samagotchi 0.133.0 → 0.134.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8b85b6006a6570eb4145c39cf37ad004a56332b33240353c78d15529d532cd71
-  data.tar.gz: 6c194c4f62179e781a121e1e35eb9f8407795cb6e2b519ffa3ff917d0b6096eb
+  metadata.gz: 1400c2aa3cceb5a84b6aa0d5610021b5e5893415afa37f98e8c99efe291de436
+  data.tar.gz: eda23134194381fd10460ba0b026ae10aa5a8aaf674fbc9dc4504359b1acb86d
 SHA512:
-  metadata.gz: 777ad65e1223ba4f99058f5ecdd3d89621af1b1f2f61ff02b21a0760607a92d18d179f9da49dae7c257a07ac107fdcfadd2c0bcf14c8555a25a1570f07c8729e
-  data.tar.gz: e5115ba552ca82ac8a1f6d79f917d50d970bcd7202866a3ac30a15a89541ea94b61ef0a2ff61f0594f996c2a874aa01e7fe1cb3c4cf1551357f017417416c217
+  metadata.gz: 7029cb713c02b4c3099ade377bc57618ec6467c2a1f04a4b21c7ebd3fbb6e34705e1ad54fe547672becdc6553824b785c96222e310690fd707a12c0fb057e852
+  data.tar.gz: e7400f091254ba9ffdf04f14160e8d6816cbe264016f8be8558c9da091edcc33bf34ed93652c83b6647be728a349b31631db49fc26e483280deda75a7658e5e3

data/CHANGELOG.md

@@ -7,6 +7,72 @@ and commands may change between minor versions. How releases are made:
 [docs/releasing.md](docs/releasing.md).
 ## [Unreleased]
 
+## [0.134.0] - 2026-10-30
+
+### Added
+
+- Web: a long answer (over ~25 lines or ~2,000 characters) gets a fold row above it: one click folds it to its first
+  line and its length, another opens it. Your folds are kept per browser across reloads; a jump into a folded answer
+  (a claim link, the working set, "View check") opens it.
+
+### Fixed
+
+- Web: the start page's ⚙ and 🧰 buttons say whether their panel is open (`aria-expanded`) to screen readers.
+- Web: an open sheet or popover is placed again when the window resizes (a rotation, a phone's keyboard): its header
+  no longer ends up above the screen, and a sheet turns back into a popover on a wide window.
+- Web: on a phone the ⚙ panel's sheet may take 85 % of the screen, so with "Apply and budget" open its closing note is
+  no longer cut off at the bottom edge.
+- Web: the ⚙ and 🧰 panels keep the keyboard focus while open (Tab wraps inside, `aria-modal`), their override chips
+  say whether the panel is open (`aria-expanded`), and Esc or × gives focus back to the chip that opened it.
+- Web: "default" on the ⚙ panel's Context row now clears a set apply rule and budget too: the chip read "ctx apply
+  payoff · budget 64000" while the row showed default, and the new session got them.
+- Web: on a touch screen a tapped row or link in the ⚙ and 🧰 panels (and the ⚙ and 🧰 buttons) no longer keeps its
+  hover tint.
+- Web: a sheet's and a popover's × is a 36 px tap target on a touch screen (it was 22x16 px).
+- Web: the Stop sheet's "+N more" no longer sits 74 px to the right (it shared a class with the ⚙ panel's row).
+- Pair turns: a read-only mention of mise's config (`find . -name mise.toml && make`) no longer asks the owner; a
+  delete, move or write of it still does, and `.tool-versions` (mise reads it too) is covered the same way.
+- `chi home doctor` checks the desktop helper only when the helper's chi reads this chi's config dir: a run with
+  `XDG_CONFIG_HOME` elsewhere no longer reports the installed helper against a home it never boots.
+- The new-version hint ("… the desktop helper can be updated: chi update") follows the same rule: a run with
+  `XDG_CONFIG_HOME` elsewhere no longer hints about the installed helper.
+- `chi home set` under `bundle exec` refuses to record its own Ruby, whose gem path is the bundle's, instead of making
+  it the home every launch boots (`--ruby` another Ruby still works).
+- `chi update` under `bundle exec`, run on another Ruby than the chi home's, hands over to the home's chi outside the
+  bundle instead of loading the bundle into it (which failed noisily).
+- `chi self`'s home row says when this chi runs on the home's Ruby and gems but isn't the home's newest chi (`this chi
+  is X`), as the terminal line and `chi home doctor` do.
+- `chi home doctor` reports a worker that couldn't boot the chi home's chi (the debug log's newest `boot_failed` line
+  since the home was set, unless a worker started after it), with what to run.
+- Toolkit suggestions (`toolkit.suggest.mode: on`): a suggestion that times out or gets no answer from System 1 now
+  says so in a notice (the session runs its default kit) and a timeout logs a warning, instead of falling back silently.
+- Pair turns: a participant can no longer write git's config at all, so no setting makes git run a command later in
+  your name (a hook, a filter or driver, a helper, an include): `git config` only reads, parsed strictly (an unknown or
+  abbreviated option counts as a write), and `git -c`, `--config-env`, a clone's `-c`/`--config`, `--template` and
+  `GIT_TEMPLATE_DIR` are denied, as are a submodule's hooks (`.git/modules/*/hooks`) and the hook installers
+  (`pre-commit install`, `husky`, `lefthook install`). A command git runs from its text (`rebase --exec`,
+  `submodule foreach`) is checked like any command. Reading git's config (`git config --get`, `-l`) is no longer
+  refused.
+- Pair turns: a command that writes outside the project with no word naming where now asks you like any other
+  outside write: global installs (`npm -g`, `pip install`, `gem install`, `brew`, `cargo`/`go install`, `pipx`,
+  `uv tool`), user config (`npm config set` writes `~/.npmrc`, `gh config set`), `defaults write`, `launchctl`; and
+  so does a shell or interpreter reading its script from stdin (`… | sh`, `| bash -x`, `curl … | bash`,
+  `sh < run.sh`). Global installs are recognised in any spelling (`npm i --location global`, `python3.12 -m pip`,
+  `npm_config_global=true`, `npm link`), with more tools (`deno`, `dotnet tool`, `corepack`, `bundle config set`).
+- System 1 no longer auto-allows a command that names the memories folder and then climbs out of it by a script's
+  own calls (`python3 -c '…os.chdir(os.pardir)…'`, `ruby -e '…File.dirname(Dir.pwd)…'`) or runs a script it can't
+  see (a file, stdin, `| sh -x`, `python3.12 x.py`, `make`, `awk -f`): it could write `config.yml`. You decide
+  those; plain memory edits stay eligible.
+- Guardrails: a `task_create` whose `env:` points git at another config (`GIT_CONFIG_GLOBAL`, `GIT_CONFIG_SYSTEM`,
+  `GIT_CONFIG_KEY_n`/`VALUE_n`) is no longer read-only, and a pair turn's command that sets one is denied like
+  `git -c`.
+- Pair turns: more spellings that hid a git config write or a command are caught: a git global option that takes a
+  value (`--attr-source`, `--shallow-file`, one git adds later), `git-config` and the other dashed builtins, a script
+  after a shell's options (`sh -c -- S`, `bash -c -x S`) or in an option cluster (`ruby -we`, `perl -le`, `node -pe`,
+  `python3 -Ic`), and a command handed through an environment variable (`GIT_EDITOR`, `GIT_SSH_COMMAND`,
+  `GIT_EXTERNAL_DIFF`, `GIT_PAGER`, `EDITOR`, …). `git maintenance register/start`, `git lfs install` and
+  `scalar register` now ask you.
+
 ## [0.133.0] - 2026-10-30
 
 ### Added
@@ -5077,7 +5143,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.133.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.134.0...HEAD
+[0.134.0]: https://github.com/dm1try/samagotchi/compare/v0.133.0...v0.134.0
 [0.133.0]: https://github.com/dm1try/samagotchi/compare/v0.132.0...v0.133.0
 [0.132.0]: https://github.com/dm1try/samagotchi/compare/v0.131.0...v0.132.0
 [0.131.0]: https://github.com/dm1try/samagotchi/compare/v0.130.1...v0.131.0

data/docs/cli.md

@@ -1026,6 +1026,17 @@ touch screen), and so does each code block of a rendered answer. An answer
 copies its Markdown source, not the rendered text; a code block copies just
 its code; a prompt copies the text as you typed it.
 
+A long answer (over 25 lines or 2,000 characters of its text) can be folded
+by hand: a slim "▾ N lines" row sits just above it once its turn has ended.
+Click it and the answer folds to one row, "▸ its first line · N lines" (the
+first line of what a hook presented in its place, else its first heading,
+else its first line); click again to unfold. A delegate report's reply
+folds the same way. Folding is this browser's choice, kept per session in
+localStorage (`chi_answer_fold:<session id>`, the last 200 folded answers;
+the keys of sessions gone from the list are dropped when the list loads);
+other viewers and the participant page are not affected. A jump into a
+folded answer (a claim link, say) unfolds it for that page load.
+
 ### Web views
 
 `web.view` picks how the page draws a turn: `stage` (the default: the

data/docs/configuration.md

@@ -1375,7 +1375,8 @@ launches it. It is recorded in `~/.config/samagotchi/home.json` (`$XDG_CONFIG_HO
 - **Setting it.** `chi home set` records the Ruby your `chi` runs on and its gem path (a chruby shell's
   `GEM_HOME`/`GEM_PATH` are part of it: that is where its chi lives); `chi home set --ruby PATH` records another
   Ruby with its own gem dirs. Either needs samagotchi installed there (`gem install samagotchi` with that Ruby
-  first). Without a home.json, the first `chi bootstrap` or `chi update` records one, once (from an installed chi,
+  first). Under `bundle exec`, `chi home set` refuses to record its own Ruby (the bundle's gem path is no home);
+  `--ruby` another Ruby still works. Without a home.json, the first `chi bootstrap` or `chi update` records one, once (from an installed chi,
   never under `bundle exec`): of the desktop helper's Ruby (when its newest chi is at least the one running) and the
   Ruby chi runs on, the one with the newer chi. Nothing else ever overwrites it.
   `chi home` shows it; `chi home doctor` checks it (see [CLI](cli.md#commands)).
@@ -1396,7 +1397,7 @@ launches it. It is recorded in `~/.config/samagotchi/home.json` (`$XDG_CONFIG_HO
   `home_older_than_spawner`), but chi web's restart runs the newest chi it knows outside the home instead
   (`restart_home_older`): its flags may be ones the older chi doesn't know.
 - **A home that still fails at boot** (a broken install): the worker writes one `boot_failed` line to the debug log
-  (`log.file`) and exits, rather than leave the spawner waiting.
+  (`log.file`) and exits, rather than leave the spawner waiting; `chi home doctor` reports the newest one.
 - Each machine has its own home (a remote's is that machine's).
 
 ### Checking it: chi home doctor
@@ -1408,7 +1409,8 @@ fails (a launch can't boot what it should), 0 otherwise. Run it in a project fol
 |---|---|---|
 | the home | `fail`: its Ruby is gone (a Ruby upgrade) or has no samagotchi | `gem install samagotchi` with the new Ruby, then `chi home set` from it |
 | this chi | `warn`: the chi you ran is another Ruby's, or another version, than the home's (`ok` for a source checkout, which starts its own code) | `chi home set` to make this one the home, or run the home's |
-| the desktop helper | `fail`: its launch file's Ruby or chi is gone; `warn`: it runs `[ruby, chi]` (installed before the home), boots the home as it was before a `chi home set`, or sets `GEM_HOME`/`GEM_PATH` | `chi desktop install --force` / `chi desktop upgrade` |
+| the last worker boot | `fail`: the newest worker boot in the debug log since the home was set is a `boot_failed` line (the home's Ruby couldn't load chi), not a worker's `start`; nothing without a log file | `gem install samagotchi` with the home's Ruby (or `chi home set` another), then `chi sessions restart ID` |
+| the desktop helper (when installed, and its chi reads this chi's config dir: none with `XDG_CONFIG_HOME` elsewhere) | `fail`: its launch file's Ruby or chi is gone; `warn`: it runs `[ruby, chi]` (installed before the home), boots the home as it was before a `chi home set`, or sets `GEM_HOME`/`GEM_PATH` | `chi desktop install --force` / `chi desktop upgrade` |
 | sessions | `warn`: sessions last saved by a newer chi than the home's (their workers run without what it added) | `chi update` |
 | the tools' `chi` | `warn`: `$XDG_STATE_HOME/samagotchi/bin/chi` boots another chi than the home | the next worker start rewrites it (`chi sessions restart ID` for a running session) |
 | this project's Gemfile.lock | `warn`: the nearest Gemfile.lock up to the git root bundles samagotchi (`bundle exec chi` isn't supported) | `bundle remove samagotchi` there; run chi itself |
@@ -1530,7 +1532,9 @@ toolkit:
   suggested`, and the turn's first request declares it; the notice reads
   `toolkit: web (suggested, p=0.71) · /toolkit to change`. Anything else (the default, a low-confidence or unknown
   pick, `undecided`, no answer, a failing System 1, which warns once as `[samagotchi:toolkit]`) keeps the default
-  kit. A Stop during the wait (or before it, even with the answer in) ends the turn before its first request, and
+  kit. No answer in time or none at all says so in a warn notice, `toolkit: full (no suggestion: System 1 took over
+  5000 ms) · /toolkit to change` (or `System 1 gave no answer`), and a timeout logs a `toolkit_suggest_timeout`
+  warning: a slow System 1 host wants a larger `guardrails.system_one.timeout_ms`. A Stop during the wait (or before it, even with the answer in) ends the turn before its first request, and
   nothing switches. After an `undecided`, a later prompt within the defer limits may switch the session; that notice
   says `from this turn`, and that request re-reads the whole prompt (system prompt, tools and conversation, which
   the defer limits keep small) without `/toolkit`'s cache confirmation. `/toolkit` or `ctx.use_toolkit` marks the

data/docs/guardrails.md

@@ -433,16 +433,46 @@ message:
   project env ([Project env](sessions.md#project-env)); a command that runs
   `mise` or `direnv` asks the owner (`ENV_LOADER`: they load the project's env
   files, and `.envrc`, `mise.local.toml` and its kin are secrets like `.env`),
-  and so does a write (by a file tool or a command) to mise's config
-  (`MISE_CONFIG`: the owner's next worker start runs its `[env]`);
+  and so does a write (by a file tool or a command) to mise's config, its
+  `.tool-versions` included (`MISE_CONFIG`: the owner's next worker start runs
+  its `[env]` and installs what it pins; a command asks when a part of it that
+  names one may write: `rm`, `mv`, `find … -delete` and `find … | xargs rm`
+  do, a read-only part such as `find . -name mise.toml && make` doesn't, the
+  list split at `;`, `&&`, `||` and newlines outside `( … )`; mise's own
+  writes, `mise use`/`mise set`, ask as runs of mise; a config that changes
+  without being named, by `git checkout`, `git stash pop`, `tar x`, `patch` or
+  `cp -r dir/. .`, isn't asked about: the owner's next restart runs it);
   and a command still
   running at the limit is killed, never handed over as a background task;
-- git settings that make git run a command (`core.hooksPath`,
-  `core.fsmonitor`, `core.sshCommand`, `core.pager`, `core.editor`, a `!`
-  alias) by `git config` or `git -c`, and `git config --global`/`--system`;
+- git config writes, whatever the key (any may make git run a command later
+  in the owner's name: hooks, `core.fsmonitor`, a filter, diff or merge
+  driver, a credential or gpg helper, `hook.<name>.command`, an include): a
+  pair turn's `git config` only reads, parsed strictly
+  (`PairCommand#git_config_read?`: `--get`, `--get-all`, `--get-regexp`,
+  `--get-urlmatch`, `--get-color(bool)`, `-l`/`--list`, `get`, `list` or a lone
+  key, with `--show-origin`, `--show-scope`, `--name-only`, `-z`, `--type=…`,
+  `--default`, `--file F` and the like, every word accounted for; any other
+  option, an abbreviation git would take (`--glob`, `--comm`), a short form
+  (`-t`) or a word too many is a write). Denied too: `git -c`, `--config-env`,
+  a clone's, init's or submodule's `-c`/`--config`, an assignment of
+  `GIT_CONFIG_*` or `GIT_TEMPLATE_DIR`, `git` under an alias, `git config` after
+  `xargs` or in `find -exec`, and an interpreter's script naming `git config`
+  or `git -c`, behind any of git's own options (`--attr-source X`,
+  `--shallow-file X`; one chi doesn't know is read both with and without the
+  next word as its value, `PairCommand.git_command_starts`), and by a
+  builtin's dashed name (`git-config`, `…/git-core/git-submodule foreach`:
+  judged as `git config`, `git submodule`). A command git runs now from its text (`git submodule foreach`,
+  `rebase --exec`, `bisect run`, a `filter-branch` filter, `--upload-pack`,
+  `--receive-pack`, `--extcmd`, an `ext::` URL) is read as a command of its
+  own and asks as an outside write. A `.gitattributes` write isn't asked
+  about: it only selects a driver, and defining one is what's denied;
   and writing git's hooks: a `write` or `edit` of a path in a `.git/hooks`
-  folder (as given or as it resolves), or a command that isn't read-only and
-  names one (`printf … > .git/hooks/pre-commit`, `cp x .git/hooks/`);
+  folder, a submodule's `.git/modules/<name>/hooks` too (as given or as it
+  resolves), or a command whose part that names one isn't read-only
+  (`printf … > .git/hooks/pre-commit`, `cp x .git/hooks/`), and installing
+  them: `git init`/`clone --template`, and the hook installers
+  (`PairCommand::HOOK_INSTALLERS`: `pre-commit install`, `husky`, `lefthook
+  install`, `simple-git-hooks`, `overcommit --install`);
 - running chi, by any wrapper (`bin/chi`, `bundle exec chi`, `ruby … bin/chi`,
   `env … chi`, `watch`, `npx`, `sh -c 'chi …'`, `$(chi …)`), in an assignment's
   value or an alias, a function, after `-exec`/`-c`/`-e`, but `chi --version` and
@@ -482,7 +512,12 @@ message:
 A script a command hands on is read too (`Guardrails::PairCommand`): one a
 shell runs (`sh -c`, `eval`, a heredoc or here-string) as a command of its
 own, one another interpreter runs (`ruby -e`, `python - <<EOF`) by its text
-(chi, secrets, the environment, detaching). A heredoc written as data (`cat`,
+(chi, secrets, the environment, detaching). So is a command handed through a
+variable a program runs through a shell (`PairCommand::COMMAND_ENV`:
+`GIT_EDITOR`, `GIT_SEQUENCE_EDITOR`, `EDITOR`, `VISUAL`, `GIT_EXTERNAL_DIFF`,
+`GIT_SSH_COMMAND`, `GIT_SSH`, `GIT_PROXY_COMMAND`, `GIT_PAGER`, `PAGER`,
+`MANPAGER`, `GIT_ASKPASS`, `SSH_ASKPASS`), as a prefix, `env`'s or `export`'s:
+read as `sh -c` would run it, for the refusals and for an outside write. A heredoc written as data (`cat`,
 `tee`, `git commit -F -`) is not looked into: where it goes is checked. A
 command the checks can't read is refused, never let through on a text match.
 
@@ -502,7 +537,44 @@ rule lowers it), so it comes even in auto mode. A command fails closed
   (`~/oth*`), `git -C`'s folder and the paths in a script it hands on (`sh -c`
   read as a command, `python -c`/`ruby -e`/a heredoc by the paths in its text)
   among them. The program's own word doesn't count (`/usr/bin/sed`), nor does
-  `PATH=…`, nor a message's heredoc (`git commit -m "$(cat <<'EOF' … EOF)"`).
+  `PATH=…`, nor a message's heredoc (`git commit -m "$(cat <<'EOF' … EOF)"`);
+  and it runs no program that writes to its own place outside with no word
+  naming it (`Guardrails::ImplicitWriters`, examples rather than a closed
+  set: `npm`/`pnpm`/`bun`/`deno` global in any spelling (`-g`, `--global=true`,
+  `--location global`, `npm_config_global=true`), `npm`/`yarn`/`bun link`,
+  `npm config set`/`login` (`~/.npmrc`), `yarn global`, `pip install`/`pip
+  config` by any interpreter (`python3.12 -m pip`, `pypy3 -mpip`; with or
+  without `--user`: its site-packages is wherever its Python is; a project
+  venv's `.venv/bin/pip` and `-t`/`--target`/`--prefix` don't count), `uv pip
+  install --system`, `gem install`, `bundle config set` without `--local`,
+  `brew` but its reading verbs, `defaults write`, `cargo install`, `go
+  install`/`go env -w`, `pipx`, `uv tool`/`uv python install`, `dotnet tool
+  install -g`, `corepack enable`, `rustup`/`pyenv`/`rbenv`/`asdf`/`volta`/`nvm`
+  installs and globals, `code --install-extension`, `gh auth`/`config
+  set`/`extension install`, `launchctl` but its reading verbs, `git maintenance register`/`start`, `git
+  lfs install`, `scalar register`/`clone`; a project
+  install such as `npm install` or `bundle install` and build caches don't
+  count), and no shell or interpreter that reads its script from stdin: one
+  on the receiving end of a pipe whatever its options (`… | sh`, `| bash -x`,
+  `| sh -e`, `| python3 -c 'exec(input())'`), `< file`, `bash -s`, `python3 -`,
+  or with no script at all: chi can't see that script. A shell's `-e`, `-x`
+  and `-o …` are flags, only `-c` (or a cluster holding it, `-ec`, `-cx`)
+  hands it a script: the first word after its options (`sh -c -- S`, `bash -c
+  -x S`); an interpreter's own code flag does (`python -c`, `ruby -e`,
+  `node -e`/`-p`/`--eval=`, `perl -e`/`-E`, `php -r`), alone or in a cluster
+  (`ruby -we`, `perl -le`, `node -pe`, `python3 -Ic`, `python3 -c'…'`;
+  `PairCommand.cluster_code_at`: a letter that takes the rest of the word,
+  `ruby -rset`, holds no code). A script file it names (`sh
+  run.sh`, `ruby x.rb`) is not read.
+
+  Accepted gaps (an accident guard for a trusted team): a script file the turn
+  wrote and then runs; inline scripts read only by their text for paths
+  (`find … -exec sh -c '…'`, `flock … sh -c`, `awk 'BEGIN{system(…)}'`,
+  `deno eval`); a `GIT_CONFIG_*` set by `printf -v` or `read` and exported
+  (it affects that command only); a variable outside `COMMAND_ENV` whose
+  value a program runs (`LESSOPEN`, a tool's own `*_EDITOR`); `npx -y`,
+  `npm exec`, `pnpm dlx`, `uvx`: they fetch into a cache, which doesn't count,
+  and run the package as in-project work.
 
 Anything else asks: `rm -rf ~/x`, `sed -i … ~/x`, `curl -o ~/x`, `dd of=~/x`,
 `touch`/`mkdir` outside, `perl -pi … ~/x`, `cd .. && make`, `cd && make`, and
@@ -629,7 +701,8 @@ repo is in count as outside.
 `touches: chi_dirs` (shell tools) matches a command that names a path in chi's
 own folders: the config folder (`config.yml`, `memories/`), the hooks folder,
 the approval store, installed bundles (`memories/.bundles`), the session repo's
-git hooks (`core.hooksPath` honoured) or any `.git/hooks` outside a tmp folder.
+git hooks (`core.hooksPath` honoured) or any `.git/hooks` (a submodule's `.git/modules/<name>/hooks` too)
+outside a tmp folder.
 Each word is read as a path against the folder the command is in by then
 (`cd`, `pushd`/`popd` and `( … )` followed), with `~`, `$HOME` and
 `$XDG_CONFIG_HOME`/`$XDG_STATE_HOME` expanded and symlinks resolved. So
@@ -657,7 +730,9 @@ only `run list|view`, `pr list|view|diff|checks`, `issue list|view` and
 at a word's start), an env prefix, `sh -c`, `xargs`, `eval`, `sudo` and the
 like make a command not read-only, as does a `task_create` `env:` that sets `BASH_ENV`, `ENV`, `CDPATH`, `IFS`,
 `SHELLOPTS`, `BASHOPTS`, `BASH_FUNC_…`, `LD_PRELOAD`, `LD_AUDIT`, `DYLD_INSERT_LIBRARIES`, `GIT_EXTERNAL_DIFF`,
-`GIT_CONFIG_PARAMETERS` or `GIT_CONFIG_COUNT` (they change what its words run; `PATH` doesn't count). It errs
+or a git config variable (`GIT_CONFIG`, `GIT_CONFIG_GLOBAL`, `GIT_CONFIG_SYSTEM`, `GIT_CONFIG_PARAMETERS`,
+`GIT_CONFIG_COUNT`, `GIT_CONFIG_KEY_n`/`VALUE_n`: `ShellGitDirs::CONFIG_ENV`) (they change what its words run; `PATH`
+doesn't count; a pair turn's command that assigns a git config variable is denied like `git -c`). It errs
 towards asking.
 
 A tool name may be a glob, so one rule covers a plugin's tools (an MCP server's,
@@ -1061,8 +1136,22 @@ gate below passes, in this order:
    it knew the dir: a script or heredoc body (`python3 -c '…'`, `cat >> x.md
    <<'EOF'`), a phrase (`echo "- a note"`) or a glob with no `/`. So
    `cd memories; cd ..`, `cd "${PWD%/*}"`, `cd $(dirname $PWD)` or `cd -`
-   loses the exemption, and the memories text then refuses it. A script body
-   is not looked into beyond its text: an accident guard, not containment.
+   loses the exemption, and the memories text then refuses it. So does a
+   script a shell or interpreter runs that climbs by its own calls
+   (`SelfProtect::SCRIPT_CLIMB`: `os.pardir`, `dirname`, `chdir`, `Dir.pwd`,
+   `Path.parent`, `rindex`, a slice from the end), and one chi can't see: a
+   script file (`cd memories && python3 x.py`) or stdin (`… | python3`,
+   `sh < f`, any interpreter or shell a pipe feeds, `| sh -x` too), by any
+   version's name (`python3.12`, `pypy3`, `Rscript`, `tclsh`), or a program
+   that runs a file (`SelfProtect::FILE_RUNNERS`: `make`, `rake`, `awk -f`,
+   `deno run`, `npm run`). A heredoc only written (`cat >> x.md <<'EOF'`) is
+   data whatever it says. A script body is not looked into beyond its text:
+   an accident guard, not containment (a script can build a path some other
+   way: `p.replace("memories", "config.yml")`, `p[0:len(p)-8]`, `.sub`,
+   `.slice` aren't caught). The price is some harmless commands the user now
+   answers: `python3 scripts/lint.py <memories>/notes.md`, `cat notes.md |
+   python3 -c …` from the memories folder, a climb word written as data by a
+   script (`File.write(".../notes.md", "dirname")`).
    A protected rule
    (`Verdict::PROTECTED_RULES`) may be listed by name and System 1 may answer
    it, but a call that really writes config.yml or the hooks is refused here;

data/docs/internals/background-tasks.md

@@ -45,6 +45,7 @@ Behavior:
 - `execute` and `task_create` both spawn with chi's own Ruby/Bundler setup scrubbed (`TaskRuntime.sanitized_spawn_env`): `RUBYOPT` loses its `-r…bundler/setup` flags (others stay) and `RUBYLIB`, `BUNDLE_GEMFILE`, `BUNDLE_BIN_PATH`, `BUNDLER_VERSION` are unset, so a project's `ruby -e` or `bundle exec` uses its own Gemfile when chi runs under `bundle exec`. `task_create` refuses those keys in the model's `env`; `execute`'s `env` comes from chi's callers (`Builtins`, `!cmd`), not the model, and is set over the scrub. An `execute` handed over at its limit keeps the process it spawned, so the task runs with the same env.
 - `execute` and `task_create` export chi's own markers into the command, set over the model's `env` (which can't set them: `Error: env key is reserved`): `SAMAGOTCHI_PARENT_SESSION` (the session's id, `chi` without one; a chi started there answers as a parent agent), `SAMAGOTCHI_SESSION_MODEL` (the resolved ref the session runs on, read at each call so it follows `/model`; unset when unknown) `SAMAGOTCHI_SESSION_THINKING` (the session's own thinking level; unset when it has none) and `SAMAGOTCHI_SESSION_REASONING_HISTORY` (its own reasoning_history level, the same way). `chi self` reads the last three for its model, thinking level and reasoning history. The four are `ChildEnv::SESSION_MARKERS` (`TaskRuntime::MARKER_ENV_KEYS`), which a spawned worker unsets (`ChildEnv.unset`, merged into its spawn env). A session's worker never inherits them from whoever started it (a `chi send` run by another session's `execute`): its other commands (a user's `!cmd`, an MCP server, a context command) have none.
 - They also pass on a set `XDG_STATE_HOME` / `XDG_CONFIG_HOME` made absolute (`Builtins.xdg_absolute`, via `Paths`), so a chi the command runs in another `cwd` (`chi send`) reads this chi's state and config. These aren't reserved: an XDG dir the model sets in `task_create`'s `env` stays its own.
+- Every runner starts from the session's project env, `ProjectEnv.tools_env`: the overlay a spawned worker computed once at boot (`SessionManager.apply_project_env` → `ProjectEnv.compute` → `ProjectEnv.install!`; its folder's `mise env`, and the chi shim's dir first on PATH so `chi` is the chi home's), less `ProjectEnv::TOOLS_DROP` (`RUBYOPT`, `RUBYLIB`, Bundler's: the scrub above sets those). Outside a worker (`ProjectEnv::NONE`) it is `{}`. The sites: `execute` and `task_create` (`Tools::Builtins#project_env`, under the markers and the model's `env`; a participant's turn gets `{}`), the user's `!cmd` (`SessionCommands#shell`) and a context source's command (`ContextFetch#env_for`). MCP servers take `ProjectEnv.current.env` whole under the server's own keys (`bundles/mcp/plugin.rb` `server_env`: no `TOOLS_DROP`, no participant rule). chi's own process env is never changed, and the project env never enters the prompt. User docs: [Project env](../sessions.md#project-env); the launch side: [How chi launches itself](../architecture.md#how-chi-launches-itself).
 
 ## Finish wake
 

data/docs/internals/participants.md

@@ -195,11 +195,12 @@ Everything else is `:owner`: `/answer`, `/command`, `/images` (an image a prompt
   to act: the turn only reads (`Guardrails::ReviewBoundary`), and proposes what the owner applies ([Apply](#apply)).
 - **`:pair`**, a working session's participant invited to act: the turn acts with the session's tools under the
   owner's guardrails, its asks go to the owner and offer once only, and `Guardrails::PairBoundary` denies secrets,
-  chi itself and chi web on loopback, background and scheduled jobs, the environment and credential printers, git's
-  hooks, owner-voiced tools and the owner's task outputs, and the model's own question, and asks before a command
-  that makes a link and before a write that may land outside the project, failing closed (a session at or above
-  home has none: every write asks) ([guardrails](../guardrails.md#a-participants-pair-boundary)). No Apply: it
-  acted itself.
+  chi itself and chi web on loopback, background and scheduled jobs, the environment and credential printers, git
+  config writes (reads only) and git's hooks, owner-voiced tools and the owner's task outputs, and the model's own question, and asks before a command
+  that makes a link and before a write that may land outside the project, failing closed (a global install or a
+  user config write that names no path, `Guardrails::ImplicitWriters`, and a script read from stdin count; a
+  session at or above home has none: every write asks) ([guardrails](../guardrails.md#a-participants-pair-boundary)).
+  No Apply: it acted itself.
 
 `ParticipantMode.of(session, features:)` is the session's: what a participant invited now gets. No session is
 `:review`. A worker names `pair_turns` (`Delivery::PAIR_FEATURE`) when it runs pair turns; one without it runs

data/docs/internals/tool-guardrails.md

@@ -50,6 +50,8 @@ Configuration (config.yml `execute.*` keys and CLI flags too, as for `read`):
 - `SAMAGOTCHI_EXECUTE_TIMEOUT_SEC` (`execute.timeout_sec`, default `120`): what a command still running then gets is `execute.on_timeout`.
 - `SAMAGOTCHI_EXECUTE_ON_TIMEOUT` (`execute.on_timeout`, default `task`): `task` hands the command over as a background task, not killed; the result starts `Still running at the 120s limit: moved to a background task, not killed.` (`Execute::HANDED_OVER`), then its `task_id:` and the tails of stdout and stderr so far, and `task_wait` waits for it. `kill` stops it and answers `Error: command timed out after …s` (`Execute::TIMEOUT_PREFIX`) with the hint to use `task_create`. The `!cmd` bang always kills. See [Background tasks](background-tasks.md).
 
+The env a command runs in (the session's project env, `ProjectEnv.tools_env`, then the Ruby/Bundler scrub and chi's markers) is the same for `execute`, `task_create`, `!cmd` and context sources: see [Background tasks](background-tasks.md).
+
 Implementation note:
 
 - Shared logic lives in `lib/samagotchi/tools/output_guardrails.rb` and is used by `read` and `execute`, and by `edit` (its env switches) and `delegate_wait` (the head+tail preview of a child's long reply).

data/docs/plugins.md

@@ -1310,7 +1310,8 @@ bundle.shutdown
   value, or raises `Samagotchi::Testing::Waiting::TimedOut` ("timed out after 5 s waiting for <what>", plus
   `; last saw: <value>` from the `seen:` callable). `join!(thread, what)` and `pop!(queue, what)` are
   `Thread#join` and `Queue#pop` with that deadline and message; `wait_until { }` returns the block's last value
-  instead of raising, for a wait whose timeout is fine; `process_gone?(pid)`. Every deadline is multiplied by
+  instead of raising, for a wait whose timeout is fine; `process_gone?(pid)`; `time_bound(seconds, below: nil)`, a
+  wall-clock upper bound scaled the same way and kept under `below:` (the unscaled deadline it tells apart from). Every deadline is multiplied by
   `SPEC_TIME_SCALE` (default 1, at least 1; chi's CI sets 2), so a slow runner gets headroom.
 - **Model notes:** `sandbox.model_notes_for(model_id, small: nil, cwd: nil)` lists the model notes chi would load
   into the prompt for a bare model id (`deepseek/deepseek-v4.1-flash`, no host prefix), from the sandbox's

data/docs/sessions.md

@@ -396,8 +396,9 @@ mise.toml pins Ruby 3.4 gets that `ruby`, `gem` and `bundle` in its tools while
 - **Pair turns** (a participant's, see [Participants](internals/participants.md)) run their `execute` without the
   project env. MCP servers are the session's, started once in the project env, so a pair turn's MCP calls do use
   it. A participant's command that runs `mise` or `direnv`, and any write to mise's config (`mise.toml`,
-  `.mise.toml`, `mise.<env>.toml`, `.config/mise.toml`, `.config/mise/…`, `mise/` or `.mise/config*.toml`: your
-  next worker start runs it, and its `[env]` can run commands), asks you first. `.envrc` and mise's local files
+  `.mise.toml`, `mise.<env>.toml`, `.config/mise.toml`, `.config/mise/…`, `mise/` or `.mise/config*.toml`, and
+  `.tool-versions`: your next worker start runs it, and its `[env]` can run commands), a delete or move of one
+  included, asks you first; a read-only mention (`find . -name mise.toml`) doesn't. `.envrc` and mise's local files
   (`mise.local.toml`, `mise.<env>.local.toml`, dotted or not, and `config.local.toml` / `config.<env>.local.toml` in
   `.config/mise/`, `mise/`, `.mise/`) are secrets to them, as `.env` is.
 - **What tools still drop**: every `execute`, task and `!cmd` takes no `RUBYOPT`, `RUBYLIB`, `BUNDLE_GEMFILE`,

data/docs/testing.md

@@ -95,6 +95,9 @@ run, CI) and too long on a fast one. The contract a new spec follows:
 4. **"Nothing happens" is shown by counting passes** (the worker's loop rounds, spec/support/worker_loop_rounds.rb;
    a class's ticks), not by a pause.
 5. **A wall-clock bound** only as "not the full N s", with at least 5× headroom measured on the slow (x86) laptop.
+   Write it `be < time_bound(3, below: 5)`: the bound scaled like a helper's deadline, and kept under the unscaled
+   deadline it tells apart from (here a 5 s read timeout), so the check still fails on the full wait at any scale. A
+   cost bound with nothing to tell apart from ("no quadratic blow-up") takes no `below:`.
 
 The helpers are the bundle test kit's (`Samagotchi::Testing::Waiting`, [plugins.md](plugins.md#testing-a-bundle-experimental)),
 so core and bundle specs share one copy; `SpecWaiting` (spec/support/waiting.rb) includes them in every example
@@ -107,6 +110,7 @@ group and also answers them as module calls (`SpecWaiting.pop!`, for a stubbed l
   same deadline and message. A gate a stubbed lib thread waits on takes `timeout: 30`: it only ends a hang.
 - `wait_until(timeout:) { … }` returns the block's last value (falsy at the deadline): for a value the example
   checks after, or a `wait-ok` wait.
+- `time_bound(seconds, below: nil)`: a wall-clock upper bound, scaled and kept under `below:` (rule 5).
 - `eventually(timeout: 5) { expect(…) }` (spec only) retries until the expectations hold, then re-raises the last
   failure prefixed `still failing after 5 s:`, so the matcher's own expected/got is in the message.
 
@@ -129,8 +133,8 @@ Every example also runs under a 120 s limit (`spec_helper`'s `around`; `integrat
 limit, `0` turns it off (a debugger session). The limit is not scaled.
 
 **The cops.** `Samagotchi/SpecSleep` (an untagged `sleep` in a spec) and `Samagotchi/SilentWait` (a `wait_until`
-whose value is dropped, an example's last line included, `expect(wait_until { … }).to be(true)`, or an untagged
-`Timeout.timeout`) live in `rubocop/` and run in `rake lint`, so CI fails on them. RSpec counts `wait_for`,
+whose value is dropped, an example's last line included, `expect(wait_until { … }).to be(true)`, an untagged
+`Timeout.timeout`, or a statement `thread.join(N)`, whose N is unscaled and whose nil is dropped: use `join!`) live in `rubocop/` and run in `rake lint`, so CI fails on them. RSpec counts `wait_for`,
 `eventually`, `join!` and `pop!` as an example's expectation (`RSpec/NoExpectationExample`), so a wait can be an
 example's last line. What the cops can't see, `script/affected-specs` hints at (`timing:`, below).
 
@@ -184,6 +188,7 @@ any other file requires it, so a spec file run alone still finds its requires. E
 | `fake_provider_server.rb` | `FakeProviderServer`: an in-process HTTP provider replaying spec/fixtures/providers, recording requests |
 | `fake_tailscale.rb` | A fake `tailscale` for `Web::Tunnel::Tailscale` (status, serve, lock from JSON files; argv.log) |
 | `git_repo.rb` | *helper*: `git_repo`, a temp folder with `git init`, removed after the example |
+| `lock_holder.rb` | *helper*: `spawn_lock_holder(session_dir)`, a stand-in worker process holding a session's owner lock, which says so on a pipe |
 | `integration_server.rb` | *helper*: the live model server `:integration` examples use, from `SAMAGOTCHI_INTEGRATION_*` ([Integration specs](#integration-specs)) |
 | `mcp_bundle.rb` | The shipped mcp bundle's path and the fake MCP server its specs start (`MCP_FAKE_COMMAND`, no RubyGems) |
 | `no_console.rb` | Loaded first (`ruby -r`) by spawned bin/chi children: `IO.console` is nil, so output never wraps at a terminal's width |

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.133.0
+version: 0.134.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/chi_home.rb

@@ -42,6 +42,15 @@ module Samagotchi
     class Invalid < StandardError
     end
 
+    # A record of this process under Bundler (`bundle exec chi home set`)
+    # would name the bundle's Ruby and gems as the home every launch boots.
+    class UnderBundler < StandardError
+      def initialize(msg = "under Bundler (bundle exec) this chi's gem path is the bundle's, not a chi home: " \
+                           "run chi itself, or name another Ruby with --ruby")
+        super
+      end
+    end
+
     # home.json's fields. +gem_path+ is what `Gem.paths=` takes (dirs joined
     # by File::PATH_SEPARATOR); +mise+ an absolute path or nil.
     Record = Data.define(:ruby, :gem_home, :gem_path, :mise, :set_at, :set_by_version) do
@@ -274,8 +283,9 @@ module Samagotchi
       nil
     end
 
-    # The test UpdateCommand's @bundler makes: a first record from a
-    # `bundle exec` would name the bundle's gems.
+    # Whether this process runs under Bundler (`bundle exec`), where a
+    # record of it would name the bundle's gems: record_first!, chi home
+    # set (UnderBundler) and chi update's @bundler.
     def under_bundler?(env = ENV) = !!(defined?(::Bundler) || !env["BUNDLE_GEMFILE"].to_s.empty?)
 
     # mise's absolute path: on +env+'s PATH, else in MISE_DIRS; nil without.

data/lib/samagotchi/desktop/macos.rb

@@ -259,6 +259,24 @@ module Samagotchi
         "the desktop helper's launch file sets #{baked.join(", ")} for its sessions' tools: chi desktop upgrade"
       end
 
+      # The config dir the helper's chi reads (its home.json, config.yml):
+      # the launch file's XDG_CONFIG_HOME when baked, else ~/.config.
+      # @return [String]
+      def launch_config_home
+        baked = read_launch["env"]
+        dir = baked["XDG_CONFIG_HOME"] if baked.is_a?(Hash)
+        # Spelled out: Paths.config_home's ~ is this process's HOME, not @env's.
+        dir.to_s.empty? ? File.join(@env["HOME"] || Dir.home, ".config") : dir
+      end
+
+      # Whether the helper's chi reads this chi's config dir (home.json,
+      # config.yml): false for a run with XDG_CONFIG_HOME elsewhere (a spec,
+      # a smoke run), whose home and bundles the helper never sees, though
+      # its launch file sits under the real ~/Library.
+      def reads_this_config?
+        File.expand_path(launch_config_home) == Paths.config_home(env: @env)
+      end
+
       # The chi version the launch file names, nil without one.
       def launch_version = read_launch["version"]
 
@@ -316,10 +334,7 @@ module Samagotchi
       # reads: the launch file's XDG_CONFIG_HOME when baked; disabled hosts
       # are left out. @return [Array<Hash>] name:, hosts:, state:
       def host_keys
-        baked = read_launch["env"]
-        dir = baked["XDG_CONFIG_HOME"] if baked.is_a?(Hash)
-        # Spelled out: Paths.config_home's ~ is this process's HOME, not @env's.
-        config_env = { "XDG_CONFIG_HOME" => dir.to_s.empty? ? File.join(@env["HOME"] || Dir.home, ".config") : dir }
+        config_env = { "XDG_CONFIG_HOME" => launch_config_home }
         hosts = ConfigFile.hosts_config(env: config_env).values.select(&:api_key_env).group_by(&:api_key_env)
         hosts.map do |name, entries|
           state = if HostKeys.from_keychain(name, env: @env) then :keychain

data/lib/samagotchi/engine.rb

@@ -3044,6 +3044,15 @@ module Samagotchi
       return if pending.nil?
 
       outcome, judged = pending.wait(turn.controller)
+      if outcome == :timeout
+        # The session starts on its default without a word otherwise: a
+        # slow System 1 host (a local one) is the usual cause.
+        timeout_ms = SystemOne::Client.configured_timeout_ms
+        Log.warn(:toolkit, "toolkit_suggest_timeout", session_id: turn.session.id, timeout_ms: timeout_ms,
+                                                      reason: "System 1 gave no answer within guardrails.system_one.timeout_ms")
+        @toolkit_binding.fell_back(turn.session, "System 1 took over #{timeout_ms} ms")
+        return
+      end
       unless outcome == :answered
         Log.info(:toolkit, "toolkit_suggest_#{outcome}", session_id: turn.session.id)
         return
@@ -3070,6 +3079,10 @@ module Samagotchi
                                                                             deferred: ToolkitSuggest.model_reply?(session.messages))
         switched ? "suggested" : "chosen"
       when "defer" then "defer"
+      when "no_judgment"
+        # System 1 failed (its own warn) or answered nothing usable.
+        @toolkit_binding.fell_back(session, "System 1 gave no answer")
+        "default"
       else "default"
       end
     end