samagotchi 0.127.0 → 0.129.0

data/lib/samagotchi/bridge.rb

@@ -11,6 +11,7 @@ require_relative "atomic_file"
 require_relative "bridge_secret"
 require_relative "delivery"
 require_relative "session_inbox"
+require_relative "verify_anchor"
 
 require_relative "bridge/bounded_queue"
 require_relative "bridge/card_store"
@@ -633,6 +634,7 @@ module Samagotchi
     # turn (Guardrails::PairBoundary); a worker without it runs it as a
     # review turn, and chi web says so (Delivery::PAIR_FEATURE).
     FEATURES = ["restart", "task_stop", "reparent", Delivery::QUEUE_FEATURE, ReplyWait::TURN_IDS_FEATURE,
+                VerifyAnchor::FEATURE,
                 SessionInbox::UNQUEUE_FEATURE, Delivery::REVIEW_FEATURE, Delivery::PAIR_FEATURE].freeze
 
     # The routes, by method and what follows /session/:id/: a handler takes

data/lib/samagotchi/bridge_client.rb

@@ -88,7 +88,8 @@ module Samagotchi
     def self.for_sidecar(session_id, sidecar, host: HOST, read_timeout: READ_TIMEOUT)
       return nil unless sidecar
 
-      new(session_id: session_id, port: sidecar.port, secret: sidecar.secret, host: host, read_timeout: read_timeout)
+      new(session_id: session_id, port: sidecar.port, secret: sidecar.secret, host: host, read_timeout: read_timeout,
+          features: sidecar.features)
     end
 
     # How often a wait for a new worker's Bridge looks: a missing sidecar is
@@ -111,6 +112,9 @@ module Samagotchi
     end
 
     attr_reader :session_id, :port, :host
+    # @return [Array<String>] what the worker's sidecar named (WorkerSidecar#features)
+    #   as this client was made from it; empty for one made without a sidecar
+    attr_reader :features
 
     # Which worker this client talks to, for EventStream: a rediscovered
     # client with another key is a new worker. A Bridge's port, and a
@@ -122,7 +126,9 @@ module Samagotchi
     #   with every request (nil: a worker from before secrets, which asks for
     #   none); from the worker's sidecar (.for_sidecar), never typed
     # @param read_timeout [Numeric] see READ_TIMEOUT
-    def initialize(session_id:, port:, secret:, host: HOST, read_timeout: READ_TIMEOUT)
+    # @param features [Array<String>] the sidecar's (#features)
+    def initialize(session_id:, port:, secret:, host: HOST, read_timeout: READ_TIMEOUT, features: [])
+      @features = Array(features).freeze
       @session_id = session_id
       @port = port
       @secret = secret

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.127.0
+version: 0.129.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/engine.rb

@@ -1620,6 +1620,61 @@ module Samagotchi
     end
     private :stamp_verify_anchor
 
+    def verified_anchor(session, anchor)
+      return unless anchor
+
+      source = verify_anchor_source_session(session, anchor)
+      return unless source
+
+      turn = AnswerTail.turn_slice(Array(source.messages), anchor.turn_id)
+      return reject_verify_anchor(anchor, :turn_missing) unless turn
+
+      reply = turn.reverse.find { |message| AnswerTail.answer?(message) }
+      return reject_verify_anchor(anchor, :reply_missing) unless reply
+
+      quote_text = verify_comparison_text(anchor.quote)
+      answer_text = verify_comparison_text(reply[:content] || reply["content"])
+      return reject_verify_anchor(anchor, :quote_missing) if quote_text.empty? || !answer_text.include?(quote_text)
+
+      anchor
+    end
+    private :verified_anchor
+
+    def verify_anchor_source_session(session, anchor)
+      return session unless session.verify_fresh
+
+      fresh = session.verify_fresh
+      return reject_verify_anchor(anchor, :fresh_anchor_mismatch) unless fresh.anchor == anchor
+      return reject_verify_anchor(anchor, :fresh_parent_missing) unless session.parent_id
+
+      Session.load(session.parent_id, state_dir: session_state_dir)
+    rescue ArgumentError, SystemCallError, IOError => e
+      Log.warn(:turn, "verify_anchor_rejected", turn_id: anchor.turn_id, reason: :source_session_unavailable,
+                                                 error: e.class.name)
+      nil
+    end
+    private :verify_anchor_source_session
+
+    def verify_comparison_text(text)
+      OutputFormatter.strip_markup(text)
+                    .gsub(/!\[([^\]]*)\]\([^)]+\)/, '\1')
+                    .gsub(/\[([^\]]+)\]\([^)]+\)/, '\1')
+                    .gsub(/^[ \t]*(?:\#{1,6}[ \t]+|>[ \t]?|[-+*][ \t]+|\d+[.)][ \t]+)/, "")
+                    .gsub(/(\*\*|__|~~|`+)(.+?)\1/m, '\2')
+                    .gsub(/(?<!\w)\*(\S(?:.*?\S)?)\*(?!\w)/m, '\1')
+                    .gsub(/(?<!\w)_(\S(?:.*?\S)?)_(?!\w)/m, '\1')
+                    .tr("|", " ") # a table row's cells; the page copies them without the pipes
+                    .gsub(/\s+/, " ")
+                    .strip
+    end
+    private :verify_comparison_text
+
+    def reject_verify_anchor(anchor, reason)
+      Log.warn(:turn, "verify_anchor_rejected", turn_id: anchor.turn_id, reason:)
+      nil
+    end
+    private :reject_verify_anchor
+
     def record_verdict(turn, outcome)
       return unless outcome == "completed" && turn.verify
 
@@ -2170,6 +2225,7 @@ module Samagotchi
       # A participant's Verify fresh child: every turn is theirs (their
       # author, boundary and cap), whoever started it.
       origin = session.verify_fresh.origin_for(origin) if session.respond_to?(:verify_fresh) && session.verify_fresh
+      verify = verified_anchor(session, VerifyAnchor.from(verify))
       # Track the active session for recap and status snapshot.
       @session = session
       # status is turn state: running now, idle again before the turn's end

data/lib/samagotchi/guardrail_wiring.rb

@@ -314,7 +314,7 @@ module Samagotchi
       # one that passes every gate is allowed once without reaching them
       # (docs/guardrails.md, "System 1").
       judgment = begin
-        system_one_judge(payload)
+        system_one_judge(payload, targets: verdict.targets)
       rescue LLM::RequestCancelled
         return turn_stopped(verdict)
       end
@@ -357,7 +357,7 @@ module Samagotchi
     # host) means no line at all. A judgment that fails is logged with p nil,
     # so the failures are in the log too.
     # @return [Hash, nil] {id:, p:, auto:}, nil when nothing was written
-    def system_one_judge(payload)
+    def system_one_judge(payload, targets: nil)
       return nil if Steer.participant_author?(turn_author)
 
       client = @system_one.call
@@ -385,7 +385,7 @@ module Samagotchi
       end
       latency_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round
       p = answers && answers[SystemOne::ApprovalQuestion::ID]&.noul
-      auto = system_one_auto_allow?(client, approval, p, entries)
+      auto = system_one_auto_allow?(client, approval, p, entries, targets: targets)
       decision = system_one_decision(client, auto)
 
       id = log.judgment(session_id: @session_lookup.call&.id,
@@ -417,13 +417,14 @@ module Samagotchi
     # the rule's record. Any one that fails leaves the ask to the user. The
     # entries are the judgment log read once for this ask.
     # @param entries [Array<Hash>] SystemOne::Log#entries
-    def system_one_auto_allow?(client, approval, p, entries)
+    # @param targets [Guardrails::Targets, nil] the call's, for its env:
+    def system_one_auto_allow?(client, approval, p, entries, targets: nil)
       return false unless client.mode == "on"
 
       rule = approval[:rule].to_s
       return false if rule.empty?
       return false unless system_one_rules.include?(rule)
-      return false if SystemOne::SelfProtect.refuse?(approval)
+      return false if SystemOne::SelfProtect.refuse?(approval, targets: targets)
 
       threshold = Config.get("guardrails.system_one.threshold").to_f
       return false if p.nil? || p.to_f < threshold

data/lib/samagotchi/guardrails/child_boundary.rb

@@ -26,8 +26,11 @@ module Samagotchi
     #     share, from anywhere (SharedGit: config, update-ref, worktree add,
     #     stash clear, tags, another branch's delete).
     # Paths elsewhere in a command (/usr/bin, ~/.gem) don't count, and
-    # read-only commands never ask. Text heuristics: sh -c bodies, scripts
-    # and $(…) aren't looked into.
+    # read-only commands never ask, nor do ones that only write into a tmp
+    # dir (> / >>, cp's destination, tee; Targets#read_only_but_tmp_writes?). Paths resolve under chi's env and the
+    # call's env: (Targets#shell_envs), and an env: that redefines the shell
+    # (BASH_ENV, CDPATH, …) always asks, from its own folder too. Text heuristics: sh
+    # -c bodies, scripts and $(…) aren't looked into.
     class ChildBoundary
       RULE = "child-boundary"
       SOURCE = "core"
@@ -73,26 +76,33 @@ module Samagotchi
       def shell_crosses?(targets, root)
         return true if targets.git_dirs.any? { |dir| dir.is_a?(String) && Outside.outside?(dir, root: root) }
         return :shared if SharedGit.changes?(targets.command, own_branch: @branch.call)
-        return false if targets.read_only?
+        # A redefined shell (BASH_ENV, BASH_FUNC_…) runs what no word says.
+        return true if targets.redefines_shell?
+        return false if targets.read_only? || targets.read_only_but_tmp_writes?(root: root)
         return true if targets.cwd && Outside.outside?(targets.cwd, root: root)
 
-        names_other_checkout?(targets.command, targets.cwd, root)
+        names_other_checkout?(targets, root)
       end
 
-      # Whether a word of +command+ resolves into another checkout of the
-      # repository (and not into root, which may sit inside the main one).
-      def names_other_checkout?(command, cwd, root)
+      # Whether a word of the command resolves into another checkout of the
+      # repository (and not into root, which may sit inside the main one),
+      # under chi's env or the call's env: (Targets#shell_envs).
+      def names_other_checkout?(targets, root)
         real_root = ProtectedPaths.real(root)
         others = [*@worktrees.call, @common_dir.call].compact.map { |dir| ProtectedPaths.real(dir) } - [real_root]
         return false if others.empty?
 
-        walk = ShellPaths::Walk.new(cwd, Dir.home, ENV)
-        ShellLex.simple_commands(ShellLex.lex(command.to_s)).any? do |words|
-          walk.step(words).any? do |_word, path|
-            next false unless path
+        commands = ShellLex.simple_commands(ShellLex.lex(targets.command.to_s))
+        targets.shell_envs.any? do |home, env|
+          walk = ShellPaths::Walk.new(targets.cwd, home, env)
+          commands.any? do |words|
+            walk.step(words).any? do |_word, path|
+              next false unless path
 
-            real = ProtectedPaths.real(path)
-            !ShellPaths.within?(real, real_root) && others.any? { |dir| ShellPaths.within?(real, dir) }
+              ProtectedPaths.reals(path).any? do |real|
+                !ShellPaths.within?(real, real_root) && others.any? { |dir| ShellPaths.within?(real, dir) }
+              end
+            end
           end
         end
       rescue ArgumentError, EncodingError

data/lib/samagotchi/guardrails/outside.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "pathname"
 require "tmpdir"
 require_relative "protected_paths"
 require_relative "../memory_bundle/index_sync"
@@ -16,19 +17,67 @@ module Samagotchi
     #   is itself in that tmp dir (a sandbox there still gets the check
     #   between its siblings).
     # chi's state dir is not special: nothing there is the model's to write.
+    # A path whose landing place resolving can't tell (.resolve: a dangling
+    # symlink, a file with another hard link) is always outside.
     module Outside
       TMP_DIRS = %w[/tmp /var/tmp].freeze
 
       # @param path [String] absolute
       # @param root [String] the session's repo root (or cwd)
       def self.outside?(path, root:)
-        real = ProtectedPaths.real(path)
+        reals = resolve(path) or return true
         session = ProtectedPaths.real(root)
-        return false if within?(real, session)
-        return false if MemoryBundle::IndexSync.memory_scope(path)
-        return false if tmp_roots.any? { |tmp| within?(real, tmp) && !within?(session, tmp) }
+        reals.any? do |real|
+          next false if within?(real, session)
+          next false if MemoryBundle::IndexSync.memory_scope(path)
+          next false if tmp_roots.any? { |tmp| within?(real, tmp) && !within?(session, tmp) }
 
-        true
+          true
+        end
+      end
+
+      # Whether +path+ lands in the session's root every way it resolves
+      # (.resolve: never a dangling symlink, nor a file with another hard
+      # link). A pair turn's test for a path its command may name
+      # (PairCommand), with .tmp_write? for the rest.
+      # @param path [String] absolute
+      # @param root [String] the session's project root
+      def self.inside?(path, root:)
+        reals = resolve(path) or return false
+        session = ProtectedPaths.real(root)
+        reals.all? { |real| within?(real, session) }
+      end
+
+      # Whether a shell command may write +path+ as a tmp file (the child
+      # boundary's tmp writes): it resolves (.resolve, every way) into a tmp
+      # dir the session's root isn't in.
+      # @param path [String] absolute
+      # @param root [String] the session's repo root (or cwd)
+      def self.tmp_write?(path, root:)
+        reals = resolve(path) or return false
+        session = ProtectedPaths.real(root)
+        reals.all? { |real| tmp_roots.any? { |tmp| within?(real, tmp) && !within?(session, tmp) } }
+      end
+
+      # +path+ resolved (ProtectedPaths.reals: the lexical answer and where
+      # the kernel lands, a `..` after a symlinked dir climbing out of its
+      # target), or nil when that doesn't say where a write lands: the path
+      # is or goes through a dangling symlink (a write would create its
+      # target; ProtectedPaths.real follows it, the lexical answer stops at
+      # it, and either way the link's own place doesn't count as where the
+      # file is), or is a file with another hard link (a write would change
+      # that file too). Both outside? and tmp_write? read it, so neither
+      # counts such a path as inside or in tmp.
+      # @param path [String] absolute
+      # @return [Array<String>, nil]
+      def self.resolve(path)
+        reals = ProtectedPaths.reals(path)
+        return nil if reals.any? { |real| Pathname.new(real).ascend.any?(&:symlink?) }
+        return nil if reals.any? { |real| File.file?(real) && File.stat(real).nlink > 1 }
+
+        reals
+      rescue SystemCallError
+        nil
       end
 
       # The tmp dirs that exist, resolved.

data/lib/samagotchi/guardrails/pair_boundary.rb

@@ -24,19 +24,25 @@ module Samagotchi
     #     credential files; project secret files) on every file tool's path,
     #     read or written (read, write, edit, a plugin's targets: paths), and
     #     on what a command does (execute, and any call whose targets carry
-    #     a command: PairCommand, which also refuses chi, background jobs,
-    #     the environment, git settings that run commands and home sweeps);
+    #     a command: PairCommand, which also refuses chi and chi web on a
+    #     loopback name, background and scheduled jobs, the environment and
+    #     credential printers, git settings that run commands, home sweeps
+    #     and links to them, and a program named by a $var or a glob); a
+    #     write or edit of git's hooks (GIT_HOOKS);
     #   - owner-voiced tools (OWNER_VOICED, and any delegate_* tool): what
     #     speaks or acts in the owner's name beyond this turn (a delegate, a
     #     reminder, a note to another session, a background task, a
-    #     forgotten output, the session's loaded tools); and memory_write:
+    #     forgotten output, the session's loaded tools); the tools that read
+    #     the owner's background tasks (OWNER_TASK_READERS); and memory_write:
     #     a memory reaches the owner's later sessions;
     #   - ask_user_question: there is no one on the participant's side to
     #     answer it here; the model asks in its reply instead.
     # And it asks the owner, always (Verdict#fresh_ask: no stored approval
-    # answers it, and the rules can't lower it), before a write, an edit or a
-    # command that writes outside the session's project root (the tmp dirs
-    # aside).
+    # answers it, and the rules can't lower it), before a write or an edit
+    # that may land outside the session's project root, or a command that
+    # may write there (failing closed: PairCommand#outside_writes?); a tmp
+    # dir the project isn't in aside (PairCommand.writable?). No project
+    # (the home folder or above it): every write asks.
     # Everything else goes on to the owner's checks and rules as for the
     # owner's turns.
     class PairBoundary
@@ -45,6 +51,10 @@ module Samagotchi
       OWNER_VOICED = %w[delegate register_reminder cancel_reminder send_note forget_outputs task_create task_stop
                         find_tools].freeze
       OWNER_VOICED_PREFIX = "delegate_"
+      # The background task tools that read the owner's tasks (a pair turn
+      # starts none: task_create is owner-voiced, and its execute is never
+      # handed over).
+      OWNER_TASK_READERS = %w[task_wait task_get task_list].freeze
       ASK_TOOL = "ask_user_question"
       WRITE_TOOLS = %w[write edit].freeze
 
@@ -52,21 +62,46 @@ module Samagotchi
                "only the owner can do."
       SECRET = "a participant's turn can't read or write secrets or chi's own files"
       OWNER_ONLY = "a participant's turn can't use %s: it acts in the owner's name beyond this turn"
+      OWNER_TASKS = "a participant's turn can't use %s: the background tasks are the owner's, and their output with them"
       MEMORY_WRITE = "a participant's turn writes no memories: they reach the owner's later sessions; say in your " \
                      "reply what to remember"
       ASK = "a participant's turn can't ask the user: ask in your reply"
       OUTSIDE_WRITE = "a participant's turn writes outside the session's project"
+      NO_PROJECT = "a participant's turn writes, and this session's folder is the home folder or above it (or none): " \
+                   "there is no project to keep it in"
       CHI = "a participant's turn can't run chi: its commands act in the owner's name (sessions, shares, answers)"
       BACKGROUND = "a participant's turn can't leave a command running in the background: it would outlive the turn"
       ENVIRONMENT = "a participant's turn can't read the environment or the keychain: they hold the owner's secrets"
-      HOME_SWEEP = "a participant's turn can't search or copy a folder that holds secrets or chi's own files"
+      HOME_SWEEP = "a participant's turn can't search, copy or link a folder that holds secrets or chi's own files"
+      LINK = "a participant's turn makes a link: a path through it can lead out of the project, so the owner " \
+             "approves it"
       GIT_CONFIG = "a participant's turn can't change git's global config or set what makes git run a command " \
                    "(core.hooksPath, core.fsmonitor, core.sshCommand, core.pager, core.editor, ! aliases)"
+      GIT_HOOKS = "a participant's turn can't write git's hooks (.git/hooks): git runs them in the owner's name"
+      CHI_WEB = "a participant's turn can't call chi web on this machine: on loopback it answers as the owner " \
+                "(sessions, shares, answers)"
+      VERB = "a participant's turn runs only a program named plainly: no $, $(…) or glob in a command's name"
       UNREADABLE = "a participant's turn runs only commands chi can read: split this command, or write the file " \
                    "with the write tool"
       # A pair turn's execute runs without the environment variables whose
       # names say they hold a secret (Tools::Builtins, PairBoundary.scrubbed_env).
       SECRET_ENV_NAME = /KEY|TOKEN|SECRET|PASS|CREDENTIAL|AUTH/i
+      # chi web's port when config names none (Config's web.port default).
+      DEFAULT_WEB_PORT = 4567
+
+      # The ports chi web may answer on here: the one the running chi web
+      # recorded (Web::Running), config's web.port, and the default. A
+      # Bridge's port needs no entry: it answers only with its secret, in
+      # the worker's bridge.json under chi's state dir (denied).
+      # @return [Array<Integer>]
+      def self.web_ports
+        require_relative "../config"
+        require_relative "../web/running"
+        configured = Config.get("web.port").to_s.to_i
+        [Web::Running.port, (configured if configured.positive?), DEFAULT_WEB_PORT].compact.uniq
+      rescue StandardError, LoadError
+        [DEFAULT_WEB_PORT]
+      end
 
       # The unsets a pair turn's execute adds to its environment: every
       # variable of +env+ whose name SECRET_ENV_NAME matches.
@@ -92,14 +127,14 @@ module Samagotchi
       # @param home [#call] → String, nil
       # @param root [#call] → String, nil: the session's project root (the
       #   work tree top of its folder); a write outside it asks the owner
-      #   (none: every write asks)
-      # @param tmp_roots [#call] → Array<String>: where a write neither asks
-      #   nor is denied (PairCommand.tmp_roots)
+      #   (none, or the home folder or above it: every write asks)
+      # @param web_ports [#call] → Array<Integer>: chi web's ports here
+      #   (.web_ports); a command naming one on a loopback name is denied
       def initialize(author:, root: -> {}, denied_dirs: -> { ReviewPaths.chi_dirs }, home: -> { Dir.home },
-                     tmp_roots: -> { PairCommand.tmp_roots })
+                     web_ports: -> { PairBoundary.web_ports })
+        @web_ports = web_ports
         @author = author
         @root = root
-        @tmp_roots = tmp_roots
         @denied_dirs = denied_dirs
         @home = home
       end
@@ -112,8 +147,8 @@ module Samagotchi
           return verdict.deny!(reason, rule: RULE, source: SOURCE, decided_by: "core", advice: ADVICE)
         end
 
-        if outside_write?(verdict)
-          verdict.ask!(OUTSIDE_WRITE, scopes: %w[once], rule: RULE, source: SOURCE, decided_by: "core")
+        if (reason = ask_reason(verdict))
+          verdict.ask!(reason, scopes: %w[once], rule: RULE, source: SOURCE, decided_by: "core")
           verdict.fresh_ask = true
         end
         verdict
@@ -126,6 +161,7 @@ module Samagotchi
         tool = call[:name].to_s
         return ASK if tool == ASK_TOOL
         return format(OWNER_ONLY, tool) if OWNER_VOICED.include?(tool) || tool.start_with?(OWNER_VOICED_PREFIX)
+        return format(OWNER_TASKS, tool) if OWNER_TASK_READERS.include?(tool)
         return MEMORY_WRITE if tool == "memory_write"
 
         targets = verdict.targets
@@ -133,37 +169,53 @@ module Samagotchi
 
         paths = denylist
         return SECRET if paths.secret_refusal(targets.paths.compact)
+        return GIT_HOOKS if WRITE_TOOLS.include?(tool) && targets.paths.compact.any? { |path| PairCommand.git_hook?(path) }
         return command(targets, paths).refusal if targets.command
 
         nil
       end
 
-      # A write or edit whose path is outside the project root (as given or
-      # as it resolves), or a command that writes there (PairCommand); the
-      # tmp dirs aside.
+      # Why the owner is asked (fresh, once): a command that makes a link
+      # (LINK), a write that may land outside the project (OUTSIDE_WRITE, or
+      # NO_PROJECT without one); nil when nothing asks.
+      def ask_reason(verdict)
+        targets = verdict.targets
+        return LINK if targets&.command && command(targets, nil).links?
+        return nil unless outside_write?(verdict)
+
+        project_root ? OUTSIDE_WRITE : NO_PROJECT
+      end
+
+      # A write or edit whose path may land outside the project root, or a
+      # command that may write there (PairCommand#outside_writes?); a tmp
+      # dir the project isn't in aside (PairCommand.writable?).
       def outside_write?(verdict)
         targets = verdict.targets
         return false unless targets
         return command(targets, nil).outside_writes? if targets.command
         return false unless WRITE_TOOLS.include?(verdict.call&.dig(:name).to_s)
 
-        paths = targets.paths.to_a.compact
-        root = @root.call.to_s
-        paths.any? do |path|
-          real = ProtectedPaths.real(path)
-          next false if @tmp_roots.call.any? { |tmp| ShellPaths.within?(real, tmp) }
-
-          root.empty? || !ShellPaths.within?(real, ProtectedPaths.real(root))
+        targets.paths.to_a.compact.any? do |path|
+          !PairCommand.writable?(File.expand_path(path), root: project_root, cwd: targets.cwd)
         end
       end
 
       def command(targets, paths)
         @command = nil unless @command&.first == targets
-        @command ||= [targets, PairCommand.new(targets.command, cwd: targets.cwd, home: home, root: @root.call,
-                                                                paths: paths || denylist, tmp_roots: @tmp_roots.call)]
+        @command ||= [targets, PairCommand.new(targets.command, cwd: targets.cwd, home: home, root: project_root,
+                                                                paths: paths || denylist, web: web_text)]
         @command.last
       end
 
+      # The session's project root; nil without one, or when it is the home
+      # folder or above it (ReviewPaths.home_root?): then every write asks.
+      def project_root
+        root = @root.call.to_s
+        root.empty? || ReviewPaths.home_root?(root, home) ? nil : root
+      end
+
+      def web_text = PairCommand.web_text(@web_ports.call, hostnames: PairCommand.hostnames)
+
       def denylist = ReviewPaths.new(root: nil, denied_dirs: @denied_dirs.call, home: @home.call)
 
       def home = @home.call.to_s