samagotchi 0.91.0 → 0.92.0

data/lib/samagotchi/session_manager.rb

@@ -5,6 +5,7 @@ require "json"
 require "time"
 require "securerandom"
 require "rbconfig"
+require_relative "child_env"
 require_relative "client_id"
 require_relative "analytics_file"
 require_relative "atomic_file"
@@ -210,7 +211,7 @@ module Samagotchi
     # is when the worker starts); opts[:env] adds to it (merged, not
     # replaced) what it can't read there: this `chi`'s CLI settings
     # (Config.cli_env) and the absolute log file. It unsets
-    # SAMAGOTCHI_GUARDRAILS_* and the session markers (SESSION_MARKER_ENV).
+    # what ChildEnv lists (SAMAGOTCHI_GUARDRAILS_*, the session markers).
     # XDG_CONFIG_HOME passes: whoever starts or
     # wakes the worker picks which config.yml it reads (docs/guardrails.md).
     # XDG_STATE_HOME and XDG_CONFIG_HOME, when set, pass made absolute
@@ -244,18 +245,15 @@ module Samagotchi
       # And the spawner's XDG dirs, absolute: a relative XDG_STATE_HOME or
       # XDG_CONFIG_HOME would otherwise be read from the session's directory.
       child_env.merge!(Paths.absolute_xdg)
-      # The spawner's environment must not reach the worker's guardrails (a
-      # parent agent starting or waking a session): Process.spawn unsets a
-      # key mapped to nil. config.yml no longer reads them; this keeps an
-      # older or future env-exposed one out as well.
-      ENV.each_key { |key| child_env[key] = nil if key.start_with?(GUARDRAILS_ENV_PREFIX) }
-      # The markers a session's execute exports (Tools::Builtins.parent_env)
-      # are that session's: a worker started from its commands (chi send)
-      # is another session. Its execute and tasks set its own; nothing else
-      # it runs (a user's !cmd, an MCP server, a context command) has one.
-      SESSION_MARKER_ENV.each { |key| child_env[key] = nil }
-      # A smoke's fake "newest installed" is for this process's notices only.
-      child_env[InstalledVersions::ENV_KEY] = nil
+      # Unset (Process.spawn unsets a key mapped to nil) what no child chi
+      # takes from its spawner (ChildEnv): the spawner's guardrails settings
+      # (a parent agent starting or waking a session; config.yml no longer
+      # reads them, this keeps an older or future env-exposed one out as
+      # well); the session markers, a session's own (a worker started from
+      # its commands, chi send, is another session: its execute and tasks
+      # set its own; nothing else it runs has one); and a smoke's fake
+      # "newest installed", for this process's notices only.
+      child_env.merge!(ChildEnv.unset)
       # A worker process: run_session_loop traps signals, and leaves this
       # process's tree.
       child_env[WORKER_PROCESS_ENV] = "1"
@@ -263,17 +261,11 @@ module Samagotchi
       # A gem-mode worker activates the newest installed chi itself: under
       # `bundle exec` (a Gemfile that has samagotchi) Bundler's RUBYOPT would
       # hold it to the bundle's version, and its badge would never clear.
-      child_env.merge!(InstalledGem.unbundled_env_changes) if InstalledGem.spec
+      child_env.merge!(ChildEnv.unbundled)
       opts[:env] = child_env unless child_env.empty?
       opts
     end
 
-    GUARDRAILS_ENV_PREFIX = "SAMAGOTCHI_GUARDRAILS_"
-    WORKER_ENV_PREFIX = "SAMAGOTCHI_WORKER_"
-    # Tools::Builtins.parent_env's (Tools::TaskRuntime::MARKER_ENV_KEYS).
-    SESSION_MARKER_ENV = %w[SAMAGOTCHI_PARENT_SESSION SAMAGOTCHI_SESSION_MODEL SAMAGOTCHI_SESSION_THINKING
-                            SAMAGOTCHI_SESSION_REASONING_HISTORY].freeze
-
     # List all sessions, reading status from persisted session.json files.
     # +project_root+: only that project's sessions (nil: every session).
     # +include_archived+: archived sessions too (Session#archived says which).

data/lib/samagotchi/task_watch.rb

@@ -18,11 +18,18 @@ module Samagotchi
   class TaskWatch
     # A watched task: +limit_sec+, the limit an execute handed it over at
     # (nil for task_create's); +note_only+, the user stopped the turn that
-    # started or waited on it (M5): its finish is a plain note, no wake.
-    Entry = Data.define(:id, :limit_sec, :note_only) do
-      def initialize(id:, limit_sec: nil, note_only: false) = super
+    # started or waited on it (M5): its finish is a plain note, no wake;
+    # +failures+, how often its note couldn't be written (#put_back) or the
+    # look for it failed (#look_failed).
+    Entry = Data.define(:id, :limit_sec, :note_only, :failures) do
+      def initialize(id:, limit_sec: nil, note_only: false, failures: 0) = super
     end
 
+    # A task whose note or look failed this often still gets tried at each
+    # look, but no longer holds the worker up (#holding): a failure that
+    # never passes must not keep it alive for good.
+    MAX_FAILURES = 3
+
     # The cancel reasons that are the user's own Stop (Bridge::CANCEL_REASONS
     # less session_stopped, and the TUI's ctrl_c).
     USER_CANCEL_REASONS = %i[manual user ctrl_c].freeze
@@ -36,11 +43,18 @@ module Samagotchi
     MODE_KEY = "session.task_wakes"
     MODES = %w[wake queue off].freeze
 
-    # session.task_wakes: wake (default), queue or off; anything else is wake.
+    # session.task_wakes: wake (default), queue or off; anything else is
+    # wake, and so is a config that can't be read (logged once per error
+    # class: it is read at every idle pass).
     def self.mode
       value = Config.get(MODE_KEY).to_s
       MODES.include?(value) ? value : "wake"
-    rescue StandardError
+    rescue StandardError => e
+      @mode_errors ||= {}
+      unless @mode_errors[e.class]
+        @mode_errors[e.class] = true
+        Log.warn(:worker, "task_wakes_unreadable", error: e.class.name, msg: e.message)
+      end
       "wake"
     end
 
@@ -94,7 +108,9 @@ module Samagotchi
 
     def ids = @mutex.synchronize { @entries.keys }
 
-    def entry(id) = @mutex.synchronize { @entries[id] }
+    # The watched tasks, oldest first (a copy).
+    # @return [Array<Entry>]
+    def entries = @mutex.synchronize { @entries.values }
 
     def any? = @mutex.synchronize { @entries.any? }
 
@@ -107,10 +123,10 @@ module Samagotchi
     # running task (TaskRuntime.get_record); nothing with an empty watch.
     # @return [Array<Array(Entry, Tools::TaskRecord)>]
     def take_finished(keep: nil)
-      entries = @mutex.synchronize { @entries.values }
-      return [] if entries.empty?
+      watched = entries
+      return [] if watched.empty?
 
-      entries.filter_map do |entry|
+      watched.filter_map do |entry|
         # Safe for any llm_context strategy: stale and forget stubs are drawn
         # in the view sent to the model (LLMContextView, the entry's edits),
         # never written over the saved tool_response text; only a !rollback
@@ -118,7 +134,10 @@ module Samagotchi
         next drop(entry, log: "not_in_conversation") if keep && !keep.include?(entry.id)
 
         record, error = Tools::TaskRuntime.get_record(entry.id)
-        next drop(entry) if error || record.nil?
+        if error || record.nil?
+          # Gone (its task dir deleted) or unreadable: no note can be written.
+          next drop(entry, log: "record_unreadable", level: :info, error: error.to_s.lines.first&.strip)
+        end
         next nil if record.running?
         # Removed by a look meanwhile (a task_wait on an anytime command's thread).
         next nil unless drop(entry, kept: true)
@@ -129,13 +148,25 @@ module Samagotchi
     end
 
     # +entries+ taken by #take_finished whose note couldn't be written:
-    # watched again (an id watched meanwhile keeps its own entry).
+    # watched again, the failure counted (an id watched meanwhile keeps its
+    # own entry).
     def put_back(entries)
-      @mutex.synchronize { entries.each { |entry| @entries[entry.id] ||= entry } }
+      @mutex.synchronize do
+        entries.each { |entry| @entries[entry.id] ||= entry.with(failures: entry.failures + 1) }
+      end
+    end
+
+    # The look for finished tasks failed before it could tell which ended
+    # (the conversation's task ids couldn't be read): every watched task
+    # counts a failure.
+    def look_failed
+      @mutex.synchronize { @entries.transform_values! { |entry| entry.with(failures: entry.failures + 1) } }
     end
 
     # Whether a watched task has finished (#take_finished would take it):
-    # Engine#next_turn_waiting asks at a turn's end. Takes nothing.
+    # Engine#next_turn_waiting asks at a turn's end. Takes nothing. A record
+    # that can't be read counts as not finished here (and not running in
+    # #running): #take_finished drops it at the next look, logged.
     def finished?
       ids.any? do |id|
         record, = Tools::TaskRuntime.get_record(id)
@@ -143,23 +174,35 @@ module Samagotchi
       end
     end
 
-    # The watched tasks still running ({id:, command:}), for the idle exit
-    # and /exit (WorkerIdleExit's running_tasks).
+    # The watched tasks a finish would wake for, running or finished and
+    # not yet taken (#take_finished takes them at the idle loop's next
+    # look): they hold the worker's idle exit (WorkerIdleExit's
+    # watched_tasks). Not a note-only one (no wake would come for it), nor
+    # one whose note or look failed MAX_FAILURES times. No `ps`: in memory.
+    # @return [Array<Entry>]
+    def holding = entries.reject { |entry| entry.note_only || entry.failures >= MAX_FAILURES }
+
+    # The #holding tasks still running ({id:, command:}), for /exit
+    # (WorkerIdleExit's watched_running): one finished meanwhile is noted
+    # as the worker leaves. One `ps` per task.
     # @return [Array<Hash>]
     def running
-      ids.filter_map do |id|
-        record, = Tools::TaskRuntime.get_record(id)
-        { id: id, command: record.command.to_s } if record&.running?
+      holding.filter_map do |entry|
+        record, = Tools::TaskRuntime.get_record(entry.id)
+        { id: entry.id, command: record.command.to_s } if record&.running?
       end
     end
 
     private
 
     # Removes +entry+; nil (a filter_map's skip), or with +kept+ whether it
-    # was there. +log+: why a task leaves without a note (debug).
-    def drop(entry, kept: false, log: nil)
+    # was there. +log+: why a task leaves without a note, at +level+ (debug
+    # by default), with +error+ when there is one.
+    def drop(entry, kept: false, log: nil, level: :debug, error: nil)
       removed = !remove(entry.id).nil?
-      Log.debug(:worker, "task_watch_dropped", task_id: entry.id, reason: log) if log && removed
+      if log && removed
+        Log.public_send(level, :worker, "task_watch_dropped", **{ task_id: entry.id, reason: log, error: error }.compact)
+      end
       kept ? removed : nil
     end
 

data/lib/samagotchi/testing/bundle.rb

@@ -11,6 +11,7 @@ require_relative "../peer_sources"
 require_relative "../toolkit"
 require_relative "../guardrails/gate"
 require_relative "../memory_bundle/manifest"
+require_relative "../memory_bundle/source"
 require_relative "../session_setup"
 require_relative "sandbox"
 require_relative "recorder"
@@ -69,7 +70,7 @@ module Samagotchi
     # raises HookFailed after the call (chi would log it and go on);
     # #lenient collects them in #errors instead.
     class Bundle
-      SHIPPED_DIR = File.expand_path("../bundles", __dir__)
+      SHIPPED_DIR = MemoryBundle::SourceNormalizer::SHIPPED_DIR
 
       class << self
         # @param dir [String] the bundle's folder (its manifest.yml)
@@ -88,6 +89,20 @@ module Samagotchi
 
         # A bundle chi ships (lib/samagotchi/bundles/<name>), as #load.
         def shipped(name, **) = load(File.join(SHIPPED_DIR, name.to_s), **)
+
+        # Registries as an Engine's start: chi's built-in commands and
+        # tools, empty services, toolkits, tool index and peer sources;
+        # +fields+ set the rest (hooks:, context_for:, init: ...) or replace
+        # these. Bundle#build_registries and Install's load both start here.
+        # @api private
+        # @return [Plugin::Registries]
+        def registries(**fields)
+          Plugin::Registries.new(
+            commands: SessionCommands.register_builtins(Commands::Registry.new), tools: Tools::Builtins.registry,
+            services: Plugin::Services.new, stage_tools: ->(*) {}, toolkits: [], tool_index: Tools::ToolIndex.new,
+            peer_sources: PeerSources.new, **fields
+          )
+        end
       end
 
       # @return [String] the bundle's name (manifest.yml)
@@ -132,6 +147,13 @@ module Samagotchi
         own = session_settings.nil? || session_settings.empty? ? {} : { setup: setup_with(session_settings, host[:setup]) }
         @own_sandbox = sandbox.nil? && Sandbox.current.nil?
         @sandbox = sandbox || Sandbox.current || Sandbox.enter
+        build(host, own)
+      rescue Exception # rubocop:disable Lint/RescueException -- leave the sandbox it entered, whatever failed
+        @sandbox.leave if @own_sandbox && @sandbox
+        raise
+      end
+
+      def build(host, own)
         @recorder = Recorder.new(cwd: @sandbox.work_dir, **host, **own)
         @sessions = Sessions.new
         @http = FakeHttp.new
@@ -143,6 +165,7 @@ module Samagotchi
         @contexts = {}
         @registries = build_registries
       end
+      private :build
 
       # @api private (Bundle.load)
       def load!
@@ -349,28 +372,22 @@ module Samagotchi
       private
 
       def build_registries
-        builtin_tools = Tools::Builtins.registry
         toolkits = []
         host = Host.build(@recorder, toolkits: -> { Toolkit::BUILTIN_KITS.keys + toolkits.map(&:name) },
                                      tool_names: -> { @registries.tools.names })
-        Plugin::Registries.new(
-          commands: SessionCommands.register_builtins(Commands::Registry.new),
-          tools: builtin_tools,
+        Bundle.registries(
           hooks: Hooks::Registry.new.tap { |registry| registry.runtime = Runtime.build(@recorder) },
           context_for: lambda { |bundle, settings, label|
             @contexts[label] = Plugin::Context.new(bundle: bundle, label: label, settings: settings, host: host,
                                                    env: ENV, sessions: @sessions, http_transport: @http)
           },
           tools_changed: -> { @tools_changes += 1 },
-          services: Plugin::Services.new,
           stage_tools: ->(_bundle, specs, context) { @staged_tools << StagedTools.new(specs: specs, context: context) },
           init: lambda { |_bundle, label, plugin_label, provides_tools:, quiet:, timeout:, failed: nil, &block|
             @inits << Init.new(label: label, plugin_label: plugin_label, provides_tools: provides_tools, quiet: quiet,
                                timeout: timeout, failed: failed, block: block)
           },
-          toolkits: toolkits,
-          tool_index: Tools::ToolIndex.new,
-          peer_sources: PeerSources.new
+          toolkits: toolkits
         )
       end
 
@@ -388,21 +405,17 @@ module Samagotchi
 
       # +setup+ (the recorder's, nil for none) with +session_settings+ as
       # this bundle's own values, checked against the manifest's
-      # session_settings: as chi --set checks them.
-      # @raise [ArgumentError] a key the manifest doesn't list
+      # session_settings: (keys and types) as chi --set checks them.
+      # @raise [ArgumentError] a key the manifest doesn't list, or a value
+      #   of another type than it gives the key
       def setup_with(session_settings, setup)
         values = { @name => stringify(session_settings) }
-        BundleSessionSettings.check!(values, bundles: { @name => @manifest.session_settings }, flag: "session_settings")
+        BundleSessionSettings.check!(values, bundles: { @name => @manifest.session_settings },
+                                             types: { @name => @manifest.session_setting_types }, flag: "session_settings")
         (setup || SessionSetup.new).with(bundle_settings: values)
       end
 
-      def stringify(value)
-        case value
-        when Hash then value.to_h { |key, item| [key.to_s, stringify(item)] }
-        when Array then value.map { |item| stringify(item) }
-        else value
-        end
-      end
+      def stringify(value) = Sandbox.stringify(value)
     end
   end
 end

data/lib/samagotchi/testing/install.rb

@@ -19,16 +19,24 @@ module Samagotchi
     # failed names the bundle's source files, not the installed copies.
     #
     #   result = Samagotchi::Testing::Install.run("path/to/bundle", settings: { "every" => 3 })
-    #   result.warnings, result.plugin_failures, result.hook_failures, result.registered[:commands]
+    #   result.warnings, result.plugin_failures, result.hook_failures, result.registered.commands
     module Install
       # warnings: the Installer's; plugin_failures / hook_failures:
       # [Guardrails::LoadFailures::Failure] of this bundle, each location
       # in the source dir; registered: what it registered (#registered).
       Result = Data.define(:name, :warnings, :plugin_failures, :hook_failures, :registered) do
         def failures = plugin_failures + hook_failures
-        def ok? = failures.empty?
       end
 
+      # What a bundle registered (#registered): commands, tools (names),
+      # hooks per event, inits (labels), toolkits, tool sources and peer
+      # sources (names).
+      Registered = Data.define(:commands, :tools, :hooks, :inits, :toolkits, :tool_sources, :peer_sources)
+      # A command: its mid_turn policy and its selection-bar labels (chi.annotation).
+      Command = Data.define(:name, :mid_turn, :labels)
+      # A hook on an event: the bundle, the hook (its file, or the plugin's) and its priority.
+      Hook = Data.define(:bundle, :hook, :priority)
+
       module_function
 
       # Install the bundle at +dir+ into +sandbox+ (default Sandbox.current,
@@ -57,15 +65,12 @@ module Samagotchi
         hook_failures = Guardrails::LoadFailures.new
         plugin_failures = Guardrails::LoadFailures.new
         extension = ExtensionLoad.new(hook_failures: hook_failures)
-        registries = Plugin::Registries.new(
-          commands: SessionCommands.register_builtins(Commands::Registry.new),
-          tools: Tools::Builtins.registry, hooks: extension.hooks,
+        registries = Bundle.registries(
+          hooks: extension.hooks,
           context_for: lambda { |bundle, bundle_settings, label|
             Plugin::Context.new(bundle: bundle, label: label, settings: bundle_settings, host: host)
           },
-          services: Plugin::Services.new, stage_tools: ->(*) {},
-          init: ->(_bundle, label, _plugin_label, **, &_block) { inits << { label: label } },
-          toolkits: [], tool_index: Tools::ToolIndex.new, peer_sources: PeerSources.new
+          init: ->(_bundle, label, _plugin_label, **, &_block) { inits << { label: label } }
         )
         extension.load_plugins(registries, failures: plugin_failures)
         installed = File.join(MemoryBundle::Provenance.bundles_dir, name)
@@ -79,26 +84,30 @@ module Samagotchi
       private_class_method :load_installed
 
       # What bundle +name+ registered, from the registries it loaded into:
-      # commands ([name, mid_turn, annotation labels]), tools, hooks per
-      # event ([bundle, hook, priority]; Hooks::EVENTS, then any other event
-      # the bundle registered for), inits, toolkits, tool sources and
-      # peer sources.
+      # hooks per event are Hooks::EVENTS, then any other event the bundle
+      # registered for.
       # @param inits [Array<Hash>] {label:} of each chi.init
-      # @return [Hash]
+      # @return [Registered]
       def registered(registries, name, inits)
-        {
-          commands: registries.commands.entries.select { |e| e.source == name }.map { |e| [e.name, e.mid_turn, e.annotations.map(&:label)] },
+        Registered.new(
+          commands: registries.commands.entries.select { |e| e.source == name }.map do |e|
+            Command.new(name: e.name, mid_turn: e.mid_turn, labels: e.annotations.map(&:label))
+          end,
           tools: registries.tools.by_source(name).map(&:name),
           hooks: hooks_of(registries.hooks, name),
           inits: inits.map { |init| init[:label] },
           toolkits: Array(registries.toolkits).map(&:name),
           tool_sources: registries.tool_index.sources.map(&:label),
           peer_sources: registries.peer_sources.names
-        }
+        )
       end
 
       def hooks_of(hooks, name)
-        own = ->(event) { hooks.bundle_hook_names(event).select { |bundle, _, _| bundle == name } }
+        own = lambda do |event|
+          hooks.bundle_hook_names(event).filter_map do |bundle, hook, priority|
+            Hook.new(bundle: bundle, hook: hook, priority: priority) if bundle == name
+          end
+        end
         others = (hooks.bundle_events - Hooks::EVENTS).to_h { |event| [event, own.call(event)] }.reject { |_, list| list.empty? }
         Hooks::EVENTS.to_h { |event| [event, own.call(event)] }.merge(others)
       end

data/lib/samagotchi/testing/sandbox.rb

@@ -5,6 +5,7 @@ require "tmpdir"
 require "yaml"
 require_relative "../log"
 require_relative "../paths"
+require_relative "../sandbox_layout"
 require_relative "fake_executable"
 
 module Samagotchi
@@ -38,7 +39,16 @@ module Samagotchi
           sandbox&.leave
         end
 
+        # +value+ with every Hash key a String, as config.yml and a
+        # handler's args read (Bundle uses it too).
         # @api private
+        def stringify(value)
+          case value
+          when Hash then value.to_h { |key, item| [key.to_s, stringify(item)] }
+          when Array then value.map { |item| stringify(item) }
+          else value
+          end
+        end
       end
 
       # @return [String] the temp folder holding everything
@@ -55,31 +65,16 @@ module Samagotchi
       def enter
         raise ArgumentError, "the sandbox was entered already" if @root
 
-        @root = File.realpath(Dir.mktmpdir("chi-bundle-test-"))
-        @saved = ENV.to_h
-        @outer = Sandbox.current
-        ENV.each_key.select { |key| key.start_with?("SAMAGOTCHI_") && !KEPT.include?(key) }.each { |key| ENV.delete(key) }
-        %w[config state data cache home work bin].each { |dir| FileUtils.mkdir_p(File.join(@root, dir)) }
-        File.write(File.join(@root, "gitconfig"), "")
-        ENV.update(
-          "HOME" => File.join(@root, "home"),
-          "XDG_CONFIG_HOME" => File.join(@root, "config"),
-          "XDG_STATE_HOME" => File.join(@root, "state"),
-          "XDG_DATA_HOME" => File.join(@root, "data"),
-          "XDG_CACHE_HOME" => File.join(@root, "cache"),
-          "CLAUDE_CONFIG_DIR" => File.join(@root, "home", ".claude"),
-          "CODEX_HOME" => File.join(@root, "home", ".codex"),
-          "GIT_CONFIG_GLOBAL" => File.join(@root, "gitconfig"),
-          "GIT_CONFIG_NOSYSTEM" => "1",
-          "SAMAGOTCHI_KEYCHAIN" => "off",
-          "SAMAGOTCHI_ENV" => "test",
-          "SAMAGOTCHI_RECAP_ENABLED" => "false",
-          "SAMAGOTCHI_CACHE_WARMUP" => "off",
-          "PATH" => [bin_dir, ENV.fetch("PATH", nil)].compact.join(File::PATH_SEPARATOR)
-        )
-        # The log resolves its file from the (now temp) state home.
-        Log.reset!
-        Sandbox.current = self
+        layout = SandboxLayout.create("chi-bundle-test-", extra: %w[data cache home bin])
+        begin
+          @root = layout.root
+          @saved = ENV.to_h
+          @outer = Sandbox.current
+          point_env(layout)
+        rescue Exception # rubocop:disable Lint/RescueException -- put ENV back, whatever failed
+          leave
+          raise
+        end
         self
       end
 
@@ -87,7 +82,7 @@ module Samagotchi
       def leave
         return unless @root
 
-        ENV.replace(@saved)
+        ENV.replace(@saved) if @saved
         Log.reset!
         FileUtils.rm_rf(@root)
         Sandbox.current = @outer
@@ -97,10 +92,7 @@ module Samagotchi
       # Write config.yml (what Config.get reads): a Hash or YAML text.
       # @return [String] its path
       def config(data)
-        path = File.join(Paths.config_home, Paths::APP_DIR, "config.yml")
-        FileUtils.mkdir_p(File.dirname(path))
-        File.write(path, data.is_a?(String) ? data : YAML.dump(stringify(data)))
-        path
+        SandboxLayout.new(@root).write_config(data.is_a?(String) ? data : stringify(data), config_home: Paths.config_home)
       end
 
       # @return [String] $XDG_STATE_HOME/samagotchi (ctx.data_dir's parent)
@@ -145,6 +137,28 @@ module Samagotchi
 
       private
 
+      # ENV at +layout+'s folders, none of the SAMAGOTCHI_* settings but KEPT.
+      def point_env(layout)
+        ENV.each_key.select { |key| key.start_with?("SAMAGOTCHI_") && !KEPT.include?(key) }.each { |key| ENV.delete(key) }
+        File.write(File.join(@root, "gitconfig"), "")
+        ENV.update(
+          **layout.env,
+          "HOME" => File.join(@root, "home"),
+          "XDG_DATA_HOME" => File.join(@root, "data"),
+          "XDG_CACHE_HOME" => File.join(@root, "cache"),
+          "CLAUDE_CONFIG_DIR" => File.join(@root, "home", ".claude"),
+          "CODEX_HOME" => File.join(@root, "home", ".codex"),
+          "GIT_CONFIG_GLOBAL" => File.join(@root, "gitconfig"),
+          "GIT_CONFIG_NOSYSTEM" => "1",
+          "SAMAGOTCHI_KEYCHAIN" => "off",
+          "SAMAGOTCHI_ENV" => "test",
+          "PATH" => [bin_dir, ENV.fetch("PATH", nil)].compact.join(File::PATH_SEPARATOR)
+        )
+        # The log resolves its file from the (now temp) state home.
+        Log.reset!
+        Sandbox.current = self
+      end
+
       # Run the block with +dir+ as the process's cwd (the memory tools
       # read the project from it); nil: as it is.
       def in_dir(dir, &)
@@ -153,13 +167,7 @@ module Samagotchi
         Dir.chdir(dir, &)
       end
 
-      def stringify(value)
-        case value
-        when Hash then value.to_h { |key, item| [key.to_s, stringify(item)] }
-        when Array then value.map { |item| stringify(item) }
-        else value
-        end
-      end
+      def stringify(value) = Sandbox.stringify(value)
     end
   end
 end

data/lib/samagotchi/testing/waiting.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../process_group"
+
 module Samagotchi
   module Testing
     # Waiting with a deadline, for a test that waits on a thread or a
@@ -24,13 +26,9 @@ module Samagotchi
       end
 
       # Whether no process +pid+ is left (a killed grandchild is reaped a
-      # moment later: wait_until { process_gone?(pid) }).
-      def process_gone?(pid)
-        Process.kill(0, pid)
-        false
-      rescue Errno::ESRCH
-        true
-      end
+      # moment later: wait_until { process_gone?(pid) }). One that isn't
+      # ours to signal is still there (ProcessGroup.alive?).
+      def process_gone?(pid) = !ProcessGroup.alive?(pid)
     end
   end
 end

data/lib/samagotchi/tool_response.rb

@@ -28,20 +28,42 @@ module Samagotchi
 
     # Runs +calls+ in order (ToolRunner#run each), yielding each run and its
     # index as it finishes. +emit+ takes the dispatch events, the runner's
-    # own go to +on_stream_event+.
+    # own go to +on_stream_event+. An Interrupt (Ctrl-C) mid-batch yields an
+    # #interrupted run for every call left (the one it cut short too), so
+    # the loop's conversation answers each call, then goes on up: the turn
+    # keeps its progress (Engine#ctrl_c_messages).
     # @return [Array<ToolRun>] the runs
     def run_batch(runner, calls, iteration:, emit:, on_stream_event:, cap:)
+      # Before anything can be interrupted: the rescue counts it.
+      runs = []
       emit.call({ type: :tool_dispatch_started, iteration: iteration, call_count: calls.length })
-      runs = calls.each_with_index.map do |call, index|
-        run = runner.run(call, iteration: iteration, call_index: index + 1, call_count: calls.length,
-                               on_stream_event: on_stream_event, max_tool_output_chars: cap)
-        yield run, index if block_given?
-        run
+      calls.each_with_index do |call, index|
+        runs << runner.run(call, iteration: iteration, call_index: index + 1, call_count: calls.length,
+                                 on_stream_event: on_stream_event, max_tool_output_chars: cap)
+        yield runs.last, index if block_given?
       end
       emit.call({ type: :tool_dispatch_completed, iteration: iteration, call_count: calls.length })
       runs
+    rescue Interrupt
+      calls.each_with_index.drop(runs.size).each { |call, index| yield interrupted(call[:name]), index } if block_given?
+      raise
     end
 
+    # The result of a call an Interrupt cut short (or never started): the
+    # model reads that it may have partly run.
+    def interrupted(name)
+      text = interrupted_text(name)
+      ToolRun.new(output: text, capped_output: text)
+    end
+
+    INTERRUPTED = "Interrupted (Ctrl-C) before it returned: it may have partly run."
+
+    def interrupted_text(name) = "[#{name}] #{INTERRUPTED}"
+
+    # Whether +content+ is an #interrupted result, whatever tool it names
+    # (an aliased call's saved name is the model's, the text the tool's).
+    def interrupted_text?(content) = content.to_s.match?(/\A\[[^\]\s]+\] #{Regexp.escape(INTERRUPTED)}\z/)
+
     # The runs' activity, for the turn's tool list (none for a call whose
     # dispatcher raised).
     def activities(runs)

data/lib/samagotchi/tools/task_runtime.rb

@@ -6,6 +6,7 @@ require "securerandom"
 require "shellwords"
 require "time"
 require_relative "../atomic_file"
+require_relative "../child_env"
 require_relative "../log"
 require_relative "../process_group"
 require_relative "shell"
@@ -29,8 +30,7 @@ module Samagotchi
       OUTPUT_TAIL_READ_BYTES = 16 * 1024
       SANITIZED_ENV_KEYS = %w[RUBYOPT RUBYLIB BUNDLE_GEMFILE BUNDLE_BIN_PATH BUNDLER_VERSION].freeze
       # Set by chi (Builtins.parent_env); the model's env can't change it.
-      MARKER_ENV_KEYS = %w[SAMAGOTCHI_PARENT_SESSION SAMAGOTCHI_SESSION_MODEL SAMAGOTCHI_SESSION_THINKING
-                           SAMAGOTCHI_SESSION_REASONING_HISTORY].freeze
+      MARKER_ENV_KEYS = ChildEnv::SESSION_MARKERS
       # task_wait and task_get add it to a task the user stopped (the web's
       # stop-task button), so the model doesn't rerun the job.
       # A record whose pid isn't a process group chi started (missing, 0, 1,