samagotchi 0.92.0 → 0.94.0

data/lib/samagotchi/child_reports.rb

@@ -194,12 +194,10 @@ module Samagotchi
     def commit
       @taken.each_value do |report|
         Tools::DelegateCursors.update(@session_id, report.child_id, state_dir: @state_dir) do |cursor|
-          next cursor unless cursor.report_claim&.fetch("id", nil) == report.claim_id
+          next cursor unless cursor.report_claim&.id == report.claim_id
 
-          before = report.before.with(report_claim: nil)
-          after = report.after.with(report_claim: nil)
-          current = cursor.with(report_claim: nil)
-          current == before ? after : current
+          current = cursor.without_claim
+          current == report.before.without_claim ? report.after.without_claim : current
         end
         delete_rings(report.rings)
       rescue StandardError => e
@@ -212,7 +210,7 @@ module Samagotchi
     def release
       @taken.each_value do |report|
         Tools::DelegateCursors.update(@session_id, report.child_id, state_dir: @state_dir) do |cursor|
-          cursor.report_claim&.fetch("id", nil) == report.claim_id ? cursor.with(report_claim: nil) : cursor
+          cursor.report_claim&.id == report.claim_id ? cursor.without_claim : cursor
         end
       end
       @taken = {}
@@ -234,11 +232,11 @@ module Samagotchi
       return report.with(relay: nil) unless relay
 
       question = report.relay
-      what = question.header.to_s.empty? ? question.hook.to_s : question.header.to_s
+      label = Tools::DelegateRelay.label(question)
       line = if Session.load(report.child_id, state_dir: @state_dir).pending_question&.id.to_s != question.id.to_s
-               Tools::DelegateRelay.line(what, "answered on the child", hook: true)
+               Tools::DelegateRelay.line(label, "answered on the child")
              elsif relay.relay_desk.settled?(report.child_id, question.id)
-               Tools::DelegateRelay.line(what, "answered on a relay already; it waits for the user on the child", hook: true)
+               Tools::DelegateRelay.line(label, "answered on a relay already; it waits for the user on the child")
              else
                outcome = Tools::DelegateRelay.call(report.child_id, question, relay: relay, state_dir: @state_dir)
                return hold_back(report) if outcome.stopped
@@ -286,7 +284,7 @@ module Samagotchi
     def release_report(report)
       @taken.delete(report.child_id)
       Tools::DelegateCursors.update(@session_id, report.child_id, state_dir: @state_dir) do |cursor|
-        cursor.report_claim&.fetch("id", nil) == report.claim_id ? cursor.with(report_claim: nil) : cursor
+        cursor.report_claim&.id == report.claim_id ? cursor.without_claim : cursor
       end
       nil
     end
@@ -330,11 +328,11 @@ module Samagotchi
                                       timeout: 0, turn: before.turn)
       return nil unless reportable?(wait)
 
-      claim_id = before.report_claim&.fetch("id", nil) || SecureRandom.hex(16)
-      after = before.with(reply_file: wait.status == :done ? wait.file : before.reply_file,
-                          turn: wait.status == :waiting_for_answer ? before.turn : nil, report_claim: nil)
+      claim_id = before.report_claim&.id || SecureRandom.hex(16)
+      after = before.without_claim.with(reply_file: wait.status == :done ? wait.file : before.reply_file,
+                                        turn: wait.status == :waiting_for_answer ? before.turn : nil)
                     .with_baseline(ReplyWait.baseline_of(wait.session))
-      claim = { "id" => claim_id, "file" => wait.file, "cursor" => after.to_json_hash }
+      claim = Tools::ReportClaim.new(id: claim_id, file: wait.file, cursor: after)
       return nil unless Tools::DelegateCursors.claim_report(@session_id, child_id, expected: before, claim: claim,
                                                             state_dir: @state_dir)
 

data/lib/samagotchi/client_id.rb

@@ -46,8 +46,26 @@ module Samagotchi
     # (#interactive?): a web tab, an attached chi TUI.
     INTERACTIVE_PREFIXES = [WEB_PREFIX, TUI_PREFIX].freeze
 
+    # A turn's origin by its sender (#origin, LastTurn#origin): the ids chi
+    # runs turns for on its own, by prefix; system:reminder is "reminder",
+    # anything else "client".
+    ORIGIN_PREFIXES = { DELEGATE_PREFIX => "delegate", CHILD_PREFIX => "delegate_report",
+                        CONTEXT_PREFIX => "context", TASK_PREFIX => "task" }.freeze
+
     module_function
 
+    # What sent a turn: "delegate" (a delegating parent), "delegate_report"
+    # (a child's report), "context" (a context wake), "task" (a task finish
+    # wake), "reminder", else "client" (a person, chi send, a plugin, nil).
+    # @return [String]
+    def origin(client_id)
+      id = client_id.to_s
+      return "reminder" if id == REMINDER
+
+      ORIGIN_PREFIXES.each { |prefix, origin| return origin if id.start_with?(prefix) }
+      "client"
+    end
+
     # Whether +client_id+ is a web tab or a chi TUI, which see a command's
     # reply and can send the line it asks for (CacheConfirm); chi send, a
     # delegate, a plugin, chi itself and nil are not.

data/lib/samagotchi/config/restart_watch.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  module Config
+    # Tells a worker or chi web when config.yml changes a setting it only
+    # reads at its start (Config::Entry#lifecycle: worker_start or web_start,
+    # and process_start): "server.port changed — applies after a worker
+    # restart". ConfigFile.watch_restart_settings! adds a Watcher;
+    # ConfigFile.read_yaml reports each new read of the file (#notify) or a
+    # file that doesn't parse (#unreadable), which tells nothing and warns
+    # once, instead of every start-only key reading as changed.
+    #
+    # Thread-safe: the watchers list sits behind one mutex; callbacks run
+    # outside it.
+    module RestartWatch
+      @mutex = Mutex.new
+      @watchers = []
+
+      # One process's start-only settings and their start values.
+      class Watcher
+        LIFECYCLES = {
+          worker: %i[worker_start process_start],
+          web: %i[web_start process_start]
+        }.freeze
+
+        attr_reader :path
+
+        # @param data [Hash, nil] config.yml as the process read it at start
+        # @param file_key [Array, nil] that read's [mtime, size]
+        def initialize(process:, path:, data:, file_key:, on_change:)
+          lifecycles = LIFECYCLES.fetch(process) { raise ArgumentError, "unknown config process #{process.inspect}" }
+          raise ArgumentError, "a config change callback is required" unless on_change
+
+          @process = process
+          @path = path
+          @entries = Config::ENTRIES.select { |entry| entry.config_exposed? && lifecycles.include?(entry.lifecycle) }
+          @values = @entries.to_h { |entry| [entry.key, Config.resolve(entry.key, file_data: data, env: {})] }
+          @noticed = {}
+          @file_key = file_key
+          @on_change = on_change
+        end
+
+        # [callback, message] for each start-only setting the file read now
+        # (+data+, under +file_key+) changes: once per key per new value,
+        # none for a value back at its start value. Empty for a read already
+        # seen. Caller holds RestartWatch's mutex.
+        def changes(file_key, data)
+          return [] unless seen!(file_key)
+
+          @entries.filter_map do |entry|
+            value = Config.resolve(entry.key, file_data: data, env: {})
+            if @values[entry.key] == value
+              @noticed.delete(entry.key)
+              next
+            end
+            # Already told for this value: a later edit of another key.
+            next if @noticed.key?(entry.key) && @noticed[entry.key] == value
+
+            @noticed[entry.key] = value
+            [@on_change, "#{entry.key} changed — applies after #{restart}"]
+          end
+        end
+
+        # Notes +file_key+ as read; false when it already was. Caller holds
+        # RestartWatch's mutex.
+        def seen!(file_key)
+          return false if @file_key == file_key
+
+          @file_key = file_key
+          true
+        end
+
+        private
+
+        def restart = @process == :worker ? "a worker restart" : "restarting chi web"
+      end
+
+      module_function
+
+      # Adds a Watcher for +process+ (:worker or :web).
+      # @return [Proc] unsubscribes
+      def watch(process:, path:, data:, file_key:, &on_change)
+        watcher = Watcher.new(process: process, path: path, data: data, file_key: file_key, on_change: on_change)
+        @mutex.synchronize { @watchers << watcher }
+        -> { @mutex.synchronize { @watchers.delete(watcher) } }
+      end
+
+      # Tells each watcher of +path+ which of its start-only settings the file
+      # read now (+data+, under +file_key+; nil for a missing file) changes.
+      def notify(path, file_key, data)
+        notices = @mutex.synchronize do
+          @watchers.select { |watcher| watcher.path == path }.flat_map { |watcher| watcher.changes(file_key, data) }
+        end
+        notices.each { |callback, message| callback.call(message) }
+      end
+
+      # The file at +path+ (under +file_key+) doesn't parse as a mapping
+      # (+problem+ says why): no watcher is told anything (its settings stay
+      # compared with the next read that parses), and a process watching it
+      # warns once per problem.
+      def unreadable(path, file_key, problem)
+        watched = @mutex.synchronize do
+          @watchers.select { |watcher| watcher.path == path }.each { |watcher| watcher.seen!(file_key) }.any?
+        end
+        return unless watched
+
+        ConfigFile.warn_once("config: #{path} doesn't parse (#{problem}); " \
+                             "start-only settings are checked again when it does")
+      end
+    end
+  end
+end

data/lib/samagotchi/config.rb

@@ -10,6 +10,7 @@ require_relative "model_ref"
 require_relative "paths"
 require_relative "llm_context_strategy"
 require_relative "host_model"
+require_relative "config/restart_watch"
 
 module Samagotchi
   # Parses the thinking: levels of host and model entries (it needs Config).
@@ -556,10 +557,6 @@ module Samagotchi
         resolve_with_origin(entry.key, file_data: file_data, env: ENV, cli_overrides: cli_overrides)
       end
 
-      def set_cli_overrides(overrides)
-        reload!(cli_overrides: overrides)
-      end
-
       # Problems with the keys of a parsed config.yml, one message per key the
       # code doesn't read (with a "did you mean" when a known key is close).
       # Every config-exposed entry in ENTRIES is known as written; names under
@@ -750,7 +747,7 @@ module Samagotchi
       cache = @yaml_cache ||= {}
       unless File.file?(path)
         cache.delete(path)
-        notify_restart_settings(path, nil, nil)
+        Config::RestartWatch.notify(path, nil, nil)
         return nil
       end
       stat = File.stat(path)
@@ -758,75 +755,37 @@ module Samagotchi
       hit = cache[path]
       return hit[1] if hit && hit[0] == key
 
+      problem = nil
       data = begin
         YAML.safe_load_file(path, permitted_classes: [], aliases: false)
-      rescue StandardError
+      rescue StandardError => e
+        problem = "#{e.class}: #{e.message.lines.first.to_s.strip[0, 200]}"
         nil
       end
+      problem ||= "its top level isn't a mapping" unless data.nil? || data.is_a?(Hash)
       data = nil unless data.is_a?(Hash)
       cache[path] = [key, data]
-      notify_restart_settings(path, key, data)
+      if problem
+        Config::RestartWatch.unreadable(path, key, problem)
+      else
+        Config::RestartWatch.notify(path, key, data)
+      end
       data
     end
 
     # Calls +on_change+ with one line ("server.port changed — applies after a
     # worker restart") when config.yml changes a setting this process only
-    # reads at its start (Config::Entry#lifecycle: worker_start or web_start,
-    # and process_start). Checked when the file is read again (#read_yaml),
-    # once per key per new value: none at start, none for a value back at its
-    # start value.
+    # reads at its start (Config::RestartWatch). Checked when the file is
+    # read again (#read_yaml), once per key per new value: none at start,
+    # none for a value back at its start value, none while the file doesn't
+    # parse (that warns once).
     # @param process [Symbol] :worker or :web
     # @return [Proc] unsubscribes
-    def watch_restart_settings!(process:, env: ENV, &on_change)
-      lifecycles = case process
-                   when :worker then %i[worker_start process_start]
-                   when :web then %i[web_start process_start]
-                   else raise ArgumentError, "unknown config process #{process.inspect}"
-                   end
-      raise ArgumentError, "a config change callback is required" unless on_change
-
+    def watch_restart_settings!(process:, env: ENV, &)
       path = global_path(env: env)
       data = read_yaml(env: env, path: path)
-      entries = Config::ENTRIES.select { |entry| entry.config_exposed? && lifecycles.include?(entry.lifecycle) }
-      watcher = {
-        path: path, process: process, entries: entries,
-        values: entries.to_h { |entry| [entry.key, Config.resolve(entry.key, file_data: data, env: {})] },
-        noticed: {},
-        file_key: File.file?(path) ? [File.stat(path).mtime.to_r, File.size(path)] : nil,
-        on_change: on_change
-      }
-      restart_watchers_mutex.synchronize { (@restart_watchers ||= []) << watcher }
-      -> { restart_watchers_mutex.synchronize { @restart_watchers&.delete(watcher) } }
-    end
-
-    # Tells each watcher of +path+ which of its start-only settings the file
-    # read now (+data+, under +file_key+) changes.
-    def notify_restart_settings(path, file_key, data)
-      notices = restart_watchers_mutex.synchronize do
-        Array(@restart_watchers).flat_map do |watcher|
-          next [] unless watcher[:path] == path && watcher[:file_key] != file_key
-
-          watcher[:file_key] = file_key
-          watcher[:entries].filter_map do |entry|
-            value = Config.resolve(entry.key, file_data: data, env: {})
-            if watcher[:values][entry.key] == value
-              watcher[:noticed].delete(entry.key)
-              next
-            end
-            # Already told for this value: a later edit of another key.
-            next if watcher[:noticed].key?(entry.key) && watcher[:noticed][entry.key] == value
-
-            watcher[:noticed][entry.key] = value
-            restart = watcher[:process] == :worker ? "a worker restart" : "restarting chi web"
-            [watcher[:on_change], "#{entry.key} changed — applies after #{restart}"]
-          end
-        end
-      end
-      notices.each { |callback, message| callback.call(message) }
-    end
-
-    def restart_watchers_mutex
-      @restart_watchers_mutex ||= Mutex.new
+      file_key = File.file?(path) ? [File.stat(path).mtime.to_r, File.size(path)] : nil
+      Config::RestartWatch.watch(process: process, path: path, data: data, file_key: file_key, &)
     end
 
     # Print +message+ to stderr unless this process already did. The config

data/lib/samagotchi/engine.rb

@@ -1402,14 +1402,7 @@ module Samagotchi
     #   answer the continue offer says so (ReplyWait, ParentReport "limit")
     # @param event [Hash] the turn's end event (#stop_facts)
     def record_last_turn(session, outcome, seconds, origin, event, limit: nil)
-      client_id = origin.is_a?(Hash) ? origin[:client_id].to_s : ""
-      source = if client_id.start_with?(ClientId::DELEGATE_PREFIX) then "delegate"
-               elsif client_id.start_with?(ClientId::CHILD_PREFIX) then "delegate_report"
-               elsif client_id.start_with?(ClientId::CONTEXT_PREFIX) then "context"
-               elsif client_id.start_with?(ClientId::TASK_PREFIX) then "task"
-               elsif client_id == ClientId::REMINDER then "reminder"
-               else "client"
-               end
+      source = ClientId.origin(origin.is_a?(Hash) ? origin[:client_id] : nil)
       enqueued_id = origin.is_a?(Hash) ? origin[:enqueued_id] : nil
       session.last_turn = LastTurn.new(outcome: outcome, ended_at: Time.now.iso8601(3), seconds: seconds.round(1),
                                        origin: source, exhausted: limit ? true : nil, limit: limit,
@@ -1523,10 +1516,9 @@ module Samagotchi
     def guardrail_notify(message) = @hook_routes.guardrail_notify(message)
     private :guardrail_notify
 
+    # @param question [HookQuestion]
     # @return [Hash, nil] {selected:, freeform:, selected_indices:}
-    def hook_ask_user(question, options, header, allow_freeform, hook, effects: nil)
-      @hook_routes.ask_user(question, options, header, allow_freeform, hook, effects: effects)
-    end
+    def hook_ask_user(question) = @hook_routes.ask_user(question)
     private :hook_ask_user
 
     # @return [Boolean] true when a running turn was cancelled now
@@ -2569,9 +2561,7 @@ module Samagotchi
         messages: -> { plugin_messages },
         messages_partial: -> { turn_running? && @running_turn_messages.nil? },
         notify: ->(text, level, label, fallback_for: nil) { hook_notify(text, level, label, fallback_for: fallback_for) },
-        ask_user: lambda { |question:, options:, header:, allow_freeform:, hook:, effects: nil|
-          hook_ask_user(question, options, header, allow_freeform, hook, effects: effects)
-        },
+        ask_user: ->(question) { hook_ask_user(question) },
         # An init task's is its own (a Ctrl-C ends a turn, not the task).
         cancelled: lambda {
           (task = current_init_task) ? task.cancelled? : active_cancel_controller&.cancelled?

data/lib/samagotchi/guardrails/data_readers.rb

@@ -32,17 +32,30 @@ module Samagotchi
 
       # Where command_word's word is in +words+ (nil when there is none).
       def command_index(words)
-        i = 0
+        each_argument_index(words).find { |i| !assignment?(words[i]) }
+      end
+
+      # Each index of +words+ from +from+ on that is no redirection and no
+      # spaced redirection's target (the "/tmp/x" of "> /tmp/x"); an
+      # Enumerator without a block.
+      def each_argument_index(words, from = 0)
+        return enum_for(:each_argument_index, words, from) unless block_given?
+
+        i = from
         while i < words.size
           word = words[i]
           if word.match?(REDIRECT)
-            i += 1 if word.match?(/\A\d*[<>]{1,2}\z/)
-          elsif !word.match?(/\A[A-Za-z_]\w*=/)
-            return i
+            i += word.match?(/\A\d*[<>]{1,2}\z/) ? 2 : 1
+            next
           end
+          yield i
           i += 1
         end
-        nil
+      end
+
+      # Whether a word is a NAME=value assignment.
+      def assignment?(word)
+        word.match?(/\A[A-Za-z_]\w*=/)
       end
 
       # Whether a cat or tee command sends its output to a file (a file
@@ -62,8 +75,21 @@ module Samagotchi
       # ">& -". A >& with any other target does write one: bash reads
       # ">& file" and ">&file" as "&>file".
       def stdout_file?(words)
+        redirects_to_file?(words, /\A1?(>>?)(&?)(.*)\z/m)
+      end
+
+      # Whether one of +words+ sends any fd's output to a file (3>run.sh,
+      # 2>>log, {fd}>run.sh, 3<>run.sh as well as stdout_file?'s forms),
+      # /dev/null and fd dups left out as there.
+      def output_file?(words)
+        redirects_to_file?(words, /\A(?:\d*|\{\w+\})(>>?|<>)(&?)(.*)\z/m)
+      end
+
+      # stdout_file? and output_file?: a word matching +pattern+ (its
+      # captures: the operator, an &, the target) that writes a file.
+      def redirects_to_file?(words, pattern)
         words.each_with_index do |word, i|
-          match = word.match(/\A1?(>>?)(&?)(.*)\z/m)
+          match = word.match(pattern)
           next unless match
 
           amp = match[2]
@@ -84,18 +110,7 @@ module Samagotchi
         verb = command_index(words)
         return false unless verb
 
-        i = verb + 1
-        while i < words.size
-          word = words[i]
-          if word.match?(REDIRECT)
-            i += word.match?(/\A\d*[<>]{1,2}\z/) ? 2 : 1
-            next
-          end
-          return true if filename_word?(word)
-
-          i += 1
-        end
-        false
+        each_argument_index(words, verb + 1).any? { |i| filename_word?(words[i]) }
       end
 
       # Whether a tee argument names a file: not an option, a heredoc's tag,
@@ -139,18 +154,7 @@ module Samagotchi
       # their spaced targets), the <<TAG words and the heredoc bodies left
       # out.
       def arguments(words)
-        args = []
-        i = 0
-        while i < words.size
-          word = words[i]
-          if word.match?(REDIRECT)
-            i += word.match?(/\A\d*[<>]{1,2}\z/) ? 2 : 1
-            next
-          end
-          args << word unless word.match?(/\A[A-Za-z_]\w*=/) || heredoc_word?(word)
-          i += 1
-        end
-        args
+        each_argument_index(words).map { |i| words[i] }.reject { |word| assignment?(word) || heredoc_word?(word) }
       end
 
       # Whether a word is a heredoc's <<TAG or one of its bodies.

data/lib/samagotchi/guardrails/parent_levels.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  module Guardrails
+    # The parent-answers level words and their one reading (#parse_level),
+    # apart from the rest of ParentPolicy so Session (its parent_answers
+    # setter) reads them without loading the guardrails.
+    module ParentPolicy
+      HARD = "hard"
+      STANDARD = "standard"
+      SOFT = "soft"
+      # Strictest first: a session's own level may only move left of
+      # config.yml's.
+      ORDER = [HARD, STANDARD, SOFT].freeze
+      # A session value that means "none of its own" (config's).
+      UNSET = "default"
+
+      # A level word as written anywhere (a session file, /parent-answers,
+      # --parent-answers), stripped and case-blind.
+      # @param word [String, Symbol, nil]
+      # @return [String, Symbol] the level, :unset (nil, "" or "default":
+      #   config's) or :invalid
+      def self.parse_level(word)
+        text = word.to_s.strip.downcase
+        return :unset if text.empty? || text == UNSET
+
+        ORDER.include?(text) ? text : :invalid
+      end
+    end
+  end
+end

data/lib/samagotchi/guardrails/parent_policy.rb

@@ -3,6 +3,7 @@
 require_relative "../config"
 require_relative "../pending_question"
 require_relative "approval"
+require_relative "parent_levels"
 require_relative "parent_approvals"
 
 module Samagotchi
@@ -49,9 +50,8 @@ module Samagotchi
       KEY = "guardrails.parent_answers"
       # A session's own value (Session#parent_answers): it may only tighten KEY.
       SESSION_KEY = "parent_answers"
-      HARD = "hard"
-      STANDARD = "standard"
-      SOFT = "soft"
+      # The level words (HARD, STANDARD, SOFT, ORDER, UNSET) and
+      # #parse_level: parent_levels.rb.
 
       # A strategy: its name, the effects a parent may pick under it, and
       # where it comes from: :config (config.yml's) or :session (a
@@ -83,12 +83,6 @@ module Samagotchi
       # @return [Strategy]
       def strategy(name) = STRATEGIES.fetch(name.to_s, STRATEGIES[HARD])
 
-      # Strictest first: a session's own level may only move left of
-      # config.yml's.
-      ORDER = [HARD, STANDARD, SOFT].freeze
-      # A session value that means "none of its own" (config's).
-      UNSET = "default"
-
       # The stricter of two strategies, by name; a tie keeps +a+.
       # @return [Strategy]
       def stricter(a, b) = ORDER.index(b.name) < ORDER.index(a.name) ? b : a
@@ -99,18 +93,16 @@ module Samagotchi
       # is read on every parent answer).
       # @return [String, nil]
       def session_level(value)
-        word = value.to_s.strip.downcase
-        return nil if word.empty? || word == UNSET
-
-        STRATEGIES.key?(word) ? word : HARD
+        case (level = parse_level(value))
+        when :unset then nil
+        when :invalid then HARD
+        else level
+        end
       end
 
       # Whether a session's own value is set but not a level (a hand-edited
       # file: read as hard); the worker says so once when it loads.
-      def unknown_level?(value)
-        word = value.to_s.strip.downcase
-        !word.empty? && word != UNSET && !STRATEGIES.key?(word)
-      end
+      def unknown_level?(value) = parse_level(value) == :invalid
 
       # What a parent may answer on a session whose own value is
       # +session_value+: config.yml's (+config+) unless the session's is
@@ -150,9 +142,6 @@ module Samagotchi
         level.nil? ? ORDER.size : ORDER.index(level)
       end
 
-      # @return [Array<String>] the effects +strategy+ lets a parent pick
-      def allowed_effects(strategy) = strategy.allowed
-
       # Each option's effect, in option order. Tagged questions carry them;
       # an untagged one (asked by an older worker, a relayed card built
       # from an older child's question) gets them derived as before:

data/lib/samagotchi/guardrails/shell_lex.rb

@@ -95,6 +95,7 @@ module Samagotchi
 
         bodies = lexer.heredoc_spans.map { |doc| doc[:span] }
         cuts = []
+        redirected = false
         each_command(tokens) do |indices|
           words = indices.map { |i| tokens[i][1] }
           indices.each_with_index do |i, position|
@@ -103,12 +104,13 @@ module Samagotchi
 
             span = lexer.spans[i]
             cut = if bodies.include?(span)
-                    body_cut(text, span, words) if value == HEREDOC
+                    body_cut(text, span, words, redirected) if value == HEREDOC
                   elsif value == SUBST
                     substitution_cut(text, tokens, i, span, words, position)
                   end
             cuts << cut if cut
           end
+          redirected ||= exec_redirect?(tokens, indices, words)
         end
         cuts.sort_by { |span, _| -span.begin }.each_with_object(+text) do |(span, replacement), out|
           out[span] = replacement
@@ -134,25 +136,44 @@ module Samagotchi
 
       # [span, what it becomes] for a data heredoc's body at +span+ (its
       # command's +words+), or nil when the body stays in the code text: a
-      # cat or tee writing a file may be run later (D1).
-      def self.body_cut(text, span, words)
-        return nil unless cut_body?(words)
+      # cat or tee writing a file may be run later (D1), and so may one
+      # printing after an earlier exec sent the shell's output to a file
+      # (+redirected+).
+      def self.body_cut(text, span, words, redirected)
+        return nil unless cut_body?(words, redirected)
 
         [span, terminator_line(text[span])]
       end
       private_class_method :body_cut
 
       # Whether a body a data reader reads leaves the code text: a cat or tee
-      # sending it to a file keeps it (D1); a body any other command reads as
+      # sending it to a file keeps it (D1), as does any cat or tee once an
+      # exec redirected the shell's output (+redirected+: its stdout, or the
+      # fd a >&3 names, may be a file); a body any other command reads as
       # data is one the lexer's data_sink? approved.
-      def self.cut_body?(words)
+      def self.cut_body?(words, redirected)
         verb = DataReaders.command_word(words)
         return true unless DataReaders::SINKS.include?(File.basename(verb.to_s))
 
-        !DataReaders.writes_file?(words)
+        !redirected && !DataReaders.writes_file?(words)
       end
       private_class_method :cut_body?
 
+      # Whether the simple command at +indices+ may be an exec that redirects
+      # the shell's own output to a file (exec >run.sh, exec 3>run.sh,
+      # exec {fd}>run.sh, exec 3<>run.sh): what a later cat or tee prints may
+      # land there. Any exec word counts, not only the command word ({ exec
+      # …; }, then exec …, command exec …, a function's body), and so does an
+      # exec backgrounded (exec &>run.sh, which the lexer reads as "exec &"
+      # and ">run.sh"): the conservative reading.
+      def self.exec_redirect?(tokens, indices, words)
+        return false unless words.include?("exec")
+
+        following = tokens[indices.last + 1]
+        DataReaders.output_file?(words) || following == [:op, "&"]
+      end
+      private_class_method :exec_redirect?
+
       # [span, what it becomes] for the body of a "$(cat <<'EOF' … EOF)" given
       # as a message (-m, --body, …) of a data reader (D2), or nil: eval,
       # bash -c, a command piped on and a body that runs stay.

data/lib/samagotchi/hook_question.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  # A hook's or a plugin's question (event[:ask_user], ctx.ask_user) as one
+  # value on its way to the question flow: built at the plugin-facing edge
+  # (Hooks::Registry's event helper, Plugin::Context#ask_user), passed
+  # through the hook runtime and the plugin host (Hooks::Runtime#ask_user,
+  # Plugin::Host#ask_user), Engine#hook_ask_user and HookRoutes#ask_user to
+  # QuestionDesk#ask_for_hook. The bundle test kit records it as asked
+  # (Testing::Recorder#questions).
+  #
+  # question, options, header, allow_freeform: as the hook gave them
+  # (QuestionDesk checks the options); hook: the asking hook's or plugin's
+  # label; effects: what an option does for a parent agent's answer, by its
+  # label (label => effect, as the hook gave it; nil for none). QuestionDesk
+  # turns it into the pending question's per-option tags
+  # (Guardrails::ParentPolicy.option_tags, PendingQuestion#effects).
+  HookQuestion = Data.define(:question, :options, :header, :allow_freeform, :hook, :effects) do
+    def initialize(effects: nil, **) = super
+  end
+end