samagotchi 0.19.0 → 0.21.0

data/lib/samagotchi/bootstrap_command.rb

@@ -3,6 +3,7 @@
 require "rbconfig"
 require_relative "config"
 require_relative "model_profile"
+require_relative "host_registry"
 require_relative "bootstrap/probe"
 require_relative "bootstrap/config_writer"
 require_relative "bootstrap/bundles"
@@ -235,9 +236,11 @@ module Samagotchi
 
     def test(result, model, key_env)
       done = Queue.new
-      waiting = Thread.new do
-        @stdout.puts("test: waiting for an answer (loading the model?)…") if done.pop(timeout: LOADING_AFTER).nil?
-      end
+      waiting = if loading_hint?(result)
+                  Thread.new do
+                    @stdout.puts("test: waiting for an answer (loading the model?)…") if done.pop(timeout: LOADING_AFTER).nil?
+                  end
+                end
       seconds = @probe.test_turn(result.candidate, model, key_env: key_env)
       @stdout.puts(format("test: answered in %.1f s", seconds))
       true
@@ -249,17 +252,25 @@ module Samagotchi
       waiting&.join
     end
 
+    # The "loading the model?" hint fits a local server (a llama.cpp loading
+    # weights); a remote provider's slow answer is the network, not a load.
+    def loading_hint?(result)
+      !HostRegistry.remote_address?(result.candidate.scheme, result.candidate.host)
+    end
+
     # 0 written, 1 written but not as planned, nil with @exit on a refusal.
     def write(result, model, key_env, options)
       writer = Bootstrap::ConfigWriter.new(path: @config_path, env: @env)
       fields = host_fields(result.candidate, result.native?, key_env)
       ids = result.models.map(&:id)
-      name = begin
-        writer.host_name(Bootstrap::ConfigWriter.derived_name(result.candidate.host), requested: options[:name], model_ids: ids)
+      base = Bootstrap::ConfigWriter.derived_name(result.candidate.host)
+      name, reason = begin
+        writer.host_name_with_reason(base, requested: options[:name], model_ids: ids)
       rescue Bootstrap::ConfigWriter::Error => e
         @exit = usage_error(e.message)
         return nil
       end
+      explain_name(base, name, reason)
       outcome = writer.write(name: name, fields: fields, model: model, dry_run: options[:dry_run])
       code = report(outcome, model)
       return code unless INSTALLS_BUNDLES.include?(outcome.kind)
@@ -269,6 +280,16 @@ module Samagotchi
       code
     end
 
+    # One line when the name wasn't free as derived: why chi picked another.
+    def explain_name(base, name, reason)
+      case reason
+      when :taken
+        @stdout.puts("a host named #{base} already exists; saved as #{name}, use --name to choose")
+      when :model_prefix
+        @stdout.puts("a model id starts with #{base} (chi would read it as a host); saved as #{name}, use --name to choose")
+      end
+    end
+
     # The system bundle, core, and dev when a terminal says yes: one line
     # each. 1 when something failed.
     def install_bundles(dry_run: false)

data/lib/samagotchi/bridge/sse_writer.rb

@@ -39,6 +39,8 @@ module Samagotchi
     class SSEWriter
       DEFAULT_MAX_QUEUE = 1024
       DEFAULT_HEARTBEAT_INTERVAL = 15.0
+      # Queued by the hang-up watcher (#watch_hangup) to wake #drain!.
+      HANGUP = Object.new.freeze
 
       # @param engine [Samagotchi::Engine] the owning engine (live fan-out)
       # @param ring [Samagotchi::Bridge::RingBuffer] shared capture buffer
@@ -77,6 +79,7 @@ module Samagotchi
         @foreign_cursor = !cursor_epoch.nil? && cursor_epoch != @epoch
         @high_water = @foreign_cursor ? 0 : cursor_seq
         @handle = nil
+        @hung_up = false
       end
 
       # Non-blocking enqueue used as the per-connection live observer. Any
@@ -97,6 +100,7 @@ module Samagotchi
       # the client disconnects or the bridge stops.
       def serve!(io)
         write_sse_headers(io)
+        watcher = watch_hangup(io)
         begin
           if @join_with_snapshot
             # Subscribe and snapshot as one step of the event log, then go live.
@@ -119,11 +123,36 @@ module Samagotchi
           # Client hung up; nothing to do.
         ensure
           @engine.unsubscribe(handle: @handle) if @handle
+          watcher&.kill
         end
       end
 
       private
 
+      # A client that hangs up is noticed now, not at the next write (a
+      # heartbeat, up to its interval away): the Bridge stops counting its
+      # stream (Bridge#open_streams_except), so an attached /exit from the
+      # TUI attached after it isn't held by it. A thread waits for the
+      # socket to read EOF and wakes #drain!. A client sends nothing after
+      # its request; bytes it does send are dropped. Real sockets only.
+      def watch_hangup(io)
+        return nil unless io.is_a?(IO)
+
+        Thread.new do
+          loop do
+            case io.read_nonblock(4096, exception: false)
+            when nil then break
+            when :wait_readable then io.wait_readable
+            end
+          end
+        rescue IOError, SystemCallError
+          nil
+        ensure
+          @hung_up = true
+          @queue.push(HANGUP)
+        end.tap { |thread| thread.report_on_exception = false }
+      end
+
       def replay!(io, snapshot_seq)
         from_seq = @high_water
         oldest = @ring.oldest_seq
@@ -146,6 +175,9 @@ module Samagotchi
       def drain!(io)
         loop do
           payload = @queue.pop(@heartbeat_interval)
+          # The watcher's flag, not only its HANGUP: an overflow can drop that.
+          break if @hung_up
+
           if payload
             if payload.is_a?(Hash) && payload[:sse_reset]
               emit_reset(io)

data/lib/samagotchi/bridge/turn_accumulator.rb

@@ -38,8 +38,8 @@ module Samagotchi
       end
 
       # @return [Hash, nil] a copy of the turn in progress: prompt, origin,
-      #   continue, ordered parts (thinking / text / tool / input / steer /
-      #   reminder / notice), pending_question and the last event_seq folded
+      #   continue, ordered parts (generation / thinking / text / tool /
+      #   input / steer / reminder / notice), pending_question and the last event_seq folded
       #   in. A finished tool part keeps the live row's action and duration_ms
       #   too, a running one the time it has run so far (elapsed_ms), so a
       #   join times its row from its start. A notice part holds the event
@@ -101,7 +101,9 @@ module Samagotchi
       # The turn in progress (#current_turn's shape, symbol keys) as the live
       # events that would have drawn it, in order, as turn_events.js
       # snapshotEvents replays it for the web (spec/shared/turn_snapshot.json
-      # pins both): a generation_chunk per thinking or text part (a
+      # pins both): a generation_started per generation part (a join during
+      # a hold shows the step the model is on), a generation_chunk per
+      # thinking or text part (a
       # generation_completed closes text before the next step's), a tool's
       # tool_call_started and, once finished, its tool_call_completed (with
       # the live activity: action, tool, params, status), a merged_input
@@ -123,6 +125,9 @@ module Samagotchi
         end
         Array(turn[:parts]).each do |part|
           case part[:kind]
+          when "generation"
+            close_text.call
+            events << { type: :generation_started, iteration: part[:iteration] }
           when "thinking" then events << { type: :generation_chunk, text: "", thinking: part[:text], iteration: part[:iteration] }
           when "text"
             close_text.call if !text_iteration.nil? && text_iteration != part[:iteration]
@@ -233,6 +238,8 @@ module Samagotchi
       def fold_turn_event(event)
         parts = @turn[:parts]
         case event[:type]
+        when :generation_started
+          parts << { kind: "generation", iteration: event[:iteration] }
         when :generation_chunk
           if event.key?(:text)
             # Profile-split stream: thinking and visible text separately.

data/lib/samagotchi/bridge.rb

@@ -134,7 +134,8 @@ module Samagotchi
 
     # Streams held by anyone but +client_id+: a client's own stream (or two,
     # while it reconnects and the old one isn't noticed dead yet) doesn't
-    # count. A closed stream counts until its next write fails (heartbeat).
+    # count. A closed stream stops counting once its writer reads the
+    # hang-up (SSEWriter#watch_hangup).
     # @return [Integer]
     def open_streams_except(client_id)
       @mutex.synchronize { @open_streams - (client_id ? @streams_by_client[client_id] : 0) }
@@ -698,7 +699,10 @@ module Samagotchi
     # event log held, so no POST /turn lands between its check and its
     # answer; it leaves from its loop after this reply.
     # 200 {status: "exiting", discard?: the session is empty and goes} ({status: "restarting"} for a restart), or 409
-    # {status: "held", reason:} naming what keeps it up. Returns [headers, status, body].
+    # {status: "held", reason:} naming what keeps it up. A past +deadline+
+    # (see #handle_post_turn), checked with the event log held: 408
+    # deadline_passed, the worker not asked (its client said it didn't stop).
+    # Returns [headers, status, body].
     def handle_exit_request(session_id, body)
       return [{}, 501, { error: "exit_unavailable" }] unless @on_exit_request
 
@@ -709,7 +713,15 @@ module Samagotchi
       delete = fetched(parsed, "delete") == true
       restart = fetched(parsed, "restart") == true
       options = restart ? { delete: delete, restart: true } : { delete: delete }
-      reason = @engine.synchronize_events { @on_exit_request.call(client_id, **options) }
+      deadline = fetched(parsed, "deadline")
+      return BAD_DEADLINE unless deadline_valid?(deadline)
+
+      reason = @engine.synchronize_events do
+        next :expired if expired?("exit_expired", deadline, sid: session_id, client_id: client_id)
+
+        @on_exit_request.call(client_id, **options)
+      end
+      return deadline_passed("exit request") if reason == :expired
       if reason.nil?
         return [{}, 200, { status: "restarting", session_id: @session_id }] if restart
 
@@ -849,7 +861,7 @@ module Samagotchi
     end
 
     # The 408 for a request read after its deadline: +what+ (turn, command,
-    # answer, dismissal) was dropped.
+    # answer, dismissal, exit request) was dropped.
     def deadline_passed(what)
       [{}, 408, { error: "deadline_passed", detail: "the #{what} arrived after its client stopped waiting; not run" }]
     end

data/lib/samagotchi/bridge_client.rb

@@ -20,6 +20,10 @@ module Samagotchi
     # A reply's status line; its code is group 1.
     STATUS_LINE = %r{\AHTTP/1\.[01] (\d{3})}
     STREAM_CONNECT_ATTEMPTS = 3
+    # Seconds #stream waits for the Bridge's response headers, per attempt:
+    # a worker that took the connection and froze must not hold the web's
+    # proxy thread (as EventStream::HEADER_TIMEOUT for the TUI's).
+    STREAM_HEADER_TIMEOUT = 5.0
     # Seconds #stream waits for bytes before it asks `running` again.
     STREAM_POLL = 0.5
     # Seconds a one-shot request waits for the whole reply. Every route
@@ -28,7 +32,7 @@ module Samagotchi
     # raises Errno::ECONNREFUSED. The event stream has no such limit.
     READ_TIMEOUT = 30
     # Share of the read timeout a request's deadline allows (25 s of 30): the
-    # Bridge drops a turn, command, answer or dismissal it reads after the
+    # Bridge drops a turn, command, answer, dismissal or exit it reads after the
     # deadline, so one this client timed out on, and said did not go
     # through, never runs when a frozen worker wakes. The rest covers the
     # write and the reply.
@@ -159,13 +163,14 @@ module Samagotchi
     # POST /session/:id/exit: ask the worker to exit now (+restart+: hand
     # the session to a new worker, a worker with the "restart" feature). 200
     # = it will (status "exiting"/"restarting"), 409 = something keeps it up (reason), 404 with
-    # error "not_found" = a worker older than the route.
+    # error "not_found" = a worker older than the route, 408 = too late.
     # @param client_id [String] the asking UI, whose own streams don't hold
     # @return [Response]
     def request_exit(client_id:, delete: false, restart: false)
       body = { client_id: client_id }
       body[:delete] = true if delete
       body[:restart] = true if restart
+      body[:deadline] = deadline
       post("exit", body, read_body: true)
     end
 
@@ -258,7 +263,8 @@ module Samagotchi
     # @param running [#call, nil] asked before every read, and every
     #   STREAM_POLL seconds of silence: the stream ends once it returns
     #   false. A quiet stream is never cut otherwise.
-    def stream(query: "", last_event_id: nil, running: nil)
+    # @param header_timeout [Float] see STREAM_HEADER_TIMEOUT
+    def stream(query: "", last_event_id: nil, running: nil, header_timeout: STREAM_HEADER_TIMEOUT)
       sock = nil
       # Absorb the probe→connect race around a resumed worker's bridge:
       # the sidecar probe can succeed a moment before the worker dies (or
@@ -266,7 +272,7 @@ module Samagotchi
       # avoid the silent empty-200 that EventSource would otherwise keep
       # re-opening.
       STREAM_CONNECT_ATTEMPTS.times do |attempt|
-        sock, = connect_stream(query: query, last_event_id: last_event_id)
+        sock, = connect_stream(query: query, last_event_id: last_event_id, timeout: header_timeout)
         break if sock
 
         sleep(0.15 * (attempt + 1))
@@ -302,7 +308,7 @@ module Samagotchi
     end
 
     # Open GET /session/:id/stream and read past the response headers.
-    # @param timeout [Float, nil] give up when the headers don't start in time
+    # @param timeout [Float, nil] give up when the headers aren't all in by then
     # @return [Array(TCPSocket, Integer), nil] the socket positioned at the
     #   body and the HTTP status, or nil when the Bridge can't be reached
     def connect_stream(query: "", last_event_id: nil, timeout: nil)
@@ -310,10 +316,9 @@ module Samagotchi
       lei = last_event_id.to_s.strip
       last_event_line = lei.empty? ? "" : "Last-Event-ID: #{lei}\r\n"
       sock.write("GET /session/#{@session_id}/stream#{query} HTTP/1.1\r\nHost: #{@host}:#{@port}\r\nAccept: text/event-stream\r\n#{last_event_line}Connection: keep-alive\r\n\r\n")
-      raise Errno::ETIMEDOUT if timeout && !sock.wait_readable(timeout)
-
-      status = sock.gets.to_s[STATUS_LINE, 1].to_i
-      while (line = sock.gets)
+      deadline = timeout && (Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout)
+      status = header_line(sock, deadline).to_s[STATUS_LINE, 1].to_i
+      while (line = header_line(sock, deadline))
         break if line.strip.empty?
       end
       [sock, status]
@@ -324,6 +329,25 @@ module Samagotchi
 
     private
 
+    # One line of the response headers, or nil at EOF; raises
+    # Errno::ETIMEDOUT once +deadline+ (monotonic, nil: none) has passed. A
+    # line read in pieces, so a Bridge that stops mid-line can't hold it.
+    def header_line(sock, deadline)
+      return sock.gets unless deadline
+
+      line = +""
+      loop do
+        remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        raise Errno::ETIMEDOUT unless remaining.positive? && sock.wait_readable(remaining)
+
+        char = sock.getc
+        return line.empty? ? nil : line if char.nil?
+
+        line << char
+        return line if char == "\n"
+      end
+    end
+
     # When this client stops waiting for a reply, as epoch seconds (see
     # DEADLINE_SHARE). Wall clock: the worker runs on this machine and reads
     # the same one.

data/lib/samagotchi/bundle_command.rb

@@ -200,6 +200,10 @@ module Samagotchi
     end
 
     # Runs +installer+, prints its summary, then yields the manifest.
+    # Ensures the extracted source dir is cleaned up even if an exception
+    # occurs between installer.run and the block (e.g. summary,
+    # print_hooks_and_plugin). The block (upgrade_conflicts) still sees
+    # the files because cleanup happens after the block returns or raises.
     # @return [Integer] the block's exit status, or 1 after "<failed> failed: …"
     def run_installer(installer, failed:)
       _nd, manifest = installer.run
@@ -208,6 +212,8 @@ module Samagotchi
     rescue Samagotchi::MemoryBundle::Installer::InstallError => e
       @stderr.puts "#{failed} failed: #{e.message}"
       1
+    ensure
+      installer.cleanup_source!
     end
 
     def print_hooks_and_plugin(manifest, plugin: true)
@@ -263,6 +269,10 @@ module Samagotchi
       @stdout.puts "Provenance updated after interactive resolution."
       @stdout.puts "Upgrade resolved interactively."
       0
+    ensure
+      # An owned source (git/zip/tar) was kept for the incoming files above;
+      # the agent step is done with them now.
+      installer.cleanup_source!
     end
 
     def uninstall(rest)
@@ -353,9 +363,15 @@ module Samagotchi
           @stdout.puts "Bundle '#{name}' not installed."
           return 0
         end
-        @stdout.puts "Bundle: #{name} v#{st[:provenance][:version]} scope=#{st[:scope]} installed=#{st[:provenance][:installed_at]}"
-        @stdout.puts "Target: #{st[:target_dir]}"
+        @stdout.puts "Bundle: #{name} v#{st[:provenance][:version]} scope=#{status_scope(st)} installed=#{st[:provenance][:installed_at]}"
+        if st[:scope_error]
+          @stdout.puts "Target: (unknown scope: this chi can't resolve it; upgrade chi or reinstall the bundle)"
+        else
+          @stdout.puts "Target: #{st[:target_dir]}"
+        end
         st[:files].each do |k, info|
+          next @stdout.puts("  #{k}: unchecked") if info[:unchecked]
+
           mods = []
           mods << "conflict (kept your edits over v#{st[:provenance][:version]}: chi bundle diff #{name} #{k})" if info[:conflict]
           mods << "modified" if info[:modified]
@@ -409,15 +425,19 @@ module Samagotchi
           plugin = st[:plugin]
           mods += 1 if plugin && (plugin[:state] != "ok" || plugin[:requires_failure])
           mods += 1 if st[:hooks_requires_failure]
+          mods += 1 if st[:scope_error]
           plugin_info = plugin ? " plugin=#{plugin[:file]}" : ""
           includes = st[:provenance][:includes]
           includes_info = includes ? " includes=#{includes.join(",")}" : ""
-          @stdout.puts "  #{bname} v#{st[:provenance][:version]} scope=#{st[:scope]} files=#{st[:files].size}#{hook_info}#{plugin_info}#{includes_info} issues=#{mods}"
+          @stdout.puts "  #{bname} v#{st[:provenance][:version]} scope=#{status_scope(st)} files=#{st[:files].size}#{hook_info}#{plugin_info}#{includes_info} issues=#{mods}"
         end
       end
       return 0
     end
 
+    # "team (unknown)" for a scope this chi can't resolve (Status#bundle_status).
+    def status_scope(st) = st[:scope_error] ? "#{st[:scope]} (unknown)" : st[:scope]
+
     def diff(rest)
       args = rest.reject { |a| a.start_with?("--") }
       bname = args[0]
@@ -431,7 +451,11 @@ module Samagotchi
         @stderr.puts "Bundle '#{bname}' not installed"; return 1
       end
       scope = data[:scope]&.to_s || "system"
-      target_dir = Samagotchi::MemoryBundle::Installer.new(source: ".", name: bname, scope: scope).send(:resolve_target_dir, scope)
+      begin
+        target_dir = Samagotchi::MemoryPaths.scope_dir!(scope)
+      rescue ArgumentError => e
+        @stderr.puts "Bundle '#{bname}': #{e.message}"; return 1
+      end
       files = data[:files] || {}
       hooks = data[:hooks] || {}
       plugin_path = prov.plugin_path(data)

data/lib/samagotchi/bundles/check-in/manifest.yml

@@ -1,10 +1,10 @@
 ---
 name: check-in
-version: 0.2.0
+version: 0.2.1
 scope: system
 description: "Checks on a long turn: after N tool calls with no answer, a card asks the user (Nudge / Keep going / Stop), or the model is nudged to say what it has found"
 trust_level: reviewed
 plugin:
   file: plugin.rb
-  sha256: sha256:0a5ba60962206b3ec90bbaa0934a7284416aef495df8a70391d9ea47f7eb9ec1
+  sha256: sha256:afbd0ecf5a41eefe79786e089aa918728ebb0fed0e3b75f84d754a47ec6ade18
 requires_chi: ">= 0.3.0"

data/lib/samagotchi/bundles/check-in/plugin.rb

@@ -103,7 +103,11 @@ class Plugin
   def check_in(ctx, count, mode)
     case mode
     when "nudge"
-      ctx.notify("nudged the model after #{count} tool calls") if ctx.steer(message(count))
+      text = message(count)
+      if ctx.steer(text)
+        @mutex.synchronize { @nudge = { text: text, count: count } }
+        ctx.notify("nudged the model after #{count} tool calls")
+      end
     when "notify"
       ctx.notify("#{count} tool calls in this turn, no answer yet")
     else
@@ -117,15 +121,20 @@ class Plugin
     nudge_not_sent(event, ctx)
   end
 
-  # The card said "Nudged": if the turn ended before the nudge joined it
-  # (the model answered first, or the turn was stopped), the card says so.
+  # A nudge that was accepted but dropped before it joined the turn (the
+  # model answered first, or the turn was stopped): the card says so, or,
+  # for a mode nudge (no card), a notice does.
   def nudge_not_sent(event, ctx)
     id, nudge = @mutex.synchronize { [@card_id, @nudge] }
-    return unless id && nudge
+    return unless nudge
     return if steered?(event[:messages], nudge[:text])
 
     first = event[:status].to_s == "canceled" ? "The turn ended first" : "The answer came first"
-    ctx.card(id: id, title: "check-in", body: "#{first}; nudge not sent.")
+    if id
+      ctx.card(id: id, title: "check-in", body: "#{first}; nudge not sent.")
+    else
+      ctx.notify("#{first}; nudge not sent.", level: :warn)
+    end
   end
 
   # Whether this turn's messages (after its last prompt) have the steer.

data/lib/samagotchi/bundles/guardrails/guardrails/rules.yml

@@ -5,8 +5,12 @@
 #
 # Fields: id, tool (a name, a list, or shell = execute + task_create),
 # command (Ruby regex), path (outside_repo or a glob), git (outside_repo:
-# a shell call runs commit/add/reset/… in another checkout), verdict (ask|deny),
-# reason, scopes (for an ask: once, session, repo, rule; default all).
+# a shell call runs commit/add/reset/… in another checkout), touches
+# (chi_dirs: a shell command names a path in chi's own dirs), skip_read_only
+# (true: a command that only reads, ls/cat/rg/sed -n/git log…, doesn't
+# match), modes (strict: only with guardrails.mode: strict; untagged rules
+# ask in every mode), verdict (ask|deny), reason, scopes (for an ask: once,
+# session, repo, rule; default all).
 # [^;&|\n]* keeps a match inside one command of a chain; the git rules match
 # the subcommand after optional global options (git -C dir push).
 rules:
@@ -31,9 +35,11 @@ rules:
     command: '\bgit(?:\s+(?:-C\s+\S+|-c\s+\S+|--?[A-Za-z][\w-]*(?:=\S+)?))*\s+branch\b[^;&|\n]*\s(-[a-zA-Z]*D|--delete\s+--force|--force\s+--delete)\b'
     verdict: ask
     reason: git branch -D deletes a branch even if it is not merged
+  # Strict mode only: a rebase rewrites local history, which the reflog keeps.
   - id: git-rebase
     tool: shell
     command: '\bgit(?:\s+(?:-C\s+\S+|-c\s+\S+|--?[A-Za-z][\w-]*(?:=\S+)?))*\s+rebase\b'
+    modes: [strict]
     verdict: ask
     reason: git rebase rewrites history
   - id: git-history-rewrite
@@ -44,10 +50,13 @@ rules:
 
   # ── deleting ───────────────────────────────────────────────────────────
   # rm with both -r and -f on an absolute path, ~, $HOME or a path with ..
-  # (a text heuristic; rm -rf build/ in the repo is not asked).
+  # (a text heuristic; rm -rf build/ in the repo is not asked), unless
+  # every rm -rf target is inside a tmp dir (rm: outside_tmp; /tmp itself,
+  # /tmp/* and a link out of it still ask).
   - id: rm-rf-wide
     tool: shell
     command: '\brm\b(?=[^;&|\n]*\s(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)(\s|$))(?=[^;&|\n]*\s(-[a-zA-Z]*f[a-zA-Z]*|--force)(\s|$))[^;&|\n]*\s(/|~|\$HOME|\S*\.\.)'
+    rm: outside_tmp
     verdict: ask
     reason: rm -rf on a path outside the working tree
 
@@ -65,10 +74,13 @@ rules:
 
   # ── work outside this session's repo, and git hooks ───────────────────
   # outside_repo: not in the session's repo (its folder outside a repo);
-  # tmp dirs and memory files don't count.
+  # tmp dirs and memory files don't count. Strict mode only, as is
+  # git-outside-repo; chi's own config and hooks still ask (core protected
+  # paths, shell-touches-chi).
   - id: write-outside-repo
     tool: [write, edit]
     path: outside_repo
+    modes: [strict]
     verdict: ask
     reason: writes outside this session's repo
   # cd/git -C into another checkout, then commit, add, reset, checkout,
@@ -80,6 +92,7 @@ rules:
   - id: git-outside-repo
     tool: shell
     git: outside_repo
+    modes: [strict]
     verdict: ask
     scopes: [once, session, rule]
     reason: runs git that changes another checkout, outside this session's repo
@@ -90,9 +103,15 @@ rules:
     reason: git hooks run code on every git command
 
   # ── chi's own config, hooks, rules and approvals, from the shell ───────
+  # The real dirs (config.yml's dir, hooks, the approval store, installed
+  # bundles, this repo's git hooks), not a look-alike under /tmp or chi's
+  # own lib/samagotchi/hooks source; a word that can't be resolved ($VAR,
+  # $(…), a glob) is matched as text. A command that only reads them (ls,
+  # cat, rg, sed -n) isn't asked about.
   - id: shell-touches-chi
     tool: shell
-    command: '(\.config/samagotchi|samagotchi/config\.yml|samagotchi/hooks|samagotchi/guardrails|memories/\.bundles|\.git/hooks)'
+    touches: chi_dirs
+    skip_read_only: true
     verdict: ask
     reason: the command names chi's config, hooks, guardrails or git hooks
 

data/lib/samagotchi/bundles/guardrails/manifest.yml

@@ -1,10 +1,11 @@
 ---
 name: guardrails
-version: 0.4.0
+version: 0.5.0
 scope: system
-description: Optional default guardrail rules (git push/rewrites, rm -rf wide, curl | sh, writes and git in another checkout outside the session's repo, git hooks, answering chi around chi answer), asks only small models get (git checkout --/restore, git stash drop), and a note for the model
+description: Optional default guardrail rules (git push/rewrites, rm -rf wide, curl | sh, git hooks, chi's own config from the shell, answering chi around chi answer; in strict mode also git rebase and writes and git in another checkout outside the session's repo), asks only small models get (git checkout --/restore, git stash drop), and a note for the model
 trust_level: reviewed
-# models: in small-models.yml (guardrails.small_models) needs 0.8.1; git: in rules.yml needs 0.17.0
-requires_chi: ">= 0.18.0"
+# models: in small-models.yml (guardrails.small_models) needs 0.8.1; git: in rules.yml needs 0.17.0;
+# skip_read_only:, touches:, rm: and modes: need 0.20.0
+requires_chi: ">= 0.20.0"
 files:
   guardrails.md: sha256:04207fd1738aeeeef3b7a8053fc57597565bddd7862f01acaba784419cbd909b

data/lib/samagotchi/bundles/loop-guard/manifest.yml

@@ -1,10 +1,10 @@
 ---
 name: loop-guard
-version: 0.2.2
+version: 0.3.1
 scope: system
 description: "Breaks loops: the same tool call with the same result again and again in one turn is denied with advice (after a few denies the turn stops with a card), and thinking that repeats itself while it streams is cut and the model asked again"
 trust_level: reviewed
 plugin:
   file: plugin.rb
-  sha256: sha256:e62c68d1a2280adf55b150488d0d85bbbc35ffce54dfed387a86adceb85e4d34
+  sha256: sha256:32d04fa3f4b3394e80160dd780615a4a1ddeb3be0f2e327a6497c7766dbd9f11
 requires_chi: ">= 0.6.0"