samagotchi 0.153.0 → 0.154.1

data/lib/samagotchi/web/participant_view.rb

@@ -6,6 +6,7 @@ require_relative "../turn_origin"
 require_relative "../participant_mode"
 require_relative "../revise_anchor"
 require_relative "../verify_anchor"
+require_relative "../redact"
 
 module Samagotchi
   module Web
@@ -23,23 +24,10 @@ module Samagotchi
     # is an allowlist that builds a new hash from named fields, so a field
     # added to an event later never reaches a participant until it is
     # named here, and an event type not named is dropped. Every string
-    # that goes out passes Redact (secret shapes, the owner's token, the
+    # that goes out passes Redact (lib/samagotchi/redact.rb: secret shapes, the owner's token, the
     # home folder), defence in depth only: the allowlist is the control.
     # Pure: no I/O; keys of what comes in may be strings (JSON) or symbols.
     module ParticipantView
-      # Who is looking: +author+ the participant's ("p:<id>"; nil for the
-      # owner through the participant view: nothing is theirs), +cwd+ the
-      # session's folder (tool paths are shown relative to it, only inside
-      # it), +home+ the folder shown as ~, +secrets+ literal strings never
-      # shown (the owner's token).
-      Viewer = Data.define(:author, :cwd, :home, :secrets) do
-        def initialize(author: nil, cwd: nil, home: Dir.home, secrets: [])
-          super(author: author, cwd: cwd, home: home, secrets: Array(secrets).map(&:to_s).reject(&:empty?))
-        end
-
-        def own?(author) = !self.author.nil? && author.to_s == self.author
-      end
-
       # A turn's participant_mode values the view passes on (ParticipantMode).
       PARTICIPANT_MODES = [ParticipantMode::REVIEW.to_s, ParticipantMode::PAIR.to_s].freeze
 
@@ -431,74 +419,6 @@ module Samagotchi
 
         hash.key?(key) ? hash[key] : hash[key.to_s]
       end
-
-      # Secret shapes and host paths out of what a participant gets (the
-      # session's folder as relative paths, home as ~). Defence in depth: the
-      # allowlist above is the control; this catches a key the model quoted
-      # in a reply, or one in a prompt.
-      module Redact
-        MARK = "[redacted]"
-        PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----.*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|\z)/m
-        PATTERNS = [
-          PRIVATE_KEY,
-          /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/,
-          /\bgh[pousr]_[A-Za-z0-9]{20,}/,
-          /\bgithub_pat_[A-Za-z0-9_]{20,}/,
-          /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
-          /\bxox[abprs]-[A-Za-z0-9-]{10,}/,
-          /\bchp_[A-Za-z0-9_-]{20,}/,
-          # A one-time link code (LinkCodes::CODE_RE): a bearer credential
-          # until its grant expires (an owner's, 10 minutes).
-          /\bchc_[A-Za-z0-9_-]{43}/,
-          /\bAIza[0-9A-Za-z_-]{30,}/,
-          /\b[rs]k_(?:live|test)_[A-Za-z0-9]{16,}/,
-          /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/,
-          %r{https://hooks\.slack\.com/services/[A-Za-z0-9/_-]+}
-        ].freeze
-        # The value after an Authorization (or a Bridge's secret,
-        # BridgeSecret::HEADER) header or a token=/key= pair.
-        VALUES = [
-          /(\b(?:Authorization|X-Chi-Bridge):\s*(?:Bearer\s+|Basic\s+|Token\s+)?)[^\s"'`]+/i,
-          /((?<![A-Za-z0-9])[A-Za-z0-9_-]*?(?:token|api[_-]?key|access[_-]?key|secret|password|passwd)["']?\s*[=:]\s*["']?)[^\s"'&`,;}]+/i,
-          # A URL's password: scheme://user:PASSWORD@host.
-          %r{(\b[a-z][a-z0-9+.-]*://[^/\s:@]+:)[^@\s/]+(?=@)}i
-        ].freeze
-        # A text that ends where one of VALUES' values (or a private key's
-        # BEGIN line) would go on: a stream cut there would send the value
-        # on its own, unredacted (ParticipantStreamFilter never cuts there).
-        OPEN_VALUE = /(?:\b(?:Authorization|X-Chi-Bridge):\s*(?:(?:Bearer|Basic|Token)\s*)?|[A-Za-z0-9_-]*?(?:token|api[_-]?key|access[_-]?key|secret|password|passwd)["']?\s*(?:[=:]\s*["']?)?|-----BEGIN [A-Z0-9 ]*)\z/i
-
-        module_function
-
-        # +value+ with every string in it redacted (hash values, array items).
-        def deep(value, viewer)
-          case value
-          when String then text(value, viewer)
-          when Hash then value.transform_values { |item| deep(item, viewer) }
-          when Array then value.map { |item| deep(item, viewer) }
-          else value
-          end
-        end
-
-        def text(value, viewer)
-          out = value.dup
-          viewer.secrets.each { |secret| out = out.gsub(secret, MARK) }
-          PATTERNS.each { |pattern| out = out.gsub(pattern, MARK) }
-          VALUES.each { |pattern| out = out.gsub(pattern) { "#{Regexp.last_match(1)}#{MARK}" } }
-          out = within(out, viewer.cwd.to_s)
-          home = viewer.home.to_s
-          out = out.gsub(%r{#{Regexp.escape(home)}(?=/|\b|\z)}, "~") if home.length > 1
-          out
-        end
-
-        # +text+ with +dir+ (the session's folder) shown relative: "dir/x"
-        # as "x", "dir" alone as ".".
-        def within(text, dir)
-          return text if dir.length < 2
-
-          text.gsub(%r{#{Regexp.escape(dir)}(/|(?=\b|\z))}) { Regexp.last_match(1) == "/" ? "" : "." }
-        end
-      end
     end
   end
 end

data/lib/samagotchi/web/participants_admin.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "grants"
+require_relative "../grants"
 require_relative "qr"
 require_relative "../review_start"
 require_relative "../review_apply"

data/lib/samagotchi/web/public/block_host.js

@@ -42,6 +42,11 @@ const NOT_AN_IMAGE = "the renderer's SVG can't be shown as an image";
 // this tall and scrolls sideways instead.
 const MIN_SHOWN_HEIGHT = 120;
 
+// The zoom button's words: the picture fitted to the column, or at its natural size.
+const ZOOM_IN = "Show at full size";
+const ZOOM_OUT = "Fit to the column";
+
+const ZOOM_ICON = html`<svg viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"><circle cx="7" cy="7" r="4.25" fill="none" stroke="currentColor" stroke-width="1.4"/><path d="m10.2 10.2 3.3 3.3" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"/></svg>`;
 const ICON = html`<svg viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"><path d="M5.5 4 2 8l3.5 4M10.5 4 14 8l-3.5 4" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
 
 // The picture's URL and size. The XML parser reads the root, as the image will: a
@@ -286,6 +291,9 @@ export function createBlockHost({
     return Promise.race([image, bound]).finally(() => clearTimeout(timer));
   }
 
+  // The picture's name says where its words are: the source <pre> is hidden, so a
+  // screen reader reaches it through the toggle. The zoom is a button too, for the
+  // keyboard (a click on the picture does the same); it shows on keyboard focus only.
   function makeFigure(picture, themeName, lang) {
     const figure = doc.createElement("figure");
     figure.className = DRAWN;
@@ -294,17 +302,33 @@ export function createBlockHost({
     scroll.className = "block-scroll";
     const img = doc.createElement("img");
     img.className = "block-img";
-    img.alt = `${lang} diagram`;
+    img.alt = `${lang} diagram, its source under the Show the source button`;
     showPicture(img, picture);
     scroll.append(img);
-    const toggle = doc.createElement("button");
-    toggle.type = "button";
-    toggle.className = "block-toggle";
-    litRender(ICON, toggle);
-    figure.append(scroll, toggle);
+    const zoom = button("block-zoom", ZOOM_ICON);
+    const toggle = button("block-toggle", ICON);
+    figure.append(scroll, zoom, toggle);
+    setZoomed(figure, false);
     return figure;
   }
 
+  function button(className, icon) {
+    const el = doc.createElement("button");
+    el.type = "button";
+    el.className = className;
+    litRender(icon, el);
+    return el;
+  }
+
+  function setZoomed(figure, on) {
+    figure.classList.toggle("natural", on);
+    const zoom = figure.querySelector(":scope > .block-zoom");
+    if (!zoom) return;
+    zoom.setAttribute("aria-pressed", on ? "true" : "false");
+    zoom.setAttribute("aria-label", on ? ZOOM_OUT : ZOOM_IN);
+    zoom.title = on ? ZOOM_OUT : ZOOM_IN;
+  }
+
   function showPicture(img, { url, width, height }) {
     if (width && height) {
       img.setAttribute("width", width);
@@ -476,7 +500,7 @@ export function createBlockHost({
     scan(root);
 
     root.addEventListener("mousedown", (e) => {
-      if (e.target.closest?.(".block-toggle")) e.preventDefault();
+      if (e.target.closest?.(".block-toggle, .block-zoom")) e.preventDefault();
     });
     // Delegated, so a Revise clone's work too.
     root.addEventListener("click", (e) => {
@@ -490,7 +514,10 @@ export function createBlockHost({
       }
       const note = e.target.closest?.(".block-note");
       if (note) { copy(note.dataset.text); return; }
-      if (e.target.closest?.(".block-img")) e.target.closest(`.${DRAWN}`).classList.toggle("natural");
+      if (e.target.closest?.(".block-zoom, .block-img")) {
+        const figure = e.target.closest(`.${DRAWN}`);
+        setZoomed(figure, !figure.classList.contains("natural"));
+      }
     });
   }
 

data/lib/samagotchi/web/public/block_renderers.css

@@ -1,4 +1,4 @@
-/* A drawn fenced block (block_host.js): the picture scales to the column, a click shows its natural size in a scroller; the toggle shows the source, in the block's place. In a .code-wrap the copy button sits top-right, so the toggle sits left of it. */
+/* A drawn fenced block (block_host.js): the picture scales to the column, a click shows its natural size in a scroller; the toggle shows the source, in the block's place. In a .code-wrap the copy button sits top-right, so the toggle sits left of it. The zoom button, the keyboard's way to the natural size, shows on keyboard focus only, left of the toggle. */
 .block-drawn{position:relative;margin:0 0 12px;white-space:normal}
 .code-wrap>.block-drawn{margin:0}
 .code-wrap>.block-drawn.source{height:0}
@@ -8,11 +8,15 @@
 .block-img{display:block;max-width:100%;max-height:50000px;object-fit:contain;height:auto;margin:0 auto;cursor:zoom-in}
 .block-drawn.natural .block-img{max-width:50000px;margin:0;cursor:zoom-out}
 .block-drawn.source .block-scroll{display:none}
-.block-toggle{position:absolute;top:5px;right:5px;z-index:1;display:inline-flex;align-items:center;justify-content:center;height:24px;min-width:24px;padding:0 5px;border-radius:6px;background:var(--bg-raised);border:1px solid var(--border-strong);color:var(--text-3);opacity:0;transition:opacity .12s}
+.block-toggle,.block-zoom{position:absolute;top:5px;right:5px;z-index:1;display:inline-flex;align-items:center;justify-content:center;height:24px;min-width:24px;padding:0 5px;border-radius:6px;background:var(--bg-raised);border:1px solid var(--border-strong);color:var(--text-3);opacity:0;transition:opacity .12s}
 .code-wrap>.block-drawn>.block-toggle{right:34px}
-.block-toggle svg{display:block}
-.block-drawn:hover>.block-toggle,.code-wrap:hover>.block-drawn>.block-toggle,.block-toggle:focus-visible,.block-drawn.source>.block-toggle{opacity:1}
-.block-toggle:hover:not(:disabled){filter:none}@media(hover:hover){.block-toggle:hover:not(:disabled){color:var(--text-bright)}}
+.block-zoom{right:34px}
+.code-wrap>.block-drawn>.block-zoom{right:63px}
+.block-drawn.source>.block-zoom{display:none}
+.block-zoom:not(:focus-visible){pointer-events:none}
+.block-toggle svg,.block-zoom svg{display:block}
+.block-drawn:hover>.block-toggle,.code-wrap:hover>.block-drawn>.block-toggle,.block-toggle:focus-visible,.block-zoom:focus-visible,.block-drawn.source>.block-toggle{opacity:1}
+.block-toggle:hover:not(:disabled),.block-zoom:hover:not(:disabled){filter:none}@media(hover:hover){.block-toggle:hover:not(:disabled),.block-zoom:hover:not(:disabled){color:var(--text-bright)}}
 .block-drawn.source:not(:last-child){margin:0}
 /* Its words are the attribute's, so a bubble's text stays the answer's (block_host.js fail). */
 .block-note{margin:4px 0 12px;font-size:12px;color:var(--text-3);white-space:normal}

data/lib/samagotchi/web/public/card_stamps.js

@@ -0,0 +1,27 @@
+// Where a snapshot's card or notice goes by its stamp: the id of the turn
+// opening it comes after (+opening_id+, Bridge::CardPlaces#opening_of: a
+// prompt's turn_id, a wake note's, /continue no's reason line's own id). The
+// page finds that opening's bubble (data-turn-id on a prompt, data-opening-id
+// on a wake note or a reason line, turn_html.js) and the entry goes before
+// the next turn's opening, or at the end. No counting, so the page and the
+// worker can't disagree on which bubbles open turns. An entry with no stamp
+// (an older worker's, one before every opening), or whose opening the page
+// doesn't draw, falls back to its count (card.js cardPlace, turns_since).
+// A new module: the static JS is unversioned (docs/internals/web-frontend.md).
+import { cardPlace } from "./card.js";
+
+// The opening bubble +id+ names among the turns' openings (oldest first,
+// bubbles.js turnPromptBubbles), or -1.
+export function stampedOpening(userBubbles, id) {
+  if (!id) return -1;
+  const stamp = String(id);
+  return userBubbles.findIndex((el) => el.dataset?.turnId === stamp || el.dataset?.openingId === stamp);
+}
+
+// The element +entry+ goes before: the opening after its stamped one (null:
+// the end), else what its count says (null: the end too).
+export function snapshotPlace(userBubbles, entry) {
+  const at = stampedOpening(userBubbles, entry?.opening_id);
+  if (at < 0) return cardPlace(userBubbles, entry);
+  return userBubbles[at + 1] || null;
+}

data/lib/samagotchi/web/public/cards_place.js

@@ -8,7 +8,8 @@
 // above the first turn after them, a finished turn's notice in its step, a
 // finished turn's question resolved where it was asked.
 import { getSession, sendCommand } from "./data.js";
-import { cardPlace, drawCard, isCard, isNoticeCard, refreshCardBody, turnNoticePlace } from "./card.js";
+import { drawCard, isCard, isNoticeCard, refreshCardBody, turnNoticePlace } from "./card.js";
+import { snapshotPlace } from "./card_stamps.js";
 import { elementOf } from "./turn_html.js";
 import { stepText } from "./turn_block.js";
 import { llmContextNotice, noticeLine } from "./turn_events.js";
@@ -83,14 +84,15 @@ export function createCardsPlace({
     bubbles.placeFollowing(el, before);
   }
 
-  // A snapshot's cards and notices, each above the first turn after it; a
+  // A snapshot's cards and notices, each above the first turn after it (the
+  // one after its stamped opening, card_stamps.js; else by its count); a
   // turn's own notice where it showed live (placeTurnNotice). +end+: what
   // closes the history below them (a failed turn's prompt), for those with
   // no turn after them; one shown after that prompt went back stays below it.
   function placeSnapshotCards(entries, { before: end = null } = {}) {
     const users = turnPromptBubbles(historyEl);
     for (const entry of entries) {
-      const before = cardPlace(users, entry) || (entry.after_failed ? null : end);
+      const before = snapshotPlace(users, entry) || (entry.after_failed ? null : end);
       if (isCard(entry)) upsertCard(entry, { before });
       else if (entry.type === "question") placeResolvedQuestion(entry, before);
       else if (entry.type === "guardrail_warning") bubbles.showGuardrailWarning(entry.message, entry.label || "guardrails", { before });

data/lib/samagotchi/web/public/chains.js

@@ -305,8 +305,8 @@ export function continueRefusal(error, sessions = []) {
 }
 
 // The open-children refusal as the toast shows it: the open delegates the
-// continue can't move to the next link (an older chi's worker, a chi
-// REPL), each a link to its session with what to do about it.
+// continue can't move to the next link (an older chi's worker, a
+// one-shot run), each a link to its session with what to do about it.
 // @param hrefFor (id) → its page's href
 export function openChildrenTemplate(prevId, children, hrefFor) {
   const n = children.length;

data/lib/samagotchi/web/public/claim_link.js

@@ -12,7 +12,7 @@
 // URL-safe and a space is one "+".
 //
 // Normalized: whitespace collapsed, and what the participant page shows
-// instead (ParticipantView::Redact): secret shapes "[redacted]" (so a link
+// instead (Samagotchi::Redact): secret shapes "[redacted]" (so a link
 // never carries one, and matches the participant's redacted text), and on
 // the owner's page the session's folder relative ("<cwd>/x" → "x",
 // "<cwd>" → "."), the home folder "~". Not the owner's token (Redact's
@@ -41,10 +41,10 @@ export const HIT_CLASS = "claim-hit";
 const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
 export const MARK = "[redacted]";
-// ParticipantView::Redact's PATTERNS and VALUES
-// (lib/samagotchi/web/participant_view.rb), as JS: keep them in step.
+// Samagotchi::Redact's PATTERNS and VALUES
+// (lib/samagotchi/redact.rb), as JS: keep them in step.
 // spec/fixtures/redact_cases.json holds cases both sides read the same
-// (participant_view_spec.rb, claim_link.test.js).
+// (redact_spec.rb, claim_link.test.js).
 const SECRET_PATTERNS = [
   /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g,
   /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}/g,

data/lib/samagotchi/web/public/composer_mode.js

@@ -51,7 +51,7 @@ export function composerMode({ selected, owner, running, narrow }) {
   if (tui) {
     return {
       ...base,
-      placeholder: pick("A terminal chi owns this session · run it with chi --shared to send from here", "A terminal chi owns this session"),
+      placeholder: pick("A terminal chi owns this session · a one-turn chi --non-interactive run or an older chi's terminal", "A terminal chi owns this session"),
       hint: "", button: "Send", disabled: true,
     };
   }

data/lib/samagotchi/web/public/format.js

@@ -97,13 +97,14 @@ export function deleteConfirmText(session) {
 }
 
 // The badge on a session a process holds right now (the list's `owner`):
-// a worker (shared: every UI can send), or a plain terminal chi (not shared).
+// a worker (every UI can send), or a terminal chi: a one-turn --non-interactive
+// run or an older chi's terminal, in OwnerLock::TUI_BUSY's words.
 export function ownerBadge(owner, id) {
   if (owner === "worker") {
     return { kind: "worker", text: "live", title: `A worker runs this session; a terminal joins with: chi --attach ${id}` };
   }
   if (owner === "tui") {
-    return { kind: "tui", text: "terminal", title: "A terminal chi owns this session and doesn't share it (chi --shared would)" };
+    return { kind: "tui", text: "terminal", title: "In use by a one-turn chi --non-interactive run or an older chi's terminal" };
   }
   return null;
 }
@@ -171,7 +172,7 @@ export function childrenSummary(parent, sessions) {
 
 // Whether the info bar offers "stop": only while a worker runs the session
 // (the list says so, or this page streams from one a send just woke). A
-// stopped or idle-exited session has nothing to stop, and a chi REPL's is
+// stopped or idle-exited session has nothing to stop, and a one-turn run's is
 // refused by the server.
 export function canStopSession({ owner, streaming }) {
   if (owner === "tui") return false;

data/lib/samagotchi/web/public/turn_html.js

@@ -285,9 +285,11 @@ export function noteBubbleTemplate(note) {
   if (note?.objectives) return objectivesEntryTemplate(note, timeTitle(note.at));
   const from = note?.label ? `note from ${note.label}` : "note";
   // A wake turn's note opens that turn (TURN_PROMPT, bubbles.js); a class, not
-  // data-turn-id, which marks a claim's anchor (claim_link.js).
+  // data-turn-id, which marks a claim's anchor (claim_link.js). Its turn's id
+  // is its data-opening-id: a card's stamp finds it (card_stamps.js).
   const cls = note?.turn_start ? "bubble note turn-start" : "bubble note";
-  return html`<div class=${cls} title=${timeTitle(note?.at)}><div class="note-line">${from}</div><div class="note-text">${note?.content ?? ""}</div></div>`;
+  const opening = note?.turn_start && note?.turn_id ? String(note.turn_id) : nothing;
+  return html`<div class=${cls} title=${timeTitle(note?.at)} data-opening-id=${opening}><div class="note-line">${from}</div><div class="note-text">${note?.content ?? ""}</div></div>`;
 }
 
 // A plugin's steer (a nudge put into the running turn): one line that
@@ -311,7 +313,9 @@ export function steerRowTemplate({ source, text } = {}, { bubble = false } = {})
 // participant's badge (participant_names.js authorBadge: their name and
 // colour) in place of +label+. A turn's opening carries its Revise stamp
 // (+message.revises+: data-revises, revise_stack.js) and whether it was a
-// Verify turn (+message.verify+: data-verify, no Revise on its answer).
+// Verify turn (+message.verify+: data-verify, no Revise on its answer). An
+// opening no turn ran (/continue no's reason) has +message.opening_id+
+// instead of a turn id: data-opening-id, a card's stamp (card_stamps.js).
 // +message.source+ (a delegate report's "delegate_report") is its
 // data-source; +lineKey+, a merged line's fold key (answer_fold.js:
 // data-line-key, the reload's "<turn id>:input:<place>").
@@ -320,7 +324,7 @@ export function userBubbleTemplate(message, { label = null, state = null, step =
   const from = author
     ? html`<span class="origin-label author-badge" title=${authorBadgeTitle(author.name, author.mode)} data-unnamed=${author.unnamed ? "1" : nothing}>${authorBadgeText(author.name, author.mode)}</span>`
     : label ? html`<span class="origin-label">${label}</span>` : nothing;
-  return html`<div class=${`bubble user${named ? ` ${named}` : ""}${author ? " by-participant" : ""}`} title=${timeTitle(message?.at)} style=${author ? `--author-color:${author.color}` : nothing} data-author=${author?.author || nothing} data-participant-mode=${author?.mode || nothing} data-user-state=${named || nothing} data-step=${step ? Number(step) : nothing} data-copy-source=${copySource({ ...message, role: "user" })} data-user-content=${key !== null ? key : nothing} data-turn-id=${message?.turn_id || nothing} data-revises=${(message?.turn_id && message?.revises?.turn_id) || nothing} data-verify=${message?.turn_id && message?.verify ? "1" : nothing} data-own=${own ? "1" : nothing} data-enqueued-id=${enqueuedId || nothing} data-delivery=${delivery || nothing} data-source=${message?.source || nothing} data-line-key=${lineKey || nothing}>${from}${userMessageTemplate(message, thumbs)}${stateBadgeTemplate(named, delivery)}</div>`;
+  return html`<div class=${`bubble user${named ? ` ${named}` : ""}${author ? " by-participant" : ""}`} title=${timeTitle(message?.at)} style=${author ? `--author-color:${author.color}` : nothing} data-author=${author?.author || nothing} data-participant-mode=${author?.mode || nothing} data-user-state=${named || nothing} data-step=${step ? Number(step) : nothing} data-copy-source=${copySource({ ...message, role: "user" })} data-user-content=${key !== null ? key : nothing} data-turn-id=${message?.turn_id || nothing} data-opening-id=${(!message?.turn_id && message?.opening_id) || nothing} data-revises=${(message?.turn_id && message?.revises?.turn_id) || nothing} data-verify=${message?.turn_id && message?.verify ? "1" : nothing} data-own=${own ? "1" : nothing} data-enqueued-id=${enqueuedId || nothing} data-delivery=${delivery || nothing} data-source=${message?.source || nothing} data-line-key=${lineKey || nothing}>${from}${userMessageTemplate(message, thumbs)}${stateBadgeTemplate(named, delivery)}</div>`;
 }
 
 // A user line's text: plain (its quotes set apart), or the server's

data/lib/samagotchi/web/push/store.rb

@@ -7,7 +7,7 @@ require "openssl"
 require "time"
 require "uri"
 require_relative "crypto"
-require_relative "../private_files"
+require_relative "../../private_files"
 require_relative "../../log"
 require_relative "../../atomic_file"
 require_relative "../../session"

data/lib/samagotchi/web/session_access_routes.rb

@@ -54,6 +54,14 @@ module Samagotchi
         json_response(status, { error: code, detail: detail, message: error.message, **fields }.compact)
       end
 
+      # 409 scratch for a chi scratch session +id+, which only its terminal
+      # uses (Session::SCRATCH_REFUSED): the session page's read and stream
+      # (a tab opened at its id by hand: the hub never lists it), as
+      # POST …/wake refuses it.
+      def scratch_refused(id)
+        refusal_response(409, "scratch", SessionManager::ScratchSession.new(id), session_id: id)
+      end
+
       # The body as a Hash ({} when there is none), or nil when it isn't one.
       def body_hash(req)
         raw = request_body(req)
@@ -256,7 +264,7 @@ module Samagotchi
       # status row), parent_strategy, installed (the newest chi here)}. A
       # worker still leaving is waited for first (Local#wake: its recap's
       # timeout and a margin, on top of +wait+); 409
-      # owned_by_tui (a chi REPL has it), 409 scratch (a leftover scratch
+      # owned_by_tui (a one-turn chi run has it), 409 scratch (a leftover scratch
       # session, as chi --attach here says); 504 worker_timeout (its Bridge
       # didn't come in time); 409 worker_newer (a worker whose protocol is newer
       # than this chi's, not resumed); 404 not_found.
@@ -425,7 +433,7 @@ module Samagotchi
       # session (NoteDelivery, as chi note; source: where it came from,
       # "cli" by default, never "broadcast"). 200 {status: "queued" (a
       # worker adds it) or "waits" (the next start does), session_id,
-      # queued}; 409 owned_by_tui (status refused: a chi REPL has it); 400
+      # queued}; 409 owned_by_tui (status refused: a one-turn chi run has it); 400
       # note_rejected (empty, or over 16 KiB).
       def handle_notes(req, id)
         body = body_hash(req) or return error_response(400, "invalid_json", "invalid JSON body")
@@ -438,8 +446,9 @@ module Samagotchi
         session_access.show(id)
         result = session_access.note(id, text: text, source: source.strip)
         if result.status == :refused
-          error = SessionManager::OwnedByTUI.new(id)
-          return refusal_response(409, "owned_by_tui", error, session_id: id, status: "refused", queued: 0)
+          error = result.scratch ? SessionManager::ScratchSession.new(id) : SessionManager::OwnedByTUI.new(id)
+          return refusal_response(409, "owned_by_tui", error, session_id: id, status: "refused", queued: 0,
+                                                             scratch: result.scratch || nil)
         end
 
         json_response(200, { status: result.status.to_s, session_id: id, queued: result.queued })

data/lib/samagotchi/web/session_control.rb

@@ -16,7 +16,7 @@ module Samagotchi
     # a task, dequeue a queued turn, what it could stop and stop it
     # (handle_session_holds, handle_stop_holds — the page's Stop asks about
     # these first), stop, restart, archive, unarchive and delete
-    # (handle_question_answer … handle_delete), with the refusals they answer (owned_by_repl, owned_by_tui, archive_refused). Included in App:
+    # (handle_question_answer … handle_delete), with the refusals they answer (owned_by_one_shot, owned_by_tui, archive_refused). Included in App:
     # its ROUTES name the handlers, and its helpers (json_response,
     # error_response, parse_json, request_body, relay, not_live,
     # bridge_error, reply_detail, worker_timeout, bridge_client,
@@ -443,7 +443,7 @@ module Samagotchi
 
       # POST /api/sessions/:id/archive: hide it (and its delegates) from the
       # lists, keep it for good. A live idle worker is stopped first; a turn
-      # running in it or a delegate, a chi REPL's session and a scratch one
+      # running in it or a delegate, a one-turn chi run's session and a scratch one
       # are refused (409).
       def handle_archive(_req, id)
         result = @manager.archive_session(id, state_dir: @state_dir, wait: STOP_WAIT_SECONDS)
@@ -451,7 +451,7 @@ module Samagotchi
         json_response(200, { status: "archived", session_id: result.id, archived: result.archived,
                              stopped: result.stopped, discarded: result.discarded })
       rescue SessionManager::OwnedByTUI => e
-        owned_by_repl(id, e)
+        owned_by_one_shot(id, e)
       rescue SessionManager::ArchiveRefused => e
         archive_refused(e)
       end
@@ -466,7 +466,7 @@ module Samagotchi
       # DELETE /api/sessions/:id?force=true: the session for good. With
       # force a live worker is stopped first (the page sends it: its confirm
       # says so); without it a live worker's session is refused, 409
-      # worker_running, as chi sessions delete without --force. A chi REPL's
+      # worker_running, as chi sessions delete without --force. A one-turn chi run's
       # session is always refused.
       def handle_delete(req, id)
         result = @manager.delete_session(id, state_dir: @state_dir, stop: truthy_param?(req.params["force"]),
@@ -474,7 +474,7 @@ module Samagotchi
         @hub&.touch(result[:id])
         json_response(200, { status: "deleted", session_id: result[:id], stopped: result[:stopped] })
       rescue SessionManager::OwnedByTUI => e
-        owned_by_repl(id, e)
+        owned_by_one_shot(id, e)
       rescue SessionManager::DeleteRefused => e
         detail = e.reason == :still_stopping ? "#{e.message}; try again in a moment" : e.message
         refusal_response(409, e.reason.to_s, e, detail: detail, session_id: e.session_id, reason: e.reason.to_s)
@@ -482,15 +482,19 @@ module Samagotchi
 
       # 409 owned_by_tui in the words a refused archive, delete or continue
       # shows (stop, restart, a turn and a command show OwnedByTUI's own).
-      def owned_by_repl(id, error = nil)
+      def owned_by_one_shot(id, error = nil)
         named = SessionManager::OwnedByTUI.new(id)
         error ||= named
         refusal_response(409, "owned_by_tui", error, detail: named.message, session_id: error.session_id)
       end
 
       # 409 owned_by_tui in OwnedByTUI's own words (stop, restart, a turn, a
-      # command).
-      def owned_by_tui(error) = refusal_response(409, "owned_by_tui", error, session_id: error.session_id)
+      # command); scratch: true for a chi scratch session
+      # (SessionManager::ScratchSession), which a remote client raises again.
+      def owned_by_tui(error)
+        scratch = error.is_a?(SessionManager::ScratchSession) || nil
+        refusal_response(409, "owned_by_tui", error, session_id: error.session_id, scratch: scratch)
+      end
 
       # 409 scratch or busy (every other reason: a turn, a queued prompt, an
       # open step-limit question, in it or a delegate, +busy_id+), with the

data/lib/samagotchi/web/session_create.rb

@@ -339,7 +339,7 @@ module Samagotchi
       rescue SessionManager::ArchiveRefused => e
         [nil, archive_refused(e)]
       rescue SessionManager::OwnedByTUI => e
-        [nil, owned_by_repl(given, e)]
+        [nil, owned_by_one_shot(given, e)]
       rescue ModelProfile::MissingModel => e
         [nil, error_response(400, "invalid_model", e.message)]
       rescue Session::AmbiguousId => e

data/lib/samagotchi/web/session_hub.rb

@@ -41,8 +41,8 @@ module Samagotchi
       # The flock leaves no file trace when its holder dies, so owners are
       # probed: every tick for the sessions the projection believes owned
       # (a handful; OwnerLock.owner is open + LOCK_SH|LOCK_NB + close), and
-      # all sessions this often (a plain REPL that opened an old session
-      # without saving it has no file signal until its first save).
+      # all sessions this often (a one-shot or an older chi's REPL that
+      # opened an old session without saving it has no file signal until its first save).
       FULL_PROBE_INTERVAL = 10.0
 
       # What a subscriber gets: `session` with {session: summary} for an

data/lib/samagotchi/web/session_show.rb

@@ -40,6 +40,10 @@ module Samagotchi
         return handle_brief_read(id) if req.params["brief"] == "1"
 
         session = @session_class.load(id, state_dir: default_state_dir)
+        # A tab opened at a chi scratch session's id: its terminal's alone.
+        # (The light re-reads come after a full read only.)
+        return scratch_refused(id) if session.scratch
+
         # Read-only preview: selecting a session never spawns a worker.
         # The worker is woken only on POST /turn (handle_turn) via
         # SessionManager.resume_session + write_turn_input. This avoids
@@ -120,8 +124,8 @@ module Samagotchi
       end
 
       # The file's question only while a worker owns the session: one a
-      # dead worker saved can't be answered (its turn is gone), nor a chi
-      # REPL's (it shares nothing with the web).
+      # dead worker saved can't be answered (its turn is gone), nor a
+      # one-shot's or an older chi's REPL's (they share nothing with the web).
       # A question between turns (the step-limit one) is the snapshot's own.
       # Its refs (the asking reply's, QuestionAsked) are checked again.
       def shown_pending_question(session, turn_snapshot, owner)

data/lib/samagotchi/web/session_summary.rb

@@ -108,7 +108,7 @@ module Samagotchi
           # For the tab's notifications (notify.js): an open question, the
           # running turn's open card with actions, and how the last turn
           # ended. A question saved by a worker that died is not open, nor a
-          # chi REPL's (only a worker shares it).
+          # one-turn chi run's (only a worker shares it).
           pending_question: session.waiting_question(live: !!owner&.worker?),
           pending_card: up ? Bridge::PendingCard.read(session_dir) : nil,
           last_turn: session.last_turn&.to_file,