samagotchi 0.128.0 → 0.130.0

data/lib/samagotchi/guardrails/targets.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "json"
 require_relative "../tools/tool_path"
 require_relative "../tools/memory"
 require_relative "../tool_declarations"
@@ -12,8 +13,10 @@ require_relative "shell_lex"
 require_relative "read_only_shell"
 require_relative "shell_paths"
 require_relative "rm_targets"
-require_relative "protected_paths"
+require_relative "chi_dirs"
+require_relative "path_resolve"
 require_relative "../memory_paths"
+require_relative "../redacted_inspect"
 
 module Samagotchi
   module Guardrails
@@ -21,8 +24,12 @@ module Samagotchi
     # shell command, absolute paths (against Dir.pwd, as the file tools have
     # no cwd:), the directory a command runs in, its repo root, and whether
     # a path leaves the session's repo (Outside: the context cwd's repo
-    # root, the cwd when there is no repo; not the call's own cwd:).
+    # root, the cwd when there is no repo; not the call's own cwd:). A
+    # path whose `..` climbs out of a symlinked dir's target is in #paths
+    # twice: lexically and as the kernel opens it (.absolutes).
     class Targets
+      include RedactedInspect # @env: the call's env: may hold a secret
+
       SHELL_TOOLS = %w[execute task_create].freeze
       PATH_TOOLS = %w[write edit read memory_write].freeze
 
@@ -31,6 +38,24 @@ module Samagotchi
 
       attr_reader :tool, :command, :paths, :cwd, :repo_root
 
+      # @return [Hash{String=>String}] the variables a task_create call's
+      #   env: sets for its command ({} for none, and for every other tool)
+      attr_reader :env
+
+      # Variables that change what a command's words run or where its cd
+      # goes, under every shell chi may use or in the programs it runs: a
+      # startup file (BASH_ENV, ENV), an exported function (BASH_FUNC_…), a
+      # cd search path, word splitting, shell options, a library loaded into
+      # every program, git config or a diff program that runs. A call whose
+      # env: sets one is never read-only (.redefines_shell?). PATH is not
+      # one (the tool's own description suggests it); nor are
+      # PROMPT_COMMAND (interactive shells only) and ZDOTDIR (zsh in sh
+      # emulation reads no rc files).
+      SHELL_REDEFINING_ENV = %w[BASH_ENV ENV CDPATH IFS SHELLOPTS BASHOPTS LD_PRELOAD LD_AUDIT
+                                DYLD_INSERT_LIBRARIES GIT_EXTERNAL_DIFF GIT_CONFIG_PARAMETERS
+                                GIT_CONFIG_COUNT].freeze
+      SHELL_REDEFINING_PREFIX = "BASH_FUNC_"
+
       # @return [String, nil] the call's repository (Context#repo: its
       #   common git dir, shared by its worktrees): what a "this repo"
       #   approval is kept for
@@ -96,15 +121,17 @@ module Samagotchi
         args = nil
         acts_as = nil
         label = nil
+        env = {}
         case tool
         when *SHELL_TOOLS
           command = call[:content].to_s
+          env = env_of(call[:env])
           given = call[:cwd].to_s.strip
           cwd = File.expand_path(given, base) unless given.empty?
         when "write", "edit"
-          paths << absolute(call[:path], base)
+          paths.concat(absolutes(call[:path], base))
         when "read"
-          paths << absolute(call[:content], base)
+          paths.concat(absolutes(call[:content], base))
         when "memory_write"
           paths << memory_path(call, model_key)
         else
@@ -112,7 +139,7 @@ module Samagotchi
           command = given[:command]
           given_cwd = given[:cwd].to_s.strip
           cwd = File.expand_path(given_cwd, base) unless given_cwd.empty?
-          paths.concat(given[:paths].map { |path| absolute(path, cwd) })
+          paths.concat(given[:paths].flat_map { |path| absolutes(path, cwd) })
           entry = registry && registry[tool]
           args = given[:args] || call[:args] if entry && !entry.core? && call[:args].is_a?(Hash)
           acts_as = given[:acts_as]
@@ -121,7 +148,7 @@ module Samagotchi
         memory_remove = tool == "memory_write" && call[:remove].to_s.strip.downcase == "true"
         memory_overlay = tool == "memory_write" && !memory_remove && call[:current_model_only].to_s.strip.downcase == "true"
         memory = tool == "memory_write" ? memory_facts(call) : nil
-        new(tool: tool, command: command, paths: paths.compact, cwd: cwd, repo_root: context.repo_root(cwd),
+        new(tool: tool, command: command, paths: paths.compact, cwd: cwd, env: env, repo_root: context.repo_root(cwd),
             repo: context.repo(cwd), args: args, acts_as: acts_as, label: label, memory_remove: memory_remove,
             memory_overlay: memory_overlay, memory: memory,
             model_name: model_name, model_key: model_key, session_root: context.repo_root(base) || base,
@@ -208,15 +235,36 @@ module Samagotchi
       end
 
       # chi's own dirs (ParentApprovals.chi_dirs) and the session repo's
-      # git hooks dir.
-      def self.chi_dirs(context, base)
-        require_relative "parent_approvals"
-        ParentApprovals.chi_dirs + [context.hooks_dir(base)].compact
+      # git hooks dir (ChiDirs.touches).
+      def self.chi_dirs(context, base) = ChiDirs.touches(context, base)
+
+      # A shell call's env: as the tool reads it (an object, or JSON text
+      # for one): {} for none, and for one the tool would refuse (it then
+      # runs nothing).
+      def self.env_of(given)
+        given = JSON.parse(given) if given.is_a?(String) && !given.strip.empty?
+        return {} unless given.is_a?(Hash)
+
+        given.to_h { |key, value| [key.to_s, value.to_s] }.freeze
+      rescue JSON::ParserError
+        {}
+      end
+
+      # Whether +env+ sets a SHELL_REDEFINING_ENV variable.
+      def self.redefines_shell?(env)
+        env.each_key.any? { |key| SHELL_REDEFINING_ENV.include?(key) || key.start_with?(SHELL_REDEFINING_PREFIX) }
       end
 
-      def self.absolute(path, base)
+      # +path+ (a file tool's, as Tools::ToolPath has it) absolute against
+      # +base+: its lexical path (File.expand_path), and the one the kernel
+      # opens when a `..` in it climbs out of a symlinked dir's target
+      # (PathResolve.expand) after it; [] for a blank path. Every check
+      # reads all of #paths, so it judges both.
+      def self.absolutes(path, base)
         path = Tools::ToolPath.normalize(path)
-        path.empty? ? nil : File.expand_path(path, base)
+        return [] if path.empty?
+
+        [File.expand_path(path, base), PathResolve.expand(path, base)].uniq
       end
 
       # The file memory_write would write; nil when the call is invalid.
@@ -245,9 +293,11 @@ module Samagotchi
       end
 
       # @param chi_dirs [#call, nil] → the dirs touches_chi? looks for
-      def initialize(tool:, command:, paths:, cwd:, repo_root:, repo: nil, args: nil, acts_as: nil, label: nil,
-                     model_name: nil, model_key: nil, session_root: nil, chi_dirs: nil, memory_remove: false,
-                     memory_overlay: false, memory: nil)
+      # @param env [Hash{String=>String}] the call's env: (.env_of)
+      def initialize(tool:, command:, paths:, cwd:, repo_root:, env: {}, repo: nil, args: nil, acts_as: nil,
+                     label: nil, model_name: nil, model_key: nil, session_root: nil, chi_dirs: nil,
+                     memory_remove: false, memory_overlay: false, memory: nil)
+        @env = env
         @acts_as = acts_as
         @label = label
         @memory_remove = memory_remove
@@ -268,6 +318,28 @@ module Samagotchi
 
       def shell? = SHELL_TOOLS.include?(@tool)
 
+      # The homes and environments a shell call's words may resolve
+      # against, as [home, env] pairs: chi's own, and when the call's env:
+      # sets anything, that env over chi's (its HOME for ~ and a bare cd).
+      # A check that asks when any pair crosses only ever asks more for an
+      # env: than without one. Not kept (chi's env holds secrets).
+      def shell_envs
+        own = [Dir.home, ENV]
+        return [own] if @env.empty?
+
+        home = @env["HOME"].to_s
+        [own, [home.empty? ? Dir.home : home, ENV.to_h.merge(@env)]]
+      end
+
+      # Whether the call's env: sets a variable that changes what the
+      # command's words run (.redefines_shell?): such a command is never
+      # read-only, nor tmp-write-only.
+      def redefines_shell?
+        return @redefines_shell if defined?(@redefines_shell)
+
+        @redefines_shell = self.class.redefines_shell?(@env)
+      end
+
       # What a rule's command: reads: the shell command with the body of each
       # heredoc its command only reads as data left out (ShellLex.code_text);
       # a plugin tool's own command as given (its text may not be shell).
@@ -310,14 +382,37 @@ module Samagotchi
       # Where a shell call runs mutating git (ShellGitDirs: dirs, and
       # :unknown for one the text doesn't tell); [] for other tools.
       def git_dirs
-        @git_dirs ||= shell? ? ShellGitDirs.for(@command, cwd: @cwd) : []
+        @git_dirs ||= if shell?
+                        # chi's own GIT_DIR is not the command's concern
+                        shell_envs.each_with_index.flat_map do |(home, vars), i|
+                          ShellGitDirs.for(@command, cwd: @cwd, home: home, env: i.zero? ? {} : @env, vars: vars)
+                        end.uniq
+                      else
+                        []
+                      end
       end
 
       # Whether the command only reads (ReadOnlyShell); false without one.
       def read_only?
         return @read_only if defined?(@read_only)
 
-        @read_only = !@command.nil? && ReadOnlyShell.read_only?(@command)
+        @read_only = !@command.nil? && !redefines_shell? && ReadOnlyShell.read_only?(@command)
+      end
+
+      # Whether the command only reads but for writes into a tmp dir that
+      # +root+ isn't in (ReadOnlyShell.read_only_but_writes?,
+      # Outside.tmp_write?): its > / >> targets, cp's destination and tee's
+      # files, from the call's cwd and any cd before them. The child
+      # boundary's; #read_only? stays what the rules read. Never for a call
+      # whose env: redefines the shell (#redefines_shell?); the writes must
+      # hold under each of #shell_envs.
+      # @param root [String] the folder the writes must stay out of
+      def read_only_but_tmp_writes?(root:)
+        !@command.nil? && !redefines_shell? && shell_envs.all? do |home, env|
+          ReadOnlyShell.read_only_but_writes?(@command, cwd: @cwd, home: home, env: env) do |path|
+            Outside.tmp_write?(path, root: root)
+          end
+        end
       end
 
       # A memory file that reaches the system prompt: the identity memory and
@@ -338,36 +433,43 @@ module Samagotchi
       # disk MODEL_NOTES_x.md in Samagotchi/Memories is the same file chi
       # loads.
       def self.prompt_memory_path?(path)
-        real = ProtectedPaths.real(path)
-        return false unless File.basename(real).downcase.match?(PROMPT_MEMORY)
+        PathResolve.reals(path).any? do |real|
+          next false unless File.basename(real).downcase.match?(PROMPT_MEMORY)
 
-        dir = File.dirname(real)
-        dir.casecmp?(ProtectedPaths.real(MemoryPaths.system_dir)) ||
-          File.dirname(dir).casecmp?(ProtectedPaths.real(MemoryPaths.projects_dir))
+          dir = File.dirname(real)
+          dir.casecmp?(PathResolve.real(MemoryPaths.system_dir)) ||
+            File.dirname(dir).casecmp?(PathResolve.real(MemoryPaths.projects_dir))
+        end
       rescue StandardError
         false
       end
 
       # Whether the command names a path in chi's own dirs (ShellPaths:
-      # resolved paths; the text CHI_SHELL_TEXT for a word that can't be
-      # resolved); false without a command.
+      # resolved paths, under any of #shell_envs; the text CHI_SHELL_TEXT
+      # for a word that can't be resolved); false without a command.
       def touches_chi?
         return @touches_chi if defined?(@touches_chi)
 
         @touches_chi = !@command.nil? && begin
           require_relative "parent_approvals"
-          ShellPaths.touches?(@command, dirs: @chi_dirs ? @chi_dirs.call : ParentApprovals.chi_dirs,
-                                        text: ParentApprovals::CHI_SHELL_TEXT, cwd: @cwd, tmp_roots: Outside.tmp_roots)
+          dirs = @chi_dirs ? @chi_dirs.call : ParentApprovals.chi_dirs
+          shell_envs.any? do |home, env|
+            ShellPaths.touches?(@command, dirs: dirs, text: ParentApprovals::CHI_SHELL_TEXT, cwd: @cwd, home: home,
+                                          env: env, tmp_roots: Outside.tmp_roots)
+          end
         end
       end
 
       # Whether an rm -rf in the command reaches outside the tmp dirs
-      # (RmTargets; a tmp dir the session's root is in doesn't count as one).
+      # (RmTargets, under any of #shell_envs; a tmp dir the session's root
+      # is in doesn't count as one).
       def rm_outside_tmp?
         return @rm_outside_tmp if defined?(@rm_outside_tmp)
 
-        @rm_outside_tmp = !@command.nil? &&
-                          RmTargets.outside_tmp?(@command, cwd: @cwd, tmp_roots: Outside.tmp_roots, session_root: @session_root)
+        @rm_outside_tmp = !@command.nil? && shell_envs.any? do |home, env|
+          RmTargets.outside_tmp?(@command, cwd: @cwd, tmp_roots: Outside.tmp_roots, session_root: @session_root,
+                                           home: home, env: env)
+        end
       end
 
       # Whether a shell call runs mutating git outside the session's repo

data/lib/samagotchi/remote_command.rb

@@ -122,8 +122,9 @@ module Samagotchi
       0
     end
 
-    # The token from its file or stdin; nil for none (a loopback chi web
-    # needs none), false after the error line.
+    # The token from its file or stdin; nil for none (a chi web on
+    # loopback only, no LAN mode or proxy, needs none), false after the
+    # error line.
     def read_token(options)
       text = if options[:token_file]
                begin
@@ -145,17 +146,26 @@ module Samagotchi
     end
 
     # GET /api/info with the token: the answer, or nil after the line that
-    # says why it can't be used.
+    # says why it can't be used. With no token, a chi web on the LAN or
+    # behind a proxy reached on its loopback (an SSH tunnel) answers chi's
+    # probe (its checked fields, no cwd) and every other route 401: it
+    # needs the token.
     def check(entry)
       reply = @transport.call(entry).call(:get, "/api/info")
       problem = SessionAccess::Remote.info_problem(entry, reply)
       return fail_line(problem.message) if problem
+      return fail_line(token_needed(entry)) unless reply.json.key?("cwd")
 
       reply.json
     rescue SessionAccess::RemoteFailed => e
       fail_line("#{e.message}: start chi web on #{entry.host} with web.host: lan")
     end
 
+    def token_needed(entry)
+      "#{entry.label}: its chi web needs its access token (its LAN link carries it, after ?token=; or its " \
+        "web-token file): chi remote add #{entry.name} #{entry.url} --token-file FILE"
+    end
+
     def lan_words(found, entry)
       return "loopback only" unless found["lan"]
 

data/lib/samagotchi/remotes.rb

@@ -25,8 +25,9 @@ module Samagotchi
     NAME = /\A[A-Za-z0-9][A-Za-z0-9_-]{0,39}\z/
 
     # One remote: its +name+, chi web's +url+ (scheme, host and port, no
-    # path) and its access +token+ (nil for a loopback chi web, which needs
-    # none). #inspect leaves the token out.
+    # path) and its access +token+ (nil for a chi web on loopback only, no
+    # LAN mode or proxy: it alone needs none, its loopback reached through
+    # an SSH tunnel). #inspect leaves the token out.
     Entry = Data.define(:name, :url, :token) do
       # The host as an address, an IPv6 one bare (::1, not [::1]).
       def host = URI(url).hostname

data/lib/samagotchi/review_start.rb

@@ -6,6 +6,7 @@ require_relative "session_setup"
 require_relative "session_chain"
 require_relative "recap_store"
 require_relative "guardrails/context"
+require_relative "guardrails/path_resolve"
 require_relative "guardrails/review_paths"
 require_relative "participant_mode"
 
@@ -185,8 +186,8 @@ module Samagotchi
                            "only reads."
 
     def relative(full, root)
-      real_root = Guardrails::ProtectedPaths.real(root)
-      real = Guardrails::ProtectedPaths.real(full)
+      real_root = Guardrails::PathResolve.real(root)
+      real = Guardrails::PathResolve.real(full)
       real.delete_prefix(File.join(real_root, ""))
     end
   end

data/lib/samagotchi/session_inbox.rb

@@ -289,6 +289,23 @@ module Samagotchi
         data["verify"].is_a?(Hash)
     end
 
+    # Whether a message waits that a running turn's next boundary merges and
+    # that a person (or chi send, or a delegating parent) sent: an unclaimed
+    # input file not held for the turn's end (#turn_end_data?), with a
+    # prompt, from a sender that may cut (Steer.cuts?). A running task_wait
+    # ends on it (Worker#input_waiting?). It only peeks: nothing is claimed;
+    # a file the drain or a dequeue claims meanwhile (ENOENT) or one that
+    # doesn't parse is skipped.
+    def self.steer_waiting?(session_dir)
+      find_new_input_files(session_dir).any? do |file|
+        data = JSON.parse(File.read(file))
+        data.is_a?(Hash) && !turn_end_data?(data) && !data["prompt"].to_s.strip.empty? &&
+          Steer.cuts?(Steer.source_for_client(data["client_id"]))
+      rescue JSON::ParserError, SystemCallError
+        false
+      end
+    end
+
     # How the unclaimed input file carrying +enqueued_id+ waits: :turn_end
     # (a queue or an image message: it runs as a turn of its own, never
     # merged, #waits_for_turn_end?), :merges (a running turn's drain may

data/lib/samagotchi/session_manager.rb

@@ -27,6 +27,7 @@ require_relative "process_group"
 require_relative "bridge_client"
 require_relative "worker_sidecar"
 require_relative "worker_link"
+require_relative "worker_idle_exit"
 require_relative "worker_signals"
 require_relative "chi_invocation"
 require_relative "log"
@@ -676,7 +677,7 @@ module Samagotchi
         command_running: "a /btw (or another command) is still running",
         relays_open: "a delegate's approval relayed here is open or just answered",
         background_tasks: "background tasks it started are still running"
-      }.freeze
+      }.merge(WorkerIdleExit::LEAVING_WORDS).freeze
 
       # What the CLI and the web say.
       def self.words(session_id, reason, version = nil, holds = [], pid: nil, via: ChiInvocation::HERE)
@@ -1408,12 +1409,12 @@ module Samagotchi
       end
       manager.resume_session(session_id, state_dir: state_dir)
       if (client = bridge.call)
-        return verify_unavailable if verify && !worker_has?(session_dir, VerifyAnchor::FEATURE)
+        return verify_unavailable if verify && !worker_has?(client, VerifyAnchor::FEATURE)
         # A worker from before queueing (no "delivery" feature) ignores the
         # field or refuses it; either way a file would steer the running turn.
-        return queue_unavailable if Delivery.queue?(delivery) && !worker_queues?(session_dir)
+        return queue_unavailable if Delivery.queue?(delivery) && !worker_has?(client, Delivery::QUEUE_FEATURE)
         # A participant's turn only to a worker with the review boundary.
-        return review_unavailable if Steer.participant_author?(author) && !worker_has?(session_dir, Delivery::REVIEW_FEATURE)
+        return review_unavailable if Steer.participant_author?(author) && !worker_has?(client, Delivery::REVIEW_FEATURE)
 
         begin
           options = { prompt: prompt, client_id: client_id }
@@ -1490,17 +1491,10 @@ module Samagotchi
                         ack: { "status" => "accepted", "enqueued_id" => enqueued_id, "session_id" => session_id })
     end
 
-    # Whether the session's live worker runs delivery: queue (its sidecar
-    # names the feature). No sidecar to read (the client came from a stand-in,
-    # or it went between the wait and here): true, the post finds out.
-    private_class_method def self.worker_queues?(session_dir) = worker_has?(session_dir, Delivery::QUEUE_FEATURE)
-
-    # Whether the session's live worker names +feature+ in its sidecar; no
-    # sidecar to read: true, as for #worker_queues?.
-    private_class_method def self.worker_has?(session_dir, feature)
-      sidecar = WorkerSidecar.read(session_dir)
-      sidecar.nil? || sidecar.features.include?(feature)
-    end
+    # Whether the worker +client+ talks to names +feature+: the features of
+    # the sidecar the client was made from (the Live link WorkerLink.await
+    # found), not a second read of bridge.json.
+    private_class_method def self.worker_has?(client, feature) = client.features.include?(feature)
 
     # The unclaimed input files +author+ wrote.
     PARTICIPANT_QUEUE_LOCK = "participants.lock"

data/lib/samagotchi/system_one/self_protect.rb

@@ -2,8 +2,12 @@
 
 require_relative "../config"
 require_relative "../memory_paths"
-require_relative "../guardrails/protected_paths"
+require_relative "../paths"
+require_relative "../guardrails/chi_dirs"
+require_relative "../guardrails/path_resolve"
 require_relative "../guardrails/parent_approvals"
+require_relative "../guardrails/shell_lex"
+require_relative "../guardrails/shell_paths"
 
 module Samagotchi
   module SystemOne
@@ -14,6 +18,21 @@ module Samagotchi
     # "System 1"). The memories dir is deliberately not one of them:
     # reading and appending a memory file stays eligible.
     #
+    # A file tool's paths and a shell command's words are judged against
+    # the same dirs (.chi_dirs: chi's whole state dir among them). The
+    # words are resolved as Guardrails::ShellPaths resolves them (cd
+    # chains, ~, $HOME and the XDG dirs, symlinks, `..` both ways), under
+    # chi's env and the call's env: when the caller hands its Targets; one
+    # landing in chi's dirs outside the memories refuses.
+    # The memories text is taken out of the command (the exemption) only
+    # when its text shows no climb (CLIMB: a `..`, a `$`, backticks, a `~`
+    # other than the home one, `cd -`) and every word either resolved or is
+    # data (Words#plain: a script or heredoc body, a phrase, a glob with no
+    # `/`) read while the dir was known. A word the walk can't follow
+    # otherwise (`${PWD%/*}`, `$(dirname $PWD)`, `cd -`) may climb out of the
+    # memories dir without saying so, so its memories text stays in and the
+    # text check refuses it.
+    #
     # Pure: it only reads the paths as this process's environment names them,
     # and answers on the approval's own facts (Guardrails::Approval.payload's
     # approval:), the same shape ParentApprovals.protected_facts? takes.
@@ -29,50 +48,138 @@ module Samagotchi
       # The characters that end a shell word: a memories path in a command
       # ends at the first one.
       WORD_END = %q{[\s'"`;&|<>(){}:,]}
-      # A `..` segment anywhere in a command: with one, a memories path may
-      # climb back out (`memories/../config.yml`, `cd memories && … ../x`),
-      # so the command's memories text is not taken out.
-      CLIMB = %r{(?:\A|[\s/'"=])\.\.(?:/|[\s'"]|\z)}
+
+      # A climb out of a dir as a command's text may spell it: a `..`
+      # segment (`cd ..;`, `../x`, inside a script body too), any `$`
+      # expansion or backticks, a `~` that isn't the home one (`~-`, `~+`,
+      # `~user`), or `cd -` / `pushd -`.
+      CLIMB = Regexp.union(
+        /(?<![\w.])\.\.(?![\w.])/, /[$`]/, %r{(?:\A|[\s=:'"(])~(?![/\s'";&|)]|\z)},
+        /(?:\A|[\s;&|(])(?:cd|pushd)\s+-(?=[\s;&|)]|\z)/
+      )
+
+      # What resolving a command's words found: whether one lands in chi's
+      # dirs (outside the memories dir, or in its installed bundles), and
+      # whether every word resolved or is data (#plain).
+      Words = Data.define(:chi, :plain)
 
       module_function
 
       # @param approval [Hash, nil] the ask's approval facts (rule, tool,
-      #   paths, command)
+      #   paths, command, cwd)
+      # @param targets [Guardrails::Targets, nil] the call's targets, for its
+      #   env: (Targets#shell_envs, #redefines_shell?)
       # @return [Boolean] whether System 1 must not answer this ask
-      def refuse?(approval)
+      def refuse?(approval, targets: nil)
         return false unless approval.is_a?(Hash)
         return true if NEVER_AUTO.include?(fetch(approval, :rule).to_s)
-        # The test that makes an ask user_only (ParentApprovals#chi_files?:
-        # chi's dirs, however a command spells them), minus the memories.
-        return true if Guardrails::ParentApprovals.chi_files?(beyond_memories(approval))
+        # An env: that redefines the shell (BASH_ENV, BASH_FUNC_…) runs what
+        # no word of the command says.
+        return true if targets&.redefines_shell?
 
         command = fetch(approval, :command).to_s
+        words = command.empty? ? nil : words(command, cwd: fetch(approval, :cwd), targets: targets)
+        return true if words&.chi
+        return true if chi_paths?(approval)
+        # The test that makes an ask user_only (ParentApprovals#chi_files?:
+        # chi's dirs as the command spells them), minus the memories.
+        return true if Guardrails::ParentApprovals.chi_files?(beyond_memories(approval, exempt: exempt?(command, words)))
+
         command.match?(DEFAULT_STATE_TEXT)
       end
 
+      # Whether a path of the approval lands in chi's dirs (#chi_dirs: its
+      # whole state dir too, as a command's words are judged) outside the
+      # memories dir, or in its installed bundles.
+      def chi_paths?(approval)
+        memories = Guardrails::PathResolve.real(MemoryPaths.system_dir)
+        bundles = Guardrails::PathResolve.real(MemoryPaths.bundles_dir)
+        dirs = chi_dirs
+        Array(fetch(approval, :paths)).map(&:to_s).reject(&:empty?).any? do |path|
+          Guardrails::PathResolve.reals(path).any? do |real|
+            dirs.any? { |dir| Guardrails::PathResolve.within?(real, dir) } && !memory?(real, memories, bundles)
+          end
+        end
+      end
+
       # The approval's facts without what is in the memories dir (not its
       # installed bundles): the paths under it, and its spellings in the
-      # command unless the command climbs with `..`.
-      def beyond_memories(approval)
-        memories = Guardrails::ProtectedPaths.real(MemoryPaths.system_dir)
-        bundles = Guardrails::ProtectedPaths.real(MemoryPaths.bundles_dir)
+      # command when +exempt+ (.exempt?).
+      def beyond_memories(approval, exempt:)
+        memories = Guardrails::PathResolve.real(MemoryPaths.system_dir)
+        bundles = Guardrails::PathResolve.real(MemoryPaths.bundles_dir)
         paths = Array(fetch(approval, :paths)).map(&:to_s).reject do |path|
-          real = Guardrails::ProtectedPaths.real(path)
-          Guardrails::ProtectedPaths.within?(real, memories) && !Guardrails::ProtectedPaths.within?(real, bundles)
+          Guardrails::PathResolve.reals(path).all? { |real| memory?(real, memories, bundles) }
         end
         command = fetch(approval, :command).to_s
-        unless command.match?(CLIMB)
-          command = command.gsub(memories_text) { |text| text.include?("/.bundles") ? text : "" }
-        end
+        command = command.gsub(memories_text) { |text| text.include?("/.bundles") ? text : "" } if exempt
         { paths: paths, command: command }
       end
 
+      # Whether the command's memories text may be taken out: no command,
+      # or one whose text shows no climb (CLIMB) and whose words are plain.
+      def exempt?(command, words)
+        words.nil? || (words.plain && !command.match?(CLIMB))
+      end
+
+      # The command's words resolved (ShellPaths::Walk) from +cwd+ (else
+      # this process's dir) under each of the call's shell envs: Words.
+      def words(command, cwd:, targets:)
+        memories = Guardrails::PathResolve.real(MemoryPaths.system_dir)
+        bundles = Guardrails::PathResolve.real(MemoryPaths.bundles_dir)
+        dirs = chi_dirs
+        tokens = Guardrails::ShellLex.lex(command)
+        plain = !Guardrails::ShellLex.unterminated?(command) &&
+                tokens.none? { |_, value| value.include?(Guardrails::ShellLex::SUBST) }
+        chi = false
+        commands = Guardrails::ShellLex.simple_commands(tokens)
+        envs = targets ? targets.shell_envs : [[Dir.home, ENV]]
+        envs.each do |home, env|
+          walk = Guardrails::ShellPaths::Walk.new(cwd.to_s.empty? ? Dir.pwd : cwd.to_s, home, env)
+          commands.each do |simple|
+            # A cd the walk couldn't follow: no later word is data.
+            known = !simple.is_a?(Array) || !walk.paths(".").empty?
+            walk.step(simple).each do |word, path|
+              next plain &&= known && data?(word) unless path
+
+              chi ||= Guardrails::PathResolve.reals(path).any? do |real|
+                dirs.any? { |dir| Guardrails::PathResolve.under?(real, dir) } && !memory?(real, memories, bundles)
+              end
+            end
+          end
+        end
+        Words.new(chi: chi, plain: plain)
+      rescue ArgumentError, EncodingError
+        Words.new(chi: false, plain: false)
+      end
+
+      # Whether a word the walk couldn't resolve is data rather than a path
+      # spelt some other way: a heredoc body, a script or a phrase (spaces,
+      # quotes, operators: `python3 -c '…'`, `'- a note'`), or a glob with
+      # no `/`. A `$` or `~` left in it is not (CLIMB refuses those anyway).
+      def data?(word)
+        return true if word == Guardrails::ShellLex::HEREDOC
+        return false if word.include?("$") || word.include?("~")
+        return true if word.match?(Guardrails::ShellPaths::SCRIPT)
+
+        word.match?(Guardrails::ShellPaths::GLOB) && !word.include?("/")
+      end
+
+      # chi's own dirs (ParentApprovals.chi_dirs) and its whole state dir
+      # (DEFAULT_STATE_TEXT's), resolved (Guardrails::ChiDirs.self_protect).
+      def chi_dirs = Guardrails::ChiDirs.self_protect
+
+      # Whether +real+ is in the memories dir and not in its installed bundles.
+      def memory?(real, memories, bundles)
+        Guardrails::PathResolve.within?(real, memories) && !Guardrails::PathResolve.within?(real, bundles)
+      end
+
       # The memories dir as a command spells it: the default
       # `.config/samagotchi/memories`, or this process's own path, with the
       # rest of that shell word.
       def memories_text
         dir = ConfigFile.config_dir
-        prefixes = [".config/samagotchi", dir, Guardrails::ProtectedPaths.real(dir)]
+        prefixes = [".config/samagotchi", dir, Guardrails::PathResolve.real(dir)]
                    .map { |prefix| Regexp.escape(prefix.to_s.chomp("/")) }.uniq
         word = WORD_END.sub("[", "[^")
         Regexp.new("(?:#{prefixes.join("|")})/memories(?=/|#{WORD_END}|\\z)(?:/#{word}*)?")

data/lib/samagotchi/terminal_ui/exit_lines.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../tools/task_record"
+require_relative "../worker_idle_exit"
 
 module Samagotchi
   class TerminalUI
@@ -23,7 +24,7 @@ module Samagotchi
         "reminders" => "reminders are set", "starting" => "the worker is still starting",
         "background_tasks" => "background tasks it started are still running",
         "delegates" => "delegates of this session are still running"
-      }.freeze
+      }.merge(WorkerIdleExit::LEAVING_WORDS.transform_keys(&:to_s)).freeze
       # How to end a background task that holds the worker up (an older
       # worker's 409 has no hint of its own).
       TASK_STOP_HINT = "stop one with the web's stop-task button or by asking for task_stop"

data/lib/samagotchi/terminal_ui/local_link.rb

@@ -57,7 +57,7 @@ module Samagotchi
         id = @session_id
         return [:gone, "stopped"] if Session.stopped_marker?(id, state_dir: @state_dir)
 
-        link = WorkerLink.resolve(session_dir, unlink: true, host: @host)
+        link = WorkerLink.resolve(session_dir, unlink: true)
         if link.is_a?(WorkerLink::Skew)
           @failure = link.message(id)
           return [:gone, "worker_newer"]
@@ -79,7 +79,7 @@ module Samagotchi
         candidate = if found&.port == port
                       found
                     else
-                      link = WorkerLink.resolve(session_dir, unlink: true, host: @host)
+                      link = WorkerLink.resolve(session_dir, unlink: true)
                       link.live? && link.port == port ? link.client(@session_id, host: @host) : nil
                     end
         @client = candidate if candidate