samagotchi 0.106.0 → 0.108.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 13a61f40d26663d6ecd66b89b94d1406f8495e161a5bbdd33a319a41e46dbfb3
-  data.tar.gz: 2b0ab74468e6020dad2b60b12abba06809933621234080f0ef75f8fbc6243ccc
+  metadata.gz: 3f63eb88d80157a6b77f733031284c1a4e376528356f8d099ffe356b4cd7e6c1
+  data.tar.gz: eab92f98b12468b5c882e5ee80524fdf151a1b479fd232ea54f8318bf952c2e3
 SHA512:
-  metadata.gz: d53a1f7c2f4347d9688e3d5f4000400297b343d2089536dd9efececcaf30cacceec91834639fed0750848e098c4845e4622c44f6b1df49180a84422dfc153430
-  data.tar.gz: 83dce80d3f6ebaa03b1bc84c6d84f025bb6055a9125c0e6ade2a7ad427922c8c2dbeb631991500e9b3be9454161917229d2f0b5f27b55f0a36e7afd0f3ab76c2
+  metadata.gz: c5df88fe266c32153072be45890e6c12f54bcab0492d367cabc0f0066e6dec41bfc8d54e800f08c610979c3ec66131f7082dbc8691ea3854498ce603f553ffec
+  data.tar.gz: e324e458bc5801eec9bc0f170ab5b839fbc4633ca33ce026566cac121deed90b53149a1052a9ec4607f67a7e3d284b4201c08309b5e8eeb1181bd1ff3ec65e31

data/CHANGELOG.md

@@ -8,6 +8,160 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.108.0] - 2026-10-24
+
+### Added
+
+- A project's memories copied from another machine or path (their folder keyed by the old path's hash) are no
+  longer missing without a word: when this project's folder is missing or empty and one of the same name with
+  another hash exists, chi warns at session start (`memory>`) and under a project `memory_read` miss, naming both
+  folders and the `mv` that fixes it. See docs/memory.md (Moving memories to another machine).
+
+### Changed
+
+- `chi send --wait` and `chi answer` left with the turn still running (`--timeout`, Ctrl-C) offer the command that waits
+  again: `chi send --wait --turn T ID`, or `chi send --wait ID` when the turn's id isn't known (with the attach that
+  shows it); under `--remote NAME` both carry it.
+- `chi send --wait` into a running turn is refused with what to do next: `--queue` runs the message after it,
+  `chi send --wait ID` waits for it, `chi --attach ID` shows it (under `--remote NAME` the attach, no longer "open it
+  in chi web").
+
+### Fixed
+
+- `chi -p … --non-interactive` prints the load warnings (a guardrail or plugin that failed to load, the orphaned
+  project memory folder) on stderr as `<label>> …` lines; it used to drop them.
+- cost-cap 0.2.3, work-cap 0.1.3: a session's state file that doesn't read (not JSON) no longer drops its `/cap` or
+  `/workcap` cap silently: it is logged and you get one notice naming the file and the cap used instead (the
+  config's), and the next `/cap`, `/workcap` or Continue that writes over it says so instead of replacing it silently.
+- `chi send --wait -m` to an idle session (and `--new --wait`) waits for its message's own turn: a worker that dies
+  in that turn ends the wait `canceled` (`worker_stopped`) once the next worker settles it, instead of sitting to
+  the timeout; the `turn_id` it reports was already that turn's.
+- A `delegate` follow-up's wait (or delegate report) to an idle child no longer takes the child's previous turn's
+  reply for its own when it looks just as the follow-up's own turn starts.
+- A scheduled job that dies of an error outside Ruby's StandardError (a stack overflow, a job calling `exit`) no
+  longer cuts chi's shutdown short: the rest of it (plugin tasks, MCP servers) still stops.
+
+Update with `chi update` (the system bundle 0.108.0, the cost-cap bundle 0.2.3, the work-cap bundle 0.1.3), then restart `chi web`.
+
+## [0.107.0] - 2026-10-24
+
+### Added
+
+- Review sessions for participants (experimental). `chi review docs/plan.md …` starts a session made to be shared:
+  its subjects are project files (a secret such as `.env` or a key, a file outside the project or chi's own is
+  refused with one message), it starts idle, and it prints the `chi share` line to invite someone. `chi review --from
+  ID` starts a review of a working session from its recap, never its transcript; that session keeps running,
+  unarchived. Both work with `chi --remote NAME` (`--dir` there). On the web, the start page's `review…` chip takes
+  the files, and the participants panel's **Start a review of it** starts a review of the session. Sharing a session that isn't a review
+  session still works, with a warning naming how many tool outputs its history holds (`chi share`, the Invite
+  dialog). Participants read the subjects as the **Plan**: rendered beside the thread on a wide screen, a Plan |
+  Thread toggle on a phone, checked again on every read and redacted. Under each participant's review turn the owner
+  gets **Apply**: it puts an owner's turn in the composer, not sent, that quotes the proposal line by line, so the
+  participant's words never reach the model as the owner's instruction; sent while a turn runs, it queues as the
+  owner's own turn (the delivery line says so; during the owner's own turn Esc steers it in instead), never merged into the running one. Plugins get `ctx.sessions.review(subjects:,
+  seed:)`. The coordinator bundle (0.6.0) adds an experimental sprint review: `/coordinate review [handoff]` opens a
+  review of the coordinator session seeded with its handoff, where a participant's new context gets a hand-off diff
+  and the owner's Apply updates the handoff. See [docs/cli.md](docs/cli.md#review-sessions) and
+  [docs/sessions.md](docs/sessions.md#review-sessions).
+
+### Changed
+
+- `chi`'s run flags take their whole name only, as the subcommands' flags always have: an abbreviation such as
+  `--verb` or `--mem x` is now an invalid option (exit 1) instead of `--verbose` / `--memory x`. Under `chi --remote`,
+  an abbreviated local-only flag could slip past the "runs on this machine only" check and be dropped silently.
+
+### Fixed
+
+- The owner's Continue on the step-limit offer of a participant whose turn is refused since (revoked, expired, at
+  their cap) ends the offer as a Stop does, with a notice: no "resumed" for a turn that never runs, and idle exit,
+  `/exit` and that participant's queued turns no longer wait on an offer nobody can answer.
+- A participant's queued turn the worker refuses (revoked, expired, at their cap) ends their `chi send --wait` (and
+  chi web's participant wait) at once: status `refused`, exit 1, `cancel_reason` `revoked` or `cap_reached`, instead
+  of waiting to the timeout (none by default).
+- The owner's input while a participant's review turn runs queues as the owner's own turn after it, from every
+  client (the web, the attached TUI, `chi send` without `--queue`), never steered or cut into their read-only turn;
+  each says it was queued (the web's delivery line, the TUI's note, `chi send`'s line), and `chi send --wait` waits
+  for that turn's own answer.
+- Participants: an agent participant's `chi send --wait` no longer reads its reply unfiltered: the reply is
+  redacted as the page shows it (secret shapes, the owner's token, host paths, no thinking or tool calls), and a
+  failed turn says "this turn failed: the session's owner can see why", never the error's own words.
+- Participants: a secret on a long streamed line (`password: …`, an `Authorization:` header, an `sk-…` key, a
+  private key's BEGIN line) is no longer sent unredacted when the participant's stream cuts the line at 400
+  characters; a line with no space for 1600 characters ends in `[redacted]`. A private key block that begins on the
+  line where another one ends is withheld too.
+- Participants: a participant's link opened on chi web's own machine (or `chi share` on a chi web not on the LAN,
+  whose link opens on that machine only) is the participant, no longer the owner: a `chp_` token is the participant's
+  from any peer, an ended one is refused, and the owner's browser that opened a participant link is the owner's again
+  once that link ends.
+- Participants: each refusal has one wording wherever it is met: a participant's `chi --remote` refused an
+  owner's command says "a participant can't do that: only the session's owner can", as chi web does, and an ended
+  link's page says whether it was revoked or expired.
+- Participants: chi web and `chi share` revoking (inviting, changing a cap) at the same moment can no longer leave
+  `participants.json` reading a revoked participant as active, so the worker refuses their queued turns: the file
+  is written under the grants store's lock.
+- Participants: a grants store (`web-grants/grants.json`) that doesn't read is no longer overwritten by the next
+  invite, which kept only the new grant and dropped every other link's; `chi share` (exit 1) and chi web refuse invite,
+  ls, cap and revoke with one line naming the file, and a grant row without its digest or expiry no longer
+  makes every participant request a 500.
+- Participants: revoking a participant (or their link expiring) ends their `chi send --wait` already waiting at chi
+  web, refused as their link's end, instead of handing them the reply that came within the next 30 s.
+- Participants: an agent participant's `chi send --wait` no longer gets the owner's wait state from chi web (the
+  owner's newest reply file, message count, pending question, running turn), only what waiting on its own turn needs.
+- Participants: a reply that opens a private key block and never closes it is withheld to that turn's end, no
+  longer hiding every later turn's reply from the participant's stream until they reload.
+- Participants: two of a participant's turns sent at once while no worker runs the session can no longer both pass
+  their queue limit.
+- `chi --remote NAME` words a value the remote's chi web refuses (`sessions list --cwd rel/dir`, `note --source " "`)
+  as one line naming the command, exit 2, instead of a Ruby backtrace; its other refusals are one line, exit 1.
+- A remote whose address answers something other than HTTP (another server on that port, an SSH banner), or a
+  request that can't be written in time, is the one "remote NAME (URL): …" failure line, exit 1 (`chi --remote`,
+  `chi remote add`'s check; the attached TUI reads it as unreachable), instead of a Ruby backtrace.
+- The attached TUI on a remote whose host went away (no answer at all, not a refused connection) gives up each
+  stream reconnect after 5 s, so it ends within about two minutes instead of about seventeen.
+- `chi --remote NAME context push` with a name that isn't a source's (`a/b`, `Bad Name`) gives the name rule, as
+  it does locally, instead of "too old for this command … update chi there" or a URI error.
+- A remote at an IPv6 address (`chi remote add box http://[::1]:4567`) connects: its commands and its attached
+  TUI's stream used the bracketed host as a name to look up ("can't find host").
+- Two `chi remote add` / `chi remote rm` at once keep each other's change: `remotes.yml` is rewritten under a lock.
+- `chi --help` and `chi remote --help` list `review` (and `share`) among the commands `chi --remote NAME` runs, and
+  `-p` says it stays in the session (the attached TUI by default, the REPL with `--no-shared`), not "in the REPL".
+- The participant page sends a comment once: a second Enter (or Send) while it is being posted no longer sends it
+  again as a second review turn.
+- The participant page that can't reach chi web (a network blip, a 5xx) says "Can't reach the session — retrying…" and
+  reads again with a backoff (3 s, doubling, at most 30 s), at open and after a turn boundary, instead of a blank or
+  silently stale page; a comment that can't be sent says so and stays in the box.
+- The participant page's live reply no longer loses the text that streams while the page re-reads the review (another
+  participant's comment queuing mid-turn left a hole until the turn ended): it streams again from the re-read's
+  cursor, and an older re-read answering last no longer overwrites a newer one.
+- The participant page shows chi web's own words for a refused comment or take-back ("A participant can't do that:
+  only the session's owner can.", too many turns, the spending cap) and for an ended link (revoked or expired),
+  instead of its own second wording.
+- The participant page keeps a tool list the reader opened or closed as they left it when the thread is read again or
+  the reply streams, and no longer redraws the messages it already shows (a text selection in them stays).
+- The participant page on a phone is the visible viewport's height (100dvh), so its composer sits above the browser's
+  URL bar instead of under it.
+- The participant page no longer adds the next turn's first words to the reply of the turn that just ended while it
+  reads the review again (a queued turn starting): the live reply waits for the re-read, whose stream replays them.
+- The web info bar's session clock, speed and ctx chips keep one width while a turn runs (tabular digits in a
+  reserved width), and the speed and the clock show from the session's start as muted placeholders: a tick or the
+  first generation's speed no longer widens the line and wraps a chip onto a new row.
+- The participants panel drops an Invite, Cap or Revoke answered after it closed or another session opened: a
+  one-time link no longer shows the next time a panel opens, under another session, and a failed list no longer
+  keeps the previous session's working-session warning.
+- The participants panel's **Start a review of it** closes the panel only once the review is made; a refusal stays in
+  the open panel, said there, instead of the panel closing on a toast.
+- The participants panel's Revoke asks first (`Revoke Alex's link? …`), as a delete does: it can't be undone, and on
+  a phone's sheet it sat one tap away beside Cap.
+- A participant's older prompt drawn before the participants list came (no name saved with it) no longer says
+  "a participant" until the page is reloaded: its badge takes the name when the list comes.
+- The start page's `review…` chip can name a file with a space in its path: in double quotes (`"docs/my plan.md"`);
+  an unclosed quote is said in its form. A file Start refuses (a secret, outside the project) is said in that form,
+  opened again at the files chosen, instead of a blocking alert.
+- The participants panel no longer closes on its own Cap or Invite another (the button, redrawn away by its own
+  click, read as a click outside the panel).
+
+Update with `chi update` (the system bundle 0.107.0, the coordinator bundle 0.6.0, the dev profile 0.7.2), then restart `chi web`.
+
 ## [0.106.0] - 2026-10-23
 
 ### Added
@@ -4011,7 +4165,9 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.106.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.108.0...HEAD
+[0.108.0]: https://github.com/dm1try/samagotchi/compare/v0.107.0...v0.108.0
+[0.107.0]: https://github.com/dm1try/samagotchi/compare/v0.106.0...v0.107.0
 [0.106.0]: https://github.com/dm1try/samagotchi/compare/v0.105.0...v0.106.0
 [0.105.0]: https://github.com/dm1try/samagotchi/compare/v0.104.0...v0.105.0
 [0.104.0]: https://github.com/dm1try/samagotchi/compare/v0.103.0...v0.104.0

data/bin/chi

@@ -54,6 +54,8 @@ SUBCOMMANDS = {
   "answer" => ["samagotchi/answer_command", "AnswerCommand"],
   # invite participants to review a session, list them, revoke them
   "share" => ["samagotchi/share_command", "ShareCommand"],
+  # a review session for files, or of a session (--from, --dir, --model)
+  "review" => ["samagotchi/review_command", "ReviewCommand"],
   # find a model server and write config.yml (--model, --name)
   "bootstrap" => ["samagotchi/bootstrap_command", "BootstrapCommand"],
   # bring an installed chi up to date

data/docs/architecture.md

@@ -201,7 +201,8 @@ These are the Engine's raw events. The worker's SSE projection omits `call` from
 `:tool_call_started` and `result` from `:turn_completed`; the answer remains in
 `turn_summary.output`.
 
-A turn started with `origin:` carries it on each of these (and `:turn_failed`).
+A turn started with `origin:` (a `TurnOrigin`, or its Hash) carries it on each of these (and `:turn_failed`), as
+the Hash `{client_id:, enqueued_id:, author:}` with only the fields set (`TurnOrigin#to_h`).
 
 Every event is a `Hash` with a `:type` symbol key; the sink must not raise (the Engine
 rescues sink errors). A new UI (web, API) supplies its own `on_event` and
@@ -548,6 +549,8 @@ model: [internals/remote-sessions.md](internals/remote-sessions.md).
 | `POST /api/sessions/:id/turn` (`no_interrupt`) | owner | `no_interrupt: true`: the turn runs with the raised iteration limit (`SessionManager.deliver_turn(no_interrupt:)`, to the Bridge or the input file) | as before | |
 | `POST /api/sessions/:id/command` (its 501) | owner | | | 501 `not_supported` for a builtin the worker lacks adds `command` (`"/title"`) and `message` |
 | `GET`/`POST`/`DELETE /api/sessions/:id/participants`, `GET`/`DELETE /api/participants` | owner | `chi share`'s (`name`, `kind`, `ttl`; `?id=p_…`) | the grants, never a token but POST's own once ([internals/participants.md](internals/participants.md)) | 400 `invalid_participant`; 404 |
+| `GET /api/sessions/:id/apply[?turn=T]` | owner | `turn`: a turn id or a prefix (none: the latest review turn with a reply) | 200 `{text, turn_id, author, author_name}` (`ReviewApply`): the owner's Apply of a participant's review turn, for the composer, never sent ([internals/participants.md](internals/participants.md)) | 404 `not_found`; 400 `not_review_turn`; 409 `no_reply` |
+| `POST /api/sessions` (`review`) | owner | `review: {subjects: [project files], from: a session id}`; never with `prompt`, `preview`, `idle` or `continues` (a `from` takes the source's folder and setup) | 201 as a create's: an idle review session (`ReviewStart.start`, or `ReviewStart.fork` with `from`) | 400 `invalid_review` (`ReviewStart::Refused`'s words: a subject, a gone folder); with `from` also 404 `not_found`, 400 `ambiguous_id` |
 
 `GET /api/info` names the feature `session_commands` (`SessionAccessRoutes::FEATURE`): `SessionAccess::Remote` asks it
 once before its first request, and a chi web without it (or `serve_static`'s 404 for a path no route takes) is "remote NAME runs chi X, too
@@ -692,6 +695,8 @@ A map of the parts the overview above doesn't name (paths under `lib/samagotchi/
 | Attached context | `context_sources.rb` (`ContextSources`), `context_poller.rb`, `context_absorber.rb`, `peer_sources.rb` (`PeerSources`: the sources peer bundles declare) | External sources a session keeps fresh, and the peer loop's wakes ([context.md](context.md)). |
 | LLM context strategies | `llm_context_strategy.rb`, `llm_context_view.rb`, `llm_context_stale.rb`, `llm_context_forget.rb` | What a request sends of the history (none, stale, forget) ([internals/llm-context-forget.md](internals/llm-context-forget.md)). |
 | Session chains | `session_continue.rb` (`SessionContinue`), `session_chain.rb` (`SessionChain`) | A session that continues an earlier one. `SessionChain.opener_for` gives the text web `continue →` prefills in the new link: the previous link's own first typed message when that link continues one itself, else nil (the 201's `opener`; not saved) ([sessions.md](sessions.md)). |
+| Review sessions | `review_start.rb` (`ReviewStart`), `session_review.rb` (`SessionReview`, the session's `review` field), `review_command.rb` (`ReviewCommand`, `chi review`), `review_apply.rb` (`ReviewApply`) | A session made to be shared: idle, its subjects project files checked by `Guardrails::ReviewPaths`, a fork of a working session from its recap (`--from`); Apply quotes a participant's review turn into the owner's composer ([sessions.md](sessions.md#review-sessions), [internals/participants.md](internals/participants.md)). |
+| Participants | `participants.rb` (`Participants`, the `participants.json` sidecar), `share_command.rb` (`ShareCommand`, `chi share`), `session_participants.rb`, `participants_watch.rb`, `web/grants.rb` (`Web::Grants`), `web/principal.rb` (`Web::Principal`), `web/participant_access.rb` (`Web::ParticipantAccess`: the participant's gate and routes), `web/participants_admin.rb` (`Web::ParticipantsAdmin`: the owner's invite, list, revoke, cap and Apply routes), `web/participant_review.rb` + `web/participant_view.rb` (`Web::ParticipantReview`, `Web::ParticipantView`), `web/participant_stream_filter.rb`, `guardrails/review_boundary.rb` + `guardrails/review_paths.rb` | The people or agents an owner invites to review one session through chi web: their grants and gate, what they read, their read-only review turns ([internals/participants.md](internals/participants.md), [guardrails.md](guardrails.md)). |
 | Analytics | `analytics_file.rb` (`AnalyticsFile`), `session_metrics/totals.rb` (`SessionMetrics::Totals`), `session_metrics/model_segment.rb` (`SessionMetrics::ModelSegment`) | A session's `analytics.json` (`SessionMetrics#persist`); the sums over its turn records (`Totals`: tokens, cost, speeds, kept as running counters) and their split per model after a `/model` switch (`ModelSegment`: a run of turns on one model, the `model_segments` rows); `session_metrics/cost.rb` (`SessionMetrics::Cost`): the spend `ctx.cost` reads; `session_metrics/usage.rb` (`SessionMetrics::Usage`): the work `ctx.usage` reads. `session_metrics/side_totals.rb` (`SessionMetrics::SideTotals`) and `side_usage.rb` (`SideUsage`): the side requests' sums, apart from the turns'. |
 | Images / vision | `image_store.rb` (`ImageStore`), `vision_support.rb`, `vision_context.rb` | Stored prompt images and whether a model takes them. |
 | Toolkits | `toolkit.rb` (`Toolkit`), `toolkit_binding.rb` (`ToolkitBinding`, the Engine's seam), `toolkit_command.rb` (`/toolkit`), `tools/registry.rb` (`Registry#toolkit`, `#left_out_names`), `web/public/toolkit_chip.js` | Which registered tools a session's prompts declare: saved in the session, resolved at a turn's start (`Engine#apply_toolkit!`), named in the prompt's not-loaded line, a kit's prompt text after the appended files; `chi.toolkit` and `ctx.use_toolkit` for plugins ([configuration.md](configuration.md#toolkits)). |

data/docs/cli.md

@@ -18,12 +18,14 @@
 - `chi web --no-web-working-set` — turns the stage view's working set off (on by default; `--web-working-set` turns a config's `web.working_set: false` back on): what each turn brought into the model's context, in the stage and under each finished turn; `?working_set=1|0` on the page URL overrides it (see [The working set](#the-working-set))
 - `chi sessions list|stop|restart|archive|unarchive|delete|prune|clean|stats` — manage persisted sessions; `list` shows this git project's, `list --scope=all` every one, a delegated session with `↳ <parent>`, `list --archived` the archived ones too (see [Sessions](sessions.md)). `stats ID` prints a session's cost, tokens and progress, and its own settings (`--set`; a `settings:` line), from a live worker's `GET stats`, else its saved `analytics.json` (`--format json` one object, with `settings`), without running a model turn. A usage error (an unknown subcommand or flag, a flag missing its value, `stop`, `restart` or `delete` with no ids, a bad `list --format` or `--scope`, a `--days`, `--keep` or `--limit` that isn't a whole number) exits 2; an unknown or refused session exits 1
 - `chi note [--source NAME] [-m TEXT] (ID|PREFIX)... | --all` — add a context note (TEXT or stdin) to sessions: background the model sees on its next turn; it starts no turn (see [Sessions: Context notes](sessions.md#context-notes))
+- `chi broadcast [-m TEXT] [--all] [--dry-run]`, `chi broadcast log [--last N] [--format json]`, `chi broadcast deliver BROADCAST_ID (ID|PREFIX)...` — share one piece of information (TEXT or stdin) with every session it may concern, as a context note from `broadcast` (see [Broadcast](broadcast.md))
 - `chi context <add|push|ls|show|refresh|rm|mute|unmute> …` — attach live external text to sessions (a command chi runs every so often, or text pushed in); the model gets a short note when it changes and reads it with `context_read`; `chi context add <URL>` attaches a GitHub PR with the github-pr bundle (see [Attached context](context.md))
 - `chi send [-m TEXT] [--image PATH]... [--cut | --queue] (ID|PREFIX)...` — send a message to sessions as if typed there: a turn starts (or a running one takes it at its next step; `--cut` asks it to cut long thinking for it; `--queue` runs it as a turn of its own after the running one, and `--queue --wait` waits for that turn's own answer); piped stdin goes above `-m` as quoted context, and `--image` attaches images (see [Sessions: Sending a message](sessions.md#sending-a-message)); `--new` starts a session with it instead (`--new --continues ID|last:ID` the next link of that session's chain, see [Session chains](sessions.md#session-chains)), and `--wait` prints the answer (`--wait ID` with no message waits for the next reply without sending — to an idle session whose last turn already ended, that ended turn's reply or end comes back; `--wait --turn T ID` with no message waits for exactly turn T, whether running, queued or last ended; `--format json` includes its `turn_id` when known, for waiting again after exit 3 or 4; exit 3 a question waits, its options on stderr; exit 4 `--timeout` passed with the turn still running; see [Starting a session](sessions.md#starting-a-session))
 - `chi answer ID --question QID (--option N|LABEL)... [--text T] [--timeout S] [--format json]` (or `--dismiss`) — answer the question a session waits on (the one `chi send --wait` exited 3 with), then wait and print what comes next as `chi send --wait` does: the reply (0), the next question (3), still running after `--timeout` (4). `--option` is 1-based or the label, repeated on a multi-select question; `--text` is free text, or a Deny's reason; `--dismiss` leaves it unanswered and the model finishes its reply. A question no longer open (the web answered first) isn't answered again: it waits for that turn's reply. An option the question doesn't offer exits 2; a worker that is gone exits 1 (`send the task again: chi send --wait -m "…" ID`). What a parent may pick follows `guardrails.parent_answers`, or the session's own `parent_answers` when stricter (`soft`, the default: a deny, a plain answer, Continue and "Allow once"; `standard`: no allow; `hard`: no Continue either), never a wider scope or an allow on chi's own config; a refused pick exits 1 with what to answer instead (a convention, not a security boundary; see [Guardrails](guardrails.md#answers-from-a-parent-agent))
 - `chi remote add NAME URL [--token-file F | --token-stdin]`, `chi remote ls`, `chi remote rm NAME` — the other machines whose chi web the session commands reach with `--remote NAME` (see [Remote sessions](#remote-sessions))
+- `chi review FILE… [--dir DIR] [--model M]`, `chi review --from ID [FILE…]` — start a review session to invite participants to: for files of a project, or as a review of a working session that starts from its recap, not its transcript (see [Review sessions](#review-sessions))
 - `chi share ID --name NAME [--agent] [--expires 3d] [--cap 2]`, `chi share ls [ID]`, `chi share cap ID P DOLLARS`, `chi share revoke ID [P] | --all` — invite a participant to review a session through chi web on the LAN (a link of their own, 7 days, a $2 spending cap), list them, change one's cap, revoke them (see [Participants](#participants))
-- `chi --remote NAME send|answer|note|context|sessions|share …` (or `CHI_REMOTE=NAME`) — those commands on that machine's sessions, through its chi web (see [Remote sessions](#remote-sessions))
+- `chi --remote NAME send|answer|note|context|sessions|share|review …` (or `CHI_REMOTE=NAME`) — those commands on that machine's sessions, through its chi web (see [Remote sessions](#remote-sessions))
 - `chi --remote NAME --attach ID` (`--resume ID`, `--dir DIR [-p TEXT]`) — the attached TUI on a session of that machine (see [Remote sessions](#remote-sessions))
 - `chi memory ls [--scope project|system] [--format text|json]` — the memories of both scopes (this folder's project first), one row each: scope, name, size, date, `from <bundle>`, the index description and its model overlays; `chi memory rm NAME [--scope project|system]` removes one as `memory_write` with `remove: true` does: its file and model overlays go to the bundle trash (the line names the dir; `chi bundle trash` lists and empties it) and its index line is dropped. NAME in both scopes without `--scope` exits 2 naming both; a missing NAME or a bundle's memory (`chi bundle uninstall` removes it) exits 1 (see [Memory: Listing and removing from the shell](memory.md#listing-and-removing-from-the-shell))
 - `chi desktop install|upgrade|uninstall|status` — the macOS "Send to chi" helper: a Service and a ⌃⌥⌘N hotkey that send text or images to a session (live, stopped or new) as a message (⏎, a turn runs) or a context note (⌘⏎) (see [Desktop helper](desktop.md))
@@ -273,6 +275,8 @@ bundles or the helper can be updated.
 
 Samagotchi exposes one flag that feeds a prompt (`-p`, `--prompt`) and one that
 controls exit behavior (`--non-interactive`); `--resume` composes with both.
+Every flag takes its whole name, as the subcommands' flags do: an abbreviation (`--verb`, `--mem x`) is an
+invalid option (exit 1).
 
 | Flag | Purpose |
 |------|---------|
@@ -1287,8 +1291,8 @@ chi share revoke --all          # every link to every session
   participant; opening it sets their browser's cookie, as the owner's LAN link does. `--agent` marks an agent
   participant, which uses the token as `Authorization: Bearer` (e.g. `chi --remote` with that token).
 - It works for 7 days (`--expires Nh` or `Nd`, 1 hour to 30 days; `web.participants.expires`), until it is revoked,
-  or until the session is archived or deleted. A revoked or expired link shows "This review link has expired or was
-  revoked."
+  or until the session is archived or deleted. A revoked link shows "This review link was revoked by the session's
+  owner.", an expired one "This review link expired: ask the session's owner for a new one."
 - **Review turns (experimental).** A participant can ask questions and comment through chi web's `POST …/turn`: each
   message is a turn of its own, queued behind the running one, that the model answers **read-only**. It may read the
   project (never its secret files or chi's own), and proposes changes as text or a diff for you to apply; it can't
@@ -1309,8 +1313,15 @@ chi share revoke --all          # every link to every session
   memories, context notes, plugin and delegate input, cards, command output, the working set, cost, timing or host
   paths; secret-shaped text (API keys, tokens, private keys) is redacted too. An agent participant can wait on its
   turns' replies through the API, or with chi: its link's token in a remote, `chi --remote NAME send --wait -m "…" ID`,
-  or `send -m`, which prints the turn id `--wait --turn T` takes. They can't reach anything else: every other route answers them 403, another
+  or `send -m`, which prints the turn id `--wait --turn T` takes; that wait exits 3 with `waiting_for_owner` while
+  their turn waits on you (a question, an approval, your step-limit Continue) and 1 with `refused` (`cancel_reason`
+  `revoked` or `cap_reached`) when their queued turn is refused before it runs. They can't reach anything else: every other route answers them 403, another
   session 404.
+- **Apply.** Under each of a participant's review turns that has a reply, your page shows **Apply** (full width on a
+  phone): it puts an Apply turn in your composer, not sent, `Apply this proposal from Alex's review turn 3f2a1c0d, as
+  far as it fits the plan. It's quoted: …` and the reply quoted line by line. Read it, edit it, send it: the
+  participant's text reaches the model as a quote under your line, never as your instruction. Don't send "do what
+  Alex said" instead: that hands their words your tools.
 - **Your side of it.** In the session bar, the participants chip (`invite` while nobody has a link, then `2
   participants`, with a green dot while one is on their page) opens the panel: each participant's state, last visit,
   spend against their cap, turns and expiry, with **Cap** and **Revoke** (revoking ends their page and stream and
@@ -1320,7 +1331,8 @@ chi share revoke --all          # every link to every session
   shows their name in their colour, live and after a reload.
 - `chi --remote studio share …` invites on studio: the link names studio's LAN address. Locally, the link names
   this machine's running chi web, on the port it listens on (it records it in `$XDG_STATE_HOME/samagotchi/web.json`;
-  `web.port` when none answers there); without one on the LAN, chi says the link opens on this machine only.
+  `web.port` when none answers there); without one on the LAN, chi says the link opens on this machine only (as
+  the participant there too: a participant's link never opens as the owner).
 - The owner's own token and the `chi web --new-token` rotation are separate: rotating it ends no participant's link.
 - **In the attached terminal.** A participant's message reads `Alex ▸ review> is step 3 right?`, the name in that
   participant's own colour (queued, running, and the last exchange when you join); yours stay as they were. A line
@@ -1333,6 +1345,34 @@ chi share revoke --all          # every link to every session
   a revoke made with them isn't announced again by the `participants>` line. The REPL
   (`--no-shared`) answers them with a note: a participant's turns run on the session's worker.
 
+#### Review sessions
+
+Share a **review session**, not a working one: a working session's history holds its tool outputs, and a review
+turn's model may quote them. `chi review` starts one, idle:
+
+```sh
+chi review docs/plan.md docs/spec.md          # a fresh session in this project for those files
+# 4b7e9a01-…  review · docs/plan.md, docs/spec.md · idle
+# open it: chi --attach 4b7e9a01 or the web
+# invite someone: chi share 4b7e9a01 --name NAME
+chi review --from 3f9a1c2e docs/plan.md       # a review of a working session: its recap, not its transcript
+```
+
+- Each FILE is a **subject**: a file in the session's project (the git work tree of its folder, `--dir`, else
+  here), relative to that folder or absolute. A missing file, a folder, a file outside the project, a secret
+  (`.env*`, keys and certificates, credentials files, a git config) or chi's own refuses the review with one line:
+  `chi review: .env can't be a review subject: …`. At most 20.
+- `--from ID` (an id, a prefix, `last:ID`) starts a **review fork**: a new session in ID's folder, on its model
+  (`--model` to change it) and setup, seeded with a fresh recap of ID (its live worker is asked first, as a continue
+  asks), never its transcript. ID keeps running, unarchived, its delegates its own. Its FILEs are relative to ID's
+  folder.
+- `chi --remote NAME review … --dir /path/there` starts it on that machine; its chi web checks the files there.
+- Sharing a working session (one `chi review` didn't start) still works, with a warning on stderr that says how many
+  tool outputs its history holds: `chi share: warning: 3f9a1c2e is a working session, not a review session: a
+  participant's review turn can quote what its history holds (42 tool outputs so far). … (chi review --from 3f9a1c2e
+  starts one)`. On the web the participants panel shows the same words before its Invite, with **Start a review of
+  it**, and again above the link an invite gives.
+
 How it works inside (grants, the gate, the routes, the audit trail):
 [internals/participants.md](internals/participants.md).
 

data/docs/guardrails.md

@@ -304,7 +304,9 @@ Built in, for a [participant's](internals/participants.md#turns) turns only (a
 turn whose author is `p:<id>`), in every mode (also with
 `guardrails.enabled: false`) and without the guardrails bundle:
 `Guardrails::ReviewBoundary`, rule `review-boundary`, source `core`. It comes
-first among the core checks, before the hooks' asks and the rules, and it
+right after the load-failure check (rules that don't load deny every call) and before the hooks' asks, the
+protected paths and the rules (`GuardrailWiring#checks`; a deny is sticky, so no later vote turns it into a
+question), and it
 **denies, never asks**: nobody on the participant's side may approve, and the
 owner's approval would give the participant's text the owner's tools. A
 participant's turn may call only the `review` kit's tools:
@@ -746,7 +748,11 @@ keep every guardrail. But an owner turn that says "do what Alex said" hands
 Alex's text the owner's tools: the model will act on it as the owner asked.
 That is the residual risk, documented rather than engineered away: on a
 session with sensitive tools, quote the proposal you want applied in your own
-turn instead.
+turn instead: the web's **Apply** under a review turn does that (it puts your
+line and the reply quoted line by line in your composer, for you to read and
+send; [internals/participants.md](internals/participants.md#apply)). A quote
+lowers the risk, it doesn't remove it: your line still asks the model to act
+on what it quotes, with your tools, so read the quote before you send it.
 
 Within its own turn a participant's text can't act: the review boundary
 leaves it reads of the project only, and an injection that convinces the

data/docs/internals/engine.md

@@ -424,7 +424,7 @@ The turn as the Engine sees it (the KernelLoop has its own `Turn` struct):
 Turn = Struct.new(:session, :prompt, :continue, :on_event, :controller, :origin, :started_at, :messages, :ended,
                   :settings, :id, :limit, :resumed, :resume_from) do
   def resumed? = resumed ? true : false                           # a step-limit Continue
-  def tag(event) = origin ? event.merge(origin: origin) : event   # boundary events carry the origin
+  def tag(event) = origin ? event.merge(origin: origin.to_h) : event   # boundary events carry the origin's wire Hash
   def elapsed = ...                                               # seconds since started_at
 end
 ```
@@ -519,11 +519,22 @@ Turn events (the main ones; `Events` in `events.rb` keeps the shared sets):
 | `:turn_failed` | an error | `{error_class, message, duration_ms, error_kind?, retryable?, host?, summary?}` |
 | `:answer_display` | after the after_turn hooks (observers only, not the sink) | `{display, refs?}` (display a string, or nil; refs the count of the answer's refs, only when a hook attached some) |
 
-The boundary events (`:turn_started`, `:turn_completed`, `:turn_canceled`, `:turn_failed`) also carry `origin`
-when the turn was queued with one: `{client_id:, enqueued_id:}`, plus `author:` when someone other than the session's
-owner wrote it (its input file's `author`, stamped by chi web from the request's `Web::Principal`). An owner's turn
-has no `author` anywhere: not in its input file, its origin or the session. `GuardrailWiring#begin_turn` gets the
-origin, and `#turn_author` reads its author for the gate's checks.
+A turn's origin is a `TurnOrigin` (`lib/samagotchi/turn_origin.rb`, a `Data.define` of `client_id`, `enqueued_id`
+and `author`): `SessionInbox.read_input` makes it from an input file's own fields, the wakes, reports and reminders
+make theirs, and `Engine#run_turn`, the Worker and `GuardrailWiring` pass it on. Its readers say what callers ask
+(`#participant?`, `#participant_author`, `#participant_id`, `#source` = `ClientId.origin`, `#human?` =
+`ClientId.human?`). At a boundary it is turned once: `#to_h` writes the wire Hash (only the fields set, as before),
+`TurnOrigin.from` reads a Hash back (symbol or string keys; nil for none). In-process an origin is never nil:
+`TurnOrigin.of` gives `TurnOrigin::NONE` (no sender: an owner's turn with no client) for nil or `{}`, and NONE is
+`run_turn(origin:)`'s default (a Hash is still read as one). NONE has no wire form (`#empty?`; `#wire` is nil, or
+`#to_h` for any other origin), so the events and the hooks' `context` carry no origin for it, as before.
+`LastTurn#author` stays the session file's string; `LastTurn#participant_author` reads it as
+`TurnOrigin#participant_author` does. The boundary events (`:turn_started`, `:turn_completed`, `:turn_canceled`, `:turn_failed`) also carry
+`origin` when the turn was queued with one: `{client_id:, enqueued_id:}`, plus `author:` when someone other than
+the session's owner wrote it (its input file's `author`, stamped by chi web from the request's `Web::Principal`).
+An owner's turn has no `author` anywhere: not in its input file, its origin or the session. `GuardrailWiring#begin_turn`
+gets the origin, and `#turn_author` reads its participant author for the gate's checks; the guardrails `Context`
+(the hooks' `context`) keeps the wire Hash.
 
 Where a participant's author (`"p:<id>"`; `Steer.participant_author?`: any author but none or `"owner"`) goes: