samagotchi 0.85.0 → 0.86.0

data/lib/samagotchi/reply_wait.rb

@@ -3,6 +3,7 @@
 require_relative "session"
 require_relative "turn_note"
 require_relative "session_inbox"
+require_relative "turn_checkpoint"
 require_relative "worker_sidecar"
 
 module Samagotchi
@@ -32,9 +33,10 @@ module Samagotchi
     # @!attribute question [PendingQuestion, nil] the pending question
     #   (:waiting_for_answer)
     # @!attribute outcome [String, nil] how the turn ended when it left no
-    #   reply (:no_reply): "failed", "canceled", "completed" (empty),
+    #   reply (:no_reply): "failed", "canceled", "completed" (empty turn or
+    #   file-delivered command ran without a turn),
     #   "exhausted" (it ran out of iterations, with nobody asked whether to
-    #   continue) or "not_continued" (a Stop answered the step-limit
+    #   continue), "not_continued" (a Stop answered the step-limit
     #   question; no turn ran), from the session's last_turn, or "removed"
     #   (turn:'s queued input was taken back before it ran, its tombstone:
     #   SessionInbox.removed?; no turn ran); nil when unknown. With
@@ -47,8 +49,9 @@ module Samagotchi
     #   retry
     # @!attribute cancel_reason [String, nil] a "canceled" turn's reason
     #   (user, hook, ctrl_c, manual, session_stopped: the session was
-    #   stopped mid-turn), passed through as the worker saved it; any
-    #   reason is a "canceled" outcome
+    #   stopped mid-turn; worker_stopped: turn:'s worker died in it and the
+    #   next one settled it, TurnCheckpoint.settled_turn), passed through
+    #   as the worker saved it; any reason is a "canceled" outcome
     # @!attribute stopped_by [String, nil] the hook that canceled it
     #   (loop-guard)
     # @!attribute session [Session, nil] the session as the look that
@@ -156,6 +159,12 @@ module Samagotchi
           reply.session = settled(session, id, state_dir: state_dir)
           return reply
         end
+        # Its worker died in it and the next one settled it, or an input
+        # command finished without a turn. After the reply check: a worker
+        # killed between writing the reply and its idle save left the reply.
+        if turn && (settled = TurnCheckpoint.settled_turn(session_dir, turn))
+          return Result.new(status: :no_reply, outcome: settled.outcome, session: session, **settled.stop_facts)
+        end
 
         case session.status
         when Session::STATUS_ERROR
@@ -314,7 +323,7 @@ module Samagotchi
 
       running = session.status == Session::STATUS_RUNNING && session.interrupted_turn&.enqueued_id == id
       queued = SessionInbox.waiting_input(session_dir, id) == :turn_end
-      ended = session.last_turn&.enqueued_id == id
+      ended = session.last_turn&.enqueued_id == id || !TurnCheckpoint.settled_turn(session_dir, id).nil?
       running || queued || ended
     end
 

data/lib/samagotchi/send_command.rb

@@ -12,6 +12,9 @@ require_relative "session_chain"
 require_relative "context_quote"
 require_relative "reply_wait"
 require_relative "parent_report"
+require_relative "turn_flow"
+require_relative "guardrails/parent_approvals"
+require_relative "guardrails/parent_policy"
 require_relative "image_store"
 require_relative "host_registry"
 require_relative "model_profile"
@@ -241,6 +244,14 @@ module Samagotchi
       if prompt && (local = local_command(prompt))
         return refuse_local_command(local, options)
       end
+
+      # A parent agent's /continue yes is chi answer --option Continue by
+      # another route: held to guardrails.parent_answers here, and marked
+      # as chi answer's (#client_id_for) so the worker checks it again.
+      if prompt && parent_continue?(prompt) && (refusal = Guardrails::ParentPolicy.continue_refusal)
+        @stderr.puts("chi send: #{refusal}")
+        return CLI::Exit::FAILED
+      end
       # A file that is not there or not an image: a run-time failure (1),
       # reported in the --format json line too; --image itself was fine.
       return CLI::Exit::FAILED unless ingest_images(options[:images])
@@ -414,7 +425,8 @@ module Samagotchi
       return report_command(session.id) if @sent_command
 
       wait_for_reply(session.id, cursor: nil, baseline: baseline_of(session, question_id: nil),
-                                 timeout: options[:timeout], report_turn_id: @sent_enqueued_id)
+                                 timeout: options[:timeout], turn: @sent_input_file ? @sent_enqueued_id : nil,
+                                 report_turn_id: @sent_enqueued_id)
     end
 
     # The model the new session will run, for the images check: --model
@@ -461,11 +473,13 @@ module Samagotchi
         # The turn waits on a question: the message would only queue
         # behind it, and the answer goes in with chi answer.
         if (waiting = session.waiting_question(live: owner.worker?))
+          # The whole question (its options, its tags) for what a parent may give.
+          question = ParentReport.question(session.pending_question)
           if ParentReport.approval?(waiting)
-            error_line("#{id[0, 8]}  waiting for an approval: #{ParentReport::DENY_AND_TELL} " \
-                       "(#{ParentReport.answer_with(id, waiting)})")
+            error_line("#{id[0, 8]}  waiting for an approval: #{ParentReport.approval_advice(question)} " \
+                       "(#{ParentReport.answer_with(id, question)})")
           else
-            error_line("#{id[0, 8]}  waiting for an answer: #{ParentReport.answer_with(id, waiting)} (or --text); " \
+            error_line("#{id[0, 8]}  waiting for an answer: #{ParentReport.answer_with(id, question)} (or --text); " \
                        "chi --attach #{id} shows it")
           end
         else
@@ -485,7 +499,9 @@ module Samagotchi
       # The ack's id names the queued message's turn, also when the turn
       # running at the check ended before it went in (an idle worker's ack
       # says next_step, and the file still runs as that turn).
-      turn = @queue ? @sent_enqueued_id : nil
+      # A file fallback has no delivery field; use its id to see terminal
+      # outcomes for commands that finish without starting a turn.
+      turn = @sent_enqueued_id if @queue || @sent_input_file
       report_turn_id = if @queue
                          turn
                        elsif session.status == Session::STATUS_RUNNING
@@ -493,7 +509,8 @@ module Samagotchi
                        else
                          @sent_enqueued_id
                        end
-      wait_for_reply(id, cursor: cursor, baseline: baseline, timeout: options[:timeout], turn: turn, queued: !turn.nil?,
+      wait_for_reply(id, cursor: cursor, baseline: baseline, timeout: options[:timeout], turn: turn,
+                          queued: @queue && !turn.nil?,
                           report_turn_id: report_turn_id)
     end
 
@@ -550,7 +567,7 @@ module Samagotchi
       begin
         refs = copy_images(dir)
         if BridgeClient.wait_for(session.id, session_dir: dir, timeout: SessionManager::TURN_BRIDGE_WAIT)
-          result = SessionManager.deliver_turn(session.id, prompt: prompt, client_id: CLIENT_ID, images: refs,
+          result = SessionManager.deliver_turn(session.id, prompt: prompt, client_id: client_id_for(prompt), images: refs,
                                                            state_dir: @state_dir)
         end
       rescue StandardError => e
@@ -569,6 +586,7 @@ module Samagotchi
       end
 
       ack = result[:ack].is_a?(Hash) ? result[:ack] : {}
+      @sent_input_file = !ack.key?("delivery")
       @sent_enqueued_id = (ack["enqueued_id"] || ack[:enqueued_id])&.to_s
       @sent_command = command_ack?(result[:ack])
       @info.puts("#{session.id}  started#{continued_words(session)}#{with_images}#{"; #{SENT_COMMAND}" if @sent_command}")
@@ -581,6 +599,13 @@ module Samagotchi
     # /turn whose line is one answers with its command_id).
     def command_ack?(ack) = ack.is_a?(Hash) && !ack["command_id"].to_s.empty?
 
+    # chi send's client id, or chi answer's for a parent agent's /continue
+    # yes (the worker holds that to its guardrails.parent_answers).
+    def client_id_for(prompt) = parent_continue?(prompt) ? ClientId::CLI_ANSWER : CLIENT_ID
+
+    # A /continue yes (or bare /continue) from a parent agent's process.
+    def parent_continue?(prompt) = TurnFlow.continue_yes?(prompt) && Guardrails::ParentApprovals.parent_process?
+
     # Whether +text+ may be a session command, which only its worker knows
     # (a bundle's too).
     def command_like?(text) = text.to_s.lstrip.start_with?("/", "!")
@@ -648,7 +673,7 @@ module Samagotchi
       delivery = if @queue then Delivery::QUEUE
                  elsif @cut && running then Delivery::CUT
                  end
-      result = SessionManager.deliver_turn(id, prompt: prompt, client_id: CLIENT_ID, images: refs, state_dir: @state_dir,
+      result = SessionManager.deliver_turn(id, prompt: prompt, client_id: client_id_for(prompt), images: refs, state_dir: @state_dir,
                                                delivery: delivery)
       unless result[:status] == :accepted
         # A worker older than queueing would steer it: refused, not sent.
@@ -664,6 +689,7 @@ module Samagotchi
       end
 
       ack = result[:ack].is_a?(Hash) ? result[:ack] : {}
+      @sent_input_file = !ack.key?("delivery")
       # What the worker applied, for --format json: its ack's delivery
       # (next_step for an idle session) and a cut's outcome.
       @sent_delivery = ack["delivery"] || delivery

data/lib/samagotchi/session_commands.rb

@@ -14,6 +14,7 @@ require_relative "llm_context_command"
 require_relative "thinking_command"
 require_relative "toolkit_command"
 require_relative "reasoning_history_command"
+require_relative "guardrails/parent_policy"
 
 module Samagotchi
   # The session commands a REPL and a session worker both run: /model,
@@ -80,7 +81,7 @@ module Samagotchi
         next reply("nothing to continue") unless @turn_flow.awaiting_continue?
 
         answer = text.delete_prefix(CONTINUE_COMMAND).strip
-        continue_answer(answer.empty? ? CONTINUE_COMMAND : answer)
+        continue_answer(answer.empty? ? CONTINUE_COMMAND : answer, as_parent: @as_parent)
       end
       # It reads the hosts only (the registry is mutex-guarded): mid-turn too.
       registry.register(MODELS_COMMAND, "list the hosts' models (/models <text> filters)", anytime: true) do |text|
@@ -254,8 +255,12 @@ module Samagotchi
     #   change asks first (CacheConfirm): true for a person at a web tab or
     #   a TUI; false applies it at once (chi send, a delegate, a plugin,
     #   chi -p)
+    # @param as_parent [Boolean] a parent agent sent it (client cli:answer):
+    #   a /continue yes is held to guardrails.parent_answers, as chi
+    #   answer --option Continue is (Guardrails::ParentPolicy)
     # @return [Result, nil] nil when +line+ is not one of these commands
-    def run(line, confirm: true)
+    def run(line, confirm: true, as_parent: false)
+      @as_parent = as_parent
       text = line.to_s.strip
       entry = @registry.lookup(text)
       return nil unless entry&.handler
@@ -268,9 +273,15 @@ module Samagotchi
     end
 
     # Answer the pending continue offer (yes / no / no, <reason>).
+    # @param as_parent [Boolean] a parent agent's answer: a yes its strategy
+    #   doesn't allow is refused (the offer stays; decision :invalid)
     # @return [Result] resume: true on yes
-    def continue_answer(text)
+    def continue_answer(text, as_parent: false)
       decision, reason = TurnFlow.continue_decision(text)
+      if decision == :resume && as_parent && (refusal = Guardrails::ParentPolicy.continue_refusal)
+        return reply(refusal, status: :error).tap { |result| result.decision = :invalid }
+      end
+
       result = case decision
                when :resume then Result.new(status: :ok, changed: [], model_name: model_name, resume: true, shell: false)
                when :abort

data/lib/samagotchi/terminal_ui/attach_launcher.rb

@@ -77,7 +77,7 @@ module Samagotchi
                                     first_command: first_command, no_interrupt: no_interrupt,
                                     default_input: default_input && !prompt && !attach && !resume,
                                     wait_at_eof: !$stdin.tty?,
-                                    parent_answers: Guardrails::ParentApprovals.parent_process?, state_dir: state_dir)
+                                    as_parent: Guardrails::ParentApprovals.parent_process?, state_dir: state_dir)
         ended = begin
           attached.run
         ensure

data/lib/samagotchi/terminal_ui/attached_loop.rb

@@ -105,7 +105,7 @@ module Samagotchi
       # @param state_dir [String] the state dir the worker was found in: its
       #   session folder (@path images, saved records) is under it
       def initialize(client:, screen:, client_id:, first_prompt: nil, first_command: nil, no_interrupt: false,
-                     default_input: false, wait_at_eof: false, parent_answers: false,
+                     default_input: false, wait_at_eof: false, as_parent: false,
                      clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) },
                      delete_session: ->(id) { SessionManager.delete_session(id, stop: true, wait: DELETE_WAIT) },
                      archive_session: ->(id) { SessionManager.archive_session(id, wait: DELETE_WAIT) },
@@ -121,8 +121,8 @@ module Samagotchi
         @client_id = client_id
         # A parent agent drives this attach (AttachLauncher:
         # ParentApprovals.parent_process?): its answers go as chi answer's,
-        # so the worker holds them to guardrails.parent_approvals.
-        @parent_answers = parent_answers
+        # so the worker holds them to Guardrails::ParentPolicy.
+        @as_parent = as_parent
         @view = AttachedView.new(screen)
         @renderer = EventRenderer.new(@view)
         @shown_enqueued = Set.new
@@ -592,7 +592,10 @@ module Samagotchi
       # The worker runs it and every UI renders its :command_ran, this one
       # too, so nothing waits here.
       def send_command(line)
-        reply = @client.post_command(line: line, client_id: @client_id)
+        # A parent agent's /continue yes goes as chi answer's: the worker
+        # holds it to guardrails.parent_answers.
+        client_id = @as_parent && TurnFlow.continue_yes?(line) ? ClientId::CLI_ANSWER : @client_id
+        reply = @client.post_command(line: line, client_id: client_id)
         if reply.status == 202
           # Input from a pipe ends once its output is in (#command_ran).
           command_id = reply.json&.fetch("command_id", nil)
@@ -990,7 +993,7 @@ module Samagotchi
           return @screen.commit(answer.error)
         end
 
-        parent = @parent_answers ? { client_id: ClientId::CLI_ANSWER } : {}
+        parent = @as_parent ? { client_id: ClientId::CLI_ANSWER } : {}
         reply = @client.answer(id: @question.id, selected: answer.selected, freeform: answer.freeform, **parent)
         case reply.status
         when 200
@@ -1554,14 +1557,13 @@ module Samagotchi
         elsif !(own?(origin[:client_id]) || @shown_enqueued.include?(origin[:enqueued_id]))
           @screen.commit(prompt_line(origin[:client_id], event[:prompt]))
         end
-        # Another client's prompt line is up (here or at its enqueue); an
-        # own send has none, so its image lines are its echo.
-        @renderer.call(own?(origin[:client_id]) ? event : without_named_images(event, event[:prompt]))
+        # The own-send echo already names an image-only prompt; another
+        # client's prompt line does too, here or at its enqueue.
+        @renderer.call(without_named_images(event, event[:prompt]))
       end
 
-      # The turn's start without its image lines when the prompt line shown
-      # for it is the web's "[image: name]" text of a turn of images alone:
-      # that line names them already.
+      # The turn's start without its image lines when the shown prompt is
+      # the image-only "[image: name]" placeholder: that line names them.
       def without_named_images(event, shown_prompt)
         ImageRef.placeholder_only?(shown_prompt) ? event.except(:images) : event
       end

data/lib/samagotchi/terminal_ui/thinking_line.rb

@@ -11,9 +11,9 @@ module Samagotchi
     # ThinkingTicker (so it changes at most once per dwell). Both TUIs use it
     # in place of the raw tail of the stream.
     #
-    # A chunk carries :text (and :thinking): both loops split their stream,
-    # for every profile. A chunk without them (an older worker) has its raw
-    # :content, markup stripped, stand for thinking. A switch of lane starts the next sentence from the new
+    # A chunk carries :text and :thinking: both loops split their stream,
+    # for every profile (the raw :content stays in the worker,
+    # Bridge::ClientEvent). A switch of lane starts the next sentence from the new
     # lane's text; the line shown keeps the label of the lane it came from.
     class ThinkingLine
       include Formatting
@@ -43,12 +43,8 @@ module Samagotchi
       # @return [Boolean] whether the line changed
       def chunk(event)
         # The Bridge's TurnAccumulator reads the lanes by the same rule.
-        if event.key?(:text)
-          changed = add(:thinking, event[:thinking])
-          add(:writing, event[:text]) || changed
-        else
-          add(:thinking, event[:content], raw: true)
-        end
+        changed = add(:thinking, event[:thinking])
+        add(:writing, event[:text]) || changed
       end
 
       # A turn joined mid-way: the newest thinking or text part so far.

data/lib/samagotchi/terminal_ui.rb

@@ -295,7 +295,7 @@ module Samagotchi
       claim_session!(session.id) unless @owner_lock
       # A turn a worker died in (TurnCheckpoint): ended as canceled, with its
       # note, before this REPL's first turn appends after it.
-      session.save if @resume_session && TurnCheckpoint.settle(session)
+      session.save if @resume_session && TurnCheckpoint.settle(session, session_dir: Session.session_dir(session.id))
       keep_cards(session)
       # Saved at once, so a process killed before its first turn leaves a
       # file the sweep knows to delete.
@@ -830,7 +830,7 @@ module Samagotchi
     end
 
     def answer_continue_offer(session, input)
-      answer = @commands.continue_answer(input)
+      answer = @commands.continue_answer(input, as_parent: as_parent?)
       if answer.decision == :invalid
         # The read left no echo: the line shows above its error.
         @surface.commit("#{paint(QUESTION_PROMPT, 33)}#{input}")
@@ -876,7 +876,9 @@ module Samagotchi
         command = if command_registry.anytime?(input)
                     @engine.running_anytime { @commands.run(input, confirm: confirm) }
                   else
-                    @commands.run(input, confirm: confirm)
+                    # A parent's /continue yes is held to guardrails.parent_answers.
+                    parent = TurnFlow.continue_yes?(input) && as_parent? ? { as_parent: true } : {}
+                    @commands.run(input, confirm: confirm, **parent)
                   end
         if command
           show_command_result(command)
@@ -1579,15 +1581,16 @@ module Samagotchi
         end
 
         begin
-          parent = parent_answers? ? { client_id: ClientId::CLI_ANSWER } : {}
+          parent = as_parent? ? { client_id: ClientId::CLI_ANSWER } : {}
           @engine.answer_question(id: prompt.id, selected: answer.selected, freeform: answer.freeform, **parent)
           close_question_widget(prompt, prompt.answer_text(answer))
           return true
         rescue QuestionDesk::Refused => e
-          # A parent's allow guardrails.parent_approvals doesn't let through:
-          # the question stays open for a deny (or the end of the input).
+          # A parent's pick its strategy doesn't let through
+          # (Guardrails::ParentPolicy): the question stays open for a deny
+          # (or the end of the input).
           echo_choice(raw)
-          @surface.commit(Guardrails::ParentApprovals.message(e.reason, typed: true))
+          @surface.commit(e.detail(typed: true))
           next
         rescue ArgumentError => e
           @surface.commit("Invalid: #{e.message}. Try again.")
@@ -1600,8 +1603,8 @@ module Samagotchi
     end
 
     # Whether the answers typed here are a parent agent's (piped stdin, an
-    # agent marker): QuestionDesk holds them to guardrails.parent_approvals.
-    def parent_answers?
+    # agent marker): QuestionDesk holds them to Guardrails::ParentPolicy.
+    def as_parent?
       Guardrails::ParentApprovals.parent_process?
     end
 

data/lib/samagotchi/testing/boundary.rb

@@ -79,9 +79,6 @@ module Samagotchi
           "Samagotchi::Session.new_session" => "spec: #{SESSION} (ctx.delegate?, ctx.fork?, ctx.context read it)",
           "Samagotchi::ContextSources.session_location" => "spec: reads and removes the session's sources (added_by), " \
                                                             "which ctx.context.list doesn't show",
-          'require "samagotchi/memory_bundle/installer"' => "spec: for Installer",
-          "Samagotchi::MemoryBundle::Installer.new" => "spec: installs the bundle so its context provider resolves: " \
-                                                       "needs a kit install helper",
           'require "samagotchi/context_providers"' => "spec: for ContextProviders",
           "Samagotchi::ContextProviders.resolve" => "spec: the manifest's URL provider through chi's own resolver",
           'require "samagotchi/answer_display"' => "spec: for AnswerDisplay",

data/lib/samagotchi/testing/bundle.rb

@@ -240,6 +240,13 @@ module Samagotchi
         failing { entry.handler.call({ name: name.to_s, args: stringify(args) }, nil) }
       end
 
+      # Install this bundle's dir into its sandbox as chi does and load the
+      # installed copy with chi's loaders (Install.run, with its settings):
+      # what a test of the installed bundle needs (its scripts, context
+      # providers), and the install warnings and load failures.
+      # @return [Install::Result]
+      def install(force: false) = Install.run(@dir, settings: @settings, sandbox: @sandbox, force: force)
+
       # Run the chi.init blocks in order, as chi's init tasks do.
       # @return [Array] their results
       def run_inits = failing { @inits.map { |init| init.block.call } }

data/lib/samagotchi/testing/host.rb

@@ -27,8 +27,9 @@ module Samagotchi
           messages: -> { recorder[:messages] },
           messages_partial: -> { recorder[:messages_partial] },
           notify: ->(text, level, label, fallback_for: nil) { recorder.notify(text, level, label, fallback_for) },
-          ask_user: lambda { |question:, options:, header:, allow_freeform:, hook:|
-            recorder.ask_user(question: question, options: options, header: header, allow_freeform: allow_freeform, hook: hook)
+          ask_user: lambda { |question:, options:, header:, allow_freeform:, hook:, effects: nil|
+            recorder.ask_user(question: question, options: options, header: header, allow_freeform: allow_freeform, hook: hook,
+                              effects: effects)
           },
           cancelled: -> { recorder[:cancelled] },
           card: ->(**card) { recorder.card(**card) },
@@ -88,8 +89,9 @@ module Samagotchi
       def build(recorder)
         Hooks::Runtime.new(
           notify: ->(text:, level:, hook:, fallback_for: nil) { recorder.notify(text, level, hook, fallback_for) },
-          ask_user: lambda { |question:, options:, header:, allow_freeform:, hook:|
-            recorder.ask_user(question: question, options: options, header: header, allow_freeform: allow_freeform, hook: hook)
+          ask_user: lambda { |question:, options:, header:, allow_freeform:, hook:, effects: nil|
+            recorder.ask_user(question: question, options: options, header: header, allow_freeform: allow_freeform, hook: hook,
+                              effects: effects)
           },
           stop_turn: ->(reason:, hook:) { recorder.stop(:turn, reason, hook) },
           steer: ->(text:, hook:) { recorder.steer(text, hook) },

data/lib/samagotchi/testing/install.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require_relative "../extension_load"
+require_relative "../guardrails/load_failures"
+require_relative "../memory_bundle/installer"
+require_relative "../memory_bundle/provenance"
+require_relative "../hooks"
+require_relative "bundle"
+require_relative "sandbox"
+require_relative "recorder"
+require_relative "host"
+
+module Samagotchi
+  module Testing
+    # A bundle as chi installs and loads it, unlike Bundle (its source as it
+    # is): MemoryBundle::Installer copies it into the sandbox's state (sha256
+    # and requires_chi checked), then chi's own loaders load what is
+    # installed (ExtensionLoad: the bundle hooks, then the plugins). What
+    # failed names the bundle's source files, not the installed copies.
+    #
+    #   result = Samagotchi::Testing::Install.run("path/to/bundle", settings: { "every" => 3 })
+    #   result.warnings, result.plugin_failures, result.hook_failures, result.registered[:commands]
+    module Install
+      # warnings: the Installer's; plugin_failures / hook_failures:
+      # [Guardrails::LoadFailures::Failure] of this bundle, each location
+      # in the source dir; registered: what it registered (#registered).
+      Result = Data.define(:name, :warnings, :plugin_failures, :hook_failures, :registered) do
+        def failures = plugin_failures + hook_failures
+        def ok? = failures.empty?
+      end
+
+      module_function
+
+      # Install the bundle at +dir+ into +sandbox+ (default Sandbox.current,
+      # else one of its own, left before returning) and load it.
+      # @param settings [Hash] config.yml `bundles: <name>:` (written to the
+      #   sandbox's config.yml)
+      # @param force [Boolean] the Installer's --force (a name chi ships)
+      # @return [Result]
+      # @raise [MemoryBundle::Installer::InstallError] what the Installer refused
+      def run(dir, settings: {}, sandbox: nil, force: false)
+        return Sandbox.with { |own| run(dir, settings: settings, sandbox: own, force: force) } if sandbox.nil? && Sandbox.current.nil?
+
+        sandbox ||= Sandbox.current
+        dir = File.expand_path(dir)
+        name = MemoryBundle::Manifest.read(dir: dir).name
+        sandbox.config("bundles" => { name => settings })
+        installer = MemoryBundle::Installer.new(source: dir, name: name, scope: "system", force: force)
+        installer.run
+        load_installed(name, dir, installer.warnings, sandbox)
+      end
+
+      def load_installed(name, dir, warnings, sandbox)
+        inits = []
+        # A session's values, as an Engine's host gives them (only what the loaders register matters).
+        host = Host.build(Recorder.new(cwd: sandbox.work_dir))
+        hook_failures = Guardrails::LoadFailures.new
+        plugin_failures = Guardrails::LoadFailures.new
+        extension = ExtensionLoad.new(hook_failures: hook_failures)
+        registries = Plugin::Registries.new(
+          commands: SessionCommands.register_builtins(Commands::Registry.new),
+          tools: Tools::Builtins.registry, hooks: extension.hooks,
+          context_for: lambda { |bundle, bundle_settings, label|
+            Plugin::Context.new(bundle: bundle, label: label, settings: bundle_settings, host: host)
+          },
+          services: Plugin::Services.new, stage_tools: ->(*) {},
+          init: ->(_bundle, label, _plugin_label, **, &_block) { inits << { label: label } },
+          toolkits: [], tool_index: Tools::ToolIndex.new, peer_sources: PeerSources.new
+        )
+        extension.load_plugins(registries, failures: plugin_failures)
+        installed = File.join(MemoryBundle::Provenance.bundles_dir, name)
+        Result.new(name: name, warnings: warnings.dup,
+                   plugin_failures: own(plugin_failures, name, installed, dir),
+                   hook_failures: own(hook_failures, name, installed, dir),
+                   registered: registered(registries, name, inits))
+      ensure
+        registries&.services&.stop_all
+      end
+      private_class_method :load_installed
+
+      # What bundle +name+ registered, from the registries it loaded into:
+      # commands ([name, mid_turn, annotation labels]), tools, hooks per
+      # event ([bundle, hook, priority]; Hooks::EVENTS, then any other event
+      # the bundle registered for), inits, toolkits, tool sources and
+      # peer sources.
+      # @param inits [Array<Hash>] {label:} of each chi.init
+      # @return [Hash]
+      def registered(registries, name, inits)
+        {
+          commands: registries.commands.entries.select { |e| e.source == name }.map { |e| [e.name, e.mid_turn, e.annotations.map(&:label)] },
+          tools: registries.tools.by_source(name).map(&:name),
+          hooks: hooks_of(registries.hooks, name),
+          inits: inits.map { |init| init[:label] },
+          toolkits: Array(registries.toolkits).map(&:name),
+          tool_sources: registries.tool_index.sources.map(&:label),
+          peer_sources: registries.peer_sources.names
+        }
+      end
+
+      def hooks_of(hooks, name)
+        own = ->(event) { hooks.bundle_hook_names(event).select { |bundle, _, _| bundle == name } }
+        others = (hooks.bundle_events - Hooks::EVENTS).to_h { |event| [event, own.call(event)] }.reject { |_, list| list.empty? }
+        Hooks::EVENTS.to_h { |event| [event, own.call(event)] }.merge(others)
+      end
+      private_class_method :hooks_of
+
+      # +failures+' entries for bundle +name+, their location moved from the
+      # installed copy to the source dir.
+      def own(failures, name, installed, dir)
+        failures.list.select { |f| f.what.end_with?("(bundle #{name})") }.map do |failure|
+          # The plugin is installed into plugin/, the hooks into hooks/.
+          location = failure.location&.sub(%r{\A#{Regexp.escape(installed)}/(?:plugin/)?}, "#{dir}/")
+          failure.dup.tap { |copy| copy.location = location }
+        end
+      end
+      private_class_method :own
+    end
+  end
+end

data/lib/samagotchi/testing/recorder.rb

@@ -2,6 +2,7 @@
 
 require_relative "../plugin/card"
 require_relative "../plugin/context"
+require_relative "../guardrails/parent_policy"
 
 module Samagotchi
   module Testing
@@ -12,8 +13,11 @@ module Samagotchi
     Steer = Data.define(:text, :hook)
     # A stop_turn or stop_generation (+kind+ :turn or :generation).
     Stop = Data.define(:kind, :reason, :hook)
-    # An ask_user question.
-    Question = Data.define(:question, :options, :header, :allow_freeform, :hook)
+    # An ask_user question; effects: its options' tags as the bundle gave
+    # them (label => effect), nil for none.
+    Question = Data.define(:question, :options, :header, :allow_freeform, :hook, :effects) do
+      def initialize(effects: nil, **) = super
+    end
     # An ask_model request: the request Context built (SideQuestion), its
     # limits, cancel controller and the model: it named (nil: the session's;
     # the kit doesn't check it against any hosts), and +source+, the asking
@@ -100,9 +104,14 @@ module Samagotchi
       end
 
       # The next queued answer (#answers), nil with none (no one to ask).
-      def ask_user(question:, options:, header:, allow_freeform:, hook:)
+      # Effects chi would refuse (a label the options don't have, an
+      # unknown effect: Guardrails::ParentPolicy.option_tags) ask no one, as
+      # in chi: nil, nothing recorded, no answer taken.
+      def ask_user(question:, options:, header:, allow_freeform:, hook:, effects: nil)
+        return nil if Guardrails::ParentPolicy.option_tags(options, effects) == false
+
         record(@questions, Question.new(question: question, options: options, header: header,
-                                        allow_freeform: allow_freeform, hook: hook))
+                                        allow_freeform: allow_freeform, hook: hook, effects: effects))
         answer = @mutex.synchronize { @answers.shift }
         answer.respond_to?(:call) ? answer.call(@questions.last) : answer
       end

data/lib/samagotchi/testing.rb

@@ -22,5 +22,6 @@ require_relative "testing/recording_api"
 require_relative "testing/waiting"
 require_relative "testing/fake_executable"
 require_relative "testing/bundle"
+require_relative "testing/install"
 require_relative "testing/helpers"
 require_relative "testing/boundary"

data/lib/samagotchi/tools/builtins.rb

@@ -118,7 +118,8 @@ module Samagotchi
 
       # What execute and task_create export into the commands they run: a
       # chi started there answers as a parent agent
-      # (Guardrails::ParentApprovals.parent_process?), even under a PTY
+      # (Guardrails::ParentApprovals.parent_process?, held to
+      # Guardrails::ParentPolicy), even under a PTY
       # wrapper. The session's id, "chi" without one. And the model the
       # session runs on (SAMAGOTCHI_SESSION_MODEL, read live, so right after
       # /model), which chi self reports; unset when unknown, so a value

data/lib/samagotchi/tools/delegate_wait.rb

@@ -305,10 +305,15 @@ module Samagotchi
       # The tool's last line follows #reports_mode.
       def waiting_text(child_id, pending, report: false, reports: "off")
         text = "Child #{child_id} is #{ParentReport.question_text(pending, session_id: child_id)}"
-        if ParentReport.continue?(pending)
+        if ParentReport.continue?(pending) && ParentReport.may_continue?(pending)
           text += "The child ran out of steps before it answered. Decide: continue it (run the chi answer command " \
                   "above with execute) if it is getting somewhere; send it a narrower follow-up with delegate " \
                   "session: #{child_id} (that drops the question); or stop it and report back to your user.\n"
+        elsif ParentReport.continue?(pending)
+          # guardrails.parent_answers: hard: continuing is the user's.
+          text += "The child ran out of steps before it answered. Decide: send it a narrower follow-up with delegate " \
+                  "session: #{child_id} (that drops the question); or stop it (the chi answer Stop command above, " \
+                  "with execute) and report back to your user, who may continue it.\n"
         end
         return "#{text}#{REPORT_NEXT_REPLY}" if report
         return "#{text}delegate_result #{child_id} waits again once it is answered." if reports == "off"