samagotchi 0.144.0 → 0.146.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9e6a9b3aacbab7f8ce2c03c1bf67ba3b37ba647db975b340b6e146ee544de0d4
-  data.tar.gz: 65346bf0d90d4355f7d47e7760d952624cd13b02f2e324ec834649c4a2e12e1d
+  metadata.gz: 701bfb63903962a149abf5d17f39be6c043141e5e1b9ea952e7ba27b77ebe3d8
+  data.tar.gz: 7be23545775dc31bba230e8dfde6c896def7530d032cc8ae7f79d2a9b91d7782
 SHA512:
-  metadata.gz: 536a9cc745170f15f8b52806bc91fa53fc5faa5e0864aa783d8508142ece75626f589fc62974a0883df922671a1543f02cd5c0c8e16d094fd8e8fb3ce94bdd56
-  data.tar.gz: '06086d99f2b967fff766b9b29dbaae5792450276ef655f3822c58d6d1c844f84cb77737c99ef0b1eeec0ea80316533900d491624450379f9b2100b8f01d39584'
+  metadata.gz: 8e4a8bbbfa0398b816a6dd266a6b127f507e6329feaf2b5f37283f2eef76344a334e2bf60409978fab45ab714c56ca1c9c44754174222238d930845bc0f5d929
+  data.tar.gz: 139f5254bb1dbeec07cbdf6cb0033cdb34ce5eae967585a9ab9a843fb961528e0d16b77d562668789646b38b16eaca42e28f2338d49f4ebe47b42a58be6f9597

data/CHANGELOG.md

@@ -7,6 +7,60 @@ and commands may change between minor versions. How releases are made:
 [docs/releasing.md](docs/releasing.md).
 ## [Unreleased]
 
+## [0.146.0] - 2026-11-03
+
+### Added
+
+- `chi memory usage [--scope project|system] [--top N] [--format text|json]` reports what the memories
+  cost, counted from the saved sessions: each scope's index tokens against `memory.index_warn_tokens` and
+  how many of its lines name a memory no session read, the memories read most by tokens with the share they
+  make of all read tokens, and the user's own memories no saved session read. It reads only — no grades, no
+  advice to delete, nothing written. [docs/memory.md](docs/memory.md) has the details.
+
+### Changed
+
+- A `delegate` child started with no `cwd:` whose task names another checkout of the repository gets a
+  `Warning:` line in the tool result naming that checkout and how to start the child there; the child still
+  runs in the parent's folder. [docs/sessions.md](docs/sessions.md#delegating)
+- The session option on a file ask says what it covers: "Allow edits to config.yml for the session"
+  rather than "Allow this call for the session".
+
+### Fixed
+
+- The session bar's status chip follows a question or approval card the moment it is answered,
+  instead of holding "waiting" until the next tick while the turn is already running again.
+- A parent agent may give Allow once on a delegate child's `child-boundary` ask under
+  `guardrails.parent_answers: soft`. It was refused with a false "changes chi's own config"; an ask
+  that really names chi's own files stays yours.
+- A parent agent's Deny on a child's approval says so: the child read "The user declined this call".
+- A delegate child's second report in one parent turn reaches the parent. A reply that came after a
+  reported question, while the parent's turn was still running, was lost with nothing left to wake it.
+
+Update with `chi update`.
+
+## [0.145.0] - 2026-11-02
+
+### Changed
+
+- On a phone, a web approval uses more of the screen, and a short one shows its question, command and Submit without
+  scrolling. A tall card can use the stage's raised height, as a long question already could.
+- The stage shrinks back once at the next step after you answer a question or approval, so no empty room stays under the
+  answered card. Otherwise it still only grows during a turn.
+- The web's approval card has no Deny radio. The Deny button denies in one tap, and a reason typed in the box now goes
+  with it. Terminals, `chi answer` and relayed approvals still answer Deny by its label.
+- On a phone or touch screen, the composer folds while a card's text field has focus and comes back afterwards. Your
+  saved fold and draft are untouched.
+- The session bar says "waiting" instead of "running" while a card blocks the turn.
+- A live answer's new line appears at once instead of fading in, which takes about a quarter off the CPU a streaming
+  answer uses on a Mac Studio.
+
+### Fixed
+
+- An approval card's folder and reason wrap at words instead of splitting them.
+- The text fields on web cards ask iOS Safari not to offer its AutoFill Contact bar.
+
+Update with `chi update`.
+
 ## [0.144.0] - 2026-11-02
 
 ### Changed
@@ -5526,7 +5580,9 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.144.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.146.0...HEAD
+[0.146.0]: https://github.com/dm1try/samagotchi/compare/v0.145.0...v0.146.0
+[0.145.0]: https://github.com/dm1try/samagotchi/compare/v0.144.0...v0.145.0
 [0.144.0]: https://github.com/dm1try/samagotchi/compare/v0.143.0...v0.144.0
 [0.143.0]: https://github.com/dm1try/samagotchi/compare/v0.142.0...v0.143.0
 [0.142.0]: https://github.com/dm1try/samagotchi/compare/v0.141.0...v0.142.0

data/docs/cli.md

@@ -30,7 +30,7 @@
 - `chi share ID --name NAME [--identity EMAIL] [--agent] [--expires 3d] [--cap 2]`, `chi share ls [ID]`, `chi share cap ID P DOLLARS`, `chi share revoke ID [P] | --all` — invite a participant to a session through chi web on the LAN (read-only review turns in a review session, pair turns that act under your guardrails in a working session) (a link of their own, 7 days, a $2 spending cap), list them, change one's cap, revoke them (see [Participants](#participants))
 - `chi --remote NAME send|answer|note|context|sessions|share|review …` (or `CHI_REMOTE=NAME`) — those commands on that machine's sessions, through its chi web (see [Remote sessions](#remote-sessions))
 - `chi --remote NAME --attach ID` (`--resume ID`, `--dir DIR [-p TEXT]`) — the attached TUI on a session of that machine (see [Remote sessions](#remote-sessions))
-- `chi memory ls [--scope project|system] [--format text|json]` — the memories of both scopes (this folder's project first), one row each: scope, name, size, date, `from <bundle>`, the index description and its model overlays; `chi memory rm NAME [--scope project|system]` removes one as `memory_write` with `remove: true` does: its file and model overlays go to the bundle trash (the line names the dir; `chi bundle trash` lists and empties it) and its index line is dropped. NAME in both scopes without `--scope` exits 2 naming both; a missing NAME or a bundle's memory (`chi bundle uninstall` removes it) exits 1 (see [Memory: Listing and removing from the shell](memory.md#listing-and-removing-from-the-shell))
+- `chi memory ls [--scope project|system] [--format text|json]` — the memories of both scopes (this folder's project first), one row each: scope, name, size, date, `from <bundle>`, the index description and its model overlays; `chi memory rm NAME [--scope project|system]` removes one as `memory_write` with `remove: true` does: its file and model overlays go to the bundle trash (the line names the dir; `chi bundle trash` lists and empties it) and its index line is dropped. NAME in both scopes without `--scope` exits 2 naming both; a missing NAME or a bundle's memory (`chi bundle uninstall` removes it) exits 1. `chi memory usage [--scope project|system] [--top N] [--format text|json]` reports what the memories cost over the saved sessions: each scope's index tokens and how many of its lines name a memory nobody read, the memories read most by tokens, and the user's own memories no saved session read (`--top` caps the rows per section, 10; no sessions says so and exits 0) — see [Memory: What the memories cost](memory.md#what-the-memories-cost)
 - `chi desktop install|upgrade|uninstall|status` — the macOS "Send to chi" helper: a Service and a ⌃⌥⌘N hotkey that send text or images to a session (live, stopped or new) as a message (⏎, a turn runs) or a context note (⌘⏎) (see [Desktop helper](desktop.md))
 - `chi models [--format text|json] [--timeout S] [TEXT]` — list the models every configured host offers, as the names `--model` takes (see [Listing the models](#listing-the-models))
 - `chi self` — print version, source dir (checkout or installed gem), config/memory/session paths, model/host and bundles. Run by a session's `execute`, the `model` row (and host, loop, profile, thinking, served model) is **that session's** model, labelled `(this session <id8>; default …)`; elsewhere it is the default, `(default)`. `model key` is the memory overlay key (`<name>.<key>.md`), and `big memories` the memories over `memory.entry_warn_tokens` ([Memory](memory.md#a-memorys-size)), and `model notes` the model notes a prompt of that model loads (`model_notes_deepseek (system, 612 chars)`, `none`; inside a session its `--mute` list is left out). `chi self --model` prints only the model a new session starts on, an alias resolved to its target (the desktop helper's hint)

data/docs/guardrails.md

@@ -81,7 +81,8 @@ Who answers:
 
 The model gets one line on a deny. A rule's or hook's deny reads
 `[execute] Error: denied by guardrail (rule git-push, bundle guardrails): git push publishes commits. The user was not asked. Do not retry it or reach the same result another way; ask the user how to proceed.`
-When the user picks Deny on an ask, it leads with the user's answer:
+When the user picks Deny on an ask, it leads with the user's answer (a parent
+agent's Deny says `The parent agent declined this call`):
 `[execute] Error: The user declined this call: "open a PR instead". It needed approval (rule git-push, bundle guardrails): git push publishes commits. Do not retry it or reach the same result another way; ask the user how to proceed.`
 
 ## Approvals
@@ -91,7 +92,7 @@ Allowing beyond "once" is stored in `$XDG_STATE_HOME/samagotchi/guardrails/appro
 
 | Scope | Allows |
 |---|---|
-| session | this exact call (tool + command, or paths) in this session |
+| session | this exact call in this session: the tool + command, or for a file tool its paths, so its label names them (`Allow edits to config.yml for the session`) and a later edit of that file needs no ask |
 | repo | this exact call in this repo (the cwd outside a repo), any session |
 | rule | anything this rule asks about in this repo |
 
@@ -234,6 +235,10 @@ other user-only rules (`chi-context-cmd`, `chi-broadcast`,
 `prompt-memory-write`, `model-overlay-write`, and `chi-answer-piped` /
 `chi-answer-http`, which answer a grandchild's question as the user).
 
+`child-boundary` isn't one of them: an ask before a delegate child acts outside
+its folder follows the level, so a `soft` parent may give Allow once. If that
+call names chi's own files, it is the user's as above.
+
 A plugin's or a hook's question (`ask_user`) tags its options the same way
 (`effects:`, see [Plugins](plugins.md)); an untagged one is a plain `answer`.
 

data/docs/internals/bridge.md

@@ -66,7 +66,9 @@ the "asking again" and steer-cut rows, ✂ rows and questions (with how they wer
 One per `GET /session/:id/stream` connection, and itself that connection's observer: `Engine#emit_event` calls
 `#call` on the turn's thread, so it only pushes onto a `BoundedQueue` (when full, the oldest entry goes and an
 overflow flag is set). The connection's own thread (`#serve!`) drains the queue onto the socket, so a slow client
-cannot stall a turn or another subscriber. `serve!` orders a join so that nothing is missed or doubled:
+cannot stall a turn or another subscriber. An event holding bytes JSON can't take goes out scrubbed
+(`SSEWriter#frame_json`, `LLM::Utf8Scrub`): a raise there would end this stream, and every later one for as long as the
+ring holds the event. `serve!` orders a join so that nothing is missed or doubled:
 
 1. subscribe the live queue first;
 2. capture `event_count` (the snapshot seq);

data/docs/internals/engine.md

@@ -805,7 +805,7 @@ Both loops:
   guessed from the block and it never enters the history (`:generation_completed`
   and `:after_generation` have already seen the text): `:generation_retrying` with `restarted` voids the streamed text, `:empty_answer_retry` with
   `malformed` goes out, and a hidden `TurnNote.malformed_retry` asks again at the retry temperature. It has its own budget, so `retry.empty_answer: 0`
-  doesn't turn it off, and a real tool call resets it. Two in a row fail the turn with `LLM::MalformedGeneration`, keeping its earlier steps. Each is
+  doesn't turn it off, and a real tool call resets it. Two in a row fail the turn with `LLM::MalformedGeneration`, keeping its earlier steps; a Stop that lands on a stray reply ends the turn cancelled, not failed, because a stopped turn skips this path. Each is
   logged as `generation_malformed` with the shape, finish reason, served model and the text's tail. `KernelLoop` has its own path (`ToolCallParser#malformed`).
 - **Empty-answer retry** (`EmptyAnswerRetry`): a generation with no visible text and no tool calls is asked
   again, up to `retry.empty_answer` times (at most 3), with a hidden nudge (`TurnNote.empty_retry`) on the tail.

data/docs/internals/web-frontend.md

@@ -23,7 +23,7 @@ page. A factory dep a new version stops passing is the same hazard the other way
 out of `send_turn.js`, `session_actions.js` and `lists_view.js`); a page loaded before keeps all its old modules
 until a reload, so the risk is a mixed cache, not an open tab. `answer_fold.js`, `details_motion.js`,
 `turn_range.js`, `history_reveal.js`, `latest.js`, `session_payload.js`, `method_api.js`, `session_store.js`,
-`session_fields.js`, `feature_gates.js`, `revise_stack.js`, `revise_switch.js`, `shell_command.js`, `stale_params.js`, `popover_modal.js` and `more_sheet.js` are new modules for that reason.
+`session_fields.js`, `feature_gates.js`, `revise_stack.js`, `revise_switch.js`, `shell_command.js`, `stale_params.js`, `popover_modal.js`, `more_sheet.js`, `hash_intent.js` (what the hash asks for: session, all, start or keep) and `worker_features.js` are new modules for that reason.
 
 ## Two pages, two models
 
@@ -152,7 +152,8 @@ restart's hub event that brings the feature enables it, the worker going (`worke
 it's unavailable. `forgetSession` and `renderSessionView` draw the history with the answer already, so they `prime()`
 the gates in the batch of their write, and nothing fires. Today two gates: `verify` (Verify fresh on a verdict's
 card, `redrawFresh`) and `revise` (the answers' Revise buttons and the composer's Revising chip, `redrawRevise`).
-Both refuse only a live worker without the feature: a worker that isn't up is woken by the send as a new one, which
+Both refuse only a live worker without the feature — `workerPredates(features, up, feature)` in
+`worker_features.js`, the rule both gates share: a worker that isn't up is woken by the send as a new one, which
 has it. A new action that needs a worker feature is one more entry.
 
 ### Exceptions
@@ -220,6 +221,23 @@ A new chip on the bar needs its place in that CSS's hidden list and a row in `mo
 it is lost on a phone. `app.js`'s `updateInfoBar` feeds the sheet (`update`) on every redraw; its rows and actions draw into
 fixed slots, so a row that joins keeps the focus where it was. The `narrowScreen` listener closes the sheet when the window grows.
 
+
+## The stage's height
+
+`stage_frame.js` is the one writer. The cap is a ceiling: 60% of the page, 80% with the cloud open, 85% while a card has
+the room, and never above the session panel. The frame is grow-only while a turn runs, so a change inside the stage
+never moves its top edge, with one exception: **the next step after a blocking card's answer lets the frame go, once**
+(`stage_view.js releaseHeldWait`, from `generationStarted`). The `held-wait` class says it is due: set with `waiting`,
+cleared there, so a later step, which calls it again, does nothing. What goes together: the live slots' waiting height, a
+raised cap, the tallest content seen (`forgetContent`). At the tap nothing moves: the card collapses to its line inside
+the held frame and the stage's scroll stays, unless the line would be above the view (a reader who scrolled down a card
+taller than the stage), when it comes back to the view's top (`settleAnsweredCard`).
+
+Two cards raise the cap: a model's own question whose reply overflows its slot (`drawRoom`, the question room, read from
+the reply's start with a pill to the card) and a blocking approval too tall for the stage's view, a delegate's relayed
+one too (`raiseForApproval`, `stage_frame.js fitsCap`). An approval gets the cap only: no room class and no pill, as it
+opens at its question and command (`revealTop`).
+
 ## Frames
 
 During a turn the cost is frames, not code: JS, layout and style are each a few percent of a core, while an animation
@@ -237,6 +255,9 @@ counts. So:
   it) stops them all, so movement means chi is working; `stage.spec.js`'s question scenario checks it, also after a
   reload. An asking card (check-in) has no `.waiting`, as its turn goes on: its dot keeps blinking. `.init-spin` is
   outside the stage (plugin setup only).
+- A one-shot fade on something that arrives many times a second is a recurring cost too. A live answer's new line
+  appears at once: its fade alone was about a quarter of the streaming answer's total on the Studio (24-25% of a core to
+  17-19%). The headline's `ts-fade` stays: turning it off saved nothing measurable.
 
 A running turn's text reaches the page at most every 100 ms (`turn_block.js FLUSH_MS`): a chunk only marks its step dirty,
 and `flush` writes the dirty steps, follows and runs `onChange`, which refreshes the stage on the next frame
@@ -295,7 +316,7 @@ reach another device or the server.
 | Key | Module | What |
 |---|---|---|
 | `chi_model`, `chi_model_recent` | `model_pick.js`, `model_picker.js`, `start_page.js` | the start page's model and its recent list |
-| `chi_composer_collapsed` | `composer_fold.js` | the composer folded |
+| `chi_composer_collapsed` | `composer_fold.js` | the composer folded (a card's text field folds it for the time it has the focus on a narrow or touch screen, `composer_grip.js watchCardField`, on top of this and of the visit's state: neither is written) |
 | `chi_composer_floor` | `composer_grip.js`, `composer_mount.js` | the composer's dragged height |
 | `chi_strip_hidden` (`chi_zen`: the old name, read once) | app.js | the session strip hidden |
 | `chi_stage_collapsed` | `stage_view.js` | the stage collapsed |

data/docs/memory.md

@@ -229,6 +229,8 @@ or trims them; chi measures them (tokens estimated as characters /
   `system ~2.0k tokens (54 lines), project ~1.4k tokens (35 lines)`, with
   `, over 2500` inside the parentheses for a scope over
   `memory.index_warn_tokens`.
+- `chi memory usage` counts what the memories cost over the saved sessions: each scope's index tokens,
+  the memories read most, and the ones no session read (see [What the memories cost](#what-the-memories-cost)).
 - `/stats` has `memory index:     ~3.4k tokens in this session's prompt (system 2.0k, project 1.4k)`,
   and the web's ctx tooltip (info bar and session card) the same line. It is
   what this session's prompt holds, measured when the prompt was built (after
@@ -282,6 +284,49 @@ every read. `chi self` has a `big memories` row instead: the memories over the l
 `config_modification_protocol` is over on every install; the fix is upstream's). This is how a
 memory already over the limit gets seen.
 
+## What the memories cost
+
+`chi memory usage [--scope project|system] [--top N] [--format text|json]` answers
+"where do my memories cost the most?" from the saved session files. It reads only: no
+writes, no model call, no grades, and no advice to delete anything. `chi self`'s `big memories`
+row still lists memories over `memory.entry_warn_tokens`; this is the other half — cost is
+size times reads, and a memory of 2k tokens read fifty times costs more than one of 8k read once.
+
+- **The header** says how many sessions were counted and the days they span, because retention
+  limits what can be seen: 14 days and 500 sessions by default, so "not read" means "not read
+  in the sessions still saved". Archived sessions count; test runs and sessions with no user
+  message do not, and the header says how many of those were left out. With nothing counted at
+  all, the line says what is in the dir instead of "nothing saved": the files that could not be
+  read and the sessions not counted.
+- **The indexes come first**, since both are sent with every prompt: their tokens (the same
+  figure `chi self` and `/stats` show), the `memory.index_warn_tokens` limit, and how many of
+  their *memory* lines name a memory no counted session read. The index's heading and a bold
+  line of prose are not memory lines, so they sit in neither the count nor its denominator.
+- **Most read, by tokens**: name, tokens, reads, the memory's size now (`-` when the line has no
+  file behind it), its scope, and `from <bundle>` for a bundle's memory (which the user cannot
+  tighten in place). The header of the section says what share the shown rows make of all read
+  tokens (`--top` caps the rows, 10 by default, at most 1000). If every read is of a name with
+  no memory now, the section says that instead of listing rows.
+- **Not read in saved sessions**: the count of the user's own memories no counted session read,
+  then the largest of them. A bundle's memories are not listed, and a memory the session was
+  started with (`--memory`, or config.yml's `memories:`) counts as used: the model has it in the
+  prompt without a read. A line says an index line is paid whether or not the memory is read, so
+  a never-read memory still costs its line.
+- Names read that no longer have a memory behind them are counted in one line, not as rows.
+
+A read is a `memory_read`, or a `read` of a memory's file, in either loop's saved shape (the chat
+loop's calls paired by `tool_call_id`, the native loop's call markup with one joined result). Its
+cost is the size of the result as it was saved — a cut result counts as it happened, a model overlay
+too, and `read`ing an overlay's file is a read of the memory it overlays — in tokens as the prompt
+estimates them (characters / `context.chars_per_token`). A comma list of names splits that one result
+by share, over every name asked for: `index` is not a row, but it is one of the names the share is
+worked out over. A project memory is credited only with the reads of
+sessions of this folder's project (worktrees of one repository share it); a system memory with every
+session's, whichever project they came from.
+
+Reads saved before whole reads hold cut results; when any counted read does, one line under "Most
+read" says so, since a big memory may cost more per read now than those numbers show.
+
 ## Skills
 
 A **skill** is a memory named `skill_<name>` that holds the steps of a

data/docs/sessions.md

@@ -452,7 +452,7 @@ mise.toml pins Ruby 3.4 gets that `ruby`, `gem` and `bundle` in its tools while
 The `delegate` tool hands a task to a **child session**: an ordinary chi session in a worker of its own, started in the parent's `working_directory` with the task, verbatim, as its first user message, on the parent's model unless the call names one (`model:` takes a name or an alias, resolved as `--model` is; an unknown host comes back as the tool's `Error:` line; an id the host's saved model list doesn't have starts the child with a `Warning: host 'h' doesn't list model 'x' (did you mean: …?)` line in the result). Children run in parallel and only their **final reply** comes back to the parent: the child's newest `output/<timestamp>.txt` file, which the worker writes at the end of each turn that produced visible text, cut head-and-tail above 64 KB (`DelegateWait.cut`); a reply longer than `max_tool_output_chars` keeps its start and its end (the conclusion), with a gap line naming that `output/` file, where the whole reply is (`ToolOutputCut`'s `:head_tail_ref`; see [Tool output guardrails](internals/tool-output-limits.md#the-runners-cut-max_tool_output_chars)). Nothing of the child's trace enters the parent's context. Nothing is hidden: a child shows in `chi sessions list` (`↳ <parent>`), the web (folded into its parent's card on the strip and in all sessions, whose `▸ N delegates` chip lists the delegates at any depth, see Web UI above; a card of its own with a `↳` chip when its parent isn't listed; `↑ <parent id>` in its info bar, its tooltip `delegated by session …`; the parent's info bar carries a `⑂ N` chip counting its delegates, with how many run, wait, are done, failed, stopped or idle in the tooltip and the waiting ones named in the attention colour; a click opens all sessions), the terminal's status row (a parent's `⑂ 2 running · 1 waiting`, see [Status Line](cli.md#status-line)) and the `list_sessions` tool (`child`; the parent shows as `parent` in the child's own list); the user can `chi --attach <child id>` and steer it mid-run, and `chi send` and `send_note` reach it like any session.
 
 - `delegate(task, model:, session:, cwd:, wait:, timeout:)`: starts a child and, by default, waits for its reply. `wait: false` is the usual way for work that takes a while, several children side by side, or to keep talking with the user: it returns at once, the parent ends its turn or works on, and the reply comes back by itself as a *delegate report* (below), in a turn of its own if the parent is idle. The tool descriptions tell the model so, and to wait (`wait: true`, `delegate_result`) only when its turn can't go on without the reply. `timeout`, default 600 s, leaves a slow child running; 0 checks once without waiting. With `session:` (a child's id or prefix) the task goes to that child as a follow-up instead, delivered like `chi send` (client id `delegate:<parent short id>`, shown as `delegate>` in the child's UIs); only this session's children take one. The wait (`wait: true`, a later `delegate_result`) and the delegate report are for the reply of the child's turn the follow-up went to: its running turn, which it merges into, or the turn of its own it runs when the child is idle (`turn` in `delegates.json`, set when the child's worker names `turn_ids`), not a newer reply of a turn queued behind it. A follow-up merged as a steer into a turn the child started at that moment (a wake, a reminder, another message) gets that turn's reply or question. A child on its first turn, or with an older worker, gives its next reply, as before.
-- `cwd:` starts the child in another folder of the parent's repository: a linked worktree (`git worktree add ../<repo>-<task> -b <branch>`, which the model runs with `execute` first, under guardrails; chi runs no git here) or a subfolder; a relative path is taken from the parent's folder. The folder must exist, have the parent's project root (the same common git dir, `MemoryPaths.project_root`) and be in a work tree: a git dir (`.git`, `.git/objects`, a bare layout's `.bare`) or a bare layout's container is refused (`git rev-parse --is-inside-work-tree`, read-only, decides). Outside git only a subfolder of the parent's folder is allowed. Otherwise the tool returns `Error: cwd must be a folder of this session's repository …` or `… is not in a work tree …`. A follow-up (`session:`) refuses `cwd:`: the child keeps its folder. The child's guardrails measure from its own worktree, and project memories, `list_sessions` and the web's project are the same as the parent's.
+- `cwd:` starts the child in another folder of the parent's repository: a linked worktree (`git worktree add ../<repo>-<task> -b <branch>`, which the model runs with `execute` first, under guardrails; chi runs no git here) or a subfolder; a relative path is taken from the parent's folder. The folder must exist, have the parent's project root (the same common git dir, `MemoryPaths.project_root`) and be in a work tree: a git dir (`.git`, `.git/objects`, a bare layout's `.bare`) or a bare layout's container is refused (`git rev-parse --is-inside-work-tree`, read-only, decides). Outside git only a subfolder of the parent's folder is allowed. Otherwise the tool returns `Error: cwd must be a folder of this session's repository …` or `… is not in a work tree …`. A follow-up (`session:`) refuses `cwd:`: the child keeps its folder. The child's guardrails measure from its own worktree, and project memories, `list_sessions` and the web's project are the same as the parent's. With no `cwd:` and a task that names another checkout of the same repository (a path in the task belonging to a linked worktree, read from the files with `Guardrails::GitInfo.checkouts`, no git process), the result carries `Warning: this child runs in <folder>, but its task names <checkout>. If it should work there, stop it (chi sessions stop <id>) and call delegate again without session, with cwd: <checkout>.` One line however many are named; nothing for a path of the child's own checkout, a folder that isn't one, or a path with spaces. The child starts as it would anyway, and with `wait: true` (the default) the line comes after the child ran, so it only helps with `wait: false`. A `Warning:` for an unknown model id comes first, then this one. `Log.info(:worker, "delegate_other_checkout", parent:)` records each line.
 - `delegate_result(session:, timeout:)`: waits for a child's next reply: the one named, or the newest running child (`timeout` as for `delegate`: 0 checks once and returns at once). The reply comes back once; a later call waits for the next one. After `wait: false` it isn't needed: the report brings the reply.
 - A wait also ends early when a person's message waits for the parent's turn's next step (the `task_wait` rule: `Engine#input_waiting?`, `SessionInbox.steer_waiting?`, never in a participant's turn): `ReplyWait`'s `message_waiting:` probe gives `:message_waiting`, checked after every outcome the child can arrive at (a reply, a question, an end, a gone worker) and a cancel, before the deadline, and the result says `no reply yet: a message from the user is waiting; the child keeps running. Read the message first.` with the same last line as a timeout's. The child is never touched, the cursor doesn't move (the reply still comes, as a report or at the next `delegate_result`), a relayed approval's outcome line stays in the result, and a reserved report reads as for a timeout. A delegate child's report doesn't end a wait. This holds for `delegate`'s own wait too (both go through `DelegateWait`).
 - A wait that timed out or was canceled still gets its delegate report: neither moves the parent's cursor, so the child's reply comes as a report when its turn ends. The result says so (`chi brings its reply here by itself as a delegate report …`; with `queue`, that it joins the next step or turn) and that `delegate_result` waits again only if the turn needs the reply now. A parent that gets no reports (`session.delegate_reports: off`, a `--no-shared` REPL, `--non-interactive`) is told `delegate_result <id> waits again` instead, and `wait: false`'s result says `delegate_result waits for its reply`.

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.144.0
+version: 0.146.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/child_reports.rb

@@ -312,12 +312,12 @@ module Samagotchi
       own + strays
     end
 
-    # A second ring for a child taken earlier in this turn: read from where
-    # the first report left the cursor, keeping the first one's +before+.
+    # A second ring for a child taken earlier in this turn: this report's
+    # cursors (#report_for), both reports' rings.
     def merge_taken(earlier, report)
       return report unless earlier
 
-      report.with(before: earlier.before, rings: earlier.rings + report.rings)
+      report.with(rings: earlier.rings + report.rings)
     end
 
     # @return [Report, nil] nil when the child has nothing to report
@@ -325,7 +325,14 @@ module Samagotchi
       child = Session.load(child_id, state_dir: @state_dir)
       return nil unless child.parent_id == @session_id
 
-      before = @taken[child_id]&.after || Tools::DelegateCursors.get(@session_id, child_id, state_dir: @state_dir)
+      current = Tools::DelegateCursors.get(@session_id, child_id, state_dir: @state_dir)
+      earlier = @taken[child_id]
+      # Until the turn commits, the file holds the cursor from before the
+      # first report, plus its claim. A second ring reads on from where that
+      # report left it, and a commit moves on from the file's. If the model
+      # moved the cursor meanwhile (delegate_result), the file's is the truth.
+      kept = earlier && current.without_claim == earlier.before.without_claim ? earlier : nil
+      before = kept ? kept.after : current
       # A follow-up's turn (DelegateCursor#turn) is reported by its own
       # reply, as delegate_result takes it, not a newer queued turn's.
       wait = ReplyWait.call(child_id, state_dir: @state_dir, cursor: before.reply_file, baseline: before.baseline,
@@ -337,14 +344,14 @@ module Samagotchi
                                         turn: wait.status == :waiting_for_answer ? before.turn : nil)
                     .with_baseline(ReplyWait.baseline_of(wait.session))
       claim = Tools::ReportClaim.new(id: claim_id, file: wait.file, cursor: after)
-      return nil unless Tools::DelegateCursors.claim_report(@session_id, child_id, expected: before, claim: claim,
+      return nil unless Tools::DelegateCursors.claim_report(@session_id, child_id, expected: current, claim: claim,
                                                             state_dir: @state_dir)
 
       # A reported end is the follow-up turn's too (DelegateCursor#turn):
       # a later wait on it would repeat its reply.
       after = after.with(report_claim: claim)
       text = Tools::DelegateWait.finish(wait, child_id, timeout: 0, report: true)
-      Report.new(child_id: child_id, text: text, before: before, after: after, rings: rings, claim_id: claim_id,
+      Report.new(child_id: child_id, text: text, before: kept ? kept.before : before, after: after, rings: rings, claim_id: claim_id,
                  relay: relay?(wait) ? wait.question : nil)
     rescue ArgumentError
       nil # the child is gone

data/lib/samagotchi/guardrails/approval.rb

@@ -181,16 +181,17 @@ module Samagotchi
           return verdict.settle!(:deny, decided_by: "user", note: "The approval was cancelled.")
         end
 
+        who = answer.parent_agent? ? Verdict::PARENT_AGENT : "user"
         index = answer.selected_indices.first
         if index && index < scopes.size
-          verdict.settle!(:allow, decided_by: "user")
+          verdict.settle!(:allow, decided_by: who)
           verdict.scope = scopes[index]
           return verdict
         end
 
         freeform = answer.freeform.to_s.strip
-        note = freeform.empty? ? "The user declined this call." : "The user declined this call: #{freeform.inspect}."
-        verdict.settle!(:deny, decided_by: "user", note: note)
+        declined = "The #{who} declined this call"
+        verdict.settle!(:deny, decided_by: who, note: freeform.empty? ? "#{declined}." : "#{declined}: #{freeform.inspect}.")
       end
 
       # The rule's scopes; "rule" only when a rule id names what to approve.
@@ -206,12 +207,24 @@ module Samagotchi
         place = verdict.targets&.repo_root ? "in this repo (#{verdict.targets.repo_name})" : "in this directory"
         case scope
         when "once" then ONCE
-        when "session" then "Allow this call for the session"
+        when "session" then "Allow #{session_subject(verdict.targets)} for the session"
         when "repo" then "Allow this call #{place}"
         when "rule" then "Allow rule #{verdict.rule} #{place}"
         end
       end
 
+      # What a session answer covers, as Approvals.key_for keys it: a file
+      # tool's later calls on the same paths, else this one exact call.
+      def session_subject(targets)
+        return "this call" if targets.nil? || targets.command || targets.paths.empty?
+
+        what = targets.paths.one? ? File.basename(targets.paths.first) : "#{targets.paths.size} files"
+        "#{SESSION_VERBS.fetch(targets.tool, "#{targets.tool} on")} #{what}"
+      end
+
+      # How a session label names a file tool's calls.
+      SESSION_VERBS = { "edit" => "edits to", "write" => "writes to" }.freeze
+
       # How much of a plugin tool's arguments the question shows.
       ARGS_CHARS = 300
 

data/lib/samagotchi/guardrails/parent_approvals.rb

@@ -40,6 +40,10 @@ module Samagotchi
       # The guardrails bundle's ask before a memory removal: its paths are in
       # the config dir, yet a parent may answer it.
       MEMORY_REMOVE_RULE = "memory-remove"
+      # A delegate child's ask before it acts outside its folder. It carries
+      # the core source but isn't about chi's own files, so it follows the
+      # level like any other ask, unless it names them (#chi_files?).
+      CHILD_BOUNDARY_RULE = "child-boundary"
       # The guardrails bundle's shell-touches-chi, for a word it can't
       # resolve to a path (Guardrails::ShellPaths): CHI_TEXT and .git/hooks.
       CHI_SHELL_TEXT = Regexp.union(CHI_TEXT, %r{\.git/(?:modules/\S+/)?hooks})
@@ -68,7 +72,7 @@ module Samagotchi
         facts = ApprovalFacts.from_h(facts)
         return false if facts.nil?
         return true if PROTECTED_RULES.include?(facts.rule.to_s)
-        return true if facts.source.to_s == ProtectedPaths::SOURCE
+        return true if facts.source.to_s == ProtectedPaths::SOURCE && facts.rule.to_s != CHILD_BOUNDARY_RULE
         # A memory's file sits in the config dir, but removing one is the
         # memory-remove rule's ask, which a parent may answer.
         return false if facts.rule.to_s == MEMORY_REMOVE_RULE

data/lib/samagotchi/guardrails/verdict.rb

@@ -26,6 +26,8 @@ module Samagotchi
       PROTECTED_RULES = %w[chi-config chi-home chi-shim chi-hooks shell-touches-chi chi-context-cmd chi-broadcast prompt-memory-write
                            model-overlay-write chi-answer-piped chi-answer-http].freeze
       SCOPES = %w[once session repo rule].freeze
+      # Who answered an ask when it was a parent agent, not the user.
+      PARENT_AGENT = "parent agent"
       DO_NOT_RETRY = "Do not retry it or reach the same result another way; ask the user how to proceed."
 
       attr_reader :decision, :reason, :rule, :source, :scopes, :decided_by
@@ -118,12 +120,12 @@ module Samagotchi
 
       # What the model gets for a deny (after the "[tool] Error: " prefix):
       # who decided, why, and not to route around it (or the voter's own
-      # advice). A user's deny leads with the user's answer, so it doesn't
-      # read as the rule refusing.
+      # advice). A deny on an ask leads with the answer, the user's or a
+      # parent agent's, so it doesn't read as the rule refusing.
       def deny_text
         reason = @reason.to_s.strip
         reason += "." unless reason.empty? || reason.match?(/[.!?]\z/)
-        parts = if @decided_by == "user" && @note
+        parts = if ["user", PARENT_AGENT].include?(@decided_by) && @note
                   [@note, "It needed approval (#{decider}):", reason]
                 else
                   ["denied by guardrail (#{decider}):", reason, @note || "The user was not asked."]