samagotchi 0.102.0 → 0.104.0

data/lib/samagotchi/web/app.rb

@@ -42,11 +42,19 @@ require_relative "../context_note"
 require_relative "../context_sources"
 require_relative "../context_providers"
 require_relative "../recap_store"
+require_relative "../toolkit"
+require_relative "../turn_flow"
+require_relative "../session_chain"
+require_relative "../parent_answers_command"
+require_relative "../guardrails/parent_policy"
 require_relative "markdown_renderer"
 require_relative "capabilities"
 require_relative "editor"
 require_relative "../message_parts"
 require_relative "session_summary"
+require_relative "session_access_routes"
+require_relative "principal"
+require_relative "participant_access"
 require_relative "../log"
 require_relative "../paths"
 require_relative "../redacted_inspect"
@@ -63,6 +71,8 @@ module Samagotchi
     class App
       # @lan holds the LAN access token.
       include RedactedInspect
+      include SessionAccessRoutes
+      include ParticipantAccess
 
       DEFAULT_HOST = BridgeClient::HOST
       BRIDGE_WAIT_TIMEOUT = 10.0
@@ -76,7 +86,11 @@ module Samagotchi
       IMAGE_TYPES = { "png" => "image/png", "jpg" => "image/jpeg", "jpeg" => "image/jpeg", "gif" => "image/gif",
                       "webp" => "image/webp" }.freeze
 
-      # POST /stop waits this long for the worker to let go of the session.
+      # POST /stop waits this long for the worker to let go of the session
+      # when the body names no wait (the page's Stop: it shows the stop at
+      # once, and a Rack thread isn't held for it). A CLI through --remote
+      # sends its own, SessionManager::STOP_WAIT at most, so chi sessions
+      # stop waits as long as here.
       STOP_WAIT_SECONDS = 2.0
 
       # GET /api/events: a `: ping` this often while idle, a queue this deep
@@ -113,17 +127,22 @@ module Samagotchi
       #   (nil: built from config.yml's hosts:, again when they change)
       # @param models_wait_timeout [Float] bounded seconds GET /api/models
       #   waits for the hosts' lists
+      # @param wait_poll_interval [Float] how often POST
+      #   /api/sessions/:id/wait looks at the session (ReplyWait's poll)
       # @param lan [Hash, nil] LAN mode (web.host: lan): { ip:, token: },
       #   the address the server also listens on and its access token (a
       #   String, or a Web::Token::Source that follows the file); nil:
       #   loopback only, no token
+      # @param grants [Grants, nil] the participants' grants (default: the
+      #   store next to +state_dir+, Grants.path)
       def initialize(manager: nil, session_class: nil, state_dir: nil, public_dir: nil,
                      bridge_wait_timeout: BRIDGE_WAIT_TIMEOUT, markdown: false, view: Config::BY_KEY["web.view"].default, hub: nil,
                      annotate_presets: Config::BY_KEY["web.annotate_presets"].default,
                      editor: Config::BY_KEY["web.editor"].default,
                      events_heartbeat: EVENTS_HEARTBEAT, events_queue: EVENTS_QUEUE,
                      registry: nil, models_wait_timeout: MODELS_WAIT_TIMEOUT, lan: nil,
-                     working_set: Config::BY_KEY["web.working_set"].default)
+                     working_set: Config::BY_KEY["web.working_set"].default, wait_poll_interval: ReplyWait::POLL_INTERVAL,
+                     grants: nil)
         @manager = manager || SessionManager
         @registry = registry
         @registry_given = !registry.nil?
@@ -146,6 +165,8 @@ module Samagotchi
         @lan = lan
         @refused_mutex = Mutex.new
         @refused_logged = {}
+        @wait_poll_interval = wait_poll_interval
+        init_participant_access(grants, state_dir)
       end
 
       def call(env)
@@ -158,39 +179,63 @@ module Samagotchi
       private
 
       # The routes, first match wins: a handler takes the request and the
-      # path's captures (the session id, an image's name). A :session route
-      # runs in #session_route: an ArgumentError is its unknown session.
+      # path's captures (the session id, an image's name). The fourth column
+      # is who may use the route (ROUTE_PERMISSIONS, checked against the
+      # request's Principal): :owner, or :participant for one a participant
+      # may use too, its handler answering them as theirs (the participant
+      # page, the trimmed info, the filtered show; docs/internals/
+      # participants.md). A :session route runs in #session_route: an
+      # ArgumentError is its unknown session.
+      ROUTE_PERMISSIONS = %i[owner participant].freeze
       ROUTES = [
-        ["GET", %r{\A/(?:index\.html)?\z}, :serve_index],
-        ["GET", %r{\A/api/sessions\z}, :handle_list],
-        ["POST", %r{\A/api/sessions\z}, :handle_create],
-        ["GET", %r{\A/api/info\z}, :handle_info],
-        ["GET", %r{\A/api/models\z}, :handle_models],
-        ["GET", %r{\A/api/history\z}, :handle_history],
-        ["GET", %r{\A/api/events\z}, :handle_events],
-        ["POST", %r{\A/api/render\z}, :handle_render],
-        ["GET", %r{\A/api/sessions/([^/]+)/stream\z}, :handle_stream],
-        ["GET", %r{\A/api/sessions/([^/]+)/output\z}, :handle_output, :session],
-        ["POST", %r{\A/api/sessions/([^/]+)/cancel\z}, :handle_cancel, :session],
-        ["POST", %r{\A/api/sessions/([^/]+)/tasks/([^/]+)/stop\z}, :handle_task_stop, :session],
-        ["POST", %r{\A/api/sessions/([^/]+)/turn/([^/]+)/dequeue\z}, :handle_dequeue_turn, :session],
-        ["POST", %r{\A/api/sessions/([^/]+)/stop\z}, :handle_stop, :session],
-        ["POST", %r{\A/api/sessions/([^/]+)/restart\z}, :handle_restart, :session],
-        ["POST", %r{\A/api/sessions/([^/]+)/archive\z}, :handle_archive, :session],
-        ["POST", %r{\A/api/sessions/([^/]+)/unarchive\z}, :handle_unarchive, :session],
-        ["POST", %r{\A/api/sessions/([^/]+)/turn\z}, :handle_turn, :session],
-        ["POST", %r{\A/api/sessions/([^/]+)/answer\z}, :handle_question_answer],
-        ["POST", %r{\A/api/sessions/([^/]+)/question/dismiss\z}, :handle_question_dismiss],
-        ["POST", %r{\A/api/sessions/([^/]+)/command\z}, :handle_command, :session],
-        ["POST", %r{\A/api/sessions/([^/]+)/images\z}, :handle_image_upload],
-        ["GET", %r{\A/api/sessions/([^/]+)/images/([^/]+)\z}, :handle_image],
-        ["GET", %r{\A/api/sessions/([^/]+)/context\z}, :handle_context_list, :session],
-        ["GET", %r{\A/api/sessions/([^/]+)/context/([^/]+)\z}, :handle_context_show, :session],
-        ["POST", %r{\A/api/sessions/([^/]+)/context\z}, :handle_context_add, :session],
-        ["DELETE", %r{\A/api/sessions/([^/]+)/context/([^/]+)\z}, :handle_context_delete, :session],
-        ["GET", %r{\A/api/sessions/([^/]+)/working_set\z}, :handle_working_set, :session],
-        ["GET", %r{\A/api/sessions/([^/]+)\z}, :handle_show, :session],
-        ["DELETE", %r{\A/api/sessions/([^/]+)\z}, :handle_delete, :session]
+        ["GET", %r{\A/(?:index\.html)?\z}, :serve_index, :participant],
+        ["GET", %r{\A/api/sessions\z}, :handle_list, :owner],
+        ["POST", %r{\A/api/sessions\z}, :handle_create, :owner],
+        ["GET", %r{\A/api/sessions/resolve\z}, :handle_resolve, :owner],
+        ["GET", %r{\A/api/sessions/summaries\z}, :handle_summaries, :owner],
+        ["GET", %r{\A/api/info\z}, :handle_info, :participant],
+        ["GET", %r{\A/api/models\z}, :handle_models, :owner],
+        ["GET", %r{\A/api/history\z}, :handle_history, :owner],
+        ["GET", %r{\A/api/events\z}, :handle_events, :owner],
+        ["POST", %r{\A/api/render\z}, :handle_render, :owner],
+        ["GET", %r{\A/api/sessions/([^/]+)/stream\z}, :handle_stream, :owner],
+        ["GET", %r{\A/api/sessions/([^/]+)/output\z}, :handle_output, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/cancel\z}, :handle_cancel, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/tasks/([^/]+)/stop\z}, :handle_task_stop, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/turn/([^/]+)/dequeue\z}, :handle_dequeue_turn, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/stop\z}, :handle_stop, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/restart\z}, :handle_restart, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/archive\z}, :handle_archive, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/unarchive\z}, :handle_unarchive, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/turn\z}, :handle_turn, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/wait/prepare\z}, :handle_wait_prepare, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/wait\z}, :handle_wait, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/notes\z}, :handle_notes, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/wake\z}, :handle_wake, :owner, :session],
+        ["GET", %r{\A/api/sessions/([^/]+)/worker\z}, :handle_worker, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/exit\z}, :handle_exit, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/recap\z}, :handle_recap, :owner, :session],
+        ["GET", %r{\A/api/sessions/([^/]+)/stats\z}, :handle_stats, :owner, :session],
+        ["GET", %r{\A/api/sessions/([^/]+)/children/counts\z}, :handle_children_counts, :owner, :session],
+        ["GET", %r{\A/api/sessions/([^/]+)/turns/([^/]+)/records\z}, :handle_turn_records, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/answer\z}, :handle_question_answer, :owner],
+        ["POST", %r{\A/api/sessions/([^/]+)/question/dismiss\z}, :handle_question_dismiss, :owner],
+        ["POST", %r{\A/api/sessions/([^/]+)/command\z}, :handle_command, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/images\z}, :handle_image_upload, :owner],
+        ["GET", %r{\A/api/sessions/([^/]+)/images/([^/]+)\z}, :handle_image, :owner],
+        ["GET", %r{\A/api/sessions/([^/]+)/context\z}, :handle_context_list, :owner, :session],
+        ["GET", %r{\A/api/sessions/([^/]+)/context/([^/]+)\z}, :handle_context_show, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/context\z}, :handle_context_add, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/context/([^/]+)/push\z}, :handle_context_push, :owner, :session],
+        ["DELETE", %r{\A/api/sessions/([^/]+)/context/([^/]+)\z}, :handle_context_delete, :owner, :session],
+        ["GET", %r{\A/api/sessions/([^/]+)/working_set\z}, :handle_working_set, :owner, :session],
+        ["GET", %r{\A/api/sessions/([^/]+)/participants\z}, :handle_participants_list, :owner, :session],
+        ["POST", %r{\A/api/sessions/([^/]+)/participants\z}, :handle_participants_invite, :owner, :session],
+        ["DELETE", %r{\A/api/sessions/([^/]+)/participants\z}, :handle_participants_revoke, :owner, :session],
+        ["GET", %r{\A/api/participants\z}, :handle_participants_list, :owner],
+        ["DELETE", %r{\A/api/participants\z}, :handle_participants_revoke, :owner],
+        ["GET", %r{\A/api/sessions/([^/]+)\z}, :handle_show, :participant, :session],
+        ["DELETE", %r{\A/api/sessions/([^/]+)\z}, :handle_delete, :owner, :session]
       ].freeze
 
       def route(env)
@@ -198,16 +243,22 @@ module Samagotchi
         return forbidden unless local_host_header?(env)
         return cross_origin if cross_site?(env)
 
-        if @lan && !LOOPBACK_PEERS.include?(env["REMOTE_ADDR"].to_s)
-          denied = token_gate(req)
-          return denied if denied
-        end
+        principal, denied = token_gate(req)
+        return denied if denied
 
-        ROUTES.each do |verb, pattern, handler, kind|
+        # The principal the handlers read (#principal): never the body's.
+        env[PRINCIPAL_ENV] = principal
+        participant_seen(req, principal) unless principal.owner?
+        ROUTES.each do |verb, pattern, handler, permission, kind|
           next unless req.request_method == verb && (m = pattern.match(req.path_info))
+          # Before the permission: a participant learns nothing of another session.
+          return unknown_session(m.captures.first) if other_session?(principal, req.path_info, m.captures)
+          return not_permitted_for(req, principal) unless principal.permits?(permission)
+
           # Every /api/sessions/:id route: an id that isn't one (Session.valid_id?,
           # "..", a %2F) is an unknown session before any handler makes a path.
-          if req.path_info.start_with?("/api/sessions/") && !Session.valid_id?(m.captures.first)
+          # (/api/sessions/resolve and /summaries take no id.)
+          if req.path_info.start_with?("/api/sessions/") && !m.captures.empty? && !Session.valid_id?(m.captures.first)
             return error_response(404, "not_found", "Session not found: #{m.captures.first.to_s[0, 80]}")
           end
 
@@ -293,25 +344,57 @@ module Samagotchi
       TOKEN_COOKIE_ATTRIBUTES = "HttpOnly; SameSite=Lax; Path=/; Max-Age=34560000"
       REFUSED_LOG_INTERVAL = 60.0
 
+      # Where #route keeps the request's Principal for its handlers.
+      PRINCIPAL_ENV = "samagotchi.principal"
+      PAGE_PATHS = ["/", "/index.html"].freeze
+
+      # The request's Principal, as #route resolved it.
+      def principal(req) = req.env.fetch(PRINCIPAL_ENV)
+
       # LAN mode, a peer that isn't this machine (the peer is the socket's
       # address, REMOTE_ADDR: never X-Forwarded-For or req.ip, which trust
       # headers a phone could send): every route needs the access token, as
       # the chi_token cookie or an Authorization: Bearer header. The page
       # with ?token= trades it for the cookie and a 303 to itself without
       # it, so the token doesn't stay in the phone's history.
-      # @return [Array, nil] the response that refuses it, or nil to go on
+      # @return [Array(Principal, nil), Array(nil, Array)] the request's
+      #   principal (#principal_for), or the response that refuses it
       def token_gate(req)
+        principal = principal_for(req)
+        return [nil, grant_ended_response(req) || unauthorized(req)] if principal.nil?
+        # The cookie gets the token that was presented: the owner's, or the
+        # participant's grant's.
+        return [nil, token_redirect(req, req.env[GRANT_TOKEN_ENV] || current_token)] if token_trade?(req)
+
+        [principal, nil]
+      end
+
+      # Who the request is: the owner for a peer the gate doesn't ask (no
+      # LAN mode, or this machine's loopback) and for the access token (the
+      # page's ?token= on a trade, else the Bearer header or the cookie);
+      # a participant for a live grant's token (Grants, looked up only when
+      # no owner token was given); nil for anyone else.
+      # @return [Principal, nil]
+      def principal_for(req)
+        return Principal::OWNER unless token_required?(req)
+
         token = current_token
-        if req.get? && ["/", "/index.html"].include?(req.path_info) && req.params.key?("token")
-          return token_redirect(req, token) if token_match?(req.params["token"], token)
-        else
-          auth = req.get_header("HTTP_AUTHORIZATION").to_s[/\ABearer +(\S+)\z/, 1]
-          return nil if token_match?(auth, token) || token_match?(req.cookies[TOKEN_COOKIE], token)
-        end
+        given = token_trade?(req) ? [req.params["token"]] : [bearer_token(req), req.cookies[TOKEN_COOKIE]]
+        return Principal::OWNER if given.any? { |value| token_match?(value, token) }
 
-        unauthorized(req)
+        participant_principal(req, given.select { |value| Grants.token?(value) })
       end
 
+      def token_required?(req) = @lan && !LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s)
+
+      # The page opened with ?token= (a gated request): its token is traded
+      # for the cookie, whatever else the request carries.
+      def token_trade?(req)
+        token_required?(req) && req.get? && PAGE_PATHS.include?(req.path_info) && req.params.key?("token")
+      end
+
+      def bearer_token(req) = req.get_header("HTTP_AUTHORIZATION").to_s[/\ABearer +(\S+)\z/, 1]
+
       def current_token
         token = @lan[:token]
         token.respond_to?(:current) ? token.current : token
@@ -398,6 +481,11 @@ module Samagotchi
         error_response(403, "cross_origin", "requests from other websites are refused")
       end
 
+      # A route the request's principal may not use (Principal#permits?).
+      def not_permitted
+        error_response(403, "not_permitted", "only the session's owner can do that")
+      end
+
       def forbidden
         names = @lan ? "127.0.0.1, [::1], localhost and #{@lan[:ip]}" : "127.0.0.1, [::1] and localhost"
         error_response(403, "forbidden", "only the host names #{names} are answered")
@@ -450,12 +538,21 @@ module Samagotchi
       # What a second `chi web` probes before starting its own server: this
       # is chi web, and it knows ?dir (features). installed: the newest chi
       # on this machine (nil until the hub has looked); newest_workers: the
-      # workers it starts run that one, not this chi web's version.
-      def handle_info(_req)
+      # workers it starts run that one, not this chi web's version;
+      # session_commands: the routes chi --remote needs
+      # (SessionAccessRoutes::FEATURE); remote_attach: the ones a remote
+      # attached TUI needs (ATTACH_FEATURE). lan: its LAN address, nil when it
+      # listens on loopback only. A participant gets app, version and
+      # features only (#participant_info).
+      def handle_info(req)
+        return participant_info unless principal(req).owner?
+
         json_response(200, { app: "chi-web", version: Samagotchi::VERSION, installed: @hub&.installed, pid: Process.pid,
-                             cwd: Dir.pwd, features: %w[dir newest_workers], lan: @lan && @lan[:ip] })
+                             cwd: Dir.pwd, features: INFO_FEATURES, lan: @lan && @lan[:ip] })
       end
 
+      INFO_FEATURES = ["dir", "newest_workers", SessionAccessRoutes::FEATURE, SessionAccessRoutes::ATTACH_FEATURE].freeze
+
       # The models a new session can start on, spelled as chi spells them
       # elsewhere: bare for the default host (what default.model holds), and
       # host:model for another host. The default is the configured model, or
@@ -679,17 +776,32 @@ module Samagotchi
           return error_response(400, "invalid_settings", e.message)
         end
 
+        # toolkit, tools, no_tools: its toolkit (chi send --new --toolkit,
+        # --tool, --no-tool: a name, tool names added and left out);
+        # parent_answers: what a parent agent may answer on its questions
+        # (hard, standard or soft; a looser one than config.yml's is capped,
+        # and the 201's parent_answers_warning says so).
+        toolkit, error = request_toolkit(body)
+        return error if error
+
+        parent_answers, error = request_parent_answers(body["parent_answers"])
+        return error if error
+
+        model = (body["model"] || body["model_name"]).to_s.strip
+        refused = create_refusal(body, idle ? body["preview"] : prompt, values: [parent_answers], model: model)
+        return refused if refused
+
         folder = dir ? { working_directory: dir } : {}
         # model: the model the session starts on (the start page's picker,
         # spelled as GET /api/models lists it); blank means the default.
-        model = (body["model"] || body["model_name"]).to_s.strip
         folder[:model_name] = model unless model.empty?
         # preview: an idle session's first message, sent as its first turn
         # next; the list and the notifications name the session by it
         # until that turn is saved.
         preview = idle ? body["preview"].to_s.strip : ""
         folder[:preview] = preview unless preview.empty?
-        setup = SessionSetup.new(llm_context: llm_context, thinking: thinking, settings: settings)
+        setup = SessionSetup.new(llm_context: llm_context, thinking: thinking, settings: settings, toolkit: toolkit,
+                                 parent_answers: parent_answers)
         folder[:setup] = setup unless setup.empty?
         begin
           session = @manager.spawn_session(prompt: idle ? nil : prompt.to_s, state_dir: @state_dir, **folder)
@@ -703,7 +815,8 @@ module Samagotchi
         # The projection holds it before the page hears back (no tick wait).
         @hub&.touch(session.id)
         record_history(body, prompt) if !idle && PromptHistory.shell_line?(prompt.to_s.strip)
-        json_response(201, session_to_json(session).merge(bridge_port: port))
+        json_response(201, session_to_json(session).merge(bridge_port: port, model_warning: session.model_warning,
+                                                          parent_answers_warning: Guardrails::ParentPolicy.capped_note(parent_answers)))
       end
 
       # POST /api/sessions with continues: <id, prefix or last:id>: the next
@@ -724,14 +837,17 @@ module Samagotchi
         unless given.is_a?(String) && !given.strip.empty?
           return error_response(400, "invalid_continues", "continues is a session id")
         end
-        if (fields = %w[dir llm_context thinking settings].select { |key| body.key?(key) }).any?
+        if (fields = CONTINUE_TAKES.select { |key| body.key?(key) }).any?
           return error_response(400, "invalid_continues",
-                                "continues takes the previous session's folder, llm_context, thinking and settings; " \
-                                "leave out #{fields.join(", ")}")
+                                "continues takes the previous session's folder, llm_context, thinking, toolkit, " \
+                                "settings and parent_answers; leave out #{fields.join(", ")}")
         end
 
         preview = idle ? body["preview"].to_s.strip : ""
         model = (body["model"] || body["model_name"]).to_s.strip
+        refused = continue_refusal(given, body, idle ? body["preview"] : prompt, model: model)
+        return refused if refused
+
         session, error = continue_from(given, prompt: idle ? nil : prompt.to_s, preview: preview.empty? ? nil : preview,
                                               model: model.empty? ? nil : model)
         return error if error
@@ -746,22 +862,123 @@ module Samagotchi
                                                           opener: session.opener))
       end
 
+      # chi send's client ids: its lines are checked as chi send checks them
+      # (#parent_gate).
+      CLI_SEND_IDS = [ClientId::CLI_SEND, ClientId::CLI_ANSWER].freeze
+
+      # What a continue takes from the previous link: refused beside it.
+      CONTINUE_TAKES = %w[dir llm_context thinking settings toolkit tools no_tools parent_answers].freeze
+
+      # The previous link's parent_answers and the model the new one runs,
+      # for #create_refusal; nil when the previous link isn't there
+      # (continue_from says so).
+      def continue_refusal(given, body, line, model:)
+        return nil unless body["check_vision"] == true || CLI_SEND_IDS.include?(body["client_id"])
+
+        previous = Session.load(SessionChain.resolve(given, state_dir: default_state_dir), state_dir: default_state_dir)
+        create_refusal(body, line, values: [previous.parent_answers], model: model, previous: previous)
+      rescue ArgumentError, ModelProfile::MissingModel
+        nil
+      end
+
+      # A create refused before anything spawns, as chi send --new refuses
+      # it (SendCommand::ParentGate, the vision check): its first line
+      # (+line+, the prompt or an idle one's preview) when it is a parent
+      # agent's /continue yes or a /parent-answers that loosens +values+
+      # (#parent_gate), and with check_vision: true (its first message
+      # brings images) a model known not to take them (422 no_vision).
+      # @param previous [Session, nil] a continue's previous link: its model
+      #   decides when +model+ is blank
+      # @return [Array, nil] the response, or nil to go on
+      def create_refusal(body, line, values:, model:, previous: nil)
+        refused = parent_gate(line, client_id: body["client_id"], values: values)
+        return refused if refused
+        return nil unless body["check_vision"] == true
+
+        name, typed = if previous
+                        SendCommand.continued_model(previous, model)
+                      else
+                        [model.empty? ? nil : model, nil]
+                      end
+        vision_refused(name, typed)
+      end
+
+      # A line from chi send (client_id cli:send, or cli:answer for a parent
+      # agent's /continue yes) refused here as chi send refuses it on its own
+      # machine (SendCommand::ParentGate), held to this server's config.yml:
+      # a parent's /continue yes that guardrails.parent_answers (tightened by
+      # +values+, the targets' own parent_answers) refuses, 403
+      # parent_continue_refused; a /parent-answers line that loosens one of
+      # +values+, 403 parent_answers_refused (loosening is the user's at a
+      # UI). The page's lines (web:…) and others aren't checked here; the
+      # worker checks every line again.
+      # @return [Array, nil] the response, or nil to go on
+      def parent_gate(line, client_id:, values:)
+        line = line.to_s
+        return nil unless CLI_SEND_IDS.include?(client_id)
+
+        if client_id == ClientId::CLI_ANSWER && TurnFlow.continue_yes?(line) &&
+           (refusal = SendCommand::ParentGate.continue_refusal_for(values))
+          return error_response(403, "parent_continue_refused", refusal)
+        end
+        return nil unless SendCommand::ParentGate.loosens_any?(line, values)
+
+        error_response(403, "parent_answers_refused", ParentAnswersCommand::REFUSED)
+      end
+
+      # 422 no_vision in chi send's words when the model (+name+, nil: the
+      # default) is known not to take images; nil when it does or is
+      # unknown (the worker decides when the turn runs).
+      def vision_refused(name, typed)
+        refusal = SendCommand.vision_refusal(name, SendCommand.vision_answer(name, typed: typed))
+        refusal && error_response(422, "no_vision", refusal)
+      end
+
+      # The create request's toolkit (a name), tools and no_tools (names, a
+      # comma list each too), as chi send --new's --toolkit, --tool and
+      # --no-tool: [toolkit, nil] (nil for none), or [nil, a 400 response].
+      def request_toolkit(body)
+        name = body["toolkit"]
+        lists = %w[tools no_tools].to_h { |key| [key, body[key]] }
+        unless (name.nil? || name.is_a?(String)) &&
+               lists.values.all? { |list| list.nil? || (list.is_a?(Array) && list.all?(String)) }
+          return [nil, error_response(400, "invalid_toolkit", "toolkit is a name; tools and no_tools are lists of names")]
+        end
+
+        [Toolkit.from_flags(name: name, add: lists["tools"] || [], remove: lists["no_tools"] || []), nil]
+      end
+
+      # The create request's parent_answers (hard, standard or soft;
+      # "default" or none: config.yml's): [level, nil] or [nil, a 400].
+      def request_parent_answers(raw)
+        return [nil, nil] if raw.nil?
+
+        level = raw.is_a?(String) ? Guardrails::ParentPolicy.parse_level(raw) : :invalid
+        return [nil, nil] if level == :unset
+        unless Guardrails::ParentPolicy::ORDER.include?(level)
+          return [nil, error_response(400, "invalid_parent_answers",
+                                      "parent_answers takes #{Guardrails::ParentPolicy::ORDER.join(", ")}")]
+        end
+
+        [level, nil]
+      end
+
       # SessionManager.continue_session, its refusals as responses: [session,
       # nil] or [nil, the response]. Only its own errors: what fails after
       # the new link started is not a refusal of it.
       def continue_from(given, prompt:, preview:, model:)
         [@manager.continue_session(given, prompt: prompt, preview: preview, model: model, state_dir: @state_dir), nil]
       rescue SessionContinue::Refused => e
-        extra = e.reason == :continued ? { next_id: e.ids.first } : { ids: e.ids }
-        [nil, json_response(409, { error: e.reason.to_s, detail: e.message, **extra })]
+        extra = e.reason == :continued ? { next_id: e.ids.first } : {}
+        [nil, refusal_response(409, e.reason.to_s, e, session_id: e.session_id, reason: e.reason.to_s, ids: e.ids, **extra)]
       rescue SessionManager::ArchiveRefused => e
-        [nil, error_response(409, e.reason == :scratch ? "scratch" : "busy", e.message)]
-      rescue SessionManager::OwnedByTUI
-        [nil, owned_by_repl(given)]
+        [nil, archive_refused(e)]
+      rescue SessionManager::OwnedByTUI => e
+        [nil, owned_by_repl(given, e)]
       rescue ModelProfile::MissingModel => e
         [nil, error_response(400, "invalid_model", e.message)]
       rescue Session::AmbiguousId => e
-        [nil, error_response(400, "ambiguous_id", e.message)]
+        [nil, refusal_response(400, "ambiguous_id", e, ids: e.ids)]
       rescue ArgumentError => e
         [nil, error_response(404, "not_found", e.message)]
       end
@@ -800,10 +1017,13 @@ module Samagotchi
       end
 
       def handle_show(req, id)
+        return participant_show(id) unless principal(req).owner?
+
         # The page's light re-reads: never the whole conversation.
         return handle_cards_read(id) if req.params["cards"] == "1"
         return handle_tail_read(req, id) if req.params["tail"] == "1"
         return handle_timing_read(id) if req.params["timing"] == "1"
+        return handle_brief_read(id) if req.params["brief"] == "1"
 
         session = @session_class.load(id, state_dir: default_state_dir)
         # Read-only preview: selecting a session never spawns a worker.
@@ -1111,17 +1331,38 @@ module Samagotchi
         qid = body["id"]
         return error_response(400, "missing_fields", "id is required") if qid.to_s.strip.empty?
 
-        request = ->(client) { client.answer(id: qid, selected: body["selected"], freeform: body["freeform"]) }
+        # client_id: only chi answer's (a parent agent's answer, which the
+        # worker holds to its guardrails.parent_answers) is passed on; any
+        # other is dropped, so a forward can only tighten (an answer never
+        # passes for the user's own by it).
+        client_id = body["client_id"] == ClientId::CLI_ANSWER ? ClientId::CLI_ANSWER : nil
+        request = once_more_on_late do |client|
+          client.answer(id: qid, selected: body["selected"], freeform: body["freeform"], client_id: client_id)
+        end
         relay(id, bridge_client(id), request, what: "the answer was not sent", cant: "answer questions") do |reply|
           case reply.status
           when 200 then json_response(200, { status: "answered", session_id: id, id: qid })
           # Another client answered first (or the question was cancelled).
           when 409 then error_response(409, "question_not_pending", reply_detail(reply, "question not pending"))
           when 400 then error_response(400, "invalid_answer", reply_detail(reply, "answer rejected"))
+          # The worker's guardrails.parent_answers refused a parent's option.
+          when 403 then json_response(403, { error: "parent_answer_refused", reason: reply.json&.dig("reason"),
+                                             detail: reply_detail(reply, "the worker refused that option") })
           end
         end
       end
 
+      # A request to the worker sent once more when the worker dropped it as
+      # past its deadline (408), as chi answer does on this machine
+      # (SessionAccess::Local#answer); a second 408 is #relay's 504
+      # worker_timeout. The question stays open either way.
+      def once_more_on_late
+        lambda do |client|
+          reply = yield client
+          reply.status == 408 ? yield(client) : reply
+        end
+      end
+
       # Leave the pending question unanswered (the card's Dismiss). A question
       # only exists while its worker waits on it, so this needs a live bridge.
       def handle_question_dismiss(req, id)
@@ -1131,11 +1372,14 @@ module Samagotchi
         qid = body["id"].to_s
         return error_response(400, "missing_fields", "id is required") if qid.strip.empty?
 
-        request = ->(client) { client.dismiss_question(id: qid) }
+        request = once_more_on_late { |client| client.dismiss_question(id: qid) }
         relay(id, bridge_client(id), request, what: "the question was not dismissed", cant: "dismiss questions") do |reply|
           case reply.status
           when 200 then json_response(200, { status: "dismissed", session_id: id, id: qid })
-          when 409 then error_response(409, "question_not_pending", reply_detail(reply, "question not pending"))
+          when 409
+            # The step-limit question can't be left unanswered.
+            code = reply.json&.dig("error") == "not_dismissable" ? "not_dismissable" : "question_not_pending"
+            error_response(409, code, reply_detail(reply, "question not pending"))
           end
         end
       end
@@ -1159,15 +1403,23 @@ module Samagotchi
             record_history(body, line) if PromptHistory.shell_line?(line)
             json_response(202, reply.json || { status: "accepted" })
           when 400
-            # One of this chi's own commands the worker doesn't know: it runs an older chi.
+            # One of this chi's own commands the worker doesn't know: it runs an
+            # older chi. command: which one, so a remote TUI names it as its
+            # Bridge's own 400 unknown_command would (WebBridgeClient).
             name = reply.json&.dig("error") == "unknown_command" && SessionCommands.builtin_name(line)
-            next error_response(501, "not_supported", BridgeClient.stale_worker_message(id, cant: "run #{name}")) if name
+            next older_worker_command(id, name) if name
 
             error_response(400, reply.json&.dig("error") || "unknown_command", reply_detail(reply, "not a session command"))
           end
         end
       rescue SessionManager::OwnedByTUI => e
-        error_response(409, "owned_by_tui", e.message)
+        owned_by_tui(e)
+      end
+
+      # 501 not_supported for a builtin +name+ ("/title") the worker lacks.
+      def older_worker_command(id, name)
+        words = BridgeClient.stale_worker_message(id, cant: "run #{name}")
+        json_response(501, { error: "not_supported", detail: words, message: words, command: name })
       end
 
       # Hand a request to the session's live Bridge (+client+, nil without
@@ -1205,8 +1457,22 @@ module Samagotchi
 
       # 409 owned_by_tui in the words a refused archive, delete or continue
       # shows (stop, restart, a turn and a command show OwnedByTUI's own).
-      def owned_by_repl(id)
-        error_response(409, "owned_by_tui", SessionManager::OwnedByTUI.new(id).message)
+      def owned_by_repl(id, error = nil)
+        named = SessionManager::OwnedByTUI.new(id)
+        error ||= named
+        refusal_response(409, "owned_by_tui", error, detail: named.message, session_id: error.session_id)
+      end
+
+      # 409 owned_by_tui in OwnedByTUI's own words (stop, restart, a turn, a
+      # command).
+      def owned_by_tui(error) = refusal_response(409, "owned_by_tui", error, session_id: error.session_id)
+
+      # 409 scratch or busy (every other reason: a turn, a queued prompt, an
+      # open step-limit question, in it or a delegate, +busy_id+), with the
+      # reason for a remote client.
+      def archive_refused(error)
+        refusal_response(409, error.reason == :scratch ? "scratch" : "busy", error, session_id: error.session_id,
+                                                                                  reason: error.reason.to_s, busy_id: error.busy_id)
       end
 
       def not_live(id)
@@ -1266,19 +1532,44 @@ module Samagotchi
           return error_response(400, refused[:error], refused[:detail])
         end
 
+        refused = turn_refusal(id, body, prompt.to_s, images)
+        return refused if refused
+
+        # no_interrupt: an attached TUI's --no-interrupt (chi --remote --attach).
+        # author: the principal's (nil for the owner), never the body's.
         result = SessionManager.deliver_turn(id, prompt: prompt.to_s, client_id: client_id, images: images,
-                                                 delivery: delivery, state_dir: @state_dir, manager: @manager,
+                                                 delivery: delivery, no_interrupt: body["no_interrupt"] == true,
+                                                 author: principal(req).author,
+                                                 state_dir: @state_dir, manager: @manager,
                                                  bridge: -> { live_bridge_client(id) })
         case result.status
         when :accepted
           record_history(body, prompt)
-          json_response(202, result.ack)
+          # via: bridge or file (the worker was gone: its input file), which
+          # names the turn a remote chi send --wait follows (WaitTarget).
+          json_response(202, result.ack.merge("via" => result.via.to_s))
         when :refused then json_response(result.code, result.ack)
         when :timeout then error_response(504, "worker_timeout", result.detail)
         else error_response(500, "enqueue_failed", "could not write turn input")
         end
       rescue SessionManager::OwnedByTUI => e
-        error_response(409, "owned_by_tui", e.message)
+        owned_by_tui(e)
+      end
+
+      # A turn refused before it goes in, as chi send refuses it on its own
+      # machine: a chi send line #parent_gate refuses (the session's own
+      # parent_answers), and with check_vision: true images to a model known
+      # not to take them (422 no_vision). The page sends neither.
+      # @return [Array, nil] the response, or nil to go on
+      def turn_refusal(id, body, prompt, images)
+        vision = body["check_vision"] == true && !images.empty?
+        return nil unless vision || CLI_SEND_IDS.include?(body["client_id"])
+
+        session = @session_class.load(id, state_dir: default_state_dir)
+        refused = parent_gate(prompt, client_id: body["client_id"], values: [session.parent_answers])
+        return refused if refused
+
+        vision ? vision_refused(session.model_name, session.model_typed) : nil
       end
 
       # A turn's images as [{file:, name:}] (refs to uploads already in the
@@ -1420,14 +1711,27 @@ module Samagotchi
         end
       end
 
-      def handle_stop(_req, id)
+      # POST /api/sessions/:id/stop {wait?}: 200 {status: "stopped",
+      # session_id, released}: released, whether the worker let go of the
+      # session within the wait (STOP_WAIT_SECONDS, or the body's seconds up
+      # to SessionManager::STOP_WAIT: chi sessions stop's two wordings); 409
+      # owned_by_tui.
+      def handle_stop(req, id)
         # Bounded, so a Rack thread isn't held long; a worker still exiting
         # after it just means an immediate resume finds it (rare).
-        @manager.stop_session(id, state_dir: @state_dir, wait: STOP_WAIT_SECONDS)
+        released = @manager.stop_session(id, state_dir: @state_dir, wait: stop_wait(req))
         @hub&.touch(id)
-        json_response(200, { status: "stopped", session_id: id })
+        json_response(200, { status: "stopped", session_id: id, released: released == true })
       rescue SessionManager::OwnedByTUI => e
-        error_response(409, "owned_by_tui", e.message)
+        owned_by_tui(e)
+      end
+
+      # The body's wait (a number of seconds), capped at
+      # SessionManager::STOP_WAIT; STOP_WAIT_SECONDS without one.
+      def stop_wait(req)
+        body = parse_json(request_body(req, 4096))
+        wait = body["wait"] if body.is_a?(Hash)
+        wait.is_a?(Numeric) && wait.positive? ? [wait, SessionManager::STOP_WAIT].min : STOP_WAIT_SECONDS
       end
 
       # POST /api/sessions/:id/restart: hand the session to a new worker on
@@ -1443,9 +1747,9 @@ module Samagotchi
                              version: result.version })
       rescue SessionManager::RestartRefused => e
         error = %i[not_running unsupported failed].include?(e.reason) ? e.reason.to_s : "held"
-        json_response(409, { error: error, reason: e.reason.to_s, detail: e.message, session_id: id })
+        refusal_response(409, error, e, reason: e.reason.to_s, session_id: id, version: e.version)
       rescue SessionManager::OwnedByTUI => e
-        error_response(409, "owned_by_tui", e.message)
+        owned_by_tui(e)
       end
 
       # POST /api/sessions/:id/archive: hide it (and its delegates) from the
@@ -1457,10 +1761,10 @@ module Samagotchi
         (result[:archived] + result[:discarded]).each { |sid| @hub&.touch(sid) }
         json_response(200, { status: "archived", session_id: result[:id], archived: result[:archived],
                              stopped: result[:stopped], discarded: result[:discarded] })
-      rescue SessionManager::OwnedByTUI
-        owned_by_repl(id)
+      rescue SessionManager::OwnedByTUI => e
+        owned_by_repl(id, e)
       rescue SessionManager::ArchiveRefused => e
-        error_response(409, e.reason == :scratch ? "scratch" : "busy", e.message)
+        archive_refused(e)
       end
 
       # POST /api/sessions/:id/unarchive: back to the lists, delegates too.
@@ -1470,17 +1774,21 @@ module Samagotchi
         json_response(200, { status: "unarchived", session_id: result[:id], unarchived: result[:unarchived] })
       end
 
-      # DELETE /api/sessions/:id: the session for good. A live worker is
-      # stopped first (the page's confirm says so); a chi REPL's session is
-      # refused.
-      def handle_delete(_req, id)
-        result = @manager.delete_session(id, state_dir: @state_dir, stop: true, wait: STOP_WAIT_SECONDS)
+      # DELETE /api/sessions/:id?force=true: the session for good. With
+      # force a live worker is stopped first (the page sends it: its confirm
+      # says so); without it a live worker's session is refused, 409
+      # worker_running, as chi sessions delete without --force. A chi REPL's
+      # session is always refused.
+      def handle_delete(req, id)
+        result = @manager.delete_session(id, state_dir: @state_dir, stop: truthy_param?(req.params["force"]),
+                                             wait: STOP_WAIT_SECONDS)
         @hub&.touch(result[:id])
         json_response(200, { status: "deleted", session_id: result[:id], stopped: result[:stopped] })
-      rescue SessionManager::OwnedByTUI
-        owned_by_repl(id)
+      rescue SessionManager::OwnedByTUI => e
+        owned_by_repl(id, e)
       rescue SessionManager::DeleteRefused => e
-        error_response(409, e.reason.to_s, "#{e.message}; try again in a moment")
+        detail = e.reason == :still_stopping ? "#{e.message}; try again in a moment" : e.message
+        refusal_response(409, e.reason.to_s, e, detail: detail, session_id: e.session_id, reason: e.reason.to_s)
       end
 
       # ── The working set (web.working_set) ───────────────────────────────
@@ -1510,7 +1818,8 @@ module Samagotchi
         llm_context = SessionSetting::LLM_CONTEXT.snapshot_value(live && live["session_state_snapshot"]) do
           SessionSetting::LLM_CONTEXT.saved_summary(session, registry: host_registry)
         end
-        snapshot = WorkingSet.build(messages, cwd: session.working_directory, strategy: working_set_strategy(llm_context))
+        snapshot = WorkingSet.build(messages, cwd: session.working_directory, strategy: working_set_strategy(llm_context),
+                                    pins: session.working_set_pins)
         json_response(200, snapshot.to_h.merge(running: running))
       end
 
@@ -1536,29 +1845,44 @@ module Samagotchi
       # provider (ContextProviders): never a command.
 
       # GET /api/sessions/:id/context: the sources this session sees, muted
-      # ones marked, with what the chips show.
-      def handle_context_list(_req, id)
+      # ones marked, with what the chips show, never a command. ?full=1
+      # (chi context ls from another machine, SessionAccess::Remote): each
+      # source as it was added too, its command included (#context_row), and
+      # a project's source a session's own of its name shadows, marked
+      # shadowed.
+      def handle_context_list(req, id)
         session = @session_class.load(id, state_dir: default_state_dir)
         own = ContextSources.session_location(id, state_dir: default_state_dir)
         subs = own.subscriptions
-        rows = attached_context(session).map { |attached| context_row(attached, own, subs) }
+        full = truthy_param?(req.params["full"])
+        rows = attached_context(session, shadowed: full).map { |attached| context_row(attached, own, subs, full: full) }
         json_response(200, { session_id: id, sources: rows, can_add_url: ContextProviders.any? })
       end
 
-      # GET /api/sessions/:id/context/:name: one source with its text.
-      def handle_context_show(_req, id, name)
+      # GET /api/sessions/:id/context/:name: one source with its text
+      # (?full=1: as the list's).
+      def handle_context_show(req, id, name)
         session = @session_class.load(id, state_dir: default_state_dir)
         attached = find_context(session, name) or return error_response(404, "not_found", "no source #{name[0, 40]}")
         own = ContextSources.session_location(id, state_dir: default_state_dir)
-        json_response(200, context_row(attached, own, own.subscriptions).merge(text: attached.snapshot.text))
-      end
-
-      # POST /api/sessions/:id/context {url, why}: the source an installed
-      # bundle's provider makes of +url+, attached to this session.
+        row = context_row(attached, own, own.subscriptions, full: truthy_param?(req.params["full"]))
+        json_response(200, row.merge(text: attached.snapshot.text))
+      end
+
+      # POST /api/sessions/:id/context: a source attached to this session.
+      # {url, why, hint}: the one an installed bundle's provider makes of
+      # +url+ (the page's only kind). As chi context add: {name, push: true,
+      # why, hint}, a source chi context push fills, or {name, cmd, every,
+      # why, hint}, a command chi runs every so often. added_by: "cli" or
+      # "agent" (chi context's), else "web". 201 {status: "attached", name};
+      # 400 invalid_json or invalid_source (a bad name or every), 422
+      # not_a_url or no_provider, 409 exists.
       def handle_context_add(req, id)
         session = @session_class.load(id, state_dir: default_state_dir)
         body = parse_json(request_body(req))
-        return error_response(400, "invalid_json", "give {url, why}") unless body.is_a?(Hash) && body["url"].is_a?(String)
+        return error_response(400, "invalid_json", CONTEXT_ADD_BODIES) unless body.is_a?(Hash)
+        return context_add_named(id, body) if body.key?("name")
+        return error_response(400, "invalid_json", CONTEXT_ADD_BODIES) unless body["url"].is_a?(String)
 
         url = body["url"].strip
         return error_response(422, "not_a_url", "give an http(s) URL") unless url.match?(%r{\Ahttps?://\S+\z})
@@ -1567,7 +1891,7 @@ module Samagotchi
         return error_response(422, "no_provider", "no installed bundle resolves #{url[0, 200]}") unless resolved
 
         own = ContextSources.session_location(session.id, state_dir: default_state_dir)
-        own.add(web_source(resolved, body["why"], own.scope))
+        own.add(web_source(resolved, body, own.scope))
         json_response(201, { status: "attached", name: resolved.name })
       rescue ContextProviders::Invalid => e
         error_response(422, "no_provider", e.message)
@@ -1575,16 +1899,49 @@ module Samagotchi
         error_response(409, "exists", e.message)
       end
 
-      def web_source(resolved, why, scope)
-        why = ContextSources.one_line(why.is_a?(String) ? why : nil, ContextSources::LINE_MAX_CHARS) || resolved.why
-        ContextSources::Source.new(name: resolved.name, cmd: resolved.cmd, every_seconds: resolved.every_seconds, why: why,
-                                   hint: resolved.hint, scope: scope, added_by: "web", created_at: Time.now.utc.iso8601,
+      CONTEXT_ADD_BODIES = "give {url, why}, {name, push: true, why, hint} or {name, cmd, every, why, hint}"
+
+      # A --push or --cmd source (chi context add NAME), checked as chi
+      # context checks it, attached through SessionAccess::Local.
+      def context_add_named(id, body)
+        name, cmd, push, every = body.values_at("name", "cmd", "push", "every")
+        unless name.is_a?(String) && ((push == true) ^ cmd.is_a?(String)) && (every.nil? || every.is_a?(Integer))
+          return error_response(400, "invalid_json", CONTEXT_ADD_BODIES)
+        end
+        return error_response(400, "invalid_source", "every is for a cmd source") if push && every
+        return error_response(400, "invalid_source", "cmd is empty") if cmd && cmd.strip.empty?
+
+        source = begin
+          ContextSources.check_name!(name)
+          ContextSources::Source.new(name: name, cmd: cmd, every_seconds: ContextSources.check_every!(every),
+                                     why: context_line(body["why"]), hint: context_line(body["hint"]), scope: nil,
+                                     added_by: context_added_by(body), created_at: Time.now.utc.iso8601)
+        rescue ContextSources::Invalid => e
+          return error_response(400, "invalid_source", e.message)
+        end
+        session_access.context_add(context_target(id), source)
+        json_response(201, { status: "attached", name: name })
+      end
+
+      def context_line(value) = ContextSources.one_line(value.is_a?(String) ? value : nil, ContextSources::LINE_MAX_CHARS)
+      def context_added_by(body) = %w[cli agent].include?(body["added_by"]) ? body["added_by"] : "web"
+
+      def web_source(resolved, body, scope)
+        ContextSources::Source.new(name: resolved.name, cmd: resolved.cmd, every_seconds: resolved.every_seconds,
+                                   why: context_line(body["why"]) || resolved.why,
+                                   hint: context_line(body["hint"]) || resolved.hint, scope: scope,
+                                   added_by: context_added_by(body), created_at: Time.now.utc.iso8601,
                                    provider: resolved.bundle)
       end
 
       # DELETE /api/sessions/:id/context/:name: the session's own source is
-      # detached; a project's is muted for this session only.
-      def handle_context_delete(_req, id, name)
+      # detached; a project's is muted for this session only (the page's
+      # ×). With ?own=1 (chi context rm) only the session's own is
+      # detached: a project's is 409 project_source, as chi context rm
+      # refuses it.
+      def handle_context_delete(req, id, name)
+        return context_remove_own(id, name) if truthy_param?(req.params["own"])
+
         session = @session_class.load(id, state_dir: default_state_dir)
         attached = find_context(session, name) or return error_response(404, "not_found", "no source #{name[0, 40]}")
         if attached.location.session?
@@ -1596,8 +1953,20 @@ module Samagotchi
         end
       end
 
-      def attached_context(session)
-        ContextSources.attached(session.id, project_root: session.project_root, state_dir: default_state_dir)
+      def context_remove_own(id, name)
+        case session_access.context_remove(context_target(id), name)
+        when :removed then json_response(200, { status: "detached", name: name })
+        when :project
+          error_response(409, "project_source", ContextCommand.project_source_message(name))
+        else error_response(404, "not_found", "no source #{name[0, 40]}")
+        end
+      rescue ContextSources::Invalid
+        error_response(404, "not_found", "no source #{name[0, 40]}")
+      end
+
+      def attached_context(session, shadowed: false)
+        ContextSources.attached(session.id, project_root: session.project_root, state_dir: default_state_dir,
+                                            shadowed: shadowed)
       end
 
       # @return [ContextSources::Attached, nil]
@@ -1608,13 +1977,20 @@ module Samagotchi
         nil
       end
 
-      def context_row(attached, own, subs)
+      # A source's row: what the page's chips show. +full+ (chi context ls
+      # and show from another machine, SessionAccess::Remote): also the
+      # source as it was added (source: Source#to_h, its command too) and
+      # the snapshot (Snapshot#to_h without its text), and shadowed.
+      def context_row(attached, own, subs, full: false)
         source = attached.source
         snapshot = attached.snapshot
-        { name: source.name, scope: source.scope, kind: source.push? ? "push" : "cmd", every_seconds: source.every_seconds,
-          why: source.why, hint: snapshot.hint || source.hint, summary: snapshot.summary, error: snapshot.error,
-          fetched_at: snapshot.fetched_at, has_text: snapshot.text?, muted: own.muted?(source.name),
-          unread: snapshot.text? && subs[source.name]&.read != snapshot.revision }
+        row = { name: source.name, scope: source.scope, kind: source.push? ? "push" : "cmd", every_seconds: source.every_seconds,
+                why: source.why, hint: snapshot.hint || source.hint, summary: snapshot.summary, error: snapshot.error,
+                fetched_at: snapshot.fetched_at, has_text: snapshot.text?, muted: own.muted?(source.name),
+                unread: snapshot.text? && subs[source.name]&.read != snapshot.revision }
+        return row unless full
+
+        row.merge(source: source.to_h, snapshot: snapshot.to_h.except("text", :text), shadowed: attached.shadowed)
       end
 
       def handle_stream(req, id)
@@ -1654,9 +2030,25 @@ module Samagotchi
           return [200, headers.merge("rack.hijack" => hijack), []]
         end
 
-        query = stream_query(req)
-        [200, headers, ProxyStreamBody.new(host: DEFAULT_HOST, port: bridge_port, session_id: id, query: query, headers: req.env,
-                                           server_running: @server_running)]
+        [200, headers, proxy_stream_body(id, req, bridge_port)]
+      end
+
+      # The one ProxyStreamBody both of #handle_stream's transports send:
+      # the session's Bridge stream, through the request principal's frame
+      # filter (#stream_filter).
+      def proxy_stream_body(id, req, port)
+        ProxyStreamBody.new(host: DEFAULT_HOST, port: port, session_id: id, query: stream_query(req), headers: req.env,
+                            server_running: stream_running(principal(req)), filter: stream_filter(principal(req)))
+      end
+
+      # What a principal's stream goes through on its way from the Bridge:
+      # nil, the raw bytes unchanged, for the owner (the only principal
+      # today). A filter is anything with #call(chunk) -> String (nil or
+      # "" sends nothing); see ProxyStreamBody.
+      def stream_filter(principal)
+        return nil if principal.owner?
+
+        raise ArgumentError, "no stream filter for a #{principal.kind} principal"
       end
 
       # GET /api/events: the session list as one SSE stream per tab. The
@@ -1716,10 +2108,10 @@ module Samagotchi
       # (WEBrick via rackup) has already sent the status line + headers, so
       # only body bytes go to the socket here.
       def sse_hijack(id, req, port)
+        # Made before the status line goes out: a principal with no filter
+        # is refused (#stream_filter), never streamed.
+        body = proxy_stream_body(id, req, port)
         lambda do |io|
-          query = stream_query(req)
-          body = ProxyStreamBody.new(host: DEFAULT_HOST, port: port, session_id: id, query: query, headers: req.env,
-                                     server_running: @server_running)
           body.each { |chunk| io.write(chunk) }
         rescue Errno::EPIPE, Errno::ECONNRESET, IOError
           nil # client went away — end the stream quietly
@@ -1777,6 +2169,8 @@ module Samagotchi
       end
 
       def serve_index(req)
+        return participant_page(principal(req)) unless principal(req).owner?
+
         path = File.join(@public_dir, "index.html")
         if File.file?(path)
           body = File.read(path).sub("<body>", "<body #{index_data_attributes(req)}>")
@@ -2323,15 +2717,20 @@ module Samagotchi
       # ends when the Bridge closes the stream or, as EventsBody, when the
       # server leaves :Running: rackup's WEBrick joins every request thread
       # before returning, and a read blocked on a quiet worker would hang
-      # Ctrl-C of chi web. The bytes go through unchanged.
+      # Ctrl-C of chi web. Without a +filter+ the bytes go through unchanged
+      # (the owner's stream); with one, each chunk read from the Bridge goes
+      # through it, and what it returns is sent.
       class ProxyStreamBody
         # @param headers [Hash] the request's Rack env; only its Last-Event-ID
         #   is kept (the env carries the token cookie, never held or inspected)
-        def initialize(host:, port:, session_id:, query:, headers:, server_running: -> { true })
+        # @param filter [#call, nil] chunk -> String (nil or "": nothing sent);
+        #   it sees the Bridge's reads as they come, not whole frames
+        def initialize(host:, port:, session_id:, query:, headers:, server_running: -> { true }, filter: nil)
           @client = BridgeClient.new(session_id: session_id, port: port, host: host)
           @query = query
           @last_event_id = headers["HTTP_LAST_EVENT_ID"]
           @server_running = server_running
+          @filter = filter
         end
 
         def each(&)
@@ -2339,7 +2738,12 @@ module Samagotchi
           # Last-Event-ID header over ?from_seq, and the reconnect URL carries a
           # stale initial cursor — without this the bridge would replay content
           # already delivered (duplicate bubbles).
-          @client.stream(query: @query, last_event_id: @last_event_id, running: @server_running, &)
+          return @client.stream(query: @query, last_event_id: @last_event_id, running: @server_running, &) unless @filter
+
+          @client.stream(query: @query, last_event_id: @last_event_id, running: @server_running) do |chunk|
+            out = @filter.call(chunk)
+            yield(out) unless out.nil? || out.empty?
+          end
         end
       end
     end