samagotchi 0.128.0 → 0.129.0

data/lib/samagotchi/guardrails/shell_paths.rb

@@ -48,7 +48,8 @@ module Samagotchi
       # word resolved as #touches? resolves it); a word that can't be
       # resolved, a command with a $(…) or backticks, or one that doesn't
       # lex, by the text match +text+ instead.
-      # @yieldparam path [String] an absolute path (not resolved for symlinks)
+      # @yieldparam path [String] an absolute path (not resolved for
+      #   symlinks but for a `..` climbing out of one: Walk)
       def any_path?(command, text:, cwd:, home: Dir.home, env: ENV)
         walk = Walk.new(cwd, home, env)
         tokens = ShellLex.lex(command.to_s)
@@ -63,21 +64,35 @@ module Samagotchi
       end
 
       def names?(path, roots, tmp_roots)
-        real = ProtectedPaths.real(path)
-        return true if roots.any? { |root| within?(real, root) }
+        ProtectedPaths.reals(path).any? do |real|
+          next true if roots.any? { |root| within?(real, root) }
 
-        real.match?(HOOKS_PART) && tmp_roots.none? { |tmp| within?(real, tmp) }
+          real.match?(HOOKS_PART) && tmp_roots.none? { |tmp| within?(real, tmp) }
+        end
       end
 
       def within?(path, root) = path == root || path.start_with?(File.join(root, ""))
 
       # Follows the current dir and gives, per simple command, each word
-      # with its path (nil when it can't be resolved).
+      # with its path (nil when it can't be resolved). A word is opened the
+      # kernel's way, so a `..` after a symlinked dir climbs out of its
+      # target: such a word comes twice, with its lexical path and its
+      # physical one (ProtectedPaths.expand), and a check reads both. A cd
+      # or pushd to such a word may land at either (the shell's logical cd
+      # chdirs to the physical path when the logical one doesn't exist, and
+      # always with -P, set -P or zsh's chase_links/chase_dots), so the walk
+      # keeps every dir the command may be in by then and resolves later
+      # words against each (a word not resolvable from one of them isn't
+      # resolved). A symlink without a `..` lands at the same file either
+      # way.
       class Walk
         include RedactedInspect
 
+        # More dirs than this after a cd: the dir is unknown.
+        MAX_DIRS = 8
+
         def initialize(cwd, home, env)
-          @dir = cwd
+          @dirs = [cwd]
           @home = home
           @env = env
           @subshells = []
@@ -88,45 +103,78 @@ module Samagotchi
         # @return [Array<[String, String|nil]>]
         def step(words)
           case words
-          when :open then @subshells << @dir
+          when :open then @subshells << @dirs
                           []
-          when :close then @dir = @subshells.pop || @dir
+          when :close then @dirs = @subshells.pop || @dirs
                            []
           else command(words)
           end
         end
 
-        # An absolute path for +word+ against the current dir, or nil.
-        def path(word) = resolve(word, @dir)
+        # Every dir the command may be in by now (nil for one it can't tell).
+        def dirs = @dirs.dup
+
+        # The part of +word+ that may be a path: an option's or an
+        # assignment's value, a redirection's target; nil for an option
+        # alone or an operator.
+        def candidate(word)
+          word = word.sub(REDIRECT_PREFIX, "")
+          word = word.split("=", 2).last if word.match?(/\A(--?[\w-]+|[A-Za-z_]\w*)=/)
+          return nil if word.empty? || word == "-" || word.match?(%r{\A-[^/]})
+
+          word
+        end
+
+        # The absolute paths for +word+ against every dir the command may be
+        # in (.paths_for), [] when it can't be resolved from one of them.
+        def paths(word)
+          found = @dirs.map { |dir| paths_for(word, dir) }
+          found.any?(&:empty?) ? [] : found.flatten.uniq
+        end
 
         private
 
         def command(words)
           verb = words.find { |w| !w.match?(/\A[A-Za-z_]\w*=/) }
-          resolved = words.filter_map { |word| candidate(word) }.map { |word| [word, resolve(word, @dir)] }
-          cd_args = words.drop_while { |w| w != verb }.drop(1).grep_v(/\A-/)
+          cd_args = words.drop_while { |w| w != verb }.drop(1).grep_v(/\A-./)
+          resolved = words.filter_map { |word| candidate(word) }.flat_map do |word|
+            paths = paths(word)
+            paths.empty? ? [[word, nil]] : paths.map { |path| [word, path] }
+          end
           case verb
-          when "cd" then @dir = cd_args.empty? ? @home : resolve(cd_args.first, @dir)
+          when "cd" then @dirs = cd_args.empty? ? [@home] : dirs_after(cd_args.first)
           when "pushd"
-            @pushed << @dir
-            @dir = cd_args.first && resolve(cd_args.first, @dir)
-          when "popd" then @dir = @pushed.pop unless @pushed.empty?
+            @pushed << @dirs
+            @dirs = cd_args.first ? dirs_after(cd_args.first) : [nil]
+          when "popd" then @dirs = @pushed.pop unless @pushed.empty?
           end
           resolved
         end
 
-        # The part of +word+ that may be a path: an option's or an
-        # assignment's value, a redirection's target; nil for an option
-        # alone or an operator.
-        def candidate(word)
-          word = word.sub(REDIRECT_PREFIX, "")
-          word = word.split("=", 2).last if word.match?(/\A(--?[\w-]+|[A-Za-z_]\w*)=/)
-          return nil if word.empty? || word == "-" || word.match?(%r{\A-[^/]})
+        # Every dir a cd to +word+ may land at, from each current one (nil
+        # for one it can't tell: `cd -` among them); [nil] past MAX_DIRS.
+        def dirs_after(word)
+          return [nil] if word == "-"
 
-          word
+          dirs = @dirs.flat_map do |dir|
+            found = paths_for(word, dir)
+            found.empty? ? [nil] : found
+          end.uniq
+          dirs.size > MAX_DIRS ? [nil] : dirs
+        end
+
+        # +word+ as a file argument against +dir+: its lexical path, and its
+        # physical one when a `..` in it climbs out of a symlinked dir's
+        # target (ProtectedPaths.expand); [] when it can't be resolved.
+        def paths_for(word, dir)
+          lexical = resolve(word, dir) or return []
+          return [lexical] unless word.include?("..")
+
+          [lexical, ProtectedPaths.expand(expand(word), dir)].uniq
         end
 
-        # An absolute path for +word+ against +dir+, or nil.
+        # An absolute path for +word+ against +dir+ with `..` taken
+        # lexically, or nil.
         def resolve(word, dir)
           return nil if word.include?(ShellLex::SUBST) || word == ShellLex::HEREDOC || word.match?(SCRIPT)
 

data/lib/samagotchi/guardrails/targets.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "json"
 require_relative "../tools/tool_path"
 require_relative "../tools/memory"
 require_relative "../tool_declarations"
@@ -14,6 +15,7 @@ require_relative "shell_paths"
 require_relative "rm_targets"
 require_relative "protected_paths"
 require_relative "../memory_paths"
+require_relative "../redacted_inspect"
 
 module Samagotchi
   module Guardrails
@@ -21,8 +23,12 @@ module Samagotchi
     # shell command, absolute paths (against Dir.pwd, as the file tools have
     # no cwd:), the directory a command runs in, its repo root, and whether
     # a path leaves the session's repo (Outside: the context cwd's repo
-    # root, the cwd when there is no repo; not the call's own cwd:).
+    # root, the cwd when there is no repo; not the call's own cwd:). A
+    # path whose `..` climbs out of a symlinked dir's target is in #paths
+    # twice: lexically and as the kernel opens it (.absolutes).
     class Targets
+      include RedactedInspect # @env: the call's env: may hold a secret
+
       SHELL_TOOLS = %w[execute task_create].freeze
       PATH_TOOLS = %w[write edit read memory_write].freeze
 
@@ -31,6 +37,24 @@ module Samagotchi
 
       attr_reader :tool, :command, :paths, :cwd, :repo_root
 
+      # @return [Hash{String=>String}] the variables a task_create call's
+      #   env: sets for its command ({} for none, and for every other tool)
+      attr_reader :env
+
+      # Variables that change what a command's words run or where its cd
+      # goes, under every shell chi may use or in the programs it runs: a
+      # startup file (BASH_ENV, ENV), an exported function (BASH_FUNC_…), a
+      # cd search path, word splitting, shell options, a library loaded into
+      # every program, git config or a diff program that runs. A call whose
+      # env: sets one is never read-only (.redefines_shell?). PATH is not
+      # one (the tool's own description suggests it); nor are
+      # PROMPT_COMMAND (interactive shells only) and ZDOTDIR (zsh in sh
+      # emulation reads no rc files).
+      SHELL_REDEFINING_ENV = %w[BASH_ENV ENV CDPATH IFS SHELLOPTS BASHOPTS LD_PRELOAD LD_AUDIT
+                                DYLD_INSERT_LIBRARIES GIT_EXTERNAL_DIFF GIT_CONFIG_PARAMETERS
+                                GIT_CONFIG_COUNT].freeze
+      SHELL_REDEFINING_PREFIX = "BASH_FUNC_"
+
       # @return [String, nil] the call's repository (Context#repo: its
       #   common git dir, shared by its worktrees): what a "this repo"
       #   approval is kept for
@@ -96,15 +120,17 @@ module Samagotchi
         args = nil
         acts_as = nil
         label = nil
+        env = {}
         case tool
         when *SHELL_TOOLS
           command = call[:content].to_s
+          env = env_of(call[:env])
           given = call[:cwd].to_s.strip
           cwd = File.expand_path(given, base) unless given.empty?
         when "write", "edit"
-          paths << absolute(call[:path], base)
+          paths.concat(absolutes(call[:path], base))
         when "read"
-          paths << absolute(call[:content], base)
+          paths.concat(absolutes(call[:content], base))
         when "memory_write"
           paths << memory_path(call, model_key)
         else
@@ -112,7 +138,7 @@ module Samagotchi
           command = given[:command]
           given_cwd = given[:cwd].to_s.strip
           cwd = File.expand_path(given_cwd, base) unless given_cwd.empty?
-          paths.concat(given[:paths].map { |path| absolute(path, cwd) })
+          paths.concat(given[:paths].flat_map { |path| absolutes(path, cwd) })
           entry = registry && registry[tool]
           args = given[:args] || call[:args] if entry && !entry.core? && call[:args].is_a?(Hash)
           acts_as = given[:acts_as]
@@ -121,7 +147,7 @@ module Samagotchi
         memory_remove = tool == "memory_write" && call[:remove].to_s.strip.downcase == "true"
         memory_overlay = tool == "memory_write" && !memory_remove && call[:current_model_only].to_s.strip.downcase == "true"
         memory = tool == "memory_write" ? memory_facts(call) : nil
-        new(tool: tool, command: command, paths: paths.compact, cwd: cwd, repo_root: context.repo_root(cwd),
+        new(tool: tool, command: command, paths: paths.compact, cwd: cwd, env: env, repo_root: context.repo_root(cwd),
             repo: context.repo(cwd), args: args, acts_as: acts_as, label: label, memory_remove: memory_remove,
             memory_overlay: memory_overlay, memory: memory,
             model_name: model_name, model_key: model_key, session_root: context.repo_root(base) || base,
@@ -214,9 +240,33 @@ module Samagotchi
         ParentApprovals.chi_dirs + [context.hooks_dir(base)].compact
       end
 
-      def self.absolute(path, base)
+      # A shell call's env: as the tool reads it (an object, or JSON text
+      # for one): {} for none, and for one the tool would refuse (it then
+      # runs nothing).
+      def self.env_of(given)
+        given = JSON.parse(given) if given.is_a?(String) && !given.strip.empty?
+        return {} unless given.is_a?(Hash)
+
+        given.to_h { |key, value| [key.to_s, value.to_s] }.freeze
+      rescue JSON::ParserError
+        {}
+      end
+
+      # Whether +env+ sets a SHELL_REDEFINING_ENV variable.
+      def self.redefines_shell?(env)
+        env.each_key.any? { |key| SHELL_REDEFINING_ENV.include?(key) || key.start_with?(SHELL_REDEFINING_PREFIX) }
+      end
+
+      # +path+ (a file tool's, as Tools::ToolPath has it) absolute against
+      # +base+: its lexical path (File.expand_path), and the one the kernel
+      # opens when a `..` in it climbs out of a symlinked dir's target
+      # (ProtectedPaths.expand) after it; [] for a blank path. Every check
+      # reads all of #paths, so it judges both.
+      def self.absolutes(path, base)
         path = Tools::ToolPath.normalize(path)
-        path.empty? ? nil : File.expand_path(path, base)
+        return [] if path.empty?
+
+        [File.expand_path(path, base), ProtectedPaths.expand(path, base)].uniq
       end
 
       # The file memory_write would write; nil when the call is invalid.
@@ -245,9 +295,11 @@ module Samagotchi
       end
 
       # @param chi_dirs [#call, nil] → the dirs touches_chi? looks for
-      def initialize(tool:, command:, paths:, cwd:, repo_root:, repo: nil, args: nil, acts_as: nil, label: nil,
-                     model_name: nil, model_key: nil, session_root: nil, chi_dirs: nil, memory_remove: false,
-                     memory_overlay: false, memory: nil)
+      # @param env [Hash{String=>String}] the call's env: (.env_of)
+      def initialize(tool:, command:, paths:, cwd:, repo_root:, env: {}, repo: nil, args: nil, acts_as: nil,
+                     label: nil, model_name: nil, model_key: nil, session_root: nil, chi_dirs: nil,
+                     memory_remove: false, memory_overlay: false, memory: nil)
+        @env = env
         @acts_as = acts_as
         @label = label
         @memory_remove = memory_remove
@@ -268,6 +320,28 @@ module Samagotchi
 
       def shell? = SHELL_TOOLS.include?(@tool)
 
+      # The homes and environments a shell call's words may resolve
+      # against, as [home, env] pairs: chi's own, and when the call's env:
+      # sets anything, that env over chi's (its HOME for ~ and a bare cd).
+      # A check that asks when any pair crosses only ever asks more for an
+      # env: than without one. Not kept (chi's env holds secrets).
+      def shell_envs
+        own = [Dir.home, ENV]
+        return [own] if @env.empty?
+
+        home = @env["HOME"].to_s
+        [own, [home.empty? ? Dir.home : home, ENV.to_h.merge(@env)]]
+      end
+
+      # Whether the call's env: sets a variable that changes what the
+      # command's words run (.redefines_shell?): such a command is never
+      # read-only, nor tmp-write-only.
+      def redefines_shell?
+        return @redefines_shell if defined?(@redefines_shell)
+
+        @redefines_shell = self.class.redefines_shell?(@env)
+      end
+
       # What a rule's command: reads: the shell command with the body of each
       # heredoc its command only reads as data left out (ShellLex.code_text);
       # a plugin tool's own command as given (its text may not be shell).
@@ -310,14 +384,37 @@ module Samagotchi
       # Where a shell call runs mutating git (ShellGitDirs: dirs, and
       # :unknown for one the text doesn't tell); [] for other tools.
       def git_dirs
-        @git_dirs ||= shell? ? ShellGitDirs.for(@command, cwd: @cwd) : []
+        @git_dirs ||= if shell?
+                        # chi's own GIT_DIR is not the command's concern
+                        shell_envs.each_with_index.flat_map do |(home, _), i|
+                          ShellGitDirs.for(@command, cwd: @cwd, home: home, env: i.zero? ? {} : @env)
+                        end.uniq
+                      else
+                        []
+                      end
       end
 
       # Whether the command only reads (ReadOnlyShell); false without one.
       def read_only?
         return @read_only if defined?(@read_only)
 
-        @read_only = !@command.nil? && ReadOnlyShell.read_only?(@command)
+        @read_only = !@command.nil? && !redefines_shell? && ReadOnlyShell.read_only?(@command)
+      end
+
+      # Whether the command only reads but for writes into a tmp dir that
+      # +root+ isn't in (ReadOnlyShell.read_only_but_writes?,
+      # Outside.tmp_write?): its > / >> targets, cp's destination and tee's
+      # files, from the call's cwd and any cd before them. The child
+      # boundary's; #read_only? stays what the rules read. Never for a call
+      # whose env: redefines the shell (#redefines_shell?); the writes must
+      # hold under each of #shell_envs.
+      # @param root [String] the folder the writes must stay out of
+      def read_only_but_tmp_writes?(root:)
+        !@command.nil? && !redefines_shell? && shell_envs.all? do |home, env|
+          ReadOnlyShell.read_only_but_writes?(@command, cwd: @cwd, home: home, env: env) do |path|
+            Outside.tmp_write?(path, root: root)
+          end
+        end
       end
 
       # A memory file that reaches the system prompt: the identity memory and
@@ -338,36 +435,43 @@ module Samagotchi
       # disk MODEL_NOTES_x.md in Samagotchi/Memories is the same file chi
       # loads.
       def self.prompt_memory_path?(path)
-        real = ProtectedPaths.real(path)
-        return false unless File.basename(real).downcase.match?(PROMPT_MEMORY)
+        ProtectedPaths.reals(path).any? do |real|
+          next false unless File.basename(real).downcase.match?(PROMPT_MEMORY)
 
-        dir = File.dirname(real)
-        dir.casecmp?(ProtectedPaths.real(MemoryPaths.system_dir)) ||
-          File.dirname(dir).casecmp?(ProtectedPaths.real(MemoryPaths.projects_dir))
+          dir = File.dirname(real)
+          dir.casecmp?(ProtectedPaths.real(MemoryPaths.system_dir)) ||
+            File.dirname(dir).casecmp?(ProtectedPaths.real(MemoryPaths.projects_dir))
+        end
       rescue StandardError
         false
       end
 
       # Whether the command names a path in chi's own dirs (ShellPaths:
-      # resolved paths; the text CHI_SHELL_TEXT for a word that can't be
-      # resolved); false without a command.
+      # resolved paths, under any of #shell_envs; the text CHI_SHELL_TEXT
+      # for a word that can't be resolved); false without a command.
       def touches_chi?
         return @touches_chi if defined?(@touches_chi)
 
         @touches_chi = !@command.nil? && begin
           require_relative "parent_approvals"
-          ShellPaths.touches?(@command, dirs: @chi_dirs ? @chi_dirs.call : ParentApprovals.chi_dirs,
-                                        text: ParentApprovals::CHI_SHELL_TEXT, cwd: @cwd, tmp_roots: Outside.tmp_roots)
+          dirs = @chi_dirs ? @chi_dirs.call : ParentApprovals.chi_dirs
+          shell_envs.any? do |home, env|
+            ShellPaths.touches?(@command, dirs: dirs, text: ParentApprovals::CHI_SHELL_TEXT, cwd: @cwd, home: home,
+                                          env: env, tmp_roots: Outside.tmp_roots)
+          end
         end
       end
 
       # Whether an rm -rf in the command reaches outside the tmp dirs
-      # (RmTargets; a tmp dir the session's root is in doesn't count as one).
+      # (RmTargets, under any of #shell_envs; a tmp dir the session's root
+      # is in doesn't count as one).
       def rm_outside_tmp?
         return @rm_outside_tmp if defined?(@rm_outside_tmp)
 
-        @rm_outside_tmp = !@command.nil? &&
-                          RmTargets.outside_tmp?(@command, cwd: @cwd, tmp_roots: Outside.tmp_roots, session_root: @session_root)
+        @rm_outside_tmp = !@command.nil? && shell_envs.any? do |home, env|
+          RmTargets.outside_tmp?(@command, cwd: @cwd, tmp_roots: Outside.tmp_roots, session_root: @session_root,
+                                           home: home, env: env)
+        end
       end
 
       # Whether a shell call runs mutating git outside the session's repo

data/lib/samagotchi/session_manager.rb

@@ -27,6 +27,7 @@ require_relative "process_group"
 require_relative "bridge_client"
 require_relative "worker_sidecar"
 require_relative "worker_link"
+require_relative "worker_idle_exit"
 require_relative "worker_signals"
 require_relative "chi_invocation"
 require_relative "log"
@@ -676,7 +677,7 @@ module Samagotchi
         command_running: "a /btw (or another command) is still running",
         relays_open: "a delegate's approval relayed here is open or just answered",
         background_tasks: "background tasks it started are still running"
-      }.freeze
+      }.merge(WorkerIdleExit::LEAVING_WORDS).freeze
 
       # What the CLI and the web say.
       def self.words(session_id, reason, version = nil, holds = [], pid: nil, via: ChiInvocation::HERE)
@@ -1408,12 +1409,12 @@ module Samagotchi
       end
       manager.resume_session(session_id, state_dir: state_dir)
       if (client = bridge.call)
-        return verify_unavailable if verify && !worker_has?(session_dir, VerifyAnchor::FEATURE)
+        return verify_unavailable if verify && !worker_has?(client, VerifyAnchor::FEATURE)
         # A worker from before queueing (no "delivery" feature) ignores the
         # field or refuses it; either way a file would steer the running turn.
-        return queue_unavailable if Delivery.queue?(delivery) && !worker_queues?(session_dir)
+        return queue_unavailable if Delivery.queue?(delivery) && !worker_has?(client, Delivery::QUEUE_FEATURE)
         # A participant's turn only to a worker with the review boundary.
-        return review_unavailable if Steer.participant_author?(author) && !worker_has?(session_dir, Delivery::REVIEW_FEATURE)
+        return review_unavailable if Steer.participant_author?(author) && !worker_has?(client, Delivery::REVIEW_FEATURE)
 
         begin
           options = { prompt: prompt, client_id: client_id }
@@ -1490,17 +1491,10 @@ module Samagotchi
                         ack: { "status" => "accepted", "enqueued_id" => enqueued_id, "session_id" => session_id })
     end
 
-    # Whether the session's live worker runs delivery: queue (its sidecar
-    # names the feature). No sidecar to read (the client came from a stand-in,
-    # or it went between the wait and here): true, the post finds out.
-    private_class_method def self.worker_queues?(session_dir) = worker_has?(session_dir, Delivery::QUEUE_FEATURE)
-
-    # Whether the session's live worker names +feature+ in its sidecar; no
-    # sidecar to read: true, as for #worker_queues?.
-    private_class_method def self.worker_has?(session_dir, feature)
-      sidecar = WorkerSidecar.read(session_dir)
-      sidecar.nil? || sidecar.features.include?(feature)
-    end
+    # Whether the worker +client+ talks to names +feature+: the features of
+    # the sidecar the client was made from (the Live link WorkerLink.await
+    # found), not a second read of bridge.json.
+    private_class_method def self.worker_has?(client, feature) = client.features.include?(feature)
 
     # The unclaimed input files +author+ wrote.
     PARTICIPANT_QUEUE_LOCK = "participants.lock"

data/lib/samagotchi/system_one/self_protect.rb

@@ -2,8 +2,11 @@
 
 require_relative "../config"
 require_relative "../memory_paths"
+require_relative "../paths"
 require_relative "../guardrails/protected_paths"
 require_relative "../guardrails/parent_approvals"
+require_relative "../guardrails/shell_lex"
+require_relative "../guardrails/shell_paths"
 
 module Samagotchi
   module SystemOne
@@ -14,6 +17,19 @@ module Samagotchi
     # "System 1"). The memories dir is deliberately not one of them:
     # reading and appending a memory file stays eligible.
     #
+    # A shell command's words are resolved as Guardrails::ShellPaths
+    # resolves them (cd chains, ~, $HOME and the XDG dirs, symlinks, `..`
+    # both ways), under chi's env and the call's env: when the caller hands
+    # its Targets; one landing in chi's dirs outside the memories refuses.
+    # The memories text is taken out of the command (the exemption) only
+    # when its text shows no climb (CLIMB: a `..`, a `$`, backticks, a `~`
+    # other than the home one, `cd -`) and every word either resolved or is
+    # data (Words#plain: a script or heredoc body, a phrase, a glob with no
+    # `/`) read while the dir was known. A word the walk can't follow
+    # otherwise (`${PWD%/*}`, `$(dirname $PWD)`, `cd -`) may climb out of the
+    # memories dir without saying so, so its memories text stays in and the
+    # text check refuses it.
+    #
     # Pure: it only reads the paths as this process's environment names them,
     # and answers on the approval's own facts (Guardrails::Approval.payload's
     # approval:), the same shape ParentApprovals.protected_facts? takes.
@@ -29,44 +45,120 @@ module Samagotchi
       # The characters that end a shell word: a memories path in a command
       # ends at the first one.
       WORD_END = %q{[\s'"`;&|<>(){}:,]}
-      # A `..` segment anywhere in a command: with one, a memories path may
-      # climb back out (`memories/../config.yml`, `cd memories && … ../x`),
-      # so the command's memories text is not taken out.
-      CLIMB = %r{(?:\A|[\s/'"=])\.\.(?:/|[\s'"]|\z)}
+
+      # A climb out of a dir as a command's text may spell it: a `..`
+      # segment (`cd ..;`, `../x`, inside a script body too), any `$`
+      # expansion or backticks, a `~` that isn't the home one (`~-`, `~+`,
+      # `~user`), or `cd -` / `pushd -`.
+      CLIMB = Regexp.union(
+        /(?<![\w.])\.\.(?![\w.])/, /[$`]/, %r{(?:\A|[\s=:'"(])~(?![/\s'";&|)]|\z)},
+        /(?:\A|[\s;&|(])(?:cd|pushd)\s+-(?=[\s;&|)]|\z)/
+      )
+
+      # What resolving a command's words found: whether one lands in chi's
+      # dirs (outside the memories dir, or in its installed bundles), and
+      # whether every word resolved or is data (#plain).
+      Words = Data.define(:chi, :plain)
 
       module_function
 
       # @param approval [Hash, nil] the ask's approval facts (rule, tool,
-      #   paths, command)
+      #   paths, command, cwd)
+      # @param targets [Guardrails::Targets, nil] the call's targets, for its
+      #   env: (Targets#shell_envs, #redefines_shell?)
       # @return [Boolean] whether System 1 must not answer this ask
-      def refuse?(approval)
+      def refuse?(approval, targets: nil)
         return false unless approval.is_a?(Hash)
         return true if NEVER_AUTO.include?(fetch(approval, :rule).to_s)
-        # The test that makes an ask user_only (ParentApprovals#chi_files?:
-        # chi's dirs, however a command spells them), minus the memories.
-        return true if Guardrails::ParentApprovals.chi_files?(beyond_memories(approval))
+        # An env: that redefines the shell (BASH_ENV, BASH_FUNC_…) runs what
+        # no word of the command says.
+        return true if targets&.redefines_shell?
 
         command = fetch(approval, :command).to_s
+        words = command.empty? ? nil : words(command, cwd: fetch(approval, :cwd), targets: targets)
+        return true if words&.chi
+        # The test that makes an ask user_only (ParentApprovals#chi_files?:
+        # chi's dirs as the command spells them), minus the memories.
+        return true if Guardrails::ParentApprovals.chi_files?(beyond_memories(approval, exempt: exempt?(command, words)))
+
         command.match?(DEFAULT_STATE_TEXT)
       end
 
       # The approval's facts without what is in the memories dir (not its
       # installed bundles): the paths under it, and its spellings in the
-      # command unless the command climbs with `..`.
-      def beyond_memories(approval)
+      # command when +exempt+ (.exempt?).
+      def beyond_memories(approval, exempt:)
         memories = Guardrails::ProtectedPaths.real(MemoryPaths.system_dir)
         bundles = Guardrails::ProtectedPaths.real(MemoryPaths.bundles_dir)
         paths = Array(fetch(approval, :paths)).map(&:to_s).reject do |path|
-          real = Guardrails::ProtectedPaths.real(path)
-          Guardrails::ProtectedPaths.within?(real, memories) && !Guardrails::ProtectedPaths.within?(real, bundles)
+          Guardrails::ProtectedPaths.reals(path).all? { |real| memory?(real, memories, bundles) }
         end
         command = fetch(approval, :command).to_s
-        unless command.match?(CLIMB)
-          command = command.gsub(memories_text) { |text| text.include?("/.bundles") ? text : "" }
-        end
+        command = command.gsub(memories_text) { |text| text.include?("/.bundles") ? text : "" } if exempt
         { paths: paths, command: command }
       end
 
+      # Whether the command's memories text may be taken out: no command,
+      # or one whose text shows no climb (CLIMB) and whose words are plain.
+      def exempt?(command, words)
+        words.nil? || (words.plain && !command.match?(CLIMB))
+      end
+
+      # The command's words resolved (ShellPaths::Walk) from +cwd+ (else
+      # this process's dir) under each of the call's shell envs: Words.
+      def words(command, cwd:, targets:)
+        memories = Guardrails::ProtectedPaths.real(MemoryPaths.system_dir)
+        bundles = Guardrails::ProtectedPaths.real(MemoryPaths.bundles_dir)
+        dirs = chi_dirs
+        tokens = Guardrails::ShellLex.lex(command)
+        plain = !Guardrails::ShellLex.unterminated?(command) &&
+                tokens.none? { |_, value| value.include?(Guardrails::ShellLex::SUBST) }
+        chi = false
+        commands = Guardrails::ShellLex.simple_commands(tokens)
+        envs = targets ? targets.shell_envs : [[Dir.home, ENV]]
+        envs.each do |home, env|
+          walk = Guardrails::ShellPaths::Walk.new(cwd.to_s.empty? ? Dir.pwd : cwd.to_s, home, env)
+          commands.each do |simple|
+            # A cd the walk couldn't follow: no later word is data.
+            known = !simple.is_a?(Array) || !walk.paths(".").empty?
+            walk.step(simple).each do |word, path|
+              next plain &&= known && data?(word) unless path
+
+              chi ||= Guardrails::ProtectedPaths.reals(path).any? do |real|
+                dirs.any? { |dir| Guardrails::ShellPaths.within?(real, dir) } && !memory?(real, memories, bundles)
+              end
+            end
+          end
+        end
+        Words.new(chi: chi, plain: plain)
+      rescue ArgumentError, EncodingError
+        Words.new(chi: false, plain: false)
+      end
+
+      # Whether a word the walk couldn't resolve is data rather than a path
+      # spelt some other way: a heredoc body, a script or a phrase (spaces,
+      # quotes, operators: `python3 -c '…'`, `'- a note'`), or a glob with
+      # no `/`. A `$` or `~` left in it is not (CLIMB refuses those anyway).
+      def data?(word)
+        return true if word == Guardrails::ShellLex::HEREDOC
+        return false if word.include?("$") || word.include?("~")
+        return true if word.match?(Guardrails::ShellPaths::SCRIPT)
+
+        word.match?(Guardrails::ShellPaths::GLOB) && !word.include?("/")
+      end
+
+      # chi's own dirs (ParentApprovals.chi_dirs) and its whole state dir
+      # (DEFAULT_STATE_TEXT's), resolved.
+      def chi_dirs
+        [*Guardrails::ParentApprovals.chi_dirs, Paths.state_dir]
+          .map { |dir| Guardrails::ProtectedPaths.real(dir.to_s.chomp("/")) }.reject(&:empty?).uniq
+      end
+
+      # Whether +real+ is in the memories dir and not in its installed bundles.
+      def memory?(real, memories, bundles)
+        Guardrails::ProtectedPaths.within?(real, memories) && !Guardrails::ProtectedPaths.within?(real, bundles)
+      end
+
       # The memories dir as a command spells it: the default
       # `.config/samagotchi/memories`, or this process's own path, with the
       # rest of that shell word.

data/lib/samagotchi/terminal_ui/exit_lines.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../tools/task_record"
+require_relative "../worker_idle_exit"
 
 module Samagotchi
   class TerminalUI
@@ -23,7 +24,7 @@ module Samagotchi
         "reminders" => "reminders are set", "starting" => "the worker is still starting",
         "background_tasks" => "background tasks it started are still running",
         "delegates" => "delegates of this session are still running"
-      }.freeze
+      }.merge(WorkerIdleExit::LEAVING_WORDS.transform_keys(&:to_s)).freeze
       # How to end a background task that holds the worker up (an older
       # worker's 409 has no hint of its own).
       TASK_STOP_HINT = "stop one with the web's stop-task button or by asking for task_stop"