samagotchi 0.18.1 → 0.20.0

data/lib/samagotchi/bundles/mcp/plugin.rb

@@ -218,7 +218,11 @@ class Plugin
 
     def ended
       status = @wait.value
-      reason = "the server exited (#{status.exitstatus ? "status #{status.exitstatus}" : "signal #{status.termsig}"})"
+      reason = if status.nil?
+                 "the server exited"
+               else
+                 "the server exited (#{status.exitstatus ? "status #{status.exitstatus}" : "signal #{status.termsig}"})"
+               end
       waiting, closing = @mutex.synchronize do
         @dead ||= reason
         [@pending.values, @closing]
@@ -652,7 +656,7 @@ class Plugin
 
         notes = paths.map do |path|
           images << { path: path, name: File.basename(path) }
-          "[image #{images.size}: #{File.basename(path)}, attached]"
+          "[image #{images.size}: #{File.basename(path)}]"
         end
         [line, *notes].join("\n")
       when "image"
@@ -661,11 +665,21 @@ class Plugin
         next "[image: #{mime}, empty]" if bytes.empty?
 
         images << { bytes: bytes, name: "#{tool}-#{images.size + 1}.#{IMAGE_EXT.fetch(mime, "img")}" }
-        "[image #{images.size}: #{mime}, attached]"
+        "[image #{images.size}: #{mime}]"
       when "audio" then "[audio: #{block["mimeType"] || "unknown type"}]"
       when "resource"
         resource = block["resource"] || {}
-        resource["text"] || "[resource: #{resource["uri"]}]"
+        mime = resource["mimeType"].to_s
+        blob = resource["blob"].to_s
+        if mime.start_with?("image/") && !blob.empty?
+          bytes = blob.unpack1("m")
+          next "[image: #{mime}, empty]" if bytes.empty?
+
+          images << { bytes: bytes, name: "#{tool}-#{images.size + 1}.#{IMAGE_EXT.fetch(mime, "img")}" }
+          "[image #{images.size}: #{mime}]"
+        else
+          resource["text"] || "[resource: #{resource["uri"]}]"
+        end
       when "resource_link" then "[resource link: #{block["uri"]}]"
       else "[#{block["type"] || "unknown"} content]"
       end

data/lib/samagotchi/bundles/source-links/hooks/source_links.rb

@@ -321,7 +321,8 @@ class SourceLinks
     links.any? do |link|
       in_target = start >= link[:target][0] && finish <= link[:target][1]
       in_label = start >= link[:label][0] && finish <= link[:label][1]
-      in_target || (in_label && target_names_ref?(link[:target_text], text[start...finish]))
+      in_target || (in_label && target_names_ref?(link[:target_text], text[start...finish],
+                                                   case_insensitive: match.regexp.casefold?))
     end
   end
 
@@ -330,10 +331,12 @@ class SourceLinks
   # the ref. So `[JIRA-1](…/JIRA-12)` is NOT skipped (the target names
   # JIRA-12), while `[JIRA-123](…/JIRA-123)` is. Note this is stricter than
   # the bare-text scan's `\b`, which treats `-` as a boundary: `…/JIRA-1-foo`
-  # would match there but not here.
-  def target_names_ref?(target, ref)
+  # would match there but not here. A case_insensitive source compares
+  # without case too: `[jira-1](…/JIRA-1)` is skipped.
+  def target_names_ref?(target, ref, case_insensitive: false)
     escaped = Regexp.escape(ref)
-    target.match?(/(?<![A-Za-z0-9\-])#{escaped}(?![A-Za-z0-9\-])/)
+    flags = case_insensitive ? Regexp::IGNORECASE : 0
+    target.match?(Regexp.new("(?<![A-Za-z0-9\\-])#{escaped}(?![A-Za-z0-9\\-])", flags))
   end
 
   # A ref glued to URL punctuation is part of a link too, even when the span

data/lib/samagotchi/bundles/source-links/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: source-links
-version: 0.3.1
+version: 0.3.2
 scope: system
 description: Links source refs (JIRA tickets, GitHub issues, …) in the model's answer — inline links in the web, and a one-line note after the turn (note false turns it off); sources are configured patterns
 trust_level: reviewed
@@ -8,7 +8,7 @@ files:
   source_links.md: sha256:aebd37f1e25491780994ecc4afc20ed6e8db32b724dc038302bb050177efada8
 hooks:
   source_links.rb:
-    sha256: sha256:574ea0c2b36f80dde410c4251753d70cbeea081d129f3f3547f41370e3990993
+    sha256: sha256:5a996b718b1db729305b893ed583b9e600e813570861d47e0b65a24fec36a35d
     event: after_turn
     on_error: log
     priority: 90

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.18.1
+version: 0.20.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:29c2f7df9f6c5acbc5ec17000a4490741e55e426af15ca0d81c8706edd9bd027
   self_map.md: sha256:69bc0ec091fdaeedf6e3aa7365275461fe3eba32b2dedc9cf45044176c356af5
   config_modification_protocol.md: sha256:8d8921854e616d840b393cdda6fd911b7d5e8172501bb8293c01f734121ccc21
-  memory_guide.md: sha256:e535e31fcf29b4b32c270042851ecdd5f412ef2e3c56b0076963e3e1f1a08ef8
+  memory_guide.md: sha256:17126f5adb9ef7b33c40e920ef339388c8c8c045b38a7de825b08760604db4e4
   delegated.md: sha256:0a71d5dfa7127df2d51cb5f0e7214240ed88777e36559430a8724c796d7ae561

data/lib/samagotchi/bundles/system/memory_guide.md

@@ -88,13 +88,13 @@ Bundles are versioned directories/zips/tar.gz/git URLs with a `manifest.yml` and
 | `install <source> [--scope system\|project] [--force]` | Install from dir/zip/tar.gz/git URL. `--force` overwrites existing entries, otherwise skips them; a skipped file stays the user's (not recorded, never upgraded or removed by the bundle). Writes provenance to `.bundles/<name>/` (base snapshots + `manifest.json`) and updates `index.md`. Warns on double-brace placeholders and checksum mismatches (strict mode). |
 | `upgrade <source> [--force] [--dry-run] [--agent]` | 3-way merge upgrade (base vs current vs incoming) per `Merger.classify`: `install` (new file), `noop` (current==incoming), `fast_forward` (current==base, not edited → auto-update), `keep` (incoming==base → preserve local edits), `conflict` (both edited → warn, needs `--force` or interactive `memory_write` resolution). Pruned files (removed from new bundle) are kept if locally edited, otherwise warned. |
 | `uninstall <bundle> [--force]` | Moves the bundle's memory files to `.bundles/.trash/<bundle>-<time>/` (refuses locally edited ones unless `--force`; keeps a file another installed bundle also lists), removes their `index.md` lines, deletes the provenance dir. |
-| `status [<bundle>]` | Provenance + per-file `ok|modified|missing|no-index` vs stored checksum and base snapshot. |
+| `status [<bundle>]` | Provenance + per-file `ok|modified|missing|no-index` vs stored checksum and base snapshot; a model overlay (`<name>.<key>.md`) has no index line and reads `ok (model overlay)`. |
 | `diff <bundle> [file]` | Prints `base` (provenance snapshot) vs `current` (on-disk) for each file. |
 | `list` | Lists installed bundles (`name v<version> scope files installed_at`, plus the shipped version when newer) and the bundles shipped with chi that are not installed (`install <name>` installs one), grouped under their profile; an installed profile shows `includes=` and `left out=`. |
 | `build [--scope system\|project] [--name NAME] [--version VER] [--description DESC] [--out PATH] [FILES...]` | **Inverse of install** — builds a shareable bundle from local memories and installed hooks. Infers `zip` vs `dir`/`tar.gz` from `--out` extension; default `chi_system_memories.zip` (system) or `chi_<repo>_memories.zip` (project, named after the project root) v`1.0.0` in `Dir.pwd`. `FILES...` is an optional allowlist of memory basenames (`identity` or `identity.md`); if omitted, all `*.md` except `index.md`/hidden/non-md and the memories other installed bundles own (each named in a `Left out` line) are included. Installed hooks are copied to `hooks/` with their manifest metadata. Computes `sha256:` checksums and writes `manifest.yml` via `Manifest.write`. No provenance write. |
 
 **Scope resolution for install/build:**
-- CLI `--scope` wins over `manifest.yml` `scope`. Default is `system` if none given (`Installer#run`). For `project`, target is the project folder `<system dir>/projects/<basename>_<hash>` of the project root (`Installer#resolve_target_dir`).
+- CLI `--scope` wins over `manifest.yml` `scope`. Default is `system` if none given (`Installer#run`). For `project`, target is the project folder `<system dir>/projects/<basename>_<hash>` of the project root (`MemoryPaths.scope_dir`).
 
 **Example flows:**
 ```bash

data/lib/samagotchi/commands/registry.rb

@@ -28,8 +28,10 @@ module Samagotchi
         def in_ui?(ui) = uis.nil? || uis.include?(ui)
       end
 
-      def initialize
+      # @param entries [Array<Entry>] taken as they are, in order (.from_listing)
+      def initialize(entries: [])
         @entries = []
+        entries.each { |entry| add(entry) }
       end
 
       # A UI without an Engine (attached) learns the session's commands from
@@ -39,8 +41,7 @@ module Samagotchi
       # @param listing [Array<Hash>] #listing, with String or Symbol keys
       # @return [Registry]
       def self.from_listing(listing, base:)
-        registry = new
-        base.entries.each { |entry| registry.send(:add, entry) }
+        registry = new(entries: base.entries)
         known = base.entries.map(&:name)
         Array(listing).each do |item|
           item = item.transform_keys(&:to_sym)

data/lib/samagotchi/config.rb

@@ -107,6 +107,9 @@ module Samagotchi
       # The guardrails settings are config.yml only: a parent agent must not switch a child's guardrails off from its
       # own environment (SAMAGOTCHI_GUARDRAILS_ENABLED=false). SessionManager.spawn_options unsets them for a worker too.
       Entry.new(key: "guardrails.enabled",       yaml_path: %w[guardrails enabled],       type: :bool,   default: true,             expose: %i[config]),
+      # Which rules vote: auto (the default) leaves out the rules tagged `modes: [strict]`; strict runs them all. An unknown
+      # value warns and is auto.
+      Entry.new(key: "guardrails.mode",          yaml_path: %w[guardrails mode],          type: :enum,   default: "auto",           expose: %i[config], enum_values: %w[auto strict]),
       # Which models get the rules with `models: small` (Guardrails::ModelSize): auto (32B or less by the name's size, an MoE's
       # active size counting), globs on the bare model name or its key, "|"-separated (a YAML list works too), or "" ([]) for none.
       Entry.new(key: "guardrails.small_models",  yaml_path: %w[guardrails small_models],  type: :string, default: "auto",           expose: %i[config]),

data/lib/samagotchi/context_usage.rb

@@ -26,9 +26,9 @@ module Samagotchi
       usage = {} unless usage.is_a?(Hash)
 
       # The token counts come from the same parser SessionMetrics uses.
-      counts = TokenUsage.from_payload(payload_hash) || {}
-      prompt_tokens = counts[:prompt_tokens]
-      completion_tokens = counts[:completion_tokens]
+      counts = TokenUsage.from_payload(payload_hash)
+      prompt_tokens = counts&.prompt_tokens
+      completion_tokens = counts&.completion_tokens
 
       total_tokens = first_positive_integer(
         usage["total_tokens"], usage[:total_tokens],

data/lib/samagotchi/engine.rb

@@ -169,9 +169,10 @@ module Samagotchi
       # kernel's dispatch): the built-ins, per Engine.
       @tools = Tools::Builtins.registry
       if @scratch
-        # A scratch session's children would outlive it; its memories
-        # would too (write and edit into the memories: ScratchWrites).
-        [Tools::Delegate::NAME, Tools::DelegateResult::NAME].each { |name| @tools.unregister(name) }
+        # A scratch session's children would outlive it, and so would a
+        # note it left in a peer; its memories would too (write and edit
+        # into the memories: ScratchWrites).
+        [Tools::Delegate::NAME, Tools::DelegateResult::NAME, Tools::SendNote::NAME].each { |name| @tools.unregister(name) }
         @tools[Tools::MemoryWrite::NAME].handler = ->(_call, _kctx) { SCRATCH_MEMORY_WRITE }
       end
       # Likewise the slash commands its SessionCommands run.
@@ -614,6 +615,11 @@ module Samagotchi
       Thread.current[key] = outer
     end
 
+    # Whether an anytime command (/btw) still runs on its thread.
+    def anytime_running?
+      @lifecycle_mutex.synchronize { @anytime_threads.any?(&:alive?) }
+    end
+
     # Start an anytime command on its own thread (D8), one #shutdown waits
     # for, so its command_ran is announced before the process leaves.
     # @return [Thread]
@@ -2292,6 +2298,7 @@ module Samagotchi
         # not an event of its own.
         next thinking_refused(event) if event[:type] == :thinking_refused
 
+        event = with_generation_report(event) if event[:type] == :generation_completed
         emit_event(on_event, event)
         watch.feed(**progress) if watch && progress
         if event[:type] == :generation_completed
@@ -2301,6 +2308,19 @@ module Samagotchi
       end
     end
 
+    # A :generation_completed with the generation's decode speed (`speed:`
+    # {decode_tps:, source:}, nil without one) and the session's running
+    # token totals (`tokens:`, the snapshot's block): the web's info bar
+    # reads them from the stream. SessionMetrics closes the generation here,
+    # so the event it gets next finds it closed.
+    def with_generation_report(event)
+      report = @metrics.finish_generation
+      event.merge(speed: report.speed&.to_h, tokens: report.tokens)
+    rescue StandardError
+      event
+    end
+    private :with_generation_report
+
     # The turn's StreamWatch, or nil when no hook listens.
     def stream_watch(cancel_controller)
       return nil unless cancel_controller && @hooks.any?(Hooks::StreamWatch::EVENT)
@@ -2316,8 +2336,8 @@ module Samagotchi
       rescue StandardError
         nil
       end
-      # Turn-scoped sink: receives the original event hash (no event_seq),
-      # byte-for-byte unchanged. Sink errors are isolated and never break the
+      # Turn-scoped sink: receives the event hash as the stream handler
+      # passed it (no event_seq; a :generation_completed has its report). Sink errors are isolated and never break the
       # kernel loop (same as KernelLoop's own handling).
       if on_event
         begin

data/lib/samagotchi/guardrail_wiring.rb

@@ -70,10 +70,15 @@ module Samagotchi
       @interface = value
     end
 
+    # The approval scopes a scratch session offers: nothing outlives it.
+    SCRATCH_SCOPES = %w[once session].freeze
+
     # Where the approval store lives: beside Session's state dir
-    # ($XDG_STATE_HOME/samagotchi/guardrails/).
+    # ($XDG_STATE_HOME/samagotchi/guardrails/). A scratch session reads
+    # it but keeps its own session approvals in memory.
     def state_dir=(state_dir)
       @approvals = Guardrails::Approvals.new(dir: Guardrails::Approvals.dir_for(state_dir))
+      @approvals = Guardrails::Approvals::InMemory.new(@approvals) if @scratch
       @protected = nil
     end
 
@@ -207,7 +212,8 @@ module Samagotchi
       # A plugin tool is asked about by its label, as its row shows it.
       label = ToolActivity.plugin_label(verdict.call[:name].to_s, registry: @tools_lookup.call)
       # verdict.call is the call that will run (a hook may have replaced it).
-      payload = Guardrails::Approval.payload(verdict, label: label, preview: approval_preview(verdict.call))
+      payload = Guardrails::Approval.payload(verdict, label: label, preview: approval_preview(verdict.call),
+                                                      only: (SCRATCH_SCOPES if @scratch))
       Guardrails::Approval.settle(verdict, @ask.call(payload), payload[:approval][:scopes])
     end
 
@@ -273,7 +279,8 @@ module Samagotchi
         @failures.add("rules in config.yml", e.message, required: true, group: :rules)
       end
       Guardrails::Rules.new(rules + bundle_rules, disable: disable,
-                            enabled: Samagotchi::Config.get("guardrails.enabled") != false)
+                            enabled: Samagotchi::Config.get("guardrails.enabled") != false,
+                            mode: Samagotchi::Config.get("guardrails.mode") || "auto")
     end
 
     # The dry-run diff of an edit/write call for its approval; a preview

data/lib/samagotchi/guardrails/approval.rb

@@ -22,9 +22,11 @@ module Samagotchi
       #   approval[:tool] stays the raw name
       # @param preview [Hash, nil] EditPreview.for(verdict.call) for edit and
       #   write: the card shows its diff, the question text one change line
+      # @param only [Array<String>, nil] offer no scope beyond these (a
+      #   scratch session: once, session); "once" when none is left
       # @return [Hash] open_question fields
-      def payload(verdict, label: nil, preview: nil)
-        scopes = offered_scopes(verdict)
+      def payload(verdict, label: nil, preview: nil, only: nil)
+        scopes = offered_scopes(verdict, only: only)
         targets = verdict.targets
         {
           question: question_text(verdict, label: label, preview: preview),
@@ -42,6 +44,8 @@ module Samagotchi
             args: args_for_card(targets),
             cwd: targets&.cwd,
             repo_root: targets&.repo_root,
+            # The repository's name (a worktree's main checkout's folder).
+            repo_name: targets&.repo_name,
             branch: verdict.context&.branch(targets&.cwd || verdict.context.cwd),
             rule: verdict.rule,
             source: verdict.source,
@@ -81,12 +85,16 @@ module Samagotchi
       end
 
       # The rule's scopes; "rule" only when a rule id names what to approve.
-      def offered_scopes(verdict)
-        verdict.scopes.reject { |scope| scope == "rule" && verdict.rule.nil? }
+      def offered_scopes(verdict, only: nil)
+        scopes = verdict.scopes.reject { |scope| scope == "rule" && verdict.rule.nil? }
+        return scopes unless only
+
+        scopes &= only
+        scopes.empty? ? ["once"] : scopes
       end
 
       def label(scope, verdict)
-        place = verdict.targets&.repo_root ? "in this repo" : "in this directory"
+        place = verdict.targets&.repo_root ? "in this repo (#{verdict.targets.repo_name})" : "in this directory"
         case scope
         when "once" then "Allow once"
         when "session" then "Allow this call for the session"
@@ -123,9 +131,8 @@ module Samagotchi
         what = Approval.args_text(targets&.args, limit: ARGS_CHARS) if what.to_s.empty?
         lines = ["#{tool}: #{what}"]
         if targets
-          repo = targets.repo_root
           branch = verdict.context&.branch(targets.cwd)
-          where = repo ? "repo #{File.basename(repo)}#{", branch #{branch}" if branch}" : "not in a repo"
+          where = targets.repo_root ? "repo #{targets.repo_name}#{", branch #{branch}" if branch}" : "not in a repo"
           lines << "  in #{targets.cwd} (#{where})"
         end
         who = verdict.rule ? ["rule #{verdict.rule}", verdict.source].compact.join(", ") : (verdict.source || "hook")

data/lib/samagotchi/guardrails/approvals.rb

@@ -16,6 +16,10 @@ module Samagotchi
     #             this session;
     #   repo    — this exact call in this repo (the cwd outside a repo);
     #   rule    — anything this rule (from this source) asks about here.
+    # "This repo" is the repository (repo: its common git dir), so an
+    # approval holds in every worktree of it; repo_root, the worktree it
+    # was given in, is kept for showing, and an entry from before repo:
+    # still matches that exact folder.
     # "once" is never stored. A file that doesn't parse is moved aside to
     # approvals.json.corrupt-<UTC time>[-N], with a warning, and the store
     # starts empty: it only means more asks, and nothing is overwritten.
@@ -45,34 +49,48 @@ module Samagotchi
       # @param verdict [Verdict] an ask with its targets and context
       # @return [Hash, nil] the first entry that allows it
       def match(verdict)
-        key = self.class.key_for(verdict)
-        place = self.class.place_for(verdict)
+        self.class.find_in(read, verdict)
+      end
+
+      # Store the verdict's allowed scope (not "once").
+      # @return [Hash, nil] the entry
+      def add(verdict, scope)
+        entry = self.class.entry_for(verdict, scope) or return nil
+
+        update { |list| list << entry unless list.any? { |e| e.except("created_at") == entry.except("created_at") } }
+        entry
+      end
+
+      # @param list [Array<Hash>] entries
+      # @return [Hash, nil] the first of +list+ that allows +verdict+
+      def self.find_in(list, verdict)
+        key = key_for(verdict)
+        place = place_for(verdict)
+        repo = verdict.targets&.repo
+        here = ->(e) { e["repo"] ? e["repo"] == repo : e["repo_root"] == place }
         session_id = verdict.context&.session_id
-        read.find do |e|
+        list.find do |e|
           case e["scope"]
           when "session" then session_id && e["session_id"] == session_id && e["key"] == key
-          when "repo" then e["repo_root"] == place && e["key"] == key
-          when "rule" then verdict.rule && e["rule"] == verdict.rule && e["source"] == verdict.source &&
-                           e["repo_root"] == place
+          when "repo" then here.(e) && e["key"] == key
+          when "rule" then verdict.rule && e["rule"] == verdict.rule && e["source"] == verdict.source && here.(e)
           end
         end
       end
 
-      # Store the verdict's allowed scope (not "once").
-      # @return [Hash, nil] the entry
-      def add(verdict, scope)
+      # @return [Hash, nil] the entry that stores +scope+ for +verdict+; nil for "once"
+      def self.entry_for(verdict, scope)
         return nil unless STORED_SCOPES.include?(scope)
 
         entry = { "scope" => scope, "tool" => verdict.targets&.tool || verdict.call[:name].to_s,
                   "rule" => verdict.rule, "source" => verdict.source, "created_at" => Time.now.utc.iso8601 }
         case scope
-        when "session" then entry.merge!("session_id" => verdict.context&.session_id, "key" => self.class.key_for(verdict))
-        when "repo" then entry.merge!("repo_root" => self.class.place_for(verdict), "key" => self.class.key_for(verdict))
-        when "rule" then entry["repo_root"] = self.class.place_for(verdict)
+        when "session" then entry.merge!("session_id" => verdict.context&.session_id, "key" => key_for(verdict))
+        when "repo"
+          entry.merge!("repo_root" => place_for(verdict), "repo" => verdict.targets&.repo, "key" => key_for(verdict))
+        when "rule" then entry.merge!("repo_root" => place_for(verdict), "repo" => verdict.targets&.repo)
         end
-        entry.compact!
-        update { |list| list << entry unless list.any? { |e| e.except("created_at") == entry.except("created_at") } }
-        entry
+        entry.compact
       end
 
       # Remove entry +index+ (0-based, as #entries lists them).
@@ -167,6 +185,42 @@ module Samagotchi
           AtomicFile.write(@path, JSON.pretty_generate(list))
         end
       end
+
+      # A scratch session's approvals: the store's entries still apply, and
+      # its own session approvals are kept in memory, so none outlives it
+      # (it offers no wider scope; one that comes anyway is not kept).
+      class InMemory
+        def initialize(store)
+          @store = store
+          @own = []
+          @mutex = Mutex.new
+        end
+
+        def path = @store.path
+
+        # The store's entries, then this session's own.
+        def entries = @store.entries + @mutex.synchronize { @own.dup }
+
+        def match(verdict)
+          @mutex.synchronize { Approvals.find_in(@own, verdict) } || @store.match(verdict)
+        end
+
+        def add(verdict, scope)
+          return nil unless scope == "session"
+
+          entry = Approvals.entry_for(verdict, scope)
+          @mutex.synchronize { @own << entry unless @own.any? { |e| e.except("created_at") == entry.except("created_at") } }
+          entry
+        end
+
+        # Index as #entries lists them: the store's first, then its own.
+        def revoke(index)
+          stored = @store.entries.size
+          return @store.revoke(index) if index < stored
+
+          @mutex.synchronize { index - stored < @own.size ? @own.delete_at(index - stored) : nil }
+        end
+      end
     end
   end
 end

data/lib/samagotchi/guardrails/context.rb

@@ -24,6 +24,11 @@ module Samagotchi
       end
 
       def repo_root(dir = @cwd) = @git.root(dir)
+      # The git hooks dir of +dir+'s repo (core.hooksPath honoured), or nil.
+      def hooks_dir(dir = @cwd) = @git.hooks(dir)
+      # +dir+'s repository: its absolute common git dir (<root>/.git for a
+      # plain checkout; the same for every worktree of it), or nil.
+      def repo(dir = @cwd) = @git.common_dir(dir)
       def branch(dir = @cwd) = @git.branch(dir)
 
       # The hook event's context: hash.
@@ -41,6 +46,8 @@ module Samagotchi
       end
 
       def root(dir) = info(dir)[:root]
+      def hooks(dir) = info(dir)[:hooks]
+      def common_dir(dir) = info(dir)[:common_dir]
       def branch(dir) = info(dir)[:branch]
 
       private
@@ -53,16 +60,16 @@ module Samagotchi
       def probe(dir)
         return {} unless File.directory?(dir)
 
-        out, status = Open3.capture2e("git", "-C", dir, "rev-parse", "--show-toplevel", "--abbrev-ref", "HEAD")
-        lines = out.lines.map(&:strip)
-        # A repo with no commits yet has no HEAD: only the root answers.
-        unless status.success?
-          out, status = Open3.capture2e("git", "-C", dir, "rev-parse", "--show-toplevel")
-          return {} unless status.success?
+        paths = ["--show-toplevel", "--git-path", "hooks", "--git-common-dir"]
+        out, status = Open3.capture2e("git", "-C", dir, "rev-parse", *paths, "--abbrev-ref", "HEAD")
+        # A repo with no commits yet has no HEAD: only the paths answer.
+        out, status = Open3.capture2e("git", "-C", dir, "rev-parse", *paths) unless status.success?
+        return {} unless status.success?
 
-          lines = [out.strip]
-        end
-        { root: lines[0], branch: lines[1] }
+        lines = out.lines.map(&:strip)
+        # --git-path and --git-common-dir are relative to dir (core.hooksPath too).
+        { root: lines[0], hooks: lines[1] && File.expand_path(lines[1], dir),
+          common_dir: lines[2] && File.expand_path(lines[2], dir), branch: lines[3] }
       rescue SystemCallError
         {}
       end

data/lib/samagotchi/guardrails/parent_approvals.rb

@@ -2,6 +2,7 @@
 
 require_relative "../config"
 require_relative "../paths"
+require_relative "../memory_paths"
 require_relative "../hooks/loader"
 require_relative "approval"
 require_relative "protected_paths"
@@ -42,9 +43,12 @@ module Samagotchi
       # Rules that ask about chi's own config and hooks: the core
       # ProtectedPaths asks and the guardrails bundle's shell rule.
       PROTECTED_RULES = %w[chi-config chi-hooks shell-touches-chi].freeze
-      # A shell command naming chi's config, hooks or guardrails (the
-      # guardrails bundle's shell-touches-chi, less .git/hooks).
+      # A shell command naming chi's config, hooks or guardrails as text
+      # (broad: a parent may not allow what only looks like one).
       CHI_TEXT = %r{\.config/samagotchi|samagotchi/config\.yml|samagotchi/hooks|samagotchi/guardrails|memories/\.bundles}
+      # The guardrails bundle's shell-touches-chi, for a word it can't
+      # resolve to a path (Guardrails::ShellPaths): CHI_TEXT and .git/hooks.
+      CHI_SHELL_TEXT = Regexp.union(CHI_TEXT, %r{\.git/hooks})
 
       module_function
 
@@ -101,10 +105,12 @@ module Samagotchi
         command.match?(CHI_TEXT) || dirs.any? { |dir| command.include?(dir) || command.include?(ProtectedPaths.real(dir)) }
       end
 
-      # chi's config dir, the hooks dir and the approval store's dir.
+      # chi's config dir, the hooks dir, the approval store's dir and the
+      # installed bundles' dir.
       def chi_dirs
         hooks = begin Hooks::Loader.hooks_dir rescue nil end
-        [ConfigFile.config_dir, hooks, File.join(Paths.state_dir, "guardrails")]
+        bundles = begin MemoryPaths.bundles_dir rescue nil end
+        [ConfigFile.config_dir, hooks, File.join(Paths.state_dir, "guardrails"), bundles]
           .compact.map { |dir| dir.to_s.chomp("/") }.reject(&:empty?).uniq
       end