samagotchi 0.120.0 → 0.121.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0b242fb85587a862bad996a05e189367e5a4e1b9d025df7a7d335d60b2184fe4
-  data.tar.gz: 85ababba9d74adb82a892cc96d8e2a9fc430a36caf55e9fa9bf549b0f502d136
+  metadata.gz: 78051f4f253f400d0b791fe2694f0dc3d07a19e7d1268ef30557ff3a780d8d64
+  data.tar.gz: c0bf5fbba8c530df5bf56a3947addddc0a9952a39f2077ddd5f59129683ba8f6
 SHA512:
-  metadata.gz: 179d89d141810eccc0038f7eac484775c17cc6b07b80504e4139a6ad0579ebb51fe344619bbb949ad9d5a183c5e82fff90915015915a12bdfac46a5b4589cde2
-  data.tar.gz: faeb2bde8eab54b4c286f596e9e3005678d1a6aeebc4758af00aa33da12e4ec5492627a6edc4b7f19c7343e361b0501e3ad92ef53edcf7684255241904e14006
+  metadata.gz: c438bac307263d1a56cd9a97b56a2c3ab7175d9be0944c4e327fb92a57c9fdd9ffb82bdac8ec7048ac780a4a9e5f3545a3186dfcb3fec7842e687e2d47099307
+  data.tar.gz: 2738c2cc9f4f81f34c3c88f02568066dced57578a88ac6d1e301ca62508a3e343179a97a7d6ef9d6778f463a00648d2aa0f0b1aded820e8bce7442b2601a0d8a

data/CHANGELOG.md

@@ -7,6 +7,39 @@ and commands may change between minor versions. How releases are made:
 [docs/releasing.md](docs/releasing.md).
 ## [Unreleased]
 
+## [0.121.0] - 2026-10-26
+
+### Added
+
+- Toolkit kits pick the MCP servers their sessions reach: `groups: [chrome]` in `toolkit.kits` (names or globs; no
+  key = the base's; the built-ins reach every server, `review` none). `/toolkit` switches them from the next turn
+  (asking first: the cached prompt changes). A call into a server the kit doesn't reach is refused without starting
+  it, naming a kit that reaches it; its deferred stub says why, `/mcp` marks such servers, and the web's toolkit chip
+  lists a restricted kit's servers. Kits without `groups:` send the same request as before.
+
+### Changed
+
+- `ask_user_question`'s description asks the model, when it recommends one option, to put it first and end its
+  label with " (Recommended)" (eval 0005: Flash Next and DeepSeek v4.1-flash mark it 5/5 on a decision question,
+  0/5 before; an answer comes back with the suffix, so `chi answer --option` takes that exact label or the number).
+- The recommended option shows as such: chi web's question card marks its row in the accent colour with a small
+  "recommended" tag (the label shown, and the answered line, without the suffix; nothing is pre-checked), and the
+  terminal's question paints its row bold. Approval and step-limit cards are unchanged.
+- chi web's select boxes have one shape in every dialog: the Invite panel's person/agent and Expires now match the
+  text fields beside them (flat box, same height and corners, one thin caret), as the Thinking and LLM context
+  dialogs' selects already did, in place of the browser's own pill.
+
+### Fixed
+
+- claude-peer (0.4.4): `pair --inbox-socket PATH` says the remote socket is forwarded to this Claude's socket, not
+  from it (`ssh -R`).
+- An ended participant link forgets its comment history even when its first review read is refused.
+- The participant review status stays idle when a live snapshot has no current turn and its status is stale.
+- The participant usage row no longer says "0 queued" when no worker is running.
+- The participant usage row counts link time down and shows its end while the page stays open.
+
+Update with `chi update` (the mcp bundle 0.7.2, claude-peer 0.4.4, the dev profile 0.7.3).
+
 ## [0.120.0] - 2026-10-26
 
 ### Added
@@ -4518,7 +4551,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.120.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.121.0...HEAD
+[0.121.0]: https://github.com/dm1try/samagotchi/compare/v0.120.0...v0.121.0
 [0.120.0]: https://github.com/dm1try/samagotchi/compare/v0.119.0...v0.120.0
 [0.119.0]: https://github.com/dm1try/samagotchi/compare/v0.118.0...v0.119.0
 [0.118.0]: https://github.com/dm1try/samagotchi/compare/v0.117.0...v0.118.0

data/docs/configuration.md

@@ -1400,6 +1400,8 @@ toolkit:
   kits:                # your own, on a base
     audit: { base: lean, add: [web_fetch, delegate], remove: [memory_write] }
     terse: { base: lean, prompt: "- Be concise in your responses" }
+    web: { base: lean, groups: [chrome] }
+    coding: { base: lean, groups: [] }
 ```
 
 | toolkit | declares |
@@ -1412,8 +1414,21 @@ toolkit:
 | `review` | `read`, `memory_read` (not `forget_outputs`, even under the `forget` layer): what a [participant's](internals/participants.md#turns) turn may call, whatever the session declares (the review boundary, [guardrails](guardrails.md#a-participants-review-boundary)). Reserved: `toolkit.kits.review` is refused ("review is reserved for participants' turns"), and a bundle can't declare it. A session may run on it too, as any kit |
 
 - **Plugin tools** are declared in every toolkit unless its `remove:` names them, and so is `forget_outputs` under
-  the `forget` layer. A `kits:` entry takes `base:` (default `full`), `add:`, `remove:` and `prompt:` (any other
-  key, a typo or a `tools:` list, is ignored with a warning); it can't reuse a built-in's name (`review`'s least of all: it is the participants' boundary). A bundle declares its own with `chi.toolkit` ([plugins](plugins.md#chitoolkitname-base-add--remove--prompt-nil)).
+  the `forget` layer. A `kits:` entry takes `base:` (default `full`), `add:`, `remove:`, `prompt:` and `groups:`
+  (any other key, a typo or a `tools:` list, is ignored with a warning); it can't reuse a built-in's name
+  (`review`'s least of all: it is the participants' boundary). A bundle declares its own with `chi.toolkit`
+  ([plugins](plugins.md#chitoolkitname-base-add--remove--prompt-nil-groups-nil)).
+- **Tool-index groups.** `groups:` selects source groups by name or glob (`chrome`, `db*`); for the MCP bundle
+  each group is a server. Selectors are sorted and deduplicated and match the groups declared when plugins load.
+  An omitted key inherits the base's selectors; `full` and `lean` (and `child`, which is on `lean`) reach all
+  groups, `review` (the participants' kit) reaches none, `groups: ["*"]` matches every group, and `groups: []`
+  reaches none. A kit whose base doesn't resolve (an unknown name, a cycle) falls back to `full`, which reaches
+  every group.
+  A selector that matches no group in that load-time snapshot warns once. `find_tools` and `call_tool` are
+  declared only when the toolkit reaches a source group or has a reachable built-in. Calls naming an unreached
+  group are refused before guardrails and do not start its server. The first-run init wait is unchanged: it can
+  still block the first turn even when its server's group is unreached; `start: eager` and stale-cache refreshes
+  also still start. `/mcp` marks servers outside the current toolkit.
 - **A kit's prompt text.** `prompt:` (text, several lines allowed) goes into the system prompt of the sessions on
   that kit, verbatim, with no header: after AGENTS.md and the appended files, before the memory indexes. A kit
   without one inherits its base's (`audit: {base: terse, add: [web_fetch]}` stays concise); `prompt: ""` clears
@@ -1422,12 +1437,13 @@ toolkit:
   fits the kit's work (the coordinator bundle's `coding`: be concise): one that isn't text or is over 2000
   characters is left out with a warning, and long text belongs in `append_system_prompt:`. `/toolkit` shows it
   (`prompt: …`), `/stats` its kit and size (`kit prompt:`), the web's tools chip in its tooltip.
-- **Saved at creation, never re-resolved from config.** A session stores its toolkit as named
+- **Saved at creation, definitions resolve at worker start.** A session stores its toolkit as named
   (`"toolkit": {"name": "lean", "add": [], "remove": []}`) when it is created: `toolkit.default`, `toolkit.child`
   for a delegate child (or the kit its `delegate` call names), or `chi --toolkit NAME` / `--tool` / `--no-tool` ([cli](cli.md)). Changing `toolkit.default`
   doesn't move existing sessions, not even when their worker is woken again; a session from before toolkits is on
-  `full`. A continue and a fork keep the toolkit. `/toolkit` shows and changes it. The prompt text is part of the
-  kit, not of the session file: it follows the name.
+  `full`. A continue and a fork keep the toolkit name. `/toolkit` shows and changes it. The kit's tools, prompt
+  text and group selectors are part of its definition, not the session file: edits reach a saved name at its next
+  worker start.
 - **Left out: reachable or removed.** A built-in missing from a kit's base list (`lean` has no `delegate`; a
   `kits:` entry on `base: lean` or `child` inherits that) is left out softly: it is **reachable**. `find_tools` searches it as group `chi` (`chi/delegate`, with its inputSchema) beside
   the MCP servers' tools, and `call_tool(tool: "chi/delegate", args: {…})` runs it as `delegate` itself, through the
@@ -1435,10 +1451,10 @@ toolkit:
   tool in a toolkit's `remove:`, a `--no-tool` or a `/toolkit remove` is **removed**: hard, also after an add, and
   call_tool can't reach it (`child` removes `memory_write`, `delegate` and `delegate_result`, so a child on it
   starts no children). To keep a built-in away from the model, name it under `remove:`. `find_tools` and `call_tool`
-  are declared when a toolkit has a reachable built-in (or an MCP server is configured); `full` with no MCP server
+  are declared when a toolkit has a reachable built-in or reaches a source group; `full` with no reachable source
   declares neither, and removing them there (`--no-tool call_tool`) leaves nothing out: no prompt line, no chip.
 - **On `api: anthropic`, reachable tools are callable by name.** Every tool `call_tool` reaches (the reachable
-  built-ins, the MCP servers' tools as `mcp_<server>_<tool>`) also goes in the request's tools deferred
+  built-ins, tools from reached MCP groups as `mcp_<server>_<tool>`) also goes in the request's tools deferred
   (`defer_loading`: Messages keeps them out of the model's view until something loads them, at a flat ~100 tokens).
   A direct call of one (`list_sessions`, `mcp_fs_read`) runs, under the same guardrails, approvals and rows as
   through `call_tool` (an MCP tool's call is `call_tool`'s). A `find_tools` hit **loads** its matches (up to 5):
@@ -1455,10 +1471,13 @@ toolkit:
   the route: `Error: delegate isn't declared in this session (toolkit lean); call it with call_tool(tool:
   "chi/delegate", args: {…}) (find_tools gives its inputSchema).` A removed tool's: `Error: memory_write isn't
   loaded in this session (toolkit child) and can't be loaded from here; only the user can (/toolkit add
-  memory_write).` `/toolkit` lists both kinds, and the web's toolkit chip says them in its tooltip.
+  memory_write).` An MCP tool in an unreached group gets a toolkit-specific refusal before guardrails; a deferred
+  stub for it points to the toolkit instead of suggesting a search. `/toolkit` lists group selectors and the
+  change; the web's toolkit chip says its source-group scope in the tooltip.
 - **Applied at a turn's start.** A change (`/toolkit`, a plugin's `ctx.use_toolkit`) is saved at once and the next
-  turn declares it, with its kit's prompt text; once the session has a model reply, `/toolkit` asks first
-  ("Changes that restart the prompt cache"), also for a kit with the same tools and another prompt text.
+  turn declares it, with its kit's prompt text and group filter; once the session has a model reply, `/toolkit`
+  asks first ("Changes that restart the prompt cache"), also when only the group selectors change and the
+  declared tools stay the same.
 - **A name that doesn't resolve** (a typo, a bundle that was uninstalled) declares every tool for that process,
   with one `toolkit>` warning at the first turn; the saved name stays, so the bundle's return brings it back.
 - **Versions.** A toolkit's definition (its tools and its prompt text) can change with chi or a bundle, which

data/docs/internals/participants.md

@@ -94,7 +94,9 @@ participant** and **one role**, until it expires or is revoked.
     block under the lock, and `App#code_identity_ok?` declines unless the trade is proxied with the grant's identity.
     Declined, the code stays and the trade answers `token_bound`, so a forwarded link opened by someone else still
     opens, once, for the account it was sent to. Owner codes and unbound grants' codes are used up whatever the gate
-    says, as before.
+    says, as before. Owner codes burn on purpose (user decision 2026-10-26, don't "align" them with bound grants): an
+    owner code is the whole control plane, so one presented by another identity has leaked and is killed at once;
+    the owner prints a new link (spec: proxy_gate_spec "uses up an owner's code someone else presents").
   - **Which identity string.** The grant binds to whatever the header this run trusts carries: through Okta and
     oauth2-proxy the work email (`alex@corp.com`), through Tailscale Serve the Tailscale login (`alex@github`, or a
     private-relay address). The same person is two strings: bind to the one that proxy sends. A request from a

data/docs/internals/prompt-caching.md

@@ -79,11 +79,13 @@ right-hand column happens.
   `Toolkit::Resolved` the Registry holds, so a switch that changes only the text is a toolkit change
   (`apply_toolkit!` → `reset!`). `full` and kits without one send the bytes they sent before.
 - find_tools' description is a function of the toolkit and the source groups **at load**: `ToolIndex#declare`
-  snapshots the MCP groups' lines (name, summary, callable count) and `ToolIndex#refresh!` (from
-  `ToolkitBinding#apply!`) rebuilds only the `chi` line, the built-ins the toolkit reaches. An MCP server that
-  finishes booting between load and the first turn changes search answers only, so two sessions on the same
-  toolkit with the same MCP cache send the same bytes. Whether find_tools/call_tool are declared at all reads the
-  same two things (`Registry#index_needed?`), never live groups.
+  snapshots source group names and description lines (name, summary, callable count). `ToolIndex#refresh!` (from
+  `ToolkitBinding#apply!`) filters that snapshot by the new toolkit and rebuilds the `chi` line from the built-ins
+  it reaches; it never consults live group names. The same group filter drives searches, deferred MCP tools and
+  whether `find_tools`/`call_tool` are declared (`Registry#index_needed?`). An MCP server that finishes booting
+  between load and the first turn changes search answers only, so two sessions on the same toolkit with the same
+  MCP cache send the same bytes. Kits that omit `groups:` keep their previous request bytes; switching only
+  groups changes the prompt key and asks `/toolkit` to confirm the cache cost once the session has history.
 - A worker's `execute` and `task_create` descriptions carry the finish wake's sentence ("if you end your turn before
   it finishes, chi tells you when it does"; `Engine.new(task_finish_notes:)`, set once as the worker builds its
   Engine); the `--no-shared` REPL's, and a worker's under `session.task_wakes: off`, don't. A session that moves
@@ -240,4 +242,3 @@ is prefilled once. The native and the chat loop use the same plan.
   `cache_prompt: true` on every native request.
 - **OpenRouter / Anthropic:** the default cache TTL is 5 minutes (`cache.ttl: 1h` for an hour, see above).
   Provider routing (which upstream serves a request) also decides whether a cache is there to hit.
-

data/docs/plugins.md

@@ -579,13 +579,16 @@ end
 - Each task runs once per session start. A `-p … --non-interactive` run
   starts them with its turn and shows nothing but the answer.
 
-### `chi.toolkit(name, base:, add: [], remove: [], prompt: nil)`
+### `chi.toolkit(name, base:, add: [], remove: [], prompt: nil, groups: nil)`
 
 A toolkit sessions can be put on: `base`'s tools (`full`, `lean`, `child`, a
 config or bundle toolkit) with `add` declared and `remove` left out, and
 `prompt`: text the sessions on it get in their system prompt, verbatim (nil
 inherits the base's, `""` clears it; at most 2000 characters, and one that
-isn't a String or is longer is a load error). Users pick
+isn't a String or is longer is a load error). `groups` selects the source
+groups the toolkit reaches (names or globs, sorted and deduplicated; nil
+inherits the base's, `[]` reaches none, and `:all` reaches every group).
+Groups match against the tool index's load-time names. Users pick
 it like chi's own (`chi --toolkit NAME`, `toolkit.default`, `/toolkit NAME`),
 and the plugin with `ctx.use_toolkit` (below). Names are `a-z`, `0-9`, `_` and
 `-`; one chi has (`full`, `lean`, `child`) or another bundle declared is a
@@ -593,11 +596,13 @@ load error. A session saved on a toolkit whose bundle is gone declares every
 tool (full) until it comes back, with a warning at its first turn. See
 [Toolkits](configuration.md#toolkits). `prompt:` needs chi 0.72.0 (an older
 chi refuses the keyword, a load error: a bundle that passes it sets
-`requires_chi: ">= 0.72.0"`).
+`requires_chi: ">= 0.72.0"`). `groups:` needs chi 0.121.0: an older chi refuses that keyword
+too, so a bundle passing it sets `requires_chi: ">= 0.121.0"`.
 
 ```ruby
 chi.toolkit "review", base: "lean", add: %w[delegate delegate_result]
 chi.toolkit "coding", base: "child", prompt: "- Be concise in your responses"
+chi.toolkit "web", base: "lean", groups: %w[chrome db*]
 ```
 
 ### `chi.tool_source(call:, acts_as:, label:, wait:, prefix:)`
@@ -611,12 +616,19 @@ first source's `label`). The index has one group of its own, **`chi`**: the
 built-ins the session's toolkit leaves out but doesn't remove
 ([toolkits](configuration.md#toolkits)), each with its registered schema.
 The two tools are registered once, after the plugins load, and declared per
-toolkit: when a plugin registered a source then, or when the toolkit has a
-reachable built-in (`full` with no source declares neither). Nothing a
+toolkit when it reaches a source group or has a reachable built-in (`full`
+with no source declares neither). Nothing a
 source publishes later changes the request's tools, only what a search
 answers, so the prompt cache keeps: the search tool's description lists the
 source groups as they were at load, and a `chi` line first, per toolkit.
-The mcp bundle is the only source so far (a group per server). A source's
+The mcp bundle is the only source so far (a group per server). `groups:`
+filters the groups find_tools searches, the source descriptions in the
+request, and the MCP tools `call_tool` can reach. Its group snapshot is
+filtered again at each toolkit change; new groups published after load do
+not alter that prompt description. An unreached MCP tool call is refused
+before the guardrails without starting the server; a deferred stub says to
+switch to a toolkit that reaches its group. `/mcp` marks servers outside the
+session's toolkit. A source's
 group named `chi`, or named like an earlier group, is left out of search,
 lookup and the description, with one warning per name.
 
@@ -1377,8 +1389,12 @@ bundles:
   its tools as `(failed: …)`. The saved list stays: the next session tries
   again.
 - **`start: eager`** on a server starts it with every session (in an init
-  task, after the Bridge is up), for a server whose start does something
-  you want at once.
+  task, after the Bridge is up), even when that session's toolkit does not
+  reach its group. A first-run init task still blocks the first turn until
+  it finishes, even for an unreached group. A stale-cache refresh likewise
+  starts its short-lived server regardless of the toolkit. Switching away
+  from a group refuses its calls without starting a lazy cached server, and
+  does not stop a server already running; switching back reuses it.
 - **`npx -y …@latest` checks the npm registry on every start** (~3.4 s for
   `chrome-devtools-mcp`, against ~0.9 s for the installed binary). The cache
   hides it from new sessions, but not from the first call. For a faster first

data/docs/testing.md

@@ -230,7 +230,9 @@ A builder runs these while working, not the full suite: the specs the change tou
 files it changed (`lib/samagotchi/foo/bar.rb` → `spec/foo/bar_spec.rb`, `bar_*_spec.rb`…), the specs that read
 docs or source as text (its `RULES`: add one when a full run catches what the names missed) and the golden of a changed
 file's layer (any `terminal_ui/*.rb` → `spec/terminal_ui_golden_spec.rb`; `turn_flow.rb` and `turn_note.rb`, whose
-words the REPL prints, pick it by a rule), then the other name matches (a spec named after several changed files first, e.g. `engine_toolkit_spec.rb` for `engine.rb` and
+words the REPL prints, pick it by a rule). Changes to `tool_declarations.rb` and `system_prompt.rb` also pick the
+effective-model, request, prompt-snapshot and full system-prompt goldens because they hash the request's prompt and
+tools. Then come the other name matches (a spec named after several changed files first, e.g. `engine_toolkit_spec.rb` for `engine.rb` and
 `toolkit.rb`; then one beside the file, so `plugin/context.rb` picks `spec/samagotchi/plugin/*context*` before
 `spec/guardrails/context_spec.rb`), then the specs that name a method the change touches (the innermost `def` around a
 changed line, read with Prism; one `git grep` for up to 12 names; names under 4 characters, `initialize`, `to_s`,

data/lib/samagotchi/bundles/claude-peer/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: claude-peer
-version: 0.4.3
+version: 0.4.4
 scope: system
 description: "Pair this session with a Claude Code session you work with: the claude_send tool and /claude send it a part of the work (a plan step, a diff, a finding) to validate or as context, and Claude's answer comes back as the claude-outbox context; /claude install-skill installs Claude's chi-peer skill, which pairs"
 trust_level: reviewed
@@ -12,7 +12,7 @@ plugin:
   file: plugin.rb
   sha256: sha256:50f427d3862ae9d0d15693b4d887c528162b96c0320cc663df89d59d830d4660
 scripts:
-  pair: sha256:bd850e8091098e249ac5b9b04a95a4d8a0dd8501cf9d58639a47d4f3bce1d757
+  pair: sha256:106d5b44020602fcd2d8065da30d10e1043e30c1b31ea82b4f27f7f79ada6592
   chi-peer-SKILL.md: sha256:b9366f8f4aee9c54d209368ce421eab7b971c03c75efab0415d1988fd40f9e60
 # The plugin needs Samagotchi::Plugin::Peer and chi.peer_source (chi 0.67.0).
 # An agreeing answer's closing wake (the skills say an OK wakes chi once)

data/lib/samagotchi/bundles/claude-peer/scripts/pair

@@ -147,6 +147,6 @@ attach claude-outbox --why "Claude's answers to what you sent it (claude-peer)"
 if [ -z "$inbox" ]; then
   echo "paired with chi $id (socket $sock)"
 else
-  echo "paired with chi $id (socket $inbox on chi's machine, forwarded from $sock)"
+  echo "paired with chi $id (socket $inbox on chi's machine, forwarded to this Claude's $sock)"
 fi
 $chi context ls "$id"

data/lib/samagotchi/bundles/dev/manifest.yml

@@ -1,10 +1,10 @@
 ---
 name: dev
-version: 0.7.2
+version: 0.7.3
 scope: system
 description: "Developer tools"
 trust_level: reviewed
-requires_chi: ">= 0.107.0"
+requires_chi: ">= 0.121.0"
 includes:
 - known-names
 - mcp

data/lib/samagotchi/bundles/mcp/manifest.yml

@@ -1,12 +1,12 @@
 ---
 name: mcp
-version: 0.7.1
+version: 0.7.2
 scope: system
 description: "Tools from MCP servers (stdio): each server in config.yml bundles: mcp: servers: runs for the session; their tools go into chi's tool index: the model searches them with find_tools and calls one with call_tool (<server>/<tool>); /mcp lists them"
 trust_level: reviewed
 files: {}
 plugin:
   file: plugin.rb
-  sha256: sha256:67b1ed9337236deb366459aaaed4e49f0d3122a0b38f3ff9328babcd332c0182
+  sha256: sha256:c4bb4cf99ad43168ea68c25283a153c5dea1e5be123743c8a4c1278c16b5ea90
 # 0.67.0 is the release with chi.tool_source (the core tool index the bundle publishes into).
-requires_chi: ">= 0.67.0"
+requires_chi: ">= 0.121.0"

data/lib/samagotchi/bundles/mcp/plugin.rb

@@ -354,6 +354,7 @@ class Plugin
   def register(chi)
     @chi = chi
     ctx = chi.ctx
+    @ctx = ctx
     configs = @settings["servers"]
     configs = {} unless configs.is_a?(Hash)
     unless configs.empty?
@@ -952,7 +953,10 @@ class Plugin
     return "No servers. Add them in config.yml under `bundles: mcp: servers:` (docs/plugins.md, The mcp bundle)." if @servers.empty?
 
     servers = @servers.map do |server|
-      head = "**#{server.name}**: #{state_text(server)}"
+      marker = if @source && !@source.declared_groups.include?(server.name)
+                 " (not in toolkit #{@ctx.toolkit})"
+               end
+      head = "**#{server.name}**: #{state_text(server)}#{marker}"
       # Sorted: a server lists its tools in its own (often grouped) order.
       tools = server.tools.sort_by(&:name).map { |t| ["- `#{t.server}/#{t.name}`", mark(t)].compact.join(" ") }
       tools.empty? ? head : "#{head}\n#{tools.join("\n")}"

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.120.0
+version: 0.121.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/engine.rb

@@ -377,6 +377,7 @@ module Samagotchi
       # A cut tool output is saved whole in the session's folder.
       @kernel.session_dir = -> { @session&.id && Session.session_dir(@session.id, state_dir: session_state_dir) }
       @kernel.guardrail_gate = @guardrail_wiring.gate
+      @kernel.participant_turn = -> { Steer.participant_author?(turn_author) }
       # The turn-end warm-up; the kernel asks it for a slot pin per request.
       @prompt_warmup = PromptWarmup.new
       @kernel.warmup = @prompt_warmup

data/lib/samagotchi/kernel_loop.rb

@@ -176,6 +176,11 @@ module Samagotchi
     # The Guardrails::Gate ToolRunner asks before each call; the Engine sets
     # it (nil: ToolRunner's own, hooks only).
     attr_accessor :guardrail_gate
+    # Whether the current turn belongs to a participant, so pre-gate
+    # refusals can defer to ReviewBoundary.
+    attr_accessor :participant_turn
+
+    def participant_turn? = @participant_turn&.call == true
     # @return [LLM::TurnSettings] the turn's vision, sampling, thinking and
     #   model name, set by the Engine per turn (#run sets the model name
     #   too); the thinking level is its own field, since the native path

data/lib/samagotchi/plugin/api.rb

@@ -308,12 +308,14 @@ module Samagotchi
       # toolkit.default, ctx.use_toolkit): +base+'s tools (a toolkit chi or
       # a bundle has) with +add+ declared and +remove+ left out, and
       # +prompt+: text the sessions on it get in their system prompt (nil:
-      # its base's, "" none; at most Toolkit::PROMPT_MAX characters). A
+      #   its base's, "" none; at most Toolkit::PROMPT_MAX characters);
+      #   +groups+: MCP source group names/globs (nil inherits its base).
+      #   A
       # name chi (full, lean, child) or another bundle has is a load error,
       # and so is a prompt that isn't text or is too long; a base that
       # doesn't resolve leaves the sessions on it with every tool
       # (Toolkit#resolve).
-      def toolkit(name, base:, add: [], remove: [], prompt: nil)
+      def toolkit(name, base:, add: [], remove: [], prompt: nil, groups: nil)
         name = name.to_s
         raise ArgumentError, "toolkit name #{name.inspect} must be a-z, 0-9, _ and -" unless name.match?(TOOLKIT_NAME)
 
@@ -327,7 +329,8 @@ module Samagotchi
         end
         raise ArgumentError, "toolkit #{name} is declared twice" if @toolkits.any? { |kit| kit.name == name }
 
-        @toolkits << Toolkit::Kit.new(name: name, base: base, add: add, remove: remove, prompt: prompt, source: @bundle)
+        @toolkits << Toolkit::Kit.new(name: name, base: base, add: add, remove: remove, prompt: prompt,
+                                      groups: groups, source: @bundle)
         nil
       end
 

data/lib/samagotchi/terminal_ui/question_slot.rb

@@ -15,6 +15,12 @@ module Samagotchi
       # A numbered option shows as "1) Apple", a word as "yes: continue".
       Option = Struct.new(:key, :label) do
         def text = key.match?(/\A\d+\z/) ? "#{key}) #{label}" : "#{key}: #{label}"
+
+        # The model's pick (a label ending in "(Recommended)"): painted bold,
+        # its label kept as is so a typed label still matches.
+        def recommended? = label.to_s.rstrip.end_with?("(Recommended)")
+
+        def code = recommended? ? "1;92" : 92
       end
 
       CONTINUE_QUESTION = "The turn ran out of iterations. Continue it?"
@@ -83,7 +89,7 @@ module Samagotchi
         question_rows = question_rows.first(1) unless details
         rows.concat(question_rows.map { |row| @paint.call(row, @question_code) })
         rows.concat(@details.map { |row| @paint.call(row, @question_code) }) if details
-        rows.concat(folded ? folded_options(width) : @options.map { |o| @paint.call("  #{o.text}", 92) })
+        rows.concat(folded ? folded_options(width) : @options.map { |o| @paint.call("  #{o.text}", o.code) })
         rows << @paint.call("  [#{@hint}]", 90) if hint && @hint
         rows
       end
@@ -91,19 +97,24 @@ module Samagotchi
       # The options packed into rows of +width+: "  1) Allow once · 2) Deny".
       def folded_options(width)
         rows = []
-        line = +""
+        line = []
         @options.each do |option|
-          item = option.text
-          candidate = line.empty? ? "  #{item}" : "#{line} · #{item}"
-          if !line.empty? && display_width(candidate) > width
+          if !line.empty? && display_width("  #{(line + [option]).map(&:text).join(" · ")}") > width
             rows << line
-            line = "  #{item}"
+            line = [option]
           else
-            line = +candidate
+            line << option
           end
         end
         rows << line unless line.empty?
-        rows.map { |row| @paint.call(row, 92) }
+        rows.map { |row| paint_folded(row) }
+      end
+
+      # One folded row; a recommended option in it is painted on its own.
+      def paint_folded(options)
+        return @paint.call("  #{options.map(&:text).join(" · ")}", 92) if options.none?(&:recommended?)
+
+        @paint.call("  ", 92) + options.map { |o| @paint.call(o.text, o.code) }.join(@paint.call(" · ", 92))
       end
 
       # Word wrap at +width+ columns, the first row after +first+, the others

data/lib/samagotchi/tool_declarations.rb

@@ -412,7 +412,7 @@ module Samagotchi
       },
       {
         name: "ask_user_question",
-        description: "Ask the user a structured qualification question. Supports single/multi selection plus optional freeform/Other input. Prefer this over plain numbered lists when you need a clear choice. The harness renders it natively and returns {selected, freeform}.",
+        description: "Ask the user a structured qualification question. Supports single/multi selection plus optional freeform/Other input. Prefer this over plain numbered lists when you need a clear choice. The harness renders it natively and returns {selected, freeform}. If you recommend one option, put it first and end its label with ' (Recommended)'.",
         parameters: {
           type: "object",
           properties: {

data/lib/samagotchi/tool_runner.rb

@@ -77,7 +77,16 @@ module Samagotchi
       # hook, no approval card for a call that can't run (KernelLoop#dispatch
       # answers it with the not-loaded error).
       original = call.dup
-      verdict = left_out?(call) ? Guardrails::Verdict.new(call: call) : evaluate(call, iteration, params)
+      refusal = unreached_group_refusal(call)
+      verdict = if refusal
+                  Guardrails::Verdict.new(call: call).deny!(refusal.message,
+                                                            rule: Tools::ToolIndex::ToolkitGroupRefusal::RULE,
+                                                            source: "core", decided_by: "core")
+                elsif left_out?(call)
+                  Guardrails::Verdict.new(call: call)
+                else
+                  evaluate(call, iteration, params)
+                end
       call = verdict.call
       params = ToolActivity.tool_activity_params(call[:name], call, registry: tools)
       label = plugin_label(call[:name])
@@ -378,6 +387,27 @@ module Samagotchi
       !registry.left_out(call[:name], layers: layers).nil?
     end
 
+    def unreached_group_refusal(call)
+      return if participant_turn?
+
+      registry = tools
+      index = registry&.index if registry.respond_to?(:index)
+      return unless index.respond_to?(:unreached_tool)
+
+      name = if call[:name] == index.call_name
+               args = call[:args].is_a?(Hash) ? call[:args] : {}
+               args["tool"] || args[:tool]
+             else
+               call[:name]
+             end
+      tool = index.unreached_tool(name)
+      tool && Tools::ToolIndex::ToolkitGroupRefusal.for(tool, registry)
+    end
+
+    def participant_turn?
+      @kernel.respond_to?(:participant_turn?) && @kernel.participant_turn?
+    end
+
     # Whether the turn's host loads tools (TurnSettings#loads_tools).
     def loads_tools? = @kernel.respond_to?(:turn_settings) && @kernel.turn_settings&.loads_tools == true
 
@@ -431,6 +461,12 @@ module Samagotchi
     # A legacy veto keeps its old text; a verdict's deny tells the model
     # who decided and not to route around it.
     def denied(call, verdict)
+      if verdict.rule == Tools::ToolIndex::ToolkitGroupRefusal::RULE
+        output = "[#{call[:name]}] #{verdict.reason}"
+        activity = ToolActivity.tool_activity_event(call[:name], call, output, registry: tools)
+        return { output: output, activity: activity.merge(status: "blocked", guardrail: verdict.to_activity) }
+      end
+
       output = if verdict.legacy?
                  reason = verdict.reason.to_s.strip
                  "[#{call[:name]}] Error: blocked by guardrail: #{reason.empty? ? "blocked by hook" : reason}"