samagotchi 0.128.0 → 0.130.0

data/lib/samagotchi/engine.rb

@@ -664,6 +664,19 @@ module Samagotchi
       @turn_state.controller
     end
 
+    # Whether a message a person sent waits for the running turn's next
+    # boundary (run_turn's input_waiting: probe): a task_wait returns on it
+    # (PeerView#input_waiting?). False outside a turn, for a turn given no
+    # probe, and when the probe raises (warned once a turn; the tool never
+    # fails for it).
+    def input_waiting?
+      probe = @turn_state.input_waiting
+      !!probe&.call
+    rescue StandardError => e
+      Log.warn(:turn, "input_waiting_failed", error: e.class.name, msg: e.message) if @turn_state.input_waiting_failed!
+      false
+    end
+
     # Cancel the currently running turn, if any.
     # @param reason [Symbol] cancellation reason
     # @return [Boolean] whether a cancellation was triggered
@@ -2132,6 +2145,9 @@ module Samagotchi
     # @param pending_input [#call, nil] optional drain proc returning
     #   Array<String> of steering messages queued while the turn runs; drained
     #   by the agentic loop at iteration boundaries (see KernelLoop#run).
+    # @param input_waiting [#call, nil] optional probe: true while a message
+    #   a person sent waits for the next boundary (it peeks, never drains);
+    #   a running task_wait returns on it (#input_waiting?). nil: never.
     # @param continue [Boolean] resume the conversation without appending a
     #   user prompt (continue after the iteration limit, reminder turns);
     #   +prompt+ is ignored and :turn_started carries `continue: true`
@@ -2170,9 +2186,9 @@ module Samagotchi
     # re-raises; a provider error adds error_kind:, retryable:, host: and a
     # one-line summary:.
     def run_turn(session, prompt, on_event: nil, max_iterations: nil, cancel_controller: nil, max_tool_output_chars: nil, pending_input: nil, continue: false,
-                 origin: TurnOrigin::NONE, images: [], id: nil, resumed: false, resume_from: nil, verify: nil)
+                 origin: TurnOrigin::NONE, images: [], id: nil, resumed: false, resume_from: nil, verify: nil, input_waiting: nil)
       turn = begin_turn(session, prompt, on_event: on_event, cancel_controller: cancel_controller, origin: origin,
-                                         continue: continue, id: id, verify: verify)
+                                         continue: continue, id: id, verify: verify, input_waiting: input_waiting)
       if continue
         turn.resumed = resumed
         turn.resume_from = resume_from
@@ -2220,7 +2236,7 @@ module Samagotchi
     # The turn's state before anything can fail it: the session running,
     # the turn flag, its cancel controller and sink. The cross-thread state
     # is set here and cleared in #release_turn only.
-    def begin_turn(session, prompt, on_event:, cancel_controller:, origin:, continue:, id: nil, verify: nil)
+    def begin_turn(session, prompt, on_event:, cancel_controller:, origin:, continue:, id: nil, verify: nil, input_waiting: nil)
       origin = TurnOrigin.of(origin)
       # A participant's Verify fresh child: every turn is theirs (their
       # author, boundary and cap), whoever started it.
@@ -2240,7 +2256,7 @@ module Samagotchi
       # invalidated recap) while the model is working. A hook's notice goes
       # where the turn's events go (the REPL renders only its sink; a
       # worker's observers carry it to the bridge).
-      @turn_state.begin!(controller: effective_controller, sink: on_event)
+      @turn_state.begin!(controller: effective_controller, sink: on_event, input_waiting: input_waiting)
       # Drop a recap already in flight: the turn makes it stale.
       @recap&.invalidate!
       # The gate's context: who queued this turn, and git asked afresh.

data/lib/samagotchi/engine_peers.rb

@@ -8,7 +8,8 @@ module Samagotchi
     # The kernel's Tools::Peers, following the current session. cancelled?
     # is the running turn's cancel, for a tool that waits (delegate_result):
     # the controller is set from another thread and a tool gets no other
-    # way to see it.
+    # way to see it. input_waiting? is whether a person's message waits for
+    # the running turn's next boundary (task_wait returns on it).
     PeerView = Struct.new(:engine) do
       def session_id = engine.session&.id
       def cwd = engine.session&.working_directory
@@ -16,6 +17,7 @@ module Samagotchi
       def state_dir = engine.peer_state_dir
       def cancelled? = !!engine.active_cancel_controller&.cancelled?
       def cancel_reason = engine.active_cancel_controller&.reason
+      def input_waiting? = engine.input_waiting?
       def relay = engine.relay_peer
       def model_ref = engine.effective_model_ref
       def thinking = engine.thinking_override

data/lib/samagotchi/guardrail_wiring.rb

@@ -314,7 +314,7 @@ module Samagotchi
       # one that passes every gate is allowed once without reaching them
       # (docs/guardrails.md, "System 1").
       judgment = begin
-        system_one_judge(payload)
+        system_one_judge(payload, targets: verdict.targets)
       rescue LLM::RequestCancelled
         return turn_stopped(verdict)
       end
@@ -357,7 +357,7 @@ module Samagotchi
     # host) means no line at all. A judgment that fails is logged with p nil,
     # so the failures are in the log too.
     # @return [Hash, nil] {id:, p:, auto:}, nil when nothing was written
-    def system_one_judge(payload)
+    def system_one_judge(payload, targets: nil)
       return nil if Steer.participant_author?(turn_author)
 
       client = @system_one.call
@@ -385,7 +385,7 @@ module Samagotchi
       end
       latency_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round
       p = answers && answers[SystemOne::ApprovalQuestion::ID]&.noul
-      auto = system_one_auto_allow?(client, approval, p, entries)
+      auto = system_one_auto_allow?(client, approval, p, entries, targets: targets)
       decision = system_one_decision(client, auto)
 
       id = log.judgment(session_id: @session_lookup.call&.id,
@@ -417,13 +417,14 @@ module Samagotchi
     # the rule's record. Any one that fails leaves the ask to the user. The
     # entries are the judgment log read once for this ask.
     # @param entries [Array<Hash>] SystemOne::Log#entries
-    def system_one_auto_allow?(client, approval, p, entries)
+    # @param targets [Guardrails::Targets, nil] the call's, for its env:
+    def system_one_auto_allow?(client, approval, p, entries, targets: nil)
       return false unless client.mode == "on"
 
       rule = approval[:rule].to_s
       return false if rule.empty?
       return false unless system_one_rules.include?(rule)
-      return false if SystemOne::SelfProtect.refuse?(approval)
+      return false if SystemOne::SelfProtect.refuse?(approval, targets: targets)
 
       threshold = Config.get("guardrails.system_one.threshold").to_f
       return false if p.nil? || p.to_f < threshold

data/lib/samagotchi/guardrails/chi_dirs.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require_relative "../config"
+require_relative "../paths"
+require_relative "../memory_paths"
+require_relative "../hooks/loader"
+require_relative "path_resolve"
+
+module Samagotchi
+  module Guardrails
+    # chi's own dirs, the sets the guardrails judge a path or a command's
+    # words against, as this process's environment and config.yml name them
+    # (read each call). Each surface keeps its set:
+    #   .protected     the config dir, the hooks dir, the approval store's
+    #                  dir, the installed bundles' dir, attached context: an
+    #                  ask only the user may answer (ParentApprovals.chi_files?)
+    #   .touches       .protected and the session repo's git hooks dir: a
+    #                  rule's touches: chi_dirs (Targets#touches_chi?)
+    #   .self_protect  .protected and the whole state dir, resolved: what
+    #                  System 1 never answers for (SelfProtect)
+    #   .review        the state dir, the config dir and a hooks dir
+    #                  configured outside it: what a participant's turn never
+    #                  reads (ReviewPaths)
+    # ProtectedPaths' deny/ask lists and ScratchWrites' memories dir are
+    # built by the wiring from the same places.
+    module ChiDirs
+      module_function
+
+      # chi's config dir, the hooks dir, the approval store's dir, the
+      # installed bundles' dir and attached context.
+      def protected
+        hooks = begin Hooks::Loader.hooks_dir rescue nil end
+        bundles = begin MemoryPaths.bundles_dir rescue nil end
+        [ConfigFile.config_dir, hooks, File.join(Paths.state_dir, "guardrails"), bundles, File.join(Paths.state_dir, "context")]
+          .compact.map { |dir| dir.to_s.chomp("/") }.reject(&:empty?).uniq
+      end
+
+      # .protected (as ParentApprovals.chi_dirs, the name its callers and
+      # specs know) and the git hooks dir of +base+'s repo (+context+).
+      def touches(context, base)
+        require_relative "parent_approvals"
+        ParentApprovals.chi_dirs + [context.hooks_dir(base)].compact
+      end
+
+      # .protected (as ParentApprovals.chi_dirs) and the whole state dir,
+      # resolved.
+      def self_protect
+        require_relative "parent_approvals"
+        [*ParentApprovals.chi_dirs, Paths.state_dir]
+          .map { |dir| PathResolve.real(dir.to_s.chomp("/")) }.reject(&:empty?).uniq
+      end
+
+      # chi's state dir and config dir, as Paths has them now, and the hooks
+      # dir when config.yml puts it outside the config dir (hooks run as the
+      # owner: a participant reads none of them).
+      def review
+        config = File.join(Paths.config_home, Paths::APP_DIR)
+        hooks = begin Hooks::Loader.hooks_dir rescue nil end
+        hooks = nil if hooks.to_s.empty? || PathResolve.reals(hooks).any? { |real| PathResolve.within?(real, config) }
+        [Paths.state_dir, config, hooks].compact
+      end
+    end
+  end
+end

data/lib/samagotchi/guardrails/child_boundary.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "outside"
-require_relative "protected_paths"
+require_relative "path_resolve"
 require_relative "shell_lex"
 require_relative "shell_paths"
 require_relative "shared_git"
@@ -26,8 +26,11 @@ module Samagotchi
     #     share, from anywhere (SharedGit: config, update-ref, worktree add,
     #     stash clear, tags, another branch's delete).
     # Paths elsewhere in a command (/usr/bin, ~/.gem) don't count, and
-    # read-only commands never ask. Text heuristics: sh -c bodies, scripts
-    # and $(…) aren't looked into.
+    # read-only commands never ask, nor do ones that only write into a tmp
+    # dir (> / >>, cp's destination, tee; Targets#read_only_but_tmp_writes?). Paths resolve under chi's env and the
+    # call's env: (Targets#shell_envs), and an env: that redefines the shell
+    # (BASH_ENV, CDPATH, …) always asks, from its own folder too. Text heuristics: sh
+    # -c bodies, scripts and $(…) aren't looked into.
     class ChildBoundary
       RULE = "child-boundary"
       SOURCE = "core"
@@ -73,26 +76,33 @@ module Samagotchi
       def shell_crosses?(targets, root)
         return true if targets.git_dirs.any? { |dir| dir.is_a?(String) && Outside.outside?(dir, root: root) }
         return :shared if SharedGit.changes?(targets.command, own_branch: @branch.call)
-        return false if targets.read_only?
+        # A redefined shell (BASH_ENV, BASH_FUNC_…) runs what no word says.
+        return true if targets.redefines_shell?
+        return false if targets.read_only? || targets.read_only_but_tmp_writes?(root: root)
         return true if targets.cwd && Outside.outside?(targets.cwd, root: root)
 
-        names_other_checkout?(targets.command, targets.cwd, root)
+        names_other_checkout?(targets, root)
       end
 
-      # Whether a word of +command+ resolves into another checkout of the
-      # repository (and not into root, which may sit inside the main one).
-      def names_other_checkout?(command, cwd, root)
-        real_root = ProtectedPaths.real(root)
-        others = [*@worktrees.call, @common_dir.call].compact.map { |dir| ProtectedPaths.real(dir) } - [real_root]
+      # Whether a word of the command resolves into another checkout of the
+      # repository (and not into root, which may sit inside the main one),
+      # under chi's env or the call's env: (Targets#shell_envs).
+      def names_other_checkout?(targets, root)
+        real_root = PathResolve.real(root)
+        others = [*@worktrees.call, @common_dir.call].compact.map { |dir| PathResolve.real(dir) } - [real_root]
         return false if others.empty?
 
-        walk = ShellPaths::Walk.new(cwd, Dir.home, ENV)
-        ShellLex.simple_commands(ShellLex.lex(command.to_s)).any? do |words|
-          walk.step(words).any? do |_word, path|
-            next false unless path
+        commands = ShellLex.simple_commands(ShellLex.lex(targets.command.to_s))
+        targets.shell_envs.any? do |home, env|
+          walk = ShellPaths::Walk.new(targets.cwd, home, env)
+          commands.any? do |words|
+            walk.step(words).any? do |_word, path|
+              next false unless path
 
-            real = ProtectedPaths.real(path)
-            !ShellPaths.within?(real, real_root) && others.any? { |dir| ShellPaths.within?(real, dir) }
+              PathResolve.reals(path).any? do |real|
+                !PathResolve.under?(real, real_root) && others.any? { |dir| PathResolve.under?(real, dir) }
+              end
+            end
           end
         end
       rescue ArgumentError, EncodingError

data/lib/samagotchi/guardrails/outside.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require "tmpdir"
-require_relative "protected_paths"
+require "pathname"
+require_relative "path_resolve"
 require_relative "../memory_bundle/index_sync"
 
 module Samagotchi
@@ -16,31 +16,82 @@ module Samagotchi
     #   is itself in that tmp dir (a sandbox there still gets the check
     #   between its siblings).
     # chi's state dir is not special: nothing there is the model's to write.
+    # A path whose landing place resolving can't tell (.resolve: a dangling
+    # symlink, a file with another hard link) is always outside.
     module Outside
-      TMP_DIRS = %w[/tmp /var/tmp].freeze
+      TMP_DIRS = PathResolve::TMP_DIRS
 
       # @param path [String] absolute
       # @param root [String] the session's repo root (or cwd)
       def self.outside?(path, root:)
-        real = ProtectedPaths.real(path)
-        session = ProtectedPaths.real(root)
-        return false if within?(real, session)
-        return false if MemoryBundle::IndexSync.memory_scope(path)
-        return false if tmp_roots.any? { |tmp| within?(real, tmp) && !within?(session, tmp) }
+        reals = resolve(path) or return true
+        session = PathResolve.real(root)
+        tmp = nil
+        reals.any? do |real|
+          next false if within?(real, session)
+          next false if MemoryBundle::IndexSync.memory_scope(path)
+          next false if (tmp ||= session_tmp_roots(session)).any? { |dir| within?(real, dir) }
 
-        true
+          true
+        end
       end
 
-      # The tmp dirs that exist, resolved.
-      def self.tmp_roots
-        [Dir.tmpdir, *TMP_DIRS].filter_map do |dir|
-          File.realpath(dir) if File.directory?(dir)
-        rescue SystemCallError
-          nil
-        end.uniq
+      # Whether +path+ lands in the session's root every way it resolves
+      # (.resolve: never a dangling symlink, nor a file with another hard
+      # link). A pair turn's test for a path its command may name
+      # (PairCommand), with .tmp_write? for the rest.
+      # @param path [String] absolute
+      # @param root [String] the session's project root
+      def self.inside?(path, root:)
+        reals = resolve(path) or return false
+        session = PathResolve.real(root)
+        reals.all? { |real| within?(real, session) }
+      end
+
+      # Whether a shell command may write +path+ as a tmp file (the child
+      # boundary's tmp writes): it resolves (.resolve, every way) into a tmp
+      # dir the session's root isn't in.
+      # @param path [String] absolute
+      # @param root [String] the session's repo root (or cwd)
+      def self.tmp_write?(path, root:)
+        reals = resolve(path) or return false
+        session = PathResolve.real(root)
+        tmp = session_tmp_roots(session)
+        reals.all? { |real| tmp.any? { |dir| within?(real, dir) } }
       end
 
-      def self.within?(path, root) = path == root || path.start_with?(File.join(root, ""))
+      # +path+ resolved (PathResolve.reals: the lexical answer and where
+      # the kernel lands, a `..` after a symlinked dir climbing out of its
+      # target), or nil when that doesn't say where a write lands: the path
+      # is or goes through a dangling symlink (a write would create its
+      # target; PathResolve.real follows it, the lexical answer stops at
+      # it, and either way the link's own place doesn't count as where the
+      # file is), or is a file with another hard link (a write would change
+      # that file too). Both outside? and tmp_write? read it, so neither
+      # counts such a path as inside or in tmp.
+      # @param path [String] absolute
+      # @return [Array<String>, nil]
+      def self.resolve(path)
+        reals = PathResolve.reals(path)
+        return nil if reals.any? { |real| Pathname.new(real).ascend.any?(&:symlink?) }
+        return nil if reals.any? { |real| File.file?(real) && File.stat(real).nlink > 1 }
+
+        reals
+      rescue SystemCallError
+        nil
+      end
+
+      # The tmp dirs that exist, resolved (PathResolve.tmp_roots).
+      def self.tmp_roots = PathResolve.tmp_roots
+
+      # The tmp dirs +session+ (resolved) isn't in (PathResolve.tmp_roots).
+      def self.session_tmp_roots(session) = PathResolve.tmp_roots(session: session, roots: tmp_roots)
+
+      # Whether +path+ is +root+ or in it (PathResolve.under?): cased alike
+      # on a disk that folds case when +root+ exists (resolved, it has its
+      # on-disk case), by their exact text when it doesn't (a missing root
+      # keeps the case it was typed in).
+      def self.within?(path, root) = PathResolve.under?(path, root, fold: File.exist?(root))
     end
   end
 end

data/lib/samagotchi/guardrails/pair_boundary.rb

@@ -24,19 +24,27 @@ module Samagotchi
     #     credential files; project secret files) on every file tool's path,
     #     read or written (read, write, edit, a plugin's targets: paths), and
     #     on what a command does (execute, and any call whose targets carry
-    #     a command: PairCommand, which also refuses chi, background jobs,
-    #     the environment, git settings that run commands and home sweeps);
+    #     a command: PairCommand, which also refuses chi and chi web on a
+    #     loopback name, URL openers (open, xdg-open, a browser) and
+    #     listeners (nc -l, socat …LISTEN, a static HTTP server), background
+    #     and scheduled jobs, the environment and
+    #     credential printers, git settings that run commands, home sweeps
+    #     and links to them, and a program named by a $var or a glob); a
+    #     write or edit of git's hooks (GIT_HOOKS);
     #   - owner-voiced tools (OWNER_VOICED, and any delegate_* tool): what
     #     speaks or acts in the owner's name beyond this turn (a delegate, a
     #     reminder, a note to another session, a background task, a
-    #     forgotten output, the session's loaded tools); and memory_write:
+    #     forgotten output, the session's loaded tools); the tools that read
+    #     the owner's background tasks (OWNER_TASK_READERS); and memory_write:
     #     a memory reaches the owner's later sessions;
     #   - ask_user_question: there is no one on the participant's side to
     #     answer it here; the model asks in its reply instead.
     # And it asks the owner, always (Verdict#fresh_ask: no stored approval
-    # answers it, and the rules can't lower it), before a write, an edit or a
-    # command that writes outside the session's project root (the tmp dirs
-    # aside).
+    # answers it, and the rules can't lower it), before a write or an edit
+    # that may land outside the session's project root, or a command that
+    # may write there (failing closed: PairCommand#outside_writes?); a tmp
+    # dir the project isn't in aside (PairCommand.writable?). No project
+    # (the home folder or above it): every write asks.
     # Everything else goes on to the owner's checks and rules as for the
     # owner's turns.
     class PairBoundary
@@ -45,6 +53,10 @@ module Samagotchi
       OWNER_VOICED = %w[delegate register_reminder cancel_reminder send_note forget_outputs task_create task_stop
                         find_tools].freeze
       OWNER_VOICED_PREFIX = "delegate_"
+      # The background task tools that read the owner's tasks (a pair turn
+      # starts none: task_create is owner-voiced, and its execute is never
+      # handed over).
+      OWNER_TASK_READERS = %w[task_wait task_get task_list].freeze
       ASK_TOOL = "ask_user_question"
       WRITE_TOOLS = %w[write edit].freeze
 
@@ -52,21 +64,55 @@ module Samagotchi
                "only the owner can do."
       SECRET = "a participant's turn can't read or write secrets or chi's own files"
       OWNER_ONLY = "a participant's turn can't use %s: it acts in the owner's name beyond this turn"
+      OWNER_TASKS = "a participant's turn can't use %s: the background tasks are the owner's, and their output with them"
       MEMORY_WRITE = "a participant's turn writes no memories: they reach the owner's later sessions; say in your " \
                      "reply what to remember"
       ASK = "a participant's turn can't ask the user: ask in your reply"
       OUTSIDE_WRITE = "a participant's turn writes outside the session's project"
+      NO_PROJECT = "a participant's turn writes, and this session's folder is the home folder or above it (or none): " \
+                   "there is no project to keep it in"
       CHI = "a participant's turn can't run chi: its commands act in the owner's name (sessions, shares, answers)"
       BACKGROUND = "a participant's turn can't leave a command running in the background: it would outlive the turn"
       ENVIRONMENT = "a participant's turn can't read the environment or the keychain: they hold the owner's secrets"
-      HOME_SWEEP = "a participant's turn can't search or copy a folder that holds secrets or chi's own files"
+      HOME_SWEEP = "a participant's turn can't search, copy or link a folder that holds secrets or chi's own files"
+      LINK = "a participant's turn makes a link: a path through it can lead out of the project, so the owner " \
+             "approves it"
       GIT_CONFIG = "a participant's turn can't change git's global config or set what makes git run a command " \
                    "(core.hooksPath, core.fsmonitor, core.sshCommand, core.pager, core.editor, ! aliases)"
+      GIT_HOOKS = "a participant's turn can't write git's hooks (.git/hooks): git runs them in the owner's name"
+      # chi web on loopback asks the owner's token too (Web::App#token_gate,
+      # LAN mode); this text check stays as defense in depth: a loopback-only
+      # chi web still answers loopback as the owner.
+      CHI_WEB = "a participant's turn can't call chi web on this machine: it is the owner's (sessions, shares, answers)"
+      # A page opened in the owner's browser carries the owner's cookies
+      # (chi web's on 127.0.0.1 or the LAN address among them) to whatever
+      # it points at; a port listening here could catch them.
+      OPENER = "a participant's turn can't open a URL or a file in the owner's apps: a browser sends that page the " \
+               "owner's cookies"
+      LISTENER = "a participant's turn can't listen on a port: what it serves on this machine could catch the " \
+                 "owner's browser cookies"
+      VERB = "a participant's turn runs only a program named plainly: no $, $(…) or glob in a command's name"
       UNREADABLE = "a participant's turn runs only commands chi can read: split this command, or write the file " \
                    "with the write tool"
       # A pair turn's execute runs without the environment variables whose
       # names say they hold a secret (Tools::Builtins, PairBoundary.scrubbed_env).
       SECRET_ENV_NAME = /KEY|TOKEN|SECRET|PASS|CREDENTIAL|AUTH/i
+      # chi web's port when config names none (Config's web.port default).
+      DEFAULT_WEB_PORT = 4567
+
+      # The ports chi web may answer on here: the one the running chi web
+      # recorded (Web::Running), config's web.port, and the default. A
+      # Bridge's port needs no entry: it answers only with its secret, in
+      # the worker's bridge.json under chi's state dir (denied).
+      # @return [Array<Integer>]
+      def self.web_ports
+        require_relative "../config"
+        require_relative "../web/running"
+        configured = Config.get("web.port").to_s.to_i
+        [Web::Running.port, (configured if configured.positive?), DEFAULT_WEB_PORT].compact.uniq
+      rescue StandardError, LoadError
+        [DEFAULT_WEB_PORT]
+      end
 
       # The unsets a pair turn's execute adds to its environment: every
       # variable of +env+ whose name SECRET_ENV_NAME matches.
@@ -92,14 +138,14 @@ module Samagotchi
       # @param home [#call] → String, nil
       # @param root [#call] → String, nil: the session's project root (the
       #   work tree top of its folder); a write outside it asks the owner
-      #   (none: every write asks)
-      # @param tmp_roots [#call] → Array<String>: where a write neither asks
-      #   nor is denied (PairCommand.tmp_roots)
+      #   (none, or the home folder or above it: every write asks)
+      # @param web_ports [#call] → Array<Integer>: chi web's ports here
+      #   (.web_ports); a command naming one on a loopback name is denied
       def initialize(author:, root: -> {}, denied_dirs: -> { ReviewPaths.chi_dirs }, home: -> { Dir.home },
-                     tmp_roots: -> { PairCommand.tmp_roots })
+                     web_ports: -> { PairBoundary.web_ports })
+        @web_ports = web_ports
         @author = author
         @root = root
-        @tmp_roots = tmp_roots
         @denied_dirs = denied_dirs
         @home = home
       end
@@ -112,8 +158,8 @@ module Samagotchi
           return verdict.deny!(reason, rule: RULE, source: SOURCE, decided_by: "core", advice: ADVICE)
         end
 
-        if outside_write?(verdict)
-          verdict.ask!(OUTSIDE_WRITE, scopes: %w[once], rule: RULE, source: SOURCE, decided_by: "core")
+        if (reason = ask_reason(verdict))
+          verdict.ask!(reason, scopes: %w[once], rule: RULE, source: SOURCE, decided_by: "core")
           verdict.fresh_ask = true
         end
         verdict
@@ -126,6 +172,7 @@ module Samagotchi
         tool = call[:name].to_s
         return ASK if tool == ASK_TOOL
         return format(OWNER_ONLY, tool) if OWNER_VOICED.include?(tool) || tool.start_with?(OWNER_VOICED_PREFIX)
+        return format(OWNER_TASKS, tool) if OWNER_TASK_READERS.include?(tool)
         return MEMORY_WRITE if tool == "memory_write"
 
         targets = verdict.targets
@@ -133,37 +180,53 @@ module Samagotchi
 
         paths = denylist
         return SECRET if paths.secret_refusal(targets.paths.compact)
+        return GIT_HOOKS if WRITE_TOOLS.include?(tool) && targets.paths.compact.any? { |path| PairCommand.git_hook?(path) }
         return command(targets, paths).refusal if targets.command
 
         nil
       end
 
-      # A write or edit whose path is outside the project root (as given or
-      # as it resolves), or a command that writes there (PairCommand); the
-      # tmp dirs aside.
+      # Why the owner is asked (fresh, once): a command that makes a link
+      # (LINK), a write that may land outside the project (OUTSIDE_WRITE, or
+      # NO_PROJECT without one); nil when nothing asks.
+      def ask_reason(verdict)
+        targets = verdict.targets
+        return LINK if targets&.command && command(targets, nil).links?
+        return nil unless outside_write?(verdict)
+
+        project_root ? OUTSIDE_WRITE : NO_PROJECT
+      end
+
+      # A write or edit whose path may land outside the project root, or a
+      # command that may write there (PairCommand#outside_writes?); a tmp
+      # dir the project isn't in aside (PairCommand.writable?).
       def outside_write?(verdict)
         targets = verdict.targets
         return false unless targets
         return command(targets, nil).outside_writes? if targets.command
         return false unless WRITE_TOOLS.include?(verdict.call&.dig(:name).to_s)
 
-        paths = targets.paths.to_a.compact
-        root = @root.call.to_s
-        paths.any? do |path|
-          real = ProtectedPaths.real(path)
-          next false if @tmp_roots.call.any? { |tmp| ShellPaths.within?(real, tmp) }
-
-          root.empty? || !ShellPaths.within?(real, ProtectedPaths.real(root))
+        targets.paths.to_a.compact.any? do |path|
+          !PairCommand.writable?(File.expand_path(path), root: project_root, cwd: targets.cwd)
         end
       end
 
       def command(targets, paths)
         @command = nil unless @command&.first == targets
-        @command ||= [targets, PairCommand.new(targets.command, cwd: targets.cwd, home: home, root: @root.call,
-                                                                paths: paths || denylist, tmp_roots: @tmp_roots.call)]
+        @command ||= [targets, PairCommand.new(targets.command, cwd: targets.cwd, home: home, root: project_root,
+                                                                paths: paths || denylist, web: web_text)]
         @command.last
       end
 
+      # The session's project root; nil without one, or when it is the home
+      # folder or above it (ReviewPaths.home_root?): then every write asks.
+      def project_root
+        root = @root.call.to_s
+        root.empty? || ReviewPaths.home_root?(root, home) ? nil : root
+      end
+
+      def web_text = PairCommand.web_text(@web_ports.call, hostnames: PairCommand.hostnames)
+
       def denylist = ReviewPaths.new(root: nil, denied_dirs: @denied_dirs.call, home: @home.call)
 
       def home = @home.call.to_s