samagotchi 0.121.0 → 0.122.0

data/lib/samagotchi/turn_checkpoint.rb

@@ -93,8 +93,9 @@ module Samagotchi
       SessionInbox.prune_old(session_dir, SETTLED_DIR, max_age: max_age)
     end
 
-    def self.settled_record(id, ended_at: nil, seconds: nil)
-      LastTurn.new(outcome: "canceled", cancel_reason: WORKER_STOPPED, ended_at: ended_at, seconds: seconds, enqueued_id: id)
+    def self.settled_record(id, ended_at: nil, seconds: nil, author: nil)
+      LastTurn.new(outcome: "canceled", cancel_reason: WORKER_STOPPED, ended_at: ended_at, seconds: seconds, enqueued_id: id,
+                   author: author)
     end
     private_class_method :settled_record
 
@@ -123,13 +124,15 @@ module Samagotchi
 
     # A participant's queued turn the worker refused (Worker#refuse_participant_turn:
     # +reason+ revoked or cap_reached) ends its sender's wait: no turn ran,
-    # canceled for that reason (ParentReport reads it as refused).
-    def self.record_refused(session_dir, enqueued_id, reason:)
+    # canceled for that reason (ParentReport reads it as refused). Its
+    # +author+ (the participant's "p:<id>") says whose wait it is to a chi
+    # web restarted since (ParticipantAccess#turn_author).
+    def self.record_refused(session_dir, enqueued_id, reason:, author: nil)
       id = enqueued_id.to_s
       return unless SessionInbox::ENQUEUED_ID_NAME.match?(id)
 
       write_settled(session_dir, id, LastTurn.new(outcome: "canceled", cancel_reason: reason.to_s,
-                                                  ended_at: Time.now.iso8601(3), enqueued_id: id))
+                                                  ended_at: Time.now.iso8601(3), enqueued_id: id, author: author))
     rescue SystemCallError, IOError => e
       Log.warn(:worker, "refused_turn_write_failed", error: e.class.name, msg: e.message, enqueued_id: id)
     end
@@ -138,7 +141,7 @@ module Samagotchi
       id = mark.enqueued_id.to_s
       return unless SessionInbox::ENQUEUED_ID_NAME.match?(id)
 
-      write_settled(session_dir, id, settled_record(id, ended_at: Time.now.iso8601(3), seconds: seconds))
+      write_settled(session_dir, id, settled_record(id, ended_at: Time.now.iso8601(3), seconds: seconds, author: mark.author))
     rescue SystemCallError => e
       # The settle goes on; a wait for that turn runs to its timeout.
       Log.warn(:worker, "settled_turn_write_failed", error: e.class.name, msg: e.message)
@@ -163,6 +166,7 @@ module Samagotchi
       @written_at = nil
       @started_at = nil
       @enqueued_id = nil
+      @author = nil
     end
 
     # A turn begins (before Engine#run_turn and the worker's running save):
@@ -170,7 +174,8 @@ module Samagotchi
     # images, no turn id), marked at iteration 0, so a worker killed before
     # the loop's first boundary leaves the prompt and a mark the next one
     # settles. A continue turn (no prompt) is the history, marked.
-    # Every mark of the turn carries +enqueued_id+ (InterruptedTurn's).
+    # Every mark of the turn carries +enqueued_id+ and a participant's
+    # +author+ (InterruptedTurn's).
     # @param prompt [String, nil]
     # @param enqueued_id [String, nil] the input the turn runs
     # @param author [Hash] a participant's prompt's author fields
@@ -179,6 +184,7 @@ module Samagotchi
     def begin_turn(prompt: nil, enqueued_id: nil, author: {})
       @boundaries = 0
       @enqueued_id = enqueued_id.to_s.empty? ? nil : enqueued_id.to_s
+      @author = author[:author]
       @written_at = nil
       @started_at = Time.now.iso8601(3)
       messages = Array(@session.messages).dup
@@ -186,7 +192,7 @@ module Samagotchi
       # stamp (Engine's Turn#wall), which the turn's first boundary saves.
       messages << { role: "user", content: prompt, **author, MessageTime::KEY => MessageTime.iso(MessageTime.now) } unless prompt.to_s.empty?
       @session.turn_checkpoint = { messages: messages, marker: InterruptedTurn.new(started_at: @started_at, at: @started_at, iteration: 0,
-                                                                                   enqueued_id: @enqueued_id) }
+                                                                                   enqueued_id: @enqueued_id, author: @author) }
     end
 
     # The turn ended (or never began): the session saves its own messages.
@@ -212,7 +218,7 @@ module Samagotchi
       # forget stub) while a save on another thread serializes this one.
       messages = conversation.map { |message| message.is_a?(Hash) ? message.dup : message } + merged
       marker = InterruptedTurn.new(id: turn_id, started_at: @started_at, at: Time.now.iso8601(3), iteration: @boundaries,
-                                   enqueued_id: @enqueued_id)
+                                   enqueued_id: @enqueued_id, author: @author)
       @session.turn_checkpoint = { messages: messages, marker: marker }
       return false unless due? || !merged.empty?
 

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.121.0"
+  VERSION = "0.122.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -16,6 +16,7 @@ require_relative "../answer_tail"
 require_relative "../answer_refs"
 require_relative "../question_asked"
 require_relative "../bridge_client"
+require_relative "../worker_link"
 require_relative "../bridge/bounded_queue"
 require_relative "../bridge/card_store"
 require_relative "../session"
@@ -54,6 +55,7 @@ require_relative "markdown_renderer"
 require_relative "capabilities"
 require_relative "editor"
 require_relative "../message_parts"
+require_relative "../launch_mode"
 require_relative "session_summary"
 require_relative "session_access_routes"
 require_relative "principal"
@@ -321,6 +323,11 @@ module Samagotchi
         # Anything else is a file under public_dir (/assets/*, /public/* or
         # a bare path such as /style.css), or 404.
         serve_static(req)
+      rescue Toolkit::Refused => e
+        # A new session (create, continue, fork, review) on a config kit
+        # with an invalid groups: (Toolkit.check_new!), whichever handler
+        # spawned it.
+        error_response(400, "toolkit_refused", e.message)
       rescue StandardError => e
         Log.exception(:web, "request_failed", e, method: env["REQUEST_METHOD"], path: env["PATH_INFO"])
         # A participant never reads an exception's words (they may name a
@@ -1086,7 +1093,7 @@ module Samagotchi
         reply = request.call(client)
         # Not the route's own 403 (a parent's option refused): the worker
         # asked for a secret this chi web didn't send.
-        return error_response(502, BridgeSecret::ERROR, BridgeSecret::REFUSED) if reply.secret_refused?
+        return error_response(502, BridgeSecret::ERROR, BridgeSecret.refused(id)) if reply.secret_refused?
 
         mapped = yield(reply)
         return mapped if mapped
@@ -1106,7 +1113,7 @@ module Samagotchi
       end
 
       def not_live(id)
-        error_response(503, "not_live", "no live bridge for session #{id}")
+        error_response(503, "not_live", WorkerLink.not_live(id))
       end
 
       # A live worker refused or failed the request (a 500 in its handler, a
@@ -1134,8 +1141,9 @@ module Samagotchi
       # The session's Bridge, waiting briefly for one a resume just spawned.
       # @return [BridgeClient, nil]
       def live_bridge_client(id)
-        sidecar = bridge_sidecar(id) || await_bridge_sidecar(id, timeout: [@bridge_wait_timeout.to_f, 5.0].min)
-        bridge_client_for(id, sidecar)
+        link = worker_link(id)
+        link = await_worker_link(id, timeout: [@bridge_wait_timeout.to_f, 5.0].min) unless link.live?
+        link_client(id, link)
       end
 
       # The process holding the session (an OwnerLock::Owner), or nil. A worker always runs a Bridge; a TUI (plain `chi`) doesn't share.
@@ -1217,7 +1225,7 @@ module Samagotchi
       # (?full=1: as the list's).
       def handle_context_show(req, id, name)
         session = @session_class.load(id, state_dir: default_state_dir)
-        attached = find_context(session, name) or return error_response(404, "not_found", "no source #{name[0, 40]}")
+        attached = find_context(session, name) or return error_response(404, "context_missing", "no source #{name[0, 40]}")
         own = ContextSources.session_location(id, state_dir: default_state_dir)
         row = context_row(attached, own, own.subscriptions, full: truthy_param?(req.params["full"]))
         json_response(200, row.merge(text: attached.snapshot.text))
@@ -1297,7 +1305,7 @@ module Samagotchi
         return context_remove_own(id, name) if truthy_param?(req.params["own"])
 
         session = @session_class.load(id, state_dir: default_state_dir)
-        attached = find_context(session, name) or return error_response(404, "not_found", "no source #{name[0, 40]}")
+        attached = find_context(session, name) or return error_response(404, "context_missing", "no source #{name[0, 40]}")
         if attached.location.session?
           attached.location.remove(attached.name)
           json_response(200, { status: "detached", name: attached.name })
@@ -1312,10 +1320,10 @@ module Samagotchi
         when :removed then json_response(200, { status: "detached", name: name })
         when :project
           error_response(409, "project_source", ContextCommand.project_source_message(name))
-        else error_response(404, "not_found", "no source #{name[0, 40]}")
+        else error_response(404, "context_missing", "no source #{name[0, 40]}")
         end
       rescue ContextSources::Invalid
-        error_response(404, "not_found", "no source #{name[0, 40]}")
+        error_response(404, "context_missing", "no source #{name[0, 40]}")
       end
 
       def attached_context(session, shadowed: false)
@@ -1355,47 +1363,55 @@ module Samagotchi
           return error_response(404, "not_found", "Session not found: #{id}")
         end
 
-        # Single live transport: proxy to the session's Bridge. When no live
-        # worker exists there is nothing to stream — history is available via
-        # GET /api/sessions/:id/output.
-        sidecar = bridge_sidecar(id)
-        # A resume just spawned the worker: its bridge may still be binding.
-        # Wait briefly for it so the first SSE connect lands on a live bridge
-        # instead of an instantly-closed empty 200 / 503 during startup.
-        if sidecar.nil? && @bridge_wait_timeout.to_i.positive?
-          sidecar = await_bridge_sidecar(id, timeout: [@bridge_wait_timeout.to_f, 2.0].min)
+        link = worker_link(id)
+        if link.is_a?(WorkerLink::Starting)
+          return error_response(503, "not_live", format(LaunchMode::BRIDGE_LATE, id)) if link.stuck
+
+          link = await_worker_link(id, timeout: [@bridge_wait_timeout.to_f, 2.0].min)
         end
-        return error_response(503, "not_live", "no live bridge for session #{id}") unless sidecar
+        return stream_link_error(id, link) unless link.live?
 
-        client = bridge_client_for(id, sidecar)
+        client = link_client(id, link)
+        filter = stream_filter(req, id)
+        query = participant_view?(req) ? participant_stream_query(req) : stream_query(req)
+        opened = client.open_stream(query: query, last_event_id: req.env["HTTP_LAST_EVENT_ID"])
+        return stream_open_error(id, opened) unless opened.is_a?(BridgeClient::StreamOpen::Opened)
 
-        headers = {
-          "Content-Type" => "text/event-stream",
-          "Cache-Control" => "no-cache",
-          "Connection" => "keep-alive",
-          "X-Accel-Buffering" => "no"
-        }
+        handed_off = false
+        begin
+          headers = {
+            "Content-Type" => "text/event-stream",
+            "Cache-Control" => "no-cache",
+            "Connection" => "keep-alive",
+            "X-Accel-Buffering" => "no"
+          }
+
+          # Handlers that buffer enumerable bodies before responding (rackup's
+          # WEBrick does `body.each` to completion) hang forever on an unbounded
+          # SSE body — the browser never even receives the status line. When the
+          # handler supports hijacking, stream frames straight to the socket
+          # instead of returning an enumerable.
+          if req.env["rack.hijack?"]
+            hijack = sse_hijack(id, req, client, opened, filter)
+            handed_off = true
+            return [200, headers.merge("rack.hijack" => hijack), []]
+          end
 
-        # Handlers that buffer enumerable bodies before responding (rackup's
-        # WEBrick does `body.each` to completion) hang forever on an unbounded
-        # SSE body — the browser never even receives the status line. When the
-        # handler supports hijacking, stream frames straight to the socket
-        # instead of returning an enumerable.
-        if req.env["rack.hijack?"]
-          hijack = sse_hijack(id, req, client)
-          return [200, headers.merge("rack.hijack" => hijack), []]
+          body = proxy_stream_body(id, req, client, opened, filter)
+          handed_off = true
+          [200, headers, body]
+        ensure
+          opened.sock.close unless handed_off
         end
-
-        [200, headers, proxy_stream_body(id, req, client)]
       end
 
       # The one ProxyStreamBody both of #handle_stream's transports send:
       # the session's Bridge stream, through the request principal's frame
       # filter (#stream_filter).
-      def proxy_stream_body(id, req, client)
+      def proxy_stream_body(_id, req, client, opened, filter)
         query = participant_view?(req) ? participant_stream_query(req) : stream_query(req)
-        ProxyStreamBody.new(client: client, query: query, headers: req.env,
-                            server_running: stream_running(principal(req)), filter: stream_filter(req, id))
+        ProxyStreamBody.new(client: client, opened: opened, query: query, headers: req.env,
+                            server_running: stream_running(principal(req)), filter: filter)
       end
 
       # What a request's stream goes through on its way from the Bridge:
@@ -1465,10 +1481,10 @@ module Samagotchi
       # frames directly to the client socket until it disconnects. The handler
       # (WEBrick via rackup) has already sent the status line + headers, so
       # only body bytes go to the socket here.
-      def sse_hijack(id, req, client)
+      def sse_hijack(id, req, client, opened, filter)
         # Made before the status line goes out: a principal with no filter
         # is refused (#stream_filter), never streamed.
-        body = proxy_stream_body(id, req, client)
+        body = proxy_stream_body(id, req, client, opened, filter)
         lambda do |io|
           body.each { |chunk| io.write(chunk) }
         rescue Errno::EPIPE, Errno::ECONNRESET, IOError
@@ -1476,36 +1492,67 @@ module Samagotchi
         rescue StandardError => e
           Log.warn(:web, "proxy_failed", sid: id, port: client.port, error: e.class.name, msg: e.message)
           nil
+        ensure
+          body.close
         end
       end
 
-      # Bounded wait for a freshly-spawned worker's bridge sidecar so the
-      # response hands the client a live transport without client-side polling.
-      # Returns the bridge's sidecar (WorkerSidecar), or nil when it is not up by the deadline (the
-      # session still exists; EventSource auto-reconnect covers late binders).
-      def await_bridge_sidecar(session_id, timeout: @bridge_wait_timeout)
-        return nil if timeout.nil? || timeout <= 0
+      # Bounded wait for a freshly-spawned worker's Bridge so the response
+      # hands the client a live transport without client-side polling (the
+      # web's WorkerLink.await: #worker_link polled). Returns the first Live,
+      # else the last outcome (None when +timeout+ allows no wait): the
+      # session still exists; EventSource auto-reconnect covers late binders.
+      # @return [WorkerLink::Live, WorkerLink::None, WorkerLink::Stale]
+      def await_worker_link(session_id, timeout: @bridge_wait_timeout)
+        return WorkerLink::None.new if timeout.nil? || timeout <= 0
+
+        WorkerLink.await(session_id, session_dir: @session_class.session_dir(session_id, state_dir: default_state_dir),
+                         timeout: timeout, interval: BridgeClient::SPAWN_POLL_INTERVAL,
+                         give_up: lambda do |outcome|
+                           outcome.is_a?(WorkerLink::Leaving) || outcome.is_a?(WorkerLink::Stale) ||
+                             outcome.is_a?(WorkerLink::Skew) ||
+                             (outcome.is_a?(WorkerLink::Starting) && outcome.stuck)
+                         end,
+                         host: DEFAULT_HOST)
+      end
+
+      def stream_link_error(id, link)
+        return error_response(502, "worker_newer", link.message(id)) if link.is_a?(WorkerLink::Skew)
+        if link.is_a?(WorkerLink::Starting) && link.stuck
+          return error_response(503, "not_live", format(LaunchMode::BRIDGE_LATE, id))
+        end
+        if link.is_a?(WorkerLink::Leaving)
+          return json_response(503, { error: "not_live", detail: WorkerLink.not_live(id),
+                                      leaving: true, leave_seconds: link.left.round(1) })
+        end
 
-        BridgeClient.poll(timeout, interval: BridgeClient::SPAWN_POLL_INTERVAL) { bridge_sidecar(session_id) }
-      rescue StandardError
-        nil
+        error_response(503, "not_live", WorkerLink.not_live(id))
+      end
+
+      def stream_open_error(id, outcome)
+        return error_response(503, "not_live", WorkerLink.unanswered(id)) if outcome.is_a?(BridgeClient::StreamOpen::Unreachable)
+        return error_response(503, "not_live", WorkerLink.not_live(id)) if outcome.reason == :unknown_session
+        return error_response(502, "bridge_secret", BridgeSecret.refused(id)) if outcome.reason == :bridge_secret
+
+        error_response(502, "bridge_error", outcome.detail || "the session's worker answered #{outcome.status}")
       end
 
-      # The session's live Bridge's sidecar (stale ones are removed), or nil:
-      # read again for every request, so a respawned worker's port and secret
-      # are the ones used.
-      # @return [WorkerSidecar, nil]
-      def bridge_sidecar(session_id)
+      # The session's worker link (WorkerLink.resolve; stale sidecars are
+      # removed): read again for every request, so a respawned worker's port
+      # and secret are the ones used.
+      # @return [WorkerLink::Live, WorkerLink::None, WorkerLink::Stale]
+      def worker_link(session_id)
         dir = @session_class.session_dir(session_id, state_dir: default_state_dir)
-        BridgeClient.live_sidecar(dir, host: DEFAULT_HOST)
+        WorkerLink.resolve(dir, unlink: true, host: DEFAULT_HOST)
       rescue StandardError
-        nil
+        WorkerLink::None.new
       end
 
       # @return [BridgeClient, nil] a client for the session's live Bridge
-      def bridge_client(session_id) = bridge_client_for(session_id, bridge_sidecar(session_id))
+      def bridge_client(session_id) = link_client(session_id, worker_link(session_id))
 
-      def bridge_client_for(session_id, sidecar) = BridgeClient.for_sidecar(session_id, sidecar, host: DEFAULT_HOST)
+      # @return [BridgeClient, nil] +link+'s client when it is Live
+      def link_client(session_id, link) = link.live? ? link.client(session_id, host: DEFAULT_HOST) : nil
 
       # GET a read path of the session's live Bridge (+path+: "state",
       # "snapshot", "stats", ...).
@@ -1533,7 +1580,8 @@ module Samagotchi
 
         path = File.join(@public_dir, "index.html")
         if File.file?(path)
-          body = File.read(path).sub("<body>", "<body #{index_data_attributes(req)}>")
+          # A block: a preset's \& or \' is text, never a backreference.
+          body = File.read(path).sub("<body>") { "<body #{index_data_attributes(req)}>" }
           [200, {
             "Content-Type" => "text/html; charset=utf-8",
             "Content-Length" => body.bytesize.to_s,
@@ -1823,9 +1871,12 @@ module Samagotchi
         #   is kept (the env carries the token cookie, never held or inspected)
         # @param filter [#call, nil] chunk -> String (nil or "": nothing sent);
         #   it sees the Bridge's reads as they come, not whole frames
-        # @param client [BridgeClient] the session's Bridge (App#bridge_client_for)
-        def initialize(client:, query:, headers:, server_running: -> { true }, filter: nil)
+        # @param client [BridgeClient] the session's Bridge (App#link_client)
+        # @param opened [BridgeClient::StreamOpen::Opened] the socket whose
+        #   200 was answered to the caller
+        def initialize(client:, opened:, query:, headers:, server_running: -> { true }, filter: nil)
           @client = client
+          @opened = opened
           @query = query
           @last_event_id = headers["HTTP_LAST_EVENT_ID"]
           @server_running = server_running
@@ -1833,16 +1884,23 @@ module Samagotchi
         end
 
         def each(&)
-          # Forward the browser's auto-reconnect cursor: the bridge prefers the
-          # Last-Event-ID header over ?from_seq, and the reconnect URL carries a
-          # stale initial cursor — without this the bridge would replay content
-          # already delivered (duplicate bubbles).
-          return @client.stream(query: @query, last_event_id: @last_event_id, running: @server_running, &) unless @filter
-
-          @client.stream(query: @query, last_event_id: @last_event_id, running: @server_running) do |chunk|
-            out = @filter.call(chunk)
+          opened = @opened
+          return unless opened
+
+          @client.read_stream(opened, running: @server_running) do |chunk|
+            out = @filter ? @filter.call(chunk) : chunk
             yield(out) unless out.nil? || out.empty?
           end
+        ensure
+          @opened = nil
+        end
+
+        def close
+          opened = @opened
+          @opened = nil
+          opened&.sock&.close
+        rescue IOError, SystemCallError
+          nil
         end
       end
     end

data/lib/samagotchi/web/participant_access.rb

@@ -13,6 +13,7 @@ require_relative "../parent_report"
 require_relative "../participant_messages"
 require_relative "../participants"
 require_relative "../session"
+require_relative "../turn_checkpoint"
 require_relative "../log"
 
 module Samagotchi
@@ -116,7 +117,7 @@ module Samagotchi
         detail = ParticipantMessages::TOKEN_BOUND
         return error_response(401, "token_bound", detail) if req.path_info.start_with?("/api/")
 
-        html_response(401, BOUND_PAGE.sub(ENDED_SENTENCE, "#{detail[0].upcase}#{detail[1..]}."))
+        html_response(401, BOUND_PAGE.sub(ENDED_SENTENCE) { "#{detail[0].upcase}#{detail[1..]}." })
       end
 
       def settle_grant(grant)
@@ -144,7 +145,7 @@ module Samagotchi
         code, detail = ENDED.fetch(state)
         return error_response(401, code, detail) if req.path_info.start_with?("/api/")
 
-        html_response(401, ENDED_PAGE.sub(ENDED_SENTENCE, "#{detail[0].upcase}#{detail[1..]}."))
+        html_response(401, ENDED_PAGE.sub(ENDED_SENTENCE) { "#{detail[0].upcase}#{detail[1..]}." })
       end
 
       def audit_expired(grant)
@@ -336,20 +337,38 @@ module Samagotchi
       end
 
       # Whether the turn +enqueued_id+ of session +id+ is +grant+'s: chi
-      # web's record of who sent it, else (a chi web restarted since) its
-      # waiting input file's author, which only a principal stamps.
+      # web's record of who sent it, else (a chi web restarted since) the
+      # author the session's files keep for it (#turn_author), which only a
+      # principal stamps.
       def own_turn?(grant, id, enqueued_id)
         return false unless enqueued_id.is_a?(String) && !enqueued_id.empty?
 
         sender = @participant_mutex.synchronize { @participant_turns[enqueued_id] }
         return sender == grant.id if sender
 
-        SessionInbox.find_new_input_files(Session.session_dir(id, state_dir: default_state_dir)).any? do |file|
+        turn_author(id, enqueued_id) == grant.author
+      end
+
+      # Who queued the turn +enqueued_id+, as the session's files say: its
+      # input file's author while it waits or runs (the claimed
+      # *.json.processing stays until the turn ends), then the turn's end:
+      # last_turn's author, or its settled record's (a refused turn's).
+      # nil for the owner's turn, or one nothing names.
+      def turn_author(id, enqueued_id)
+        dir = Session.session_dir(id, state_dir: default_state_dir)
+        files = SessionInbox.find_new_input_files(dir) + SessionInbox.claimed_input_files(dir)
+        files.each do |file|
           data = JSON.parse(File.read(file))
-          data.is_a?(Hash) && data["enqueued_id"] == enqueued_id && data["author"] == grant.author
+          return data["author"] if data.is_a?(Hash) && data["enqueued_id"] == enqueued_id
         rescue JSON::ParserError, SystemCallError
-          false
+          next
         end
+        last = session_access.show(id).last_turn
+        return last.author if last&.enqueued_id == enqueued_id
+
+        TurnCheckpoint.settled_turn(dir, enqueued_id)&.author
+      rescue ArgumentError, JSON::ParserError, SystemCallError
+        nil
       end
 
       # GET /api/sessions/resolve?id= for a participant: their grant's
@@ -401,7 +420,10 @@ module Samagotchi
         result = session_access.wait_reply(id, **options, poll_interval: @wait_poll_interval,
                                                cancelled: -> { !@server_running.call || !@grants.active?(grant.id) })
         if result.status == :canceled
-          ended = @grants.find(grant.id)&.state(@grants.now)
+          current = @grants.find(grant.id)
+          return error_response(401, *ENDED.fetch(:revoked)) unless current
+
+          ended = current.state(@grants.now)
           return error_response(401, *ENDED.fetch(ended)) if ENDED.key?(ended)
 
           return error_response(503, "server_stopping", "chi web is stopping; wait again")

data/lib/samagotchi/web/participant_review.rb

@@ -6,6 +6,7 @@ require_relative "participant_exposure"
 require_relative "../session_metrics"
 require_relative "../review_start"
 require_relative "../guardrails/review_paths"
+require_relative "../participant_mode"
 
 module Samagotchi
   module Web
@@ -49,6 +50,7 @@ module Samagotchi
       #   current_turn, waiting_for_owner, queued: {mine, others}, last_event_id}
       def handle_review(req, id)
         session = @session_class.load(id, state_dir: default_state_dir)
+        mode = ParticipantMode.of(session).to_s
         viewer = participant_viewer(req, session)
         live = bridge_get_json(id, "snapshot")
         turn_snapshot = live && live["snapshot"]
@@ -63,7 +65,7 @@ module Samagotchi
         status = displayed_status(session, state)
         status = Session::STATUS_IDLE if status == Session::STATUS_RUNNING && current.nil?
         json_response(200, {
-          viewer: review_viewer(req, id, session: session, state: state, queued: queued, viewer: viewer),
+          viewer: review_viewer(req, id, session: session, state: state, queued: queued, viewer: viewer, mode: mode),
           session: { id: session.id, title: participant_title(session), status: status },
           subjects: review_subjects(session, viewer),
           participants: participant_names(id).map { |entry| entry.slice(:id, :name, :kind) },
@@ -149,12 +151,12 @@ module Samagotchi
       # participant view (no composer, no usage: the owner has /stats).
       # +state+ the live worker's session state (nil without one), +queued+
       # its queue.
-      def review_viewer(req, id, session:, state:, queued:, viewer:)
-        return { kind: "owner", can_comment: false } if principal(req).owner?
+      def review_viewer(req, id, session:, state:, queued:, viewer:, mode:)
+        return { kind: "owner", can_comment: false, mode: mode } if principal(req).owner?
 
         grant = principal(req).grant
         capped = !participant_cap_refusal(grant).nil?
-        { kind: "participant", id: grant.id, name: grant.name, participant_kind: grant.kind, can_comment: !capped,
+        { kind: "participant", id: grant.id, name: grant.name, participant_kind: grant.kind, mode: mode, can_comment: !capped,
           cap_reached: capped, session_id: id,
           usage: review_usage(grant, session: session, state: state, queued: queued, viewer: viewer) }
       end
@@ -248,7 +250,8 @@ module Samagotchi
         # The owner's participant view has no composer; a participant's
         # selection quotes with the same presets as the owner's page.
         attrs.merge!(annotate_presets_data) unless principal(req).owner?
-        html_response(200, File.read(path).sub("<body>", "<body #{body_data(attrs)}>"))
+        # A block: a name's \& or \' is text, never a backreference.
+        html_response(200, File.read(path).sub("<body>") { "<body #{body_data(attrs)}>" })
       end
 
       # A filtered stream's frame filter (App#stream_filter), for the

data/lib/samagotchi/web/participant_view.rb

@@ -374,14 +374,18 @@ module Samagotchi
           /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
           /\bxox[abprs]-[A-Za-z0-9-]{10,}/,
           /\bchp_[A-Za-z0-9_-]{20,}/,
+          # A one-time link code (LinkCodes::CODE_RE): a bearer credential
+          # until its grant expires (an owner's, 10 minutes).
+          /\bchc_[A-Za-z0-9_-]{43}/,
           /\bAIza[0-9A-Za-z_-]{30,}/,
           /\b[rs]k_(?:live|test)_[A-Za-z0-9]{16,}/,
           /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/,
           %r{https://hooks\.slack\.com/services/[A-Za-z0-9/_-]+}
         ].freeze
-        # The value after an Authorization header or a token=/key= pair.
+        # The value after an Authorization (or a Bridge's secret,
+        # BridgeSecret::HEADER) header or a token=/key= pair.
         VALUES = [
-          /(\bAuthorization:\s*(?:Bearer\s+|Basic\s+|Token\s+)?)[^\s"'`]+/i,
+          /(\b(?:Authorization|X-Chi-Bridge):\s*(?:Bearer\s+|Basic\s+|Token\s+)?)[^\s"'`]+/i,
           /((?<![A-Za-z0-9])[A-Za-z0-9_-]*?(?:token|api[_-]?key|access[_-]?key|secret|password|passwd)["']?\s*[=:]\s*["']?)[^\s"'&`,;}]+/i,
           # A URL's password: scheme://user:PASSWORD@host.
           %r{(\b[a-z][a-z0-9+.-]*://[^/\s:@]+:)[^@\s/]+(?=@)}i
@@ -389,7 +393,7 @@ module Samagotchi
         # A text that ends where one of VALUES' values (or a private key's
         # BEGIN line) would go on: a stream cut there would send the value
         # on its own, unredacted (ParticipantStreamFilter never cuts there).
-        OPEN_VALUE = /(?:\bAuthorization:\s*(?:(?:Bearer|Basic|Token)\s*)?|[A-Za-z0-9_-]*?(?:token|api[_-]?key|access[_-]?key|secret|password|passwd)["']?\s*(?:[=:]\s*["']?)?|-----BEGIN [A-Z0-9 ]*)\z/i
+        OPEN_VALUE = /(?:\b(?:Authorization|X-Chi-Bridge):\s*(?:(?:Bearer|Basic|Token)\s*)?|[A-Za-z0-9_-]*?(?:token|api[_-]?key|access[_-]?key|secret|password|passwd)["']?\s*(?:[=:]\s*["']?)?|-----BEGIN [A-Z0-9 ]*)\z/i
 
         module_function
 

data/lib/samagotchi/web/participants_admin.rb

@@ -33,8 +33,15 @@ module Samagotchi
         warning = ReviewStart.share_warning(Session.load(id, state_dir: default_state_dir))
         json_response(200, { participants: with_spend(id, grants), warning: warning,
                              identity_header: @public_url&.identity_header })
+      rescue Grants::Unwritable => e
+        grants_unwritable(e)
       end
 
+      # 409 grants_unwritable for a store chi won't read or write over
+      # (Grants::Corrupt, Grants::Newer), in the store's own words: a
+      # refusal the panel shows, not a 500 with a backtrace per refresh.
+      def grants_unwritable(error) = error_response(409, "grants_unwritable", error.message)
+
       # One session's grants with what each spent and how many turns they
       # ran (its saved analytics: SessionMetrics.saved_by_author), for the
       # owner's participants panel.
@@ -69,6 +76,8 @@ module Samagotchi
                              link: link, lan: !@lan.nil? || !@public_url.nil?, qr_svg: QR.svg(link), warning: warning })
       rescue Grants::Invalid => e
         error_response(400, "invalid_participant", e.message)
+      rescue Grants::Unwritable => e
+        grants_unwritable(e)
       end
 
       # GET /api/sessions/:id/apply[?turn=T] (owner): the owner's turn that
@@ -102,6 +111,8 @@ module Samagotchi
         revoked = Participants.revoke(@grants, session_id: id, id: grant_id, by: "owner", state_dir: default_state_dir)
         now = @grants.now
         json_response(200, { revoked: revoked.map { |grant| grant.public_h(now) } })
+      rescue Grants::Unwritable => e
+        grants_unwritable(e)
       end
 
       # POST /api/sessions/:id/participants/:participant/cap {cap}: the
@@ -119,6 +130,8 @@ module Samagotchi
         json_response(200, { participant: grant.public_h(@grants.now) })
       rescue Grants::Invalid => e
         error_response(400, "invalid_participant", e.message)
+      rescue Grants::Unwritable => e
+        grants_unwritable(e)
       end
 
       # The link a participant opens: web.public_url's with a one-time code

data/lib/samagotchi/web/principal.rb

@@ -2,14 +2,13 @@
 
 module Samagotchi
   module Web
-    # Who a chi web request is (App#principal_for). Today there is one
-    # kind: the owner, a peer on this machine or a request with the
-    # Web::Token access token. The routes' permission column
+    # Who a chi web request is (App#principal_for): the owner or a
+    # participant admitted by a grant. The routes' permission column
     # (App::ROUTES, :owner or :participant) is checked against it, and a
     # turn's author comes from it, never from the request body. See
     # docs/internals/remote-sessions.md (Trust model).
     #
-    # +kind+ :owner; +grant+ what a non-owner principal was admitted by
+    # +kind+ :owner or :participant; +grant+ what admitted a participant
     # (nil for the owner).
     Principal = Data.define(:kind, :grant) do
       def owner? = kind == :owner