samagotchi 0.128.0 → 0.129.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9b175cb8468dd1b6dccbb74c3c372b0796aa18126b47034d07d11d6ead1e1e22
-  data.tar.gz: e6b6ea98bf78a7a43962a70ab6daf3cd35519c7db1cefdae44ad8021d4274b75
+  metadata.gz: 91648ee9b8cf9906ded9d6f865f424b10148222e8007516d8d74718a5a4a9c41
+  data.tar.gz: 0ca9cd428118fd52e4c2dc3f1b5e1750d6d7f4bf41ca0d039c8769660a2db2e9
 SHA512:
-  metadata.gz: adcfe4e020e6829703e1b9e1d2836d53bb3ddc336da1001c598853352eef75a3ca3df25b7e4d07d292bdaf8b413be228e57487a8b570365e2fba4cecd98490f0
-  data.tar.gz: d4b57b741cd271740cb0826e0ff50845a5213c1de30b28c9477ba1b126e5448511f5b73861a3380ae2a93e4102e41df9d4093b14a193a61dcbdd7ed6894a11cd
+  metadata.gz: 1fa243881749c0b856bcb0c40f42937a253f33b0a0904d6145950cbf81c52262bfd3bdcf883389041f06383d7796150d7ee74a74bb9b8a8118d90ac3b4807a1c
+  data.tar.gz: dc1b3dafdca94da6af0338e1a76b3df6e914847514f6eeb9e61359de941cc789955e5a4b04f6e04417402fcdc221d460940051dcde3101737694cb080b038e1a

data/CHANGELOG.md

@@ -7,6 +7,86 @@ and commands may change between minor versions. How releases are made:
 [docs/releasing.md](docs/releasing.md).
 ## [Unreleased]
 
+## [0.129.0] - 2026-10-28
+
+### Changed
+
+- A delegate child's read-only command that writes only into a tmp dir (`sqlite3 -readonly -safe ../main/x.db "…" >
+  /tmp/rows`, `cp ../main/x.db /tmp/`, `… | tee /tmp/f`) no longer asks as a change outside its folder
+  (`child-boundary`); a tmp path that links back into the repository still asks, as does a target spelt with `$` or
+  `~`, or one after a `cd`/`pushd` the shell may not have taken (anything but one existing dir joined by `&&`).
+
+### Fixed
+
+- The owner page's Verify fresh button no longer stays disabled ("restart this session to use Verify") after the
+  session's worker comes back with the `verify` feature: the cards follow the session's update without a reload.
+- The web's "Couldn't start a fresh check." under a verdict card no longer vanishes at the next redraw (the participant
+  page re-creates its cards on every update): the page keeps it until the next attempt.
+- A `write` or `edit` of a dangling symlink (or a path through one) or of a file with another hard link no longer
+  counts as in a tmp dir or in the session's repo: a write there lands outside, so the delegate child's
+  `child-boundary` and `path: outside_repo` rules ask for it.
+- A `task_create` call's `env:` now counts in the guardrails' path checks: `env: {TMPDIR: <main checkout>}` with
+  `echo x > $TMPDIR/a.txt` (or a `HOME`, `GIT_DIR`, `GIT_WORK_TREE` there) asks as the delegate child's
+  `child-boundary`, and `rm -rf`, chi-dir and `git: outside_repo` checks read it too. An `env:` setting `BASH_ENV`,
+  `ENV`, `CDPATH`, `IFS`, an exported `BASH_FUNC_…`, `LD_PRELOAD` or a git config/diff-program variable makes the
+  command not read-only.
+- An exit and a restart asked of one worker at once (an attached terminal's `/exit` with "stop them and exit" while
+  chi web's "Restart workers" runs) no longer both hear yes: the first one taken decides, and the other is refused
+  ("the worker is already leaving as a plain exit"), so a restart no longer reports "restarted" for a worker that
+  left with no successor.
+- A delegate child's `task_create` whose `env:` redefines the shell (`BASH_ENV`, an exported `BASH_FUNC_cat%%`,
+  `CDPATH`, …) now asks as `child-boundary` from its own folder too: `cat a.txt` there with a startup file or an
+  exported function that writes the main checkout no longer ran unasked.
+
+### Security
+
+- A participant's pair turn (`chi share`, a working session) can no longer call this machine's chi web on a loopback
+  name (`curl -X POST 127.0.0.1:4567/api/sessions/ID/participants`, `localhost`, `[::1]`, `0.0.0.0`, the host name,
+  with chi web's recorded or configured port, by any client or script): a LAN chi web takes a token-less loopback
+  request as the owner's, so the command could mint a grant or queue an owner turn. chi web's own auth is unchanged.
+- A pair turn's "a write outside the project always asks the owner" now fails closed. A command runs unasked only when
+  it only reads, only writes (`>`, `cp`, `tee`) into the project or a tmp dir, or stays inside the project (it runs
+  there and every path it names lands there or in a tmp dir). `rm -rf ~/x`, `sed -i … ~/x`, `curl -o ~/x`,
+  `dd of=~/x`, `touch`/`mkdir` outside, `perl -pi`, `python -c "open('/…', 'w')"`, `cd .. && make`, and a command with
+  a `$var`, a `$(…)` (but a commit message's heredoc), `xargs` or a `cd` it can't follow now ask. A tmp path is one by
+  the delegate child's rule (`/var/tmp` too, not the tmp dir the project is in, never through a dangling symlink or
+  onto a file with another hard link).
+- A pair turn in a session whose folder is the home folder or above it asks before every write (the review boundary
+  already read nothing there).
+- A pair command that makes a link (`ln`, `cp -s`/`-l`, a script's `symlink`) asks the owner, and one linking to home
+  or a folder above a secret is denied: `ln -s ~/.config g && cat g/gh/hosts.yml` passed, as the link didn't exist yet
+  when the paths were judged.
+- A pair turn can no longer write git's hooks (`.git/hooks/*`, by `write`/`edit` or a command), schedule a command
+  (`crontab`, `at`, `batch`), run a credential printer (`gh auth token`, `git credential fill`, `gcloud … print-access-token`,
+  `op`, `aws configure get`, …) or `ps -E`, read the owner's background tasks (`task_wait`, `task_get`, `task_list`), or
+  run a program whose name is a `$var`, a `$(…)` or a glob (`bin/ch? …`).
+- A guardrail check no longer cuts a heredoc's body out of the command it then runs (since 0.81.0,
+  `ShellLex.code_text` built its result on the caller's string): with the guardrails bundle's `command:` rules, an
+  owner's `git commit -m "$(cat <<'EOF' … EOF)"` or `git commit -F - <<EOF` could run with an empty message, and a pair
+  turn's `cat > docs/x.md <<EOF … EOF` with an empty body.
+- Guardrails take a path's `..` the way the kernel does: after a symlinked folder it climbs out of the link's target.
+  A participant's review turn could read `node_modules/foo/../../.config/gh/hosts.yml` (with `foo` an `npm link` to
+  `~/src/foo`) as a project file while the read opened `~/.config/gh/hosts.yml`; a pair turn's secret check, the
+  protected paths (`mem/../config.yml` with `mem` a link to chi's memories), `outside_repo`, the delegate child's
+  boundary, `touches: chi_dirs` and `rm: outside_tmp` had the same gap. Each now refuses or asks when either reading of
+  the path does, and a write through a dangling symlink to `config.yml`, the hooks or `.bundles/` is asked or denied
+  like the file it creates.
+- A shell `cd` or `pushd` whose `..` climbs out of a symlinked folder's target now counts as landing in either folder:
+  zsh (chi's shell on macOS) and bash chdir to the physical one when the logical one doesn't exist, and `cd -P`
+  always does. A pair turn's `cd node_modules/foo/../../.config/gh && cat hosts.yml` (or `cd -P
+  node_modules/foo/../.. && echo x > .zshrc`) was allowed while it read or wrote outside the project; `touches:
+  chi_dirs`, `git: outside_repo` and the delegate child's boundary read the same cd logically only. Later words are
+  now resolved and judged against both folders, and `cd -` leaves the folder unknown.
+- System 1 (`on` mode) no longer auto-allows a command that climbs out of chi's memories folder into its config:
+  `cd …/memories; cd ..; echo 'mode: off' >> config.yml`, `cd "${PWD%/*}"` or `cd $(dirname $PWD)` passed its
+  own-files check, since only the text was read. The check now resolves the command's words like
+  `shell-touches-chi` (cd chains, symlinks, `..`, the call's `env:`), so `cd ~/.config; cd samagotchi; cat
+  config.yml` is refused too. A memories command keeps its exemption while its text shows no climb (`..`, `$`,
+  backticks, `cd -`) and every word resolves or is data (a `python3 -c` or heredoc body, `echo "- a note"`); a call
+  whose `env:` redefines the shell is never auto-allowed.
+
+Update with `chi update`, then restart `chi web` and the session workers (`chi sessions restart`).
+
 ## [0.128.0] - 2026-10-28
 
 ### Changed
@@ -4810,7 +4890,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.128.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.129.0...HEAD
+[0.129.0]: https://github.com/dm1try/samagotchi/compare/v0.128.0...v0.129.0
 [0.128.0]: https://github.com/dm1try/samagotchi/compare/v0.127.0...v0.128.0
 [0.127.0]: https://github.com/dm1try/samagotchi/compare/v0.126.0...v0.127.0
 [0.126.0]: https://github.com/dm1try/samagotchi/compare/v0.125.0...v0.126.0

data/docs/architecture.md

@@ -120,7 +120,7 @@ terminal renders the events it gets over the Bridge.
 - Attached (`bin/chi`, `--attach ID`, `--shared [--resume ID]`) → `TerminalUI::AttachLauncher`: no `Engine`
   and no `OwnerLock`; finds or starts the session's worker and runs `TerminalUI::AttachedLoop`
   as a client of its Bridge (`BridgeClient#follow`, `post_turn`, `post_command`, `cancel`, `answer`,
-  `dismiss_question`). The worker runs in the session's `working_directory`, so `!cmd` and
+  `dismiss_question`; opening the SSE connection answers `BridgeClient::StreamOpen::Opened`, `Refused` or `Unreachable`). The worker runs in the session's `working_directory`, so `!cmd` and
   the tools don't depend on where the terminal attached from.
 - `bin/chi web` → builds `Web::Server` (Rack+WEBrick on `127.0.0.1:4567`, `--port`/`SAMAGOTCHI_WEB_PORT`, `--open`;
   `web.host: lan` adds a LAN address, `--new-token` replaces its access token).
@@ -173,6 +173,8 @@ agent logic and can be used without any terminal rendering; the UI is a thin lay
   but `RelineSeam` (prepended to `Reline::LineEditor`) sends its drawing to the
   `Screen`. The saved history and cards in a join or resync are rendered by
   `TerminalUI::JoinReplay` with the loop's screen, view, link, gap clock and renderer.
+  The loop's concerns live in mixins under `terminal_ui/attached_loop/`: `AttachedLoop::Composer`, `Questions`,
+  `Queueing`, `Sending` and `ExitCommands` (the `/exit` ask's reply text is `TerminalUI::ExitLines`).
   With input from a pipe (`chi -p X </dev/null`), `TerminalUI::OwnTurns` keeps this
   run's own prompts until their turns end; `#run` distinguishes an empty answer from a
   prompt this terminal removed before it ran (both exit 1), as well as chi's other outcomes.
@@ -376,7 +378,10 @@ process that already owns the `Engine`); every worker starts it, and it exposes:
   the event log held (`WorkerIdleExit#hold_for_request`): `200 {status: "exiting"}` and it leaves
   like an idle exit, or `409 {status: "held", reason:}` with `turn_running`, `input_queued`,
   `continue_offered`, `client_connected` (a stream not named by the asker), `reminders`,
-  `background_tasks` (with `tasks: [{id, command}]`: the running tasks a finish wake watches) or `starting`.
+  `background_tasks` (with `tasks: [{id, command}]`: the running tasks a finish wake watches), `starting`, or
+  `leaving_exit` / `leaving_delete` / `leaving_restart` when another client's exit of another kind is already taken
+  (`Worker#claim_exit`, claimed before a stop-all; the words are `WorkerIdleExit::LEAVING_WORDS`). A second exit of
+  the kind already taken is answered `200` as that one.
 - `GET  /session/:id/state` — `session_state_snapshot` (JSON).
 - `GET  /session/:id/stats` — `Engine#stats_snapshot` for attached `/stats`: the metrics, with the context window and prompt profile asked from the server before the first turn.
 - `GET  /session/:id/snapshot` — the snapshot frame's content as one request (the web server renders
@@ -506,7 +511,8 @@ for client discovery, with the Bridge's secret (see above).
 reading `bridge.json` or probing a port itself: `WorkerLink.resolve(session_dir, unlink:, owner:)` answers a typed
 outcome. The rule is the owner lock plus the sidecar's `pid`; there is no port probe (a port can be reused by another
 session's Bridge, a free lock is the kernel's proof the worker died). In order: no lock holder, or a chi REPL's: a
-sidecar is `Stale(:lock_free)` (removed with `unlink: true`, only if it is still the file that was read), else `None`;
+sidecar is `Stale(:lock_free)` (removed with `unlink: true`, only if it is still the file that was read and the lock,
+read again just before, is still free: a worker that took it meanwhile is resolved as that worker), else `None`;
 a holder with no kind yet: `Starting`; a leaving worker: `Leaving` (marked before its Bridge stops, on every way out:
 `Worker#teardown` marks it too, with `TEARDOWN_LEAVE_WAIT`); a worker whose sidecar names no port or another
 pid than the holder's (a worker that has not written its own yet): `Starting`, `stuck` once it has held the lock
@@ -565,7 +571,8 @@ it holds with `update.notify: off`; a child that prints no rows fails with its o
 done install refreshes the hub's installed version (`SessionHub#refresh_installed`) before its `done`.
 Worker restarts target every worker older than the version installed now (refreshed the same way)
 and publish per-session results. Only one of an install, a worker restart pass and a web restart runs
-at a time (409 `update_running`). `POST /api/update/restart_web` (409 `restart_unavailable` without a
+at a time (409 `update_running`). `POST /api/update/restart_workers` (`handle_restart_workers`) starts the worker pass
+by itself. `POST /api/update/restart_web` (409 `restart_unavailable` without a
 chi wrapper to exec) schedules WEBrick shutdown only after its response is sent; after the hub and
 listener stop, `Server` execs the RubyGems chi wrapper with every flag chi web was started with, as
 `RunOptions`' parser recorded them (`RunOptions.web_restart_argv`), but the one-shot `--open` and
@@ -618,7 +625,7 @@ model: [internals/remote-sessions.md](internals/remote-sessions.md).
 |---|---|---|---|---|
 | `GET /api/sessions/resolve?id=` | owner | an id or a unique prefix | 200 `{id}` | 404 `not_found`; 400 `ambiguous_id` with `ids` |
 | `GET /api/sessions/summaries` | owner | `dir` (a folder: its project; none: every project), `cwd`, `live=1`, `archived=1`, `tests=0`, `sort`, `order`, `limit` | 200: the rows `chi sessions list` prints (`SessionManager.session_summaries`: `status`, `live`, `busy`, `owner`, `recap`, `ctx_pct`, `waiting`, `waiting_id`, `title`, `preview`, …) | 400 `invalid_dir`, `invalid_cwd` |
-| `GET /api/projects?dir=` | owner | optional page-scope folder | 200: project rows with counts, roots, default/current marks; no `dir`: no current project | 400 `invalid_dir`; 503 `no_hub` |
+| `GET /api/projects?dir=` | owner | optional page-scope folder | 200: project rows (`Web::ProjectList`: the hub's projects plus the start project) with counts, roots, default/current marks; no `dir`: no current project | 400 `invalid_dir`; 503 `no_hub` |
 | `POST /api/sessions` (more fields) | owner | `toolkit`, `tools`, `no_tools`, `parent_answers`; `client_id` (`cli:send`/`cli:answer`: the first line is checked as chi send checks it); `check_vision: true` (images follow) | 201 adds `model_warning`, `parent_answers_warning` (a level looser than config.yml's, capped) and `first_turn_id` (the id the prompt it starts with gets for its turn; null for an `idle` create) | 400 `invalid_toolkit`, `invalid_parent_answers`, `invalid_continues` (beside `continues`); 403 `parent_answers_refused`, `parent_continue_refused`; 422 `no_vision` |
 | `POST /api/sessions/:id/turn` (more fields) | owner | `client_id` as above; `check_vision: true` with `images` | as before | 403 `parent_answers_refused`, `parent_continue_refused`; 422 `no_vision` |
 | `POST /api/sessions/:id/wait/prepare` | owner | `question_id` (absent: the pending one; `null`: none), `turn`, `created`, `busy` (+ `queue`) | 200 `{session_id, cursor, baseline: {messages, question_id, last_turn}, own_turn, known_turn, running, live, settled, last_turn_id}` (`WaitStart`) | 409 `busy`, `waiting` (`SendCommand::Busy`'s words, and its fields: `question`, `parent_strategy`) |

data/docs/cli.md

@@ -1210,7 +1210,8 @@ pills there (a review turn refuses `/` lines).
 
 After the presets, both pages have a built-in **Verify**: the quote, then
 an ask to check the claim against the code and end on a line `Verdict:
-confirmed|refuted|unclear — <reason>`. On your page a selection in a turn
+confirmed|refuted|unclear — <reason>`. A session whose worker predates Verify (started by an older chi) refuses it (409
+`verify_unavailable`); a participant's page disables Verify and Verify fresh with a hint to restart the session. On your page a selection in a turn
 also offers **Copy link**: a link to that turn and quote for a participant's
 browser (the one their review link was opened in), which opens their page
 scrolled to the quote and highlights it; with no one invited, a link to it

data/docs/guardrails.md

@@ -274,7 +274,8 @@ sub-agent](sub-agent.md)) tell them to use `chi answer` only.
 
 ## Protected paths
 
-Built in, for `write`, `edit` and `memory_write` (symlinks resolved):
+Built in, for `write`, `edit` and `memory_write` (symlinks resolved; see
+[How paths resolve](#how-paths-resolve)):
 
 - deny: the approval store's dir, installed bundles (`memories/.bundles/`),
   and [attached context](context.md) sources (`<state dir>/context/`: a
@@ -305,7 +306,21 @@ else the parent's checkout). Rule `child-boundary`, source `core`; it asks when
   overwriting a branch other than its own.
 
 Read-only commands (`git -C ../app log`, `cat ../app/x`) and paths elsewhere
-(`/usr/bin`, `~/.gem`) never ask. The answer is once or for the child's
+(`/usr/bin`, `~/.gem`) never ask, nor does a read-only command that writes only
+into a tmp dir (`/tmp`, `/var/tmp`, `$TMPDIR`): its `>` / `>>` targets, `cp`'s
+destination (the last argument, or `-t` / `--target-directory`) and `tee`'s
+files, resolved against its `cwd:` and any `cd` or `pushd` before them, as in
+`sqlite3 -readonly -safe ../app/x.db "select 1" > /tmp/rows` or
+`cp ../app/x.db /tmp/x.db`. A target that links back out of the tmp dir (a
+symlink, a dangling one, a file with another hard link), `cp -l`/`-s`, `mv`,
+`&>`, `>|` and `>&file` still ask, as does a target with a `$` or `~` (the
+call's `env:` may set it), a `popd`, and a `cd`/`pushd` that isn't one existing
+dir spelt `/…`, `.` or `..` joined by `&&` only (it may fail or be skipped and
+leave the shell elsewhere); so does every tmp write when the
+child's folder is itself in that tmp dir. A `task_create` call's paths resolve under chi's env and
+under its own `env:` (its `$TMPDIR`, `$HOME`, `GIT_DIR`, …): either one naming another checkout asks. An `env:` that
+redefines the shell (`BASH_ENV`, `BASH_FUNC_cat%%`, `CDPATH`, …, as under `skip_read_only` below) always asks, even
+for `cat a.txt` in the child's own folder: what it runs is in no word of the command. The answer is once or for the child's
 session only: a repo or rule answer would hold in every worktree, for every
 child, so a stored repo or rule approval doesn't let it through either. Its
 ask goes before the rules, so with the guardrails bundle in strict mode the
@@ -337,7 +352,9 @@ participant's turn may call only the `review` kit's tools:
   `.pypirc`, ssh keys (`id_rsa`, `id_ed25519`, …), `*.tfstate`,
   `secrets.yml`/`.json`, `.docker/config.json`, `.kube/config` and any config
   under `.git` (a submodule's too). The path is checked as given and as it
-  resolves, so a symlink in the project to `~/.ssh` is `~/.ssh`. A session
+  resolves, so a symlink in the project to `~/.ssh` is `~/.ssh`, and
+  `node_modules/foo/../../.config/gh/hosts.yml` with `foo` a link to `~/src/foo`
+  is `~/.config/gh/hosts.yml` ([How paths resolve](#how-paths-resolve)). A session
   whose folder is the home folder or above it reads nothing.
 - `memory_read` with `scope: project` (a read without a scope would fall back
   to the system memories). The prompt's preloaded memories and the memory
@@ -391,31 +408,56 @@ message:
   each word resolved as `touches: chi_dirs` resolves it; a glob that matches a
   secret or whose fixed part leads into a denied folder (`~/.ss?/id_*`,
   `~/.config/*/config.yml`, `.en?`), a `$var` word whose fixed part does
-  (`~/.ss${d}h`), and a text match for the rest;
+  (`~/.ss${d}h`), and a text match for the rest. A prefix that comes through a
+  variable (`x=~/.s; cat ${x}sh/config`) isn't followed: such a command isn't
+  denied, it asks (its `$var` word and the assignment's path place it outside
+  the project);
 - sweeping a folder that holds secrets: `find`, `tar`, `cp`, `rsync`, `scp`,
   `zip`, `ditto`, `grep`/`rg`/`ag` and the like given home or any folder above
-  a denied one;
-- the environment and the keychain: `env` or `printenv` alone, `set`,
-  `export`, `declare` or `typeset` that list, `launchctl getenv`, `ps e`,
-  `security`, `/proc/*/environ`. On top of it, a pair turn's `execute` runs
+  a denied one, and linking to one (`ln -s ~/.config g`, `ln -s ../.. up`);
+- the environment, the keychain and stored credentials: `env` or `printenv`
+  alone, `set`, `export`, `declare` or `typeset` that list, `launchctl
+  getenv`, `ps e`/`ps -E`, `security`, `/proc/*/environ`, and the commands
+  that print a credential (`gh auth token`, `git credential fill` and the
+  `git credential-*`/`docker-credential-*` helpers, `gcloud … print-access-token`,
+  `op`, `aws configure get`/`export-credentials`, `az account
+  get-access-token`, `heroku auth:token`, `kubectl config view --raw`;
+  `PairCommand::CREDENTIAL_PRINTERS`). On top of it, a pair turn's `execute` runs
   without every variable whose name matches `KEY|TOKEN|SECRET|PASS|CREDENTIAL|AUTH`
   (`PairBoundary::SECRET_ENV_NAME`, case-insensitive), and a command still
   running at the limit is killed, never handed over as a background task;
 - git settings that make git run a command (`core.hooksPath`,
   `core.fsmonitor`, `core.sshCommand`, `core.pager`, `core.editor`, a `!`
   alias) by `git config` or `git -c`, and `git config --global`/`--system`;
+  and writing git's hooks: a `write` or `edit` of a path in a `.git/hooks`
+  folder (as given or as it resolves), or a command that isn't read-only and
+  names one (`printf … > .git/hooks/pre-commit`, `cp x .git/hooks/`);
 - running chi, by any wrapper (`bin/chi`, `bundle exec chi`, `ruby … bin/chi`,
   `env … chi`, `watch`, `npx`, `sh -c 'chi …'`, `$(chi …)`), in an assignment's
   value or an alias, a function, after `-exec`/`-c`/`-e`, but `chi --version` and
   `chi --help`: its commands act in the owner's name (shares, caps, sends,
   answers, sessions);
+- calling chi web on this machine: a command whose text names a loopback name
+  (`localhost` and its subdomains, `127.x`, `0.0.0.0`, `[::1]`, `::ffff:127.x`,
+  `0:PORT`) or this machine's host name together with chi web's port (the one
+  the running chi web recorded in `web.json`, config's `web.port`, 4567), by
+  `curl`, `wget`, `nc`, `/dev/tcp`, a script's URL or anything else: a loopback
+  request without a token is the owner on a LAN chi web
+  (`PairBoundary::CHI_WEB`). A Bridge answers only with its secret, which sits
+  in chi's state dir;
+- a program whose name the shell expands: a `$var`, a `$(…)` or a glob in a
+  command's name (`bin/ch? …`, `e=ch; ${e}i …`, `$CMD x`), whatever it would
+  turn out to be (`PairBoundary::VERB`);
 - leaving something running: `&` at a command's end, `nohup`, `setsid`,
-  `disown`, `screen -d…`, `tmux new -d`;
+  `disown`, `screen -d…`, `tmux new -d`, and scheduling it: `crontab`, `at`,
+  `batch`;
 - owner-voiced tools, which act in the owner's name beyond the turn:
   `delegate` and any `delegate_*` tool, `register_reminder`,
   `cancel_reminder`, `send_note`, `forget_outputs`, `task_create`,
   `task_stop`, `find_tools` (it loads tools into the session), and
-  `memory_write` (a memory reaches the owner's later sessions);
+  `memory_write` (a memory reaches the owner's later sessions); and the tools
+  that read the owner's background tasks and their output, `task_wait`,
+  `task_get`, `task_list` (a pair turn starts none);
 - `ask_user_question`, with the advice to ask in the reply: nobody on the
   participant's side answers a card.
 
@@ -426,13 +468,41 @@ own, one another interpreter runs (`ruby -e`, `python - <<EOF`) by its text
 `tee`, `git commit -F -`) is not looked into: where it goes is checked. A
 command the checks can't read is refused, never let through on a text match.
 
-And it **asks the owner** before a `write` or `edit` outside the session's
-project root, and before a command that writes there (a redirection's target,
-`tee`'s files, a `cp`/`mv`/`ln`/`install`/`rsync`/`ditto` destination, or a
-target it can't resolve), every time: the ask is fresh (`Verdict#fresh_ask`: no
-stored approval answers it, and no rule lowers it), so it comes even in auto
-mode. The tmp dirs (`Dir.tmpdir`, `$TMPDIR`, `/tmp`, `/private/tmp`) and
-`/dev/null` neither ask nor deny.
+And it **asks the owner** before a `write` or `edit` that may land outside the
+session's project root, and before a command that may write there, every time:
+the ask is fresh (`Verdict#fresh_ask`: no stored approval answers it, and no
+rule lowers it), so it comes even in auto mode. A command fails closed
+(`PairCommand#outside_writes?`): it runs unasked only when it
+
+- only reads (`ReadOnlyShell.read_only?`, wherever it reads), or
+- only reads but for writes it can name (a `>`/`>>` target, `cp`'s
+  destination, `tee`'s files) into the project or a tmp dir
+  (`ReadOnlyShell.read_only_but_writes?`), or
+- stays inside the project: every part of it runs in the project, and every
+  path it names lands in the project or a tmp dir, an option's or an
+  assignment's value (`of=`, `--output=`, `GIT_DIR=`), a glob's fixed part
+  (`~/oth*`), `git -C`'s folder and the paths in a script it hands on (`sh -c`
+  read as a command, `python -c`/`ruby -e`/a heredoc by the paths in its text)
+  among them. The program's own word doesn't count (`/usr/bin/sed`), nor does
+  `PATH=…`, nor a message's heredoc (`git commit -m "$(cat <<'EOF' … EOF)"`).
+
+Anything else asks: `rm -rf ~/x`, `sed -i … ~/x`, `curl -o ~/x`, `dd of=~/x`,
+`touch`/`mkdir` outside, `perl -pi … ~/x`, `cd .. && make`, `cd && make`, and
+whatever the checks can't place: a `$var` (`rm -rf $DIR`, `> "$OUT"`), a `$(…)`,
+`xargs`, a `cd $X`. A path "lands" in the project or a tmp dir every way it
+resolves ([How paths resolve](#how-paths-resolve)) and never through a dangling
+symlink or onto a file with another hard link (`Outside.inside?`,
+`Outside.tmp_write?`, the child boundary's tmp rule): the tmp dirs are
+`Dir.tmpdir`, `/tmp` and `/var/tmp`, except the one the project itself is in.
+`/dev/null` and the like neither ask nor deny. A script file's body (`ruby
+x.rb`, `make`, `sh ./run.sh`) isn't read: it runs as in-project work.
+A command that makes a link asks too, wherever it points (`ln`, `link`, `cp
+-s`/`-l`, `sh -c 'ln …'`, an interpreter's `symlink`/`link(`): a path through
+a link the same command makes is judged before the link exists, so `ln -s ..
+up && cat up/…` can't be read for what it reaches.
+A session whose folder is the home folder or above it has no project to
+keep the turn in (`ReviewPaths.home_root?`, the review boundary's test): every
+write there asks.
 
 A participant's ask names them on the owner's card ("Sam's turn asks: approve
 tool call?", `approval.author`/`author_name`, `approval.asked_by`, the same
@@ -448,7 +518,10 @@ The trust model is a team's (everyone invited is trusted): the boundary is an
 hostile participant; a review session is. A pair turn can still reach, through
 the owner's rules: `web_fetch` (an open egress path: what the turn can read it
 can send out in a URL), plugin and MCP tools, `memory_read` and `context_read`,
-`list_sessions` (the owner's other sessions' titles), and anything a script
+`list_sessions` (the owner's other sessions' titles), chi web by a name the
+check doesn't know (a DNS name or a decimal address for 127.0.0.1, a port
+forward, a port spelt in a variable), where a LAN chi web still takes a
+token-less loopback request as the owner's, and anything a script
 does that the command checks don't read (a script file's body, an interpreter's
 `-e` code). Share a working session only with people you would let type in it.
 
@@ -564,7 +637,10 @@ only `run list|view`, `pr list|view|diff|checks`, `issue list|view` and
 `repo view`; `--web`/`-w`, `gh api` and `pr checks --watch` are not read-only.
 `$(…)`, backticks, `$VAR` (other than `$HOME`, `$XDG_*`, `$TMPDIR` and `$PWD`
 at a word's start), an env prefix, `sh -c`, `xargs`, `eval`, `sudo` and the
-like make a command not read-only. It errs towards asking.
+like make a command not read-only, as does a `task_create` `env:` that sets `BASH_ENV`, `ENV`, `CDPATH`, `IFS`,
+`SHELLOPTS`, `BASHOPTS`, `BASH_FUNC_…`, `LD_PRELOAD`, `LD_AUDIT`, `DYLD_INSERT_LIBRARIES`, `GIT_EXTERNAL_DIFF`,
+`GIT_CONFIG_PARAMETERS` or `GIT_CONFIG_COUNT` (they change what its words run; `PATH` doesn't count). It errs
+towards asking.
 
 A tool name may be a glob, so one rule covers a plugin's tools (an MCP server's,
 say): `tool: "mcp_*"` or `tool: ["mcp_{git,gh}_*", web_fetch]` (`*`, `?`, `[…]` and
@@ -647,6 +723,41 @@ one folder; a link in the repo that points elsewhere is outside). Never outside:
 - a tmp folder (`$TMPDIR`, `/tmp`, `/var/tmp`), unless the session's repo is
   itself in that tmp folder: a sandbox there still gets asked about its siblings.
 
+A path that is or goes through a dangling symlink (a write would create the
+link's target) or a file with another hard link (a write changes the other
+name too) is always outside, in the repo or a tmp folder alike
+(`Outside.resolve`, which the child boundary's tmp writes read as well).
+
+#### How paths resolve
+
+Every path check (protected paths, `outside_repo`, `touches`, `rm`, `memory:
+prompt`, the child, review and pair boundaries, System 1's own-files test)
+resolves paths with `Guardrails::ProtectedPaths`:
+
+- `..` is taken the kernel's way (`.expand`): after a symlinked folder it
+  climbs out of the link's target, so `repo/link/../x` with `link` pointing
+  to `/elsewhere/deep` is `/elsewhere/x`, not `repo/x`;
+- symlinks are resolved on the longest part that exists, and a dangling
+  symlink is followed to the file a write through it would create (`.real`);
+- a check reads the path both ways, the lexical answer (`File.expand_path`,
+  stopping at a dangling link) and where the kernel lands (`.reals`): it
+  refuses, asks or votes when either is protected, outside or a secret, so
+  the kernel's answer only ever adds to the lexical one. A file tool call's
+  paths (`Targets#paths`, what approvals show) list both when they differ.
+
+In a shell command a file argument resolves the same way, against the folder
+the command is in by then. A `cd` or `pushd` to such a path may land either
+way: `cd link/..` is back where it started only while that logical folder
+exists (zsh, which chi's shell is on macOS, and bash chdir to the physical one
+when it doesn't), and `cd -P`, `set -P` and zsh's `chase_links`/`chase_dots`
+always take the physical one. So after it the command counts as in both
+folders: each later word is resolved against each (a word that can't be
+resolved from one isn't resolved), and judged both ways as above; past eight
+folders, or after `cd -`, the folder is unknown. After `cd link` a `../x`
+climbs out of the link's target as well. git's `-C`, `--git-dir` and
+`--work-tree` (and `GIT_DIR`/`GIT_WORK_TREE`) are counted both ways, from each
+folder the command may be in.
+
 `git: outside_repo` (shell tools only) reads the command for git subcommands
 that change a checkout: `commit`, `add`, `reset`, `checkout`, `switch`,
 `rebase`, `merge`, `push`, `stash` (not `stash list`/`show`), `rm`, `mv`,
@@ -883,12 +994,26 @@ gate below passes, in this order:
    config dir (config.yml), the hooks dir, the installed bundles dir, the
    guardrails store (where `approvals.json` and `judgments.jsonl` live) or the
    attached context dir, and no `execute` or `task_create` command naming any
-   of them, however it spells them (`ParentApprovals::CHI_TEXT`:
-   `$XDG_CONFIG_HOME/samagotchi/config.yml`, `~/.config/samagotchi/…`, a
-   `cd ~/.config` then `samagotchi/config.yml`). The memories dir is
-   deliberately not one of these: reading or appending a memory file can be
-   auto-allowed, unless the command has a `..` segment (`memories/../config.yml`
-   climbs out of it). A protected rule
+   of them (or chi's state dir). A command is checked twice: by its text
+   (`ParentApprovals::CHI_TEXT`: `$XDG_CONFIG_HOME/samagotchi/config.yml`,
+   `~/.config/samagotchi/…`, a `cd ~/.config` then `samagotchi/config.yml`),
+   and by its words resolved as `shell-touches-chi` resolves them
+   (`Guardrails::ShellPaths::Walk`: cd chains, `~`, `$HOME` and the XDG dirs,
+   symlinks, `..`; under the call's `env:` too), so `cd ~/.config; cd
+   samagotchi; cat config.yml` or a symlink into the config dir is refused.
+   A call whose `env:` redefines the shell (`Targets#redefines_shell?`:
+   `BASH_ENV`, `BASH_FUNC_…`, …) is refused whatever it names. The memories
+   dir is deliberately not one of these: reading or appending a memory file
+   can be auto-allowed, by a command none of whose words lands in chi's dirs
+   outside the memories, whose text shows no climb (`SelfProtect::CLIMB`: a
+   `..` segment, any `$` or `$(…)`, backticks, a `~` other than the home one,
+   `cd -`), and whose words the walk can't resolve are only data read while
+   it knew the dir: a script or heredoc body (`python3 -c '…'`, `cat >> x.md
+   <<'EOF'`), a phrase (`echo "- a note"`) or a glob with no `/`. So
+   `cd memories; cd ..`, `cd "${PWD%/*}"`, `cd $(dirname $PWD)` or `cd -`
+   loses the exemption, and the memories text then refuses it. A script body
+   is not looked into beyond its text: an accident guard, not containment.
+   A protected rule
    (`Verdict::PROTECTED_RULES`) may be listed by name and System 1 may answer
    it, but a call that really writes config.yml or the hooks is refused here;
 5. the judgment's `p` is at least `guardrails.system_one.threshold` (0.8);

data/docs/internals/participants.md

@@ -176,8 +176,11 @@ Everything else is `:owner`: `/answer`, `/command`, `/images` (an image a prompt
   to act: the turn only reads (`Guardrails::ReviewBoundary`), and proposes what the owner applies ([Apply](#apply)).
 - **`:pair`**, a working session's participant invited to act: the turn acts with the session's tools under the
   owner's guardrails, its asks go to the owner and offer once only, and `Guardrails::PairBoundary` denies secrets,
-  chi itself, background jobs, the environment, owner-voiced tools and the model's own question, and asks before a
-  write outside the project ([guardrails](../guardrails.md#a-participants-pair-boundary)). No Apply: it acted itself.
+  chi itself and chi web on loopback, background and scheduled jobs, the environment and credential printers, git's
+  hooks, owner-voiced tools and the owner's task outputs, and the model's own question, and asks before a command
+  that makes a link and before a write that may land outside the project, failing closed (a session at or above
+  home has none: every write asks) ([guardrails](../guardrails.md#a-participants-pair-boundary)). No Apply: it
+  acted itself.
 
 `ParticipantMode.of(session, features:)` is the session's: what a participant invited now gets. No session is
 `:review`. A worker names `pair_turns` (`Delivery::PAIR_FEATURE`) when it runs pair turns; one without it runs
@@ -230,6 +233,15 @@ worker checks their link (`participants.json`: revoked, expired) and their cap a
 dequeued (`:turn_dequeued`) and audited (`revoked`, `cap_reached`) instead of run, so a revoke also stops what they
 had queued; its settled record (`TurnCheckpoint.record_refused`: canceled, `cancel_reason` the reason) ends their
 wait on it at once, which `ParentReport` reads as status `refused`, exit 1.
+
+**The Verify gate.** A worker names `verify` (`VerifyAnchor::FEATURE`, in the Bridge's `FEATURES`) when it understands a
+Verify turn's anchor (`VerifyAnchor`, `{turn_id, quote}`: a UUID and a quote of 1 to 200 characters). A turn carrying an
+anchor, or a Verify fresh check, sent to a connected worker without it is refused 409 `verify_unavailable`
+(`VerifyAnchor::UNAVAILABLE`: "restart this session to use Verify"; `SessionManager` checks `worker_has?` before it
+delivers, on the features of the sidecar its client was made from), since an older worker would run it as a plain prompt. A session with no connected worker is not gated: the
+worker that starts for it is current. The participant page's session summary carries `verify_unavailable`
+(`VerifyAnchor.worker_unavailable?`, from the worker's features; `participant_review.rb`), and the page disables
+Verify and Verify fresh with a "restart this session" hint.
 **The owner's input during a review turn queues.** While a participant's turn runs, the owner's input never merges
 into it, from any client (the web, an attached TUI, `chi send` without `--queue`): the Bridge's `POST /turn` makes it
 `delivery: queue` whatever it asked, so it never steers or cuts (`TurnAccumulator#participant_turn?`, under the event
@@ -264,7 +276,9 @@ queued, as `--turn T` does.
 **The tool calls.** In a review session `Guardrails::ReviewBoundary` denies a participant's turn everything but
 reads of the project ([guardrails](../guardrails.md#a-participants-review-boundary)). In a working session
 `Guardrails::PairBoundary` takes its seat: the owner's checks and rules decide the rest, as for the owner's turns
-([guardrails](../guardrails.md#a-participants-pair-boundary)). Approvals and questions are owner-only: either
+([guardrails](../guardrails.md#a-participants-pair-boundary)). Both judge a path every way it resolves
+(`ProtectedPaths.reals`: a `..` after a symlinked folder climbs out of its target, as the read opens it;
+[guardrails](../guardrails.md#how-paths-resolve)). Approvals and questions are owner-only: either
 boundary denies the model's own question, and `/answer` is an owner route. A pair turn's ask reaches the owner's card
 naming who asks (`approval.author`, `author_name`; `Guardrails::Approval::PARTICIPANT_HEADER`) with Allow once as its
 only scope, and System 1 never judges it (`GuardrailWiring#system_one_judge`). A grant without `--identity` (a LAN

data/docs/internals/web-push.md

@@ -202,7 +202,10 @@ yet). Results: `:ok` stamps the device's
 `last_ok_at`; `:gone` removes it; `:failed` keeps its code in `last_error` and logs `push_failed`; `:bad_jwt` logs
 one `push_bad_jwt` warning (on chi web's terminal too) and stops all pushes until chi web restarts. Log lines carry
 `device:` (the short id), `code:`, `ms:`, `kind:`: never the endpoint, keys or text. `#stop` drops pending holds and
-joins with a timeout; `Server.start`'s ensure calls it. Specs drive `#pump` with a moved clock
+joins with a timeout; `Server.start`'s ensure calls it. chi web's own restart (`restart_web`, `Server.reexec`) execs
+without either: the shows still in their hold and the retries waiting in `@pending` / `@retries` go with the process,
+unsent and not in `sent.json`. The exec'd chi web's seed brings back only what restart catch-up covers (a question
+still open); a closed-meanwhile or non-question show held then is not pushed. Specs drive `#pump` with a moved clock
 (`start(hub, sender: false)`), and one example runs the real thread with a client that blocks.
 
 ## The routes (`web/push_routes.rb`)

data/docs/sessions.md

@@ -21,7 +21,7 @@ Sessions are plain files — no DB. Each session is `~/.local/state/samagotchi/s
 
 A session is deleted if **expired by age OR overflow by count** (unless `keep_status` or the live-owner guard: a session a worker or `chi` still has open is never pruned). A session's `status` is its turn state (`idle`/`running`), not whether a worker is alive. Orphan dirs without a `*.json` are never deleted, except skeleton-only ones (see *Empty sessions*). Deletion removes both `*.json` and sidecar dir atomically. Set both `DAYS=0` and `MAX=0` to retain forever.
 
-**Worker idle exit:** a background worker (plain `chi`, Web UI sessions) exits after `SAMAGOTCHI_SESSION_IDLE_EXIT_MINUTES` (`session.idle_exit_minutes`, default `30`, `0`=never) with no turn running or queued, no client on its stream (an open web tab or attached terminal keeps it), no reminder registered, no background task it watches for a [finish wake](internals/background-tasks.md#finish-wake) still running or waiting for its wake turn (with `session.task_wakes: wake`; not one whose turn you stopped) and no continue offer (the step-limit question) waiting for an answer. It removes `bridge.json` and frees `owner.lock`; the next prompt or `--attach` wakes a new worker (`WorkerIdleExit`, `SessionManager.run_session_loop`). As its Bridge stops, the worker marks the lock leaving (`OwnerLock#mark_leaving`: `leaving_at`, and `leave_wait`, its `recap.timeout`), since it keeps the lock while it writes the recap on leave: an `--attach` or `--resume` meanwhile (here, or a remote one through chi web's wake) prints `(waiting for the session to finish its recap…)` (`LaunchMode::RECAP_WAIT`) and waits for the release, up to that budget plus `OwnerLock::LEAVE_MARGIN` (5 s), before starting the new worker (`OwnerLock.await_release`). A lock held by a worker that isn't leaving (a live one, a stuck one) is left as before. A client can also ask the worker to exit right away (Bridge `POST /session/:id/exit`; `/exit` in an attached terminal does, `/detach` doesn't): the same rules apply without the timeout (even with `0`), and the asker's own stream doesn't count. The reply names what keeps it up (for background tasks, which ones and how to stop them). When every hold is one the user can stop — reminders, a watched task still running, a delegate with a live worker — the 409 also carries `holds: [{kind:, items: [{id:, label:, detail:}]}]` (a reminder's detail is its schedule, `every 20m`/`every 1h`, `, due now` when it is already due), and an attached terminal asks what to do with them; its "stop them and exit" posts `{"stop": "all"}`, which clears the reminders, stops those tasks (`TaskRuntime.stop_task`, as `task_stop`) and stops those children (`SessionManager.stop_session`) before leaving, re-checking first that nothing the user can't stop appeared meanwhile (`HoldStop`). A delegate counts only for that ask: it never holds the idle exit, and an exit that deletes or archives the session does not ask about it. The session's status stays as it was, not `stopped`. With `"restart": true` (a worker whose sidecar lists the `restart` feature) the worker hands the session to a new worker on the newest chi installed: it leaves, then starts its successor once its lock is free, keeping even an empty session and writing no recap. Clients' streams don't hold a restart (a web tab and an attached terminal reconnect to the new worker); what would be lost does: a turn running or queued, a continue offer, a question or approval waiting, a `/btw` (or another anytime command) still running, a delegate's approval relay open or settled in the last 10 minutes, and background tasks this conversation started that still run (`WorkerIdleExit#hold_for_restart`; 409 `held` with `reason`). Reminders go along: as it leaves, the worker writes them to `<id>/reminders.json` (0600: `session_id`, `written_at`, and each reminder's id, name, description, interval and next fire as wall-clock time; `ReminderCarry`), and its successor reads and deletes the file as it starts, before its idle scheduler runs. A restored reminder keeps its id and schedule; one that came due meanwhile fires once at once, and one further ahead than its interval (a clock that jumped) is due one interval from now. The file counts only for the same session within 2 minutes of `written_at`, and not once the session is stopped: otherwise it is deleted unread (log `reminders_carry_dropped`, at warn unless the session was stopped). A stop that lands while the worker leaves for a restart wins: the worker writes no file, and no successor starts (`SessionManager.run_session_loop`, log `restart_dropped`); an archive deletes the file of each session it archives. Once an exit or restart is taken, a later exit request (a stop-all from another terminal) is answered as that same exit: the first one decides how the worker leaves. A write that fails keeps the worker up with its reminders (log `reminders_carry_failed`), and the caller reports no new worker. A reminder already due when the restart is asked runs its turn first, so the restart's wait (10 s) may report no new worker yet though the hand-off follows. A worker from before this still refuses a restart for its reminders (409 `reminders`). Only an asked restart carries them: the fallback's TERM (a worker that can't be asked, below), a stop, an idle exit (which reminders hold anyway) and a crash drop them as before. What lives only in the worker's memory goes: the event history a late client replays, the kept `/btw` answers, a plugin's in-memory state.
+**Worker idle exit:** a background worker (plain `chi`, Web UI sessions) exits after `SAMAGOTCHI_SESSION_IDLE_EXIT_MINUTES` (`session.idle_exit_minutes`, default `30`, `0`=never) with no turn running or queued, no client on its stream (an open web tab or attached terminal keeps it), no reminder registered, no background task it watches for a [finish wake](internals/background-tasks.md#finish-wake) still running or waiting for its wake turn (with `session.task_wakes: wake`; not one whose turn you stopped) and no continue offer (the step-limit question) waiting for an answer. It removes `bridge.json` and frees `owner.lock`; the next prompt or `--attach` wakes a new worker (`WorkerIdleExit`, `SessionManager.run_session_loop`). As its Bridge stops, the worker marks the lock leaving (`OwnerLock#mark_leaving`: `leaving_at`, and `leave_wait`, its `recap.timeout`), since it keeps the lock while it writes the recap on leave: an `--attach` or `--resume` meanwhile (here, or a remote one through chi web's wake) prints `(waiting for the session to finish its recap…)` (`LaunchMode::RECAP_WAIT`) and waits for the release, up to that budget plus `OwnerLock::LEAVE_MARGIN` (5 s), before starting the new worker (`OwnerLock.await_release`). A lock held by a worker that isn't leaving (a live one, a stuck one) is left as before. A client can also ask the worker to exit right away (Bridge `POST /session/:id/exit`; `/exit` in an attached terminal does, `/detach` doesn't): the same rules apply without the timeout (even with `0`), and the asker's own stream doesn't count. The reply names what keeps it up (for background tasks, which ones and how to stop them). When every hold is one the user can stop — reminders, a watched task still running, a delegate with a live worker — the 409 also carries `holds: [{kind:, items: [{id:, label:, detail:}]}]` (a reminder's detail is its schedule, `every 20m`/`every 1h`, `, due now` when it is already due), and an attached terminal asks what to do with them; its "stop them and exit" posts `{"stop": "all"}`, which clears the reminders, stops those tasks (`TaskRuntime.stop_task`, as `task_stop`) and stops those children (`SessionManager.stop_session`) before leaving, re-checking first that nothing the user can't stop appeared meanwhile (`HoldStop`). A delegate counts only for that ask: it never holds the idle exit, and an exit that deletes or archives the session does not ask about it. The session's status stays as it was, not `stopped`. With `"restart": true` (a worker whose sidecar lists the `restart` feature) the worker hands the session to a new worker on the newest chi installed: it leaves, then starts its successor once its lock is free, keeping even an empty session and writing no recap. Clients' streams don't hold a restart (a web tab and an attached terminal reconnect to the new worker); what would be lost does: a turn running or queued, a continue offer, a question or approval waiting, a `/btw` (or another anytime command) still running, a delegate's approval relay open or settled in the last 10 minutes, and background tasks this conversation started that still run (`WorkerIdleExit#hold_for_restart`; 409 `held` with `reason`). Reminders go along: as it leaves, the worker writes them to `<id>/reminders.json` (0600: `session_id`, `written_at`, and each reminder's id, name, description, interval and next fire as wall-clock time; `ReminderCarry`), and its successor reads and deletes the file as it starts, before its idle scheduler runs. A restored reminder keeps its id and schedule; one that came due meanwhile fires once at once, and one further ahead than its interval (a clock that jumped) is due one interval from now. The file counts only for the same session within 2 minutes of `written_at`, and not once the session is stopped: otherwise it is deleted unread (log `reminders_carry_dropped`, at warn unless the session was stopped). A stop that lands while the worker leaves for a restart wins: the worker writes no file, and no successor starts (`SessionManager.run_session_loop`, log `restart_dropped`); an archive deletes the file of each session it archives. Once an exit or restart is taken (claimed before a stop-all stops anything), the first one decides how the worker leaves: a later request of the same kind is answered as that exit, one of another kind (a stop-all from another terminal after a restart, chi web's "Restart workers" after a `/exit`) gets 409 `held` with `reason` `leaving_exit`, `leaving_delete` or `leaving_restart`, and a restart says it was refused rather than "restarted". A write that fails keeps the worker up with its reminders (log `reminders_carry_failed`), and the caller reports no new worker. A reminder already due when the restart is asked runs its turn first, so the restart's wait (10 s) may report no new worker yet though the hand-off follows. A worker from before this still refuses a restart for its reminders (409 `reminders`). Only an asked restart carries them: the fallback's TERM (a worker that can't be asked, below), a stop, an idle exit (which reminders hold anyway) and a crash drop them as before. What lives only in the worker's memory goes: the event history a late client replays, the kept `/btw` answers, a plugin's in-memory state.
 
 **Empty sessions:** a session nothing happened in is deleted when it is left, so `chi` → `/exit` leaves no trace. Empty means: no messages, no turn tried (a failed turn leaves a `last_prompt` and keeps it), no memory used, no pending question, nothing in `input/`, `notes/` or `images/`, nothing in its dir beyond the worker's skeleton, mode `assist`, and the default model. A session on another model (`/model`, `--model`) counts as prepared and stays (`SessionManager.discardable?`). The worker checks as it idle-exits or leaves on a client's request and deletes it once its lock is free, checking again first. The attached `/exit` then says `Detached; the session is empty: it will be discarded if nothing arrives before its worker stops.` (a note or prompt landing first keeps it). The REPL (`--no-shared`) does the same at `/exit` or Ctrl-D. The retention sweep catches those killed first: empty sessions over an hour old with no live owner, whatever `DAYS`/`MAX`, and skeleton-only dirs with no `*.json`. `session.keep_empty: true` (env `SAMAGOTCHI_SESSION_KEEP_EMPTY`) turns all of it off.
 

data/lib/samagotchi/bridge_client.rb

@@ -88,7 +88,8 @@ module Samagotchi
     def self.for_sidecar(session_id, sidecar, host: HOST, read_timeout: READ_TIMEOUT)
       return nil unless sidecar
 
-      new(session_id: session_id, port: sidecar.port, secret: sidecar.secret, host: host, read_timeout: read_timeout)
+      new(session_id: session_id, port: sidecar.port, secret: sidecar.secret, host: host, read_timeout: read_timeout,
+          features: sidecar.features)
     end
 
     # How often a wait for a new worker's Bridge looks: a missing sidecar is
@@ -111,6 +112,9 @@ module Samagotchi
     end
 
     attr_reader :session_id, :port, :host
+    # @return [Array<String>] what the worker's sidecar named (WorkerSidecar#features)
+    #   as this client was made from it; empty for one made without a sidecar
+    attr_reader :features
 
     # Which worker this client talks to, for EventStream: a rediscovered
     # client with another key is a new worker. A Bridge's port, and a
@@ -122,7 +126,9 @@ module Samagotchi
     #   with every request (nil: a worker from before secrets, which asks for
     #   none); from the worker's sidecar (.for_sidecar), never typed
     # @param read_timeout [Numeric] see READ_TIMEOUT
-    def initialize(session_id:, port:, secret:, host: HOST, read_timeout: READ_TIMEOUT)
+    # @param features [Array<String>] the sidecar's (#features)
+    def initialize(session_id:, port:, secret:, host: HOST, read_timeout: READ_TIMEOUT, features: [])
+      @features = Array(features).freeze
       @session_id = session_id
       @port = port
       @secret = secret

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.128.0
+version: 0.129.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/guardrail_wiring.rb

@@ -314,7 +314,7 @@ module Samagotchi
       # one that passes every gate is allowed once without reaching them
       # (docs/guardrails.md, "System 1").
       judgment = begin
-        system_one_judge(payload)
+        system_one_judge(payload, targets: verdict.targets)
       rescue LLM::RequestCancelled
         return turn_stopped(verdict)
       end
@@ -357,7 +357,7 @@ module Samagotchi
     # host) means no line at all. A judgment that fails is logged with p nil,
     # so the failures are in the log too.
     # @return [Hash, nil] {id:, p:, auto:}, nil when nothing was written
-    def system_one_judge(payload)
+    def system_one_judge(payload, targets: nil)
       return nil if Steer.participant_author?(turn_author)
 
       client = @system_one.call
@@ -385,7 +385,7 @@ module Samagotchi
       end
       latency_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round
       p = answers && answers[SystemOne::ApprovalQuestion::ID]&.noul
-      auto = system_one_auto_allow?(client, approval, p, entries)
+      auto = system_one_auto_allow?(client, approval, p, entries, targets: targets)
       decision = system_one_decision(client, auto)
 
       id = log.judgment(session_id: @session_lookup.call&.id,
@@ -417,13 +417,14 @@ module Samagotchi
     # the rule's record. Any one that fails leaves the ask to the user. The
     # entries are the judgment log read once for this ask.
     # @param entries [Array<Hash>] SystemOne::Log#entries
-    def system_one_auto_allow?(client, approval, p, entries)
+    # @param targets [Guardrails::Targets, nil] the call's, for its env:
+    def system_one_auto_allow?(client, approval, p, entries, targets: nil)
       return false unless client.mode == "on"
 
       rule = approval[:rule].to_s
       return false if rule.empty?
       return false unless system_one_rules.include?(rule)
-      return false if SystemOne::SelfProtect.refuse?(approval)
+      return false if SystemOne::SelfProtect.refuse?(approval, targets: targets)
 
       threshold = Config.get("guardrails.system_one.threshold").to_f
       return false if p.nil? || p.to_f < threshold