samagotchi 0.134.0 → 0.135.0

data/lib/samagotchi/guardrail_wiring.rb

@@ -330,9 +330,10 @@ module Samagotchi
         return verdict
       end
 
-      answer = @ask.call(payload)
+      # The card and the session file carry the facts as the hash they were.
+      answer = @ask.call(payload.merge(approval: payload[:approval].to_h))
       system_one_label(judgment, answer, payload)
-      Guardrails::Approval.settle(verdict, answer, payload[:approval][:scopes])
+      Guardrails::Approval.settle(verdict, answer, payload[:approval].scopes)
     end
 
     private
@@ -391,9 +392,9 @@ module Samagotchi
       decision = system_one_decision(client, auto)
 
       id = log.judgment(session_id: @session_lookup.call&.id,
-                        rule: approval[:rule], source: approval[:source], tool: approval[:tool],
+                        rule: approval.rule, source: approval.source, tool: approval.tool,
                         **SystemOne::ApprovalQuestion.call_fields(approval),
-                        repo_name: approval[:repo_name],
+                        repo_name: approval.repo_name,
                         p: p, threshold: Config.get("guardrails.system_one.threshold"), model: client.model,
                         latency_ms: latency_ms, decision: decision, origin: "live")
       # A judgment the log cannot hold is no judgment: the user is asked.
@@ -418,12 +419,13 @@ module Samagotchi
     # user opted in, the never-list and chi's own files, the probability, and
     # the rule's record. Any one that fails leaves the ask to the user. The
     # entries are the judgment log read once for this ask.
+    # @param approval [Guardrails::ApprovalFacts] the ask's facts
     # @param entries [Array<Hash>] SystemOne::Log#entries
     # @param targets [Guardrails::Targets, nil] the call's, for its env:
     def system_one_auto_allow?(client, approval, p, entries, targets: nil)
       return false unless client.mode == "on"
 
-      rule = approval[:rule].to_s
+      rule = approval.rule.to_s
       return false if rule.empty?
       return false unless system_one_rules.include?(rule)
       return false if SystemOne::SelfProtect.refuse?(approval, targets: targets)
@@ -456,7 +458,7 @@ module Samagotchi
       id = judgment && judgment[:id]
       return nil if id.nil?
 
-      scopes = Array(payload[:approval][:scopes])
+      scopes = Array(payload[:approval].scopes)
       if !answer.is_a?(Samagotchi::QuestionAnswer)
         label = "none"
       elsif answer.parent_agent?

data/lib/samagotchi/guardrails/approval.rb

@@ -6,6 +6,41 @@ require_relative "../question_answer"
 
 module Samagotchi
   module Guardrails
+    # An ask's facts, as Approval.payload builds them (its approval:) and
+    # the question card shows them: the tool (tool, acts_as, label), what
+    # it acts on (command, paths, args, memory), where (cwd, repo_root,
+    # repo_name, branch), who asked and why (rule, source, reason), the
+    # offered scopes, an edit's preview (EditPreview.for) and, for a
+    # participant's turn, who asks (author, author_name, asked_by).
+    #
+    # In this process it is passed as this value; it crosses to the UIs and
+    # the session file (PendingQuestion's approval) as #to_h, the hash it
+    # always was: symbol keys, in member order, unset fields left out. A
+    # saved or sent one (string or symbol keys, missing fields, a key we
+    # don't know dropped) comes back through .from_h. memory and preview
+    # stay as given (string keys inside after a load).
+    ApprovalFacts = Data.define(:tool, :acts_as, :label, :command, :paths, :args, :memory, :cwd, :repo_root,
+                                :repo_name, :branch, :rule, :source, :reason, :scopes, :preview, :author,
+                                :author_name, :asked_by) do
+      def initialize(**fields)
+        super(**members.to_h { |m| [m, nil] }, **fields)
+      end
+
+      # @param raw [ApprovalFacts, Hash, nil] facts as built, saved or sent
+      # @return [ApprovalFacts, nil] nil for anything that is not facts
+      def self.from_h(raw)
+        return raw if raw.is_a?(ApprovalFacts)
+        return nil unless raw.is_a?(Hash)
+
+        new(**members.to_h { |m| [m, raw.key?(m) ? raw[m] : raw[m.to_s]] })
+      end
+
+      # The card's and the session file's shape: symbol keys, in member
+      # order, unset fields left out.
+      # @return [Hash{Symbol => Object}]
+      def to_h = super.compact
+    end
+
     # An ask as a question for the user (Engine#open_question), and the
     # answer back as a verdict. The question text is plain and complete, so
     # a UI that doesn't know approvals still shows everything; `approval:`
@@ -42,9 +77,10 @@ module Samagotchi
       #   their turn asks: it offers once only (PARTICIPANT_SCOPES), and the
       #   card names them (approval author:, author_name:, the header)
       # @param author_name [String, nil] their name (participants.json)
-      # @return [Hash] open_question fields; its caller adds user_only:
-      #   (ParentApprovals.protected_facts? on approval:, a file that
-      #   requires this one)
+      # @return [Hash] open_question fields, with approval: an ApprovalFacts
+      #   (its caller hands open_question approval.to_h); the caller adds
+      #   user_only: (ParentApprovals.protected_facts? on approval:, a file
+      #   that requires this one)
       def payload(verdict, label: nil, preview: nil, only: nil, author: nil, author_name: nil)
         asker = asker(author, author_name)
         only = PARTICIPANT_SCOPES if asker
@@ -60,7 +96,7 @@ module Samagotchi
           allow_freeform: true,
           effects: effects(scopes),
           kind: KIND,
-          approval: {
+          approval: ApprovalFacts.new(
             tool: targets&.tool || verdict.call[:name].to_s,
             # The tool the call acts as (an MCP tool behind call_tool).
             acts_as: targets&.acts_as,
@@ -86,7 +122,7 @@ module Samagotchi
             author: (author.to_s if asker),
             author_name: (author_name_for(author_name) if asker),
             asked_by: (format(ASKED_BY, asker) if asker)
-          }.compact
+          )
         }
       end
 

data/lib/samagotchi/guardrails/implicit_writers.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "shell_lex"
+
 module Samagotchi
   module Guardrails
     # Programs that write outside the folder they run in with no word of
@@ -61,9 +63,10 @@ module Samagotchi
         "gh" => [[%w[auth], %w[login logout refresh setup-git switch]], [%w[config], %w[set]],
                  [%w[extension extensions ext], %w[install upgrade remove]], [%w[alias], %w[set delete import]]],
         # the global config and a launchd/cron schedule; git lfs's global filters
-        "git" => [[%w[maintenance], %w[register start unregister stop]], [%w[lfs], %w[install uninstall]]],
+        # (git's first group is its subcommand: .git_outside?)
+        "git" => [[%w[maintenance], %w[register start unregister stop]], [%w[lfs], %w[install uninstall update]]],
         "git-maintenance" => [[%w[register start unregister stop]]],
-        "git-lfs" => [[%w[install uninstall]]],
+        "git-lfs" => [[%w[install uninstall update]]],
         "scalar" => [[%w[register unregister clone reconfigure delete]]]
       }.freeze
       # program => the verbs (its first argument) that only read: every
@@ -89,9 +92,9 @@ module Samagotchi
 
       module_function
 
-      # The table's name for +program+ (a word's basename).
+      # The table's name for +program+ (its word's ShellLex.program_name).
       def name(program)
-        base = File.basename(program.to_s)
+        base = ShellLex.program_name(program)
         ALIASES.each { |pattern, to| return to if base.match?(pattern) }
         base
       end
@@ -108,6 +111,7 @@ module Samagotchi
         return bundle_config_outside?(args) if program == "bundle" && args.first == "config"
 
         entries = BY_VERB[program] or return false
+        return git_outside?(entries, args, assigned) if program == "git"
         return false unless entries.any? { |groups| groups.all? { |group| group?(group, args, assigned) } }
         return true unless LOCAL_INSTALLERS.include?(program)
         return true if args.include?("--user")
@@ -115,6 +119,17 @@ module Samagotchi
         !(local || args.any? { |arg| arg.match?(PLACE_OPTIONS) })
       end
 
+      # git's entries match from its subcommand on (PairCommand.git_command_starts:
+      # git -C . maintenance start), the first group holding the subcommand,
+      # not its words anywhere (git add maintenance start, git commit -m lfs -m install).
+      def git_outside?(entries, args, assigned)
+        PairCommand.git_command_starts(args).grep(Integer).any? do |i|
+          entries.any? do |first, *rest|
+            first.include?(args[i]) && rest.all? { |group| group?(group, args[(i + 1)..], assigned) }
+          end
+        end
+      end
+
       def group?(group, args, assigned)
         group == :global ? global?(args, assigned) : args.intersect?(group)
       end

data/lib/samagotchi/guardrails/pair_boundary.rb

@@ -97,6 +97,8 @@ module Samagotchi
                "owner's cookies"
       LISTENER = "a participant's turn can't listen on a port: what it serves on this machine could catch the " \
                  "owner's browser cookies"
+      NET = "a participant's turn runs a command chi can't read for sure (git or chi behind a program it doesn't " \
+            "know, or a $(…) kept in a value the shell expands later), so the owner approves it"
       VERB = "a participant's turn runs only a program named plainly: no $, $(…) or glob in a command's name"
       UNREADABLE = "a participant's turn runs only commands chi can read: split this command, or write the file " \
                    "with the write tool"
@@ -195,13 +197,15 @@ module Samagotchi
 
       # Why the owner is asked (fresh, once): a command that makes a link
       # (LINK), one that runs mise or direnv (ENV_LOADER), a write to mise's
-      # config (MISE_CONFIG), a write that may land outside the project (OUTSIDE_WRITE, or
+      # config (MISE_CONFIG), a command chi can't read for sure (NET:
+      # PairCommand#net_ask?), a write that may land outside the project (OUTSIDE_WRITE, or
       # NO_PROJECT without one); nil when nothing asks.
       def ask_reason(verdict)
         targets = verdict.targets
         return LINK if targets&.command && command(targets, nil).links?
         return ENV_LOADER if targets&.command && command(targets, nil).loads_env?
         return MISE_CONFIG if mise_config_write?(verdict)
+        return NET if targets&.command && command(targets, nil).net_ask?
         return nil unless outside_write?(verdict)
 
         project_root ? OUTSIDE_WRITE : NO_PROJECT