samagotchi 0.159.0 → 0.160.0

data/lib/samagotchi/project_init.rb

@@ -1,20 +1,43 @@
 # frozen_string_literal: true
 
 require "fileutils"
+require_relative "atomic_file"
+require_relative "context_sources"
 require_relative "guardrails/path_resolve"
+require_relative "memory_orphans"
 require_relative "memory_paths"
 require_relative "paths"
+require_relative "project_id"
+require_relative "session_paths"
 
 module Samagotchi
-  # The shared decisions for `chi project init` and chi web's project picker.
+  # The shared decisions for `chi project init` and chi web's project picker,
+  # and every text they refuse or report with (the CLI prints them). A new
+  # marker gets an id (ProjectId); #adopt gives an older marker one, #new_id
+  # a copied folder its own.
   module ProjectInit
-    Outcome = Data.define(:kind, :reason, :root, :top, :nested_in, :message)
+    # +id+: the project's id (ProjectId), nil for none (a git repository, a
+    # marker without one, a refusal).
+    Outcome = Data.define(:kind, :reason, :root, :top, :nested_in, :message, :id) do
+      def initialize(kind:, reason:, root:, top:, nested_in:, message:, id: nil) = super
+    end
+
+    # A folder keyed by the project key (MemoryPaths.key_for): under +base+,
+    # named +prefix+ + the key.
+    Place = Data.define(:base, :prefix) do
+      def path(key) = File.join(base, "#{prefix}#{key}")
+    end
 
     MARKER_TEXT = "# chi project marker: this folder is a chi project (docs/memory.md)\n"
 
     module_function
 
-    def call(dir, home:)
+    # Marks +dir+ (a new marker gets an id), or says why not. A folder whose
+    # path key already names a folder (memories kept while it was no
+    # project, keyed by the same path) is marked without an id, so nothing
+    # it has goes out of reach: #adopt moves those and writes the id.
+    # @param state_dir [String, nil] the sessions dir (SessionPaths.default_state_dir)
+    def call(dir, home:, env: ENV, state_dir: nil)
       dir = File.expand_path(dir.to_s)
       found = MemoryPaths.lookup(dir, home: home)
       if found.git?
@@ -32,19 +55,94 @@ module Samagotchi
       # The marked project this folder sits in, if any: the folder itself (already marked) or its parent project.
       enclosing = found.marker? ? found.root : nil
       if enclosing == Guardrails::PathResolve.real(dir)
+        id_part = found.id ? " (id #{found.id})" : ""
         return Outcome.new(kind: :already_marked, reason: nil, root: enclosing, top: found.top, nested_in: nil,
-                           message: "#{Paths.tilde(enclosing)} is already a chi project")
+                           message: "#{Paths.tilde(enclosing)} is already a chi project#{id_part}", id: found.id)
       end
 
-      write_marker(dir)
+      id = write_marker(dir, places(env: env, state_dir: state_dir || SessionPaths.default_state_dir(env: env)))
       root = File.realpath(dir)
       # No message: each surface words its own success (the CLI's report, the web's navigation).
-      Outcome.new(kind: :created, reason: nil, root: root, top: root, nested_in: enclosing, message: nil)
+      Outcome.new(kind: :created, reason: nil, root: root, top: root, nested_in: enclosing, message: nil, id: id)
     rescue SystemCallError => e
       marker = File.join(dir, MemoryPaths::MARKER)
       write_failed("couldn't write #{Paths.tilde(marker)}: #{e.message}")
     end
 
+    # `chi project init` (the CLI only: chi web's New-project row calls
+    # #call, which never moves folders): #call, and for a marked folder
+    # with no valid id, its adoption of one. The folders keyed by its path
+    # key (its memories, its project context sources, the skills bundle's
+    # kept versions) move to the id, each leaving a link by its old name so
+    # an older chi, keying by path, finds the same folder; then the id is
+    # written (a crash before that leaves the path key reaching the moved
+    # folders through the links, and a rerun finishes with the same id).
+    # Refused while a running session belongs to the project: its worker
+    # could write a memory under the old name between a move and its link.
+    # @param state_dir [String, nil] the sessions dir (SessionPaths.default_state_dir)
+    # @param sessions [Array<SessionRow>] this machine's sessions (+live+, +project+, +id+)
+    # A folder #call marked without an id is adopted the same way.
+    # @param sessions [Array<SessionRow>] this machine's sessions (+live+,
+    #   +project+, +cwd+, +id+): a running one in the project (by the root it
+    #   stored, else its folder's) refuses
+    # @return [Outcome] :adopted (its message the report), :created (its
+    #   message what moved, nil when nothing did) or #call's
+    def adopt(dir, home:, env: ENV, state_dir: nil, sessions: [])
+      state_dir ||= SessionPaths.default_state_dir(env: env)
+      outcome = call(dir, home: home, env: env, state_dir: state_dir)
+      return outcome unless %i[already_marked created].include?(outcome.kind) && outcome.id.nil?
+
+      root = outcome.root
+      running = Array(sessions).select do |row|
+        row.live && (row.project ? row.project == root : MemoryPaths.lookup(row.cwd.to_s, home: home).root == root)
+      end
+      unless running.empty?
+        return refused(:running, root, "#{Paths.tilde(root)} has running sessions " \
+                                       "(#{running.map { |row| row.id[0, 8] }.join(", ")}): stop them " \
+                                       "(chi sessions stop ID) and rerun chi project init, which moves the " \
+                                       "project's folders while no session can write to them")
+      end
+
+      adopted = adopt_id(root, env: env, state_dir: state_dir)
+      return adopted unless outcome.kind == :created && adopted.kind == :adopted
+
+      # A new project: the CLI words its success; the report keeps what moved.
+      moved = adopted.message.lines.drop(1).join.chomp
+      outcome.with(id: adopted.id, message: moved.empty? ? nil : moved)
+    rescue SystemCallError => e
+      write_failed("couldn't adopt an id for #{Paths.tilde(outcome&.root || dir.to_s)}: #{e.message}")
+    end
+
+    # `chi project init --new-id`: a fresh id for a marked folder (a copied
+    # one, going its own way), its folders copied from the key it had to the
+    # new id (the copy keeps what it had; the other folder keeps its own).
+    # @return [Outcome] :new_id (its message the report) or :refused
+    def new_id(dir, home:, env: ENV, state_dir: nil)
+      dir = File.expand_path(dir.to_s)
+      found = MemoryPaths.lookup(dir, home: home)
+      unless found.marker? && found.root == Guardrails::PathResolve.real(dir)
+        return refused(:not_marked, nil, "#{Paths.tilde(dir)} is not a marked chi project folder: --new-id gives " \
+                                         "one (made with chi project init) an id of its own")
+      end
+
+      root = found.root
+      old_key = MemoryPaths.key_for(root: root, id: found.id)
+      id = ProjectId.generate(File.basename(root))
+      lines = ["#{Paths.tilde(root)} has a chi project id of its own now: #{id} (was #{found.id || "none: keyed by its path"})"]
+      places(env: env, state_dir: state_dir || SessionPaths.default_state_dir(env: env)).each do |place|
+        from = place.path(old_key)
+        next unless File.directory?(from)
+
+        to = place.path(id)
+        copy_folder(File.realpath(from), to)
+        lines << "copied #{Paths.tilde(from)} to #{Paths.tilde(to)}"
+      end
+      write_id(root, id)
+      Outcome.new(kind: :new_id, reason: nil, root: root, top: root, nested_in: nil, message: lines.join("\n"), id: id)
+    rescue SystemCallError => e
+      write_failed("couldn't give #{Paths.tilde(dir)} a new id: #{e.message}")
+    end
+
     # chi web opens a folder in a git repository without marking it, so the folder has to exist.
     # @return [Outcome, nil] a refused (:write_failed) outcome when it can't be made, else nil
     def ensure_folder(dir)
@@ -54,16 +152,122 @@ module Samagotchi
       write_failed("couldn't create #{Paths.tilde(dir)}: #{e.message}")
     end
 
+    # The folders a project key names: its memories, its project context
+    # sources (where the workers keep them: ContextSources.root), and the
+    # skills bundle's kept versions of its project skills (history/
+    # project-<key>, the bundle's own data dir).
+    # @return [Array<Place>]
+    def places(env:, state_dir:)
+      [Place.new(base: MemoryPaths.projects_dir(env: env), prefix: ""),
+       Place.new(base: File.join(ContextSources.root(state_dir: state_dir), "projects"), prefix: ""),
+       Place.new(base: File.join(File.dirname(state_dir), "plugins", "skills", "history"), prefix: "project-")]
+    end
+
+    def adopt_id(root, env:, state_dir:)
+      problem = ProjectId.read(root).problem
+      path_key = MemoryPaths.key_for_root(root)
+      # Before the id: what MemoryOrphans finds for the project keyed by its path.
+      orphans = MemoryOrphans.find(env: env, cwd: root)
+      list = places(env: env, state_dir: state_dir)
+      id = resumed_id(list.first, path_key) || ProjectId.generate(File.basename(root))
+      taken = list.map { |place| [place.path(path_key), place.path(id)] }
+                  .find { |from, to| real_dir?(from) && (File.exist?(to) || File.symlink?(to)) }
+      if taken
+        return refused(:id_taken, root, "#{Paths.tilde(taken[1])} already exists: chi project init can't move " \
+                                        "#{Paths.tilde(taken[0])} there; nothing moved")
+      end
+
+      lines = ["#{Paths.tilde(root)} now has the chi project id #{id}: its memories and project context stay " \
+               "with it when the folder moves or is renamed"]
+      lines << "#{problem}: replaced" if problem
+      list.each { |place| lines.concat(move_folder(place.path(path_key), place.path(id))) }
+      write_id(root, id)
+      if orphans
+        lines << "memories from an earlier path: #{orphans.candidates.map { |c| Paths.tilde(c) }.join(", ")} (this " \
+                 "folder's name with another path's hash; if they are this project's, move their files into " \
+                 "#{Paths.tilde(list.first.path(id))})"
+      end
+      Outcome.new(kind: :adopted, reason: nil, root: root, top: root, nested_in: nil, message: lines.join("\n"), id: id)
+    end
+
+    # The id an adoption that crashed before writing it chose: the path
+    # key already a link to an id folder beside it.
+    def resumed_id(place, path_key)
+      link = place.path(path_key)
+      return nil unless File.symlink?(link)
+
+      target = File.readlink(link)
+      target if target.match?(ProjectId::PATTERN) && File.directory?(place.path(target))
+    end
+
+    def real_dir?(path) = File.directory?(path) && !File.symlink?(path)
+
+    # Move +from+ to +to+ and leave a link named +from+ (relative: the
+    # folder may move with its parent). Nothing to move (no folder, or a
+    # link already): no move and no link. A folder made again at +from+
+    # between the move and the link has its files moved over (none
+    # replaced), then gives way to the link; what was in both stays.
+    # @return [Array<String>] the report's lines
+    def move_folder(from, to)
+      return [] unless real_dir?(from)
+
+      File.rename(from, to)
+      begin
+        File.symlink(File.basename(to), from)
+      rescue Errno::EEXIST
+        Dir.children(from).each do |name|
+          File.rename(File.join(from, name), File.join(to, name)) unless File.exist?(File.join(to, name))
+        end
+        unless Dir.empty?(from)
+          return ["moved #{Paths.tilde(from)} to #{Paths.tilde(to)}; files written to the old folder meanwhile " \
+                  "that #{Paths.tilde(to)} has too stay in #{Paths.tilde(from)}"]
+        end
+
+        Dir.rmdir(from)
+        File.symlink(File.basename(to), from)
+      end
+      ["moved #{Paths.tilde(from)} to #{Paths.tilde(to)} (the old name links to it, for an older chi)"]
+    end
+
+    # +to+ made a copy of +from+'s files, without the copied project's
+    # claim (.root: ProjectIdClash).
+    def copy_folder(from, to)
+      FileUtils.mkdir_p(to)
+      FileUtils.cp_r(File.join(from, "."), to)
+      FileUtils.rm_f(File.join(to, ".root"))
+    end
+
+    def write_id(root, id)
+      marker = File.join(root, MemoryPaths::MARKER)
+      AtomicFile.write(marker, ProjectId.with_id(File.read(marker), id))
+    end
+
+    def refused(reason, root, message)
+      Outcome.new(kind: :refused, reason: reason, root: root, top: root, nested_in: nil, message: message)
+    end
+
     def write_failed(message)
       Outcome.new(kind: :refused, reason: :write_failed, root: nil, top: nil, nested_in: nil, message: message)
     end
-    private_class_method :write_failed
 
-    def write_marker(dir)
+    # @param places [Array<Place>] the folders a key names (#places)
+    # @return [String, nil] the new marker's id; nil when a folder already
+    #   has the path key (#call)
+    def write_marker(dir, places)
       marker = File.join(dir, MemoryPaths::MARKER)
       FileUtils.mkdir_p(File.dirname(marker))
-      File.write(marker, MARKER_TEXT)
+      root = File.realpath(dir)
+      key = MemoryPaths.key_for_root(root)
+      if places.any? { |place| File.exist?(place.path(key)) || File.symlink?(place.path(key)) }
+        File.write(marker, MARKER_TEXT)
+        return nil
+      end
+
+      id = ProjectId.generate(File.basename(root))
+      File.write(marker, ProjectId.with_id(MARKER_TEXT, id))
+      id
     end
-    private_class_method :write_marker
+    private_class_method :write_failed, :write_marker, :refused, :adopt_id, :resumed_id, :real_dir?, :move_folder,
+                         :copy_folder, :write_id
   end
 end

data/lib/samagotchi/project_scope.rb

@@ -18,10 +18,19 @@ module Samagotchi
       return nil if dir.empty?
       return cache[dir] if cache&.key?(dir)
 
-      found = MemoryPaths.lookup(File.expand_path(dir))
-      root = found.project? ? found.root : nil
+      root = project_for(dir)&.root
       cache[dir] = root if cache
       root
     end
+
+    # +dir+'s project (MemoryPaths::ProjectLookup: its root and, for a
+    # marked project, its id), or nil in none.
+    def project_for(dir)
+      dir = dir.to_s
+      return nil if dir.empty?
+
+      found = MemoryPaths.lookup(File.expand_path(dir))
+      found.project? ? found : nil
+    end
   end
 end

data/lib/samagotchi/schedules.rb

@@ -9,6 +9,7 @@ require "fileutils"
 require_relative "atomic_file"
 require_relative "archive_store"
 require_relative "client_id"
+require_relative "command_intake"
 require_relative "config"
 require_relative "continue_offer"
 require_relative "delivery"
@@ -18,6 +19,7 @@ require_relative "session_chain"
 require_relative "session_inbox"
 require_relative "session_manager"
 require_relative "session_row"
+require_relative "state_format"
 require_relative "worker_link"
 
 module Samagotchi
@@ -79,15 +81,20 @@ module Samagotchi
     # puts the clock back to it.
     Entry = Data.define(:id, :title, :anchor, :head, :mode, :prompt, :recurrence, :busy, :catch_up,
                         :keep_links, :max_failures, :max_skips, :next_due, :due_was, :last_fired, :last_result,
-                        :firing_since, :failures, :skips, :enabled, :created_at) do
+                        :firing_since, :failures, :skips, :enabled, :created_at, :extra) do
       # The recurrence comes back from JSON with string keys: every reader of
       # it below matches on `recurrence[:kind]`, so it is symbolised here once.
-      # A file written by a newer chi may carry keys this one does not know:
-      # they are dropped rather than raising in Data#initialize.
-      def self.from_h(hash)
-        fields = hash.transform_keys(&:to_sym).select { |key| Entry.members.include?(key) }
+      def self.from_record(record)
+        fields = record.attributes
         recurrence = fields[:recurrence]
-        new(**fields, recurrence: recurrence.is_a?(Hash) ? recurrence.transform_keys(&:to_sym) : recurrence)
+        fields[:recurrence] = recurrence.transform_keys(&:to_sym) if recurrence.is_a?(Hash)
+        new(**fields, extra: record.extra)
+      end
+
+      def to_h
+        fields = super
+        extra = fields.delete(:extra) || {}
+        extra.transform_keys(&:to_s).merge(fields.transform_keys(&:to_s))
       end
 
       def due?(now)
@@ -111,6 +118,34 @@ module Samagotchi
       def target_words = "#{mode} · #{head.to_s[0, 8]}"
     end
 
+    FORMAT = StateFormat.new(
+      version: VERSION,
+      members: [
+        StateFormat.required(:id),
+        StateFormat.added(:title, in_version: VERSION, default: nil),
+        StateFormat.required(:anchor),
+        StateFormat.added(:head, in_version: VERSION, default: ->(values) { values[:anchor] }),
+        StateFormat.required(:mode),
+        StateFormat.required(:prompt),
+        StateFormat.required(:recurrence),
+        StateFormat.added(:busy, in_version: VERSION, default: "skip"),
+        StateFormat.added(:catch_up, in_version: VERSION, default: "once"),
+        StateFormat.added(:keep_links, in_version: VERSION, default: 5),
+        StateFormat.added(:max_failures, in_version: VERSION, default: 3),
+        StateFormat.added(:max_skips, in_version: VERSION, default: 12),
+        StateFormat.required(:next_due),
+        StateFormat.added(:due_was, in_version: VERSION, default: nil),
+        StateFormat.added(:last_fired, in_version: VERSION, default: nil),
+        StateFormat.added(:last_result, in_version: VERSION, default: nil),
+        StateFormat.added(:firing_since, in_version: VERSION, default: nil),
+        StateFormat.added(:failures, in_version: VERSION, default: 0),
+        StateFormat.added(:skips, in_version: VERSION, default: 0),
+        StateFormat.added(:enabled, in_version: VERSION, default: true),
+        StateFormat.added(:created_at, in_version: VERSION, default: nil),
+        StateFormat.extra(:extra, in_version: VERSION)
+      ]
+    )
+
     # What one entry did in a tick: "fired", "skipped", "missed", "failed" or
     # "dry" (a --dry-run's "would fire"). +detail+ is the reason.
     Outcome = Data.define(:id, :title, :status, :detail, :entry) do
@@ -144,7 +179,7 @@ module Samagotchi
     # @param include_disabled [Boolean] the disabled and the fired one-offs too
     # @return [Array<Entry>] every entry, the earliest due first
     def entries(include_disabled: false)
-      list = read.sort_by { |entry| [entry.next_due.to_s, entry.id] }
+      list = read.entries.grep(Entry).sort_by { |entry| [entry.next_due.to_s, entry.id] }
       include_disabled ? list : list.select(&:enabled)
     end
 
@@ -155,7 +190,7 @@ module Samagotchi
       given = id_or_name.to_s.strip
       return nil if given.empty?
 
-      list = read
+      list = read.entries.grep(Entry)
       exact = list.find { |entry| entry.id == given }
       return exact if exact
 
@@ -188,6 +223,9 @@ module Samagotchi
 
       prompt = prompt.to_s
       raise Usage, "a schedule needs a prompt" if prompt.strip.empty?
+      # It fires from a schedule, never a person: a shell line would be
+      # refused at every firing (CommandIntake); a /word one is the model's text.
+      raise Usage, CommandIntake::REFUSED if CommandIntake.shell_line?(prompt)
       if prompt.bytesize > PROMPT_MAX_BYTES
         raise Usage, "the prompt is #{prompt.bytesize} bytes; the limit is 16 KiB (#{PROMPT_MAX_BYTES} bytes)"
       end
@@ -224,9 +262,9 @@ module Samagotchi
         max_skips: int_or_default(max_skips, "schedule.default_max_skips", 12, min: 1),
         next_due: next_due_for(recurrence, from: now).utc.iso8601, due_was: nil,
         last_fired: nil, last_result: nil, firing_since: nil,
-        failures: 0, skips: 0, enabled: true, created_at: now.utc.iso8601
+        failures: 0, skips: 0, enabled: true, created_at: now.utc.iso8601, extra: {}
       )
-      write_under_lock { |list| list << entry }
+      write_under_lock { |file| file.entries << entry }
       entry
     end
 
@@ -295,7 +333,8 @@ module Samagotchi
           return Tick.new(locked: true, outcomes: [])
         end
 
-        list = read
+        file = read
+        list = file.entries.grep(Entry)
         # Ordered by the moment each entry is due, then id: with one chain
         # firing per tick, the entries of that chain take turns (a skipped
         # entry keeps its `next_due`, so the earliest waiting one goes next).
@@ -308,14 +347,14 @@ module Samagotchi
         # One session listing for the whole tick: a chain walk re-globbing
         # every session per call is the tick's dominant cost.
         index = Index.new(@state_dir)
-        updated = list.dup
+        updated = file.entries.dup
         # One firing per chain per tick. A second chain entry of the same chain
         # would continue the link the first one just made: that link has no
         # worker lock yet and is not in this tick's index, so the busy check
         # cannot see it, and its prompt would be archived before it ever ran.
         fired_chains = {}
         due.each do |entry|
-          position = updated.index { |candidate| candidate.id == entry.id }
+          position = updated.index { |candidate| candidate.is_a?(Entry) && candidate.id == entry.id }
           verdict = check(entry, index)
           if verdict
             kind, reason = verdict
@@ -347,7 +386,7 @@ module Samagotchi
           pending << advanced
           fired_chains[chain_key(index, entry)] = true if entry.mode == CHAIN
         end
-        write(list: updated) unless dry_run
+        write(file: file.with(entries: updated)) unless dry_run
       end
 
       pending.each { |entry| outcomes << fire_and_record(entry, index) }
@@ -522,21 +561,30 @@ module Samagotchi
     #   than reading as empty: a write starting from an empty list would rewrite
     #   the file and lose every schedule on it. Listing stays lenient.
     def read(strict: false)
-      return [] unless File.exist?(path)
+      return FORMAT.read({}, collection: "schedules") unless File.exist?(path)
 
-      data = JSON.parse(File.read(path))
-      Array(data["schedules"]).map { |hash| Entry.from_h(hash) }
-    rescue JSON::ParserError => e
+      file = FORMAT.read(JSON.parse(File.read(path)), collection: "schedules")
+      file.with(entries: file.entries.map do |record|
+        if record.readable?
+          Entry.from_record(record)
+        else
+          Log.warn(:worker, "schedule_entry_unreadable",
+                   id: record.raw.is_a?(Hash) ? record.raw["id"] : nil,
+                   missing: record.missing.map(&:to_s))
+          record
+        end
+      end)
+    rescue JSON::ParserError, StateFormat::InvalidDocument => e
       Log.warn(:worker, "store_unreadable", error: e.class.name, msg: e.message)
       raise Corrupt, "#{path} is not readable JSON (#{e.message}): fix or remove it before changing schedules" if strict
 
-      []
+      FORMAT.read({}, collection: "schedules")
     end
 
-    def write(list:)
+    def write(file:)
       FileUtils.mkdir_p(@store_dir)
       FileUtils.mkdir_p(@state_dir)
-      body = { "version" => VERSION, "updated_at" => Time.now.utc.iso8601, "schedules" => list.map(&:to_h) }
+      body = FORMAT.write(file, collection: "schedules", updated_at: Time.now.utc.iso8601)
       AtomicFile.write(path, "#{JSON.pretty_generate(body)}\n")
     end
 
@@ -546,9 +594,9 @@ module Samagotchi
       FileUtils.mkdir_p(@state_dir)
       File.open(lock_path, File::RDWR | File::CREAT, 0o600) do |lock|
         lock.flock(File::LOCK_EX)
-        list = read(strict: true)
-        yield(list)
-        write(list: list)
+        file = read(strict: true)
+        yield(file)
+        write(file: file)
       end
     end
 
@@ -558,15 +606,15 @@ module Samagotchi
       entry = lookup(id_or_name)
       return nil if entry.nil?
 
-      write_under_lock do |list|
-        position = list.index { |candidate| candidate.id == entry.id }
+      write_under_lock do |file|
+        position = file.entries.index { |candidate| candidate.is_a?(Entry) && candidate.id == entry.id }
         next if position.nil?
 
         if delete
-          list[position] = nil
-          list.compact!
+          file.entries[position] = nil
+          file.entries.compact!
         else
-          list[position] = entry.with(enabled: enabled, last_result: enabled ? "enabled" : "disabled")
+          file.entries[position] = entry.with(enabled: enabled, last_result: enabled ? "enabled" : "disabled")
         end
       end
       entry
@@ -800,10 +848,17 @@ module Samagotchi
     def fire_chain(entry, index)
       head, _reason = target_of(entry, index)
       return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: "the chain is gone", entry: entry) if head.nil?
+      # One stored before #add refused it: its link would refuse the line,
+      # so it fails here, with no link started and nothing archived.
+      if CommandIntake.shell_line?(entry.prompt)
+        return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: CommandIntake::REFUSED, entry: entry)
+      end
 
       # `last:<head>` so SessionContinue.run's own TRIES/`:moved` loop follows
-      # a continue a human made between here and its lock.
-      link = SessionContinue.run("last:#{head}", prompt: entry.prompt, state_dir: @state_dir)
+      # a continue a human made between here and its lock. The link's first
+      # turn is the schedule's (its origin), as a same-mode firing's is.
+      link = SessionContinue.run("last:#{head}", prompt: entry.prompt, state_dir: @state_dir,
+                                                 client_id: ClientId.schedule(entry.id))
       Outcome.new(id: entry.id, title: entry.title, status: "fired", detail: "new link #{link.id[0, 8]}",
                   entry: entry.with(head: link.id))
     rescue SessionContinue::Refused => e
@@ -820,6 +875,11 @@ module Samagotchi
       # listing and this moment archives the target it just resolved to.
       dir = Session.session_dir(target, state_dir: @state_dir)
       return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: "archived", entry: entry) if ArchiveStore.archived?(dir)
+      # One stored before #add refused it: the Bridge would refuse it, but a
+      # delivery that falls back to the input file is accepted.
+      if CommandIntake.shell_line?(entry.prompt)
+        return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: CommandIntake::REFUSED, entry: entry)
+      end
 
       result = SessionManager.deliver_turn(target, prompt: entry.prompt,
                                           client_id: ClientId.schedule(entry.id),
@@ -843,23 +903,23 @@ module Samagotchi
     # moves for a skip or a failure. `due_was` is untouched — run-now is not a
     # scheduled occurrence, so there is no occurrence to put the clock back to.
     def record_refusal(entry, status, reason)
-      write_under_lock do |list|
-        position = list.index { |candidate| candidate.id == entry.id }
+      write_under_lock do |file|
+        position = file.entries.index { |candidate| candidate.is_a?(Entry) && candidate.id == entry.id }
         next if position.nil?
 
-        stored = list[position]
-        list[position] = status == "skipped" ? skipped(stored, reason) : failed(stored, reason)
+        stored = file.entries[position]
+        file.entries[position] = status == "skipped" ? skipped(stored, reason) : failed(stored, reason)
       end
     end
 
     # The result goes back under the lock before any pruning, so a prune that
     # raises midway cannot lose the new head.
     def record(entry, outcome)
-      write_under_lock do |list|
-        position = list.index { |candidate| candidate.id == entry.id }
+      write_under_lock do |file|
+        position = file.entries.index { |candidate| candidate.is_a?(Entry) && candidate.id == entry.id }
         next if position.nil?
 
-        stored = list[position]
+        stored = file.entries[position]
         updated = if outcome.status == "fired"
                     # Any success clears the skip and failure counters: twelve
                     # skips spread over months do not kill a healthy schedule.
@@ -877,7 +937,7 @@ module Samagotchi
         # tried comes back, so the next tick tries it again. max_skips and
         # max_failures bound how often that happens.
         updated = updated.with(next_due: stored.due_was) if outcome.status != "fired" && !stored.due_was.nil?
-        list[position] = updated
+        file.entries[position] = updated
       end
     end
 

data/lib/samagotchi/session.rb

@@ -166,6 +166,11 @@ module Samagotchi
       # deleted folder no longer leads to its repository. nil outside a repo,
       # and in files written before the field existed (see #project_root).
       SessionField.plain("project_root", nil),
+      # The project's id (ProjectId: a marked project's `id:`), saved beside
+      # project_root at creation, else nil: its memories and project context
+      # sources are keyed by it (MemoryPaths.key_for), so a session resumed
+      # after its folder moved finds them under the id, not its dead path.
+      SessionField.plain("project_id", nil, optional: true),
       # Memories the session was started with (--memory) and memories hidden
       # from it (--mute): the worker rebuilds the same prompt on a respawn.
       # Names as given; the engine normalizes them.
@@ -271,6 +276,14 @@ module Samagotchi
       # chi web's create) can name it (`--wait --turn T ID`). nil for a
       # session created idle, and for one saved before the field existed.
       SessionField.plain("first_turn_id", nil, optional: true),
+      # Who sent that prompt when no person did (a ClientId: a delegating
+      # parent's delegate:<parent8>, a schedule's chain link
+      # system:schedule:<id>): the first turn's origin, so the command
+      # intake treats it as theirs (CommandIntake) and last_turn names
+      # them. nil for a person's prompt (chi send --new, the web, a TUI, a
+      # continue) and an idle session. Set once, by spawn_session; a
+      # continue and a fork don't carry it.
+      SessionField.plain("first_turn_client_id", nil, optional: true),
       # A Verify fresh child's requester, rules and claim (VerifyFreshOrigin),
       # nil for any other session. Set once, at spawn (VerifyFresh.start).
       # Autoloaded on the first one (the bundle test kit's load budget).
@@ -290,7 +303,7 @@ module Samagotchi
     attr_accessor :id, :metadata_version, :mode, :model_name, :model_typed, :working_directory, :messages,
                   :created_at, :updated_at, :status, :last_prompt, :first_preview, :title, :test_run,
                   :used_memory_names, :preloaded_memory_names, :muted_memory_names, :parent_id, :scratch,
-                  :continues, :first_turn_id
+                  :continues, :first_turn_id, :first_turn_client_id, :project_id
     attr_writer :project_root, :delegate
     attr_reader :appended_prompt_files, :written_by
 
@@ -572,6 +585,7 @@ module Samagotchi
                          review: nil, now: Time.now)
       own = setup.to_h
       own = own.merge(toolkit_origin: own[:toolkit_origin] || "chosen")
+      project = ProjectScope.project_for(working_directory)
       Toolkit.check_new!(own[:toolkit] || Toolkit.configured(delegate: delegate))
       now = now.iso8601(3)
       resolved_test = if test_run.nil?
@@ -591,7 +605,8 @@ module Samagotchi
         status: STATUS_IDLE,
         first_preview: "",
         test_run: resolved_test,
-        project_root: ProjectScope.root_for(working_directory),
+        project_root: project&.root,
+        project_id: project&.id,
         preloaded_memory_names: preloaded_memory_names,
         muted_memory_names: muted_memory_names,
         parent_id: parent_id,