samagotchi 0.115.0 → 0.117.0

data/lib/samagotchi/web/public/system_one_wrong.js

@@ -0,0 +1,32 @@
+import { markSystemOneWrong } from "./data.js";
+
+// The owner-only correction button on a System 1 auto-allowed tool row.
+export function createSystemOneWrongAction({
+  sessionId,
+  mark = markSystemOneWrong,
+  alert = (text) => globalThis.alert(text),
+}) {
+  return async (event) => {
+    const button = event.target.closest?.("button.system-one-wrong");
+    if (!button) return false;
+
+    event.preventDefault();
+    event.stopPropagation();
+    const id = sessionId();
+    if (!id || button.disabled) return false;
+
+    button.disabled = true;
+    try {
+      await mark(id, button.dataset.judgmentId);
+      button.textContent = "should have asked";
+      button.setAttribute("aria-pressed", "true");
+      button.classList.add("marked");
+      button.closest(".activity-row")?.classList.add("guardrail-wrong");
+      return true;
+    } catch (error) {
+      button.disabled = false;
+      alert(`Could not mark auto-allow: ${error.message}`);
+      return false;
+    }
+  };
+}

data/lib/samagotchi/web/public/timing.js

@@ -274,18 +274,22 @@ function canceledSteps(g, record, tools) {
 // A call's row from its tool record alone (no saved parts): the record's
 // called_as and via too, so "(called as bash)" and "(via call_tool)" show
 // after a reload, as live, and
-// its no_match ("no match" on a grep that found nothing).
+// its no_match ("no match" on a grep that found nothing) and System 1's
+// auto-allow (guardrail: {rule, p}).
 function recordRows(tools, iteration) {
   return tools.filter((r) => Number(r.iteration) === iteration).map((r) => ({
     key: `${iteration}:${r.call_index ?? 0}`, tool: r.tool, status: r.status, duration_ms: r.duration_ms,
     ...(r.called_as ? { called_as: r.called_as } : {}),
     ...(r.via ? { via: r.via } : {}),
-    ...noMatch(r),
+    ...recordFlags(r),
   }));
 }
 
-function noMatch(record) {
-  return record?.no_match ? { no_match: true } : {};
+function recordFlags(record) {
+  return {
+    ...(record?.no_match ? { no_match: true } : {}),
+    ...(record?.guardrail ? { guardrail: record.guardrail } : {}),
+  };
 }
 
 // A turn whose saved messages carry their parts (the server's ?parts=1):
@@ -308,7 +312,7 @@ function partsTurn(g, items, record, tools, stepsOnly = false) {
     const rows = Array.isArray(parts.tools)
       ? parts.tools.map((call, j) => {
         const r = takeRecord(pool, call.tool);
-        return { key: `${iteration}:${j + 1}`, status: r?.status || "ok", duration_ms: r?.duration_ms, ...noMatch(r), ...call };
+        return { key: `${iteration}:${j + 1}`, status: r?.status || "ok", duration_ms: r?.duration_ms, ...recordFlags(r), ...call };
       })
       : [];
     const thinking = String(parts.thinking || "");

data/lib/samagotchi/web/public/turn_events.js

@@ -411,6 +411,7 @@ export function snapshotEvents({ current_turn: turn = null, queued = [], queued_
             };
             // A grep that found nothing: its row stays muted "no match".
             if (part.no_match) completed.activity.no_match = true;
+            if (part.guardrail) completed.activity.guardrail = part.guardrail;
             if (part.duration_ms != null) completed.duration_ms = part.duration_ms;
             if (part.diff) completed.diff = part.diff;
             Object.assign(completed, fields);

data/lib/samagotchi/web/public/turn_html.js

@@ -145,7 +145,8 @@ function tailClip(text) {
 // part the user toggled (the raw command, the diff, the read lines) stays.
 // +stop+: the live row's stop-task button (a node), after the title.
 export function toolRowTemplate(row, opts = {}) {
-  return html`<div class="activity-row" data-key=${row.key}>${toolRowInnerTemplate(row, opts)}</div>`;
+  const wrong = row.guardrail?.should_have_asked ? " guardrail-wrong" : "";
+  return html`<div class=${`activity-row${wrong}`} data-key=${row.key}>${toolRowInnerTemplate(row, opts)}</div>`;
 }
 
 export function toolRowInnerTemplate(row, { thumbs = () => nothing, stop = nothing } = {}) {
@@ -163,13 +164,23 @@ export function toolRowInnerTemplate(row, { thumbs = () => nothing, stop = nothi
   // tool it was reached through (call_tool), dim.
   const alias = row.called_as ? html`<span class="activity-alias">(called as ${row.called_as})</span>`
     : row.via ? html`<span class="activity-alias">(via ${row.via})</span>` : nothing;
+  const auto = row.guardrail
+    ? html`<span class="activity-auto" title=${`rule ${row.guardrail.rule}, p=${Number(row.guardrail.p).toFixed(2)}, allowed once`}>auto-allowed · System 1</span>`
+    : nothing;
+  const wrong = row.guardrail?.judgment_id
+    ? row.guardrail.should_have_asked
+      ? html`<span class="system-one-wrong marked"
+          title="System 1 was told this call should have been asked about">should have asked</span>`
+      : html`<button type="button" class="system-one-wrong" data-judgment-id=${row.guardrail.judgment_id}
+          title="Tell System 1 this call should have been asked about">should have asked</button>`
+    : nothing;
   const duration = formatDuration(row.duration_ms);
   const full = row.status === "running" ? "" : String(row.output || "").replace(/^\[[^\]]*\]\s*/, "");
   const output = full
     ? html`<div class=${tailMode(row.tool, full) ? "activity-output tail" : "activity-output"} title=${full}>${inlineOutput(row.tool, full)}</div>`
     : nothing;
   const status = statusParts(row.status, { noMatch: !!row.no_match });
-  return html`${statusMarkTemplate(status)}<span class="activity-tool">${toolName(row)}</span>${params}${stop}${alias}${statusWordTemplate(status)}${duration ? html`<span class="activity-duration">${duration}</span>` : nothing}${commandBlockTemplate(row.view, row.title)}${llmEditTemplate(row)}${output}${full ? readLinesTemplate(row) : nothing}${row.images?.length ? thumbs(row.images) : nothing}${row.diff ? activityDiffTemplate(row.diff) : nothing}`;
+  return html`${statusMarkTemplate(status)}<span class="activity-tool">${toolName(row)}</span>${params}${stop}${alias}${statusWordTemplate(status)}${auto}${wrong}${duration ? html`<span class="activity-duration">${duration}</span>` : nothing}${commandBlockTemplate(row.view, row.title)}${llmEditTemplate(row)}${output}${full ? readLinesTemplate(row) : nothing}${row.images?.length ? thumbs(row.images) : nothing}${row.diff ? activityDiffTemplate(row.diff) : nothing}`;
 }
 
 // A prompt bubble's states and their badges: queued (waiting for its

data/lib/samagotchi/web/session_access_routes.rb

@@ -304,22 +304,25 @@ module Samagotchi
         { epoch: sidecar.epoch, started_at: sidecar.started_at, version: sidecar.version, features: sidecar.features }
       end
 
-      # POST /api/sessions/:id/exit {client_id, delete}: a remote attached
+      # POST /api/sessions/:id/exit {client_id, delete, stop}: a remote attached
       # TUI's /exit (and the worker's half of /exit --delete and /archive),
       # relayed to the live worker's exit (BridgeClient#request_exit; never
       # wakes one). client_id is passed on only when it is an attached TUI's
       # (tui:…): any other is dropped, and then every stream counts as a UI,
-      # which only keeps the worker up. 200 the Bridge's {status: exiting,
-      # session_id, discard}; 409 held with its {status, reason, tasks,
-      # hint}; 503 not_live, 501 not_supported (an older worker), 504
-      # worker_timeout.
+      # which only keeps the worker up. stop: true means the ask's "stop them
+      # and exit". 200 the Bridge's {status: exiting, session_id, discard,
+      # stopped}; 409 held with its {status, reason, tasks, hint, holds};
+      # 503 not_live, 501 not_supported (an older worker), 504 worker_timeout.
       def handle_exit(req, id)
         body = body_hash(req) or return refusal(400, "invalid_json", "invalid JSON body")
         @session_class.load(id, state_dir: default_state_dir)
         client_id = body["client_id"] if body["client_id"].is_a?(String) && body["client_id"].start_with?(ClientId::TUI_PREFIX)
         delete = body["delete"] == true
+        options = { delete: delete }
+        options[:stop] = true if body["stop"] == "all"
+        options[:ask] = false if body["ask"] == false
 
-        request = ->(client) { client.request_exit(client_id: client_id, delete: delete) }
+        request = ->(client) { client.request_exit(client_id: client_id, **options) }
         with_message(relay(id, bridge_client(id), request, what: "the worker was not asked to exit", cant: "exit from here") do |reply|
           case reply.status
           when 200 then json_response(200, reply.json || { status: "exiting", session_id: id })

data/lib/samagotchi/web/session_control.rb

@@ -13,9 +13,10 @@ module Samagotchi
   module Web
     # The owner's routes that act on a session's worker: answer or dismiss
     # its question, run a command, send a turn (and its images), cancel, stop
-    # a task, dequeue a queued turn, stop, restart, archive, unarchive and
-    # delete (handle_question_answer … handle_delete), with the refusals they
-    # answer (owned_by_repl, owned_by_tui, archive_refused). Included in App:
+    # a task, dequeue a queued turn, what it could stop and stop it
+    # (handle_session_holds, handle_stop_holds — the page's Stop asks about
+    # these first), stop, restart, archive, unarchive and delete
+    # (handle_question_answer … handle_delete), with the refusals they answer (owned_by_repl, owned_by_tui, archive_refused). Included in App:
     # its ROUTES name the handlers, and its helpers (json_response,
     # error_response, parse_json, request_body, relay, not_live,
     # bridge_error, reply_detail, worker_timeout, bridge_client,
@@ -107,6 +108,28 @@ module Samagotchi
         end
       end
 
+      # The owner's correction for a System 1 auto-allow. The Bridge checks
+      # that the judgment belongs to this worker's session.
+      def handle_system_one_wrong(req, id)
+        body = parse_json(request_body(req))
+        return error_response(400, "invalid_json", "invalid JSON body") unless body.is_a?(Hash)
+
+        judgment_id = body["id"].to_s.strip
+        return error_response(400, "missing_fields", "id is required") if judgment_id.empty?
+
+        request = ->(client) { client.mark_system_one_wrong(judgment_id: judgment_id) }
+        relay(id, bridge_client(id), request, what: "the System 1 judgment was not labelled",
+              cant: "label System 1 judgments") do |reply|
+          case reply.status
+          when 200 then json_response(200, { status: "labelled", id: judgment_id })
+          when 404
+            error_response(404, "unknown_judgment", "unknown System 1 judgment") if reply.json&.dig("error") == "unknown_judgment"
+          when 409 then error_response(409, "already_labelled", "System 1 judgment already has a label")
+          when 400 then error_response(400, "invalid_judgment", reply_detail(reply, "invalid System 1 judgment"))
+          end
+        end
+      end
+
       # A session command typed in the composer (/model, /models, !rollback,
       # !cmd, /continue): the worker runs it (woken as for a turn) and every
       # UI gets its :command_ran. Needs the worker's Bridge.
@@ -337,6 +360,42 @@ module Samagotchi
         end
       end
 
+      # GET /api/sessions/:id/holds: what this session's worker could stop
+      # right now (its Bridge's GET holds: reminders, the background tasks a
+      # finish wake watches that still run, the delegate children with a live
+      # worker), so the page's Stop can ask about them before TERMed-ing the
+      # worker. 200 {session_id, holds: []} — always a list: with no live
+      # worker, a worker from before the route, or one that didn't answer
+      # there is nothing to ask about, and Stop stays one tap as it was.
+      def handle_session_holds(_req, id)
+        @session_class.load(id, state_dir: default_state_dir)
+        client = bridge_client(id)
+        return json_response(200, { session_id: id, holds: [] }) unless client
+
+        status, json = client.get("holds")
+        holds = status == 200 && json.is_a?(Hash) ? json["holds"] : nil
+        json_response(200, { session_id: id, holds: holds.is_a?(Array) ? holds : [] })
+      rescue SystemCallError, IOError, SocketError
+        json_response(200, { session_id: id, holds: [] })
+      end
+
+      # POST /api/sessions/:id/holds/stop: the sheet's "Stop all" — the worker
+      # stops everything the user can stop (Bridge#handle_holds_stop) before
+      # today's Stop TERMs it. 200 {status: "stopped", session_id, stopped:
+      # {reminders:, tasks:, delegates:}}; 503 no live worker, 501 a worker
+      # from before the route, 504/502 as every relay (the page says which
+      # thing it could not stop and stops the session anyway).
+      def handle_stop_holds(_req, id)
+        @session_class.load(id, state_dir: default_state_dir)
+        request = ->(client) { client.stop_holds }
+        relay(id, bridge_client(id), request, what: "nothing was stopped", cant: "stop what the session runs") do |reply|
+          next unless reply.status == 200
+
+          stopped = reply.json&.dig("stopped")
+          json_response(200, { status: "stopped", session_id: id, stopped: stopped || {} })
+        end
+      end
+
       # POST /api/sessions/:id/stop {wait?}: 200 {status: "stopped",
       # session_id, released}: released, whether the worker let go of the
       # session within the wait (STOP_WAIT_SECONDS, or the body's seconds up

data/lib/samagotchi/web/session_show.rb

@@ -8,9 +8,11 @@ require_relative "../answer_refs"
 require_relative "../answer_tail"
 require_relative "../output_formatter"
 require_relative "../question_asked"
+require_relative "../guardrails/approvals"
 require_relative "../session_commands"
 require_relative "../session_metrics"
 require_relative "../session_setting"
+require_relative "../system_one/log"
 
 module Samagotchi
   module Web
@@ -300,7 +302,7 @@ module Samagotchi
                    persisted
                  end
         turns = Array(source["turn_records"])
-        timing_from(source, turns, Array(source["tool_records"]), live: live,
+        timing_from(source, turns, Array(source["tool_records"]), session_id: session_id, live: live,
                                                                  turn_count: (live && turn_count(live_metrics)) || turns.size)
       end
 
@@ -321,13 +323,13 @@ module Samagotchi
           # An older worker's metrics hold every record (before they held the
           # recent ones only, never more than LIVE_RECORDS_CAP turns).
           turns, tools = newest_turn_records(turns, tools, live_metrics["active_turn"]) if turns.size > SessionMetrics::LIVE_RECORDS_CAP
-          return timing_from(live_metrics, turns, tools, live: true, turn_count: count)
+          return timing_from(live_metrics, turns, tools, session_id: session_id, live: true, turn_count: count)
         end
 
         persisted = read_analytics(session_id)
         all = Array(persisted["turn_records"])
         turns, tools = newest_turn_records(all, Array(persisted["tool_records"]), nil)
-        timing_from(persisted, turns, tools, live: false, turn_count: all.size)
+        timing_from(persisted, turns, tools, session_id: session_id, live: false, turn_count: all.size)
       end
 
       # The finished turns a live worker counts: its metrics' turns (the
@@ -349,7 +351,7 @@ module Samagotchi
         [kept, tools.select { |r| r.is_a?(Hash) && ids.include?(r["turn_id"]) }]
       end
 
-      def timing_from(source, turn_records, tool_records, live:, turn_count:)
+      def timing_from(source, turn_records, tool_records, session_id:, live:, turn_count:)
         started_at = source["started_at"]
         last_activity_at = source["last_activity_at"]
         {
@@ -357,7 +359,7 @@ module Samagotchi
           last_activity_at: last_activity_at,
           session_duration_ms: session_duration_ms(started_at, last_activity_at, active: live),
           turn_records: turn_records,
-          tool_records: tool_records,
+          tool_records: system_one_labelled_records(session_id, tool_records),
           turn_count: turn_count,
           active_turn: source["active_turn"],
           active_tools: Array(source["active_tools"]),
@@ -376,6 +378,34 @@ module Samagotchi
         }
       end
 
+      # A saved analytics record knows the judgment id, not the later label:
+      # the judgments log remains the source of truth across reloads.
+      def system_one_labelled_records(session_id, records)
+        ids = records.filter_map do |record|
+          record.dig("guardrail", "judgment_id") if record.is_a?(Hash) && record["guardrail"].is_a?(Hash)
+        end.to_h { |id| [id, true] }
+        return records if ids.empty?
+
+        log = SystemOne::Log.new(dir: Guardrails::Approvals.dir_for(default_state_dir))
+        return records unless File.file?(log.path)
+
+        labelled = log.entries.each_with_object({}) do |entry, result|
+          next unless ids[entry["id"]] && entry["session_id"] == session_id && entry["decision"] == "auto" &&
+                      entry["answer"] == "should_have_asked"
+
+          result[entry["id"]] = true
+        end
+        return records if labelled.empty?
+
+        records.map do |record|
+          guardrail = record.is_a?(Hash) && record["guardrail"]
+          judgment_id = guardrail.is_a?(Hash) && guardrail["judgment_id"]
+          next record unless labelled[judgment_id]
+
+          record.merge("guardrail" => guardrail.merge("should_have_asked" => true))
+        end
+      end
+
       def read_analytics(session_id)
         AnalyticsFile.read(@session_class.session_dir(session_id, state_dir: default_state_dir)) || {}
       end

data/lib/samagotchi/worker.rb

@@ -13,6 +13,8 @@ require_relative "turn_note"
 require_relative "steer"
 require_relative "turn_origin"
 require_relative "worker_idle_exit"
+require_relative "hold_stop"
+require_relative "children_status"
 require_relative "worker_wakes"
 require_relative "worker_inbound"
 require_relative "worker_signals"
@@ -210,6 +212,11 @@ module Samagotchi
       end
     end
 
+    # The step that stops what the user can stop (the reminders, the watched
+    # tasks and the delegate children the exit ask lists), and what the last
+    # stop-all exit stopped. /exit's 2 uses it; the web's Stop will too.
+    attr_reader :hold_stop, :stopped_holds
+
     private
 
     # @return [Symbol] what #run returns
@@ -330,7 +337,13 @@ module Samagotchi
                                             on_command: method(:on_command),
                                             on_exit_request: method(:exit_request),
                                             # Decided again as it leaves (a note may still come in).
-                                            exit_discards: method(:empty_session?))
+                                            exit_discards: method(:empty_session?),
+                                            # What a stop-all /exit stopped, for its 200.
+                                            exit_stopped: method(:stopped_holds),
+                                            # chi web's Stop asks about these before TERMed-ing
+                                            # the worker (its own holds routes).
+                                            on_holds: -> { @idle_exit&.stoppable_holds },
+                                            on_holds_stop: -> { @hold_stop&.stop_all })
       # What failed to load and what plugins showed as they loaded, now that
       # a UI can be there (a late one gets them in the snapshot).
       @engine.announce_load_events!
@@ -346,8 +359,25 @@ module Samagotchi
         # finished since the pass looked holds too, until the next pass
         # wakes for it (#run_task_wake).
         watched_tasks: -> { TaskWatch.mode == "wake" ? @task_wakes.watch.holding : [] },
-        watched_running: -> { TaskWatch.mode == "wake" ? @task_wakes.watch.running : [] }
+        watched_running: -> { TaskWatch.mode == "wake" ? @task_wakes.watch.running : [] },
+        # Never a hold (a child is its own worker), but the exit ask lists
+        # them so "stop them and exit" stops them too.
+        delegates: method(:live_delegates)
       )
+      @hold_stop = HoldStop.new(engine: @engine, task_watch: @task_wakes.watch, delegates: method(:live_delegates),
+                                state_dir: @state_dir)
+    end
+
+    # The delegate children of this session that are running a turn or have
+    # a live worker. ChildrenStatus.of scans the session files; this runs on
+    # an exit request, not every pass.
+    # @return [Array<ChildrenStatus::Child>]
+    def live_delegates
+      ChildrenStatus.of(@session_id, state_dir: @state_dir)
+                      .select { |child| child.delegate && (child.state == "running" || child.live) }
+    rescue StandardError => e
+      Log.warn(:worker, "delegate_look_failed", error: e.class.name, msg: e.message)
+      []
     end
 
     # What runs beside the loop until it leaves.
@@ -1418,10 +1448,18 @@ module Samagotchi
     # +delete+: the session is deleted after (/exit --delete), so no recap.
     # +restart+: a new worker takes over (on the newest chi installed), so
     # WorkerIdleExit#hold_for_restart's rules, and no recap or discard.
+    # +stop+: the exit ask's "stop them and exit" — stop every hold the user
+    #   can stop before leaving; a hold they can't stop refuses the request
+    #   (WorkerIdleExit#request_hold checks again, so one that appeared
+    #   since the ask is refused too).
+    # +ask+: this client asks the user what to do with what still runs, so the
+    #   delegate children are part of the list. An exit that deletes the
+    #   session, or one a UI can't ask about (/archive), leaves them out:
+    #   they never hold the worker up on their own.
     # @return [WorkerIdleExit::Hold, nil] what keeps the worker up (for
     #   :background_tasks, the watched tasks still running), nil when it
     #   will leave
-    def exit_request(client_id, delete: false, restart: false)
+    def exit_request(client_id, delete: false, restart: false, stop: false, ask: true)
       # The Bridge serves before the idle-exit policy exists.
       return WorkerIdleExit::Hold.new(reason: :starting) unless @idle_exit
 
@@ -1430,10 +1468,24 @@ module Samagotchi
         return WorkerIdleExit::Hold.new(reason: hold) if hold
       else
         # /exit names the tasks it waits for (D3), from the one look that found them.
-        hold = @idle_exit.request_hold(requester: client_id, hint: TASK_STOP_HINT)
-        return hold if hold
+        # The ask covers the delegate children too, but only for a plain /exit: an
+        # exit that deletes the session, or one a UI won't ask about, ignores them.
+        hold = @idle_exit.request_hold(requester: client_id, hint: TASK_STOP_HINT, ask: ask && !delete)
+        if hold
+          # A hold the user can't stop here: no ask, today's refusal.
+          return hold unless hold.ask?
+          # The ask's 409: the list, for the terminal to ask with.
+          return hold unless stop
+
+          @stopped_holds = @hold_stop.stop_all
+          # An unstoppable hold may have arrived while stopping (a child stopped
+          # here is no longer counted).
+          recheck = @idle_exit.request_hold(requester: client_id, hint: TASK_STOP_HINT)
+          return recheck if recheck
+        end
       end
 
+      @stopped_holds = nil unless stop
       @exit_requested = true
       @exit_requested_by = client_id
       @exit_deletes = delete && !restart

data/lib/samagotchi/worker_idle_exit.rb

@@ -27,12 +27,27 @@ module Samagotchi
     # What keeps the worker up when a client asks it to exit (Worker#exit_request,
     # the Bridge's 409): +reason+, a #hold_for_request (or #hold_for_restart)
     # Symbol, or :starting before this policy exists; for :background_tasks
-    # the watched tasks still running ({id:, command:}) and a +hint+ on
-    # stopping them.
-    Hold = Data.define(:reason, :tasks, :hint) do
-      def initialize(reason:, tasks: nil, hint: nil) = super
+    # the watched tasks still running ({id:, command:, age_seconds:}) and a
+    # +hint+ on stopping them; +holds+ what the user can stop from the exit
+    # ask (#StoppableHold), empty when the reason is something they can't.
+    Hold = Data.define(:reason, :tasks, :hint, :holds) do
+      def initialize(reason:, tasks: nil, hint: nil, holds: []) = super
+
+      # Held only by things the user can stop: /exit asks what to do with them
+      # rather than refusing.
+      def ask? = !holds.empty?
     end
 
+    # One kind of hold the exit ask offers to stop: +kind+ (:reminders,
+    # :background_tasks or :delegates) and its +items+ (#HoldItem). The 409's
+    # +holds+ is this in JSON: `{kind:, items: [{id:, label:, detail:}]}`.
+    StoppableHold = Data.define(:kind, :items)
+
+    # One entry of a hold: +id+ (a reminder's name, a task id, a child session
+    # id), +label+ (the command, the child's title) and +detail+ ("every 20m",
+    # "2m", "running a turn").
+    HoldItem = Data.define(:id, :label, :detail)
+
     # @param engine [Engine] #turn_running?, #last_activity_at, #reminder_store
     # @param bridge [Bridge, nil] #open_streams, #last_client_activity_at; nil
     #   when the worker's Bridge failed to start
@@ -46,10 +61,13 @@ module Samagotchi
     # @param watched_running [#call] those of them still running
     #   (TaskWatch#running): they hold /exit (one that finished is a note
     #   as the worker leaves)
+    # @param delegates [#call] the delegate children this session has running
+    #   or with a live worker (ChildrenStatus::Child): they never hold the
+    #   exit, but the exit ask lists them so "stop them" stops them too
     # @param clock [#call] monotonic seconds, the Engine's and Bridge's clock
     def initialize(engine:, bridge:, timeout_minutes:, input_pending:, awaiting_continue: -> { false },
                    running_tasks: -> { [] }, watched_tasks: -> { [] }, watched_running: -> { [] },
-                   clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
+                   delegates: -> { [] }, clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
       @engine = engine
       @bridge = bridge
       @timeout = timeout_minutes.to_f * 60
@@ -58,6 +76,7 @@ module Samagotchi
       @running_tasks = running_tasks
       @watched_tasks = watched_tasks
       @watched_running = watched_running
+      @delegates = delegates
       @clock = clock
       @started_at = clock.call
     end
@@ -96,21 +115,50 @@ module Samagotchi
     #   :client_connected, :reminders or :background_tasks
     def hold_for_request(requester:, streams: true) = request_hold(requester: requester, streams: streams)&.reason
 
+    # What the user could stop in this worker right now, whatever else keeps
+    # it up: its reminders, the watched background tasks still running, and
+    # (for a UI that asks about them, +include_delegates+) the delegate
+    # children with a live worker. #request_hold's +holds+ is this, and the
+    # web's Stop asks with it before TERMed-ing the worker — a turn running
+    # or another UI attached does not hide it, since Stop cancels the turn
+    # anyway (docs/sessions.md, "Stopping a worker").
+    # @return [Array<StoppableHold>]
+    def stoppable_holds(running: @watched_running.call, include_delegates: true)
+      holds = []
+      reminders = reminder_items
+      tasks = running.map do |task|
+        HoldItem.new(id: task.id, label: task.command, detail: age_words(task.age_seconds))
+      end
+      children = include_delegates ? delegate_items : []
+
+      holds << StoppableHold.new(kind: :reminders, items: reminders) if reminders.any?
+      holds << StoppableHold.new(kind: :background_tasks, items: tasks) if tasks.any?
+      holds << StoppableHold.new(kind: :delegates, items: children) if children.any?
+      holds
+    end
+
     # #hold_for_request as a Hold: for :background_tasks, the watched tasks
     # still running, read once (TaskWatch#running looks at each task's
-    # process), with +hint+.
+    # process), with +hint+. +ask+: the client will ask the user about what
+    # still runs (an attached terminal's plain `/exit`), so the delegate
+    # children this session has running or with a live worker are listed too;
+    # they are never a hold on their own, so a request without +ask: true
+    # (an exit that deletes the session, the worker's last look before
+    # leaving) ignores them.
     # @return [Hold, nil]
-    def request_hold(requester:, streams: true, hint: nil)
+    def request_hold(requester:, streams: true, hint: nil, ask: false)
       reason = if @engine.turn_running? then :turn_running
                elsif @input_pending.call then :input_queued
                elsif @awaiting_continue.call then :continue_offered
                elsif streams && @bridge && @bridge.open_streams_except(requester).positive? then :client_connected
-               elsif @engine.reminder_store&.any? then :reminders
                end
       return Hold.new(reason: reason) if reason
 
       running = @watched_running.call
-      running.any? ? Hold.new(reason: :background_tasks, tasks: running, hint: hint) : nil
+      holds = stoppable_holds(running: running, include_delegates: ask)
+      return nil if holds.empty?
+
+      Hold.new(reason: holds.first.kind, tasks: running.map(&:to_h), hint: hint, holds: holds)
     end
 
     # What keeps the worker from restarting now (a client asked: POST /exit
@@ -143,5 +191,59 @@ module Samagotchi
       last = [@started_at, @engine.last_activity_at, @bridge&.last_client_activity_at].compact.max
       @clock.call - last
     end
+
+    private
+
+    # One item per reminder the Engine holds. Every reminder ReminderStore
+    # registers is periodic (interval_minutes, 1..1440), so the detail is its
+    # schedule — "every 20m", "every 1h" for a whole number of hours — plus
+    # ", due now" when its next fire has already come. An entry written
+    # without an interval (a store from another chi, a hand-edited one) has no
+    # detail: the label alone.
+    def reminder_items
+      store = @engine.reminder_store
+      return [] unless store
+
+      store.reminders.values.map do |reminder|
+        HoldItem.new(id: reminder[:name], label: reminder[:name].to_s, detail: schedule_words(reminder))
+      end
+    end
+
+    def schedule_words(reminder)
+      minutes = Integer(reminder[:interval_minutes], exception: false)
+      return nil if minutes.nil? || minutes <= 0
+
+      words = (minutes % 60).zero? ? "every #{minutes / 60}h" : "every #{minutes}m"
+      next_fire = reminder[:next_fire_at]
+      words = "#{words}, due now" if next_fire && @clock.call >= next_fire
+      words
+    end
+
+    # One item per delegate child still running or with a live worker.
+    def delegate_items
+      @delegates.call.map do |child|
+        HoldItem.new(id: child.id, label: child.title.to_s, detail: child_state_words(child))
+      end
+    end
+
+    # What a child is doing, as the ask says it. #live_delegates takes only
+    # ones running a turn or with a worker of their own.
+    def child_state_words(child)
+      case child.state
+      when "running" then "running a turn"
+      when "waiting" then "waiting for an answer"
+      else "a live worker"
+      end
+    end
+
+    # How long a task has been running, as the ask words it ("2m", "42s");
+    # nil when its record has no start time.
+    def age_words(seconds)
+      return nil if seconds.nil?
+      return "#{seconds / 3600}h" if seconds >= 3600
+      return "#{seconds / 60}m" if seconds >= 60
+
+      "#{seconds}s"
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: samagotchi
 version: !ruby/object:Gem::Version
-  version: 0.115.0
+  version: 0.117.0
 platform: ruby
 authors:
 - Dmitry Dedov
@@ -362,6 +362,8 @@ files:
 - lib/samagotchi/guardrails/shell_paths.rb
 - lib/samagotchi/guardrails/targets.rb
 - lib/samagotchi/guardrails/verdict.rb
+- lib/samagotchi/guardrails_command.rb
+- lib/samagotchi/hold_stop.rb
 - lib/samagotchi/hook_question.rb
 - lib/samagotchi/hook_routes.rb
 - lib/samagotchi/hooks.rb
@@ -576,6 +578,18 @@ files:
 - lib/samagotchi/steer.rb
 - lib/samagotchi/steer_cut.rb
 - lib/samagotchi/steer_cut_after.rb
+- lib/samagotchi/system_one.rb
+- lib/samagotchi/system_one/answer.rb
+- lib/samagotchi/system_one/approval_question.rb
+- lib/samagotchi/system_one/client.rb
+- lib/samagotchi/system_one/errors.rb
+- lib/samagotchi/system_one/fake_backend.rb
+- lib/samagotchi/system_one/http_backend.rb
+- lib/samagotchi/system_one/log.rb
+- lib/samagotchi/system_one/question.rb
+- lib/samagotchi/system_one/record.rb
+- lib/samagotchi/system_one/self_protect.rb
+- lib/samagotchi/system_one/similar.rb
 - lib/samagotchi/system_prompt.rb
 - lib/samagotchi/task_finish_note.rb
 - lib/samagotchi/task_watch.rb
@@ -811,11 +825,13 @@ files:
 - lib/samagotchi/web/public/stage_view.js
 - lib/samagotchi/web/public/stage_watch.js
 - lib/samagotchi/web/public/start_page.js
+- lib/samagotchi/web/public/stop_sheet.js
 - lib/samagotchi/web/public/storage.js
 - lib/samagotchi/web/public/stream_handlers.js
 - lib/samagotchi/web/public/strip.js
 - lib/samagotchi/web/public/strip_grip.js
 - lib/samagotchi/web/public/sw.js
+- lib/samagotchi/web/public/system_one_wrong.js
 - lib/samagotchi/web/public/tally.js
 - lib/samagotchi/web/public/task_stop.js
 - lib/samagotchi/web/public/thinking_chip.js