samagotchi 0.129.0 → 0.130.0

data/lib/samagotchi/session_inbox.rb

@@ -289,6 +289,23 @@ module Samagotchi
         data["verify"].is_a?(Hash)
     end
 
+    # Whether a message waits that a running turn's next boundary merges and
+    # that a person (or chi send, or a delegating parent) sent: an unclaimed
+    # input file not held for the turn's end (#turn_end_data?), with a
+    # prompt, from a sender that may cut (Steer.cuts?). A running task_wait
+    # ends on it (Worker#input_waiting?). It only peeks: nothing is claimed;
+    # a file the drain or a dequeue claims meanwhile (ENOENT) or one that
+    # doesn't parse is skipped.
+    def self.steer_waiting?(session_dir)
+      find_new_input_files(session_dir).any? do |file|
+        data = JSON.parse(File.read(file))
+        data.is_a?(Hash) && !turn_end_data?(data) && !data["prompt"].to_s.strip.empty? &&
+          Steer.cuts?(Steer.source_for_client(data["client_id"]))
+      rescue JSON::ParserError, SystemCallError
+        false
+      end
+    end
+
     # How the unclaimed input file carrying +enqueued_id+ waits: :turn_end
     # (a queue or an image message: it runs as a turn of its own, never
     # merged, #waits_for_turn_end?), :merges (a running turn's drain may

data/lib/samagotchi/system_one/self_protect.rb

@@ -3,7 +3,8 @@
 require_relative "../config"
 require_relative "../memory_paths"
 require_relative "../paths"
-require_relative "../guardrails/protected_paths"
+require_relative "../guardrails/chi_dirs"
+require_relative "../guardrails/path_resolve"
 require_relative "../guardrails/parent_approvals"
 require_relative "../guardrails/shell_lex"
 require_relative "../guardrails/shell_paths"
@@ -17,10 +18,12 @@ module Samagotchi
     # "System 1"). The memories dir is deliberately not one of them:
     # reading and appending a memory file stays eligible.
     #
-    # A shell command's words are resolved as Guardrails::ShellPaths
-    # resolves them (cd chains, ~, $HOME and the XDG dirs, symlinks, `..`
-    # both ways), under chi's env and the call's env: when the caller hands
-    # its Targets; one landing in chi's dirs outside the memories refuses.
+    # A file tool's paths and a shell command's words are judged against
+    # the same dirs (.chi_dirs: chi's whole state dir among them). The
+    # words are resolved as Guardrails::ShellPaths resolves them (cd
+    # chains, ~, $HOME and the XDG dirs, symlinks, `..` both ways), under
+    # chi's env and the call's env: when the caller hands its Targets; one
+    # landing in chi's dirs outside the memories refuses.
     # The memories text is taken out of the command (the exemption) only
     # when its text shows no climb (CLIMB: a `..`, a `$`, backticks, a `~`
     # other than the home one, `cd -`) and every word either resolved or is
@@ -77,6 +80,7 @@ module Samagotchi
         command = fetch(approval, :command).to_s
         words = command.empty? ? nil : words(command, cwd: fetch(approval, :cwd), targets: targets)
         return true if words&.chi
+        return true if chi_paths?(approval)
         # The test that makes an ask user_only (ParentApprovals#chi_files?:
         # chi's dirs as the command spells them), minus the memories.
         return true if Guardrails::ParentApprovals.chi_files?(beyond_memories(approval, exempt: exempt?(command, words)))
@@ -84,14 +88,28 @@ module Samagotchi
         command.match?(DEFAULT_STATE_TEXT)
       end
 
+      # Whether a path of the approval lands in chi's dirs (#chi_dirs: its
+      # whole state dir too, as a command's words are judged) outside the
+      # memories dir, or in its installed bundles.
+      def chi_paths?(approval)
+        memories = Guardrails::PathResolve.real(MemoryPaths.system_dir)
+        bundles = Guardrails::PathResolve.real(MemoryPaths.bundles_dir)
+        dirs = chi_dirs
+        Array(fetch(approval, :paths)).map(&:to_s).reject(&:empty?).any? do |path|
+          Guardrails::PathResolve.reals(path).any? do |real|
+            dirs.any? { |dir| Guardrails::PathResolve.within?(real, dir) } && !memory?(real, memories, bundles)
+          end
+        end
+      end
+
       # The approval's facts without what is in the memories dir (not its
       # installed bundles): the paths under it, and its spellings in the
       # command when +exempt+ (.exempt?).
       def beyond_memories(approval, exempt:)
-        memories = Guardrails::ProtectedPaths.real(MemoryPaths.system_dir)
-        bundles = Guardrails::ProtectedPaths.real(MemoryPaths.bundles_dir)
+        memories = Guardrails::PathResolve.real(MemoryPaths.system_dir)
+        bundles = Guardrails::PathResolve.real(MemoryPaths.bundles_dir)
         paths = Array(fetch(approval, :paths)).map(&:to_s).reject do |path|
-          Guardrails::ProtectedPaths.reals(path).all? { |real| memory?(real, memories, bundles) }
+          Guardrails::PathResolve.reals(path).all? { |real| memory?(real, memories, bundles) }
         end
         command = fetch(approval, :command).to_s
         command = command.gsub(memories_text) { |text| text.include?("/.bundles") ? text : "" } if exempt
@@ -107,8 +125,8 @@ module Samagotchi
       # The command's words resolved (ShellPaths::Walk) from +cwd+ (else
       # this process's dir) under each of the call's shell envs: Words.
       def words(command, cwd:, targets:)
-        memories = Guardrails::ProtectedPaths.real(MemoryPaths.system_dir)
-        bundles = Guardrails::ProtectedPaths.real(MemoryPaths.bundles_dir)
+        memories = Guardrails::PathResolve.real(MemoryPaths.system_dir)
+        bundles = Guardrails::PathResolve.real(MemoryPaths.bundles_dir)
         dirs = chi_dirs
         tokens = Guardrails::ShellLex.lex(command)
         plain = !Guardrails::ShellLex.unterminated?(command) &&
@@ -124,8 +142,8 @@ module Samagotchi
             walk.step(simple).each do |word, path|
               next plain &&= known && data?(word) unless path
 
-              chi ||= Guardrails::ProtectedPaths.reals(path).any? do |real|
-                dirs.any? { |dir| Guardrails::ShellPaths.within?(real, dir) } && !memory?(real, memories, bundles)
+              chi ||= Guardrails::PathResolve.reals(path).any? do |real|
+                dirs.any? { |dir| Guardrails::PathResolve.under?(real, dir) } && !memory?(real, memories, bundles)
               end
             end
           end
@@ -148,15 +166,12 @@ module Samagotchi
       end
 
       # chi's own dirs (ParentApprovals.chi_dirs) and its whole state dir
-      # (DEFAULT_STATE_TEXT's), resolved.
-      def chi_dirs
-        [*Guardrails::ParentApprovals.chi_dirs, Paths.state_dir]
-          .map { |dir| Guardrails::ProtectedPaths.real(dir.to_s.chomp("/")) }.reject(&:empty?).uniq
-      end
+      # (DEFAULT_STATE_TEXT's), resolved (Guardrails::ChiDirs.self_protect).
+      def chi_dirs = Guardrails::ChiDirs.self_protect
 
       # Whether +real+ is in the memories dir and not in its installed bundles.
       def memory?(real, memories, bundles)
-        Guardrails::ProtectedPaths.within?(real, memories) && !Guardrails::ProtectedPaths.within?(real, bundles)
+        Guardrails::PathResolve.within?(real, memories) && !Guardrails::PathResolve.within?(real, bundles)
       end
 
       # The memories dir as a command spells it: the default
@@ -164,7 +179,7 @@ module Samagotchi
       # rest of that shell word.
       def memories_text
         dir = ConfigFile.config_dir
-        prefixes = [".config/samagotchi", dir, Guardrails::ProtectedPaths.real(dir)]
+        prefixes = [".config/samagotchi", dir, Guardrails::PathResolve.real(dir)]
                    .map { |prefix| Regexp.escape(prefix.to_s.chomp("/")) }.uniq
         word = WORD_END.sub("[", "[^")
         Regexp.new("(?:#{prefixes.join("|")})/memories(?=/|#{WORD_END}|\\z)(?:/#{word}*)?")

data/lib/samagotchi/terminal_ui.rb

@@ -716,6 +716,8 @@ module Samagotchi
           max_iterations: max_iterations,
           cancel_controller: cancellation_controller,
           pending_input: method(:drain_steering),
+          # A steering line waits (#steer_line): a running task_wait ends for it.
+          input_waiting: -> { !@pending_input_queue.empty? },
           continue: continue,
           images: images,
           resumed: resumed,

data/lib/samagotchi/tool_declarations.rb

@@ -221,7 +221,7 @@ module Samagotchi
       },
       {
         name: "task_wait",
-        description: "Wait for a background task to finish. Polls every 0.5s until completion, a log pattern matches, or timeout. Timed-out waits include a bounded output tail.",
+        description: "Wait for a background task to finish. Polls every 0.5s until completion, a log pattern matches, a message from the user arrives, or timeout. Timed-out waits include a bounded output tail.",
         parameters: {
           type: "object",
           properties: {

data/lib/samagotchi/tools/builtins.rb

@@ -86,7 +86,8 @@ module Samagotchi
         end,
         TaskWait::NAME => lambda do |call, kctx|
           TaskWait.call(call[:content], timeout: call[:timeout], tail_lines: call[:tail_lines],
-                                        done_pattern: call[:done_pattern], cancelled: cancelled_proc(kctx))
+                                        done_pattern: call[:done_pattern], cancelled: cancelled_proc(kctx),
+                                        message_waiting: input_waiting_proc(kctx))
         end,
         Execute::NAME => lambda do |call, kctx|
           Execute.call(call[:content], cwd: call[:cwd], cancelled: cancelled_proc(kctx), stop_reason: stop_reason_proc(kctx),
@@ -188,6 +189,14 @@ module Samagotchi
         -> { !!peers&.cancelled? }
       end
 
+      # A person's message waits for the turn's next boundary
+      # (Engine#input_waiting?, through its PeerView): a task_wait returns on
+      # it. A kernel whose peers can't tell: never.
+      def input_waiting_proc(kctx)
+        peers = kctx.peers
+        -> { peers.respond_to?(:input_waiting?) && !!peers.input_waiting? }
+      end
+
       # The running turn's stop reason (:signal, :manual, …), nil without one.
       def stop_reason_proc(kctx)
         peers = kctx.peers

data/lib/samagotchi/tools/peers.rb

@@ -23,6 +23,10 @@ module Samagotchi
       def cancelled?
         cancelled.respond_to?(:call) ? !!cancelled.call : !!cancelled
       end
+
+      # A person's message waits for the turn's next boundary: never here
+      # (Engine::PeerView asks the running turn).
+      def input_waiting? = false
     end
   end
 end

data/lib/samagotchi/tools/task_wait.rb

@@ -14,13 +14,23 @@ module Samagotchi
       # A handed-over execute keeps stderr in a log of its own: at most this
       # many of its last lines follow the output tail.
       STDERR_TAIL_LINES_MAX = 10
+      # The note of a wait a waiting message ended (wait_result:
+      # message_waiting); %<id>s is the task's id. "The user" whoever sent
+      # it: the merged message itself names its sender.
+      MESSAGE_WAITING_NOTE = [
+        "note: a message from the user is waiting; the task is STILL RUNNING.",
+        "  Read the message first. To keep waiting after it: task_wait %<id>s. If it is no longer needed: task_stop %<id>s."
+      ].join("\n").freeze
 
       def self.name = NAME
 
       # @param cancelled [#call] true once the user stopped the turn: the
       #   wait returns then, and the task keeps running
+      # @param message_waiting [#call] true once a person's message waits for
+      #   the turn's next boundary (Engine#input_waiting?): the wait returns
+      #   then, so the model reads it, and the task keeps running
       def self.call(task_id, timeout: TIMEOUT_DEFAULT, tail_lines: TAIL_LINES_DEFAULT, done_pattern: nil,
-                    cancelled: -> { false })
+                    cancelled: -> { false }, message_waiting: -> { false })
         timeout = TIMEOUT_DEFAULT if blank?(timeout)
         tail_lines = TAIL_LINES_DEFAULT if blank?(tail_lines)
         timeout = timeout.to_i
@@ -48,6 +58,7 @@ module Samagotchi
           end
 
           return cancelled_response(task_id, tail_lines, started) if cancelled.call
+          return message_waiting_response(task_id, tail_lines, started) if message_waiting.call
 
           break if monotonic_time > deadline
 
@@ -80,6 +91,20 @@ module Samagotchi
       end
       private_class_method :cancelled_response
 
+      # A message waits: the wait ends so the model reads it at the next
+      # boundary. A task that finished meanwhile gives its finished result,
+      # as after a Stop.
+      def self.message_waiting_response(task_id, tail_lines, started)
+        record, error = TaskRuntime.get_record(task_id)
+        return error if error
+        return finished_response(record, tail_lines) unless record.running?
+
+        note = [format(MESSAGE_WAITING_NOTE, id: task_id), "waited: #{(monotonic_time - started).round}s"]
+        format_response(record, wait_result: "message_waiting", output_tail: output_tail(record, tail_lines),
+                                tail_lines: tail_lines, extra: note)
+      end
+      private_class_method :message_waiting_response
+
       # A finished task's text, as task_wait gives it: its status lines and
       # always the log's last lines (a test run's summary, an error), then a
       # stderr_tail when the record has a non-empty one. A task the user

data/lib/samagotchi/turn_state.rb

@@ -5,7 +5,8 @@ require "monitor"
 module Samagotchi
   # A session's turn as other threads see it: whether one runs, its cancel
   # controller and event sink, the plugin steers waiting for its next
-  # boundary, and the activity clock the idle jobs read.
+  # boundary, whether a person's message waits for it (its caller's
+  # input_waiting: probe), and the activity clock the idle jobs read.
   #
   # The turn thread writes it (Engine#begin_turn, #release_turn); the idle
   # scheduler, the bridge's request threads, plugin threads and the UIs
@@ -24,6 +25,8 @@ module Samagotchi
       @sink = nil
       @thread = nil
       @ended = false
+      @input_waiting = nil
+      @input_waiting_warned = false
       @steers = []
       @carried_steers = []
     end
@@ -67,20 +70,24 @@ module Samagotchi
     end
 
     # A turn begins, on the calling thread (the turn's own): running, with
-    # its controller and sink, in one step.
-    def begin!(controller:, sink:)
+    # its controller, sink and input_waiting probe, in one step.
+    # @param input_waiting [#call, nil] true while a person's message waits
+    #   for the turn's next boundary (Engine#input_waiting?); nil: never
+    def begin!(controller:, sink:, input_waiting: nil)
       @lock.synchronize do
         @running = true
         @controller = controller
         @sink = sink
         @thread = Thread.current
         @ended = false
+        @input_waiting = input_waiting
+        @input_waiting_warned = false
         @steers.concat(@carried_steers)
         @carried_steers = []
       end
     end
 
-    # The turn is over: not running, no controller, sink or steers.
+    # The turn is over: not running, no controller, sink, probe or steers.
     # @return [Array<Hash>] the steers it never took ({text:, source:})
     def finish!
       @lock.synchronize do
@@ -89,6 +96,7 @@ module Samagotchi
         @sink = nil
         @thread = nil
         @ended = false
+        @input_waiting = nil
         @steers.tap { @steers = [] }
       end
     end
@@ -118,6 +126,17 @@ module Samagotchi
       end
     end
 
+    # @return [#call, nil] the running turn's input_waiting probe (called
+    #   outside the lock), nil outside a turn or for a turn given none
+    def input_waiting
+      @lock.synchronize { @running ? @input_waiting : nil }
+    end
+
+    # A probe failed: true the first time in a turn (warn then), false after.
+    def input_waiting_failed!
+      @lock.synchronize { !@input_waiting_warned.tap { @input_waiting_warned = true } }
+    end
+
     # Cancel the running turn, if any (outside the lock).
     # @return [Boolean] whether a cancellation was triggered
     def cancel!(reason)

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.129.0"
+  VERSION = "0.130.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -459,12 +459,14 @@ module Samagotchi
       # The request's Principal, as #route resolved it.
       def principal(req) = req.env.fetch(PRINCIPAL_ENV)
 
-      # LAN mode, a peer that isn't this machine (the peer is the socket's
-      # address, REMOTE_ADDR: never X-Forwarded-For or req.ip, which trust
-      # headers a phone could send): every route needs the access token, as
-      # the chi_token cookie or an Authorization: Bearer header. The page
-      # with ?token= trades it for the cookie and a 303 to itself without
-      # it, so the token doesn't stay in the phone's history.
+      # LAN mode: every route needs the access token, from a phone and from
+      # this machine's loopback too (a pair participant's shell runs here),
+      # as the chi_token cookie or an Authorization: Bearer header; only
+      # GATE_FREE_PATHS and chi's token-less /api/info probe
+      # (ProxyGate#probe_info?) are answered without it. The page with
+      # ?token= (or a link's #code=, POST /api/token) trades it for the
+      # cookie and a 303 to itself without it, so the token doesn't stay in
+      # the browser's history.
       # @return [Array(Principal, nil), Array(nil, Array)] the request's
       #   principal (#principal_for), or the response that refuses it
       def token_gate(req)
@@ -489,9 +491,9 @@ module Samagotchi
       # the access token; a participant for a live grant's token (a chp_
       # one, looked up only when no owner token was given), wherever the
       # request comes from, this machine's loopback too; with neither, the
-      # owner for a peer the gate doesn't ask (no LAN mode, or this
-      # machine's loopback), else nil. An ended or unknown grant's token is
-      # nil anywhere: it never falls back to the owner.
+      # owner only on a chi web that asks no token (loopback only: no LAN
+      # mode, no web.public_url), else nil. An ended or unknown grant's
+      # token is nil anywhere: it never falls back to the owner.
       # @return [Principal, nil]
       # With web.public_url (ProxyGate) every request needs a token, and a
       # proxied one is #proxied_principal's.
@@ -595,11 +597,10 @@ module Samagotchi
         "#{token_cookie_name(req)}=; #{token_cookie_attributes(req).sub(/Max-Age=\d+/, "Max-Age=0")}"
       end
 
-      def token_required?(req)
-        return true if @public_url
-
-        @lan && !LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s)
-      end
+      # Whether the gate asks this request for a token: on a chi web on the
+      # LAN or behind a proxy, every request does, this machine's loopback
+      # too. Only a loopback-only chi web takes loopback as the owner.
+      def token_required?(_req) = !(@public_url || @lan).nil?
 
       # The page opened with ?token= (a gated request, or a grant's token
       # anywhere): its token is traded for the cookie, whatever else the
@@ -903,7 +904,11 @@ module Samagotchi
 
       def unauthorized_detail(req, reason)
         return "chi web behind the proxy: #{reason || "needs its access token"}" if proxied?(req)
-        return "chi web on the LAN needs its access token" unless @public_url
+
+        unless @public_url
+          here = LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s)
+          return "chi web on the LAN needs its access token#{", on this machine too" if here}"
+        end
 
         detail = "chi web with web.public_url needs its access token, on this machine too"
         direct_public?(req) ? "#{detail}; open its public address #{@public_url.origin}/ instead" : detail
@@ -941,7 +946,7 @@ module Samagotchi
       # the proxy too.
       def self.public_unauthorized_page(page)
         page.sub('<form method="get" action="/">', '<form method="post" action="/api/token">')
-            .sub("Open the link chi web printed in its terminal (LAN, or Proxied behind an\nauth proxy), or scan its QR code.",
+            .sub("Open the link chi web printed in its terminal (Local on this machine, LAN, or\nProxied behind an auth proxy), or scan its QR code.",
                  "Open the Proxied link chi web printed in its terminal (it works once; chi web again prints a new " \
                  "one), or paste the token from its web-token file.")
       end
@@ -961,8 +966,8 @@ module Samagotchi
         </style></head>
         <body>
         <h1>chi web</h1>
-        <p>This page needs chi web's access token. Open the link chi web printed in its terminal (LAN, or Proxied behind an
-        auth proxy), or scan its QR code.</p>
+        <p>This page needs chi web's access token. Open the link chi web printed in its terminal (Local on this machine, LAN, or
+        Proxied behind an auth proxy), or scan its QR code.</p>
         <p id="trade" hidden></p>
         <form method="get" action="/">
           <label for="token">Or paste the token:</label>

data/lib/samagotchi/web/proxy_gate.rb

@@ -124,13 +124,15 @@ module Samagotchi
         participant_principal(req, grant_tokens, identity: identity, proxied: true)
       end
 
-      # chi's own probe of a chi web behind a proxy (InfoProbe: a second chi
-      # web, chi share, chi update) sends no token: GET /api/info from this
+      # chi's own probe of a chi web that asks this machine for its token
+      # (behind a proxy, or on the LAN: InfoProbe from a second chi web, chi
+      # share, chi update, chi self) sends no token: GET /api/info from this
       # machine, not through the proxy, with no token at all, gets the
-      # fields it checks (nothing secret), so no probe ever hands the token
-      # to whatever listens on the port.
+      # fields it checks (nothing secret: its start folder is a path on this
+      # machine), so no probe ever hands the token to whatever listens on
+      # the port. Any token or cookie makes it an ordinary request.
       def probe_info?(req)
-        return false unless @public_url && req.get? && req.path_info == "/api/info"
+        return false unless (@public_url || @lan) && req.get? && req.path_info == "/api/info"
         return false unless App::LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s) && !proxied?(req)
 
         req.get_header("HTTP_AUTHORIZATION").nil? && req.get_header("HTTP_COOKIE").nil?
@@ -138,7 +140,7 @@ module Samagotchi
 
       def probe_info
         json_response(200, { app: "chi-web", version: Samagotchi::VERSION, pid: Process.pid, features: App::INFO_FEATURES,
-                             lan: @lan && @lan[:ip] })
+                             lan: @lan && @lan[:ip], start_dir: start_dir })
       end
 
       def proxy_refuse(req, reason)

data/lib/samagotchi/web/server.rb

@@ -118,11 +118,15 @@ module Samagotchi
           puts "chi web already runs on port #{port} (pid #{found["pid"]}): #{url}"
           other_start = start_given && other_start_line(found["start_dir"], start_dir)
           puts other_start if other_start
-          puts running_lan_lines(found["lan"], port) if found["lan"]
           running_public = public_url || Running.live_public_url(probe: ->(at) { probe(host, at) })
+          # On the LAN this machine's page needs the token too: the link
+          # printed and opened here carries an owner's one-time code.
+          here = found["lan"] && !running_public && Token.read(Token.path) ? local_owner_link(url) : nil
+          puts local_lines(here) if here
+          puts running_lan_lines(found["lan"], port) if found["lan"]
           puts running_public_lines(running_public) if running_public
           puts lan_off_line(setting) if new_token && !found["lan"]
-          open_url(url) if open_browser
+          open_url(here ? local_owner_link(url) : url) if open_browser
           0
         when :other
           warn in_use_message(port)
@@ -388,6 +392,10 @@ module Samagotchi
           on_bound&.call
           record_running(running_path, port, public_url)
           puts "Chi Web on #{url} (public: #{File.expand_path("public", __dir__)})"
+          # On the LAN (no web.public_url) this machine's page needs the
+          # token too: a one-time owner's code in the link instead.
+          local = lan && !public_url
+          puts local_lines(local_owner_link(url, codes: owner_codes(state_dir))) if local
           puts lan_lines(ip: lan.ip, port: port, token: Token.read(token_path), others: lan.others, public: lan.public) if lan
           if public_url
             puts public_lines(public_url, token: Token.read(token_path), codes: owner_codes(state_dir), notes: public_notes)
@@ -395,8 +403,12 @@ module Samagotchi
           puts "Press Ctrl-C to stop."
           $stdout.flush # a log file isn't line-buffered
           if open_browser
-            # With web.public_url the page opens through the proxy.
-            open_target = public_url ? public_url.link(owner_codes(state_dir).issue(kind: :owner, ttl: LinkCodes::OWNER_TTL)) : url
+            # With web.public_url the page opens through the proxy; on the
+            # LAN with a one-time owner's code (#code=, its own).
+            open_target = if public_url then public_url.link(owner_codes(state_dir).issue(kind: :owner, ttl: LinkCodes::OWNER_TTL))
+                          elsif local then local_owner_link(url, codes: owner_codes(state_dir))
+                          else url
+                          end
             Thread.new do
               sleep 0.8
               open_url(open_target)
@@ -518,6 +530,19 @@ module Samagotchi
         lines
       end
 
+      # This machine's page on the LAN (web.host lan, no web.public_url),
+      # whose loopback needs the token too: +url+ with an owner's one-time
+      # code in its fragment (token_fragment.js trades it for the cookie on
+      # 127.0.0.1), never the token. One code per link.
+      def self.local_owner_link(url, codes: owner_codes)
+        "#{url}#code=#{codes.issue(kind: :owner, ttl: LinkCodes::OWNER_TTL)}"
+      end
+
+      def self.local_lines(link)
+        ["Local: #{link}   ← opens chi web as you once, within #{LinkCodes::OWNER_TTL / 60} minutes " \
+         "(chi web again prints a new one; the LAN link works here too)"]
+      end
+
       # The owner's one-time link codes, next to the grants.
       def self.owner_codes(state_dir = nil) = LinkCodes.for_grants(Grants.path(state_dir: state_dir))
 

data/lib/samagotchi/worker.rb

@@ -1245,7 +1245,8 @@ module Samagotchi
         # status, its rings and every save from here on say so.
         @session.parent_id = Session.parent_override(@session_id, state_dir: @state_dir) || @session.parent_id
         save_session
-        result = @engine.run_turn(@session, prompt, pending_input: pending_input_drain, **turn_args)
+        result = @engine.run_turn(@session, prompt, pending_input: pending_input_drain, input_waiting: method(:input_waiting?),
+                                                    **turn_args)
       rescue StandardError => e
         error = e
         # Still running: no turn of the Engine's ended (it never began).
@@ -1468,6 +1469,13 @@ module Samagotchi
       end
     end
 
+    # Whether a person's message waits that the next boundary merges
+    # (SessionInbox.steer_waiting?): a running task_wait ends on it. Never
+    # in a participant's turn, whose drain merges none.
+    def input_waiting?
+      !@participant_turn && SessionInbox.steer_waiting?(@session_dir)
+    end
+
     # A participant's author fields (Engine#author_fields), {} for the owner.
     def turn_author_fields(origin)
       origin.participant? ? @engine.author_fields(origin.author, session: @session) : {}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: samagotchi
 version: !ruby/object:Gem::Version
-  version: 0.129.0
+  version: 0.130.0
 platform: ruby
 authors:
 - Dmitry Dedov
@@ -342,6 +342,7 @@ files:
 - lib/samagotchi/guardrails.rb
 - lib/samagotchi/guardrails/approval.rb
 - lib/samagotchi/guardrails/approvals.rb
+- lib/samagotchi/guardrails/chi_dirs.rb
 - lib/samagotchi/guardrails/child_boundary.rb
 - lib/samagotchi/guardrails/context.rb
 - lib/samagotchi/guardrails/data_readers.rb
@@ -354,6 +355,7 @@ files:
 - lib/samagotchi/guardrails/parent_approvals.rb
 - lib/samagotchi/guardrails/parent_levels.rb
 - lib/samagotchi/guardrails/parent_policy.rb
+- lib/samagotchi/guardrails/path_resolve.rb
 - lib/samagotchi/guardrails/protected_paths.rb
 - lib/samagotchi/guardrails/read_only_shell.rb
 - lib/samagotchi/guardrails/review_boundary.rb