samagotchi 0.133.0 → 0.134.0

data/lib/samagotchi/guardrails/parent_approvals.rb

@@ -42,7 +42,7 @@ module Samagotchi
       MEMORY_REMOVE_RULE = "memory-remove"
       # The guardrails bundle's shell-touches-chi, for a word it can't
       # resolve to a path (Guardrails::ShellPaths): CHI_TEXT and .git/hooks.
-      CHI_SHELL_TEXT = Regexp.union(CHI_TEXT, %r{\.git/hooks})
+      CHI_SHELL_TEXT = Regexp.union(CHI_TEXT, %r{\.git/(?:modules/\S+/)?hooks})
 
       module_function
 

data/lib/samagotchi/guardrails/read_only_shell.rb

@@ -98,12 +98,44 @@ module Samagotchi
         text = command.to_s
         return false if text.strip.empty?
 
-        commands = split(ShellLex.lex(text)) or return false
-        !commands.empty? && commands.all? { |words| simple_read_only?(words) }
+        tokens_read_only?(ShellLex.lex(text))
       rescue ArgumentError, EncodingError
         false
       end
 
+      def tokens_read_only?(tokens)
+        commands = split(tokens) or return false
+        !commands.empty? && commands.all? { |words| simple_read_only?(words) }
+      end
+
+      # Operators that end a part of a list (.read_only_parts) outside ( … ).
+      PART_ENDS = ["&&", "||", ";", "\n"].freeze
+
+      # Per simple command of +tokens+ (ShellLex.lex's; the word lists of
+      # ShellLex.simple_commands, in order), whether the part of the list it
+      # is in only reads: the list split at ;, &&, || and newlines outside
+      # ( … ). A pipe or a group keeps its commands in one part, so
+      # `find . -name x | xargs rm` reads as one part that writes.
+      # @return [Array<Boolean>]
+      def read_only_parts(tokens)
+        parts = [[]]
+        depth = 0
+        tokens.each do |token|
+          kind, value = token
+          depth += 1 if kind == :op && value == "("
+          depth -= 1 if kind == :op && value == ")" && depth.positive?
+          next parts << [] if kind == :op && depth.zero? && PART_ENDS.include?(value)
+
+          parts.last << token
+        end
+        parts.flat_map do |part|
+          read_only = tokens_read_only?(part)
+          ShellLex.simple_commands(part).grep(Array).map { read_only }
+        end
+      rescue ArgumentError, EncodingError
+        ShellLex.simple_commands(tokens).grep(Array).map { false }
+      end
+
       # Whether the command only reads but for writes whose resolved paths
       # the block accepts: > and >> targets, cp's destination (and the
       # files it makes in it) and tee's files. Paths resolve against +cwd+

data/lib/samagotchi/guardrails/shell_git_dirs.rb

@@ -28,7 +28,12 @@ module Samagotchi
       STASH_READS = %w[list show].freeze
       PREFIXES = %w[command builtin exec time nohup env ! { if then else elif do while until].freeze
       # git global options that take the next word as their value.
-      VALUE_OPTIONS = %w[-C -c --git-dir --work-tree --namespace].freeze
+      VALUE_OPTIONS = %w[-C -c --git-dir --work-tree --namespace --attr-source --shallow-file].freeze
+      # The variables that hand git config of their own (another global or
+      # system file, settings as -c gives them) or a template (an init's
+      # hooks): what they set may run a command (Targets::SHELL_REDEFINING_ENV,
+      # PairCommand's refusal). GIT_CONFIG_NOSYSTEM only turns one off.
+      CONFIG_ENV = /\A(?:GIT_CONFIG(?:_GLOBAL|_SYSTEM|_PARAMETERS|_COUNT|_KEY_\d+|_VALUE_\d+)?|GIT_TEMPLATE_DIR)\z/
 
       # @param command [String] the shell command
       # @param cwd [String] where it starts (the call's cwd:, else the session's)

data/lib/samagotchi/guardrails/shell_lex.rb

@@ -63,6 +63,29 @@ module Samagotchi
         commands.reject { |c| c.is_a?(Array) && c.empty? }
       end
 
+      # For each word list .simple_commands gives (its :open / :close
+      # markers left out), whether it reads a pipe: a | or |& comes before
+      # it, a ( between them included (`x | (sh)`).
+      # @return [Array<Boolean>]
+      def self.piped_flags(tokens)
+        flags = []
+        words = 0
+        pending = false
+        piped = false
+        tokens.each do |kind, value|
+          if kind == :op
+            flags << piped if words.positive?
+            words = 0
+            pending = %w[| |&].include?(value) || (value == "(" && pending)
+          else
+            piped = pending if words.zero?
+            words += 1
+          end
+        end
+        flags << piped if words.positive?
+        flags
+      end
+
       # Whether an ( or { group is still open at token +at+: a pipe after
       # the group's ) or } takes what the group prints. The counters never go
       # below 0 (a case pattern's "x)" closes nothing); ((…)) arithmetic and

data/lib/samagotchi/guardrails/shell_paths.rb

@@ -11,7 +11,8 @@ module Samagotchi
     # command is in by then (cd, pushd/popd and ( … ) followed as in
     # ShellGitDirs), with ~, $HOME and the XDG dirs expanded and symlinks
     # resolved. A word names a dir when it is in it. Any path with a
-    # .git/hooks part counts too, outside the tmp dirs.
+    # .git/hooks part (a submodule's .git/modules/<name>/hooks too) counts
+    # too, outside the tmp dirs.
     #
     # A word it can't resolve (another $VAR, $(…), a glob, a relative path
     # after cd $X) or one that reads as a script (sh -c '…', ruby -e '…':
@@ -23,7 +24,7 @@ module Samagotchi
       # A word that is a script rather than a path.
       SCRIPT = /[\s;&|<>()'"`]/
       GLOB = /[*?\[\]{}]/
-      HOOKS_PART = %r{(?:\A|/)\.git/hooks(?:/|\z)}
+      HOOKS_PART = %r{(?:\A|/)\.git/(?:modules/.+/)?hooks(?:/|\z)}
       # $HOME, ${HOME} and the XDG dirs at a word's start (PathResolve's).
       EXPANSION = PathResolve::EXPANSION
       # Where XDG dirs default when unset.

data/lib/samagotchi/guardrails/targets.rb

@@ -46,7 +46,8 @@ module Samagotchi
       # goes, under every shell chi may use or in the programs it runs: a
       # startup file (BASH_ENV, ENV), an exported function (BASH_FUNC_…), a
       # cd search path, word splitting, shell options, a library loaded into
-      # every program, git config or a diff program that runs. A call whose
+      # every program, git config or a diff program that runs (and the rest
+      # of git's config variables: ShellGitDirs::CONFIG_ENV). A call whose
       # env: sets one is never read-only (.redefines_shell?). PATH is not
       # one (the tool's own description suggests it); nor are
       # PROMPT_COMMAND (interactive shells only) and ZDOTDIR (zsh in sh
@@ -250,9 +251,13 @@ module Samagotchi
         {}
       end
 
-      # Whether +env+ sets a SHELL_REDEFINING_ENV variable.
+      # Whether +env+ sets a SHELL_REDEFINING_ENV variable (or a git config
+      # one: ShellGitDirs::CONFIG_ENV).
       def self.redefines_shell?(env)
-        env.each_key.any? { |key| SHELL_REDEFINING_ENV.include?(key) || key.start_with?(SHELL_REDEFINING_PREFIX) }
+        env.each_key.any? do |key|
+          SHELL_REDEFINING_ENV.include?(key) || key.start_with?(SHELL_REDEFINING_PREFIX) ||
+            key.match?(ShellGitDirs::CONFIG_ENV)
+        end
       end
 
       # +path+ (a file tool's, as Tools::ToolPath has it) absolute against

data/lib/samagotchi/home_command.rb

@@ -3,6 +3,7 @@
 require "rbconfig"
 require_relative "chi_home"
 require_relative "home_doctor"
+require_relative "home_notice"
 require_relative "cli/command"
 require_relative "cli/exit"
 require_relative "cli/flags"
@@ -25,8 +26,9 @@ module Samagotchi
         set --ruby PATH   record that Ruby (its own gem dirs) as the home; it must have samagotchi
                           (gem install samagotchi with it first)
         doctor            check the home (its Ruby is there and has samagotchi) and what should
-                          follow it: this chi, the desktop helper, sessions, the tools' chi script,
-                          this project's Gemfile.lock, mise and the last worker's project env
+                          follow it: this chi, the last worker boot, the desktop helper, sessions,
+                          the tools' chi script, this project's Gemfile.lock, mise and the last
+                          worker's project env
         Every chi launch (workers, chi web's restart and Update, the macOS helper's next
         chi desktop install or upgrade) boots the home's Ruby with the home's gems. Saved in
         #{Paths.tilde(ChiHome.path)}.
@@ -42,14 +44,16 @@ module Samagotchi
     # @param path [String] home.json
     # @param probe [#call] (ruby) → ChiHome::Record or nil (ChiHome.probe)
     # @param doctor [#call] (home) → HomeDoctor
+    # @param bundler [Boolean, nil] running under Bundler (nil: found out)
     def initialize(argv, stdout: $stdout, stderr: $stderr, path: ChiHome.path, gem_spec: InstalledGem.spec,
-                   env: ENV, probe: nil, doctor: nil)
+                   env: ENV, probe: nil, doctor: nil, bundler: nil)
       @argv = argv.dup
       @stdout = stdout
       @stderr = stderr
       @path = path
       @gem_spec = gem_spec
       @env = env
+      @bundler = bundler.nil? ? ChiHome.under_bundler?(env) : bundler
       @probe = probe || ->(ruby) { ChiHome.probe(ruby, env: env) }
       @doctor = doctor || lambda { |home|
         HomeDoctor.new(home: home, env: env, gem_spec: gem_spec, helper: HomeDoctor.default_helper(env: env))
@@ -70,6 +74,9 @@ module Samagotchi
     rescue ChiHome::Invalid => e
       error_line("#{command_name}: #{e.message} (chi home set rewrites it)")
       CLI::Exit::FAILED
+    rescue ChiHome::UnderBundler => e
+      error_line("#{command_name}: #{e.message}")
+      CLI::Exit::FAILED
     end
 
     private
@@ -98,12 +105,12 @@ module Samagotchi
       list
     end
 
-    def running_home?(home) = @gem_spec && home.running_here? && home.newest_version.to_s == VERSION
+    def running_home?(home) = @gem_spec && HomeNotice.home?(home)
 
     def running_ruby = "#{RbConfig.ruby}#{" (a checkout)" unless @gem_spec}"
 
     def run_set(options)
-      home = options[:ruby] ? probed(options[:ruby]) : ChiHome.from_running(env: @env)
+      home = options[:ruby] ? probed(options[:ruby]) : running_record
       return CLI::Exit::FAILED unless home
 
       if (problem = ChiHome.problem(home))
@@ -127,13 +134,22 @@ module Samagotchi
         error_line("#{command_name}: no Ruby at #{ruby}")
         return nil
       end
-      return ChiHome.from_running(env: @env) if ChiHome.real(path) == ChiHome.real(RbConfig.ruby)
+      return running_record if ChiHome.real(path) == ChiHome.real(RbConfig.ruby)
 
       home = @probe.call(path)
       error_line("#{command_name}: #{ruby} didn't answer as a Ruby") unless home
       home
     end
 
+    # This process's Ruby and gem path, never under Bundler (the bundle's
+    # gems). Another Ruby is probed with Bundler's variables unset.
+    # @raise [ChiHome::UnderBundler]
+    def running_record
+      raise ChiHome::UnderBundler if @bundler
+
+      ChiHome.from_running(env: @env)
+    end
+
     # The home's rows and what should follow it (HomeDoctor); exit 1 when
     # one fails.
     def run_doctor

data/lib/samagotchi/home_doctor.rb

@@ -7,6 +7,7 @@ require_relative "config"
 require_relative "desktop"
 require_relative "home_notice"
 require_relative "installed_gem"
+require_relative "log_line"
 require_relative "log_path"
 require_relative "paths"
 require_relative "project_env"
@@ -51,18 +52,21 @@ module Samagotchi
     def rows
       list = [home_row]
       if @home && !ChiHome.problem(@home)
-        list.concat([running_row, helper_row, sessions_row, shim_row].compact)
+        list.concat([running_row, boot_row, helper_row, sessions_row, shim_row].compact)
       end
       list.concat([gemfile_row, mise_row, project_env_row].compact)
     end
 
     # The desktop helper chi home doctor checks: this machine's, when it
-    # is installed.
+    # is installed and its chi reads this chi's config dir (home.json's,
+    # Desktop::MacOS#reads_this_config?).
     def self.default_helper(env: ENV)
       return nil unless Desktop.supported?
 
       helper = Desktop::MacOS.new(env: env, register: false)
-      File.file?(helper.launch_path) ? helper : nil
+      return nil unless File.file?(helper.launch_path)
+
+      helper.reads_this_config? ? helper : nil
     end
 
     private
@@ -89,6 +93,35 @@ module Samagotchi
       text && warn_row("#{text}: launches boot the home; chi home set makes this chi the home")
     end
 
+    # The newest worker boot in the debug log since the home was set, when
+    # it is SessionManager::HOME_BOOT_FAILED's line (the home's Ruby
+    # couldn't load chi) rather than a worker's `start`. Without a log
+    # file (log.file off) there is no line to read.
+    def boot_row
+      failed = last_boot_failure
+      return nil unless failed
+
+      ruby = failed.fields["ruby"] || @home.ruby
+      fail_row("the last worker (#{failed.ts}, session #{failed.sid}) failed to boot the home's chi on #{ruby}: " \
+               "#{failed.fields["error"]}: gem install samagotchi with #{ruby} (or chi home set another Ruby), " \
+               "then chi sessions restart #{failed.sid}")
+    end
+
+    def last_boot_failure
+      return nil unless @log_path && File.file?(@log_path)
+
+      since = Time.iso8601(@home.set_at.to_s)
+      newest = nil
+      LogLine.each_tail_record(@log_path, bytes: ProjectEnv::LOG_TAIL_BYTES) do |record|
+        next unless record.tag == "worker" && %w[start boot_failed].include?(record.event)
+
+        newest = record if Time.iso8601(record.ts) >= since
+      end
+      newest if newest&.event == "boot_failed"
+    rescue SystemCallError, ArgumentError
+      nil
+    end
+
     def helper_row
       return nil unless @helper
 

data/lib/samagotchi/home_notice.rb

@@ -48,11 +48,18 @@ module Samagotchi
       nil
     end
 
+    # Whether this chi is +home+'s: it runs on the home's Ruby and gems and
+    # is its newest chi. The one rule for "not the home's chi" (this line,
+    # chi home doctor, chi home's "running" row, chi self's home row).
+    def home?(home, ruby: RbConfig.ruby, gem_dir: Gem.dir, version: VERSION)
+      home.running_here?(ruby: ruby, gem_dir: gem_dir) && home.newest_version.to_s == version
+    end
+
     # This chi isn't the home's: the text, also chi home doctor's row; nil
     # when this process runs on +home+ (or there is none).
     # @return [String, nil]
     def mismatch(home, ruby: RbConfig.ruby, gem_dir: Gem.dir, version: VERSION)
-      return nil if home.nil? || (home.running_here?(ruby: ruby, gem_dir: gem_dir) && home.newest_version.to_s == version)
+      return nil if home.nil? || home?(home, ruby: ruby, gem_dir: gem_dir, version: version)
 
       where = ruby
       # The same Ruby on other gems (a chruby GEM_HOME): name them both.

data/lib/samagotchi/hooks/loader.rb

@@ -165,6 +165,11 @@ module Samagotchi
         end
       end
 
+      # Forgets the cached plugin instances (load_plugin builds new ones;
+      # Ruby's require cache keeps their classes). For tests: the cache is
+      # process-wide.
+      def self.reset_cache! = @plugin_cache = nil
+
       # The plugin's #call under the entry's error policy: a required
       # before_tool_call hook that raises denies the call; otherwise
       # on_error: log warns and skip is silent.

data/lib/samagotchi/log_line.rb

@@ -104,6 +104,18 @@ module Samagotchi
       line.start_with?(INDENT)
     end
 
+    # Yields each Record in the last +bytes+ of the log at +path+ (a torn
+    # first line skipped): chi home doctor's readers.
+    # @raise [SystemCallError]
+    def each_tail_record(path, bytes:, &)
+      File.open(path, "rb") do |io|
+        size = io.size
+        io.seek([size - bytes, 0].max)
+        io.gets if size > bytes
+        each_record(io, &)
+      end
+    end
+
     # Yields each Record of a log (payload lines joined onto theirs). Lines
     # that are neither (an older format, a torn write) go to on_invalid.
     def each_record(io, on_invalid: nil)

data/lib/samagotchi/project_env.rb

@@ -80,7 +80,8 @@ module Samagotchi
     # chi home doctor's row when session.project_env is mise and no mise is found.
     NO_MISE = "project env: no mise found (home.json's, PATH, /opt/homebrew/bin, /usr/local/bin, ~/.local/bin): " \
               "tools run in the env of whoever starts the worker; install mise, or set session.project_env: off"
-    # How much of the debug log's end chi home doctor reads for #last_warning.
+    # How much of the debug log's end chi home doctor reads (#last_warning,
+    # HomeDoctor's boot row).
     LOG_TAIL_BYTES = 4 * 1024 * 1024
 
     # A worker's `project_env` warning from the debug log (#last_warning).
@@ -327,7 +328,7 @@ module Samagotchi
 
       want = Array(dirs).map { |dir| ChiHome.real(dir) }
       newest = {}
-      each_tail_record(log_path) do |record|
+      LogLine.each_tail_record(log_path, bytes: LOG_TAIL_BYTES) do |record|
         next unless record.tag == "worker" && %w[project_env project_env_applied].include?(record.event)
 
         dir = record.fields["dir"]
@@ -342,15 +343,6 @@ module Samagotchi
       nil
     end
 
-    def each_tail_record(log_path, &)
-      File.open(log_path, "rb") do |io|
-        size = io.size
-        io.seek([size - LOG_TAIL_BYTES, 0].max)
-        io.gets if size > LOG_TAIL_BYTES # a torn first line
-        LogLine.each_record(io, &)
-      end
-    end
-
     def configured_mode
       Config.get("session.project_env").to_s
     rescue StandardError

data/lib/samagotchi/self_report.rb

@@ -25,6 +25,7 @@ require_relative "desktop"
 require_relative "live_versions"
 require_relative "web/lan"
 require_relative "chi_home"
+require_relative "home_notice"
 require_relative "project_env"
 
 module Samagotchi
@@ -429,7 +430,8 @@ module Samagotchi
 
       label = "#{home.ruby} (chi #{home.newest_version})"
       return "#{label}; this chi is a source checkout" unless InstalledGem.spec
-      return label if home.running_here?
+      return label if HomeNotice.home?(home)
+      return "#{label}; this chi is #{VERSION}" if home.running_here?
 
       "#{label}; this chi runs on #{RbConfig.ruby}"
     rescue ChiHome::Invalid => e

data/lib/samagotchi/system_one/self_protect.rb

@@ -5,6 +5,7 @@ require_relative "../memory_paths"
 require_relative "../paths"
 require_relative "../guardrails/chi_dirs"
 require_relative "../guardrails/path_resolve"
+require_relative "../guardrails/pair_command"
 require_relative "../guardrails/parent_approvals"
 require_relative "../guardrails/shell_lex"
 require_relative "../guardrails/shell_paths"
@@ -31,7 +32,12 @@ module Samagotchi
     # `/`) read while the dir was known. A word the walk can't follow
     # otherwise (`${PWD%/*}`, `$(dirname $PWD)`, `cd -`) may climb out of the
     # memories dir without saying so, so its memories text stays in and the
-    # text check refuses it.
+    # text check refuses it. So does a script an interpreter or shell runs
+    # that climbs by its own calls (SCRIPT_CLIMB: os.pardir, dirname,
+    # chdir, Dir.pwd, Path.parent, rindex, a slice from the end), and one
+    # chi can't see: a script file it names, or stdin
+    # (Guardrails::PairCommand.script_source). A heredoc or phrase that is
+    # only written (cat >> note <<EOF) is data whatever it says.
     #
     # Pure: it only reads the paths as this process's environment names them,
     # and answers on the approval's own facts (Guardrails::Approval.payload's
@@ -58,6 +64,21 @@ module Samagotchi
         /(?:\A|[\s;&|(])(?:cd|pushd)\s+-(?=[\s;&|)]|\z)/
       )
 
+      # An interpreter's own calls that climb out of a dir or cut a path
+      # from its end, as a script body may spell them without `..` or `$`
+      # (an accident guard, not a parser: a script can always build a path
+      # some other way).
+      SCRIPT_CLIMB = Regexp.union(
+        /\b(?:pardir|dirname|parents?|chdir|getcwd|cwd|pwd|abspath|realpath|normpath|expand_path|absolute_path|
+           resolve|rsplit|rpartition|rindex|rfind|lastIndexOf)\b/x,
+        /\b(?:os\.path|File)\.split\b/, /\[[^\]\[]*:\s*-/
+      )
+
+      # Programs that run a script file (theirs or the dir's) by the words
+      # that make them do it ([]: any call): unseen, like a shell's file.
+      FILE_RUNNERS = { /\Ag?make\z/ => [], /\Arake\z/ => [], /\A[gmn]?awk\z/ => %w[-f], /\Adeno\z/ => %w[run task],
+                       /\A(?:npm|yarn|pnpm|bun)\z/ => %w[run run-script test start exec x] }.freeze
+
       # What resolving a command's words found: whether one lands in chi's
       # dirs (outside the memories dir, or in its installed bundles), and
       # whether every word resolved or is data (#plain).
@@ -133,14 +154,18 @@ module Samagotchi
                 tokens.none? { |_, value| value.include?(Guardrails::ShellLex::SUBST) }
         chi = false
         commands = Guardrails::ShellLex.simple_commands(tokens)
+        pipes = Guardrails::ShellLex.piped_flags(tokens)
         envs = targets ? targets.shell_envs : [[Dir.home, ENV]]
         envs.each do |home, env|
+          piped = pipes.dup
           walk = Guardrails::ShellPaths::Walk.new(cwd.to_s.empty? ? Dir.pwd : cwd.to_s, home, env)
           commands.each do |simple|
             # A cd the walk couldn't follow: no later word is data.
             known = !simple.is_a?(Array) || !walk.paths(".").empty?
+            runs = simple.is_a?(Array) && runs_script?(simple)
+            plain &&= !unseen_script?(simple, piped: simple.is_a?(Array) && piped.shift)
             walk.step(simple).each do |word, path|
-              next plain &&= known && data?(word) unless path
+              next plain &&= known && data?(word) && !(runs && climbs?(word)) unless path
 
               chi ||= Guardrails::PathResolve.reals(path).any? do |real|
                 dirs.any? { |dir| Guardrails::PathResolve.under?(real, dir) } && !memory?(real, memories, bundles)
@@ -165,6 +190,37 @@ module Samagotchi
         word.match?(Guardrails::ShellPaths::GLOB) && !word.include?("/")
       end
 
+      # Whether a simple command hands a script to a shell or interpreter
+      # (one anywhere in it, find -execdir's too) or has a code option.
+      def runs_script?(simple)
+        simple.any? do |word|
+          Guardrails::PairCommand.runner?(word) || Guardrails::PairCommand::CODE_OPTIONS.include?(word)
+        end
+      end
+
+      # Whether a simple command runs a script chi can't see: its shell or
+      # interpreter (any version's name: python3.12, pypy3, Rscript, tclsh)
+      # runs a file or stdin, a pipe into it included whatever its options
+      # (Guardrails::PairCommand.script_source), or another program runs a
+      # file of the dir it is in (FILE_RUNNERS: make, awk -f, deno run,
+      # npm run).
+      def unseen_script?(simple, piped: false)
+        return false unless simple.is_a?(Array)
+        return true if %i[file stdin].include?(Guardrails::PairCommand.script_source(simple, piped: piped))
+
+        simple.each_with_index.any? do |word, i|
+          next false if word.include?("\0")
+
+          verbs = FILE_RUNNERS.find { |pattern, _| File.basename(word).match?(pattern) }&.last
+          verbs && (verbs.empty? || simple[(i + 1)..].intersect?(verbs))
+        end
+      end
+
+      # Whether a script word, its memories text aside, climbs (SCRIPT_CLIMB).
+      def climbs?(word)
+        word.match?(Guardrails::ShellPaths::SCRIPT) && word.gsub(memories_text, "").match?(SCRIPT_CLIMB)
+      end
+
       # chi's own dirs (ParentApprovals.chi_dirs) and its whole state dir
       # (DEFAULT_STATE_TEXT's), resolved (Guardrails::ChiDirs.self_protect).
       def chi_dirs = Guardrails::ChiDirs.self_protect

data/lib/samagotchi/testing/waiting.rb

@@ -108,6 +108,19 @@ module Samagotchi
         value
       end
 
+      # A wall-clock upper bound for "this didn't take the full wait"
+      # (expect(elapsed).to be < time_bound(3, below: 5)): +seconds+ scaled,
+      # so a slow runner gets the headroom a helper's deadline gets, and kept
+      # under +below+, the unscaled deadline (a lib timeout, a hung child's
+      # sleep) the bound tells apart from, so the check still fails on the
+      # full wait whatever SPEC_TIME_SCALE is. A bound with nothing to tell
+      # apart from (a cost: "no quadratic blow-up") takes no +below+.
+      # @return [Float]
+      def time_bound(seconds, below: nil)
+        bound = Waiting.scaled(seconds)
+        below ? [bound, below].min : bound
+      end
+
       # Whether no process +pid+ is left (a killed grandchild is reaped a
       # moment later: wait_for("pid gone") { process_gone?(pid) }). One that
       # isn't ours to signal is still there (ProcessGroup.alive?).

data/lib/samagotchi/toolkit_binding.rb

@@ -155,6 +155,22 @@ module Samagotchi
       true
     end
 
+    # On mode's ask gave the turn no suggestion to judge (Engine
+    # #settle_toolkit_suggestion: a timeout, no answer): say, as a warn
+    # notice, that +session+ runs its default (not once a toolkit was
+    # chosen meanwhile). +why+ is fallback_notice's.
+    def fell_back(session, why)
+      return if session.nil? || session.toolkit_origin != "default"
+
+      @notify.call(self.class.fallback_notice(Toolkit.of(session.toolkit).name, why), :warn, "toolkit", extra: {})
+    end
+
+    # "toolkit: full (no suggestion: System 1 took over 5000 ms) · /toolkit
+    # to change"; +why+ follows "no suggestion: ".
+    def self.fallback_notice(name, why)
+      "toolkit: #{name} (no suggestion: #{why}) · /toolkit to change"
+    end
+
     # "toolkit: smoke (suggested, p=0.71) · /toolkit to change"; a
     # deferred switch says "from this turn".
     def self.suggestion_notice(name, confidence, deferred:)

data/lib/samagotchi/update_command.rb

@@ -3,6 +3,7 @@
 require_relative "cli/command"
 require_relative "cli/flags"
 require_relative "chi_home"
+require_relative "child_env"
 require_relative "config"
 require_relative "desktop"
 require_relative "gem_update"
@@ -89,7 +90,7 @@ module Samagotchi
       # Built after the home is known: its install env goes into the home.
       @gem_update_given = gem_update
       @exec = exec || ->(argv) { Kernel.exec(*argv) }
-      @bundler = bundler.nil? ? (defined?(::Bundler) || !ENV["BUNDLE_GEMFILE"].to_s.empty?) : bundler
+      @bundler = bundler.nil? ? ChiHome.under_bundler? : bundler
       @argv = argv.dup
       @stdout = stdout
       @stderr = stderr
@@ -168,11 +169,14 @@ module Samagotchi
 
     # A chi on another Ruby than the home's updates the home: exec its chi
     # (newer?, --to and the bundle rows are then the home's), once
-    # (IN_HOME_ENV).
+    # (IN_HOME_ENV), outside a `bundle exec`'s bundle (ChildEnv.unbundled,
+    # as worker spawns and chi web's restart boot it). hand_over never runs
+    # under Bundler: the gem row skips there.
     def to_home(options)
       notice(options, "updating the chi home (#{@run_home.ruby})")
       @stdout.flush
-      @exec.call([{ IN_HOME_ENV => "1" }, *@run_home.boot_argv(run: ChiHome::CHI_BOOT), "--", "update", *@argv])
+      @exec.call([ChildEnv.unbundled.merge(IN_HOME_ENV => "1"), *@run_home.boot_argv(run: ChiHome::CHI_BOOT), "--",
+                  "update", *@argv])
       0 # only when exec is a spec's stand-in
     end
 

data/lib/samagotchi/update_hint.rb

@@ -52,8 +52,13 @@ module Samagotchi
       "chi #{version}: #{parts.join(" and ")} can be updated: chi update"
     end
 
+    # The helper whose chi reads this chi's config dir: an isolated run
+    # (XDG_CONFIG_HOME elsewhere) never hints about the real one.
     def default_helper(env)
-      Desktop.supported? ? Desktop::MacOS.new(env: env) : nil
+      return nil unless Desktop.supported?
+
+      helper = Desktop::MacOS.new(env: env, register: false)
+      helper.reads_this_config? ? helper : nil
     end
   end
 end

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.133.0"
+  VERSION = "0.134.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end