false, which
+    # hosts_config leaves out. Read from the same source: config.yml's
+    # hosts:, or SAMAGOTCHI_HOSTS_JSON in a worker.
+    # @return [Array<String>]
+    def disabled_host_names(env: ENV, path: global_path(env: env))
+      raw = hosts_source(read_yaml(env: env, path: path), env)
+      return [] unless raw.is_a?(Hash)
+
+      raw.filter_map { |name, cfg| name.to_s.strip.downcase if cfg.is_a?(Hash) && host_disabled?(cfg) }
+    rescue StandardError
+      []
+    end
+
+    # config.yml's hosts: as written, or the SAMAGOTCHI_HOSTS_JSON override
+    # a worker inherits from its parent.
+    def hosts_source(data, env)
+      raw = data[HOSTS_KEY] if data.is_a?(Hash)
+      env_json = env["SAMAGOTCHI_HOSTS_JSON"].to_s.strip
+      return raw if env_json.empty?
+
+      parsed = begin
+        JSON.parse(env_json)
+      rescue StandardError
+        nil
+      end
+      parsed.is_a?(Hash) ? parsed : raw
+    end
+    private_class_method :hosts_source
+
+    # enabled: false (or "false", any case) in a hosts entry.
+    def host_disabled?(cfg)
+      enabled = cfg.key?("enabled") ? cfg["enabled"] : (cfg.key?(:enabled) ? cfg[:enabled] : true)
+      enabled == false || enabled.to_s.strip.downcase == "false"
+    end
+    private_class_method :host_disabled?
+
     # Resolve the `recap:` section through the Config registry so scalar
     # recap settings share the single precedence path (CLI > ENV > file >
     # default). Returns false when explicitly disabled (file `recap: false`
@@ -908,6 +937,9 @@ module Samagotchi
                        "profile" => v[:profile], "first_token_timeout" => v[:first_token_timeout],
                        "vision" => v[:vision], "sampling" => v[:sampling], "thinking" => v[:thinking]&.to_s).compact
       end
+      # Disabled hosts travel as just that, so a worker refuses "box:x"
+      # the way its parent does instead of sending it to the default host.
+      disabled_host_names(env: env, path: path).grep(HOST_NAME_RE).each { |name| simple[name] ||= { "enabled" => false } }
       JSON.generate(simple)
     rescue StandardError
       nil

data/lib/samagotchi/desktop_command.rb

@@ -6,7 +6,8 @@ require_relative "desktop"
 
 module Samagotchi
   # `chi desktop install|upgrade|uninstall|status`: the native helper that
-  # sends selected text to live sessions as a context note (macOS for now).
+  # sends selected text (or images) to sessions, live, stopped or new, as a
+  # message or a context note (macOS for now).
   class DesktopCommand
     include CLI::Command
 
@@ -15,8 +16,9 @@ module Samagotchi
         install [--force] [--login]
                            build "Chi Helper" into ~/Applications (needs the Command Line Tools)
                            and start it: Services > "Send to chi", or ⌃⌥⌘N with the clipboard,
-                           sends text to a live session as a context note. --login: start it
-                           at login too (else it runs until you log out)
+                           sends text or images to a session (live, stopped or new) as a
+                           message (⏎) or a context note (⌘⏎). --login: start it at login
+                           too (else it runs until you log out)
         upgrade            rebuild it for this chi and restart it (chi update does this only
                            when its sources changed)
         uninstall          remove it, its settings and its launch file

data/lib/samagotchi/engine.rb

@@ -223,8 +223,6 @@ module Samagotchi
       # memory_read guard reads the same list for every turn.
       @muted_memory_names = MutedMemories.normalize_list(muted_memories)
       @kernel.muted_memory_names = @muted_memory_names
-      # Keep kernel client in sync with active host via setter
-      @kernel_client_synced = false
       # ask_user_question blocks on the Engine's question flow (TUI/Web answer it).
       @kernel.question_handler = proc { |payload| request_question(payload) }
       # Every tool call asks this gate first. The kernel is never rebuilt, so
@@ -967,10 +965,6 @@ module Samagotchi
       @prompt_builder.preloaded_memory_names
     end
 
-    def memory_muted?(name)
-      MutedMemories.muted?(name, @muted_memory_names)
-    end
-
     # ── Guardrails ─────────────────────────────────────────────────────────────
 
     # Who can answer an approval: :repl, :worker or :non_interactive (the
@@ -1245,8 +1239,8 @@ module Samagotchi
 
     # Answer the pending question (called from UI thread; QuestionDesk#answer).
     # @return [Hash] normalized answer
-    def answer_question(id:, selected:, freeform: nil)
-      @question_desk.answer(id: id, selected: selected, freeform: freeform)
+    def answer_question(id:, selected:, freeform: nil, client_id: nil)
+      @question_desk.answer(id: id, selected: selected, freeform: freeform, client_id: client_id)
     end
 
     def set_question_sync_handler(&block)
@@ -1412,7 +1406,7 @@ module Samagotchi
     # the prompt is kept in the session and :turn_canceled is emitted, then the
     # Interrupt is re-raised so the caller still decides whether to exit. One
     # after the turn's end event (in its after_turn/session_end hooks) is
-    # only re-raised: the turn already ended. Any
+    # only re-raised: the turn already ended; so is any error there. Any
     # other error (e.g. an LLM::ProviderError) emits :turn_failed and
     # re-raises; a provider error adds error_kind:, retryable:, host: and a
     # one-line summary:.
@@ -1424,7 +1418,8 @@ module Samagotchi
         # A Stop cuts the /props probes this thread makes for the turn
         # (window, served model, vision) instead of waiting their timeout.
         probe_cancel_before = Client.swap_probe_cancel(turn.controller)
-        prepare_turn(turn, continue ? [] : images)
+        return stopped_before_model(turn) unless prepare_turn(turn, continue ? [] : images)
+
         result = generate(turn, max_iterations: max_iterations, max_tool_output_chars: max_tool_output_chars,
                                 pending_input: pending_input)
         publish_used_memories(session, on_event)
@@ -1441,6 +1436,13 @@ module Samagotchi
         end
         raise
       rescue StandardError => e
+        # After the end event (post-turn work) likewise: logged and
+        # re-raised, no turn_failed over the turn that ended.
+        if turn.ended
+          Log.warn(:turn, "post_turn_error", error: "#{e.class}: #{e.message}")
+          raise
+        end
+
         # Keep what the turn got to (the prompt plus the loop's completed
         # tool iterations) like a cancel does, and save it: a worker exits
         # after a failed turn. The REPL still rolls back to its checkpoint.
@@ -1482,7 +1484,9 @@ module Samagotchi
 
     # Everything before the model is asked: :turn_started, the kernel's
     # per-turn settings, the plugins' setup, the session_start/before_turn
-    # hooks, then the messages to send (#turn_messages).
+    # hooks, then the messages to send (#turn_messages). False when a Stop
+    # came before the hooks (the turn ends canceled there; before the
+    # load-failure warnings when it came during the probes), else true.
     def prepare_turn(turn, images)
       session = turn.session
       image_refs, image_error = turn_image_refs(session, images)
@@ -1506,6 +1510,10 @@ module Samagotchi
       # Before anything of the turn is kept or a reminder is used up.
       turn.settings = turn_settings(session)
       refuse_images!(turn.settings.vision) unless image_refs.empty?
+      # A Stop during the probes: the turn ends before the load-failure
+      # warnings, which show once, so the next turn still shows them.
+      return false if turn.controller.cancelled?
+
       announce_guardrail_failures(turn.on_event)
       # Plugins' slow setup that brings tools (an MCP server's first
       # start): the turn waits for it here, before the system prompt
@@ -1515,6 +1523,9 @@ module Samagotchi
       await_init_tasks(turn.controller, turn.on_event)
       # Plugins' tool sets that changed since the last turn.
       apply_staged_tools!
+      # A Stop during the wait above: the turn ends here,
+      # before the hooks run or a reminder is used up.
+      return false if turn.controller.cancelled?
 
       # Fire :session_start on the very first turn
       if @first_turn
@@ -1528,9 +1539,22 @@ module Samagotchi
                                   messages: hook_messages(session.messages) })
 
       turn_messages(turn, image_refs)
+      true
     end
     private :prepare_turn
 
+    # A turn stopped before the model was asked (#prepare_turn returned
+    # false): canceled with nothing kept, like a Ctrl-C there; the result
+    # has no conversation, so a UI's checkpoint stands.
+    def stopped_before_model(turn)
+      reason = turn.controller.reason
+      end_turn(turn, "canceled") do |seconds|
+        [nil, { type: :turn_canceled, cancellation_reason: reason, duration_ms: (seconds * 1000).round }]
+      end
+      LLM::ModelResult.new(text: "", canceled: true, cancellation_reason: reason)
+    end
+    private :stopped_before_model
+
     # The turn's settings for the kernel (LLM::TurnSettings): vision,
     # sampling and thinking, the thinking resolved before the hooks run.
     # The model name is added in #generate, after the hooks that may switch
@@ -1640,7 +1664,8 @@ module Samagotchi
         end
       end
 
-      # Fire :after_turn hook (runs even on cancel/success), with a read-only
+      # Fire :after_turn hook (an answer or a Stop; an Interrupt or a failure
+      # ends the turn in #run_turn without it), with a read-only
       # copy of the conversation the turn stored, and event[:present] for
       # a display version of the answer (AnswerDisplay).
       session = turn.session
@@ -1651,7 +1676,7 @@ module Samagotchi
       @hooks.fire(:after_turn, after_turn)
       store_answer_display(session, display, pending: display_pending)
 
-      # Fire :session_end after every turn (turn-level lifecycle)
+      # Fire :session_end after the turn (turn-level lifecycle), as :after_turn
       @hooks.fire(:session_end, { type: :session_end, session_id: session.id })
     end
     private :complete_turn
@@ -1973,7 +1998,8 @@ module Samagotchi
         end
         begin
           Hooks::BundleLoader.load(bundle_name: bundle_name, hooks_dir: hooks_dir, metadata: data[:hooks], registry: @hooks,
-                                   failures: @guardrail_failures, settings: settings[bundle_name.to_s] || {})
+                                   failures: @guardrail_failures, settings: settings[bundle_name.to_s] || {},
+                                   requires_chi: data[:requires_chi])
         rescue Exception => e
           Log.error(:hooks, "bundle_load_failed", echo: "[samagotchi:hooks] bundle '#{bundle_name}' failed to load hooks: #{e.class}: #{e.message}", bundle: bundle_name, error: e.class.name)
         end