samagotchi 0.131.0 → 0.133.0

data/lib/samagotchi/desktop/macos.rb

@@ -9,6 +9,7 @@ require "rbconfig"
 require_relative "../atomic_file"
 require_relative "../version"
 require_relative "../self_report"
+require_relative "../chi_home"
 require_relative "../installed_gem"
 require_relative "../config"
 require_relative "../host_keys"
@@ -41,9 +42,16 @@ module Samagotchi
       BUILD_NAME = ".chi-helper-build"
       OLD_NAME = ".chi-helper-old"
       # Apps started by launchd get a bare env (no shell rc files), so the
-      # launch file carries what chi needs to find its gems, state and tools.
-      # Only these, and only when set: no tokens, no runtime knobs.
-      ENV_ALLOWLIST = %w[XDG_CONFIG_HOME XDG_STATE_HOME GEM_HOME GEM_PATH RUBYLIB].freeze
+      # launch file carries what chi needs to find its state and tools.
+      # Only these, and only when set: no tokens, no runtime knobs. No
+      # RUBYLIB, and GEM_HOME/GEM_PATH (GEM_ENV) only for a [ruby, chi]
+      # argv, whose wrapper may find its gem only through them (a chruby
+      # GEM_HOME): the chi home's boot sets its gem path itself, and they
+      # would reach every tool its sessions run (a project's `bundle exec`).
+      ENV_ALLOWLIST = %w[XDG_CONFIG_HOME XDG_STATE_HOME].freeze
+      GEM_ENV = %w[GEM_HOME GEM_PATH].freeze
+      # What older launch files carried and a refresh drops (#refresh_launch_file).
+      DROPPED_ENV = %w[GEM_HOME GEM_PATH RUBYLIB].freeze
       # PATH is separately filtered to absolute dirs and frozen when written,
       # so the helper's chi, workers and execute can find the shell's tools.
       # Without it Ruby reads stdin as US-ASCII and non-ASCII notes break.
@@ -131,7 +139,7 @@ module Samagotchi
       def initialize(app_dir: nil, support_dir: nil, env: ENV, runner: Runner.new,
                      source_dir: SelfReport::SOURCE_DIR, ruby: RbConfig.ruby, version: VERSION,
                      arch: nil, sources_dir: SOURCES_DIR, register: true, chi_path: nil, terminals: {},
-                     broadcast_timeout: nil)
+                     broadcast_timeout: nil, chi_home: ChiHome.current(gem_spec: InstalledGem.spec(source_dir)))
         home = env["HOME"] || Dir.home
         @app_dir = app_dir || File.join(home, "Applications")
         @support_dir = support_dir || File.join(home, "Library", "Application Support", APP_NAME)
@@ -146,6 +154,7 @@ module Samagotchi
         @register = register
         @terminals = terminals
         @broadcast_timeout = broadcast_timeout
+        @chi_home = chi_home
       end
 
       def app_path = File.join(@app_dir, "#{APP_NAME}.app")
@@ -155,10 +164,12 @@ module Samagotchi
       def executable_path = File.join(app_path, "Contents", "MacOS", EXECUTABLE)
       def installed? = File.directory?(app_path)
 
-      # What the helper runs: absolute ruby + chi (no shims, which need the
-      # shell's PATH), and the allowlisted env. chi is an installed gem's
-      # RubyGems wrapper (it activates the gem and outlives upgrades and
-      # `gem cleanup`), else this checkout's bin/chi. A section per terminal
+      # What the helper runs: the chi home's boot (ChiHome: its ruby, its gem
+      # path in the -e string, then "--" and the helper's args) when there
+      # is one; else absolute ruby + chi (no shims, which need the shell's
+      # PATH). chi is an installed gem's RubyGems wrapper (it activates the
+      # gem and outlives upgrades and `gem cleanup`), else this checkout's
+      # bin/chi. And the allowlisted env. A section per terminal
       # switched on (TERMINALS order); the broadcast timeout when given.
       # The XDG dirs go in absolute (Paths): launchd starts the app in /,
       # where a relative one would mean /<dir>. PATH is filtered to absolute,
@@ -166,16 +177,22 @@ module Samagotchi
       # it is frozen at bake time.
       def launch_config
         env = { "LANG" => LANG }
-        ENV_ALLOWLIST.each { |name| env[name] = @env[name] unless @env[name].to_s.empty? }
+        argv = launch_argv
+        names = home_boot?(argv) ? ENV_ALLOWLIST : ENV_ALLOWLIST + GEM_ENV
+        names.each { |name| env[name] = @env[name] unless @env[name].to_s.empty? }
         path = self.class.baked_path(@env)
         env["PATH"] = path if path
         env.merge!(Paths.absolute_xdg(env: env, set: :key))
-        config = { "version" => @version, "argv" => [@ruby, @chi_path], "env" => env, "sources_sha" => sources_sha }
+        config = { "version" => @version, "argv" => argv, "env" => env, "sources_sha" => sources_sha }
         TERMINALS.each { |name| config[name] = @terminals[name] if @terminals[name] }
         config["broadcast_timeout"] = @broadcast_timeout if @broadcast_timeout
         config
       end
 
+      def launch_argv
+        @chi_home ? @chi_home.boot_argv(run: ChiHome::CHI_BOOT) + ["--"] : [@ruby, @chi_path]
+      end
+
       # A digest of what a build compiles: the Swift sources and the
       # Info.plist template. The launch file records the one it was built
       # from, so a new chi rebuilds only when these changed.
@@ -209,13 +226,37 @@ module Samagotchi
 
       # Why chi update can't keep the launch file's ruby or chi: one of them
       # is gone. nil when it runs, or has no usable argv (a refresh writes
-      # this chi's then).
+      # this chi's then). Only the absolute paths in it count (a boot
+      # string, "-e" and "--" are not paths), as ChiRunner.swift checks.
       def launch_problem
         argv = usable_argv(read_launch)
-        missing = Array(argv).reject { |path| File.exist?(path) }
-        return nil if missing.empty?
+        argv && argv_problem(argv)
+      end
+
+      # Why the launch file doesn't boot +home+ (chi home doctor), or nil:
+      # it runs [ruby, chi] (installed before the home), boots another Ruby
+      # or gem path (the home was set since), or bakes GEM_HOME/GEM_PATH
+      # under the home's boot. Each fixed by chi desktop upgrade. nil without
+      # a launch file.
+      # @param home [ChiHome::Record]
+      # @return [String, nil]
+      def home_problem(home)
+        launch = read_launch
+        argv = usable_argv(launch)
+        return nil unless argv
+
+        unless home_boot?(argv)
+          return "the desktop helper runs #{argv.first(2).join(" ")}, not the chi home's boot: chi desktop upgrade"
+        end
+        unless ChiHome.real(argv[0]) == ChiHome.real(home.ruby) && argv[2].to_s.start_with?("#{home.prelude};")
+          return "the desktop helper boots the chi home as it was (#{argv[0]}), not as it is now: chi desktop upgrade"
+        end
+
+        env = launch["env"]
+        baked = env.is_a?(Hash) ? GEM_ENV.select { |key| env.key?(key) } : []
+        return nil if baked.empty?
 
-        "chi not found at #{missing.join(", ")}: run chi desktop install --force from the shell whose chi it should run"
+        "the desktop helper's launch file sets #{baked.join(", ")} for its sessions' tools: chi desktop upgrade"
       end
 
       # The chi version the launch file names, nil without one.
@@ -232,7 +273,10 @@ module Samagotchi
       # Rewrite the launch file for this chi and its settings, keeping
       # its argv and the env it was installed with; a PATH only when it has
       # none (changing them takes chi desktop install --force or upgrade). A
-      # newer version stays. The app reads it at each send.
+      # newer version stays. The app reads it at each send. The kept env
+      # loses what ENV_ALLOWLIST no longer takes (DROPPED_ENV): RUBYLIB
+      # always; GEM_HOME/GEM_PATH once the argv boots the chi home (an old
+      # [ruby, wrapper] argv may find its gem only through them).
       def refresh_launch_file
         config = launch_config
         old = read_launch
@@ -240,7 +284,8 @@ module Samagotchi
         config["version"] = old["version"] unless older_version?(old["version"])
         old_env = old["env"]
         if old_env.is_a?(Hash)
-          config["env"] = old_env
+          dropped = home_boot?(config["argv"]) ? DROPPED_ENV : DROPPED_ENV - GEM_ENV
+          config["env"] = old_env.except(*dropped)
           path = self.class.baked_path(@env)
           config["env"]["PATH"] = path if config["env"]["PATH"].to_s.empty? && path
         end
@@ -466,11 +511,41 @@ module Samagotchi
         !env.is_a?(Hash) || env["PATH"].to_s.empty?
       end
 
+      # A launch file whose argv runs (#argv_problem finds nothing).
       def launch_ok?(launch)
-        argv = Array(launch["argv"])
-        !argv.empty? && argv.all? { |path| File.exist?(path) }
+        argv = usable_argv(launch)
+        !argv.nil? && argv_problem(argv).nil?
       end
 
+      # Why a launch argv (strings) can't run chi, or nil: its ruby isn't an
+      # absolute path, an absolute path in it is gone, or it boots the chi
+      # home (home.json's ruby) and the home can't boot chi
+      # (ChiHome.problem).
+      def argv_problem(argv)
+        return "the launch file's ruby #{argv[0]} isn't an absolute path: run chi desktop install --force" unless argv[0].start_with?("/")
+
+        missing = launch_paths(argv).reject { |path| File.exist?(path) }
+        unless missing.empty?
+          return "chi not found at #{missing.join(", ")}: run chi desktop install --force from the shell whose chi it should run"
+        end
+        return nil unless home_boot?(argv)
+
+        home = begin
+          ChiHome.read
+        rescue ChiHome::Invalid
+          nil
+        end
+        why = home && ChiHome.real(home.ruby) == ChiHome.real(argv[0]) && ChiHome.problem(home)
+        why ? "the chi home it boots can't run chi (#{why}): chi home doctor" : nil
+      end
+
+      # The argv entries that are paths (absolute): a boot's "-e", its
+      # string and "--" are not.
+      def launch_paths(argv) = Array(argv).select { |arg| arg.is_a?(String) && arg.start_with?("/") }
+
+      # An argv in the chi home's boot form ([ruby, "-e", boot, "--"]).
+      def home_boot?(argv) = argv.is_a?(Array) && argv[1] == "-e"
+
       def write_launch_file(config = launch_config, keep_launch: false)
         if keep_launch
           old = read_launch
@@ -478,6 +553,13 @@ module Samagotchi
           old_env = old["env"]
           old_path = old_env["PATH"] if old_env.is_a?(Hash)
           config["env"]["PATH"] = old_path unless old_path.to_s.empty?
+          # A kept [ruby, wrapper] argv keeps the GEM_* its gem was found
+          # through; a kept home boot takes none.
+          if home_boot?(config["argv"])
+            config["env"] = config["env"].except(*GEM_ENV)
+          elsif old_env.is_a?(Hash)
+            config["env"].merge!(old_env.slice(*GEM_ENV))
+          end
         end
         FileUtils.mkdir_p(@support_dir)
         AtomicFile.write(launch_path, JSON.pretty_generate(config) + "\n")

data/lib/samagotchi/engine.rb

@@ -319,6 +319,9 @@ module Samagotchi
       # The context sources the peer bundles declare as a peer agent's
       # answers (chi.peer_source); the worker's ContextAbsorber asks it.
       @peer_sources = PeerSources.new
+      # The system-prompt text plugins add (chi.prompt_section), run when
+      # the prompt is built (#build_system_prompt's sections:).
+      @prompt_sections = Plugin::PromptSections.new
       load_plugins if load
       # Registered from what the sources published while they loaded, and
       # with no plugins too: a toolkit's left-out built-ins are reachable
@@ -527,7 +530,8 @@ module Samagotchi
                        thinking: -> { turn_thinking }, model: -> { model_identity },
                        model_notes: -> { model_notes }, memories: memories,
                        muted_memory_names: @muted_memory_names, appended_files: appended_prompt_files,
-                       participants: -> { @participants_line })
+                       participants: -> { @participants_line },
+                       sections: -> { @prompt_sections ? @prompt_sections.render(@session&.id) : [] })
     end
     private :build_system_prompt
 
@@ -832,6 +836,13 @@ module Samagotchi
       @host_registry.model_ref(name).ref
     end
 
+    # The ref #switch_model! would switch +model_name+ to, checked the way it
+    # checks one (UnknownHost, MissingModel), without switching.
+    # @return [String]
+    def model_switch_ref(model_name)
+      model_ref_for(ModelProfile.check_host!(ModelProfile.required_model_name(model_name), hosts: @host_registry.entries))
+    end
+
     # Writes the effective model to +session+: the resolved ref, and the
     # name as typed when that differs (model_typed: an alias, for the
     # models: lookup after a resume).
@@ -1304,7 +1315,7 @@ module Samagotchi
     # the saved context's status: SessionModelSettings' (resolved on every
     # read); these forward.
     def saved_context_status(context, model: :current) = @model_settings.saved_context_status(context, model: model)
-    def llm_context_explained = @model_settings.llm_context_explained
+    def llm_context_explained(own: :session) = @model_settings.llm_context_explained(own: own)
     def llm_context_summary = @model_settings.llm_context_summary
     def llm_context_override = @model_settings.llm_context_override
     def chat_model? = @model_settings.chat_model?
@@ -2827,7 +2838,9 @@ module Samagotchi
         },
         toolkits: @toolkit_binding.plugin_kits,
         tool_index: @tool_index,
-        peer_sources: @peer_sources
+        peer_sources: @peer_sources,
+        prompt_sections: @prompt_sections,
+        prompt_changed: -> { prompt_changed! }
       )
       # What plugins show while they load (an MCP server that didn't
       # start) waits for the first turn, beside the load warnings: no UI
@@ -3144,8 +3157,18 @@ module Samagotchi
     # The tools changed (a plugin's chi.tools_changed!): the system prompts,
     # which declare them, are built again on the next turn.
     def tools_changed!
+      prompt_changed!
+    end
+
+    # A plugin's prompt section would give other text now
+    # (chi.prompt_changed!): the system prompts are built again at their
+    # next build (the next turn's start; a running turn keeps the prompt it
+    # started with). One cache restart: the plugin's command asked first
+    # (Plugin::Context#cache_confirm).
+    def prompt_changed!
       @prompt_builder&.reset!
     end
+    public :prompt_changed!
 
     # What a Plugin::Context reads and calls: the session now, and the
     # hook runtime's notify and ask_user.
@@ -3176,6 +3199,12 @@ module Samagotchi
         },
         model_name: -> { effective_model_ref },
         model_key: -> { @model_binding.model_key },
+        # The names a models: map looks the model up under; [] when it doesn't resolve.
+        model_names: lambda do
+          effective_model.names
+        rescue StandardError
+          []
+        end,
         state_dir: -> { session_state_dir },
         scratch: -> { @scratch },
         setup: -> { SessionSetup.of(@session) },
@@ -3186,7 +3215,9 @@ module Samagotchi
         frontend: -> { interface },
         cost: -> { @metrics.cost },
         usage: -> { @metrics.usage },
-        turn_author: -> { turn_author }
+        turn_author: -> { turn_author },
+        # A plugin's prompt section is in the stable part: a full re-read.
+        cache_confirm: ->(line, changed) { CacheConfirm.ask(line: line, cost: :full, changed: changed, engine: self) }
       )
     end
 

data/lib/samagotchi/engine_snapshots.rb

@@ -62,6 +62,8 @@ module Samagotchi
     # price_host: the effective model's host, whose hosts.<name>.models
     # prices the cost estimate names. kit_prompt: the next turn's kit
     # prompt text ({kit:, tokens:}), only when its toolkit has one.
+    # prompt_sections: the plugins' sections the built prompt holds, only
+    # when it holds some.
     # settings: the session's own settings ({"recap.enabled" => false}),
     # only when it has some.
     # @return [Hash] @metrics.snapshot, filled in
@@ -78,6 +80,9 @@ module Samagotchi
                                 price_host: model.host_name)
       kit_prompt = kit_prompt_stats
       snapshot = snapshot.merge(kit_prompt: kit_prompt) if kit_prompt
+      # The plugins' prompt sections the built prompt holds ({bundle:, name:}).
+      sections = prompt_builder.prompt_sections.map(&:to_stats)
+      snapshot = snapshot.merge(prompt_sections: sections) unless sections.empty?
       # Each participant's spend under their name (participants.json's).
       if (spend = snapshot[:spend_by_author])
         named = spend.to_h { |author, row| [author, row.merge(name: participants.name_for(author, session: session))] }

data/lib/samagotchi/gem_update.rb

@@ -6,13 +6,15 @@ require "open3"
 require "rbconfig"
 require "rubygems/package"
 require "time"
+require_relative "chi_home"
 require_relative "version"
 require_relative "redacted_inspect"
 
 module Samagotchi
   # The gem part of `chi update`: the newest samagotchi on rubygems, and a
-  # `gem install` of it through this Ruby's own gem command (the real
-  # interpreter's bindir, not a shim: the same under mise, rbenv and asdf).
+  # `gem install` of it through the chi home's gem command, else this
+  # Ruby's own (the real interpreter's bindir, not a shim: the same under
+  # mise, rbenv and asdf).
   #
   # SAMAGOTCHI_UPDATE_GEM_FILE=<path to a .gem> (hidden, for smokes) makes that
   # file the newest version and installs it instead.
@@ -32,26 +34,31 @@ module Samagotchi
     Latest = Struct.new(:version, :source, keyword_init: true)
     Release = Data.define(:version, :created_at, :prerelease)
 
-    # Runs a command without a shell; [output, success].
+    # Runs a command without a shell; [output, success]. +env+ is merged
+    # into the inherited one (nil unsets a key).
     class Runner
-      def run(argv)
-        output, status = Open3.capture2e(*argv)
+      def run(argv, env: {})
+        output, status = Open3.capture2e(env, *argv)
         [output, status.success?]
       rescue SystemCallError => e
         [e.message, false]
       end
     end
 
-    # This Ruby's own gem command (chi bootstrap installs commonmarker with
-    # it too).
-    def self.gem_bin = File.join(RbConfig::CONFIG["bindir"], "gem")
+    # The gem command an install runs: the chi home's (ChiHome.gem_bin),
+    # else this Ruby's own (chi bootstrap installs commonmarker with it too).
+    def self.gem_bin = ChiHome.gem_bin
 
     # @param fetcher [#call, nil] → the latest.json body (specs)
-    def initialize(env: ENV, fetcher: nil, runner: Runner.new, gem_bin: GemUpdate.gem_bin)
+    # @param install_env [Hash] the install child's env on top of this
+    #   process's (ChiHome.install_env: into the home's gems)
+    def initialize(env: ENV, fetcher: nil, runner: Runner.new, gem_bin: GemUpdate.gem_bin,
+                   install_env: ChiHome.install_env)
       @env = env
       @fetcher = fetcher || method(:fetch)
       @runner = runner
       @gem_bin = gem_bin
+      @install_env = install_env
     end
 
     # @return [Latest]
@@ -104,7 +111,9 @@ module Samagotchi
 
     # @return [Array(String, Boolean)] gem's output, success
     def install(latest)
-      @runner.run(install_argv(latest))
+      return @runner.run(install_argv(latest)) if @install_env.empty?
+
+      @runner.run(install_argv(latest), env: @install_env)
     end
 
     private

data/lib/samagotchi/guardrail_wiring.rb

@@ -265,12 +265,14 @@ module Samagotchi
       @protected ||= begin
         require_relative "memory_bundle/provenance"
         require_relative "context_sources"
+        require_relative "chi_home"
         Guardrails::ProtectedPaths.new(
           store_dir: File.dirname(@approvals.path),
           bundles_dir: MemoryBundle::Provenance.bundles_dir,
           config_path: Samagotchi::ConfigFile.global_path,
           hooks_dir: Hooks::Loader.hooks_dir,
-          context_dir: ContextSources.root
+          context_dir: ContextSources.root,
+          home_path: ChiHome.path
         )
       end
     end

data/lib/samagotchi/guardrails/pair_boundary.rb

@@ -79,6 +79,10 @@ module Samagotchi
              "approves it"
       GIT_CONFIG = "a participant's turn can't change git's global config or set what makes git run a command " \
                    "(core.hooksPath, core.fsmonitor, core.sshCommand, core.pager, core.editor, ! aliases)"
+      ENV_LOADER = "a participant's turn runs mise or direnv: they load the project's env files (a mise.local.toml, " \
+                   "an .envrc), which may hold the owner's secrets, so the owner approves it"
+      MISE_CONFIG = "a participant's turn changes mise's config: the owner's next worker start runs it (its [env] " \
+                    "can run commands), so the owner approves it"
       GIT_HOOKS = "a participant's turn can't write git's hooks (.git/hooks): git runs them in the owner's name"
       # chi web on loopback asks the owner's token too (Web::App#token_gate,
       # LAN mode); this text check stays as defense in depth: a loopback-only
@@ -127,7 +131,8 @@ module Samagotchi
         ParentApprovals::CHI_TEXT,
         %r{\.local/state/samagotchi|web-grants|grants\.json|web-token},
         %r{(?:\A|[\s/'"=])\.(?:ssh|gnupg|aws|kube|docker)(?![\w.-])},
-        %r{(?:\A|[\s/'"=])(?:\.env(?:\.[\w.-]*)?|[._]netrc|\.npmrc|\.pypirc|\.git-credentials)(?![\w-])},
+        %r{(?:\A|[\s/'"=])(?:\.env(?:\.[\w.-]*)?|\.envrc|\.?mise(?:\.[\w-]+)?\.local\.toml|(?:\.config/mise|\.?mise)/config(?:\.[\w-]+)?\.local\.toml|[._]netrc|\.npmrc|\.pypirc|
+           \.git-credentials)(?![\w-])}x,
         /\bid_(?:rsa|dsa|ecdsa|ed25519)\b|credentials|\.(?:pem|p12|pfx|tfstate)\b/
       )
 
@@ -187,16 +192,30 @@ module Samagotchi
       end
 
       # Why the owner is asked (fresh, once): a command that makes a link
-      # (LINK), a write that may land outside the project (OUTSIDE_WRITE, or
+      # (LINK), one that runs mise or direnv (ENV_LOADER), a write to mise's
+      # config (MISE_CONFIG), a write that may land outside the project (OUTSIDE_WRITE, or
       # NO_PROJECT without one); nil when nothing asks.
       def ask_reason(verdict)
         targets = verdict.targets
         return LINK if targets&.command && command(targets, nil).links?
+        return ENV_LOADER if targets&.command && command(targets, nil).loads_env?
+        return MISE_CONFIG if mise_config_write?(verdict)
         return nil unless outside_write?(verdict)
 
         project_root ? OUTSIDE_WRITE : NO_PROJECT
       end
 
+      # A write or edit of a mise config file (PairCommand.mise_config?), or a
+      # command that writes or names one (PairCommand#mise_config_write?).
+      def mise_config_write?(verdict)
+        targets = verdict.targets
+        return false unless targets
+        return command(targets, nil).mise_config_write? if targets.command
+        return false unless WRITE_TOOLS.include?(verdict.call&.dig(:name).to_s)
+
+        targets.paths.to_a.compact.any? { |path| PairCommand.mise_config?(File.expand_path(path, targets.cwd || Dir.pwd)) }
+      end
+
       # A write or edit whose path may land outside the project root, or a
       # command that may write there (PairCommand#outside_writes?); a tmp
       # dir the project isn't in aside (PairCommand.writable?).

data/lib/samagotchi/guardrails/pair_command.rb

@@ -52,6 +52,9 @@ module Samagotchi
       ENV_READERS = %w[printenv security op].freeze
       # Commands that print a stored credential (a token, a password, a
       # key), by the program and the words that say so in its arguments.
+      # Programs that load a project's env files (PairBoundary::ENV_LOADER).
+      ENV_LOADERS = %w[mise direnv].freeze
+      ENV_LOADER_TEXT = %r{(?<![\w./-])(?:mise|direnv)(?![\w./-])}
       CREDENTIAL_PRINTERS = {
         "gh" => [%w[auth token]],
         "git" => [%w[credential], %w[credential-osxkeychain], %w[credential-store], %w[credential-cache],
@@ -139,6 +142,20 @@ module Samagotchi
         Outside.inside?(path, root: root) || Outside.tmp_write?(path, root: root)
       end
 
+      # mise's config files (mise.toml, .mise.toml, mise.<env>.toml, .config/mise.toml,
+      # anything under .config/mise/, mise/ or .mise/ config*.toml): mise runs
+      # their [env] at the next worker start (ProjectEnv).
+      MISE_CONFIG_PATH = %r{(?:\A|/)(?:\.?mise(?:\.[^/]+)?\.toml|\.config/mise\.toml|\.config/mise/.+|
+                             \.?mise/config[^/]*\.toml)\z}x
+      MISE_CONFIG_TEXT = %r{(?<![\w-])(?:\.?mise(?:\.[\w.-]+)?\.toml|\.config/mise|\.?mise/config[\w.-]*\.toml)}
+
+      # Whether +path+ is one of mise's config files (MISE_CONFIG_PATH), as
+      # given or as it resolves.
+      def self.mise_config?(path)
+        path.to_s.match?(MISE_CONFIG_PATH) ||
+          (path.to_s.start_with?("/") && PathResolve.reals(path).any? { |real| real.match?(MISE_CONFIG_PATH) })
+      end
+
       # Whether +path+ is in a .git/hooks folder, as given or as it resolves
       # (ShellPaths::HOOKS_PART): git runs what is there.
       def self.git_hook?(path)
@@ -193,6 +210,7 @@ module Samagotchi
 
         @refusal = read
       rescue StandardError
+        @mise_config = true
         @refusal = PairBoundary::UNREADABLE
       end
 
@@ -210,6 +228,28 @@ module Samagotchi
         @links = true
       end
 
+      # Whether it runs mise or direnv (ENV_LOADERS): they load the
+      # project's env files (a mise.local.toml, an .envrc), which hold the
+      # owner's secrets, into what the command prints; the owner approves
+      # it. True for one it can't read.
+      def loads_env?
+        return @loads_env if defined?(@loads_env)
+
+        @loads_env = @depth > MAX_DEPTH || ShellLex.simple_commands(ShellLex.lex(@text)).any? do |words|
+          words.is_a?(Array) && env_loader_command?(words)
+        end
+      rescue StandardError
+        @loads_env = true
+      end
+
+      # Whether it writes (or, not only reading, names) a mise config file
+      # (.mise_config?), a script it hands on included: the owner approves
+      # it. True for one it can't read.
+      def mise_config_write?
+        refusal
+        @mise_config ||= false
+      end
+
       # Whether it may write outside the project (asked about, never
       # denied); true for one it can't read.
       def outside_writes?
@@ -313,8 +353,10 @@ module Samagotchi
         program = File.basename(words[at])
         scripts(words, at).each do |script|
           reason = if SHELLS.include?(program) || program == "eval"
-                     nested(script).refusal
+                     inner = nested(script)
+                     inner.refusal.tap { @mise_config = true if inner.mise_config_write? }
                    elsif INTERPRETERS.include?(program)
+                     @mise_config = true if script.match?(MISE_CONFIG_TEXT)
                      script_text_refusal(script)
                    end
           return reason if reason
@@ -448,6 +490,8 @@ module Samagotchi
         resolved.each do |word, path|
           return PairBoundary::GIT_HOOKS if !@read_only && PairCommand.git_hook?(path || word)
 
+          @mise_config = true if !@read_only && PairCommand.mise_config?(path || word)
+
           if path
             return PairBoundary::SECRET if @paths.secret_refusal([path])
             return PairBoundary::HOME_SWEEP if SWEEPERS.include?(program_word) && above_denied?(path)
@@ -512,6 +556,18 @@ module Samagotchi
         end
       end
 
+      def env_loader_command?(words)
+        at = program_at(words)
+        return true if at && ENV_LOADERS.include?(File.basename(words[at]))
+        return true if words.each_cons(2).any? { |option, word| CODE_OPTIONS.include?(option) && ENV_LOADERS.include?(File.basename(word)) }
+
+        runner = (0..(at || (words.size - 1))).find { |i| runner?(words[i]) } or return false
+        name = File.basename(words[runner])
+        scripts(words, runner).any? do |script|
+          SHELLS.include?(name) || name == "eval" ? nested(script).loads_env? : script.match?(ENV_LOADER_TEXT)
+        end
+      end
+
       def nested(script) = PairCommand.new(script, cwd: @cwd, paths: @paths, home: @home, root: @root,
                                                    depth: @depth + 1, web: @web)
 

data/lib/samagotchi/guardrails/protected_paths.rb

@@ -14,7 +14,8 @@ module Samagotchi
     #         hooks, rules, manifests) and attached context (a source's
     #         command runs later, outside the gate; chi context writes
     #         it); nothing legitimate writes there through the file tools.
-    #   ask (once / session): config.yml and the plain hooks dir. The
+    #   ask (once / session): config.yml, home.json (the chi home: the
+    #         Ruby every chi launch boots) and the plain hooks dir. The
     #         system bundle's config protocol edits config.yml with
     #         write/edit, so this keeps the user in the loop without
     #         breaking it.
@@ -29,7 +30,8 @@ module Samagotchi
       # @param config_path [String] config.yml
       # @param hooks_dir [String] the plain hooks dir
       # @param context_dir [String, nil] <state dir>/context (ContextSources.root)
-      def initialize(store_dir:, bundles_dir:, config_path:, hooks_dir:, context_dir: nil)
+      # @param home_path [String, nil] home.json (ChiHome.path)
+      def initialize(store_dir:, bundles_dir:, config_path:, hooks_dir:, context_dir: nil, home_path: nil)
         @deny = [
           ["guardrail-store", store_dir, "the approval store belongs to the user"],
           ["installed-bundles", bundles_dir, "installed bundles (hooks, rules, manifests) are changed by chi bundle install"],
@@ -37,8 +39,9 @@ module Samagotchi
         ]
         @ask = [
           ["chi-config", config_path, "changes chi's config.yml"],
+          ["chi-home", home_path, "changes the Ruby every chi launch boots"],
           ["chi-hooks", hooks_dir, "changes chi's hooks"]
-        ]
+        ].select { |_, root, _| root }
       end
 
       # Vote on +verdict+ (its targets).

data/lib/samagotchi/guardrails/review_paths.rb

@@ -30,13 +30,16 @@ module Samagotchi
                              .netrc .npmrc .pypirc .claude.json .zsh_history .bash_history .history .python_history
                              .node_repl_history .psql_history .mysql_history .irb_history .lesshst
                              .local/share/fish/fish_history].freeze
-      # Project files that hold secrets, by a path part's name: .env*,
-      # netrc, keys and certificates, anything named credentials, package
+      # Project files that hold secrets, by a path part's name: .env* (.envrc
+      # too), mise's local files (mise.local.toml, .mise.dev.local.toml), netrc, keys and certificates, anything named credentials, package
       # registry tokens (.npmrc, .pypirc), ssh keys, terraform state, a
       # secrets file; and a git config (.git/config, a submodule's
       # .git/modules/x/config), checked apart.
-      SECRET_FILE = /\A(?:\.env.*|[._]netrc|.*\.(?:pem|key|p12|pfx|tfstate(?:\.backup)?)|.*credentials.*|
+      SECRET_FILE = /\A(?:\.env.*|\.?mise(?:\.[\w-]+)?\.local\.toml|[._]netrc|.*\.(?:pem|key|p12|pfx|tfstate(?:\.backup)?)|.*credentials.*|
                        \.npmrc|\.pypirc|\.git-credentials|id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?|secrets?\.(?:ya?ml|json))\z/xi
+      # mise's local config in its config dirs (.config/mise/config.local.toml,
+      # config.<env>.local.toml; mise/ and .mise/ too): by the path's end.
+      SECRET_PATH = %r{(?:\A|/)(?:\.config/mise|\.?mise)/config(?:\.[\w-]+)?\.local\.toml\z}i
       # The .docker/config.json kind: a dot dir's config holding tokens.
       SECRET_DIR_FILES = { ".docker" => "config.json", ".kube" => "config" }.freeze
       GIT_DIR = ".git"
@@ -124,7 +127,7 @@ module Samagotchi
         return true if denied_roots.any? { |root| PathResolve.under?(path, root) }
 
         parts = path.split(File::SEPARATOR)
-        return true if parts.any? { |part| SECRET_FILE.match?(part) }
+        return true if parts.any? { |part| SECRET_FILE.match?(part) } || path.match?(SECRET_PATH)
         return true if parts.each_cons(2).any? { |dir, file| SECRET_DIR_FILES[dir.downcase] == file.downcase }
 
         git_config?(parts)

data/lib/samagotchi/guardrails/verdict.rb

@@ -23,7 +23,7 @@ module Samagotchi
       # ParentPolicy's user_only); System 1 may, only if the user lists the
       # rule by name in guardrails.system_one.rules, and never for the
       # chi-answer/chi-broadcast ones (SystemOne::SelfProtect::NEVER_AUTO).
-      PROTECTED_RULES = %w[chi-config chi-hooks shell-touches-chi chi-context-cmd chi-broadcast prompt-memory-write
+      PROTECTED_RULES = %w[chi-config chi-home chi-hooks shell-touches-chi chi-context-cmd chi-broadcast prompt-memory-write
                            model-overlay-write chi-answer-piped chi-answer-http].freeze
       SCOPES = %w[once session repo rule].freeze
       DO_NOT_RETRY = "Do not retry it or reach the same result another way; ask the user how to proceed."