samagotchi 0.18.0 → 0.19.0

data/lib/samagotchi/bridge_client.rb

@@ -156,14 +156,16 @@ module Samagotchi
       post("command", payload, read_body: true)
     end
 
-    # POST /session/:id/exit: ask the worker to exit now. 200 = it will
-    # (status "exiting"), 409 = something keeps it up (reason), 404 with
+    # POST /session/:id/exit: ask the worker to exit now (+restart+: hand
+    # the session to a new worker, a worker with the "restart" feature). 200
+    # = it will (status "exiting"/"restarting"), 409 = something keeps it up (reason), 404 with
     # error "not_found" = a worker older than the route.
     # @param client_id [String] the asking UI, whose own streams don't hold
     # @return [Response]
-    def request_exit(client_id:, delete: false)
+    def request_exit(client_id:, delete: false, restart: false)
       body = { client_id: client_id }
       body[:delete] = true if delete
+      body[:restart] = true if restart
       post("exit", body, read_body: true)
     end
 
@@ -290,11 +292,13 @@ module Samagotchi
     # Follow the session's events on a reader thread (see EventStream).
     # @param snapshot [Boolean] join with a snapshot frame
     # @param client_id [String, nil] names the stream (see EventStream)
+    # @param rediscover [#call, nil] follows a new worker (see EventStream)
     # @yieldparam event [Hash] string-keyed event
     # @return [EventStream] started
-    def follow(snapshot: true, client_id: nil, reconnect_delays: EventStream::DEFAULT_RECONNECT_DELAYS, &on_event)
+    def follow(snapshot: true, client_id: nil, reconnect_delays: EventStream::DEFAULT_RECONNECT_DELAYS, rediscover: nil,
+               &on_event)
       EventStream.new(self, snapshot: snapshot, client_id: client_id, reconnect_delays: reconnect_delays,
-                            &on_event).start
+                            rediscover: rediscover, &on_event).start
     end
 
     # Open GET /session/:id/stream and read past the response headers.

data/lib/samagotchi/bundle_command.rb

@@ -360,8 +360,9 @@ module Samagotchi
           mods << "conflict (kept your edits over v#{st[:provenance][:version]}: chi bundle diff #{name} #{k})" if info[:conflict]
           mods << "modified" if info[:modified]
           mods << "missing" if info[:missing]
-          mods << "no-index" unless info[:index_present]
+          mods << "no-index" unless info[:index_present] || info[:overlay]
           label = mods.empty? ? "ok" : mods.join(",")
+          label += " (model overlay)" if info[:overlay]
           @stdout.puts "  #{k}: #{label}"
         end
         # Hooks

data/lib/samagotchi/bundles/source-links/hooks/source_links.rb

@@ -321,7 +321,8 @@ class SourceLinks
     links.any? do |link|
       in_target = start >= link[:target][0] && finish <= link[:target][1]
       in_label = start >= link[:label][0] && finish <= link[:label][1]
-      in_target || (in_label && target_names_ref?(link[:target_text], text[start...finish]))
+      in_target || (in_label && target_names_ref?(link[:target_text], text[start...finish],
+                                                   case_insensitive: match.regexp.casefold?))
     end
   end
 
@@ -330,10 +331,12 @@ class SourceLinks
   # the ref. So `[JIRA-1](…/JIRA-12)` is NOT skipped (the target names
   # JIRA-12), while `[JIRA-123](…/JIRA-123)` is. Note this is stricter than
   # the bare-text scan's `\b`, which treats `-` as a boundary: `…/JIRA-1-foo`
-  # would match there but not here.
-  def target_names_ref?(target, ref)
+  # would match there but not here. A case_insensitive source compares
+  # without case too: `[jira-1](…/JIRA-1)` is skipped.
+  def target_names_ref?(target, ref, case_insensitive: false)
     escaped = Regexp.escape(ref)
-    target.match?(/(?<![A-Za-z0-9\-])#{escaped}(?![A-Za-z0-9\-])/)
+    flags = case_insensitive ? Regexp::IGNORECASE : 0
+    target.match?(Regexp.new("(?<![A-Za-z0-9\\-])#{escaped}(?![A-Za-z0-9\\-])", flags))
   end
 
   # A ref glued to URL punctuation is part of a link too, even when the span

data/lib/samagotchi/bundles/source-links/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: source-links
-version: 0.3.1
+version: 0.3.2
 scope: system
 description: Links source refs (JIRA tickets, GitHub issues, …) in the model's answer — inline links in the web, and a one-line note after the turn (note false turns it off); sources are configured patterns
 trust_level: reviewed
@@ -8,7 +8,7 @@ files:
   source_links.md: sha256:aebd37f1e25491780994ecc4afc20ed6e8db32b724dc038302bb050177efada8
 hooks:
   source_links.rb:
-    sha256: sha256:574ea0c2b36f80dde410c4251753d70cbeea081d129f3f3547f41370e3990993
+    sha256: sha256:5a996b718b1db729305b893ed583b9e600e813570861d47e0b65a24fec36a35d
     event: after_turn
     on_error: log
     priority: 90

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.18.0
+version: 0.19.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:29c2f7df9f6c5acbc5ec17000a4490741e55e426af15ca0d81c8706edd9bd027
   self_map.md: sha256:69bc0ec091fdaeedf6e3aa7365275461fe3eba32b2dedc9cf45044176c356af5
   config_modification_protocol.md: sha256:8d8921854e616d840b393cdda6fd911b7d5e8172501bb8293c01f734121ccc21
-  memory_guide.md: sha256:e535e31fcf29b4b32c270042851ecdd5f412ef2e3c56b0076963e3e1f1a08ef8
+  memory_guide.md: sha256:8819678a243590203fa439ad736bf1959af4b4677bc6d2d507bad92c46fb1ccc
   delegated.md: sha256:0a71d5dfa7127df2d51cb5f0e7214240ed88777e36559430a8724c796d7ae561

data/lib/samagotchi/bundles/system/memory_guide.md

@@ -88,7 +88,7 @@ Bundles are versioned directories/zips/tar.gz/git URLs with a `manifest.yml` and
 | `install <source> [--scope system\|project] [--force]` | Install from dir/zip/tar.gz/git URL. `--force` overwrites existing entries, otherwise skips them; a skipped file stays the user's (not recorded, never upgraded or removed by the bundle). Writes provenance to `.bundles/<name>/` (base snapshots + `manifest.json`) and updates `index.md`. Warns on double-brace placeholders and checksum mismatches (strict mode). |
 | `upgrade <source> [--force] [--dry-run] [--agent]` | 3-way merge upgrade (base vs current vs incoming) per `Merger.classify`: `install` (new file), `noop` (current==incoming), `fast_forward` (current==base, not edited → auto-update), `keep` (incoming==base → preserve local edits), `conflict` (both edited → warn, needs `--force` or interactive `memory_write` resolution). Pruned files (removed from new bundle) are kept if locally edited, otherwise warned. |
 | `uninstall <bundle> [--force]` | Moves the bundle's memory files to `.bundles/.trash/<bundle>-<time>/` (refuses locally edited ones unless `--force`; keeps a file another installed bundle also lists), removes their `index.md` lines, deletes the provenance dir. |
-| `status [<bundle>]` | Provenance + per-file `ok|modified|missing|no-index` vs stored checksum and base snapshot. |
+| `status [<bundle>]` | Provenance + per-file `ok|modified|missing|no-index` vs stored checksum and base snapshot; a model overlay (`<name>.<key>.md`) has no index line and reads `ok (model overlay)`. |
 | `diff <bundle> [file]` | Prints `base` (provenance snapshot) vs `current` (on-disk) for each file. |
 | `list` | Lists installed bundles (`name v<version> scope files installed_at`, plus the shipped version when newer) and the bundles shipped with chi that are not installed (`install <name>` installs one), grouped under their profile; an installed profile shows `includes=` and `left out=`. |
 | `build [--scope system\|project] [--name NAME] [--version VER] [--description DESC] [--out PATH] [FILES...]` | **Inverse of install** — builds a shareable bundle from local memories and installed hooks. Infers `zip` vs `dir`/`tar.gz` from `--out` extension; default `chi_system_memories.zip` (system) or `chi_<repo>_memories.zip` (project, named after the project root) v`1.0.0` in `Dir.pwd`. `FILES...` is an optional allowlist of memory basenames (`identity` or `identity.md`); if omitted, all `*.md` except `index.md`/hidden/non-md and the memories other installed bundles own (each named in a `Left out` line) are included. Installed hooks are copied to `hooks/` with their manifest metadata. Computes `sha256:` checksums and writes `manifest.yml` via `Manifest.write`. No provenance write. |

data/lib/samagotchi/client.rb

@@ -31,12 +31,39 @@ module Samagotchi
     CONTEXT_WINDOW_PROBE_READ_TIMEOUT = 2
     # Seconds a probe that got no answer (refused, timed out) is remembered:
     # a down or hung server then costs one probe per window, not one per
-    # generation, and a new turn doesn't ask again at once.
+    # generation, and a new turn doesn't ask again at once. A request to the
+    # host that succeeds drops the remembered failure (see
+    # #clear_props_failures!).
     PROPS_FAILURE_TTL = 30
 
     DEFAULT_TRANSPORT = :llama_cpp
     VALID_TRANSPORTS = %i[llama_cpp mlx omlx].freeze
 
+    # One /props cache per host per process. A host has more than one Client
+    # in a run (the registry's, a rebuilt HostRegistry's, the Engines of a
+    # TUI and a spec): with a cache each, every one of them asks /props for
+    # the same server. Keyed by the host's base URL (scheme://host:port), so
+    # two Clients of the same server share the answers their turns read.
+    # Entries live for the process: they are the same small hash per host
+    # (answers by model, failures by model with their timestamps).
+    @props_store = {}
+    @props_store_mutex = Mutex.new
+
+    class << self
+      # The shared props entry for a host's base URL:
+      # { answers: { model => ServerProps }, failures: { model => [props, at] },
+      #   mutex: Mutex }. The caller may hold the entry's own mutex.
+      def props_entry(base_url)
+        @props_store_mutex.synchronize { @props_store[base_url] ||= { answers: {}, failures: {}, mutex: Mutex.new } }
+      end
+
+      # Forget every host's answers and failures. Specs call it per example
+      # (the store outlives one); nothing in a run does.
+      def reset_props_store!
+        @props_store_mutex.synchronize { @props_store.clear }
+      end
+    end
+
     # Wire-format strategy for one server transport. `Client` keeps the
     # transport-agnostic request/retry/stream loop; everything that differs
     # between llama.cpp's native API and the OpenAI-compatible servers
@@ -175,9 +202,13 @@ module Samagotchi
       @open_timeout  = Samagotchi::Config.positive_seconds("server.open_timeout", open_timeout)
       @read_timeout  = Samagotchi::Config.positive_seconds("server.read_timeout", read_timeout)
       @transport = build_transport(resolve_transport(transport))
-      @props_cache = {}
-      @props_failures = {}
-      @props_mutex = Mutex.new
+      # This host's process-wide /props entry (see self.props_entry): its
+      # answers and failures are shared with every other Client of the same
+      # server.
+      @props_entry = self.class.props_entry("#{@scheme}://#{@host}:#{@port}")
+      @props_cache = @props_entry[:answers]
+      @props_failures = @props_entry[:failures]
+      @props_mutex = @props_entry[:mutex]
       @first_token_timeout = first_token_timeout
       @host_name = name
       @label = name.to_s.empty? ? @transport.label : name.to_s
@@ -270,6 +301,10 @@ module Samagotchi
         chunk[:finish_reason] = finish_reason if finish_reason
         on_chunk.call(**chunk)
       end
+      # The host answered: a /props probe that failed while it was down (or
+      # loading) is no longer true, so the next turn asks it again instead
+      # of reusing the failure for the rest of its PROPS_FAILURE_TTL.
+      clear_props_failures!
       result
     rescue LLM::BadRequest => e
       raise unless e.status == 404 && @transport.name == :llama_cpp
@@ -293,6 +328,7 @@ module Samagotchi
     def list_models
       uri = URI("#{@scheme}://#{@host}:#{@port}#{@transport.models_path}")
       response = @http.fetch(uri, Net::HTTP::Get.new(uri), log_fields: { purpose: "models" })
+      clear_props_failures!
       parsed = JSON.parse(response.body.to_s)
       parsed.fetch("data", parsed)
     rescue LLM::ProviderError
@@ -309,7 +345,9 @@ module Samagotchi
     # Whatever the server answers (a non-200 too) is cached per model; a
     # network failure for PROPS_FAILURE_TTL seconds, then the next call asks
     # again. A probe cut by this thread's Client.probe_cancel answers
-    # :cancelled, uncached, and the turn's next request ends it.
+    # :cancelled, uncached, and the turn's next request ends it. A completion
+    # or model list this client gets through clears the failures: a server
+    # that just answered is not the down or hung one the window remembered.
     def server_props(model: nil)
       path = @transport.props_path
       return nil unless path
@@ -350,11 +388,12 @@ module Samagotchi
       nil
     end
 
-    # Forget cached /props answers: the server may have restarted with
-    # another -c, or a model switch may have loaded one with a different
-    # window. A recent failure stays until its PROPS_FAILURE_TTL ends: it
-    # holds no stale window, and asking a hung server again at every turn's
-    # start is what it saves.
+    # Forget cached /props answers for this host: the server may have
+    # restarted with another -c, or a model switch may have loaded one with a
+    # different window. The host's entry is shared with every Client of the
+    # same server, so the clear reaches them all. A recent failure stays
+    # until its PROPS_FAILURE_TTL ends: it holds no stale window, and asking
+    # a hung server again at every turn's start is what it saves.
     def invalidate_context_window!
       @props_mutex.synchronize { @props_cache.clear }
     end
@@ -363,6 +402,15 @@ module Samagotchi
 
     def monotonic_now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
 
+    # The host answered a request: whatever a probe failed with (refused,
+    # timed out, 503 while it loaded) is stale, so the next probe asks it
+    # again rather than serving the failure for the rest of its
+    # PROPS_FAILURE_TTL. A cached answer stays: it was read from the same
+    # running server.
+    def clear_props_failures!
+      @props_mutex.synchronize { @props_failures.clear }
+    end
+
     def probe_props(path, model)
       query = model.empty? ? "" : "?#{URI.encode_www_form(model: model)}"
       uri = URI("#{@scheme}://#{@host}:#{@port}#{path}#{query}")

data/lib/samagotchi/engine.rb

@@ -142,7 +142,8 @@ module Samagotchi
         model_key: -> { @model_key },
         model_name: -> { guardrail_model_name },
         cancelled: -> { !!active_cancel_controller&.cancelled? },
-        ask: ->(fields) { open_question(fields) }
+        ask: ->(fields) { open_question(fields) },
+        notify: ->(message) { guardrail_notify(message) }
       )
       @guardrail_failures = @guardrail_wiring.failures
       # Plugins that failed to load: announced apart, as plugins (not
@@ -168,9 +169,10 @@ module Samagotchi
       # kernel's dispatch): the built-ins, per Engine.
       @tools = Tools::Builtins.registry
       if @scratch
-        # A scratch session's children would outlive it; its memories
-        # would too (write and edit into the memories: ScratchWrites).
-        [Tools::Delegate::NAME, Tools::DelegateResult::NAME].each { |name| @tools.unregister(name) }
+        # A scratch session's children would outlive it, and so would a
+        # note it left in a peer; its memories would too (write and edit
+        # into the memories: ScratchWrites).
+        [Tools::Delegate::NAME, Tools::DelegateResult::NAME, Tools::SendNote::NAME].each { |name| @tools.unregister(name) }
         @tools[Tools::MemoryWrite::NAME].handler = ->(_call, _kctx) { SCRATCH_MEMORY_WRITE }
       end
       # Likewise the slash commands its SessionCommands run.
@@ -613,6 +615,11 @@ module Samagotchi
       Thread.current[key] = outer
     end
 
+    # Whether an anytime command (/btw) still runs on its thread.
+    def anytime_running?
+      @lifecycle_mutex.synchronize { @anytime_threads.any?(&:alive?) }
+    end
+
     # Start an anytime command on its own thread (D8), one #shutdown waits
     # for, so its command_ran is announced before the process leaves.
     # @return [Thread]
@@ -1194,6 +1201,16 @@ module Samagotchi
     end
     private :hook_notify
 
+    # A guardrails line to the user after load (:guardrail_warning, as the
+    # load failures show): a running turn's event, else announced.
+    def guardrail_notify(message)
+      event = { type: :guardrail_warning, message: message.to_s }
+      in_turn, sink = @turn_state.in_turn_sink
+      in_turn ? emit_event(sink, event) : announce_or_hold(event)
+      nil
+    end
+    private :guardrail_notify
+
     # A question through the question flow (REPL sync handler, attached TUI,
     # web), single-select, kind "hook". A --non-interactive run has no one
     # to ask: nil at once. Anything but an answer (a sync handler's text, no
@@ -1569,13 +1586,13 @@ module Samagotchi
       emit_event(turn.on_event, turn.tag(turn_started))
       raise image_error if image_error
 
-      # Ask the server for its window again each turn (one short /props GET,
-      # cached across the turn's generations): a restart with another -c
-      # between turns raises no error that would drop the cache. The
-      # profile may probe too (a first turn, a retry). Both run after
-      # run_turn's probe-cancel swap, so a Stop cuts them, and a failure
-      # ends the turn as turn_failed.
-      @client.invalidate_context_window!
+      # The window and the profile probes run after run_turn's probe-cancel
+      # swap, so a Stop cuts them; a failure ends the turn as turn_failed.
+      # The cache itself was dropped at the previous turn's end, so this
+      # turn's first probe asks the server (a restart with another -c
+      # between turns is noticed), and the answer the session's prompt build
+      # read for its profile (a first turn) is what this turn starts from:
+      # one GET /props per turn, not two.
       refresh_profile!
 
       # Before anything of the turn is kept or a reminder is used up.
@@ -1828,6 +1845,13 @@ module Samagotchi
       # treats the just-finished turn as activity and re-arms its window.
       left = @turn_state.finish!
       Client.swap_probe_cancel(probe_cancel_before)
+      # The next turn's window and served model are asked again: the cache
+      # (this host's, process-wide) is dropped here, at the turn's end,
+      # rather than at its start, so what this turn read (the profile's own
+      # probe included) is not asked for a second time within the turn. A
+      # restart with another -c between turns is still noticed: the next
+      # turn's first probe goes to the server.
+      @client.invalidate_context_window!
       log_dropped_steers(left, "turn_ended")
       record_activity
       # Clear hooks so they remain turn-scoped and never leak into the next turn.

data/lib/samagotchi/guardrail_wiring.rb

@@ -5,6 +5,8 @@ require "yaml"
 require_relative "config"
 require_relative "log"
 require_relative "guardrails"
+require_relative "memory_bundle/manifest"
+require_relative "version"
 require_relative "hooks"
 require_relative "edit_preview"
 require_relative "tool_activity"
@@ -32,7 +34,10 @@ module Samagotchi
     # @param model_name [#call] → String, nil: the effective model's bare name
     # @param cancelled [#call] → Boolean, whether the running turn is cancelled
     # @param ask       [#call] (fields) → the answer; the Engine's question flow
-    def initialize(scratch:, hooks:, tools:, session:, model_key:, cancelled:, ask:, model_name: -> {})
+    # @param notify    [#call] (message) → shows a guardrails line in every UI
+    #   (a bundle's rules kept because it needs a newer chi)
+    def initialize(scratch:, hooks:, tools:, session:, model_key:, cancelled:, ask:, model_name: -> {},
+                   notify: ->(_message) {})
       @scratch = scratch
       @hooks_lookup = hooks
       @tools_lookup = tools
@@ -41,6 +46,11 @@ module Samagotchi
       @model_name_lookup = model_name
       @cancelled_lookup = cancelled
       @ask = ask
+      @notify = notify
+      # Bundle name → the rules last loaded from it whole, kept while the
+      # installed version needs a newer chi; [name, version] said so once.
+      @loaded_bundle_rules = {}
+      @kept_noticed = {}
       @failures = Guardrails::LoadFailures.new
       @rules_mutex = Mutex.new
       @git = Guardrails::GitInfo.new
@@ -60,10 +70,15 @@ module Samagotchi
       @interface = value
     end
 
+    # The approval scopes a scratch session offers: nothing outlives it.
+    SCRATCH_SCOPES = %w[once session].freeze
+
     # Where the approval store lives: beside Session's state dir
-    # ($XDG_STATE_HOME/samagotchi/guardrails/).
+    # ($XDG_STATE_HOME/samagotchi/guardrails/). A scratch session reads
+    # it but keeps its own session approvals in memory.
     def state_dir=(state_dir)
       @approvals = Guardrails::Approvals.new(dir: Guardrails::Approvals.dir_for(state_dir))
+      @approvals = Guardrails::Approvals::InMemory.new(@approvals) if @scratch
       @protected = nil
     end
 
@@ -115,7 +130,9 @@ module Samagotchi
 
     # Installed bundles' guardrails/*.yml, by bundle name then file name.
     # A file that is missing, changed since install (sha256) or doesn't
-    # parse is a required load failure.
+    # parse is a required load failure. A bundle whose requires_chi this
+    # chi doesn't meet isn't read (its rules may use keys this chi doesn't
+    # know): the rules last loaded from it stay (#too_new_bundle_rules).
     def bundle_rules
       require_relative "memory_bundle/provenance"
       rules = []
@@ -125,7 +142,13 @@ module Samagotchi
           @failures.add("rules (bundle #{bundle_name})", data[:error], required: true, group: :rules)
           next
         end
+        if (too_new = MemoryBundle::Manifest.requires_chi_failure(data[:requires_chi], Samagotchi::VERSION))
+          rules.concat(too_new_bundle_rules(bundle_name, data, too_new))
+          next
+        end
         dir = MemoryBundle::Provenance.new(name: bundle_name).guardrails_dir
+        loaded = []
+        whole = true
         data[:guardrails].sort_by { |k, _| k.to_s }.each do |basename, meta|
           what = "rules #{basename} (bundle #{bundle_name})"
           path = File.join(dir, basename.to_s)
@@ -139,12 +162,15 @@ module Samagotchi
             doc = YAML.safe_load(File.read(path))
             raise Guardrails::Rules::ParseError, "expected a mapping with rules:" unless doc.is_a?(Hash)
 
-            rules.concat(Guardrails::Rules.parse(doc["rules"], source: "bundle #{bundle_name}"))
+            loaded.concat(Guardrails::Rules.parse(doc["rules"], source: "bundle #{bundle_name}"))
           rescue Guardrails::Rules::ParseError, Psych::Exception => e
             Log.warn(:guardrails, "rules_file_invalid", echo: "[samagotchi:guardrails] #{what}: #{e.message}", bundle: bundle_name, file: basename.to_s)
             @failures.add(what, e.message, required: true, group: :rules)
+            whole = false
           end
         end
+        rules.concat(loaded)
+        @loaded_bundle_rules[bundle_name] = loaded if whole
       end
       rules
     rescue StandardError => e
@@ -186,12 +212,45 @@ module Samagotchi
       # A plugin tool is asked about by its label, as its row shows it.
       label = ToolActivity.plugin_label(verdict.call[:name].to_s, registry: @tools_lookup.call)
       # verdict.call is the call that will run (a hook may have replaced it).
-      payload = Guardrails::Approval.payload(verdict, label: label, preview: approval_preview(verdict.call))
+      payload = Guardrails::Approval.payload(verdict, label: label, preview: approval_preview(verdict.call),
+                                                      only: (SCRATCH_SCOPES if @scratch))
       Guardrails::Approval.settle(verdict, @ask.call(payload), payload[:approval][:scopes])
     end
 
     private
 
+    # The rules of a bundle that needs a newer chi: the ones last loaded
+    # from it, with one notice per bundle version (restart the session to
+    # load the new ones). Never loaded (a chi older than the bundle it
+    # starts with): none, and a required load failure, as the hook loader
+    # does for a guardrail hook, so the calls aren't quietly unguarded.
+    def too_new_bundle_rules(bundle_name, data, reason)
+      kept = @loaded_bundle_rules[bundle_name]
+      unless kept
+        Log.warn(:guardrails, "bundle_rules_requires_chi", echo: "[samagotchi:guardrails] bundle #{bundle_name}: its rules are not loaded: #{reason}",
+                                                           bundle: bundle_name)
+        @failures.add("rules (bundle #{bundle_name})", "#{reason}; update chi (chi update) or uninstall the bundle",
+                      required: true, group: :rules)
+        return []
+      end
+
+      key = [bundle_name, data[:version].to_s]
+      return kept if @kept_noticed[key]
+
+      @kept_noticed[key] = true
+      Log.warn(:guardrails, "bundle_rules_kept", bundle: bundle_name, version: data[:version].to_s,
+                                                 requires_chi: data[:requires_chi].to_s)
+      @notify.call(kept_notice(bundle_name, data))
+      kept
+    end
+
+    def kept_notice(bundle_name, data)
+      id = @session_lookup.call&.id || "ID"
+      "bundle #{bundle_name} #{data[:version]} needs chi #{data[:requires_chi]} and this session runs chi #{Samagotchi::VERSION}: " \
+        "its new rules are not loaded, the ones loaded before still apply. Restart the session to load them " \
+        "(chi sessions stop #{id}, then chi --resume #{id})"
+    end
+
     # [path, mtime, size] of config.yml and every installed bundle's
     # manifest.json and guardrails/ file.
     def rules_stamp

data/lib/samagotchi/guardrails/approval.rb

@@ -22,9 +22,11 @@ module Samagotchi
       #   approval[:tool] stays the raw name
       # @param preview [Hash, nil] EditPreview.for(verdict.call) for edit and
       #   write: the card shows its diff, the question text one change line
+      # @param only [Array<String>, nil] offer no scope beyond these (a
+      #   scratch session: once, session); "once" when none is left
       # @return [Hash] open_question fields
-      def payload(verdict, label: nil, preview: nil)
-        scopes = offered_scopes(verdict)
+      def payload(verdict, label: nil, preview: nil, only: nil)
+        scopes = offered_scopes(verdict, only: only)
         targets = verdict.targets
         {
           question: question_text(verdict, label: label, preview: preview),
@@ -81,8 +83,12 @@ module Samagotchi
       end
 
       # The rule's scopes; "rule" only when a rule id names what to approve.
-      def offered_scopes(verdict)
-        verdict.scopes.reject { |scope| scope == "rule" && verdict.rule.nil? }
+      def offered_scopes(verdict, only: nil)
+        scopes = verdict.scopes.reject { |scope| scope == "rule" && verdict.rule.nil? }
+        return scopes unless only
+
+        scopes &= only
+        scopes.empty? ? ["once"] : scopes
       end
 
       def label(scope, verdict)

data/lib/samagotchi/guardrails/approvals.rb

@@ -45,10 +45,25 @@ module Samagotchi
       # @param verdict [Verdict] an ask with its targets and context
       # @return [Hash, nil] the first entry that allows it
       def match(verdict)
-        key = self.class.key_for(verdict)
-        place = self.class.place_for(verdict)
+        self.class.find_in(read, verdict)
+      end
+
+      # Store the verdict's allowed scope (not "once").
+      # @return [Hash, nil] the entry
+      def add(verdict, scope)
+        entry = self.class.entry_for(verdict, scope) or return nil
+
+        update { |list| list << entry unless list.any? { |e| e.except("created_at") == entry.except("created_at") } }
+        entry
+      end
+
+      # @param list [Array<Hash>] entries
+      # @return [Hash, nil] the first of +list+ that allows +verdict+
+      def self.find_in(list, verdict)
+        key = key_for(verdict)
+        place = place_for(verdict)
         session_id = verdict.context&.session_id
-        read.find do |e|
+        list.find do |e|
           case e["scope"]
           when "session" then session_id && e["session_id"] == session_id && e["key"] == key
           when "repo" then e["repo_root"] == place && e["key"] == key
@@ -58,21 +73,18 @@ module Samagotchi
         end
       end
 
-      # Store the verdict's allowed scope (not "once").
-      # @return [Hash, nil] the entry
-      def add(verdict, scope)
+      # @return [Hash, nil] the entry that stores +scope+ for +verdict+; nil for "once"
+      def self.entry_for(verdict, scope)
         return nil unless STORED_SCOPES.include?(scope)
 
         entry = { "scope" => scope, "tool" => verdict.targets&.tool || verdict.call[:name].to_s,
                   "rule" => verdict.rule, "source" => verdict.source, "created_at" => Time.now.utc.iso8601 }
         case scope
-        when "session" then entry.merge!("session_id" => verdict.context&.session_id, "key" => self.class.key_for(verdict))
-        when "repo" then entry.merge!("repo_root" => self.class.place_for(verdict), "key" => self.class.key_for(verdict))
-        when "rule" then entry["repo_root"] = self.class.place_for(verdict)
+        when "session" then entry.merge!("session_id" => verdict.context&.session_id, "key" => key_for(verdict))
+        when "repo" then entry.merge!("repo_root" => place_for(verdict), "key" => key_for(verdict))
+        when "rule" then entry["repo_root"] = place_for(verdict)
         end
-        entry.compact!
-        update { |list| list << entry unless list.any? { |e| e.except("created_at") == entry.except("created_at") } }
-        entry
+        entry.compact
       end
 
       # Remove entry +index+ (0-based, as #entries lists them).
@@ -167,6 +179,42 @@ module Samagotchi
           AtomicFile.write(@path, JSON.pretty_generate(list))
         end
       end
+
+      # A scratch session's approvals: the store's entries still apply, and
+      # its own session approvals are kept in memory, so none outlives it
+      # (it offers no wider scope; one that comes anyway is not kept).
+      class InMemory
+        def initialize(store)
+          @store = store
+          @own = []
+          @mutex = Mutex.new
+        end
+
+        def path = @store.path
+
+        # The store's entries, then this session's own.
+        def entries = @store.entries + @mutex.synchronize { @own.dup }
+
+        def match(verdict)
+          @mutex.synchronize { Approvals.find_in(@own, verdict) } || @store.match(verdict)
+        end
+
+        def add(verdict, scope)
+          return nil unless scope == "session"
+
+          entry = Approvals.entry_for(verdict, scope)
+          @mutex.synchronize { @own << entry unless @own.any? { |e| e.except("created_at") == entry.except("created_at") } }
+          entry
+        end
+
+        # Index as #entries lists them: the store's first, then its own.
+        def revoke(index)
+          stored = @store.entries.size
+          return @store.revoke(index) if index < stored
+
+          @mutex.synchronize { index - stored < @own.size ? @own.delete_at(index - stored) : nil }
+        end
+      end
     end
   end
 end

data/lib/samagotchi/host_registry.rb

@@ -2,6 +2,7 @@
 
 require "ipaddr"
 require_relative "config"
+require_relative "log"
 require_relative "model_ref"
 require_relative "client"
 require_relative "llm/openai_chat"
@@ -125,9 +126,17 @@ module Samagotchi
     LOCAL_NETS = %w[127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 100.64.0.0/10
                     ::1/128 fc00::/7 fe80::/10].map { |net| IPAddr.new(net) }.freeze
 
-    # Whether an address is remote: https, or an http IP address outside
-    # the local nets (LOCAL_NETS). An http host named by a name (localhost,
-    # box, mac.local, gpu.lan) counts as local: chi doesn't look names up.
+    # Name suffixes that stay on a home or office network: mDNS, the
+    # special-use and customary private names, router defaults (fritz.box)
+    # and Tailscale's MagicDNS. Compared on whole labels.
+    LOCAL_NAME_SUFFIXES = %w[localhost local lan home home.arpa internal intranet localdomain private corp test
+                             box ts.net].freeze
+
+    # Whether an address is remote: https, an http IP address outside the
+    # local nets (LOCAL_NETS), or an http name with a dot whose suffix isn't
+    # a local one (LOCAL_NAME_SUFFIXES): `gpu.example.com` is remote, while
+    # `box`, `mac.local`, `gpu.lan` and `pc.tail1234.ts.net` are local. chi
+    # doesn't look names up; hosts.<name>.remote overrides either way.
     def self.remote_address?(scheme, host)
       return true if scheme.to_s == "https"
 
@@ -135,9 +144,17 @@ module Samagotchi
       address = address.native if address.ipv4_mapped?
       LOCAL_NETS.none? { |net| net.family == address.family && net.include?(address) }
     rescue IPAddr::Error
-      false
+      remote_name?(host)
     end
 
+    def self.remote_name?(host)
+      name = host.to_s.downcase.delete_suffix(".")
+      return false unless name.include?(".")
+
+      LOCAL_NAME_SUFFIXES.none? { |suffix| name == suffix || name.end_with?(".#{suffix}") }
+    end
+    private_class_method :remote_name?
+
     # server.first_token_timeout, or nil when unset or unreadable.
     def self.configured_first_token_timeout
       Config.get("server.first_token_timeout")
@@ -273,6 +290,7 @@ module Samagotchi
             data = { host: entry.host, port: entry.port, transport: entry.transport, models: models, error: nil }
             @mutex.synchronize { @host_lists[name] = { data: data, at: @clock.call } }
           rescue StandardError => e
+            Log.warn(:model, "list_failed", host: name, error: e.class.name, msg: e.message.to_s[0, 500])
             data = { host: entry.host, port: entry.port, transport: entry.transport, models: [], error: e.message }
           end
           results_mutex.synchronize { results[name] = data }