samagotchi 0.129.0 → 0.130.1

data/lib/samagotchi/web/server.rb

@@ -118,11 +118,15 @@ module Samagotchi
           puts "chi web already runs on port #{port} (pid #{found["pid"]}): #{url}"
           other_start = start_given && other_start_line(found["start_dir"], start_dir)
           puts other_start if other_start
-          puts running_lan_lines(found["lan"], port) if found["lan"]
           running_public = public_url || Running.live_public_url(probe: ->(at) { probe(host, at) })
+          # On the LAN this machine's page needs the token too: the link
+          # printed and opened here carries an owner's one-time code.
+          here = found["lan"] && !running_public && Token.read(Token.path) ? local_owner_link(url) : nil
+          puts local_lines(here) if here
+          puts running_lan_lines(found["lan"], port) if found["lan"]
           puts running_public_lines(running_public) if running_public
           puts lan_off_line(setting) if new_token && !found["lan"]
-          open_url(url) if open_browser
+          open_url(here ? local_owner_link(url) : url) if open_browser
           0
         when :other
           warn in_use_message(port)
@@ -388,6 +392,10 @@ module Samagotchi
           on_bound&.call
           record_running(running_path, port, public_url)
           puts "Chi Web on #{url} (public: #{File.expand_path("public", __dir__)})"
+          # On the LAN (no web.public_url) this machine's page needs the
+          # token too: a one-time owner's code in the link instead.
+          local = lan && !public_url
+          puts local_lines(local_owner_link(url, codes: owner_codes(state_dir))) if local
           puts lan_lines(ip: lan.ip, port: port, token: Token.read(token_path), others: lan.others, public: lan.public) if lan
           if public_url
             puts public_lines(public_url, token: Token.read(token_path), codes: owner_codes(state_dir), notes: public_notes)
@@ -395,8 +403,12 @@ module Samagotchi
           puts "Press Ctrl-C to stop."
           $stdout.flush # a log file isn't line-buffered
           if open_browser
-            # With web.public_url the page opens through the proxy.
-            open_target = public_url ? public_url.link(owner_codes(state_dir).issue(kind: :owner, ttl: LinkCodes::OWNER_TTL)) : url
+            # With web.public_url the page opens through the proxy; on the
+            # LAN with a one-time owner's code (#code=, its own).
+            open_target = if public_url then public_url.link(owner_codes(state_dir).issue(kind: :owner, ttl: LinkCodes::OWNER_TTL))
+                          elsif local then local_owner_link(url, codes: owner_codes(state_dir))
+                          else url
+                          end
             Thread.new do
               sleep 0.8
               open_url(open_target)
@@ -518,6 +530,19 @@ module Samagotchi
         lines
       end
 
+      # This machine's page on the LAN (web.host lan, no web.public_url),
+      # whose loopback needs the token too: +url+ with an owner's one-time
+      # code in its fragment (token_fragment.js trades it for the cookie on
+      # 127.0.0.1), never the token. One code per link.
+      def self.local_owner_link(url, codes: owner_codes)
+        "#{url}#code=#{codes.issue(kind: :owner, ttl: LinkCodes::OWNER_TTL)}"
+      end
+
+      def self.local_lines(link)
+        ["Local: #{link}   ← opens chi web as you once, within #{LinkCodes::OWNER_TTL / 60} minutes " \
+         "(chi web again prints a new one; the LAN link works here too)"]
+      end
+
       # The owner's one-time link codes, next to the grants.
       def self.owner_codes(state_dir = nil) = LinkCodes.for_grants(Grants.path(state_dir: state_dir))
 

data/lib/samagotchi/web/token.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "fileutils"
+require "openssl"
 require "securerandom"
 require_relative "../atomic_file"
 
@@ -14,11 +15,15 @@ module Samagotchi
     # can read, $XDG_STATE_HOME/samagotchi/web-token (0600). It is made on
     # the first LAN start and kept, so a phone's bookmark survives
     # restarts; `chi web --new-token` replaces it. A loopback-only chi web
-    # never reads it.
+    # never reads it. The owner's cookie for this machine's 127.0.0.1
+    # holds #loopback_cookie, never the token: a server on any other local
+    # port is sent that cookie too.
     module Token
       FILE = "web-token"
       # 32 random bytes: 43 URL-safe characters.
       BYTES = 32
+      LOOPBACK_PREFIX = "chl_"
+      LOOPBACK_LABEL = "chi web loopback cookie v1"
 
       module_function
 
@@ -49,6 +54,20 @@ module Samagotchi
         SecureRandom.urlsafe_base64(BYTES)
       end
 
+      # The owner's 127.0.0.1 cookie on the LAN: an HMAC of a label keyed
+      # by +token+, so a leaked one gives nothing about the token, and
+      # rotating the token ends it. The gate takes it only as that cookie,
+      # from an unproxied loopback peer (App#loopback_cookie_peer?).
+      # @return [String, nil] "chl_" and 43 URL-safe characters; nil
+      #   without a token
+      def loopback_cookie(token)
+        return nil if token.nil? || token.empty?
+
+        # URL-safe base64 without padding (pack: base64 isn't a default gem).
+        digest = OpenSSL::HMAC.digest("SHA256", token, LOOPBACK_LABEL)
+        LOOPBACK_PREFIX + [digest].pack("m0").tr("+/", "-_").delete("=")
+      end
+
       # Written whole under a temporary name, then renamed over +path+: a
       # reader never sees half a token. The file is 0600 from the start,
       # its folder 0700 when this makes it.

data/lib/samagotchi/worker.rb

@@ -251,6 +251,13 @@ module Samagotchi
       ChildMove.clear_starting(@session_id, state_dir: @state_dir)
       ChildMove.adopt(@session_id, state_dir: @state_dir)
       @session = Session.load(@session_id, state_dir: @state_dir)
+      # A newer chi saved it: this worker keeps the fields it doesn't know
+      # but runs the session without them (docs/sessions.md).
+      if @session.newer_writer?
+        unknown = @session.extra_fields.keys.join(",")
+        Log.warn(:worker, "newer_writer", sid: @session_id, version: VERSION, written_by: @session.written_by,
+                                          unknown_fields: (unknown unless unknown.empty?))
+      end
       drop_dead_question
       # The running turn, on disk at its iteration boundaries.
       @checkpoint = TurnCheckpoint.new(session: @session, state_dir: @state_dir)
@@ -1245,7 +1252,8 @@ module Samagotchi
         # status, its rings and every save from here on say so.
         @session.parent_id = Session.parent_override(@session_id, state_dir: @state_dir) || @session.parent_id
         save_session
-        result = @engine.run_turn(@session, prompt, pending_input: pending_input_drain, **turn_args)
+        result = @engine.run_turn(@session, prompt, pending_input: pending_input_drain, input_waiting: method(:input_waiting?),
+                                                    **turn_args)
       rescue StandardError => e
         error = e
         # Still running: no turn of the Engine's ended (it never began).
@@ -1468,6 +1476,13 @@ module Samagotchi
       end
     end
 
+    # Whether a person's message waits that the next boundary merges
+    # (SessionInbox.steer_waiting?): a running task_wait ends on it. Never
+    # in a participant's turn, whose drain merges none.
+    def input_waiting?
+      !@participant_turn && SessionInbox.steer_waiting?(@session_dir)
+    end
+
     # A participant's author fields (Engine#author_fields), {} for the owner.
     def turn_author_fields(origin)
       origin.participant? ? @engine.author_fields(origin.author, session: @session) : {}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: samagotchi
 version: !ruby/object:Gem::Version
-  version: 0.129.0
+  version: 0.130.1
 platform: ruby
 authors:
 - Dmitry Dedov
@@ -342,6 +342,7 @@ files:
 - lib/samagotchi/guardrails.rb
 - lib/samagotchi/guardrails/approval.rb
 - lib/samagotchi/guardrails/approvals.rb
+- lib/samagotchi/guardrails/chi_dirs.rb
 - lib/samagotchi/guardrails/child_boundary.rb
 - lib/samagotchi/guardrails/context.rb
 - lib/samagotchi/guardrails/data_readers.rb
@@ -354,6 +355,7 @@ files:
 - lib/samagotchi/guardrails/parent_approvals.rb
 - lib/samagotchi/guardrails/parent_levels.rb
 - lib/samagotchi/guardrails/parent_policy.rb
+- lib/samagotchi/guardrails/path_resolve.rb
 - lib/samagotchi/guardrails/protected_paths.rb
 - lib/samagotchi/guardrails/read_only_shell.rb
 - lib/samagotchi/guardrails/review_boundary.rb