samagotchi 0.156.0 → 0.158.0

data/lib/samagotchi/memory_bundle/provenance.rb

@@ -8,7 +8,6 @@ require "tmpdir"
 require_relative "../atomic_file"
 require_relative "../memory_paths"
 require_relative "../version"
-require_relative "bundle_hook"
 require_relative "file_digest"
 require_relative "installed_bundle"
 require_relative "manifest"
@@ -159,6 +158,16 @@ module Samagotchi
         unchecked?(recorded) || file_sha(path) == recorded_sha(recorded)
       end
 
+      # Whether a memory on disk is what the install wrote: the entry's
+      # recorded checksum, else its base copy. Unknown counts as edited. The
+      # one rule a prune, an uninstall's refusal and chi bundle status read.
+      def self.unchanged?(path, entry, base_path)
+        recorded = entry[:checksum]
+        return sha_matches?(path, recorded) unless recorded_sha(recorded).empty?
+
+        File.exist?(base_path) && file_sha(path) == file_sha(base_path)
+      end
+
       # The record's mirror of the manifest keys (InstalledBundle::MIRROR_KEYS)
       # as #write records them from its kwargs: what an older chi reads, and
       # what #adopt_manifest holds a source's manifest against.
@@ -185,12 +194,14 @@ module Samagotchi
       #   the record. nil keeps an entry with no base (a kept edit that has
       #   none: the user's file must never become it), with its recorded
       #   checksum.
-      # @param hooks_files [Hash] basename => path for hook file snapshots (optional)
       # @param guardrails_files [Hash] basename => installed rule file; the
       #   sha256 of each is recorded (the Engine checks it at load)
       # @param plugin_file [String, nil] the installed plugin file; its name
       #   and sha256 are recorded (the Engine checks it at load) with a base
       #   snapshot
+      # @param plugin_required [Boolean] the manifest's plugin: required: true
+      #   (a guardrail plugin), recorded with it as "required": true, so the
+      #   Engine knows it whatever becomes of the kept manifest.yml
       # @param requires_chi [String, nil] the manifest's requirement
       # @param needs [Array<Hash>] the manifest's needs ({command:, why:, hint:})
       # @param marks [Array<FileStanding::Behind>] files an upgrade left behind;
@@ -216,8 +227,10 @@ module Samagotchi
       #   (requires_chi … setting_types) are still written from the kwargs:
       #   an older chi sharing this memories dir reads only them
       #   (docs/internals/bundles.md); a key a later manifest gains is never added
-      def write(files:, scope:, version:, source_path:, hooks: {}, trust_level: nil, source_commit: nil, hooks_files: {},
-                guardrails_files: {}, plugin_file: nil, requires_chi: nil, needs: nil, marks: [], incoming_dir: nil, includes: nil,
+      # The record has no hooks ("hooks" => {}: class-file hooks are retired)
+      # and an older record's hook bases go.
+      def write(files:, scope:, version:, source_path:, trust_level: nil, source_commit: nil,
+                guardrails_files: {}, plugin_file: nil, plugin_required: false, requires_chi: nil, needs: nil, marks: [], incoming_dir: nil, includes: nil,
                 scripts_files: {}, context_providers: [], block_renderers: [], file_descriptions: {}, session_settings: [], session_setting_types: {}, settings: nil, setting_types: {},
                 dev: false, manifest_from: nil)
         FileUtils.mkdir_p(@bundle_dir)
@@ -262,40 +275,8 @@ module Samagotchi
           end
         end
 
-        # Hooks provenance: persist metadata and base snapshots for hooks
-        hooks_map = {}
-        # Incoming hooks: basename => BundleHook (or its metadata hash)
-        normalized_hooks = {}
-        if hooks.is_a?(Hash)
-          hooks.each do |k, v|
-            next unless k.is_a?(String) && !k.empty?
-            next unless v.is_a?(Hash) || v.is_a?(BundleHook)
-
-            normalized_hooks[k] = BundleHook.parse(v)
-          end
-        end
-        # Prune stale hook bases
-        existing&.hooks&.each_key do |old_key_str|
-          FileUtils.rm_f(File.join(bases_dir, old_key_str)) unless normalized_hooks.key?(old_key_str)
-        end
-        # Save base snapshots for hooks where a file path was provided, and
-        # record the sha256 of the installed file itself: the load-time check
-        # compares against it, and a declared sha can be wrong (installing
-        # only warns about that).
-        hooks_files = {} unless hooks_files.is_a?(Hash)
-        normalized_hooks.each do |k, hook|
-          src = hooks_files[k] || hooks_files[k.to_sym]
-          hook = hook.with(sha256: BundleHook.of_file(src.to_s).sha256) if src && File.exist?(src.to_s)
-          hook = hook.with(sha256: DEV_SHA) if dev
-          hooks_map[k] = hook.to_record
-          next unless src && File.exist?(src.to_s)
-
-          begin
-            File.write(File.join(bases_dir, k), File.read(src.to_s))
-          rescue StandardError
-            nil
-          end
-        end
+        # An older chi's hooks: their bases go with them (AssetInstaller#retire_hooks).
+        existing&.hooks&.each_key { |old_key_str| FileUtils.rm_f(File.join(bases_dir, old_key_str)) }
 
         manifest_data = {
           "name" => @name,
@@ -304,7 +285,7 @@ module Samagotchi
           "source" => source_path.to_s,
           "installed_at" => DateTime.now.iso8601,
           "files" => merged_entries,
-          "hooks" => hooks_map
+          "hooks" => {}
         }
         manifest_data["dev"] = true if dev
         if guardrails_files.is_a?(Hash) && !guardrails_files.empty?
@@ -318,6 +299,7 @@ module Samagotchi
           content = File.binread(plugin_file.to_s) # the base snapshot's bytes
           manifest_data["plugin"] = { "file" => File.basename(plugin_file.to_s),
                                       "sha256" => dev ? DEV_SHA : FileDigest.sha256(plugin_file.to_s) }
+          manifest_data["plugin"]["required"] = true if plugin_required
           FileUtils.mkdir_p(File.join(bases_dir, "plugin"))
           File.binwrite(plugin_base_path(File.basename(plugin_file.to_s)), content)
         end
@@ -446,7 +428,7 @@ module Samagotchi
       # wrote it, or the file is gone), when +dir+ is the source of what's
       # installed: its manifest names this bundle at the recorded version and
       # says what the record keeps (#manifest_difference), and every sha the
-      # record has for a memory, plugin, hook, script or rule is the source
+      # record has for a memory, plugin, script or rule is the source
       # file's. Then the file is copied to #kept_manifest_path and the
       # record gains its manifest_sha, and nothing else changes (installed_at,
       # the mirror, installed_by). A dev record is never adopted: its next
@@ -571,8 +553,8 @@ module Samagotchi
       # The first manifest key in which +manifest+ says other than what the
       # record keeps, nil when none: each mirrored key as #write records it (one
       # the record lacks is fine only when an older chi couldn't have known it:
-      # Manifest::SINCE has it), then each recorded hook's events, on_error and
-      # priority.
+      # Manifest::SINCE has it). An older record's hooks don't count: they
+      # no longer load, and the source can't list any (Manifest::HooksRetired).
       def manifest_difference(bundle, manifest)
         recorded = plain(bundle.mirror)
         source = plain(self.class.mirror_fields(
@@ -581,18 +563,11 @@ module Samagotchi
           session_settings: manifest.session_settings, session_setting_types: manifest.session_setting_types,
           settings: manifest.settings, setting_types: manifest.setting_types
         ))
-        differing = InstalledBundle::MIRROR_KEYS.find do |key|
+        InstalledBundle::MIRROR_KEYS.find do |key|
           next false if recorded[key] == source[key]
 
           !(recorded[key].nil? && Manifest::SINCE.key?(MIRROR_SINCE.fetch(key, key)))
         end
-        return differing if differing
-
-        same_hooks = bundle.hooks.all? do |file, hook|
-          theirs = manifest.hooks.fetch(file, BundleHook.new)
-          [hook.events, hook.on_error, hook.priority] == [theirs.events, theirs.on_error, theirs.priority]
-        end
-        same_hooks ? nil : "hooks"
       end
       private :manifest_difference
 
@@ -600,7 +575,7 @@ module Samagotchi
       private :plain
 
       # Each file the record has a sha for, by its path in the bundle's source
-      # => that sha: the plugin, hooks, scripts, rules, and each memory whose
+      # => that sha: the plugin, scripts, rules, and each memory whose
       # entry has a checksum and no conflict mark (its base is the bundle's text).
       def installed_shas(bundle, manifest)
         shas = bundle.files.each_with_object({}) do |(key, entry), acc|
@@ -610,7 +585,6 @@ module Samagotchi
           file = manifest.plugin && manifest.plugin[:file].to_s
           shas[file && File.basename(file) == bundle.plugin.file ? file : bundle.plugin.file] = bundle.plugin.sha256
         end
-        bundle.hooks.each { |file, hook| shas["hooks/#{file}"] = hook.sha256 }
         bundle.scripts.each { |file, sha| shas["scripts/#{file}"] = sha }
         bundle.guardrails.each { |file, sha| shas["guardrails/#{file}"] = sha }
         shas

data/lib/samagotchi/memory_bundle/remerge.rb

@@ -3,6 +3,8 @@
 require_relative "index_updater"
 require_relative "manifest"
 require_relative "memory_files"
+require_relative "file_actions"
+require_relative "file_digest"
 require_relative "merger"
 require_relative "provenance"
 require_relative "trash"
@@ -17,7 +19,8 @@ module Samagotchi
     # scripts, and GuardrailWiring#rules stats per tool call, so a live session
     # could hit a transient deny.
     #
-    # Each marked file, by what Merger::Upgrade says of it:
+    # Each marked file, by its FileState and REMERGE row (FileActions; a
+    # :decide cell by what Merger::Upgrade says of it):
     #   - not shipped now: its mark, base and text stay, and it reads as behind
     #     unless level or missing, as every report has it;
     #   - the shipped text isn't the one the mark names (a checkout at the same
@@ -32,7 +35,7 @@ module Samagotchi
     #     to miss, so the mark goes;
     #   - conflict: behind, and the mark records why, only when that changed;
     #   - fast_forward (one Merger::Upgrade#outcome lets go ahead): the next
-    #     upgrade's (save_marked_file), behind until then;
+    #     upgrade's (its save_first), behind until then;
     #   - install: a missing file, which isn't behind (FileStanding.behind?): the
     #     next upgrade or a restore puts it back, and a warning says so;
     #   - one it can't read or replace: left as it is, behind, saying why.
@@ -75,7 +78,8 @@ module Samagotchi
         @behind = []
         @warnings = []
         @trash = Trash.new(@name)
-        shipped = MemoryFiles.select(@source_dir, Manifest.read(dir: @source_dir))
+        @manifest = Manifest.read(dir: @source_dir)
+        shipped = MemoryFiles.select(@source_dir, @manifest)
         marked.each { |key, entry| retry_file(key, entry, shipped) }
         settle unless dry_run
         Result.new(merged: @merged, settled: @settled, stamped: @stamped.map(&:file), behind: @behind, warnings: @warnings, trash_copy: @trash.copy_line)
@@ -90,24 +94,35 @@ module Samagotchi
           return
         end
 
-        incoming_sha = Merger.digest(view.paths(key)[:incoming])
-        if entry[:incoming_sha] && entry[:incoming_sha] != incoming_sha
+        state = view.state(key)
+        if state.source_moved?
           @behind << @record.behind_entry(key, entry) if behind
           return
         end
 
-        outcome = view.outcome(key)
-        case outcome.status
-        when :merged then merge_file(key, entry, outcome)
-        when :conflict then mark(key, entry, view.behind(key, outcome, @record.version))
-        when :noop, :keep then @settled << key
-        when :fast_forward then mark(key, entry, behind_for(key, FileStanding::WAITS_FOR_UPGRADE))
-        when :install then @warnings << "#{key}: #{FileStanding::FILE_MISSING}"
-        end
+        retry_row(key, entry, state, FileActions.for(:remerge, state))
       rescue SystemCallError => e
         stay(key, FileStanding.left_as_it_is(e.message))
       end
 
+      # The file's REMERGE row, done. A :decide cell, and a behind one, asks
+      # Merger::Upgrade#decision for the Outcome (the text merge, the legacy
+      # guard, or why no merge is possible); a fast-forward waits for the
+      # upgrade. A missing file is put back by the next upgrade or a restore;
+      # one it can't read raises here (left as it is, saying why).
+      def retry_row(key, entry, state, action)
+        decision = view.decision(key, state) if action.do == :decide || action.behind?
+        action = FileActions.decided(decision.outcome, :remerge) if action.do == :decide
+        if action.do == :merge then merge_file(key, entry, state, decision.outcome)
+        elsif action.behind?
+          waits = decision.outcome.status == :fast_forward
+          mark(key, entry, waits ? behind_for(key, FileStanding::WAITS_FOR_UPGRADE) : view.behind(key, decision.outcome, @record.version))
+        elsif action.word == :settled then @settled << key
+        elsif state.kind == :missing then @warnings << "#{key}: #{FileStanding::FILE_MISSING}"
+        elsif state.kind == :unreadable then FileDigest.hex(state.paths[:current])
+        end
+      end
+
       def behind_for(key, why) = FileStanding::Behind.new(file: key, version: @record.version, why: why)
 
       # The record says it too, so chi bundle status reads as the row does. There
@@ -128,7 +143,9 @@ module Samagotchi
         @stamped << behind unless entry[:incoming_sha] && @record.behind_entry(key, entry) == behind && File.exist?(@provenance.incoming_path(key))
       end
 
-      def merge_file(key, entry, outcome)
+      def merge_file(key, entry, state, outcome)
+        warning = FileDigest.mismatch(key, state.paths[:incoming], @manifest.checksum_for(key))
+        @warnings << warning if warning
         return @merged << key if @dry_run
         return @merged << key if Merger.write_merged(view.paths(key)[:current], outcome, @trash)
 

data/lib/samagotchi/memory_bundle/shas.rb

@@ -14,7 +14,7 @@ module Samagotchi
 
       # A sha line that doesn't match its file: +old+ is the hex the line
       # holds ("" for a placeholder `sha256: sha256:`), nil when the entry
-      # has no sha line at all (a plugin:, hooks: or scripts: entry the
+      # has no sha line at all (a plugin: or scripts: entry the
       # installer then takes unchecked; .refresh can't write one).
       Stale = Data.define(:file, :old, :new)
 
@@ -30,7 +30,6 @@ module Samagotchi
       # names, the layout otherwise untouched. The shapes:
       #   files:            a.md: sha256:<hex>             (dir/a.md)
       #                     a.md:\n    sha256: sha256:<hex> (dir/a.md, with description:)
-      #   hooks:            h.rb:\n    sha256: sha256:<hex> (dir/hooks/h.rb)
       #   plugin:           file: p.rb\n  sha256: sha256:<hex> (dir/p.rb)
       #   scripts:          s.rb: sha256:<hex>             (dir/scripts/s.rb)
       # Returns [text, [[relative file, old sha, new sha], ...]] for the lines
@@ -43,8 +42,9 @@ module Samagotchi
         [text, changes]
       end
 
-      # The stale sha lines of the bundle at +dir+, then the plugin:, hooks:
-      # and scripts: entries with no sha line, as [Stale].
+      # The stale sha lines of the bundle at +dir+, then the plugin: and
+      # scripts: entries with no sha line, as [Stale]. (A hooks: key, which
+      # chi refuses, has no sha lines here.)
       def stale(dir, text = File.read(File.join(dir, "manifest.yml")))
         _, changes, unlined = scan(dir, text)
         changes.map { |file, old, new| Stale.new(file, old, new) } +
@@ -86,11 +86,10 @@ module Samagotchi
       # take a placeholder (`chi bundle check`) parse this text.
       def parseable(text) = text.gsub(/^(\s*(?:["']?[^"':\s][^"':]*["']?: )?)sha256:(?=[ \t]*(?:#[^\r\n]*)?\r?$)/, "\\1sha256:0")
 
-      # The code files the manifest names (plugin, hooks, scripts), as paths
+      # The code files the manifest names (plugin, scripts), as paths
       # relative to the bundle dir.
       def coded(parsed, plugin_file)
         (plugin_file.is_a?(String) ? [plugin_file] : []) +
-          keys(parsed["hooks"]).map { |h| File.join("hooks", h) } +
           keys(parsed["scripts"]).map { |s| File.join("scripts", s) }
       end
       private_class_method :coded
@@ -114,8 +113,6 @@ module Samagotchi
         when "files"
           m = line.match(/\A(    sha256: )sha256:\h*#{TAIL}/) and return sub && [sub.delete("\"'"), m[1]]
           m = line.match(/\A(  ["']?([^"':]+)["']?: )sha256:\h*#{TAIL}/) and [m[2], m[1]]
-        when "hooks"
-          m = line.match(/\A(    sha256: )sha256:\h*#{TAIL}/) and sub and [File.join("hooks", sub.delete("\"'")), m[1]]
         when "plugin"
           m = line.match(/\A(  sha256: )sha256:\h*#{TAIL}/) and plugin_file and [plugin_file, m[1]]
         when "scripts"

data/lib/samagotchi/memory_bundle/shipped_update.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "asset_installer"
 require_relative "installer"
 require_relative "listing"
 require_relative "manifest"
@@ -11,6 +12,7 @@ require_relative "remerge"
 require_relative "source"
 require_relative "status"
 require_relative "system_bundle"
+require_relative "trash"
 require_relative "../memory_paths"
 require_relative "../version"
 
@@ -25,9 +27,11 @@ module Samagotchi
     # bundle that isn't installed and never downgrades.
     #
     # .md files take the Installer's 3-way merge: a clean text merge replaces
-    # the file (merged), a real conflict keeps the user's (behind). Hooks, rules and the plugin are replaced; an
-    # edited one (which didn't load: its sha no longer matched) is listed
-    # in replaced.
+    # the file (merged), a real conflict keeps the user's (behind). Rules,
+    # the plugin and scripts are replaced, an older chi's hooks removed; an edited one (Trash.edit?: its
+    # bytes neither the recorded sha, none recorded counting as edited, nor
+    # the incoming file's) is copied to the trash first and listed in
+    # replaced (#trash_bound).
     #
     # A profile (a shipped meta bundle) is updated through Profile: its row
     # is :would_update when the shipped version is newer or it has members
@@ -41,8 +45,9 @@ module Samagotchi
     # a project-scope bundle: chi bundle upgrade in the project.
     module ShippedUpdate
       # status: :would_update, :would_merge (plan), :updated, :merged,
-      # :up_to_date, :skipped, :failed. note says why for skipped/failed, and
-      # what a retry at the same version warned of. merged and replaced are file
+      # :up_to_date, :skipped, :failed. note says why for skipped/failed,
+      # what a retry at the same version warned of, and an update's Checksum
+      # mismatch warnings. merged and replaced are file
       # names, behind FileStanding::Behind; under plan they are what apply would
       # merge, replace or leave behind.
       # adds is nil but for a profile: the members it installs.
@@ -114,6 +119,7 @@ module Samagotchi
           r.merged = installer.merged_files
           r.behind = installer.behind
           r.trash_copy = installer.trash_copy_line
+          r.note = mismatch_note(installer)
         end
       rescue StandardError => e
         row.dup.tap do |r|
@@ -193,14 +199,19 @@ module Samagotchi
         if Manifest.requires_chi_failure(manifest.requires_chi, chi_version)
           return skip(row, "needs chi #{manifest.requires_chi}", keep_to: true)
         end
+
+        # The upgrade would refuse it (Installer#refuse_hooks).
+        hooks = Manifest::HooksRetired.files_in(row.source_dir)
+        return skip(row, Manifest::HooksRetired.for_files(hooks).message, keep_to: true) unless hooks.empty?
         return skip(row, "project scope: chi bundle upgrade #{ship.source} in the project") if row.scope == "project"
         return skip(row, "unknown scope #{row.scope}: upgrade chi or reinstall") unless MemoryPaths.scope_dir(row.scope)
 
         forecast = forecast(row, bundle)
         row.merged = forecast.merged
         row.behind = forecast.behind
-        row.replaced = edited_executables(name, bundle)
+        row.replaced = trash_bound(name, bundle, manifest, row.source_dir)
         row.status = :would_update
+        row.note = planned_mismatch_note(row)
         row
       rescue SystemCallError => e
         # A file it can't read: the upgrade would fail on it, so this is that
@@ -233,6 +244,20 @@ module Samagotchi
 
       def note_of(remerged) = remerged.warnings.empty? ? nil : remerged.warnings.join("; ")
 
+      def mismatch_note(installer)
+        mismatches = installer.warnings.grep(/\AChecksum mismatch/)
+        mismatches.join("; ") unless mismatches.empty?
+      end
+
+      def planned_mismatch_note(row)
+        installer = Installer.new(source: row.source_dir, name: row.name, scope: row.scope, strict: true, upgrade: true, dry_run: true,
+                                  shipped_dir: File.dirname(row.source_dir))
+        installer.run
+        mismatch_note(installer)
+      rescue Installer::InstallError
+        nil
+      end
+
       def profile_row(row, bundle, shipped_dir, chi_version)
         manifest = Manifest.read(dir: row.source_dir)
         newer = Listing.newer?(row.to, row.from)
@@ -267,14 +292,29 @@ module Samagotchi
                             source_dir: row.source_dir).forecast(shipped & bundle.files.keys, version: row.to)
       end
 
-      # Installed hooks, rules and the plugin whose sha differs from the
-      # recorded one (they didn't load), as hooks/F, guardrails/F, plugin/F.
+      # What the upgrade from +source_dir+ copies to the trash, as
+      # hooks/F, guardrails/F, plugin/F, scripts/F: Trash.edits over the
+      # folders AssetInstaller replaces or removes, each file against the one
+      # it puts in its place. Rules, the plugin and scripts: their whole
+      # folder, which the upgrade replaces. hooks/: an older chi's, which the
+      # upgrade removes whole (AssetInstaller#retire_hooks; no incoming).
+      def trash_bound(name, bundle, manifest, source_dir)
+        provenance = Provenance.new(name: name)
+        rules = Dir.glob(File.join(source_dir, "guardrails", "*.yml")).sort
+                   .reject { |file| AssetInstaller.linked?(file, source_dir) }
+        plugin = manifest.plugin ? { manifest.plugin[:file] => File.join(source_dir, manifest.plugin[:file]) } : {}
+        scripts = manifest.scripts.keys.to_h { |file| [file, File.join(source_dir, "scripts", file)] }
+        Trash.edits(provenance.hooks_dir, "hooks", bundle.hooks.transform_values(&:sha256)) +
+          Trash.edits(provenance.guardrails_dir, "guardrails", bundle.guardrails, rules.to_h { |file| [File.basename(file), file] }) +
+          Trash.edits(provenance.plugin_dir, "plugin", bundle.plugin_shas, plugin) +
+          Trash.edits(provenance.scripts_dir, "scripts", bundle.scripts, scripts)
+      end
+
+      # Installed rules and the plugin whose sha differs from the recorded
+      # one (they didn't load), as guardrails/F, plugin/F.
       def edited_executables(name, bundle)
         provenance = Provenance.new(name: name)
         edited = []
-        bundle.hooks.each do |file, hook|
-          edited << "hooks/#{file}" if edited?(File.join(provenance.hooks_dir, file), hook.sha256)
-        end
         bundle.guardrails.each do |file, sha|
           edited << "guardrails/#{file}" if edited?(File.join(provenance.guardrails_dir, file), sha)
         end

data/lib/samagotchi/memory_bundle/status.rb

@@ -2,6 +2,7 @@
 
 require_relative "file_digest"
 require_relative "provenance"
+require_relative "file_state"
 require_relative "manifest"
 require_relative "../version"
 require_relative "index_updater"
@@ -15,14 +16,15 @@ module Samagotchi
       # A bundle as this chi reads it now (what chi bundle status prints):
       # its stored record, the scope it resolves to (scope_error when it
       # can't), the folder its files belong in, what each file looks like on
-      # disk, its installed plugin, why none of its hooks load, and its needs
+      # disk, its installed plugin, the class-file hooks its record still
+      # has (retired_hooks: they don't load), and its needs
       # with what this process's PATH found. The +files+ entries and +plugin+
       # stay Hashes: their fields differ per case (an unchecked file has no
       # paths at all). An entry's behind is its FileStanding::Behind, nil for a
       # file that isn't; merge_note its FileStanding::MergeNote, nil without one;
       # unreadable: the file is there, but this chi can't read it.
       Report = Data.define(:provenance, :scope, :scope_error, :target_dir, :files, :plugin,
-                           :hooks_requires_failure, :needs)
+                           :retired_hooks, :needs)
 
       # A scope this chi can't resolve (a newer chi's, a hand edit) isn't
       # guessed: scope_error says so, target_dir is nil and each file is
@@ -41,16 +43,12 @@ module Samagotchi
         files.each do |file_key_str, meta|
           next details[file_key_str] = unchecked_file(meta) unless target_dir
 
-          target_path = File.join(target_dir, file_key_str)
-          base_path = provenance.base_path(file_key_str)
-          stored_checksum = meta[:checksum]
-          current_checksum = checksum(target_path)
-          unreadable = current_checksum == :unreadable
-          current_checksum = nil if unreadable
-          base_checksum = checksum(base_path)
-          base_checksum = nil if base_checksum == :unreadable
-          modified = base_checksum && current_checksum && base_checksum != current_checksum
-          missing = !File.exist?(target_path)
+          state = FileState.of(file_key_str, record: bundle, provenance: provenance, target_dir: target_dir, source_dir: nil)
+          target_path = state.paths[:current]
+          base_path = state.paths[:base]
+          unreadable = state.kind == :unreadable
+          missing = state.kind == :missing
+          modified = %i[edited edited_no_base].include?(state.kind)
           # A model overlay has no index line (Installer#note_overlay).
           overlay = ModelOverlay.bundle_overlay?(file_key_str, bundle_files: files.keys, target_dir: target_dir)
           index_present = overlay ? nil : index_has_entry?(scope, file_key_str)
@@ -59,9 +57,9 @@ module Samagotchi
             behind: behind[file_key_str],
             merge_note: notes[file_key_str],
             unreadable: unreadable,
-            stored_checksum: stored_checksum,
-            current_checksum: current_checksum,
-            base_checksum: base_checksum,
+            stored_checksum: meta[:checksum],
+            current_checksum: digest_or_nil(state.digests.disk),
+            base_checksum: digest_or_nil(state.digests.base),
             modified: modified,
             missing: missing,
             index_present: index_present,
@@ -72,24 +70,22 @@ module Samagotchi
         end
         Report.new(provenance: bundle, scope: scope, scope_error: target_dir ? nil : "unknown scope: #{scope}",
                    target_dir: target_dir, files: details, plugin: plugin_status(provenance, bundle),
-                   hooks_requires_failure: hooks_requires_failure(bundle), needs: needs_status(bundle))
+                   retired_hooks: retired_hooks(provenance, bundle), needs: needs_status(bundle))
       end
 
-      # The file's digest, nil when there is none, :unreadable when it can't be read.
-      def self.checksum(path)
-        FileDigest.hex(path)
-      rescue SystemCallError
-        :unreadable
-      end
-      private_class_method :checksum
-
-      # Why none of the bundle's hooks load (this chi doesn't meet its
-      # requires_chi, Hooks::BundleLoader), or nil: it has no hooks or meets it.
-      def self.hooks_requires_failure(bundle)
-        manifest = bundle.manifest
-        return nil if manifest.hooks.empty?
+      # A FileState digest as the Report has it: nil for none, or one that
+      # can't be read (unreadable says which).
+      def self.digest_or_nil(digest) = digest == :unreadable ? nil : digest
+      private_class_method :digest_or_nil
 
-        manifest.requires_chi_failure
+      # The class-file hooks the record still has (a 0.157 install's; chi
+      # loads none, Manifest::HooksRetired), each "ok" or "missing" in
+      # hooks/, by name; {} for none.
+      # @return [Hash{String => String}]
+      def self.retired_hooks(provenance, bundle)
+        bundle.hooks.keys.sort.to_h do |file|
+          [file, File.exist?(File.join(provenance.hooks_dir, file)) ? "ok" : "missing"]
+        end
       end
 
       # The stored needs, each with found: from this process's PATH (the

data/lib/samagotchi/memory_bundle/system_bundle.rb

@@ -2,6 +2,7 @@
 
 require "fileutils"
 require_relative "installer"
+require_relative "file_digest"
 require_relative "provenance"
 require_relative "manifest"
 require_relative "index_updater"
@@ -204,29 +205,54 @@ module Samagotchi
       # A file from the bundle missing on disk (the user deleted it) is put
       # back, and nothing else: at the same version a checkout can carry other
       # text, so no other file is merged here (Remerge has its guard), and a live
-      # session's guardrails, plugin and scripts stay where they are.
+      # session's guardrails, plugin and scripts stay where they are. Which
+      # missing file is put back is its RESTORE row (FileActions): one the
+      # record doesn't own too. A put-back file is checked against the
+      # manifest's files: sha, as an installed one is (a bad copy warns).
       def verify_files_present(gem_manifest, version, dry_run)
         target_dir = MemoryPaths.system_dir
         missing = MemoryFiles.select(GEM_BUNDLE_DIR, gem_manifest).reject { |key| File.exist?(File.join(target_dir, key)) }
+        missing = restored_rows(missing, target_dir) unless missing.empty?
         return result(:up_to_date, from: version, to: version) if missing.empty?
-        return result(:restored, from: version, to: version) if dry_run
 
-        warnings = missing.filter_map { |key| restore_file(key, gem_manifest.file_descriptions[key]) }
+        if dry_run
+          warnings = missing.filter_map { |key| restore_mismatch(key, gem_manifest) }
+          return result(:restored, from: version, to: version, warnings: warnings)
+        end
+
+        warnings = missing.flat_map { |key| restore_file(key, gem_manifest) }
         result(:restored, from: version, to: version, warnings: warnings)
       end
 
-      # @return [String, nil] a warning: the file is in place, its index line isn't
-      def restore_file(key, description)
+      # The ones among +keys+ whose FileState's RESTORE row restores.
+      def restored_rows(keys, target_dir)
+        provenance = Provenance.new(name: BUNDLE_NAME)
+        record = provenance.record
+        keys.select do |key|
+          state = FileState.of(key, record: record, provenance: provenance, target_dir: target_dir, source_dir: GEM_BUNDLE_DIR)
+          FileActions.for(:restore, state)&.do == :restore
+        end
+      end
+
+      # @return [Array<String>] warnings: its bytes don't match the manifest's
+      #   sha, or the file is in place and its index line isn't
+      def restore_file(key, gem_manifest)
         source = File.join(GEM_BUNDLE_DIR, key)
         target = File.join(MemoryPaths.system_dir, key)
+        description = gem_manifest.file_descriptions[key]
         FileUtils.cp(source, target)
         Provenance.new(name: BUNDLE_NAME).record_restored(key, source, description: description)
+        warnings = [restore_mismatch(key, gem_manifest)].compact
         begin
           IndexUpdater.update_index(SCOPE, key.delete_suffix(".md"), File.size(target), description, source: BUNDLE_NAME)
-          nil
         rescue StandardError => e
-          "index.md: line for #{key.delete_suffix(".md")} not updated (#{e.message})"
+          warnings << "index.md: line for #{key.delete_suffix(".md")} not updated (#{e.message})"
         end
+        warnings
+      end
+
+      def restore_mismatch(key, gem_manifest)
+        FileDigest.mismatch(key, File.join(GEM_BUNDLE_DIR, key), gem_manifest.checksum_for(key))
       end
 
       # An up-to-date bundle's marked files, retried. No marks: nothing is read.
@@ -246,7 +272,10 @@ module Samagotchi
         owned = provenance.record&.files&.keys || []
         forecast = Merger::Upgrade.new(provenance: provenance, target_dir: MemoryPaths.system_dir, source_dir: GEM_BUNDLE_DIR)
                                   .forecast(gem_manifest.files.keys.map(&:to_s).sort & owned, version: to)
-        result(:updated, from: from, to: to, merged: forecast.merged, behind: forecast.behind)
+        installer = upgrade_installer(dry_run: true)
+        installer.run
+        warnings = installer.warnings.grep(/\AChecksum mismatch/)
+        result(:updated, from: from, to: to, merged: forecast.merged, behind: forecast.behind, warnings: warnings)
       end
 
       # Provenance#adopt_manifest from the shipped dir, for a record without a
@@ -258,9 +287,9 @@ module Samagotchi
         Provenance.new(name: BUNDLE_NAME).adopt_manifest(GEM_BUNDLE_DIR)
       end
 
-      def upgrade_installer
+      def upgrade_installer(dry_run: false)
         Installer.new(source: GEM_BUNDLE_DIR, name: BUNDLE_NAME, scope: SCOPE, force: false, strict: true, upgrade: true,
-                      shipped_dir: File.dirname(GEM_BUNDLE_DIR))
+                      dry_run: dry_run, shipped_dir: File.dirname(GEM_BUNDLE_DIR))
       end
       private_class_method :with_lock, :note_newer_installed, :install_fresh, :keep_manifest, :upgrade_existing, :verify_files_present, :restore_file, :remerge,
                            :upgrade_installer, :result, :planned_update