samagotchi 0.19.0 → 0.20.0

data/lib/samagotchi/bundles/guardrails/guardrails/rules.yml

@@ -5,8 +5,12 @@
 #
 # Fields: id, tool (a name, a list, or shell = execute + task_create),
 # command (Ruby regex), path (outside_repo or a glob), git (outside_repo:
-# a shell call runs commit/add/reset/… in another checkout), verdict (ask|deny),
-# reason, scopes (for an ask: once, session, repo, rule; default all).
+# a shell call runs commit/add/reset/… in another checkout), touches
+# (chi_dirs: a shell command names a path in chi's own dirs), skip_read_only
+# (true: a command that only reads, ls/cat/rg/sed -n/git log…, doesn't
+# match), modes (strict: only with guardrails.mode: strict; untagged rules
+# ask in every mode), verdict (ask|deny), reason, scopes (for an ask: once,
+# session, repo, rule; default all).
 # [^;&|\n]* keeps a match inside one command of a chain; the git rules match
 # the subcommand after optional global options (git -C dir push).
 rules:
@@ -31,9 +35,11 @@ rules:
     command: '\bgit(?:\s+(?:-C\s+\S+|-c\s+\S+|--?[A-Za-z][\w-]*(?:=\S+)?))*\s+branch\b[^;&|\n]*\s(-[a-zA-Z]*D|--delete\s+--force|--force\s+--delete)\b'
     verdict: ask
     reason: git branch -D deletes a branch even if it is not merged
+  # Strict mode only: a rebase rewrites local history, which the reflog keeps.
   - id: git-rebase
     tool: shell
     command: '\bgit(?:\s+(?:-C\s+\S+|-c\s+\S+|--?[A-Za-z][\w-]*(?:=\S+)?))*\s+rebase\b'
+    modes: [strict]
     verdict: ask
     reason: git rebase rewrites history
   - id: git-history-rewrite
@@ -44,10 +50,13 @@ rules:
 
   # ── deleting ───────────────────────────────────────────────────────────
   # rm with both -r and -f on an absolute path, ~, $HOME or a path with ..
-  # (a text heuristic; rm -rf build/ in the repo is not asked).
+  # (a text heuristic; rm -rf build/ in the repo is not asked), unless
+  # every rm -rf target is inside a tmp dir (rm: outside_tmp; /tmp itself,
+  # /tmp/* and a link out of it still ask).
   - id: rm-rf-wide
     tool: shell
     command: '\brm\b(?=[^;&|\n]*\s(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)(\s|$))(?=[^;&|\n]*\s(-[a-zA-Z]*f[a-zA-Z]*|--force)(\s|$))[^;&|\n]*\s(/|~|\$HOME|\S*\.\.)'
+    rm: outside_tmp
     verdict: ask
     reason: rm -rf on a path outside the working tree
 
@@ -65,10 +74,13 @@ rules:
 
   # ── work outside this session's repo, and git hooks ───────────────────
   # outside_repo: not in the session's repo (its folder outside a repo);
-  # tmp dirs and memory files don't count.
+  # tmp dirs and memory files don't count. Strict mode only, as is
+  # git-outside-repo; chi's own config and hooks still ask (core protected
+  # paths, shell-touches-chi).
   - id: write-outside-repo
     tool: [write, edit]
     path: outside_repo
+    modes: [strict]
     verdict: ask
     reason: writes outside this session's repo
   # cd/git -C into another checkout, then commit, add, reset, checkout,
@@ -80,6 +92,7 @@ rules:
   - id: git-outside-repo
     tool: shell
     git: outside_repo
+    modes: [strict]
     verdict: ask
     scopes: [once, session, rule]
     reason: runs git that changes another checkout, outside this session's repo
@@ -90,9 +103,15 @@ rules:
     reason: git hooks run code on every git command
 
   # ── chi's own config, hooks, rules and approvals, from the shell ───────
+  # The real dirs (config.yml's dir, hooks, the approval store, installed
+  # bundles, this repo's git hooks), not a look-alike under /tmp or chi's
+  # own lib/samagotchi/hooks source; a word that can't be resolved ($VAR,
+  # $(…), a glob) is matched as text. A command that only reads them (ls,
+  # cat, rg, sed -n) isn't asked about.
   - id: shell-touches-chi
     tool: shell
-    command: '(\.config/samagotchi|samagotchi/config\.yml|samagotchi/hooks|samagotchi/guardrails|memories/\.bundles|\.git/hooks)'
+    touches: chi_dirs
+    skip_read_only: true
     verdict: ask
     reason: the command names chi's config, hooks, guardrails or git hooks
 

data/lib/samagotchi/bundles/guardrails/manifest.yml

@@ -1,10 +1,11 @@
 ---
 name: guardrails
-version: 0.4.0
+version: 0.5.0
 scope: system
-description: Optional default guardrail rules (git push/rewrites, rm -rf wide, curl | sh, writes and git in another checkout outside the session's repo, git hooks, answering chi around chi answer), asks only small models get (git checkout --/restore, git stash drop), and a note for the model
+description: Optional default guardrail rules (git push/rewrites, rm -rf wide, curl | sh, git hooks, chi's own config from the shell, answering chi around chi answer; in strict mode also git rebase and writes and git in another checkout outside the session's repo), asks only small models get (git checkout --/restore, git stash drop), and a note for the model
 trust_level: reviewed
-# models: in small-models.yml (guardrails.small_models) needs 0.8.1; git: in rules.yml needs 0.17.0
-requires_chi: ">= 0.18.0"
+# models: in small-models.yml (guardrails.small_models) needs 0.8.1; git: in rules.yml needs 0.17.0;
+# skip_read_only:, touches:, rm: and modes: need 0.20.0
+requires_chi: ">= 0.20.0"
 files:
   guardrails.md: sha256:04207fd1738aeeeef3b7a8053fc57597565bddd7862f01acaba784419cbd909b

data/lib/samagotchi/bundles/mcp/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: mcp
-version: 0.4.0
+version: 0.4.1
 scope: system
 description: "Tools from MCP servers (stdio): each server in config.yml bundles: mcp: servers: runs for the session, its tools are mcp_<server>_<tool>; /mcp lists them"
 trust_level: reviewed
 files: {}
 plugin:
   file: plugin.rb
-  sha256: sha256:009dbb3b754958a6d9edb1e3b828f486aa0ddd09ff5b548f0c576abbfea18807
+  sha256: sha256:7c87e14dbdb20d32c37ef2a83f8d56448807ad26564a4034db4f6afbcf8a0323
 requires_chi: ">= 0.8.0"

data/lib/samagotchi/bundles/mcp/plugin.rb

@@ -218,7 +218,11 @@ class Plugin
 
     def ended
       status = @wait.value
-      reason = "the server exited (#{status.exitstatus ? "status #{status.exitstatus}" : "signal #{status.termsig}"})"
+      reason = if status.nil?
+                 "the server exited"
+               else
+                 "the server exited (#{status.exitstatus ? "status #{status.exitstatus}" : "signal #{status.termsig}"})"
+               end
       waiting, closing = @mutex.synchronize do
         @dead ||= reason
         [@pending.values, @closing]
@@ -652,7 +656,7 @@ class Plugin
 
         notes = paths.map do |path|
           images << { path: path, name: File.basename(path) }
-          "[image #{images.size}: #{File.basename(path)}, attached]"
+          "[image #{images.size}: #{File.basename(path)}]"
         end
         [line, *notes].join("\n")
       when "image"
@@ -661,11 +665,21 @@ class Plugin
         next "[image: #{mime}, empty]" if bytes.empty?
 
         images << { bytes: bytes, name: "#{tool}-#{images.size + 1}.#{IMAGE_EXT.fetch(mime, "img")}" }
-        "[image #{images.size}: #{mime}, attached]"
+        "[image #{images.size}: #{mime}]"
       when "audio" then "[audio: #{block["mimeType"] || "unknown type"}]"
       when "resource"
         resource = block["resource"] || {}
-        resource["text"] || "[resource: #{resource["uri"]}]"
+        mime = resource["mimeType"].to_s
+        blob = resource["blob"].to_s
+        if mime.start_with?("image/") && !blob.empty?
+          bytes = blob.unpack1("m")
+          next "[image: #{mime}, empty]" if bytes.empty?
+
+          images << { bytes: bytes, name: "#{tool}-#{images.size + 1}.#{IMAGE_EXT.fetch(mime, "img")}" }
+          "[image #{images.size}: #{mime}]"
+        else
+          resource["text"] || "[resource: #{resource["uri"]}]"
+        end
       when "resource_link" then "[resource link: #{block["uri"]}]"
       else "[#{block["type"] || "unknown"} content]"
       end

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.19.0
+version: 0.20.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:29c2f7df9f6c5acbc5ec17000a4490741e55e426af15ca0d81c8706edd9bd027
   self_map.md: sha256:69bc0ec091fdaeedf6e3aa7365275461fe3eba32b2dedc9cf45044176c356af5
   config_modification_protocol.md: sha256:8d8921854e616d840b393cdda6fd911b7d5e8172501bb8293c01f734121ccc21
-  memory_guide.md: sha256:8819678a243590203fa439ad736bf1959af4b4677bc6d2d507bad92c46fb1ccc
+  memory_guide.md: sha256:17126f5adb9ef7b33c40e920ef339388c8c8c045b38a7de825b08760604db4e4
   delegated.md: sha256:0a71d5dfa7127df2d51cb5f0e7214240ed88777e36559430a8724c796d7ae561

data/lib/samagotchi/bundles/system/memory_guide.md

@@ -94,7 +94,7 @@ Bundles are versioned directories/zips/tar.gz/git URLs with a `manifest.yml` and
 | `build [--scope system\|project] [--name NAME] [--version VER] [--description DESC] [--out PATH] [FILES...]` | **Inverse of install** — builds a shareable bundle from local memories and installed hooks. Infers `zip` vs `dir`/`tar.gz` from `--out` extension; default `chi_system_memories.zip` (system) or `chi_<repo>_memories.zip` (project, named after the project root) v`1.0.0` in `Dir.pwd`. `FILES...` is an optional allowlist of memory basenames (`identity` or `identity.md`); if omitted, all `*.md` except `index.md`/hidden/non-md and the memories other installed bundles own (each named in a `Left out` line) are included. Installed hooks are copied to `hooks/` with their manifest metadata. Computes `sha256:` checksums and writes `manifest.yml` via `Manifest.write`. No provenance write. |
 
 **Scope resolution for install/build:**
-- CLI `--scope` wins over `manifest.yml` `scope`. Default is `system` if none given (`Installer#run`). For `project`, target is the project folder `<system dir>/projects/<basename>_<hash>` of the project root (`Installer#resolve_target_dir`).
+- CLI `--scope` wins over `manifest.yml` `scope`. Default is `system` if none given (`Installer#run`). For `project`, target is the project folder `<system dir>/projects/<basename>_<hash>` of the project root (`MemoryPaths.scope_dir`).
 
 **Example flows:**
 ```bash

data/lib/samagotchi/commands/registry.rb

@@ -28,8 +28,10 @@ module Samagotchi
         def in_ui?(ui) = uis.nil? || uis.include?(ui)
       end
 
-      def initialize
+      # @param entries [Array<Entry>] taken as they are, in order (.from_listing)
+      def initialize(entries: [])
         @entries = []
+        entries.each { |entry| add(entry) }
       end
 
       # A UI without an Engine (attached) learns the session's commands from
@@ -39,8 +41,7 @@ module Samagotchi
       # @param listing [Array<Hash>] #listing, with String or Symbol keys
       # @return [Registry]
       def self.from_listing(listing, base:)
-        registry = new
-        base.entries.each { |entry| registry.send(:add, entry) }
+        registry = new(entries: base.entries)
         known = base.entries.map(&:name)
         Array(listing).each do |item|
           item = item.transform_keys(&:to_sym)

data/lib/samagotchi/config.rb

@@ -107,6 +107,9 @@ module Samagotchi
       # The guardrails settings are config.yml only: a parent agent must not switch a child's guardrails off from its
       # own environment (SAMAGOTCHI_GUARDRAILS_ENABLED=false). SessionManager.spawn_options unsets them for a worker too.
       Entry.new(key: "guardrails.enabled",       yaml_path: %w[guardrails enabled],       type: :bool,   default: true,             expose: %i[config]),
+      # Which rules vote: auto (the default) leaves out the rules tagged `modes: [strict]`; strict runs them all. An unknown
+      # value warns and is auto.
+      Entry.new(key: "guardrails.mode",          yaml_path: %w[guardrails mode],          type: :enum,   default: "auto",           expose: %i[config], enum_values: %w[auto strict]),
       # Which models get the rules with `models: small` (Guardrails::ModelSize): auto (32B or less by the name's size, an MoE's
       # active size counting), globs on the bare model name or its key, "|"-separated (a YAML list works too), or "" ([]) for none.
       Entry.new(key: "guardrails.small_models",  yaml_path: %w[guardrails small_models],  type: :string, default: "auto",           expose: %i[config]),

data/lib/samagotchi/context_usage.rb

@@ -26,9 +26,9 @@ module Samagotchi
       usage = {} unless usage.is_a?(Hash)
 
       # The token counts come from the same parser SessionMetrics uses.
-      counts = TokenUsage.from_payload(payload_hash) || {}
-      prompt_tokens = counts[:prompt_tokens]
-      completion_tokens = counts[:completion_tokens]
+      counts = TokenUsage.from_payload(payload_hash)
+      prompt_tokens = counts&.prompt_tokens
+      completion_tokens = counts&.completion_tokens
 
       total_tokens = first_positive_integer(
         usage["total_tokens"], usage[:total_tokens],

data/lib/samagotchi/engine.rb

@@ -2298,6 +2298,7 @@ module Samagotchi
         # not an event of its own.
         next thinking_refused(event) if event[:type] == :thinking_refused
 
+        event = with_generation_report(event) if event[:type] == :generation_completed
         emit_event(on_event, event)
         watch.feed(**progress) if watch && progress
         if event[:type] == :generation_completed
@@ -2307,6 +2308,19 @@ module Samagotchi
       end
     end
 
+    # A :generation_completed with the generation's decode speed (`speed:`
+    # {decode_tps:, source:}, nil without one) and the session's running
+    # token totals (`tokens:`, the snapshot's block): the web's info bar
+    # reads them from the stream. SessionMetrics closes the generation here,
+    # so the event it gets next finds it closed.
+    def with_generation_report(event)
+      report = @metrics.finish_generation
+      event.merge(speed: report.speed&.to_h, tokens: report.tokens)
+    rescue StandardError
+      event
+    end
+    private :with_generation_report
+
     # The turn's StreamWatch, or nil when no hook listens.
     def stream_watch(cancel_controller)
       return nil unless cancel_controller && @hooks.any?(Hooks::StreamWatch::EVENT)
@@ -2322,8 +2336,8 @@ module Samagotchi
       rescue StandardError
         nil
       end
-      # Turn-scoped sink: receives the original event hash (no event_seq),
-      # byte-for-byte unchanged. Sink errors are isolated and never break the
+      # Turn-scoped sink: receives the event hash as the stream handler
+      # passed it (no event_seq; a :generation_completed has its report). Sink errors are isolated and never break the
       # kernel loop (same as KernelLoop's own handling).
       if on_event
         begin

data/lib/samagotchi/guardrail_wiring.rb

@@ -279,7 +279,8 @@ module Samagotchi
         @failures.add("rules in config.yml", e.message, required: true, group: :rules)
       end
       Guardrails::Rules.new(rules + bundle_rules, disable: disable,
-                            enabled: Samagotchi::Config.get("guardrails.enabled") != false)
+                            enabled: Samagotchi::Config.get("guardrails.enabled") != false,
+                            mode: Samagotchi::Config.get("guardrails.mode") || "auto")
     end
 
     # The dry-run diff of an edit/write call for its approval; a preview

data/lib/samagotchi/guardrails/approval.rb

@@ -44,6 +44,8 @@ module Samagotchi
             args: args_for_card(targets),
             cwd: targets&.cwd,
             repo_root: targets&.repo_root,
+            # The repository's name (a worktree's main checkout's folder).
+            repo_name: targets&.repo_name,
             branch: verdict.context&.branch(targets&.cwd || verdict.context.cwd),
             rule: verdict.rule,
             source: verdict.source,
@@ -92,7 +94,7 @@ module Samagotchi
       end
 
       def label(scope, verdict)
-        place = verdict.targets&.repo_root ? "in this repo" : "in this directory"
+        place = verdict.targets&.repo_root ? "in this repo (#{verdict.targets.repo_name})" : "in this directory"
         case scope
         when "once" then "Allow once"
         when "session" then "Allow this call for the session"
@@ -129,9 +131,8 @@ module Samagotchi
         what = Approval.args_text(targets&.args, limit: ARGS_CHARS) if what.to_s.empty?
         lines = ["#{tool}: #{what}"]
         if targets
-          repo = targets.repo_root
           branch = verdict.context&.branch(targets.cwd)
-          where = repo ? "repo #{File.basename(repo)}#{", branch #{branch}" if branch}" : "not in a repo"
+          where = targets.repo_root ? "repo #{targets.repo_name}#{", branch #{branch}" if branch}" : "not in a repo"
           lines << "  in #{targets.cwd} (#{where})"
         end
         who = verdict.rule ? ["rule #{verdict.rule}", verdict.source].compact.join(", ") : (verdict.source || "hook")

data/lib/samagotchi/guardrails/approvals.rb

@@ -16,6 +16,10 @@ module Samagotchi
     #             this session;
     #   repo    — this exact call in this repo (the cwd outside a repo);
     #   rule    — anything this rule (from this source) asks about here.
+    # "This repo" is the repository (repo: its common git dir), so an
+    # approval holds in every worktree of it; repo_root, the worktree it
+    # was given in, is kept for showing, and an entry from before repo:
+    # still matches that exact folder.
     # "once" is never stored. A file that doesn't parse is moved aside to
     # approvals.json.corrupt-<UTC time>[-N], with a warning, and the store
     # starts empty: it only means more asks, and nothing is overwritten.
@@ -62,13 +66,14 @@ module Samagotchi
       def self.find_in(list, verdict)
         key = key_for(verdict)
         place = place_for(verdict)
+        repo = verdict.targets&.repo
+        here = ->(e) { e["repo"] ? e["repo"] == repo : e["repo_root"] == place }
         session_id = verdict.context&.session_id
         list.find do |e|
           case e["scope"]
           when "session" then session_id && e["session_id"] == session_id && e["key"] == key
-          when "repo" then e["repo_root"] == place && e["key"] == key
-          when "rule" then verdict.rule && e["rule"] == verdict.rule && e["source"] == verdict.source &&
-                           e["repo_root"] == place
+          when "repo" then here.(e) && e["key"] == key
+          when "rule" then verdict.rule && e["rule"] == verdict.rule && e["source"] == verdict.source && here.(e)
           end
         end
       end
@@ -81,8 +86,9 @@ module Samagotchi
                   "rule" => verdict.rule, "source" => verdict.source, "created_at" => Time.now.utc.iso8601 }
         case scope
         when "session" then entry.merge!("session_id" => verdict.context&.session_id, "key" => key_for(verdict))
-        when "repo" then entry.merge!("repo_root" => place_for(verdict), "key" => key_for(verdict))
-        when "rule" then entry["repo_root"] = place_for(verdict)
+        when "repo"
+          entry.merge!("repo_root" => place_for(verdict), "repo" => verdict.targets&.repo, "key" => key_for(verdict))
+        when "rule" then entry.merge!("repo_root" => place_for(verdict), "repo" => verdict.targets&.repo)
         end
         entry.compact
       end

data/lib/samagotchi/guardrails/context.rb

@@ -24,6 +24,11 @@ module Samagotchi
       end
 
       def repo_root(dir = @cwd) = @git.root(dir)
+      # The git hooks dir of +dir+'s repo (core.hooksPath honoured), or nil.
+      def hooks_dir(dir = @cwd) = @git.hooks(dir)
+      # +dir+'s repository: its absolute common git dir (<root>/.git for a
+      # plain checkout; the same for every worktree of it), or nil.
+      def repo(dir = @cwd) = @git.common_dir(dir)
       def branch(dir = @cwd) = @git.branch(dir)
 
       # The hook event's context: hash.
@@ -41,6 +46,8 @@ module Samagotchi
       end
 
       def root(dir) = info(dir)[:root]
+      def hooks(dir) = info(dir)[:hooks]
+      def common_dir(dir) = info(dir)[:common_dir]
       def branch(dir) = info(dir)[:branch]
 
       private
@@ -53,16 +60,16 @@ module Samagotchi
       def probe(dir)
         return {} unless File.directory?(dir)
 
-        out, status = Open3.capture2e("git", "-C", dir, "rev-parse", "--show-toplevel", "--abbrev-ref", "HEAD")
-        lines = out.lines.map(&:strip)
-        # A repo with no commits yet has no HEAD: only the root answers.
-        unless status.success?
-          out, status = Open3.capture2e("git", "-C", dir, "rev-parse", "--show-toplevel")
-          return {} unless status.success?
+        paths = ["--show-toplevel", "--git-path", "hooks", "--git-common-dir"]
+        out, status = Open3.capture2e("git", "-C", dir, "rev-parse", *paths, "--abbrev-ref", "HEAD")
+        # A repo with no commits yet has no HEAD: only the paths answer.
+        out, status = Open3.capture2e("git", "-C", dir, "rev-parse", *paths) unless status.success?
+        return {} unless status.success?
 
-          lines = [out.strip]
-        end
-        { root: lines[0], branch: lines[1] }
+        lines = out.lines.map(&:strip)
+        # --git-path and --git-common-dir are relative to dir (core.hooksPath too).
+        { root: lines[0], hooks: lines[1] && File.expand_path(lines[1], dir),
+          common_dir: lines[2] && File.expand_path(lines[2], dir), branch: lines[3] }
       rescue SystemCallError
         {}
       end

data/lib/samagotchi/guardrails/parent_approvals.rb

@@ -2,6 +2,7 @@
 
 require_relative "../config"
 require_relative "../paths"
+require_relative "../memory_paths"
 require_relative "../hooks/loader"
 require_relative "approval"
 require_relative "protected_paths"
@@ -42,9 +43,12 @@ module Samagotchi
       # Rules that ask about chi's own config and hooks: the core
       # ProtectedPaths asks and the guardrails bundle's shell rule.
       PROTECTED_RULES = %w[chi-config chi-hooks shell-touches-chi].freeze
-      # A shell command naming chi's config, hooks or guardrails (the
-      # guardrails bundle's shell-touches-chi, less .git/hooks).
+      # A shell command naming chi's config, hooks or guardrails as text
+      # (broad: a parent may not allow what only looks like one).
       CHI_TEXT = %r{\.config/samagotchi|samagotchi/config\.yml|samagotchi/hooks|samagotchi/guardrails|memories/\.bundles}
+      # The guardrails bundle's shell-touches-chi, for a word it can't
+      # resolve to a path (Guardrails::ShellPaths): CHI_TEXT and .git/hooks.
+      CHI_SHELL_TEXT = Regexp.union(CHI_TEXT, %r{\.git/hooks})
 
       module_function
 
@@ -101,10 +105,12 @@ module Samagotchi
         command.match?(CHI_TEXT) || dirs.any? { |dir| command.include?(dir) || command.include?(ProtectedPaths.real(dir)) }
       end
 
-      # chi's config dir, the hooks dir and the approval store's dir.
+      # chi's config dir, the hooks dir, the approval store's dir and the
+      # installed bundles' dir.
       def chi_dirs
         hooks = begin Hooks::Loader.hooks_dir rescue nil end
-        [ConfigFile.config_dir, hooks, File.join(Paths.state_dir, "guardrails")]
+        bundles = begin MemoryPaths.bundles_dir rescue nil end
+        [ConfigFile.config_dir, hooks, File.join(Paths.state_dir, "guardrails"), bundles]
           .compact.map { |dir| dir.to_s.chomp("/") }.reject(&:empty?).uniq
       end