samagotchi 0.158.0 → 0.160.0

data/lib/samagotchi/guardrails/approvals.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "digest"
 require "json"
 require "fileutils"
 require "time"
@@ -13,7 +14,9 @@ module Samagotchi
     # written aside and renamed under an exclusive flock (several chi
     # processes share it). An entry relaxes an ask, never a deny:
     #   session — this exact call (tool + normalized command / paths) in
-    #             this session;
+    #             this session; a command's in its place too (the
+    #             worktree or folder it ran in, and a digest of its env:),
+    #             since the same text acts on whatever they point at;
     #   repo    — this exact call in this repo (the cwd outside a repo);
     #   rule    — anything this rule (from this source) asks about here.
     # "This repo" is the repository (repo: its common git dir), so an
@@ -74,11 +77,14 @@ module Samagotchi
         here = ->(e) { e["repo"] ? e["repo"] == repo : e["repo_root"] == place }
         session_id = verdict.context&.session_id
         session_only = SESSION_ONLY_RULES.include?(verdict.rule.to_s)
+        command_place = session_place(verdict)
         list.find do |e|
           next false if session_only && e["scope"] != "session"
 
           case e["scope"]
-          when "session" then session_id && e["session_id"] == session_id && e["key"] == key
+          when "session"
+            session_id && e["session_id"] == session_id && e["key"] == key &&
+              (command_place.nil? || e.slice("repo_root", "env") == command_place)
           when "repo" then here.call(e) && e["key"] == key
           when "rule"
             # One rule's grant can't answer for a second rule's ask on the call.
@@ -94,7 +100,9 @@ module Samagotchi
         entry = { "scope" => scope, "tool" => verdict.targets&.tool || verdict.call[:name].to_s,
                   "acts_as" => verdict.targets&.acts_as, "rule" => verdict.rule, "source" => verdict.source, "created_at" => Time.now.utc.iso8601 }
         case scope
-        when "session" then entry.merge!("session_id" => verdict.context&.session_id, "key" => key_for(verdict))
+        when "session"
+          entry.merge!("session_id" => verdict.context&.session_id, "key" => key_for(verdict))
+          entry.merge!(session_place(verdict) || {})
         when "repo"
           entry.merge!("repo_root" => place_for(verdict), "repo" => verdict.targets&.repo, "key" => key_for(verdict))
         when "rule" then entry.merge!("repo_root" => place_for(verdict), "repo" => verdict.targets&.repo)
@@ -131,6 +139,22 @@ module Samagotchi
         t&.repo_root || t&.cwd || verdict.context&.cwd
       end
 
+      # Where a session entry of a command holds: the call's worktree root
+      # (or folder: #place_for; never the common git dir, which every
+      # worktree shares) and, when it sets one, a sha256 of its env: (never
+      # the env: it may hold a secret). nil for a call with no command:
+      # its paths are its place. An entry without them (stored before) no
+      # longer matches: one more ask.
+      # @return [Hash, nil]
+      def self.session_place(verdict)
+        t = verdict.targets
+        return nil unless t&.command
+
+        env = t.env.to_h
+        digest = env.empty? ? nil : Digest::SHA256.hexdigest(JSON.generate(env.map { |k, v| [k.to_s, v.to_s] }.sort))
+        { "repo_root" => place_for(verdict), "env" => digest }.compact
+      end
+
       private
 
       # @param locked [Boolean] the caller holds the store's lock

data/lib/samagotchi/guardrails/pair_boundary.rb

@@ -52,7 +52,7 @@ module Samagotchi
       RULE = "pair-boundary"
       SOURCE = "core"
       OWNER_VOICED = %w[delegate register_reminder cancel_reminder send_note forget_outputs task_create task_stop
-                        find_tools objectives].freeze
+                        find_tools objectives schedule_task list_schedules cancel_schedule].freeze
       OWNER_VOICED_PREFIX = "delegate_"
       # The background task tools that read the owner's tasks (a pair turn
       # starts none: task_create is owner-voiced, and its execute is never

data/lib/samagotchi/hook_routes.rb

@@ -24,7 +24,6 @@ module Samagotchi
     # (a chi.on handler :log, or :deny for an on_error: :fail_closed one).
     HOOK_FAILURE_EFFECTS = {
       log: "it's skipped, and only the log has its next failures",
-      skip: "it's skipped, and its next failures are silent",
       deny: "it denies every tool call it guards, and its next failures are in each denial's reason"
     }.freeze
 

data/lib/samagotchi/memory_bundle/asset_installer.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require "fileutils"
+require_relative "asset_state"
+require_relative "file_actions"
 require_relative "file_digest"
 require_relative "manifest"
 require_relative "provenance"
@@ -20,8 +22,11 @@ module Samagotchi
     # warnings, and #run returns what the record (Provenance#write) keeps.
     # A dev install (+dev+, `chi bundle install --dev`) links each file to
     # the source instead of copying it, and warns of no checksum mismatch.
-    # An edited file it replaces or removes is copied to the trash first,
-    # under its subfolder (Trash#copy_edits); a link never is.
+    # Each folder is one loop over its files' AssetStates (#install_set):
+    # FileActions' asset tables say what each gets, the dry run reading the
+    # same row. An edited file it replaces or removes is copied to the trash
+    # first, under its subfolder (AssetState#edited?, Trash.edit?'s rule); a
+    # link never is.
     class AssetInstaller
       # What was installed: the paths Provenance#write records (each
       # empty / nil on a dry run).
@@ -32,6 +37,10 @@ module Samagotchi
       # The retire's summary words (Installer#summary): why the hooks went.
       RETIRED = "chi no longer loads class-file bundle hooks"
 
+      # A dry run's word for a real run's (Installer#summary): nothing would
+      # be written to a file already up to date.
+      DRY_WORDS = { installed: :would_install, updated: :would_update, up_to_date: :up_to_date }.freeze
+
       # @param source_dir [String] the normalized bundle source
       # @param manifest [Manifest, nil] nil for a non-strict install without one
       # @param existing [InstalledBundle, nil] the record before this install
@@ -65,9 +74,9 @@ module Samagotchi
       def run
         incoming_rules = Dir.glob(File.join(@bundle_dir, "guardrails", "*.yml")).sort
                             .reject { |src| linked_out?(src, "guardrails/#{File.basename(src)}") }
-        guardrail_files = install_guardrails(incoming_rules)
-        plugin_file = install_plugin
-        script_files = install_scripts
+        guardrail_files = install_set(:rule, rules_incoming(incoming_rules))
+        plugin_file = install_set(:plugin, plugin_incoming).values.first
+        script_files = install_set(:script, scripts_incoming)
         # After the plugin and scripts, which raise for a file the manifest
         # names and the bundle lacks: a refused install leaves hooks/ as it was.
         retire_hooks
@@ -95,8 +104,8 @@ module Samagotchi
       # load): every file in it goes, an edited one (or one the record
       # doesn't know) copied to the trash first, a dev link never (it points
       # at the source, which stays). Each is a :removed result (a dry run's
-      # :would_remove, through #planned) with the RETIRED note; an empty
-      # hooks/ dir goes without a word. The record keeps no hooks
+      # :would_remove) with the RETIRED note; an empty hooks/ dir goes
+      # without a word. The record keeps no hooks
       # (Provenance#write).
       def retire_hooks
         dir = @provenance.hooks_dir
@@ -104,9 +113,13 @@ module Samagotchi
 
         files = File.symlink?(dir) ? [] : Dir.glob("**/*", File::FNM_DOTMATCH, base: dir).sort.reject { |f| File.directory?(File.join(dir, f)) }
         files.each do |file|
-          @results["hooks/#{file}"] = @dry_run ? planned(retired) : retired
+          @results["hooks/#{file}"] = @dry_run ? retired.with(word: :would_remove) : retired
+        end
+        if @dry_run
+          edits = Trash.edits(dir, "hooks", @existing&.hooks&.transform_values(&:sha256))
+          @warnings << "Would copy to the trash first: #{edits.join(", ")}" unless edits.empty?
+          return
         end
-        return if @dry_run
 
         @trash.copy_edits(dir, "hooks", @existing&.hooks&.transform_values(&:sha256))
         FileUtils.rm_rf(dir)
@@ -114,44 +127,15 @@ module Samagotchi
 
       def retired = Installer::FileResult.new(word: :removed, note: RETIRED)
 
-      # The bundle's guardrails/*.yml into <bundle_dir>/guardrails/: the
-      # set replaces what an earlier version installed. Same bytes as
-      # installed are reported up to date, not "Installed".
-      # @return [Hash{String => String}] basename => installed path ({} on a dry run)
-      def install_guardrails(incoming_rules)
-        target = @provenance.guardrails_dir
-        results = incoming_rules.to_h { |src| [src, result_for(src, File.join(target, File.basename(src)), updated: false)] }
-        if @dry_run
-          results.each { |src, result| @results["guardrails/#{File.basename(src)}"] = planned(result) }
-          return {}
-        end
-
-        @trash.copy_edits(target, "guardrails", @existing&.guardrails, incoming_rules.to_h { |src| [File.basename(src), src] })
-        FileUtils.rm_rf(target)
-        return {} if incoming_rules.empty?
+      # The bundle's guardrails/*.yml, by basename.
+      def rules_incoming(incoming_rules) = incoming_rules.to_h { |src| [File.basename(src), src] }
 
-        FileUtils.mkdir_p(target)
-        incoming_rules.to_h do |src|
-          dest = File.join(target, File.basename(src))
-          place(src, dest)
-          @results["guardrails/#{File.basename(src)}"] = results[src]
-          [File.basename(src), dest]
-        end
-      end
-
-      # Copy the manifest's plugin file into the bundle's plugin/ dir,
-      # warning when its sha256 differs from the declared one or this chi
-      # doesn't meet requires_chi (the Engine then won't load it).
-      # @return [String, nil] the installed file (nil: none, or a dry run)
-      def install_plugin
+      # The manifest's plugin file, warning when this chi doesn't meet
+      # requires_chi (the Engine then won't load it). {} without one.
+      # @return [Hash{String => String}] its file => the source file
+      def plugin_incoming
         plugin = @manifest&.plugin
-        unless plugin
-          unless @dry_run
-            @trash.copy_edits(@provenance.plugin_dir, "plugin", @existing&.plugin_shas)
-            FileUtils.rm_rf(@provenance.plugin_dir)
-          end
-          return nil
-        end
+        return {} unless plugin
 
         src = File.join(@bundle_dir, plugin[:file])
         raise Installer::InstallError, "the manifest names plugin #{plugin[:file]}, which the bundle doesn't have" unless File.file?(src)
@@ -160,83 +144,101 @@ module Samagotchi
         if (failure = Manifest.requires_chi_failure(@manifest.requires_chi, @chi_version))
           @warnings << "Plugin #{plugin[:file]} won't load: #{failure}"
         end
-        dest = File.join(@provenance.plugin_dir, plugin[:file])
-        result = result_for(src, dest, updated: @upgrade && @provenance.installed?)
-        if @dry_run
-          @results[plugin[:file]] = planned(result)
-          return nil
-        end
-
-        @trash.copy_edits(@provenance.plugin_dir, "plugin", @existing&.plugin_shas, { plugin[:file] => src })
-        FileUtils.rm_rf(@provenance.plugin_dir)
-        FileUtils.mkdir_p(@provenance.plugin_dir)
-        place(src, dest)
-        @results[plugin[:file]] = result
-        warning = FileDigest.mismatch("plugin #{plugin[:file]}", dest, @manifest.checksum_for_plugin) if @strict && !@dev
-        @warnings << warning if warning
-        dest
+        { plugin[:file] => src }
       end
 
-      # The manifest's scripts, copied into <bundle_dir>/scripts/ (the
-      # folder replaced: a script the new version dropped goes). A declared
-      # sha256 that differs warns, as a plugin's does.
-      # @return [Hash{String => String}] file name => installed path
-      def install_scripts
+      # The manifest's scripts (a dev install warns of one it can't run).
+      # @return [Hash{String => String}] file name => the source file
+      def scripts_incoming
         scripts = @manifest&.scripts || {}
-        scripts.each_key do |file|
+        scripts.keys.to_h do |file|
           src = File.join(@bundle_dir, "scripts", file)
           raise Installer::InstallError, "the manifest names scripts/#{file}, which the bundle doesn't have" unless File.file?(src)
           raise Installer::InstallError, "scripts/#{file} is a symlink (not installed)" if linked?(src)
 
           @warnings << "scripts/#{file} is not executable; chmod +x #{src}" if @dev && !File.executable?(src) && !page_only?(file)
+          [file, src]
+        end
+      end
+
+      # One folder of the bundle's own dir (guardrails/, plugin/, scripts/),
+      # replaced whole by +incoming+: each file's AssetState and its action
+      # (FileActions' ASSET_INSTALL, or ASSET_UPGRADE over an installed
+      # bundle), one result per incoming file (a dry run's DRY_WORDS of it,
+      # and nothing written), an edit copied to the trash first (save_first),
+      #   then the folder replaced. A removed file is named in the summary.
+      #   A plugin or script whose sha256 differs from the declared one warns
+      #   (not a dev link: it is the source).
+      # @param incoming [Hash{String => String}] name => the source file, in
+      #   the order the results list them
+      # @return [Hash{String => String}] name => installed path ({} on a dry run)
+      def install_set(kind_of_file, incoming)
+        dir, recorded = folder(kind_of_file)
+        command = @upgrade && @provenance.installed? ? :upgrade : :install
+        states = AssetState.in(dir, kind_of_file: kind_of_file, recorded: recorded, incoming: incoming)
+                           .to_h { |asset| [asset.name, [asset, FileActions.for_asset(command, asset)]] }
+        if @dry_run
+          copies = states.filter_map { |_, (asset, action)| asset.label if action&.save_first }
+          @warnings << "Would copy to the trash first: #{copies.join(", ")}" unless copies.empty?
+        end
+        results = incoming.keys.to_h do |name|
+          asset, action = states.fetch(name)
+          [name, Installer::FileResult.new(word: @dry_run ? DRY_WORDS.fetch(action.word) : action.word, state: asset, action: action)]
         end
-        results = scripts.keys.to_h do |file|
-          [file, result_for(File.join(@bundle_dir, "scripts", file), File.join(@provenance.scripts_dir, file),
-                            updated: @upgrade && @provenance.installed?)]
+        dropped = states.filter_map do |name, (asset, action)|
+          next unless action&.do == :remove
+
+          [result_key(kind_of_file, name),
+           Installer::FileResult.new(word: @dry_run ? :would_remove : :removed, state: asset, action: action,
+                                     note: "no longer in the bundle")]
         end
         if @dry_run
-          results.each { |file, result| @results["scripts/#{file}"] = planned(result) }
+          results.each { |name, result| @results[result_key(kind_of_file, name)] = result }
+          dropped.each { |key, result| @results[key] = result }
           return {}
         end
 
-        @trash.copy_edits(@provenance.scripts_dir, "scripts", @existing&.scripts,
-                          scripts.keys.to_h { |file| [file, File.join(@bundle_dir, "scripts", file)] })
-        FileUtils.rm_rf(@provenance.scripts_dir)
-        return {} if scripts.empty?
-
-        FileUtils.mkdir_p(@provenance.scripts_dir)
-        scripts.to_h do |file, declared|
-          dest = File.join(@provenance.scripts_dir, file)
-          place(File.join(@bundle_dir, "scripts", file), dest)
-          @results["scripts/#{file}"] = results[file]
-          FileUtils.chmod(0o755, dest) unless @dev
-          warning = FileDigest.mismatch("script #{file}", dest, declared.to_s.delete_prefix("sha256:")) if @strict && !@dev
-          @warnings << warning if warning
-          [file, dest]
+        states.each_value { |asset, action| @trash.copy(asset.path, as: asset.label) if action.save_first }
+        FileUtils.rm_rf(dir)
+        if incoming.empty?
+          dropped.each { |key, result| @results[key] = result }
+          return {}
         end
+
+        FileUtils.mkdir_p(dir)
+        installed = incoming.to_h do |name, src|
+          dest = File.join(dir, name)
+          place(src, dest)
+          @results[result_key(kind_of_file, name)] = results[name]
+          FileUtils.chmod(0o755, dest) if kind_of_file == :script && !@dev
+          if (declared = declared_sha(kind_of_file, name)) && results[name].action.do == :write_incoming && @strict && !@dev
+            warning = FileDigest.mismatch("#{kind_of_file} #{name}", dest, declared)
+            @warnings << warning if warning
+          end
+          [name, dest]
+        end
+        dropped.each { |key, result| @results[key] = result }
+        installed
       end
 
-      # What the real run reports for +src+ over +dest+: up to date when the
-      # bytes are the same, else updated (+updated+: an upgrade over an
-      # install, of a file that is there) or installed. A dry run records #planned of it, so the two
-      # can't drift.
-      def result_for(src, dest, updated:)
-        word = if File.file?(dest) && FileUtils.identical?(src, dest) then :up_to_date
-               elsif updated && File.exist?(dest) then :updated
-               else :installed
-               end
-        Installer::FileResult.new(word: word)
+      # The kind's folder and the record's shas for it.
+      def folder(kind_of_file)
+        case kind_of_file
+        when :rule then [@provenance.guardrails_dir, @existing&.guardrails]
+        when :plugin then [@provenance.plugin_dir, @existing&.plugin_shas]
+        else [@provenance.scripts_dir, @existing&.scripts]
+        end
       end
 
-      # A dry run's word for a result: would_install, would_update,
-      # would_remove, or the up to date result as it is (nothing would be
-      # written).
-      def planned(result)
-        case result.word
-        when :installed then result.with(word: :would_install)
-        when :updated then result.with(word: :would_update)
-        when :removed then result.with(word: :would_remove)
-        else result
+      # Its key in the Installer's results (the summary's name): a rule's
+      # guardrails/r.yml, the plugin's own file name, a script's scripts/s.sh.
+      def result_key(kind_of_file, name) = kind_of_file == :plugin ? name : "#{AssetState::FOLDERS.fetch(kind_of_file)}/#{name}"
+
+      # The manifest's sha256 for a plugin or script (hex), nil for a rule.
+      def declared_sha(kind_of_file, name)
+        case kind_of_file
+        when :plugin then @manifest.checksum_for_plugin
+        when :script then @manifest.scripts[name].to_s.delete_prefix("sha256:")
         end
       end
 
@@ -267,7 +269,7 @@ module Samagotchi
       # GuardrailWiring#bundle_rules doesn't read the rules of a bundle whose
       # requires_chi this chi doesn't meet, and a session that never loaded
       # them records a required load failure (the gate refuses guarded calls
-      # until chi is updated): say so at install, as install_plugin does.
+      # until chi is updated): say so at install, as #plugin_incoming does.
       def warn_rules_requires_chi(rule_files)
         return if @manifest.nil? || rule_files.empty?
 

data/lib/samagotchi/memory_bundle/asset_state.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require_relative "trash"
+
+module Samagotchi
+  module MemoryBundle
+    # One file of a bundle's own folder (a guardrail rule, the plugin, a
+    # script) as a command finds it: derived from the file on disk, the sha
+    # the record holds and the source file that would take its place, never
+    # stored. FileActions' ASSET_* tables say what each command does in each
+    # state; AssetInstaller, ShippedUpdate's plan, Uninstaller and Status read
+    # it. Whether it is edited is Trash.edit?'s answer (what the trash keeps a
+    # copy of), asked once in .of.
+    #
+    #   name          its path in its folder (r.yml, plugin.rb, s.sh)
+    #   path          where it is installed
+    #   kind_of_file  :rule, :plugin or :script
+    #   state         :new        not there (or a broken link), the source has it
+    #                 :unchanged  the source's bytes already (a dev link to them too)
+    #                 :pristine   the recorded sha, the source has other bytes
+    #                 :edited     neither the recorded sha (none recorded: unknown,
+    #                             so edited) nor the source's bytes
+    #                 :linked     a link (a dev install's) to other bytes than the
+    #                             source's: it points at a source nothing here touches
+    #                 :dropped_pristine, :dropped_edited  there, the source hasn't
+    #                             it (with no source read, as uninstall and status
+    #                             do, every file there is one of these)
+    #                 :missing    recorded, not there, the source hasn't it
+    #   recorded      the record's sha256 for it (nil: not in the record)
+    #   incoming      the source file that replaces it (nil: none)
+    AssetState = Data.define(:name, :path, :kind_of_file, :state, :recorded, :incoming) do
+      # @param path [String] the installed file
+      # @param recorded [String, nil] its recorded sha256
+      # @param incoming [String, nil] the source file put in its place
+      def self.of(path, kind_of_file:, recorded: nil, incoming: nil, name: File.basename(path))
+        new(name: name, path: path, kind_of_file: kind_of_file, state: state_of(path, recorded, incoming),
+            recorded: recorded, incoming: incoming)
+      end
+
+      # Every file of the folder +dir+ a command meets: each file in it (at
+      # any depth, as Trash#copy_edits reads it; a linked dir isn't followed),
+      # each incoming one and each recorded one, by name.
+      # @param recorded [Hash, nil] name => recorded sha256
+      # @param incoming [Hash] name => the source file
+      # @return [Array<AssetState>]
+      def self.in(dir, kind_of_file:, recorded: nil, incoming: {})
+        recorded ||= {}
+        on_disk = if File.symlink?(dir) || !File.directory?(dir) then []
+                  else Dir.glob("**/*", File::FNM_DOTMATCH, base: dir).reject { |file| File.directory?(File.join(dir, file)) }
+                  end
+        (on_disk | incoming.keys | recorded.keys).sort.map do |name|
+          of(File.join(dir, name), kind_of_file: kind_of_file, recorded: recorded[name], incoming: incoming[name], name: name)
+        end
+      end
+
+      def self.state_of(path, recorded, incoming)
+        if incoming && File.file?(path) && FileUtils.identical?(incoming, path) then :unchanged
+        elsif File.symlink?(path) && File.exist?(path) then :linked
+        elsif !File.file?(path) then incoming ? :new : :missing
+        elsif Trash.edit?(path, recorded: recorded, incoming: incoming) then incoming ? :edited : :dropped_edited
+        else incoming ? :pristine : :dropped_pristine
+        end
+      end
+      private_class_method :state_of
+
+      # Trash.edit?'s rule (asked in .of): an edit a replace or a removal
+      # would lose, so the trash keeps a copy first.
+      def edited? = %i[edited dropped_edited].include?(state)
+
+      # Where the trash keeps its copy, and the plan names it: guardrails/r.yml,
+      # plugin/plugin.rb, scripts/s.sh.
+      def label = "#{self.class::FOLDERS.fetch(kind_of_file)}/#{name}"
+    end
+
+    class AssetState
+      # Each kind's folder in the bundle's own dir (and in the trash).
+      FOLDERS = { rule: "guardrails", plugin: "plugin", script: "scripts" }.freeze
+    end
+  end
+end

data/lib/samagotchi/memory_bundle/bundle_hook.rb

@@ -2,38 +2,18 @@
 
 module Samagotchi
   module MemoryBundle
-    # One class-file hook's metadata, as an older chi's installed record
-    # (manifest.json) keeps it (chi no longer installs or loads them:
-    # Manifest::HooksRetired; it reads them to retire, uninstall and name
-    # them, and the trash selection takes #sha256): the file's sha256
-    # ("sha256:<hex>", "" when none is recorded), the events it registers
-    # for (manifest `event:` for one, `events:` a list; none: it isn't
-    # loaded), on_error (skip, log or fail_closed) and priority. The one
-    # place the defaults live.
-    class BundleHook < Data.define(:sha256, :events, :on_error, :priority)
-      DEFAULT_ON_ERROR = "skip"
-      DEFAULT_PRIORITY = 100
+    # One class-file hook's sha256 in an older chi's installed record; its
+    # other fields are ignored now that class-file hooks are retired.
+    BundleHook = Data.define(:sha256) do
+      def initialize(sha256: "") = super
 
-      # @param event [String, nil] one event (manifest `event:`)
-      # @param events [Array<String>, String, nil] the events (manifest
-      #   `events:`); `event:` and `events:` together are joined, blanks
-      #   and repeats dropped
-      def initialize(sha256: "", event: nil, events: nil, on_error: DEFAULT_ON_ERROR, priority: DEFAULT_PRIORITY)
-        names = [*event, *events].map { |e| e.to_s.strip }.reject(&:empty?).uniq.freeze
-        super(sha256: sha256, events: names, on_error: on_error, priority: priority)
-      end
-
-      # @param raw [Hash, BundleHook, nil] string keys (manifest.yml) or
-      #   symbol keys (a read record); missing or blank values get the
-      #   defaults
+      # @param raw [Hash, BundleHook, nil] string or symbol keys; legacy
+      #   metadata beyond sha256 is ignored
       def self.parse(raw)
         return raw if raw.is_a?(BundleHook)
 
         h = raw.is_a?(Hash) ? raw.transform_keys(&:to_s) : {}
-        on_error = h["on_error"].to_s.strip
-        new(sha256: prefixed(h["sha256"]), event: h["event"], events: h["events"],
-            on_error: on_error.empty? ? DEFAULT_ON_ERROR : on_error,
-            priority: (h["priority"] || DEFAULT_PRIORITY).to_i)
+        new(sha256: prefixed(h["sha256"]))
       end
 
       # "sha256:<hex>" from either form, "" for none.

data/lib/samagotchi/memory_bundle/file_actions.rb

@@ -22,6 +22,8 @@ module Samagotchi
       #   :keep            left as it is (already the bundle's, or kept)
       #   :skip            left as it is, the bundle doesn't take it
       #   :move_to_trash   moved to the trash (a removal)
+      #   :remove          deleted (an asset: save_first copies an edit to the
+      #                    trash first)
       #   :refuse          the command stops
       #   :restore         the bundle's text put back (SystemBundle at its version)
       # save_first: a copy of the old bytes goes to the trash before a write
@@ -157,6 +159,54 @@ module Samagotchi
 
       TABLES = { install: INSTALL, force: FORCE, upgrade: UPGRADE, remerge: REMERGE, restore: RESTORE,
                  uninstall: UNINSTALL }.freeze
+
+      # A bundle's own folder (rules, the plugin, scripts: AssetState), which
+      # every install replaces whole: the source's files go in, the rest go,
+      # an edit (AssetState#edited?) copied to the trash first. A cell is keyed
+      # [state, kind_of_file] or [state, :any]. A file the source has is
+      # written even when it has its bytes already (and so checked against the
+      # manifest's sha, as any other).
+      ASSET_WRITE = Action.new(do: :write_incoming, word: :installed, next_base: :on_disk)
+      ASSET_REMOVE = Action.new(do: :remove, word: nil, next_base: :none, record: :drop)
+      ASSET_GONE = Action.new(do: :skip, word: nil, next_base: :none, record: :drop)
+
+      # A plain install, install --force, and an upgrade with no record yet.
+      ASSET_INSTALL = {
+        %i[new any] => ASSET_WRITE, %i[unchanged any] => ASSET_WRITE.with(word: :up_to_date),
+        %i[pristine any] => ASSET_WRITE, %i[edited any] => ASSET_WRITE.with(save_first: true),
+        %i[linked any] => ASSET_WRITE,
+        # The source dropped it: it goes with the folder, without a word.
+        %i[dropped_pristine any] => ASSET_REMOVE, %i[dropped_edited any] => ASSET_REMOVE.with(save_first: true),
+        %i[missing any] => ASSET_GONE
+      }.freeze
+
+      # An upgrade (--force too) over the record: a file it replaces is updated.
+      ASSET_UPGRADE = ASSET_INSTALL.merge(
+        %i[pristine any] => ASSET_WRITE.with(word: :updated),
+        %i[edited any] => ASSET_WRITE.with(word: :updated, save_first: true),
+        %i[linked any] => ASSET_WRITE.with(word: :updated),
+        %i[pristine rule] => ASSET_WRITE.with(word: :updated),
+        %i[edited rule] => ASSET_WRITE.with(word: :updated, save_first: true),
+        %i[linked rule] => ASSET_WRITE
+      ).freeze
+
+      # Uninstall: the folder goes (no source, so every file there is a
+      # dropped_* or a link), an edit copied to the trash first, --force or not.
+      ASSET_UNINSTALL = {
+        %i[dropped_pristine any] => ASSET_REMOVE, %i[dropped_edited any] => ASSET_REMOVE.with(save_first: true),
+        %i[linked any] => ASSET_REMOVE, %i[missing any] => ASSET_GONE
+      }.freeze
+
+      ASSET_TABLES = { install: ASSET_INSTALL, upgrade: ASSET_UPGRADE, uninstall: ASSET_UNINSTALL }.freeze
+
+      # The command's action for an AssetState: [state, kind_of_file], then
+      # [state, :any].
+      # @param command [Symbol] an ASSET_TABLES key
+      # @return [Action, nil] nil: the command never meets the state
+      def self.for_asset(command, asset)
+        table = ASSET_TABLES.fetch(command)
+        table[[asset.state, asset.kind_of_file]] || table[[asset.state, :any]]
+      end
       # The kinds whose row depends on another bundle listing the file.
       SHARED_ASKED = %i[dropped_pristine dropped_edited pristine pristine_no_base edited edited_no_base].freeze
 

data/lib/samagotchi/memory_bundle/installed_bundle.rb

@@ -26,7 +26,7 @@ module Samagotchi
     #               legacy_base: true on an older mark that has since got its incoming_sha (.legacy_mark?);
     #               why, missed, missed_places: FileStanding::Behind's, nil on an older mark;
     #               merged_version, merged_at, merged_trash: a merge no report has shown (Provenance#note_merged)
-    #   hooks       basename => BundleHook
+    #   hooks       basename => BundleHook (sha256; other legacy fields ignored)
     #   guardrails  basename => recorded sha256 ("" when none)
     #   scripts     file name => recorded sha256 ("" when none)
     #   plugin      PluginRef, nil without one

data/lib/samagotchi/memory_bundle/installer.rb

@@ -20,7 +20,7 @@ module Samagotchi
     # Installs a bundle into a scoped memories directory.
     #
     # Flow (#run):
-    #   1. Normalize source → directory, read manifest.yml (load_source)
+    #   1. Normalize source → directory, refuse retired hooks, read manifest.yml (load_source)
     #   2. Refuse a bundle whose requires_chi this chi doesn't meet,
     #      unless force (refuse_too_new)
     #   3. Copy .md files to the target scope dir and update index.md
@@ -356,7 +356,7 @@ module Samagotchi
         @bundle_dir = @source_dir = prepared.dir
         @source_owned = prepared.owned
         @source_commit = prepared.commit
-        refuse_hooks
+        Manifest::HooksRetired.refuse_source_files(@bundle_dir)
         @manifest = Manifest.read(dir: @bundle_dir)
         clash = @manifest.session_settings_clash
         raise InstallError, clash if clash
@@ -371,15 +371,6 @@ module Samagotchi
         @warnings << "No manifest found — proceeding without strict manifest validation"
       end
 
-      # A source that ships class-file hooks (hooks/*.rb, listed or not) is
-      # refused before its manifest is read; its manifest's hooks: is
-      # Manifest.read's refusal (Manifest::HooksRetired either way).
-      # @raise [Manifest::HooksRetired]
-      def refuse_hooks
-        files = Manifest::HooksRetired.files_in(@bundle_dir)
-        raise Manifest::HooksRetired.for_files(files) unless files.empty?
-      end
-
       # A bundle whose requires_chi this chi doesn't meet is not installed at
       # all: --force is what installs it, and its plugin and rules then
       # warn that they won't load (AssetInstaller). The words come from
@@ -557,6 +548,7 @@ module Samagotchi
       # cell's text merge runs on temp copies). --force would install every
       # file, unread.
       def preview_memory(file_key, state, action)
+        preview_trash_copy(file_key, state, action)
         return @results[file_key] = FileResult.new(word: :would_install, state: state, action: action) if @force
         return refuse_unreadable(file_key, state.paths[:current]) if action.do == :refuse
 
@@ -564,9 +556,20 @@ module Samagotchi
         action = decision.action if decision
         return note_conflict(file_key, decision.outcome, state) if action.behind?
 
+        preview_trash_copy(file_key, state, action)
         @results[file_key] = FileResult.new(word: DRY_WORDS.fetch(action.word), state: state, action: action)
       end
 
+      def preview_trash_copy(file_key, state, action)
+        return unless action.save_first
+
+        current = state.paths[:current]
+        incoming = state.paths[:incoming]
+        return unless File.file?(current) && !FileUtils.identical?(incoming, current)
+
+        @warnings << "Would copy to the trash first: #{file_key}"
+      end
+
       # Strict mode: a memory that takes the bundle's text (Action#takes_source?:
       # a new or missing file, --force, an upgrade's or a re-install's
       # fast-forward, a merge into a local edit) warns when the bundle's file