samagotchi 0.121.0 → 0.121.1

data/lib/samagotchi/bundle_command/check.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "prism"
 require "rbconfig"
 require "stringio"
 require "tmpdir"
@@ -214,8 +215,9 @@ module Samagotchi
         floor = lower_bound(manifest.requires_chi)
         return unless floor && File.file?(path(manifest.plugin[:file]))
 
-        calls = File.read(path(manifest.plugin[:file])).scan(API_CALL).flat_map { |call| [call, call.split(".").first(2).join(".")] }
-                    .uniq.select { |call| Plugin::Api::SINCE.key?(call) }
+        source = File.read(path(manifest.plugin[:file]))
+        calls = source.scan(API_CALL).flat_map { |call| [call, call.split(".").first(2).join(".")] }
+        calls = (calls + keyword_calls(source)).uniq.select { |call| Plugin::Api::SINCE.key?(call) }
         call = calls.max_by { |c| Gem::Version.new(Plugin::Api::SINCE[c]) } or return
         version = Plugin::Api::SINCE[call]
         return unless Gem::Version.new(version) > floor
@@ -226,6 +228,29 @@ module Samagotchi
                                                                                       fix: "requires_chi: \">= #{version}\"")
       end
 
+      # Each API call's keywords in +source+, as "chi.toolkit(groups:)": the
+      # call's receiver as written, its name and the keyword (Prism sees
+      # them with or without parens, over lines). Nothing when it doesn't parse.
+      def keyword_calls(source)
+        result = Prism.parse(source)
+        return [] unless result.success?
+
+        found = []
+        nodes = [result.value]
+        while (node = nodes.pop)
+          nodes.concat(node.compact_child_nodes)
+          next unless node.is_a?(Prism::CallNode) && node.receiver && node.arguments
+
+          call = "#{node.receiver.slice}.#{node.name}"
+          node.arguments.arguments.grep(Prism::KeywordHashNode).each do |hash|
+            hash.elements.each do |pair|
+              found << "#{call}(#{pair.key.unescaped}:)" if pair.is_a?(Prism::AssocNode) && pair.key.is_a?(Prism::SymbolNode)
+            end
+          end
+        end
+        found
+      end
+
       def lower_bound(requirement)
         requirement.to_s.split(",").filter_map do |part|
           version = part.strip[LOWER_BOUND, 1]

data/lib/samagotchi/bundles/claude-peer/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: claude-peer
-version: 0.4.4
+version: 0.4.5
 scope: system
 description: "Pair this session with a Claude Code session you work with: the claude_send tool and /claude send it a part of the work (a plan step, a diff, a finding) to validate or as context, and Claude's answer comes back as the claude-outbox context; /claude install-skill installs Claude's chi-peer skill, which pairs"
 trust_level: reviewed
@@ -12,7 +12,7 @@ plugin:
   file: plugin.rb
   sha256: sha256:50f427d3862ae9d0d15693b4d887c528162b96c0320cc663df89d59d830d4660
 scripts:
-  pair: sha256:106d5b44020602fcd2d8065da30d10e1043e30c1b31ea82b4f27f7f79ada6592
+  pair: sha256:d8089ec422a816367d8c41393235223e06b21cbc0ae1e37b6fc22e94ea9a1497
   chi-peer-SKILL.md: sha256:b9366f8f4aee9c54d209368ce421eab7b971c03c75efab0415d1988fd40f9e60
 # The plugin needs Samagotchi::Plugin::Peer and chi.peer_source (chi 0.67.0).
 # An agreeing answer's closing wake (the skills say an OK wakes chi once)

data/lib/samagotchi/bundles/claude-peer/scripts/pair

@@ -26,17 +26,20 @@ while [ $# -gt 0 ]; do
   case "$1" in
     --inbox-socket)
       [ $# -ge 2 ] || usage
-      inbox=$2 shift 2
+      inbox=$2
+      shift 2
       [ -n "$inbox" ] || usage
       ;;
     --inbox-socket=*)
-      inbox=${1#--inbox-socket=} shift
+      inbox=${1#--inbox-socket=}
+      shift
       [ -n "$inbox" ] || usage
       ;;
     -h | --help) usage ;;
     *)
       [ -z "$target" ] || usage
-      target=$1 shift
+      target=$1
+      shift
       ;;
   esac
 done
@@ -84,10 +87,21 @@ case "$target" in
   *) id=$target ;;
 esac
 
-# A JSON string: backslashes, quotes, tabs and newlines escaped.
+# A JSON string: backslashes and quotes escaped, newlines, tabs and
+# carriage returns as \n, \t, \r, any other control character as \u00XX.
 json() {
-  printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/	/\\t/g' |
-    awk 'BEGIN { ORS = ""; printf "\"" } NR > 1 { print "\\n" } { print } END { printf "\"" }'
+  printf '%s' "$1" | awk '
+    BEGIN {
+      ORS = ""; printf "\""
+      for (i = 1; i < 32; i++) esc[sprintf("%c", i)] = sprintf("\\u%04x", i)
+      esc["\t"] = "\\t"; esc["\r"] = "\\r"; esc["\\"] = "\\\\"; esc["\""] = "\\\""
+    }
+    NR > 1 { print "\\n" }
+    {
+      n = length($0)
+      for (i = 1; i <= n; i++) { c = substr($0, i, 1); print ((c in esc) ? esc[c] : c) }
+    }
+    END { printf "\"" }'
 }
 
 # Attaches a pushed source, unless the session has one of that name already.

data/lib/samagotchi/bundles/codex-peer/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: codex-peer
-version: 0.3.3
+version: 0.3.4
 scope: system
 description: "Pair this session with an OpenAI Codex CLI session you work with: the codex_send tool and /codex send it a part of the work (a plan step, a diff, a finding) to validate or as context, with codex queue, and Codex's answer comes back as the codex-outbox context; /codex install-skill installs Codex's chi-peer skill, which pairs"
 trust_level: reviewed
@@ -12,7 +12,7 @@ plugin:
   file: plugin.rb
   sha256: sha256:b03465566272891237ac1906980ff6956579a4703d3a42c414ce50a81de551f6
 scripts:
-  pair: sha256:0830dcb856debea0e4a2a0eb0da8a73b9e9ac2444da957d2928ec734280186a1
+  pair: sha256:a61c3d311ce3f3e5386e90f0f867f649a39763a5883877e731e43d84dd9c85aa
   chi-peer-SKILL.md: sha256:7c392ac04c115ea1e762ad562b5c4c44c3eca71558ba5d9dfeaeabdd533b6a82
 # The plugin needs Samagotchi::Plugin::Peer and chi.peer_source (chi 0.67.0).
 # An agreeing answer's closing wake (the skills say an OK wakes chi once)

data/lib/samagotchi/bundles/codex-peer/scripts/pair

@@ -93,10 +93,21 @@ MSG
   exit 1
 }
 
-# A JSON string: backslashes, quotes, tabs and newlines escaped.
+# A JSON string: backslashes and quotes escaped, newlines, tabs and
+# carriage returns as \n, \t, \r, any other control character as \u00XX.
 json() {
-  printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/	/\\t/g' |
-    awk 'BEGIN { ORS = ""; printf "\"" } NR > 1 { print "\\n" } { print } END { printf "\"" }'
+  printf '%s' "$1" | awk '
+    BEGIN {
+      ORS = ""; printf "\""
+      for (i = 1; i < 32; i++) esc[sprintf("%c", i)] = sprintf("\\u%04x", i)
+      esc["\t"] = "\\t"; esc["\r"] = "\\r"; esc["\\"] = "\\\\"; esc["\""] = "\\\""
+    }
+    NR > 1 { print "\\n" }
+    {
+      n = length($0)
+      for (i = 1; i <= n; i++) { c = substr($0, i, 1); print ((c in esc) ? esc[c] : c) }
+    }
+    END { printf "\"" }'
 }
 
 # Attaches a pushed source, unless the session has one of that name already.

data/lib/samagotchi/bundles/github-pr/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: github-pr
-version: 0.5.0
+version: 0.5.1
 scope: system
 description: Attaches the branch's open GitHub pull request to a session as context (and any PR URL with chi context add or the web's "+ URL"); the agent gets a note when reviews, comments, checks or its state change; in the web, a path:line in an answer links to that line of the PR; the auto_attach setting can offer the PR with a card first, or attach nothing
 trust_level: reviewed
@@ -11,7 +11,7 @@ needs:
   hint: brew install gh, then gh auth login
 plugin:
   file: plugin.rb
-  sha256: sha256:b9e3d7a837ecaa2b0e53f3d62d2ccedd532f4d1b5d6faefd5adc9570cb3c4efe
+  sha256: sha256:cfadb7668528302b3631681e570899230b6878c80ccbc87dfb16c80d43dead7b
 scripts:
   pr_context.rb: sha256:a883d2780e89c68c0d7b6d5e0fcb22c273f17bb167e79064e0e99db6bd2ee6f0
 context_providers:

data/lib/samagotchi/bundles/github-pr/plugin.rb

@@ -649,12 +649,8 @@ class LineLinker
     out << head[pos..] << text[MAX_SCAN..].to_s
   end
 
-  # The URL for +path+'s lines +from+..+to+ (+to+ nil: one line), or nil:
-  # no PR has the file, or more than one does.
-  def url_for(path, from, to = nil) = line_for(path, from, to)&.fetch(:url)
-
-  # {url:, diff:, path:, line:, end_line:} for +path+'s lines (see #url_for),
-  # or nil.
+  # {url:, diff:, path:, line:, end_line:} for +path+'s lines +from+..+to+
+  # (+to+ nil: one line), or nil: no PR has the file, or more than one does.
   def line_for(path, from, to = nil)
     found = @prs.filter_map do |pr, data|
       file = resolve(data.files, path)

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.121.0
+version: 0.121.1
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/child_move.rb

@@ -6,7 +6,7 @@ require "time"
 require_relative "atomic_file"
 require_relative "session"
 require_relative "session_inbox"
-require_relative "worker_sidecar"
+require_relative "worker_link"
 require_relative "log"
 require_relative "tools/delegate_cursor"
 
@@ -93,13 +93,11 @@ module Samagotchi
     # installed (SessionManager.worker_command): it moves.
     # @return [String, nil]
     def unmovable(child_id, state_dir:)
-      owner = SessionManager.session_owner(child_id, state_dir: state_dir) or return nil
-      return "open in a chi REPL; close it there" if owner.tui?
+      link = WorkerLink.resolve(Session.session_dir(child_id, state_dir: state_dir), unlink: false)
+      return "open in a chi REPL; close it there" if link.owner&.tui?
+      return nil if !link.live? || link.features.include?(FEATURE)
 
-      sidecar = WorkerSidecar.live(Session.session_dir(child_id, state_dir: state_dir), unlink: false)
-      return nil if sidecar.nil? || sidecar.features.include?(FEATURE)
-
-      "older chi worker#{" #{sidecar.version}" if sidecar.version}; restart it"
+      "older chi worker#{" #{link.version}" if link.version}; restart it"
     end
 
     # Move +ids+ (direct children of +from+) to +to+: the intent, the

data/lib/samagotchi/children_status.rb

@@ -5,6 +5,7 @@ require_relative "session"
 require_relative "archive_store"
 require_relative "git_head"
 require_relative "reply_wait"
+require_relative "worker_link"
 require_relative "tools/delegate"
 require_relative "tools/delegate_cursor"
 
@@ -106,7 +107,7 @@ module Samagotchi
     # The keys of a children_of row that state_of and child read, for a
     # session counts loaded itself.
     def summary_of(session, state_dir:)
-      live = SessionManager.worker_live?(session.id, state_dir: state_dir)
+      live = WorkerLink.resolve(Session.session_dir(session.id, state_dir: state_dir), unlink: false).worker_owned?
       { live: live, busy: live && session.status == Session::STATUS_RUNNING, status: session.status,
         updated_at: session.updated_at, waiting: session.waiting_question(live: live)&.dig(:kind),
         preview: session.last_prompt.to_s }

data/lib/samagotchi/guardrail_wiring.rb

@@ -271,7 +271,14 @@ module Samagotchi
       # System 1: the ask is judged before the user sees it, and in `on` mode
       # one that passes every gate is allowed once without reaching them
       # (docs/guardrails.md, "System 1").
-      judgment = system_one_judge(payload)
+      judgment = begin
+        system_one_judge(payload)
+      rescue LLM::RequestCancelled
+        return turn_stopped(verdict)
+      end
+      # A turn stopped while the judge was asked opens no card.
+      return turn_stopped(verdict) if @cancelled_lookup.call
+
       if judgment && judgment[:auto]
         verdict.judgment = { id: judgment[:id], p: judgment[:p] }
         verdict.settle!(:allow, decided_by: "system one")
@@ -286,6 +293,12 @@ module Samagotchi
 
     private
 
+    # The deny for a call whose turn was stopped before its ask reached the
+    # user (as Guardrails::Gate words one stopped before the vote).
+    def turn_stopped(verdict)
+      verdict.settle!(:deny, decided_by: "core", note: "The turn was stopped before the user was asked.")
+    end
+
     # The judgments log (SystemOne::Log), beside the approvals store; nil
     # while there is no store dir.
     def system_one_log
@@ -319,6 +332,8 @@ module Samagotchi
                                                             entries: entries),
                    questions: { SystemOne::ApprovalQuestion::ID => SystemOne::ApprovalQuestion.question },
                    cancel_controller: @cancel_controller.call)
+      rescue LLM::RequestCancelled
+        raise
       rescue StandardError => e
         # The client already turns every failure it knows into a nil; this is
         # the unexpected one. Either way the ask goes to the user.
@@ -338,6 +353,8 @@ module Samagotchi
                         latency_ms: latency_ms, decision: decision, origin: "live")
       # A judgment the log cannot hold is no judgment: the user is asked.
       { id: id, p: p, auto: auto && !id.nil? }
+    rescue LLM::RequestCancelled
+      raise
     rescue StandardError => e
       # The approval never fails because of System 1.
       Samagotchi::Log.warn(:guardrails, "system_one_judgment_failed", error: "#{e.class}: #{e.message}")
@@ -408,7 +425,7 @@ module Samagotchi
                   "deny"
                 end
       end
-      system_one_log.label(id, label)
+      system_one_log.label(id, label, question_id: (answer.id if answer.is_a?(Samagotchi::QuestionAnswer)))
     rescue StandardError => e
       Samagotchi::Log.warn(:guardrails, "system_one_label_failed", error: "#{e.class}: #{e.message}")
       nil

data/lib/samagotchi/guardrails/parent_approvals.rb

@@ -69,6 +69,15 @@ module Samagotchi
         # memory-remove rule's ask, which a parent may answer.
         return false if fetch(facts, :rule).to_s == MEMORY_REMOVE_RULE
 
+        chi_files?(facts)
+      end
+
+      # Whether an approval's paths or command name chi's own dirs (#chi_dirs)
+      # or CHI_TEXT, whatever its rule: the part of #protected_facts? that
+      # System 1's SystemOne::SelfProtect shares.
+      def chi_files?(facts)
+        return false unless facts.is_a?(Hash)
+
         dirs = chi_dirs
         paths = Array(fetch(facts, :paths)).map(&:to_s).reject(&:empty?)
         return true if paths.any? { |path| dirs.any? { |dir| ProtectedPaths.within?(ProtectedPaths.real(path), dir) } }

data/lib/samagotchi/guardrails_command.rb

@@ -61,6 +61,7 @@ module Samagotchi
     # uses.
     SKIP_WORDS = {
       already_replayed: "already replayed",
+      judged_live: "already judged live",
       answered_by_parent: "answered by a parent agent",
       parent_cannot_allow: "answered by a parent that could not allow",
       unanswered: "unanswered",
@@ -73,6 +74,36 @@ module Samagotchi
     # and when the user was asked.
     Ask = Data.define(:question_id, :session_id, :approval, :label, :asked_at)
 
+    # What the judgments log already holds, so no ask is judged twice: the
+    # question ids its judgments name, with their origin (a replay's own, a
+    # live one's through its label), and, for live judgments with none (an ask that was
+    # cancelled, or a line older than the id), how many each (session, call
+    # digest) has. A card with no id match takes one of those (#take_live).
+    Judged = Data.define(:question_ids, :live_calls) do
+      # @param entries [Array<Hash>] SystemOne::Log#entries
+      def self.of(entries)
+        ids = entries.filter_map { |entry| [entry["question_id"], entry["origin"]] if entry["question_id"] }.to_h
+        live = Hash.new(0)
+        entries.each do |entry|
+          next unless entry["origin"] == "live" && entry["question_id"].nil?
+
+          live[[entry["session_id"], entry["call_digest"]]] += 1
+        end
+        new(question_ids: ids, live_calls: live)
+      end
+
+      # Whether a live judgment without a question id is this card's: true
+      # (and that judgment counted off) while one with its session and call
+      # digest is left.
+      def take_live(session_id, approval)
+        key = [session_id, SystemOne::ApprovalQuestion.call_fields(approval)["call_digest"]]
+        return false unless live_calls[key].positive?
+
+        live_calls[key] -= 1
+        true
+      end
+    end
+
     # @param argv [Array<String>] the arguments after "guardrails"
     # @param client [SystemOne::Client, nil] the judgment client; nil: the
     #   one config.yml describes (the seam the specs pass a fake through)
@@ -122,7 +153,7 @@ module Samagotchi
 
       sessions_dir = @sessions_dir || Session.default_state_dir
       log = @log || SystemOne::Log.new(dir: Guardrails::Approvals.dir_for(sessions_dir))
-      replayed = File.exist?(log.path) ? log.entries.filter_map { |entry| entry["question_id"] if entry["origin"] == "replay" }.to_set : Set.new
+      judged = Judged.of(File.exist?(log.path) ? log.entries : [])
       @dry_run = options[:dry_run] ? true : false
 
       asks = []
@@ -140,7 +171,7 @@ module Samagotchi
           end
 
           entries.each do |entry|
-            ask = ask_of(entry, name, replayed, sessions_dir)
+            ask = ask_of(entry, name, judged, sessions_dir)
             next if ask.nil?
 
             ask.is_a?(Symbol) ? skipped[ask] += 1 : asks << ask
@@ -168,9 +199,10 @@ module Samagotchi
     end
 
     # One card entry as an ask to judge: an Ask, a skip reason (:already_replayed,
-    # :answered_by_parent, :parent_cannot_allow, :unanswered, :no_approval,
-    # :no_question_id), or nil for an entry that is not a question at all.
-    def ask_of(entry, session_id, replayed, sessions_dir)
+    # :judged_live, :answered_by_parent, :parent_cannot_allow, :unanswered,
+    # :no_approval, :no_question_id), or nil for an entry that is not a
+    # question at all.
+    def ask_of(entry, session_id, judged, sessions_dir)
       return nil unless entry.is_a?(Hash) && entry[:type] == "question"
 
       pending = entry[:pending_question]
@@ -178,7 +210,10 @@ module Samagotchi
 
       question_id = pending[:id].to_s
       return :no_question_id if question_id.empty?
-      return :already_replayed if replayed.include?(question_id)
+
+      origin = judged.question_ids[question_id]
+      return origin == "replay" ? :already_replayed : :judged_live if origin
+      return :judged_live if judged.take_live(session_id, pending[:approval])
 
       answer = entry[:answer]
       label = if entry[:cancelled]

data/lib/samagotchi/image_store.rb

@@ -201,6 +201,9 @@ module Samagotchi
   # a request is sent.
   module ImageStore
     class Error < StandardError
+      # A ref to a file this session doesn't hold as an image: one wording
+      # for a turn's refs (#check_refs) and a web upload's (#ref_for).
+      def self.unknown_image(file) = new("unknown image #{file.to_s[0, 80]}")
     end
 
     DIR = "images"
@@ -278,7 +281,7 @@ module Samagotchi
 
         ref = symbolize(image)
         return "images are refs to uploaded files, not paths" if ref.key?(:path)
-        return "unknown image #{ref[:file].to_s[0, 80]}" unless valid_ref?(session_dir, ref)
+        return Error.unknown_image(ref[:file]).message unless valid_ref?(session_dir, ref)
 
         { file: ref[:file].to_s, name: File.basename(ref[:name].to_s)[0, 120] }
       end
@@ -321,11 +324,11 @@ module Samagotchi
     # A ref for an image already stored in this session (a web upload),
     # rebuilt from the file itself: only its name comes from the caller.
     def self.ref_for(session_dir, file:, name: nil, source: "user")
-      raise Error, "unknown image #{file.to_s[0, 80]}" unless valid_ref?(session_dir, { file: file })
+      raise Error.unknown_image(file) unless valid_ref?(session_dir, { file: file })
 
       bytes = File.binread(File.join(session_dir.to_s, file.to_s))
       info = ImageHeader.read(bytes)
-      raise Error, "unknown image #{file}" unless info && MIME.key?(info.format) && info.width
+      raise Error.unknown_image(file) unless info && MIME.key?(info.format) && info.width
 
       name = File.basename(name.to_s).gsub(/[[:cntrl:]]/, "")[0, 120]
       { file: file.to_s, mime: MIME.fetch(info.format), width: info.width, height: info.height,

data/lib/samagotchi/interrupted_turn.rb

@@ -13,9 +13,12 @@ module Samagotchi
   # runs (its ack's id, LastTurn#enqueued_id once it ends; a Continue turn
   # carries its offer turn's), so any process that loads the session can
   # tell which turn is running (ReplyWait.own_turn); nil when it ran none,
-  # or a worker from before it wrote one.
-  InterruptedTurn = Data.define(:id, :started_at, :at, :iteration, :enqueued_id) do
-    def initialize(id: nil, started_at: nil, at: nil, iteration: nil, enqueued_id: nil) = super
+  # or a worker from before it wrote one. author: a participant's turn's
+  # "p:<id>" (nil for the owner's), which its settled record keeps, so a
+  # chi web restarted since still knows whose wait it is
+  # (ParticipantAccess#turn_author).
+  InterruptedTurn = Data.define(:id, :started_at, :at, :iteration, :enqueued_id, :author) do
+    def initialize(id: nil, started_at: nil, at: nil, iteration: nil, enqueued_id: nil, author: nil) = super
 
     # A saved record (string or symbol keys), an InterruptedTurn as it is;
     # nil for anything else.

data/lib/samagotchi/live_versions.rb

@@ -2,7 +2,7 @@
 
 require_relative "session"
 require_relative "version"
-require_relative "worker_sidecar"
+require_relative "worker_link"
 require_relative "web/info_probe"
 
 module Samagotchi
@@ -21,13 +21,12 @@ module Samagotchi
 
     # @return [Array<Worker>] the workers whose Bridge answers, by session id
     def workers(state_dir: Session.default_state_dir)
-      Dir[File.join(state_dir, "*", WorkerSidecar::FILE)].sort.filter_map do |path|
-        session_dir = File.dirname(path)
-        sidecar = WorkerSidecar.live(session_dir, unlink: false)
-        next unless sidecar
+      WorkerLink.each_dir(state_dir).filter_map do |session_dir|
+        link = WorkerLink.resolve(session_dir, unlink: false)
+        next unless link.live?
 
-        Worker.new(session_id: File.basename(session_dir), version: sidecar.version,
-                   restart: sidecar.features.include?("restart"))
+        Worker.new(session_id: File.basename(session_dir), version: link.version,
+                   restart: link.features.include?("restart"))
       end
     end
 

data/lib/samagotchi/memory_bundle/profile.rb

@@ -152,7 +152,7 @@ module Samagotchi
       # @raise [Uninstaller::UninstallError] when +name+ isn't installed
       def uninstall(name, shipped_dir: SourceNormalizer::SHIPPED_DIR, force: false)
         bundle = Provenance.new(name: name).record
-        raise Uninstaller::UninstallError, "Bundle '#{name}' is not installed" unless bundle
+        raise Uninstaller::UninstallError.not_installed(name) unless bundle
 
         shipped = File.join(shipped_dir, name)
         manifest = File.file?(File.join(shipped, "manifest.yml")) ? Manifest.read(dir: shipped) : nil

data/lib/samagotchi/memory_bundle/uninstaller.rb

@@ -12,7 +12,11 @@ require_relative "../model_overlay"
 module Samagotchi
   module MemoryBundle
     class Uninstaller
-      class UninstallError < StandardError; end
+      class UninstallError < StandardError
+        # The bundle +name+ has no install record: one wording for the
+        # uninstall of a bundle and of a profile (Profile#uninstall).
+        def self.not_installed(name) = new("Bundle '#{name}' is not installed")
+      end
 
       # removed_files: the bundle's own hooks/ and plugin/ files (deleted);
       # trashed_files: its memory files, moved to trash_dir (Trash), nil
@@ -34,7 +38,7 @@ module Samagotchi
       def run
         provenance = Provenance.new(name: @name)
         bundle = provenance.record
-        raise UninstallError, "Bundle '#{@name}' is not installed" unless bundle
+        raise UninstallError.not_installed(@name) unless bundle
 
         # The scope from the flag, else the record's
         target_scope = @scope.to_s.strip.empty? ? bundle.effective_scope : @scope

data/lib/samagotchi/plugin/api.rb

@@ -24,9 +24,11 @@ module Samagotchi
       # A call not listed gets no floor check: it is in the first tag (v0.2.0:
       # chi.command/tool/on/service/init, ctx.settings, ctx.sessions,
       # ctx.ask_model, ctx.notify, ctx.card, ctx.messages…). A member of
-      # one (ctx.sessions.children) is listed when it came later. Keys have
-      # no "?" (API_CALL drops it). A keyword added later (ctx.ask_model's
-      # model: in 0.80.0, ctx.sessions.send's delivery: in 0.64.0) has none.
+      # one (ctx.sessions.children) is listed when it came later; fork, send
+      # and read are in v0.2.0. Keys have no "?" (API_CALL drops it). A
+      # keyword added later is "call(keyword:)", the call's receiver as the
+      # plugin writes it (Check#keyword_calls: `ctx.sessions.send(…,
+      # delivery:)` is seen, a `sessions = ctx.sessions` alias isn't).
       # Events aren't listed: chi.on takes any symbol and an older chi never
       # fires one it doesn't know (harmless; chi bundle check warns on it),
       # and a manifest hook's events: list (BundleHook) needs the bundle's
@@ -42,7 +44,8 @@ module Samagotchi
         "chi.tool_source" => "0.67.0", "chi.peer_source" => "0.67.0", "ctx.http" => "0.80.0",
         "ctx.cost" => "0.83.0", "ctx.sessions.children" => "0.34.0", "ctx.load_tools" => "0.99.0",
         "ctx.usage" => "0.100.0", "ctx.sessions.stop" => "0.34.0", "ctx.turn_author" => "0.106.0",
-        "ctx.sessions.review" => "0.107.0"
+        "ctx.sessions.review" => "0.107.0", "ctx.sessions.send(delivery:)" => "0.64.0",
+        "chi.toolkit(prompt:)" => "0.72.0", "ctx.ask_model(model:)" => "0.80.0", "chi.toolkit(groups:)" => "0.121.0"
       }.freeze
 
       # @param bundle [String]
@@ -319,7 +322,7 @@ module Samagotchi
         name = name.to_s
         raise ArgumentError, "toolkit name #{name.inspect} must be a-z, 0-9, _ and -" unless name.match?(TOOLKIT_NAME)
 
-        problem = Toolkit.prompt_error(prompt)
+        problem = Toolkit.prompt_error(prompt) || (Toolkit.groups_error(groups) unless groups == :all)
         raise ArgumentError, "toolkit #{name}: #{problem}" if problem
         raise ArgumentError, "this chi has no toolkits (plugins: false)" unless @registries.toolkits
         if Toolkit::BUILTIN_KITS.key?(name)

data/lib/samagotchi/plugin/sessions.rb

@@ -3,7 +3,7 @@
 require_relative "../client_id"
 require_relative "../delivery"
 require_relative "../session"
-require_relative "../bridge_client"
+require_relative "../worker_link"
 require_relative "../bridge/turn_accumulator"
 require_relative "../tools/delegate"
 require_relative "../children_status"
@@ -27,6 +27,11 @@ module Samagotchi
       # A fork, send, read or stop that couldn't be done; the message says why.
       class Error < StandardError; end
 
+      # What starting a session can be refused by, answered as Error with
+      # chi's own message: a model that is gone, a toolkit the config refuses,
+      # a bad argument. #review adds its own: a subject it won't take.
+      REFUSED = [ModelProfile::MissingModel, Toolkit::Refused, ArgumentError].freeze
+
       # @param host [Host] session_id, cwd, model_name and state_dir
       def initialize(host)
         @host = host
@@ -44,7 +49,9 @@ module Samagotchi
       # @param prompt [String, nil] the child's first turn
       # @return [String] the child's id
       # @raise [Error] no session yet, a scratch session (the child would
-      #   outlive it), or too many children running
+      #   outlive it), too many children running, or the model or toolkit the
+      #   child starts on being refused (a config kit with an invalid groups:,
+      #   a model that is gone)
       def fork(messages:, title: nil, prompt: nil)
         parent_id = @host.session_id.call or raise Error, "this session has no id yet"
         raise Error, "a scratch session starts no other sessions: they would outlive it" if @host.scratch&.call
@@ -60,6 +67,8 @@ module Samagotchi
           setup: @host.setup&.call || SessionSetup.new
         )
         child.id
+      rescue *REFUSED => e
+        raise Error, e.message
       end
 
       # A review of this session (ReviewStart.fork, chi review --from): a new
@@ -81,7 +90,7 @@ module Samagotchi
 
         ReviewStart.fork(from: source, subjects: Array(subjects), seed: seed, state_dir: state_dir,
                          recap_wait: recap_wait).id
-      rescue ReviewStart::Refused, ModelProfile::MissingModel, ArgumentError => e
+      rescue *REFUSED, ReviewStart::Refused => e
         raise Error, e.message
       end
 
@@ -212,7 +221,7 @@ module Samagotchi
       end
 
       def live_snapshot(sid, state_dir)
-        BridgeClient.discover(sid, session_dir: Session.session_dir(sid, state_dir: state_dir))&.get_json("snapshot")
+        WorkerLink.client(sid, session_dir: Session.session_dir(sid, state_dir: state_dir))&.get_json("snapshot")
       rescue StandardError
         nil
       end

data/lib/samagotchi/push_command.rb

@@ -135,7 +135,7 @@ module Samagotchi
     # route does). @return [Boolean] delivered
     def test(sub)
       result = client_for(sub).deliver(sub, Web::Push::TEST_PAYLOAD, ttl: Web::Push::TEST_TTL, urgency: "high")
-      words = "#{result.status} #{result.code}#{" (#{result.ms} ms)" if result.ms}"
+      words = [result.status, result.code, ("(#{result.ms} ms)" if result.ms)].reject { |part| part.to_s.empty? }.join(" ")
       words += ": #{result.error}" if result.error && !result.ok?
       if result.status == :gone
         @store.remove(sub.id)

data/lib/samagotchi/relay_verifier.rb

@@ -2,8 +2,7 @@
 
 require_relative "client_id"
 require_relative "session"
-require_relative "bridge_client"
-require_relative "worker_sidecar"
+require_relative "worker_link"
 require_relative "question_desk"
 require_relative "log"
 
@@ -87,7 +86,7 @@ module Samagotchi
     # @return [Hash, nil] what the parent's live Bridge says about the relay
     def parent_relay(parent_id, relay_id)
       dir = Session.session_dir(parent_id, state_dir: @state_dir)
-      client = BridgeClient.discover(parent_id, session_dir: dir) or return nil
+      client = WorkerLink.client(parent_id, session_dir: dir) or return nil
       response = client.relay_status(relay_id)
       response.ok? ? response.json : nil
     rescue SystemCallError, IOError