samagotchi 0.109.0 → 0.111.0

data/lib/samagotchi/web/app.rb

@@ -38,6 +38,7 @@ require_relative "../version"
 require_relative "../config"
 require_relative "../output_formatter"
 require_relative "../image_store"
+require_relative "../message_time"
 require_relative "../context_note"
 require_relative "../context_sources"
 require_relative "../context_providers"
@@ -59,6 +60,11 @@ require_relative "principal"
 require_relative "participant_access"
 require_relative "participants_admin"
 require_relative "participant_review"
+require_relative "message_display"
+require_relative "session_show"
+require_relative "session_create"
+require_relative "session_control"
+require_relative "push_routes"
 require_relative "proxy_gate"
 require_relative "../log"
 require_relative "../paths"
@@ -80,26 +86,16 @@ module Samagotchi
       include ParticipantAccess
       include ParticipantsAdmin
       include ParticipantReview
+      include MessageDisplay
+      include SessionShow
+      include SessionCreate
+      include SessionControl
+      include PushRoutes
       include ProxyGate
 
       DEFAULT_HOST = BridgeClient::HOST
       BRIDGE_WAIT_TIMEOUT = 10.0
-      # An uploaded image may be this big before it is downscaled.
-      MAX_IMAGE_UPLOAD_BYTES = 20 * 1024 * 1024
-      # A POST /api/render body may be this big: a decision message is a few
-      # KB, and the cap bounds the work a page can ask for.
-      MAX_RENDER_BYTES = 64 * 1024
       SESSION_ID_RE = /\A[0-9A-Za-z-]{1,64}\z/
-      IMAGE_NAME_RE = /\A[0-9a-f]{16}\.(png|jpe?g|gif|webp)\z/
-      IMAGE_TYPES = { "png" => "image/png", "jpg" => "image/jpeg", "jpeg" => "image/jpeg", "gif" => "image/gif",
-                      "webp" => "image/webp" }.freeze
-
-      # POST /stop waits this long for the worker to let go of the session
-      # when the body names no wait (the page's Stop: it shows the stop at
-      # once, and a Rack thread isn't held for it). A CLI through --remote
-      # sends its own, SessionManager::STOP_WAIT at most, so chi sessions
-      # stop waits as long as here.
-      STOP_WAIT_SECONDS = 2.0
 
       # GET /api/events: a `: ping` this often while idle, a queue this deep
       # per tab (an overflow ends the connection; the reconnect's snapshot
@@ -147,6 +143,8 @@ module Samagotchi
       #   (web.public_url, ProxyGate): every request needs a token
       # @param public_token [String, Token::Source, nil] the access token
       #   with +public_url+ (the LAN one when both are set)
+      # @param push [Push::Runtime, nil] Web Push for this run (PushRoutes);
+      #   nil: off (no https public_url, or web.push.enabled false)
       def initialize(manager: nil, session_class: nil, state_dir: nil, public_dir: nil,
                      bridge_wait_timeout: BRIDGE_WAIT_TIMEOUT, markdown: false, view: Config::BY_KEY["web.view"].default, hub: nil,
                      annotate_presets: Config::BY_KEY["web.annotate_presets"].default,
@@ -154,7 +152,7 @@ module Samagotchi
                      events_heartbeat: EVENTS_HEARTBEAT, events_queue: EVENTS_QUEUE,
                      registry: nil, models_wait_timeout: MODELS_WAIT_TIMEOUT, lan: nil,
                      working_set: Config::BY_KEY["web.working_set"].default, wait_poll_interval: ReplyWait::POLL_INTERVAL,
-                     grants: nil, public_url: nil, public_token: nil)
+                     grants: nil, public_url: nil, public_token: nil, push: nil)
         @manager = manager || SessionManager
         @registry = registry
         @registry_given = !registry.nil?
@@ -178,6 +176,7 @@ module Samagotchi
         @refused_mutex = Mutex.new
         @refused_logged = {}
         @wait_poll_interval = wait_poll_interval
+        @push = push
         init_participant_access(grants, state_dir)
         init_proxy_gate(public_url, public_token)
       end
@@ -269,6 +268,10 @@ module Samagotchi
         ["GET", %r{\A/api/sessions/([^/]+)/apply\z}, :handle_apply, :owner, :session],
         ["GET", %r{\A/api/participants\z}, :handle_participants_list, :owner],
         ["DELETE", %r{\A/api/participants\z}, :handle_participants_revoke, :owner],
+        ["GET", %r{\A/api/push\z}, :handle_push_info, :owner],
+        ["POST", %r{\A/api/push/subscriptions\z}, :handle_push_subscribe, :owner],
+        ["DELETE", %r{\A/api/push/subscriptions\z}, :handle_push_unsubscribe, :owner],
+        ["POST", %r{\A/api/push/test\z}, :handle_push_test, :owner],
         ["GET", %r{\A/api/sessions/([^/]+)\z}, :handle_show, :participant, :session],
         ["DELETE", %r{\A/api/sessions/([^/]+)\z}, :handle_delete, :owner, :session]
       ].freeze
@@ -404,7 +407,13 @@ module Samagotchi
       # form) for the cookie.
       TOKEN_TRADE_PATH = "/api/token"
       TRADE_BODY_LIMIT = 4096
-      GATE_FREE_PATHS = ["/token_fragment.js"].freeze
+      # Exact paths served before the token gate (still after the Host,
+      # cross-site and frame checks), none holding a secret: the 401 page's
+      # fragment trade script, and what a Home Screen app fetches without
+      # the cookie (Chrome fetches a manifest without credentials): the
+      # manifest, the service worker and the icons (Web Push).
+      GATE_FREE_PATHS = ["/token_fragment.js", "/manifest.webmanifest", "/sw.js", "/apple-touch-icon.png",
+                         "/icons/chi-180.png", "/icons/chi-192.png", "/icons/chi-512.png"].freeze
 
       # The request's Principal, as #route resolved it.
       def principal(req) = req.env.fetch(PRINCIPAL_ENV)
@@ -975,756 +984,6 @@ module Samagotchi
         n.positive? ? n : 0
       end
 
-      def handle_create(req)
-        body = parse_json(request_body(req))
-        unless body.is_a?(Hash)
-          return error_response(400, "invalid_json", "invalid JSON body")
-        end
-
-        prompt = body["prompt"] || body[:prompt]
-        # idle: a session with no first turn, for a first message with
-        # images (the page uploads them into it, then sends the turn).
-        idle = body["idle"] == true
-        review, error = request_review(body)
-        return error if error
-        return handle_review_fork(body, review) if review&.from
-
-        if prompt.to_s.strip.empty? && !idle && !review
-          return error_response(400, "missing_fields", "prompt is required")
-        end
-        return handle_continue(body, prompt, idle) if body.key?("continues")
-
-        # dir: the folder the chat starts in (the page's scope); without it,
-        # the server's own cwd.
-        dir, error = scope_dir(body["dir"])
-        return error if error
-
-        # llm_context: the session's own LLM context values before its first
-        # turn (the start page's llm ctx chip; chi --llm-context), read
-        # before anything spawns so a bad one spawns nothing.
-        llm_context, error = request_llm_context(body["llm_context"])
-        return error if error
-
-        # thinking: the session's own thinking level (the start page's think
-        # chip; chi --thinking), checked the same way.
-        thinking, error = request_thinking(body["thinking"])
-        return error if error
-
-        # settings: the session's own settings, flat as chi --set names
-        # them ({"recap.enabled" => false, "cost-cap.cap" => 3}), checked
-        # the same way (SessionConfig.from_request).
-        begin
-          settings = SessionConfig.from_request(body["settings"])
-        rescue SessionConfig::Error => e
-          return error_response(400, "invalid_settings", e.message)
-        end
-
-        # toolkit, tools, no_tools: its toolkit (chi send --new --toolkit,
-        # --tool, --no-tool: a name, tool names added and left out);
-        # parent_answers: what a parent agent may answer on its questions
-        # (hard, standard or soft; a looser one than config.yml's is capped,
-        # and the 201's parent_answers_warning says so).
-        toolkit, error = request_toolkit(body)
-        return error if error
-
-        parent_answers, error = request_parent_answers(body["parent_answers"])
-        return error if error
-
-        model = (body["model"] || body["model_name"]).to_s.strip
-        refused = create_refusal(body, idle ? body["preview"] : prompt, values: [parent_answers], model: model)
-        return refused if refused
-
-        folder = dir ? { working_directory: dir } : {}
-        # model: the model the session starts on (the start page's picker,
-        # spelled as GET /api/models lists it); blank means the default.
-        folder[:model_name] = model unless model.empty?
-        # preview: an idle session's first message, sent as its first turn
-        # next; the list and the notifications name the session by it
-        # until that turn is saved.
-        preview = idle ? body["preview"].to_s.strip : ""
-        folder[:preview] = preview unless preview.empty?
-        setup = SessionSetup.new(llm_context: llm_context, thinking: thinking, settings: settings, toolkit: toolkit,
-                                 parent_answers: parent_answers)
-        folder[:setup] = setup unless setup.empty?
-        begin
-          session = if review
-                      ReviewStart.start(subjects: review.subjects, dir: dir || Dir.pwd, model: folder[:model_name],
-                                        setup: setup, state_dir: @state_dir)
-                    else
-                      @manager.spawn_session(prompt: idle ? nil : prompt.to_s, state_dir: @state_dir, **folder)
-                    end
-        rescue ModelProfile::MissingModel => e
-          # No model configured, or one qualified with an unknown host.
-          return error_response(400, "invalid_model", e.message)
-        rescue ReviewStart::Refused => e
-          return error_response(400, "invalid_review", e.message)
-        end
-        # The worker's Bridge is the single live transport: wait (bounded) for
-        # it so the client can attach without client-side polling.
-        port = await_bridge_port(session.id)
-        # The projection holds it before the page hears back (no tick wait).
-        @hub&.touch(session.id)
-        record_history(body, prompt) if !idle && PromptHistory.shell_line?(prompt.to_s.strip)
-        json_response(201, session_to_json(session).merge(bridge_port: port, model_warning: session.model_warning,
-                                                          parent_answers_warning: Guardrails::ParentPolicy.capped_note(parent_answers)))
-      end
-
-      # POST /api/sessions with continues: <id, prefix or last:id>: the next
-      # link of that session's chain (SessionManager.continue_session), in its
-      # folder and with its own setup (SessionSetup: llm_context, thinking
-      # and reasoning_history levels, settings), so dir, llm_context, thinking and settings are
-      # refused beside it (a create takes no reasoning_history). It runs on
-      # model (or model_name) when given, else on the previous link's: one
-      # whose host is gone falls back to the default, and the 201's
-      # model_warning (null when none) says so. Its opener is the text the
-      # page prefills (SessionChain.opener_for; null: the page's constant).
-      # A model it can't start on is 400 invalid_model, nothing archived.
-      # 409 continued (with next_id, the link that continues it already: the
-      # page opens that one), open_children (ids), folder_gone, busy, scratch
-      # or owned_by_tui.
-      def handle_continue(body, prompt, idle)
-        given = body["continues"]
-        unless given.is_a?(String) && !given.strip.empty?
-          return error_response(400, "invalid_continues", "continues is a session id")
-        end
-        if (fields = CONTINUE_TAKES.select { |key| body.key?(key) }).any?
-          return error_response(400, "invalid_continues",
-                                "continues takes the previous session's folder, llm_context, thinking, toolkit, " \
-                                "settings and parent_answers; leave out #{fields.join(", ")}")
-        end
-
-        preview = idle ? body["preview"].to_s.strip : ""
-        model = (body["model"] || body["model_name"]).to_s.strip
-        refused = continue_refusal(given, body, idle ? body["preview"] : prompt, model: model)
-        return refused if refused
-
-        session, error = continue_from(given, prompt: idle ? nil : prompt.to_s, preview: preview.empty? ? nil : preview,
-                                              model: model.empty? ? nil : model)
-        return error if error
-
-        port = await_bridge_port(session.id)
-        moved = session.moved_children || []
-        # The moved delegates' cards fold under the new link now.
-        [session.continues, session.id, *moved].each { |sid| @hub&.touch(sid) }
-        record_history(body, prompt) if !idle && PromptHistory.shell_line?(prompt.to_s.strip)
-        json_response(201, session_to_json(session).merge(bridge_port: port, moved: moved,
-                                                          model_warning: session.model_warning,
-                                                          opener: session.opener))
-      end
-
-      # The create's review: {subjects: [paths], from: id} (chi review, the
-      # page's Start review) as a SessionAccess::Review: [review, nil] (nil
-      # when absent), or [nil, a 400 invalid_review]. A review session
-      # starts idle: prompt, preview, idle and continues are refused beside
-      # it. Its subjects are checked where it starts (ReviewStart).
-      def request_review(body)
-        return [nil, nil] unless body.key?("review")
-
-        raw = body["review"]
-        subjects = raw.is_a?(Hash) ? raw.fetch("subjects", []) : nil
-        from = raw.is_a?(Hash) ? raw["from"] : nil
-        unless subjects.is_a?(Array) && subjects.all?(String) && (from.nil? || (from.is_a?(String) && !from.strip.empty?))
-          return [nil, error_response(400, "invalid_review", "review is {subjects: [project files], from: a session id}")]
-        end
-        if (fields = REVIEW_REFUSES.select { |key| body.key?(key) }).any?
-          return [nil, error_response(400, "invalid_review", "a review session starts idle; leave out #{fields.join(", ")}")]
-        end
-
-        [SessionAccess::Review.new(subjects: subjects, from: from&.strip), nil]
-      end
-
-      # What a review session's create refuses beside review.
-      REVIEW_REFUSES = %w[prompt preview idle continues].freeze
-
-      # POST /api/sessions with review.from: a review fork of that session
-      # (ReviewStart.fork), in its folder and with its setup (dir and the
-      # setup fields refused beside it, as for a continue), on model when
-      # given. 201 as a create's; 400 invalid_review (a subject, its folder
-      # gone), invalid_model, ambiguous_id; 404 not_found.
-      def handle_review_fork(body, review)
-        if (fields = CONTINUE_TAKES.select { |key| body.key?(key) }).any?
-          return error_response(400, "invalid_review",
-                                "a review of a session takes its folder and setup; leave out #{fields.join(", ")}")
-        end
-
-        model = (body["model"] || body["model_name"]).to_s.strip
-        begin
-          session = ReviewStart.fork(from: review.from, subjects: review.subjects, model: model.empty? ? nil : model,
-                                     state_dir: @state_dir)
-        rescue ReviewStart::Refused => e
-          return error_response(400, "invalid_review", e.message)
-        rescue ModelProfile::MissingModel => e
-          return error_response(400, "invalid_model", e.message)
-        rescue Session::AmbiguousId => e
-          return refusal_response(400, "ambiguous_id", e, ids: e.ids)
-        rescue ArgumentError => e
-          return error_response(404, "not_found", e.message)
-        end
-        port = await_bridge_port(session.id)
-        @hub&.touch(session.id)
-        json_response(201, session_to_json(session).merge(bridge_port: port, model_warning: session.model_warning))
-      end
-
-      # chi send's client ids: its lines are checked as chi send checks them
-      # (#parent_gate).
-      CLI_SEND_IDS = [ClientId::CLI_SEND, ClientId::CLI_ANSWER].freeze
-
-      # What a continue takes from the previous link: refused beside it.
-      CONTINUE_TAKES = %w[dir llm_context thinking settings toolkit tools no_tools parent_answers].freeze
-
-      # The previous link's parent_answers and the model the new one runs,
-      # for #create_refusal; nil when the previous link isn't there
-      # (continue_from says so).
-      def continue_refusal(given, body, line, model:)
-        return nil unless body["check_vision"] == true || CLI_SEND_IDS.include?(body["client_id"])
-
-        previous = Session.load(SessionChain.resolve(given, state_dir: default_state_dir), state_dir: default_state_dir)
-        create_refusal(body, line, values: [previous.parent_answers], model: model, previous: previous)
-      rescue ArgumentError, ModelProfile::MissingModel
-        nil
-      end
-
-      # A create refused before anything spawns, as chi send --new refuses
-      # it (SendCommand::ParentGate, the vision check): its first line
-      # (+line+, the prompt or an idle one's preview) when it is a parent
-      # agent's /continue yes or a /parent-answers that loosens +values+
-      # (#parent_gate), and with check_vision: true (its first message
-      # brings images) a model known not to take them (422 no_vision).
-      # @param previous [Session, nil] a continue's previous link: its model
-      #   decides when +model+ is blank
-      # @return [Array, nil] the response, or nil to go on
-      def create_refusal(body, line, values:, model:, previous: nil)
-        refused = parent_gate(line, client_id: body["client_id"], values: values)
-        return refused if refused
-        return nil unless body["check_vision"] == true
-
-        name, typed = if previous
-                        SendCommand.continued_model(previous, model)
-                      else
-                        [model.empty? ? nil : model, nil]
-                      end
-        vision_refused(name, typed)
-      end
-
-      # A line from chi send (client_id cli:send, or cli:answer for a parent
-      # agent's /continue yes) refused here as chi send refuses it on its own
-      # machine (SendCommand::ParentGate), held to this server's config.yml:
-      # a parent's /continue yes that guardrails.parent_answers (tightened by
-      # +values+, the targets' own parent_answers) refuses, 403
-      # parent_continue_refused; a /parent-answers line that loosens one of
-      # +values+, 403 parent_answers_refused (loosening is the user's at a
-      # UI). The page's lines (web:…) and others aren't checked here; the
-      # worker checks every line again.
-      # @return [Array, nil] the response, or nil to go on
-      def parent_gate(line, client_id:, values:)
-        line = line.to_s
-        return nil unless CLI_SEND_IDS.include?(client_id)
-
-        if client_id == ClientId::CLI_ANSWER && TurnFlow.continue_yes?(line) &&
-           (refusal = SendCommand::ParentGate.continue_refusal_for(values))
-          return error_response(403, "parent_continue_refused", refusal)
-        end
-        return nil unless SendCommand::ParentGate.loosens_any?(line, values)
-
-        error_response(403, "parent_answers_refused", ParentAnswersCommand::REFUSED)
-      end
-
-      # 422 no_vision in chi send's words when the model (+name+, nil: the
-      # default) is known not to take images; nil when it does or is
-      # unknown (the worker decides when the turn runs).
-      def vision_refused(name, typed)
-        refusal = SendCommand.vision_refusal(name, SendCommand.vision_answer(name, typed: typed))
-        refusal && error_response(422, "no_vision", refusal)
-      end
-
-      # The create request's toolkit (a name), tools and no_tools (names, a
-      # comma list each too), as chi send --new's --toolkit, --tool and
-      # --no-tool: [toolkit, nil] (nil for none), or [nil, a 400 response].
-      def request_toolkit(body)
-        name = body["toolkit"]
-        lists = %w[tools no_tools].to_h { |key| [key, body[key]] }
-        unless (name.nil? || name.is_a?(String)) &&
-               lists.values.all? { |list| list.nil? || (list.is_a?(Array) && list.all?(String)) }
-          return [nil, error_response(400, "invalid_toolkit", "toolkit is a name; tools and no_tools are lists of names")]
-        end
-
-        [Toolkit.from_flags(name: name, add: lists["tools"] || [], remove: lists["no_tools"] || []), nil]
-      end
-
-      # The create request's parent_answers (hard, standard or soft;
-      # "default" or none: config.yml's): [level, nil] or [nil, a 400].
-      def request_parent_answers(raw)
-        return [nil, nil] if raw.nil?
-
-        level = raw.is_a?(String) ? Guardrails::ParentPolicy.parse_level(raw) : :invalid
-        return [nil, nil] if level == :unset
-        unless Guardrails::ParentPolicy::ORDER.include?(level)
-          return [nil, error_response(400, "invalid_parent_answers",
-                                      "parent_answers takes #{Guardrails::ParentPolicy::ORDER.join(", ")}")]
-        end
-
-        [level, nil]
-      end
-
-      # SessionManager.continue_session, its refusals as responses: [session,
-      # nil] or [nil, the response]. Only its own errors: what fails after
-      # the new link started is not a refusal of it.
-      def continue_from(given, prompt:, preview:, model:)
-        [@manager.continue_session(given, prompt: prompt, preview: preview, model: model, state_dir: @state_dir), nil]
-      rescue SessionContinue::Refused => e
-        extra = e.reason == :continued ? { next_id: e.ids.first } : {}
-        [nil, refusal_response(409, e.reason.to_s, e, session_id: e.session_id, reason: e.reason.to_s, ids: e.ids, **extra)]
-      rescue SessionManager::ArchiveRefused => e
-        [nil, archive_refused(e)]
-      rescue SessionManager::OwnedByTUI => e
-        [nil, owned_by_repl(given, e)]
-      rescue ModelProfile::MissingModel => e
-        [nil, error_response(400, "invalid_model", e.message)]
-      rescue Session::AmbiguousId => e
-        [nil, refusal_response(400, "ambiguous_id", e, ids: e.ids)]
-      rescue ArgumentError => e
-        [nil, error_response(404, "not_found", e.message)]
-      end
-
-      # The create request's "llm_context" ({strategy:, apply:, budget:},
-      # each a word as /llm-context takes it, "default" for unset) as an
-      # override: [override, nil] (nil when absent or all default), or
-      # [nil, a 400 response] for anything else.
-      def request_llm_context(raw)
-        return [nil, nil] if raw.nil?
-
-        fields = LLMContextOverride::COMMAND_WORDS.invert
-        unless raw.is_a?(Hash) && raw.all? { |key, word| fields.key?(key) && word.is_a?(String) }
-          return [nil, error_response(400, "invalid_llm_context",
-                                      "llm_context is an object of #{fields.keys.join(", ")} words")]
-        end
-
-        override = LLMContextOverride.update(nil, raw.to_h { |key, word| [fields.fetch(key), word] })
-        [override.empty? ? nil : override, nil]
-      rescue ArgumentError => e
-        [nil, error_response(400, "invalid_llm_context", e.message)]
-      end
-
-      # The create request's "thinking" (a level word as /thinking takes it,
-      # "default" for none) as the session's own level: [level, nil] (nil
-      # when absent or default), or [nil, a 400 response] for anything else.
-      def request_thinking(raw)
-        return [nil, nil] if raw.nil?
-
-        word = raw.is_a?(String) ? raw.strip.downcase : nil
-        unless word && Thinking::LEVELS.map(&:to_s).include?(word)
-          return [nil, error_response(400, "invalid_thinking", "thinking is one of #{Thinking::LEVELS.join(", ")}")]
-        end
-
-        [Thinking.session_level(word), nil]
-      end
-
-      def handle_show(req, id)
-        return participant_show(id) unless principal(req).owner?
-
-        # The page's light re-reads: never the whole conversation.
-        return handle_cards_read(id) if req.params["cards"] == "1"
-        return handle_tail_read(req, id) if req.params["tail"] == "1"
-        return handle_timing_read(id) if req.params["timing"] == "1"
-        return handle_brief_read(id) if req.params["brief"] == "1"
-
-        session = @session_class.load(id, state_dir: default_state_dir)
-        # Read-only preview: selecting a session never spawns a worker.
-        # The worker is woken only on POST /turn (handle_turn) via
-        # SessionManager.resume_session + write_turn_input. This avoids
-        # replaying last_prompt and spamming workers on preview scrub.
-        # last_event_seq is nil when no live bridge, so the frontend stays
-        # silent until the first Send.
-        #
-        # A live worker's snapshot is the truth (the session file lags its
-        # Engine): the messages, the turn in progress and the prompts queued
-        # behind it, all at one event_seq the client streams on from.
-        live = bridge_get_json(id, "snapshot")
-        turn_snapshot = live && live["snapshot"]
-        snapshot = live && live["session_state_snapshot"]
-        last_event_seq = live_or_saved(snapshot, "event_seq") { bridge_event_seq(id) }
-        current_turn = turn_snapshot && turn_snapshot["current_turn"]
-        owner = session_owner(id)
-        pending = shown_pending_question(session, turn_snapshot, owner)
-        # What the worker's server said it served for that model (after a turn);
-        # without a worker, what the session's analytics.json last saved.
-        persisted = snapshot ? nil : read_analytics(id)
-        session_json = shown_session_json(session, snapshot, owner, persisted)
-        raw_messages = live_or_saved(turn_snapshot, "messages") { session.messages }
-        timing = timing_payload(id, live_metrics: snapshot && snapshot["metrics"], persisted: persisted)
-        json_response(200, {
-          session: session_json,
-          history: read_history(id),
-          messages: messages_for_display(raw_messages, parts: req.params["parts"] == "1",
-                                                       cwd: session.working_directory),
-          failed_turn: failed_turn_for(session, raw_messages),
-          current_turn: current_turn,
-          queued: snapshot_list(turn_snapshot, "queued"),
-          # Commands waiting for the running turn's end (their bubbles).
-          queued_commands: snapshot_list(turn_snapshot, "queued_commands"),
-          recap: turn_snapshot && turn_snapshot["recap"],
-          saved_recap: saved_recap_for(id, session, turn_snapshot),
-          continue_offer: turn_snapshot && turn_snapshot["continue_offer"],
-          guardrail_warning: turn_snapshot && turn_snapshot["guardrail_warning"],
-          plugin_warning: turn_snapshot && turn_snapshot["plugin_warning"],
-          # Plugins' slow setup still running (chi.init): the page's init row.
-          init_tasks: snapshot_list(turn_snapshot, "init_tasks"),
-          cards: cards_for_display(live_or_saved(turn_snapshot, "cards") { saved_cards(id) }, cwd: session.working_directory),
-          # The composer's / autocomplete; the built-ins until a worker
-          # names its plugins' too.
-          commands: turn_snapshot&.fetch("commands", nil) || SessionCommands.builtin_registry.listing,
-          markdown_warning: @markdown_renderer.warning,
-          **viewer_capabilities(req),
-          pending_question: pending,
-          last_event_seq: last_event_seq,
-          # The stream cursor `<seq>-<epoch>`: a later worker resets it
-          # instead of taking the seq as its own. Only the snapshot has it.
-          last_event_id: turn_snapshot && turn_snapshot["event_id"],
-          timing: timing
-        })
-      end
-
-      # A list in the worker's turn +snapshot+ (queued prompts, commands,
-      # init tasks); [] without a worker.
-      def snapshot_list(snapshot, key) = Array(snapshot&.[](key))
-
-      # A live worker's +key+ as its reading (+live+: a snapshot, a tail)
-      # says it, nil included; without a worker (+live+ nil) the block's,
-      # the server's own reading of the saved session. A nil value from a
-      # worker is not a missing one (contrast SessionSetting#snapshot_value's
-      # :or).
-      def live_or_saved(live, key)
-        live ? live[key] : yield
-      end
-
-      # The file's question only while a worker owns the session: one a
-      # dead worker saved can't be answered (its turn is gone), nor a chi
-      # REPL's (it shares nothing with the web).
-      # A question between turns (the step-limit one) is the snapshot's own.
-      # Its refs (the asking reply's, QuestionAsked) are checked again.
-      def shown_pending_question(session, turn_snapshot, owner)
-        pending = if turn_snapshot
-                    current_turn = turn_snapshot["current_turn"]
-                    current_turn ? current_turn["pending_question"] : turn_snapshot["pending_question"]
-                  elsif owner&.worker?
-                    session.pending_question&.to_h
-                  end
-        with_question_refs(pending, cwd: session.working_directory)
-      end
-
-      # A pending question (a snapshot's, the session file's or a saved
-      # card's) with its refs checked again, under a question's caps
-      # (QuestionAsked): a stored file is never trusted, and what isn't
-      # valid any more is dropped. The question as it was without refs.
-      def with_question_refs(pending, cwd:)
-        return pending unless pending.is_a?(Hash)
-
-        key = [:refs, "refs"].find { |name| pending.key?(name) } or return pending
-        refs = Samagotchi::AnswerRefs.for_display(pending[key], cwd: cwd, max_refs: Samagotchi::QuestionAsked::MAX_REFS,
-                                                                max_bytes: Samagotchi::QuestionAsked::MAX_BYTES)
-        refs.empty? ? pending.except(key) : pending.merge(key => refs)
-      end
-
-      # The full show's session part: the file's, with what a live worker's
-      # state +snapshot+ knows first (its model, status, served model,
-      # prompt notes and chips); without one, the served model from
-      # +persisted+ (analytics.json). Sets a worker's model on +session+:
-      # a /model in the worker changes it before the file catches up.
-      def shown_session_json(session, snapshot, owner, persisted)
-        session.model_name = snapshot["model_name"] if snapshot && !snapshot["model_name"].to_s.empty?
-        session_json = session_to_json(session, status: displayed_status(session, snapshot, owner: owner), owner: owner)
-        if snapshot
-          session_json = session_json.merge(served_model: snapshot["served_model"], served_model_for: snapshot["served_model_for"],
-                                            served_expected_by: snapshot["served_expected_by"])
-          # The model notes its prompt carries now (a /model there changes them).
-          session_json = session_json.merge(prompt_notes: snapshot["prompt_notes"]) if snapshot["prompt_notes"].is_a?(Array)
-        else
-          session_json = session_json.merge(saved_served_model(session, persisted))
-        end
-        # The per-session settings' chips (the info bar's llm ctx, think,
-        # reasoning and tools): the worker's, else worked out here from the
-        # session file (SessionSetting#snapshot_value, #saved_summary).
-        SessionSetting::ALL.each do |setting|
-          chip = setting.snapshot_value(snapshot) { setting.saved_summary(session, registry: host_registry) }
-          session_json = session_json.merge(setting.key => chip)
-        end
-        session_json
-      end
-
-      # ?cards=1: the page's re-read when a card arrives, for its rendered
-      # body (the stream carries the card's plain text only). The worker's
-      # cards from its light GET tail, else the saved ones; the session file
-      # is only stat'ed (the 404), never parsed.
-      def handle_cards_read(id)
-        return error_response(404, "not_found", "Session not found: #{id}") unless session_exists?(id)
-
-        tail = live_tail(id)
-        json_response(200, { cards: cards_for_display(live_or_saved(tail, "cards") { saved_cards(id) }) })
-      end
-
-      # ?tail=1: the page's re-read at the end of a turn wants the final
-      # answer's rendered markdown, the status and the timing, not the whole
-      # history again (nor a render of every earlier answer). Live: the
-      # worker's GET tail alone (no session file read); else the file. The
-      # session part is what the page reads of it (id, status, used memory
-      # names, the model notes its prompt carried: the first turn's build or
-      # a /model records them). ?turn_id=: that turn's answer (a queued
-      # turn's page re-reads after the next one started). The timing's records
-      # are the newest turn's (#recent_timing), which the page merges by id
-      # (the page still sends ?recent=1, which is accepted and not needed).
-      def handle_tail_read(req, id)
-        return error_response(404, "not_found", "Session not found: #{id}") unless session_exists?(id)
-
-        turn_id = req.params["turn_id"].to_s.strip
-        turn_id = nil if turn_id.empty?
-        tail = live_tail(id, turn_id: turn_id)
-        state = tail && tail["session_state_snapshot"]
-        state = nil unless state.is_a?(Hash)
-        if state
-          status, used, notes = state.values_at("status", "used_memory_names", "prompt_notes")
-          answer = tail["answer"]
-          cwd = tail_working_directory(id, tail, answer)
-          answer = without_file_refs(answer) unless cwd
-          messages = last_assistant_for_display([answer].compact, cwd: cwd)
-        else
-          session = @session_class.load(id, state_dir: default_state_dir)
-          status = displayed_status(session)
-          used = session.used_memory_names
-          notes = session.prompt_notes.map(&:to_h)
-          messages = last_assistant_for_display(session.messages, turn_id: turn_id, cwd: session.working_directory)
-        end
-        session_json = { id: id, status: status, used_memory_names: Array(used), prompt_notes: Array(notes) }
-        live_metrics = state && state["metrics"]
-        timing = recent_timing(id, live_metrics)
-        json_response(200, {
-          tail: true,
-          session: session_json,
-          messages: messages,
-          markdown_warning: @markdown_renderer.warning,
-          **viewer_capabilities(req),
-          timing: timing
-        })
-      end
-
-      # The folder the live tail's answer's file refs must stay under: the
-      # worker's (its tail's working_directory), else the hub's session list
-      # entry's (a worker from before the field, or read through its
-      # snapshot), else, only when the answer has refs to check, the session
-      # file's, as the full read takes it. nil when none is known: the
-      # caller drops the file refs rather than show them unchecked.
-      # @return [String, nil]
-      def tail_working_directory(id, tail, answer)
-        known = ->(dir) { dir.is_a?(String) && !dir.empty? }
-        cwd = tail["working_directory"]
-        cwd = @hub&.working_directory(id) unless known.call(cwd)
-        return cwd if known.call(cwd)
-        return nil unless answer.is_a?(Hash) && (answer[AnswerRefs::KEY.to_s] || answer[AnswerRefs::KEY])
-
-        cwd = @session_class.load(id, state_dir: default_state_dir).working_directory
-        known.call(cwd) ? cwd : nil
-      rescue ArgumentError, KeyError, SystemCallError
-        nil
-      end
-
-      # +answer+ without its file refs (the rest kept), for a read that
-      # knows no folder to check them against.
-      def without_file_refs(answer)
-        return answer unless answer.is_a?(Hash)
-
-        key = [AnswerRefs::KEY.to_s, AnswerRefs::KEY].find { |name| answer[name].is_a?(Array) } or return answer
-        answer.merge(key => answer[key].reject { |ref| ref.is_a?(Hash) && (ref["kind"] || ref[:kind]).to_s == Ref::FILE })
-      end
-
-      # ?timing=1: the whole timing (every record, analytics.json merged with
-      # the live ones) and turn_count, when the page's merge comes up short.
-      # The worker's GET state, never its messages.
-      def handle_timing_read(id)
-        return error_response(404, "not_found", "Session not found: #{id}") unless session_exists?(id)
-
-        state = bridge_get_json(id, "state")
-        json_response(200, { timing: timing_payload(id, live_metrics: state && state["session_state_snapshot"]&.fetch("metrics", nil)) })
-      end
-
-      def session_exists?(id)
-        @session_class.exist?(id, state_dir: default_state_dir)
-      rescue ArgumentError
-        false
-      end
-
-      # The worker's light read (Bridge GET tail): {"session_state_snapshot",
-      # "working_directory", "answer", "cards", "event_seq", "event_id"}. A
-      # worker from before the route answers 404 not_found: its GET snapshot,
-      # in the same shape (the answer by AnswerTail; no working_directory). Anything else (no worker, a refused connect, a
-      # 500, a timeout) is nil: the caller reads the disk, with no second
-      # try at a worker that failed once.
-      # @return [Hash, nil]
-      def live_tail(id, turn_id: nil)
-        status, body = bridge_get(id, turn_id ? "tail?turn_id=#{URI.encode_www_form_component(turn_id)}" : "tail")
-        return body if status == 200 && body.is_a?(Hash)
-        return nil unless status == 404 && body.is_a?(Hash) && body["error"] == "not_found"
-
-        status, live = bridge_get(id, "snapshot")
-        return nil unless status == 200 && live.is_a?(Hash) && live["snapshot"].is_a?(Hash)
-
-        snap = live["snapshot"]
-        { "session_state_snapshot" => live["session_state_snapshot"],
-          "answer" => AnswerTail.find(snap["messages"], turn_id: turn_id),
-          "cards" => snap["cards"], "event_seq" => snap["event_seq"], "event_id" => snap["event_id"] }
-      end
-
-      # The worker's last cards and between-turns notices (Bridge
-      # cards: CardStore#list), else (no live worker) the ones the last
-      # worker saved in the session's folder (#saved_cards), a card's body as
-      # body_html: rendered markdown when the renderer is on, else the
-      # escaped text in a <pre>, and a question card's refs checked again
-      # (#with_question_refs; +cwd+ the session's folder, nil where the
-      # session file isn't read: a file ref then stays only absolute).
-      # @return [Array<Hash>]
-      def cards_for_display(cards, cwd: nil)
-        Array(cards).filter_map do |card|
-          next unless card.is_a?(Hash)
-          if card["type"].to_s == "question" && card["pending_question"].is_a?(Hash)
-            next card.merge("pending_question" => with_question_refs(card["pending_question"], cwd: cwd))
-          end
-          next card unless card["type"].to_s == "card"
-
-          card.merge("body_html" => card_body_html(card["body"].to_s))
-        end
-      end
-
-      # As JSON has them (string keys and values), like a snapshot's.
-      def saved_cards(id)
-        JSON.parse(JSON.generate(Samagotchi::Bridge::CardStore.saved(Session.session_dir(id, state_dir: default_state_dir))))
-      rescue StandardError
-        []
-      end
-
-      def card_body_html(body)
-        return "" if body.strip.empty?
-
-        html = @markdown_renderer.render(body) if @markdown_renderer.available?
-        html || "<pre>#{CGI.escapeHTML(body)}</pre>"
-      end
-
-      # POST /api/render {text}: the page's markdown read for a text it
-      # already shows (the stage's asking text, a resolved question card's
-      # reply), session-free. {html: nil} when markdown is off or
-      # commonmarker is missing: the page keeps the raw text.
-      def handle_render(req)
-        too_large = error_response(413, "too_large", "a text to render may be up to #{MAX_RENDER_BYTES / 1024} KB")
-        return too_large if req.content_length.to_i > MAX_RENDER_BYTES
-
-        raw = request_body(req, MAX_RENDER_BYTES + 1).to_s
-        return too_large if raw.bytesize > MAX_RENDER_BYTES
-
-        body = parse_json(raw)
-        return error_response(400, "invalid_json", "give {text}") unless body.is_a?(Hash) && body["text"].is_a?(String)
-
-        html = @markdown_renderer.render(body["text"]) if @markdown_renderer.available?
-        json_response(200, { html: html })
-      end
-
-      def handle_question_answer(req, id)
-        session = @session_class.load(id, state_dir: default_state_dir) rescue nil
-        return error_response(404, "not_found", "Session not found: #{id}") unless session
-
-        body = parse_json(request_body(req))
-        return error_response(400, "invalid_json", "invalid JSON body") unless body.is_a?(Hash)
-
-        qid = body["id"]
-        return error_response(400, "missing_fields", "id is required") if qid.to_s.strip.empty?
-
-        # client_id: only chi answer's (a parent agent's answer, which the
-        # worker holds to its guardrails.parent_answers) is passed on; any
-        # other is dropped, so a forward can only tighten (an answer never
-        # passes for the user's own by it).
-        client_id = body["client_id"] == ClientId::CLI_ANSWER ? ClientId::CLI_ANSWER : nil
-        request = once_more_on_late do |client|
-          client.answer(id: qid, selected: body["selected"], freeform: body["freeform"], client_id: client_id)
-        end
-        relay(id, bridge_client(id), request, what: "the answer was not sent", cant: "answer questions") do |reply|
-          case reply.status
-          when 200 then json_response(200, { status: "answered", session_id: id, id: qid })
-          # Another client answered first (or the question was cancelled).
-          when 409 then error_response(409, "question_not_pending", reply_detail(reply, "question not pending"))
-          when 400 then error_response(400, "invalid_answer", reply_detail(reply, "answer rejected"))
-          # The worker's guardrails.parent_answers refused a parent's option.
-          when 403 then json_response(403, { error: "parent_answer_refused", reason: reply.json&.dig("reason"),
-                                             detail: reply_detail(reply, "the worker refused that option") })
-          end
-        end
-      end
-
-      # A request to the worker sent once more when the worker dropped it as
-      # past its deadline (408), as chi answer does on this machine
-      # (SessionAccess::Local#answer); a second 408 is #relay's 504
-      # worker_timeout. The question stays open either way.
-      def once_more_on_late
-        lambda do |client|
-          reply = yield client
-          reply.status == 408 ? yield(client) : reply
-        end
-      end
-
-      # Leave the pending question unanswered (the card's Dismiss). A question
-      # only exists while its worker waits on it, so this needs a live bridge.
-      def handle_question_dismiss(req, id)
-        body = parse_json(request_body(req))
-        return error_response(400, "invalid_json", "invalid JSON body") unless body.is_a?(Hash)
-
-        qid = body["id"].to_s
-        return error_response(400, "missing_fields", "id is required") if qid.strip.empty?
-
-        request = once_more_on_late { |client| client.dismiss_question(id: qid) }
-        relay(id, bridge_client(id), request, what: "the question was not dismissed", cant: "dismiss questions") do |reply|
-          case reply.status
-          when 200 then json_response(200, { status: "dismissed", session_id: id, id: qid })
-          when 409
-            # The step-limit question can't be left unanswered.
-            code = reply.json&.dig("error") == "not_dismissable" ? "not_dismissable" : "question_not_pending"
-            error_response(409, code, reply_detail(reply, "question not pending"))
-          end
-        end
-      end
-
-      # A session command typed in the composer (/model, /models, !rollback,
-      # !cmd, /continue): the worker runs it (woken as for a turn) and every
-      # UI gets its :command_ran. Needs the worker's Bridge.
-      def handle_command(req, id)
-        body = parse_json(request_body(req))
-        return error_response(400, "invalid_json", "invalid JSON body") unless body.is_a?(Hash)
-
-        line = body["line"].to_s.strip
-        return error_response(400, "missing_fields", "line is required") if line.empty?
-
-        @manager.resume_session(id, state_dir: @state_dir)
-        # card: a card's action; its command events say so (no echo).
-        request = ->(client) { client.post_command(line: line, client_id: body["client_id"], card: body["card"] == true) }
-        relay(id, live_bridge_client(id), request, what: "the command was not run", cant: "run commands") do |reply|
-          case reply.status
-          when 202
-            record_history(body, line) if PromptHistory.shell_line?(line)
-            json_response(202, reply.json || { status: "accepted" })
-          when 400
-            # One of this chi's own commands the worker doesn't know: it runs an
-            # older chi. command: which one, so a remote TUI names it as its
-            # Bridge's own 400 unknown_command would (WebBridgeClient).
-            name = reply.json&.dig("error") == "unknown_command" && SessionCommands.builtin_name(line)
-            next older_worker_command(id, name) if name
-
-            error_response(400, reply.json&.dig("error") || "unknown_command", reply_detail(reply, "not a session command"))
-          end
-        end
-      rescue SessionManager::OwnedByTUI => e
-        owned_by_tui(e)
-      end
-
-      # 501 not_supported for a builtin +name+ ("/title") the worker lacks.
-      def older_worker_command(id, name)
-        words = BridgeClient.stale_worker_message(id, cant: "run #{name}")
-        json_response(501, { error: "not_supported", detail: words, message: words, command: name })
-      end
-
       # Hand a request to the session's live Bridge (+client+, nil without
       # one) and map its reply. The block gets the reply and answers the
       # statuses its route knows (nil for the rest); every relay maps the
@@ -1758,26 +1017,6 @@ module Samagotchi
         not_live(id)
       end
 
-      # 409 owned_by_tui in the words a refused archive, delete or continue
-      # shows (stop, restart, a turn and a command show OwnedByTUI's own).
-      def owned_by_repl(id, error = nil)
-        named = SessionManager::OwnedByTUI.new(id)
-        error ||= named
-        refusal_response(409, "owned_by_tui", error, detail: named.message, session_id: error.session_id)
-      end
-
-      # 409 owned_by_tui in OwnedByTUI's own words (stop, restart, a turn, a
-      # command).
-      def owned_by_tui(error) = refusal_response(409, "owned_by_tui", error, session_id: error.session_id)
-
-      # 409 scratch or busy (every other reason: a turn, a queued prompt, an
-      # open step-limit question, in it or a delegate, +busy_id+), with the
-      # reason for a remote client.
-      def archive_refused(error)
-        refusal_response(409, error.reason == :scratch ? "scratch" : "busy", error, session_id: error.session_id,
-                                                                                  reason: error.reason.to_s, busy_id: error.busy_id)
-      end
-
       def not_live(id)
         error_response(503, "not_live", "no live bridge for session #{id}")
       end
@@ -1804,139 +1043,6 @@ module Samagotchi
         error_response(504, "worker_timeout", "the session's worker did not answer, so #{what}")
       end
 
-      def handle_output(req, id)
-        # Query ?since= may be an ISO8601 time or numeric mtime; we treat it as Time parse.
-        since_param = req.params["since"]
-        since_time = parse_since(since_param)
-        session = @session_class.load(id, state_dir: default_state_dir)
-        raw = @manager.read_responses(id, since_time: since_time, state_dir: @state_dir)
-        # Strip wire tokens server-side so the client never sees <|tool_call> etc.
-        rendered = raw.map { |chunk| OutputFormatter.strip(chunk) }.reject(&:empty?)
-        json_response(200, { session_id: session.id, output: rendered })
-      end
-
-      def handle_turn(req, id)
-        body = parse_json(request_body(req))
-        unless body.is_a?(Hash)
-          return error_response(400, "invalid_json", "invalid JSON body")
-        end
-        # A participant's review turn: its own path, which takes from the
-        # body only the prompt (ParticipantAccess#handle_participant_turn).
-        return handle_participant_turn(req, id, body) unless principal(req).owner?
-
-        prompt = body["prompt"] || body[:prompt]
-        client_id = body["client_id"] || body[:client_id]
-        if prompt.to_s.strip.empty?
-          return error_response(400, "missing_fields", "prompt is required")
-        end
-
-        images = turn_images(id, body["images"])
-        return error_response(400, "bad_images", images) if images.is_a?(String)
-
-        delivery = body["delivery"] || body[:delivery]
-        if (refused = Delivery.refusal(delivery))
-          return error_response(400, refused[:error], refused[:detail])
-        end
-
-        refused = turn_refusal(id, body, prompt.to_s, images)
-        return refused if refused
-
-        # no_interrupt: an attached TUI's --no-interrupt (chi --remote --attach).
-        # author: the principal's (nil for the owner), never the body's.
-        result = SessionManager.deliver_turn(id, prompt: prompt.to_s, client_id: client_id, images: images,
-                                                 delivery: delivery, no_interrupt: body["no_interrupt"] == true,
-                                                 author: principal(req).author,
-                                                 state_dir: @state_dir, manager: @manager,
-                                                 bridge: -> { live_bridge_client(id) })
-        case result.status
-        when :accepted
-          record_history(body, prompt)
-          # via: bridge or file (the worker was gone: its input file), which
-          # names the turn a remote chi send --wait follows (WaitTarget).
-          json_response(202, result.ack.merge("via" => result.via.to_s))
-        when :refused then json_response(result.code, result.ack)
-        when :timeout then error_response(504, "worker_timeout", result.detail)
-        else error_response(500, "enqueue_failed", "could not write turn input")
-        end
-      rescue SessionManager::OwnedByTUI => e
-        owned_by_tui(e)
-      end
-
-      # A turn refused before it goes in, as chi send refuses it on its own
-      # machine: a chi send line #parent_gate refuses (the session's own
-      # parent_answers), and with check_vision: true images to a model known
-      # not to take them (422 no_vision). The page sends neither.
-      # @return [Array, nil] the response, or nil to go on
-      def turn_refusal(id, body, prompt, images)
-        vision = body["check_vision"] == true && !images.empty?
-        return nil unless vision || CLI_SEND_IDS.include?(body["client_id"])
-
-        session = @session_class.load(id, state_dir: default_state_dir)
-        refused = parent_gate(prompt, client_id: body["client_id"], values: [session.parent_answers])
-        return refused if refused
-
-        vision ? vision_refused(session.model_name, session.model_typed) : nil
-      end
-
-      # A turn's images as [{file:, name:}] (refs to uploads already in the
-      # session's images/), or a String saying what's wrong. Never a path.
-      def turn_images(id, raw)
-        return [] if raw.nil?
-
-        session_dir = image_session_dir(id)
-        return "unknown session" unless session_dir
-
-        ImageStore.check_refs(session_dir, raw)
-      end
-
-      # The session's folder, or nil for an id that isn't one.
-      def image_session_dir(id)
-        return nil unless SESSION_ID_RE.match?(id.to_s)
-
-        @session_class.load(id, state_dir: default_state_dir)
-        Session.session_dir(id, state_dir: default_state_dir)
-      rescue ArgumentError
-        nil
-      end
-
-      # POST /api/sessions/:id/images: the raw image as the body (a paste or
-      # a drop), ?name= for its file name. Stored like any other image
-      # (converted, downscaled); answers the ref the turn then names.
-      def handle_image_upload(req, id)
-        session_dir = image_session_dir(id)
-        return error_response(404, "not_found", "unknown session") unless session_dir
-
-        length = req.content_length.to_i
-        if length > MAX_IMAGE_UPLOAD_BYTES
-          return error_response(413, "too_large", "an image may be up to #{MAX_IMAGE_UPLOAD_BYTES / 1024 / 1024} MB")
-        end
-
-        bytes = request_body(req, MAX_IMAGE_UPLOAD_BYTES + 1).to_s.b
-        if bytes.bytesize > MAX_IMAGE_UPLOAD_BYTES
-          return error_response(413, "too_large", "an image may be up to #{MAX_IMAGE_UPLOAD_BYTES / 1024 / 1024} MB")
-        end
-
-        name = File.basename(req.params["name"].to_s)[0, 120]
-        ref = ImageStore.ingest(session_dir, bytes: bytes, name: name.empty? ? "image" : name, source: "user")
-        json_response(201, ref)
-      rescue ImageStore::Error => e
-        error_response(422, "bad_image", e.message)
-      end
-
-      # GET /api/sessions/:id/images/<hash>.<ext>: a stored image (only
-      # raster types; never svg), for the page's thumbnails.
-      def handle_image(_req, id, name)
-        session_dir = image_session_dir(id)
-        return not_found(path: "images/#{name}") unless session_dir && IMAGE_NAME_RE.match?(name.to_s)
-
-        path = File.join(session_dir, ImageStore::DIR, name)
-        return not_found(path: "images/#{name}") unless File.file?(path) && !File.symlink?(path)
-
-        body = File.binread(path)
-        [200, { "Content-Type" => IMAGE_TYPES.fetch(File.extname(name).delete(".")), "Content-Length" => body.bytesize.to_s,
-                "X-Content-Type-Options" => "nosniff", "Cache-Control" => "private, max-age=86400" }, [body]]
-      end
-
       # The session's Bridge, waiting briefly for one a resume just spawned.
       # @return [BridgeClient, nil]
       def live_bridge_client(id)
@@ -1951,159 +1057,6 @@ module Samagotchi
         nil
       end
 
-      # The Bridge decides the reason (Bridge::CANCEL_REASONS; anything
-      # else is manual) and the reply echoes its choice. No reason: user.
-      def handle_cancel(req, id)
-        @session_class.load(id, state_dir: default_state_dir)
-
-        parsed = parse_json(request_body(req))
-        reason = (parsed["reason"] if parsed.is_a?(Hash)).to_s.strip
-        reason = "user" if reason.empty?
-
-        request = ->(client) { client.cancel(reason: reason) }
-        relay(id, bridge_client(id), request, what: "the turn was not cancelled", cant: "cancel turns") do |reply|
-          case reply.status
-          when 202
-            json_response(202, { status: "cancel_requested", session_id: id, reason: reply.json&.dig("reason"), via: "bridge" })
-          # No active turn to cancel.
-          when 409 then json_response(409, { error: "not_running", detail: "no active turn to cancel", session_id: id })
-          end
-        end
-      end
-
-      # A task id as TaskRuntime.generate_task_id makes it.
-      TASK_ID = /\A\d{14}-\h{8}\z/
-
-      # The stop-task button: the worker stops the task as the user
-      # (Bridge#handle_task_stop) and its task_wait returns. Its own 404
-      # (not this conversation's task) and 409 (already ended) pass through;
-      # a 404 from a worker without the route is the stale worker's 501.
-      def handle_task_stop(_req, id, task_id)
-        return error_response(400, "invalid_task_id", "not a task id: #{task_id.to_s[0, 80]}") unless TASK_ID.match?(task_id)
-
-        @session_class.load(id, state_dir: default_state_dir)
-        request = ->(client) { client.stop_task(task_id) }
-        relay(id, bridge_client(id), request, what: "the task was not stopped", cant: "stop tasks") do |reply|
-          body = reply.json || {}
-          case reply.status
-          when 200 then json_response(200, { status: body["status"], stop_reason: body["stop_reason"], task_id: task_id, session_id: id })
-          when 404 then (error_response(404, "task_not_found", "no task #{task_id} in this conversation") if body["error"] == "task_not_found")
-          when 409 then json_response(409, { error: "not_running", status: body["status"], task_id: task_id, session_id: id })
-          end
-        end
-      end
-
-      # POST /api/sessions/:id/turn/:enqueued_id/dequeue {client_id?}: the ×
-      # on a queued bubble takes the message back before it runs
-      # (Bridge#handle_dequeue_turn). Straight to the live worker, never
-      # through deliver_turn: a removal must not wake one, and a stopped
-      # worker's queued file is the next worker's (503 not_live). 200
-      # {status, enqueued_id, prompt}; 409 already_started / not_queued and
-      # 404 unknown_enqueued_id pass through; the rest as every relay.
-      def handle_dequeue_turn(req, id, enqueued_id)
-        @session_class.load(id, state_dir: default_state_dir)
-        parsed = parse_json(request_body(req))
-        client_id = (parsed["client_id"] if parsed.is_a?(Hash))
-        # A participant takes back only their own queued turns, by chi web's
-        # record of who sent each (never a body's client id).
-        unless (who = principal(req)).owner?
-          return not_permitted_for(req, who) unless own_turn?(who.grant, id, enqueued_id)
-
-          client_id = ClientId.review(who.grant.id)
-        end
-
-        request = ->(client) { client.dequeue(enqueued_id: enqueued_id, client_id: client_id) }
-        relay(id, bridge_client(id), request, what: "the message was not removed", cant: "remove queued messages") do |reply|
-          body = reply.json || {}
-          case reply.status
-          when 200 then json_response(200, { status: body["status"], enqueued_id: enqueued_id, prompt: body["prompt"].to_s, session_id: id })
-          when 409 then json_response(409, { error: body["error"] || "already_started", detail: body["detail"], enqueued_id: enqueued_id, session_id: id }.compact)
-          when 404
-            json_response(404, { error: "unknown_enqueued_id", enqueued_id: enqueued_id, session_id: id }) if body["error"] == "unknown_enqueued_id"
-          end
-        end
-      end
-
-      # POST /api/sessions/:id/stop {wait?}: 200 {status: "stopped",
-      # session_id, released}: released, whether the worker let go of the
-      # session within the wait (STOP_WAIT_SECONDS, or the body's seconds up
-      # to SessionManager::STOP_WAIT: chi sessions stop's two wordings); 409
-      # owned_by_tui.
-      def handle_stop(req, id)
-        # Bounded, so a Rack thread isn't held long; a worker still exiting
-        # after it just means an immediate resume finds it (rare).
-        released = @manager.stop_session(id, state_dir: @state_dir, wait: stop_wait(req))
-        @hub&.touch(id)
-        json_response(200, { status: "stopped", session_id: id, released: released == true })
-      rescue SessionManager::OwnedByTUI => e
-        owned_by_tui(e)
-      end
-
-      # The body's wait (a number of seconds), capped at
-      # SessionManager::STOP_WAIT; STOP_WAIT_SECONDS without one.
-      def stop_wait(req)
-        body = parse_json(request_body(req, 4096))
-        wait = body["wait"] if body.is_a?(Hash)
-        wait.is_a?(Numeric) && wait.positive? ? [wait, SessionManager::STOP_WAIT].min : STOP_WAIT_SECONDS
-      end
-
-      # POST /api/sessions/:id/restart: hand the session to a new worker on
-      # the newest chi installed (SessionManager.restart_session). 200
-      # {status: "restarted", session_id, from_version, version} (version nil:
-      # the new worker is still starting; its bridge_up follows); 409
-      # {error: "held" | "not_running" | "unsupported" | "failed", reason, detail} in words; 409
-      # owned_by_tui; 404.
-      def handle_restart(_req, id)
-        result = @manager.restart_session(id, state_dir: @state_dir, client_id: ClientId::WEB_RESTART)
-        @hub&.touch(id)
-        json_response(200, { status: "restarted", session_id: id, from_version: result.from_version,
-                             version: result.version })
-      rescue SessionManager::RestartRefused => e
-        error = %i[not_running unsupported failed].include?(e.reason) ? e.reason.to_s : "held"
-        refusal_response(409, error, e, reason: e.reason.to_s, session_id: id, version: e.version)
-      rescue SessionManager::OwnedByTUI => e
-        owned_by_tui(e)
-      end
-
-      # POST /api/sessions/:id/archive: hide it (and its delegates) from the
-      # lists, keep it for good. A live idle worker is stopped first; a turn
-      # running in it or a delegate, a chi REPL's session and a scratch one
-      # are refused (409).
-      def handle_archive(_req, id)
-        result = @manager.archive_session(id, state_dir: @state_dir, wait: STOP_WAIT_SECONDS)
-        (result[:archived] + result[:discarded]).each { |sid| @hub&.touch(sid) }
-        json_response(200, { status: "archived", session_id: result[:id], archived: result[:archived],
-                             stopped: result[:stopped], discarded: result[:discarded] })
-      rescue SessionManager::OwnedByTUI => e
-        owned_by_repl(id, e)
-      rescue SessionManager::ArchiveRefused => e
-        archive_refused(e)
-      end
-
-      # POST /api/sessions/:id/unarchive: back to the lists, delegates too.
-      def handle_unarchive(_req, id)
-        result = @manager.unarchive_session(id, state_dir: @state_dir)
-        result[:unarchived].each { |sid| @hub&.touch(sid) }
-        json_response(200, { status: "unarchived", session_id: result[:id], unarchived: result[:unarchived] })
-      end
-
-      # DELETE /api/sessions/:id?force=true: the session for good. With
-      # force a live worker is stopped first (the page sends it: its confirm
-      # says so); without it a live worker's session is refused, 409
-      # worker_running, as chi sessions delete without --force. A chi REPL's
-      # session is always refused.
-      def handle_delete(req, id)
-        result = @manager.delete_session(id, state_dir: @state_dir, stop: truthy_param?(req.params["force"]),
-                                             wait: STOP_WAIT_SECONDS)
-        @hub&.touch(result[:id])
-        json_response(200, { status: "deleted", session_id: result[:id], stopped: result[:stopped] })
-      rescue SessionManager::OwnedByTUI => e
-        owned_by_repl(id, e)
-      rescue SessionManager::DeleteRefused => e
-        detail = e.reason == :still_stopping ? "#{e.message}; try again in a moment" : e.message
-        refusal_response(409, e.reason.to_s, e, detail: detail, session_id: e.session_id, reason: e.reason.to_s)
-      end
-
       # ── The working set (web.working_set) ───────────────────────────────
 
       # GET /api/sessions/:id/working_set: the working set as the model has
@@ -2537,6 +1490,8 @@ module Samagotchi
         when ".css" then "text/css; charset=utf-8"
         when ".json" then "application/json; charset=utf-8"
         when ".svg" then "image/svg+xml"
+        when ".png" then "image/png"
+        when ".webmanifest" then "application/manifest+json"
         else "application/octet-stream"
         end
       end
@@ -2553,302 +1508,6 @@ module Samagotchi
                                 registry: host_registry)
       end
 
-      # The whole timing: analytics.json's records merged with a live
-      # worker's (by id), and turn_count, the finished turns (#turn_count).
-      # +persisted+: the session's analytics.json when the caller read it.
-      def timing_payload(session_id, live_metrics: nil, persisted: nil)
-        persisted ||= read_analytics(session_id)
-        live = live_metrics.is_a?(Hash)
-        source = if live
-                   persisted.merge(live_metrics).merge(
-                     "started_at" => persisted["started_at"] || live_metrics["started_at"],
-                     "turn_records" => merge_timing_records(without_running_turn(persisted["turn_records"], live_metrics),
-                                                            live_metrics["turn_records"]),
-                     "tool_records" => merge_timing_records(persisted["tool_records"], live_metrics["tool_records"])
-                   )
-                 else
-                   persisted
-                 end
-        turns = Array(source["turn_records"])
-        timing_from(source, turns, Array(source["tool_records"]), live: live,
-                                                                 turn_count: (live && turn_count(live_metrics)) || turns.size)
-      end
-
-      # The timing a ?tail=1 read sends: a live worker's recent
-      # records as its metrics hold them (the newest finished turn's and
-      # the unsaved ones, the running turn's finished calls), no
-      # analytics.json read; with no worker the disk's, trimmed to the
-      # newest turn. turn_count tells the page whether its merge missed one
-      # (it then reads ?timing=1).
-      def recent_timing(session_id, live_metrics)
-        if live_metrics.is_a?(Hash)
-          count = turn_count(live_metrics)
-          # A metrics hash without the count: the whole timing.
-          return timing_payload(session_id, live_metrics: live_metrics) unless count
-
-          turns = Array(live_metrics["turn_records"])
-          tools = Array(live_metrics["tool_records"])
-          # An older worker's metrics hold every record (before they held the
-          # recent ones only, never more than LIVE_RECORDS_CAP turns).
-          turns, tools = newest_turn_records(turns, tools, live_metrics["active_turn"]) if turns.size > SessionMetrics::LIVE_RECORDS_CAP
-          return timing_from(live_metrics, turns, tools, live: true, turn_count: count)
-        end
-
-        persisted = read_analytics(session_id)
-        all = Array(persisted["turn_records"])
-        turns, tools = newest_turn_records(all, Array(persisted["tool_records"]), nil)
-        timing_from(persisted, turns, tools, live: false, turn_count: all.size)
-      end
-
-      # The finished turns a live worker counts: its metrics' turns (the
-      # loaded history, its own and the running one) less the running one.
-      # @return [Integer, nil]
-      def turn_count(metrics)
-        turns = metrics["turns"]
-        return nil unless turns.is_a?(Integer)
-
-        [turns - (metrics["active_turn"] ? 1 : 0), 0].max
-      end
-
-      # The newest turn record and its tool records (and the running turn's
-      # finished calls).
-      def newest_turn_records(turns, tools, active_turn)
-        kept = turns.last(1)
-        ids = kept.filter_map { |r| r["id"] if r.is_a?(Hash) }
-        ids << active_turn["id"] if active_turn.is_a?(Hash) && active_turn["id"]
-        [kept, tools.select { |r| r.is_a?(Hash) && ids.include?(r["turn_id"]) }]
-      end
-
-      def timing_from(source, turn_records, tool_records, live:, turn_count:)
-        started_at = source["started_at"]
-        last_activity_at = source["last_activity_at"]
-        {
-          started_at: started_at,
-          last_activity_at: last_activity_at,
-          session_duration_ms: session_duration_ms(started_at, last_activity_at, active: live),
-          turn_records: turn_records,
-          tool_records: tool_records,
-          turn_count: turn_count,
-          active_turn: source["active_turn"],
-          active_tools: Array(source["active_tools"]),
-          # The context last seen and the token sums, for the ctx meter
-          # before the next turn streams (live over saved).
-          context: source["context"],
-          tokens: source["tokens"],
-          # The tokens, cost and speeds per model (SessionMetrics'
-          # model_segments; none with one model, or from an older file).
-          model_segments: Array(source["model_segments"]),
-          # The memory indexes the session's prompt holds (the ctx tooltip).
-          memory_index: source["memory_index"],
-          # The side requests (recap, /btw, ctx.ask_model), apart from the
-          # tokens: the ctx tooltip's own line (nil without any).
-          side: source["side"]
-        }
-      end
-
-      def read_analytics(session_id)
-        AnalyticsFile.read(@session_class.session_dir(session_id, state_dir: default_state_dir)) || {}
-      end
-
-      # The saved turn records without the one the live worker is running:
-      # its turn checkpoint saves that turn's record so far as a killed
-      # turn's (canceled, worker_stopped, SessionMetrics#persist's
-      # running_turn), which is only true once the worker is gone.
-      def without_running_turn(records, live_metrics)
-        active = live_metrics["active_turn"]
-        id = active.is_a?(Hash) ? active["id"] || active[:id] : nil
-        return records if id.nil?
-
-        Array(records).reject { |record| record.is_a?(Hash) && (record["id"] || record[:id]) == id }
-      end
-
-      def merge_timing_records(persisted, live)
-        (Array(persisted) + Array(live)).each_with_object({}) do |record, records|
-          next unless record.is_a?(Hash)
-
-          id = record["id"] || record[:id]
-          records[id] = record if id
-        end.values
-      end
-
-      def session_duration_ms(started_at, last_activity_at, active:)
-        started = Time.iso8601(started_at.to_s)
-        finished = active ? Time.now : Time.iso8601(last_activity_at.to_s)
-        [((finished - started) * 1000).round, 0].max
-      rescue ArgumentError
-        nil
-      end
-
-      # The recap saved with the session and how many user turns came since:
-      # a live worker's (it counts against its Engine's messages), else
-      # recap.json against the session file. A stopped session gets its
-      # recap without a worker being woken.
-      # @return [Hash, nil] {text:, turns_since:}
-      def saved_recap_for(id, session, turn_snapshot)
-        if turn_snapshot
-          saved = turn_snapshot["saved_recap"]
-          return saved && { text: saved["text"], turns_since: saved["turns_since"].to_i }
-        end
-
-        saved = RecapStore.read(@session_class.session_dir(id, state_dir: default_state_dir))
-        return nil unless saved
-
-        messages = Array(session.messages)
-        since = messages.drop(saved[:covered].to_i).count { |m| Samagotchi::Steer.turn_prompt?(m) }
-        { text: saved[:text], turns_since: since }
-      rescue StandardError
-        nil
-      end
-
-      # The step (iteration) that answered the steer or merged input at
-      # +index+: one past the model messages between it and the turn's
-      # prompt.
-      def steer_step(list, index)
-        list[0...index].reverse_each.take_while { |m| !Samagotchi::Steer.turn_prompt?(m) }
-                       .count { |m| %w[model assistant].include?((m[:role] || m["role"]).to_s) } + 1
-      end
-
-      def read_history(id)
-        raw = @manager.read_responses(id, since_time: nil, state_dir: @state_dir)
-        raw.map { |chunk| OutputFormatter.strip(chunk) }.reject(&:empty?)
-      rescue StandardError
-        []
-      end
-
-      # @param msgs [Array<Hash>] a session's messages; symbol keys from disk,
-      #   string keys from a Bridge snapshot
-      # @param parts [Boolean] the turn view's reload (?parts=1): each
-      #   assistant message also carries what it did (MessageParts: thinking,
-      #   tool calls with params and output), and a message with nothing to
-      #   show but that (a text-less step) is kept with empty content
-      # @param cwd [String, nil] the session's working directory (the parts'
-      #   tool titles are relative to it)
-      def messages_for_display(msgs, parts: false, cwd: nil)
-        filtered = []
-        list = Array(msgs)
-        # The outputs' ✂ marks (LLM context edits), by id, for the parts.
-        marks = parts ? MessageParts.edit_marks(list) : {}
-        list.each_with_index do |m, index|
-          role = (m[:role] || m["role"]).to_s
-          content = (m[:content] || m["content"]).to_s
-          if Samagotchi::ContextNote.note?(m)
-            note = { role: "note", content: Samagotchi::ContextNote.text_of(m), label: Samagotchi::ContextNote.label_of(m) }
-            # A context wake turn's note starts that turn (Steer.turn_prompt?):
-            # the page opens the turn with it and pairs it with its record.
-            if Samagotchi::Steer.turn_prompt?(m)
-              note[:turn_start] = true
-              note[:turn_id] = (m[:turn_id] || m["turn_id"]).to_s
-            end
-            filtered << note
-            next
-          end
-          # A plugin's steer: a row of the step that answered it, which the
-          # page finds by `step`.
-          if Samagotchi::Steer.steer?(m)
-            filtered << { role: "steer", content: content, source: (m[:source] || m["source"]).to_s, step: steer_step(list, index) }
-            next
-          end
-          # A turn that ended with no answer (TurnNote.empty's marker): its
-          # empty steps (with ?parts=1) and the item the page draws its
-          # notice from; the note itself stays hidden.
-          if (marker = Samagotchi::TurnNote.empty_answer(m))
-            filtered.concat(empty_answer_items(marker, parts: parts, cwd: cwd))
-            next
-          end
-          next if role == "system"
-          next if role == "tool_response"
-
-          stripped = Samagotchi::OutputFormatter.strip_markup(content)
-          did = parts && %w[model assistant].include?(role) ? message_parts(list, index, cwd, marks) : nil
-          next if stripped.empty? && did.nil?
-
-          norm_role = role == "model" ? "assistant" : role
-          # normalize assistant vs model, keep user as is
-          norm_role = "assistant" if %w[assistant model].include?(norm_role)
-          norm_role = "user" if norm_role == "user"
-          next unless %w[user assistant].include?(norm_role)
-
-          message = { role: norm_role, content: stripped }
-          # Merged into the running turn (Steer::INPUT_KIND): part of it,
-          # read by step +step+; a wake turn's report starts its turn
-          # (Steer.turn_prompt?). Its sender (a delegate report, chi send):
-          # the page's label.
-          if norm_role == "user" && Samagotchi::Steer.input?(m)
-            message.merge!(merged: true, step: steer_step(list, index)) unless Samagotchi::Steer.turn_prompt?(m)
-            source = (m[:source] || m["source"]).to_s
-            message[:source] = source unless source.empty?
-          end
-          # The turn it started (Engine): the page pairs it with that turn's
-          # record by this, not by its place.
-          turn_id = m[:turn_id] || m["turn_id"]
-          message[:turn_id] = turn_id.to_s if norm_role == "user" && turn_id
-          # A participant's message names them (the page's author badge).
-          message.merge!(Samagotchi::Steer.author_fields(m[:author] || m["author"], m[:author_name] || m["author_name"])) if norm_role == "user"
-          images = m[:images] || m["images"]
-          message[:images] = Array(images).map { |ref| ImageStore.symbolize(ref).slice(:file, :name, :width, :height) } if norm_role == "user" && images.is_a?(Array) && !images.empty?
-          if norm_role == "assistant"
-            # What an after_turn hook presented (AnswerDisplay): rendered and
-            # copied in place of the answer, sanitised the same way; content
-            # stays the model's text, which the page finds the bubble by.
-            display = m[:display] || m["display"]
-            shown = display.is_a?(String) ? Samagotchi::OutputFormatter.strip_markup(display) : ""
-            message[:display] = shown unless shown.strip.empty?
-            rendered = message[:display] || stripped
-            message[:html] = @markdown_renderer.render(rendered) if !rendered.empty? && @markdown_renderer.available?
-            # The refs after_turn hooks attached (AnswerRefs), checked again:
-            # a stored file is never trusted. Never raises.
-            refs = Samagotchi::AnswerRefs.for_display(m[:display_refs] || m["display_refs"], cwd: cwd)
-            message[:display_refs] = refs unless refs.empty?
-          end
-          message[:parts] = did if did
-          filtered << message
-        end
-        filtered
-      rescue StandardError
-        []
-      end
-
-      # A no-answer turn's marker as display items: each empty step that
-      # has something to show (its thinking) as a text-less assistant step
-      # (only with +parts+, as other text-less steps), then
-      # { role: "empty_answer", retries: }.
-      def empty_answer_items(marker, parts:, cwd:)
-        steps = parts ? Array(marker[:steps] || marker["steps"]) : []
-        items = steps.filter_map do |step|
-          did = step.is_a?(Hash) ? MessageParts.for_message(step, [], cwd: cwd) : nil
-          { role: "assistant", content: "", parts: did } if did
-        end
-        refusal = marker[:refusal] || marker["refusal"]
-        items << { role: "empty_answer", content: "", retries: (marker[:retries] || marker["retries"]).to_i, refusal: refusal }.compact
-      end
-
-      # The last turn failed and its prompt went back to the user: the
-      # prompt (session.last_prompt) and why, for the page to show after the
-      # conversation as it did live. nil otherwise.
-      def failed_turn_for(session, msgs)
-        summary = Samagotchi::TurnNote.restored_failure(msgs)
-        prompt = session.last_prompt.to_s
-        return nil if summary.nil? || prompt.strip.empty?
-
-        { prompt: prompt, summary: summary }
-      end
-
-      # The parts of the assistant message at +index+, with the tool_response
-      # messages right after it; +marks+: the session's ✂ marks
-      # (MessageParts.edit_marks).
-      def message_parts(list, index, cwd = nil, marks = {})
-        responses = list.drop(index + 1).take_while { |r| (r[:role] || r["role"]).to_s == "tool_response" }
-        MessageParts.for_message(list[index], responses, cwd: cwd, marks: marks)
-      end
-
-      # The last message messages_for_display shows as an answer
-      # (AnswerTail), as a list of at most one: only that one is rendered.
-      # +cwd+: the session's folder, for its file refs (nil from a live
-      # worker's tail: its refs were held to the folder when they were added).
-      def last_assistant_for_display(msgs, turn_id: nil, cwd: nil)
-        messages_for_display([AnswerTail.find(msgs, turn_id: turn_id)].compact, cwd: cwd)
-      end
-
       def parse_json(str)
         return nil if str.nil? || str.strip.empty?