samagotchi 0.152.0 → 0.154.0

data/lib/samagotchi/turn_endings.rb

@@ -34,7 +34,7 @@ module Samagotchi
 
     # What the session keeps of a turn that ended normally (nil: nothing to
     # replace). Runs under the event lock: it also adds the turn's note to
-    # result.conversation, which the REPL keeps as-is.
+    # result.conversation, which the session keeps as-is.
     # A turn that ran out of iterations ends at its tool results, so a
     # continue resumes from them rather than after a made-up reply (and a
     # step-limit Continue from its run's start: ModelResult#run_start).
@@ -43,7 +43,7 @@ module Samagotchi
       # Nothing visible (no text) is a turn the model should know ended
       # that way: the note, and nothing made up as its answer. The note's
       # marker is for the UIs (the notice, and the empty steps after a
-      # reload); it goes on the result's conversation too (the REPL keeps it).
+      # reload); it goes on the result's conversation too (the session keeps it).
       # A retry's nudge at the tail goes: this note says it all. An earlier
       # turn's note stays: it says why that turn ended.
       if result.empty_answer?

data/lib/samagotchi/turn_flow.rb

@@ -6,8 +6,8 @@ require_relative "context_note"
 require_relative "llm/errors"
 
 module Samagotchi
-  # The state around turns that the REPL and a session worker share, kept out
-  # of either loop: the pre-turn checkpoint (what !rollback and a failed turn
+  # The state around turns a session worker (and a one-shot) keeps out of
+  # its loop: the pre-turn checkpoint (what !rollback and a failed turn
   # restore), the continue offer after a turn that ran out of iterations, and
   # the checkpoint a continue turn starts from.
   #
@@ -189,9 +189,8 @@ module Samagotchi
     end
 
     # Restore the pre-turn checkpoint (!rollback after a Ctrl-C). A pending
-    # offer goes too: the turn it offered to continue is gone. (The REPL
-    # reads every line as an answer while an offer is pending; a worker
-    # also takes !rollback then.) The cards' places follow the messages
+    # offer goes too: the turn it offered to continue is gone. (A worker
+    # takes !rollback while an offer is pending.) The cards' places follow the messages
     # (Bridge::CardStore).
     # @return [Boolean] false when there is none
     def rollback!

data/lib/samagotchi/update_hint.rb

@@ -7,8 +7,8 @@ require_relative "session"
 require_relative "version"
 
 module Samagotchi
-  # One line at the first interactive start of a new chi version (REPL,
-  # attached, chi web) when something chi update would update is behind:
+  # One line at the first interactive start of a new chi version (a
+  # terminal, chi web) when something chi update would update is behind:
   # "chi 0.3.1: 2 bundles and the desktop helper can be updated: chi update".
   # Noted once per version in $XDG_STATE_HOME/samagotchi/update_noted,
   # whether or not anything was behind. No network; nothing is changed (the

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.152.0"
+  VERSION = "0.154.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -12,6 +12,7 @@ require "rack/request"
 
 require_relative "../analytics_file"
 require_relative "../client_id"
+require_relative "../degrade"
 require_relative "../delivery"
 require_relative "../answer_tail"
 require_relative "../answer_refs"
@@ -969,11 +970,7 @@ module Samagotchi
 
         root = dir && ProjectScope.root_for(dir)
         # Lazy retention sweep (once per 24h)
-        begin
-          @manager.retention_sweep_if_due(state_dir: @state_dir)
-        rescue StandardError
-          nil
-        end
+        Degrade.call(:web, "retention_sweep_failed") { @manager.retention_sweep_if_due(state_dir: @state_dir) }
         limit = sanitize_limit(req.params["limit"])
         offset = sanitize_offset(req.params["offset"])
         all = @hub.snapshot(project_root: root, sort: sanitize_sort(req.params["sort"]), order: sanitize_order(req.params["order"]))
@@ -1056,8 +1053,8 @@ module Samagotchi
       # A line the page sent, once the worker took it, into the shared prompt
       # history; "history": false (an image-only send's placeholder text)
       # keeps it out. A failed write never fails the send. There's no scratch
-      # check: a live scratch session is the REPL's (OwnedByTUI, 409 before
-      # any delivery), and one whose REPL died is left as an edge case.
+      # check: a scratch session is refused before any delivery
+      # (SessionManager::ScratchSession, an OwnedByTUI: 409).
       def record_history(body, line)
         return if body["history"] == false
 
@@ -1067,11 +1064,7 @@ module Samagotchi
       end
 
       def handle_models(_req)
-        default = begin
-          ModelProfile.required_model_name
-        rescue StandardError
-          nil
-        end
+        default = Degrade.call(:web, "default_model_unresolved") { ModelProfile.required_model_name }
         models = []
         warnings = []
         begin
@@ -1156,35 +1149,35 @@ module Samagotchi
       # and each model's LLM context (LLMContextStrategy::Explained#summary).
       # A config that can't be read leaves the list as it is.
       def add_sampling(models, registry)
-        return if registry.nil? || models.empty?
-
-        settings = ConfigFile.model_settings
-        models.each do |model|
-          target = registry.resolve(model[:name])
-          names = registry.lookup_names(model[:name], target: target)
-          summary = SamplingSettings.summary(target, names: names, models: settings)
-          model[:sampling] = summary if summary
-          add_llm_context(model, target, names, settings)
-          add_thinking(model, target, names, settings)
+        Degrade.call(:web, "model_sampling_unreadable") do
+          return if registry.nil? || models.empty?
+
+          settings = ConfigFile.model_settings
+          models.each do |model|
+            target = registry.resolve(model[:name])
+            names = registry.lookup_names(model[:name], target: target)
+            summary = SamplingSettings.summary(target, names: names, models: settings)
+            model[:sampling] = summary if summary
+            add_llm_context(model, target, names, settings)
+            add_thinking(model, target, names, settings)
+          end
         end
-      rescue StandardError
-        nil
       end
 
       # The LLM context +model+ starts under (the start page's ⚙ panel);
       # one that can't be read leaves this model without, not the others.
       def add_llm_context(model, target, names, settings)
-        model[:llm_context] = LLMContextStrategy.explain(target, names: names, models: settings).summary(nil)
-      rescue StandardError
-        nil
+        Degrade.call(:web, "model_llm_context_unreadable") do
+          model[:llm_context] = LLMContextStrategy.explain(target, names: names, models: settings).summary(nil)
+        end
       end
 
       # The thinking level +model+ starts at, with where it came from (the
       # start page's ⚙ panel; SettingExplained#summary, no session).
       def add_thinking(model, target, names, settings)
-        model[:thinking] = Thinking.explain(target, names: names, models: settings).summary
-      rescue StandardError
-        nil
+        Degrade.call(:web, "model_thinking_unreadable") do
+          model[:thinking] = Thinking.explain(target, names: names, models: settings).summary
+        end
       end
 
       # The served model a session's last generation reported (analytics.json,
@@ -1193,25 +1186,25 @@ module Samagotchi
       # Engine#served_model does, with the host whose served: expects it.
       # {} when none applies.
       def saved_served_model(session, persisted)
-        served = persisted["served_model"]
-        model = session.model_name.to_s
-        return {} unless served.is_a?(String) && !served.empty? && !model.empty?
+        Degrade.call(:web, "served_model_unreadable", fallback: {}) do
+          served = persisted["served_model"]
+          model = session.model_name.to_s
+          return {} unless served.is_a?(String) && !served.empty? && !model.empty?
 
-        registry = host_registry
-        asked = registry.bare_name(model)
-        return {} unless persisted["served_model_for"] == asked
+          registry = host_registry
+          asked = registry.bare_name(model)
+          return {} unless persisted["served_model_for"] == asked
 
-        { served_model: served, served_model_for: asked, served_expected_by: saved_served_expected_by(registry, model, served) }
-      rescue StandardError
-        {}
+          { served_model: served, served_model_for: asked, served_expected_by: saved_served_expected_by(registry, model, served) }
+        end
       end
 
       # See ServedModel.expected_by; nil when the model doesn't resolve (the
       # mismatch still shows).
       def saved_served_expected_by(registry, model, served)
-        ServedModel.expected_by(registry.resolve(model), served)
-      rescue StandardError
-        nil
+        Degrade.call(:web, "served_expected_by_unresolved") do
+          ServedModel.expected_by(registry.resolve(model), served)
+        end
       end
 
       # Built again when config.yml's hosts: changed (compared as read: the
@@ -1343,9 +1336,9 @@ module Samagotchi
 
       # The process holding the session (an OwnerLock::Owner), or nil. A worker always runs a Bridge; a TUI (plain `chi`) doesn't share.
       def session_owner(id)
-        @manager.session_owner(id, state_dir: @state_dir)
-      rescue StandardError
-        nil
+        Degrade.call(:web, "session_owner_unreadable") do
+          @manager.session_owner(id, state_dir: @state_dir)
+        end
       end
 
       # ── The working set (web.working_set) ───────────────────────────────
@@ -1871,11 +1864,7 @@ module Samagotchi
         # Try ISO8601, then float timestamp
         Time.iso8601(val.to_s)
       rescue ArgumentError
-        begin
-          Time.at(Float(val.to_s))
-        rescue StandardError
-          nil
-        end
+        Degrade.call(:web, "since_unparsable") { Time.at(Float(val.to_s)) }
       end
 
       def default_state_dir

data/lib/samagotchi/web/participant_access.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
-require_relative "grants"
+require_relative "../grants"
 require_relative "principal"
 require_relative "participant_view"
 require_relative "../archive_store"
@@ -19,7 +19,7 @@ require_relative "../log"
 
 module Samagotchi
   module Web
-    # What a participant (a Web::Grants token) may do in chi web, mixed into
+    # What a participant (a Grants token) may do in chi web, mixed into
     # App: the gate's lookup of their grant, the refusals that are theirs
     # (token_revoked, token_expired with its ended page, token_bound for a
     # link bound to another account, another session's

data/lib/samagotchi/web/participant_review.rb

@@ -3,7 +3,7 @@
 require_relative "participant_view"
 require_relative "token"
 require_relative "participant_stream_filter"
-require_relative "participant_exposure"
+require_relative "../participant_exposure"
 require_relative "../session_metrics"
 require_relative "../review_start"
 require_relative "../guardrails/review_paths"
@@ -44,7 +44,7 @@ module Samagotchi
       # cookie value.
       def participant_viewer(req, session)
         author = principal(req).owner? ? nil : principal(req).grant.author
-        ParticipantView::Viewer.new(author: author, cwd: session.working_directory, secrets: owner_secrets)
+        Redact::Viewer.new(author: author, cwd: session.working_directory, secrets: owner_secrets)
       end
 
       def owner_secrets
@@ -119,7 +119,7 @@ module Samagotchi
 
       def review_subject(path, full, viewer)
         raw = File.open(full, File::RDONLY | File::NOFOLLOW | File::BINARY) { |file| file.read(SUBJECT_BYTES + 1) }.to_s
-        text = ParticipantView::Redact.text(raw.byteslice(0, SUBJECT_BYTES).force_encoding(Encoding::UTF_8).scrub, viewer)
+        text = Redact.text(raw.byteslice(0, SUBJECT_BYTES).force_encoding(Encoding::UTF_8).scrub, viewer)
         entry = { path: path, text: text, truncated: raw.bytesize > SUBJECT_BYTES }
         markdown = MARKDOWN_EXT.include?(File.extname(path).downcase)
         entry[:html] = @markdown_renderer.render(text) if markdown && @markdown_renderer.available?
@@ -226,7 +226,7 @@ module Samagotchi
         return nil if ref.to_s.empty?
 
         name = host_registry.bare_name(ref.to_s)
-        name.to_s.empty? ? nil : ParticipantView::Redact.text(name.to_s, viewer)
+        name.to_s.empty? ? nil : Redact.text(name.to_s, viewer)
       rescue StandardError
         nil
       end
@@ -235,7 +235,7 @@ module Samagotchi
       # enqueued id, for dequeue, and the text), and how many others wait.
       def review_queue(queued, viewer)
         mine, others = queued.partition { |entry| entry.is_a?(Hash) && viewer.own?(entry["author"]) }
-        { mine: mine.map { |entry| ParticipantView::Redact.deep({ "enqueued_id" => entry["enqueued_id"].to_s, "prompt" => entry["prompt"].to_s }, viewer) },
+        { mine: mine.map { |entry| Redact.deep({ "enqueued_id" => entry["enqueued_id"].to_s, "prompt" => entry["prompt"].to_s }, viewer) },
           others: others.size }
       end
 

data/lib/samagotchi/web/participant_stream_filter.rb

@@ -134,14 +134,14 @@ module Samagotchi
       def hard_cut(id, shown)
         text = @held.sub(/\S*\z/, "")
         # A key word or a key's BEGIN line before that run goes with it.
-        open = ParticipantView::Redact::OPEN_VALUE.match(text[-80..] || text)
+        open = Redact::OPEN_VALUE.match(text[-80..] || text)
         text = text[0, text.size - open[0].size] if open
         @dropped = +""
         @dropped_key = false
         dropping = @held[text.size..]
         @held = +""
         @held << undropped(dropping)
-        frame(id, shown.merge("text" => "#{lines_of(text)}#{ParticipantView::Redact::MARK}"))
+        frame(id, shown.merge("text" => "#{lines_of(text)}#{Redact::MARK}"))
       end
 
       # The last newline (past MAX_HELD, the last space) the held text may
@@ -162,11 +162,11 @@ module Samagotchi
       # a secret's value would go on.
       def open_value?(at)
         from = [at - 80, 0].max
-        ParticipantView::Redact::OPEN_VALUE.match?(@held[from..at])
+        Redact::OPEN_VALUE.match?(@held[from..at])
       end
 
-      SPAN_PATTERNS = (ParticipantView::Redact::PATTERNS - [ParticipantView::Redact::PRIVATE_KEY] +
-                       ParticipantView::Redact::VALUES).freeze
+      SPAN_PATTERNS = (Redact::PATTERNS - [Redact::PRIVATE_KEY] +
+                       Redact::VALUES).freeze
 
       # [from, to) of every match Redact would redact in +text+ (but a
       # private key's block: lines_of withholds it by its lines).
@@ -220,15 +220,15 @@ module Samagotchi
           if @in_key
             @in_key = opens_key?(line) if PEM_END.match?(line)
           elsif opens_key?(line)
-            out << ParticipantView::Redact.text(run, @viewer)
+            out << Redact.text(run, @viewer)
             run = +""
             @in_key = true
-            out << "#{ParticipantView::Redact::MARK}#{"\n" if line.end_with?("\n")}"
+            out << "#{Redact::MARK}#{"\n" if line.end_with?("\n")}"
           else
             run << line
           end
         end
-        out << ParticipantView::Redact.text(run, @viewer)
+        out << Redact.text(run, @viewer)
       end
 
       # Whether +line+ leaves a private key block open: a BEGIN line with

data/lib/samagotchi/web/participant_view.rb

@@ -6,6 +6,7 @@ require_relative "../turn_origin"
 require_relative "../participant_mode"
 require_relative "../revise_anchor"
 require_relative "../verify_anchor"
+require_relative "../redact"
 
 module Samagotchi
   module Web
@@ -23,23 +24,10 @@ module Samagotchi
     # is an allowlist that builds a new hash from named fields, so a field
     # added to an event later never reaches a participant until it is
     # named here, and an event type not named is dropped. Every string
-    # that goes out passes Redact (secret shapes, the owner's token, the
+    # that goes out passes Redact (lib/samagotchi/redact.rb: secret shapes, the owner's token, the
     # home folder), defence in depth only: the allowlist is the control.
     # Pure: no I/O; keys of what comes in may be strings (JSON) or symbols.
     module ParticipantView
-      # Who is looking: +author+ the participant's ("p:<id>"; nil for the
-      # owner through the participant view: nothing is theirs), +cwd+ the
-      # session's folder (tool paths are shown relative to it, only inside
-      # it), +home+ the folder shown as ~, +secrets+ literal strings never
-      # shown (the owner's token).
-      Viewer = Data.define(:author, :cwd, :home, :secrets) do
-        def initialize(author: nil, cwd: nil, home: Dir.home, secrets: [])
-          super(author: author, cwd: cwd, home: home, secrets: Array(secrets).map(&:to_s).reject(&:empty?))
-        end
-
-        def own?(author) = !self.author.nil? && author.to_s == self.author
-      end
-
       # A turn's participant_mode values the view passes on (ParticipantMode).
       PARTICIPANT_MODES = [ParticipantMode::REVIEW.to_s, ParticipantMode::PAIR.to_s].freeze
 
@@ -431,74 +419,6 @@ module Samagotchi
 
         hash.key?(key) ? hash[key] : hash[key.to_s]
       end
-
-      # Secret shapes and host paths out of what a participant gets (the
-      # session's folder as relative paths, home as ~). Defence in depth: the
-      # allowlist above is the control; this catches a key the model quoted
-      # in a reply, or one in a prompt.
-      module Redact
-        MARK = "[redacted]"
-        PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----.*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|\z)/m
-        PATTERNS = [
-          PRIVATE_KEY,
-          /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/,
-          /\bgh[pousr]_[A-Za-z0-9]{20,}/,
-          /\bgithub_pat_[A-Za-z0-9_]{20,}/,
-          /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
-          /\bxox[abprs]-[A-Za-z0-9-]{10,}/,
-          /\bchp_[A-Za-z0-9_-]{20,}/,
-          # A one-time link code (LinkCodes::CODE_RE): a bearer credential
-          # until its grant expires (an owner's, 10 minutes).
-          /\bchc_[A-Za-z0-9_-]{43}/,
-          /\bAIza[0-9A-Za-z_-]{30,}/,
-          /\b[rs]k_(?:live|test)_[A-Za-z0-9]{16,}/,
-          /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/,
-          %r{https://hooks\.slack\.com/services/[A-Za-z0-9/_-]+}
-        ].freeze
-        # The value after an Authorization (or a Bridge's secret,
-        # BridgeSecret::HEADER) header or a token=/key= pair.
-        VALUES = [
-          /(\b(?:Authorization|X-Chi-Bridge):\s*(?:Bearer\s+|Basic\s+|Token\s+)?)[^\s"'`]+/i,
-          /((?<![A-Za-z0-9])[A-Za-z0-9_-]*?(?:token|api[_-]?key|access[_-]?key|secret|password|passwd)["']?\s*[=:]\s*["']?)[^\s"'&`,;}]+/i,
-          # A URL's password: scheme://user:PASSWORD@host.
-          %r{(\b[a-z][a-z0-9+.-]*://[^/\s:@]+:)[^@\s/]+(?=@)}i
-        ].freeze
-        # A text that ends where one of VALUES' values (or a private key's
-        # BEGIN line) would go on: a stream cut there would send the value
-        # on its own, unredacted (ParticipantStreamFilter never cuts there).
-        OPEN_VALUE = /(?:\b(?:Authorization|X-Chi-Bridge):\s*(?:(?:Bearer|Basic|Token)\s*)?|[A-Za-z0-9_-]*?(?:token|api[_-]?key|access[_-]?key|secret|password|passwd)["']?\s*(?:[=:]\s*["']?)?|-----BEGIN [A-Z0-9 ]*)\z/i
-
-        module_function
-
-        # +value+ with every string in it redacted (hash values, array items).
-        def deep(value, viewer)
-          case value
-          when String then text(value, viewer)
-          when Hash then value.transform_values { |item| deep(item, viewer) }
-          when Array then value.map { |item| deep(item, viewer) }
-          else value
-          end
-        end
-
-        def text(value, viewer)
-          out = value.dup
-          viewer.secrets.each { |secret| out = out.gsub(secret, MARK) }
-          PATTERNS.each { |pattern| out = out.gsub(pattern, MARK) }
-          VALUES.each { |pattern| out = out.gsub(pattern) { "#{Regexp.last_match(1)}#{MARK}" } }
-          out = within(out, viewer.cwd.to_s)
-          home = viewer.home.to_s
-          out = out.gsub(%r{#{Regexp.escape(home)}(?=/|\b|\z)}, "~") if home.length > 1
-          out
-        end
-
-        # +text+ with +dir+ (the session's folder) shown relative: "dir/x"
-        # as "x", "dir" alone as ".".
-        def within(text, dir)
-          return text if dir.length < 2
-
-          text.gsub(%r{#{Regexp.escape(dir)}(/|(?=\b|\z))}) { Regexp.last_match(1) == "/" ? "" : "." }
-        end
-      end
     end
   end
 end

data/lib/samagotchi/web/participants_admin.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "grants"
+require_relative "../grants"
 require_relative "qr"
 require_relative "../review_start"
 require_relative "../review_apply"