samagotchi 0.159.0 → 0.160.0

data/lib/samagotchi/session_access/local.rb

@@ -353,7 +353,8 @@ module Samagotchi
       def context_candidates(target)
         return [] if target.project?
 
-        ContextCandidates.with_status(target.session_id, project_root: target.project_root, state_dir: @state_dir)
+        ContextCandidates.with_status(target.session_id, project_root: target.project_root, project_id: target.project_id,
+                                                         state_dir: @state_dir)
                          .map { |candidate, status| ContextCandidate.new(candidate: candidate, status: status) }
       end
 
@@ -371,7 +372,9 @@ module Samagotchi
         ContextSources.check_name!(name)
         return :removed if context_location(target).remove(name)
 
-        project = !target.project? && ContextSources.project_location_for(target.project_root, state_dir: @state_dir)
+        project = !target.project? && ContextSources.project_location_for(target.project_root,
+                                                                          project_id: target.project_id,
+                                                                          state_dir: @state_dir)
         project&.source(name) ? :project : :missing
       end
 
@@ -394,7 +397,7 @@ module Samagotchi
       # live in.
       def context_location(target)
         if target.project?
-          ContextSources.project_location_for(target.project_root, state_dir: @state_dir)
+          ContextSources.project_location_for(target.project_root, project_id: target.project_id, state_dir: @state_dir)
         else
           ContextSources.session_location(target.session_id, state_dir: @state_dir)
         end
@@ -534,8 +537,8 @@ module Samagotchi
       end
 
       def attached_to(target, shadowed: false)
-        ContextSources.attached(target.session_id, project_root: target.project_root, state_dir: @state_dir,
-                                                   shadowed: shadowed)
+        ContextSources.attached(target.session_id, project_root: target.project_root, project_id: target.project_id,
+                                                   state_dir: @state_dir, shadowed: shadowed)
       end
 
       # The block's post to the session's live worker, again on a 408 (the

data/lib/samagotchi/session_access/remote.rb

@@ -809,7 +809,8 @@ module Samagotchi
         owner = json["owner"] && OwnerLock::Owner.new(pid: nil, kind: json["owner"].to_s, started_at: nil)
         SessionView.new(id: json["id"], status: json["status"], title: json["title"],
                         display_title: json["display_title"] || json["title"] || json["first_preview"].to_s,
-                        project_root: json["project_root"], working_directory: json["working_directory"],
+                        project_root: json["project_root"], project_id: json["project_id"],
+                        working_directory: json["working_directory"],
                         model_name: json["model_name"], model_typed: json["model_typed"],
                         parent_answers: json["parent_answers"], owner: owner,
                         pending_question: PendingQuestion.from_file(pending))

data/lib/samagotchi/session_access.rb

@@ -166,7 +166,10 @@ module Samagotchi
     # @!attribute owner [OwnerLock::Owner, nil] its worker or one-turn chi run
     # @!attribute pending_question [PendingQuestion, nil] the file's
     SessionView = Data.define(:id, :status, :title, :display_title, :project_root, :working_directory, :model_name,
-                              :model_typed, :parent_answers, :owner, :pending_question)
+                              :model_typed, :parent_answers, :owner, :pending_question, :project_id) do
+      def initialize(id:, status:, title:, display_title:, project_root:, working_directory:, model_name:,
+                     model_typed:, parent_answers:, owner:, pending_question:, project_id: nil) = super
+    end
 
     # What chi send --new created (Remote; Local gives the Session): its
     # id, a model warning, the session it continues, the delegates it took

data/lib/samagotchi/session_commands.rb

@@ -473,7 +473,8 @@ module Samagotchi
 
       peers = Tools::Peers.new(session_id: session.id, cwd: session.working_directory, state_dir: @engine.peer_state_dir)
       listing = Tools::ContextRead.call("", peers: peers)
-      candidates = ContextCandidates.listing(session.id, project_root: session.project_root, state_dir: @engine.peer_state_dir)
+      candidates = ContextCandidates.listing(session.id, project_root: session.project_root, project_id: session.project_id,
+                                                         state_dir: @engine.peer_state_dir)
       candidates ? "#{listing}\n\n#{candidates}" : listing
     end
 
@@ -618,9 +619,12 @@ module Samagotchi
 
     def approval_line(entry)
       what = entry["key"] ? entry["key"].tr("\n", " ") : "any call rule #{entry["rule"]} asks about"
-      where = if entry["scope"] == "session" then "session #{entry["session_id"].to_s[0, 8]}"
+      where = if entry["scope"] == "session"
+                place = entry["repo_root"] ? " in #{entry["repo_root"]}" : ""
+                "session #{entry["session_id"].to_s[0, 8]}#{place}#{" with its env:" if entry["env"]}"
               elsif entry["repo"] then "in repo #{entry["repo"]}"
-              else "in #{entry["repo_root"]}"
+              else
+                "in #{entry["repo_root"]}"
               end
       rule = entry["rule"] ? " (rule #{entry["rule"]}, #{entry["source"]})" : ""
       "#{entry["scope"]}: #{what} — #{where}#{rule}, #{entry["created_at"]}"

data/lib/samagotchi/session_continue.rb

@@ -91,6 +91,9 @@ module Samagotchi
     # @param prompt [String, nil] its first message (nil: it starts idle)
     # @param preview [String, nil] what the lists show before the first turn;
     #   by default the prompt, else the previous link's preview
+    # @param client_id [String, nil] who sends +prompt+ when no person does
+    #   (a schedule's chain firing: ClientId.schedule), the first turn's
+    #   origin (spawn_session's client_id:)
     # @return [Session] the new link (#model_warning as spawn_session's,
     #   #moved_children: the delegates it took over, #moved_context: the
     #   attached context it took (ContextMove), #opener:
@@ -99,7 +102,8 @@ module Samagotchi
     # @raise [Refused] continued already, delegates open that can't
     #   move, or its folder is gone
     # @raise [ArchiveRefused, OwnedByTUI] as archive_session
-    def self.run(id_or_ref, prompt: nil, preview: nil, model: nil, state_dir: nil, recap_wait: RECAP_WAIT, archive_wait: 5)
+    def self.run(id_or_ref, prompt: nil, preview: nil, model: nil, state_dir: nil, recap_wait: RECAP_WAIT, archive_wait: 5,
+                 client_id: nil)
       sd = state_dir || Session.default_state_dir
       TRIES.times do |try|
         id = SessionChain.resolve(id_or_ref, state_dir: sd)
@@ -108,7 +112,7 @@ module Samagotchi
           next :moved if follow && SessionChain.next_of(id, state_dir: sd)
 
           run_locked(id, prompt: prompt, preview: preview, model: model, state_dir: sd, recap_wait: recap_wait,
-                         archive_wait: archive_wait)
+                         archive_wait: archive_wait, client_id: client_id)
         end
         return result unless result == :moved
       end
@@ -123,7 +127,7 @@ module Samagotchi
       end
     end
 
-    private_class_method def self.run_locked(id, prompt:, preview:, model:, state_dir:, recap_wait:, archive_wait:)
+    private_class_method def self.run_locked(id, prompt:, preview:, model:, state_dir:, recap_wait:, archive_wait:, client_id:)
       previous = Session.load(id, state_dir: state_dir)
       checked = check!(previous, state_dir, model: model)
       plan = checked.plan
@@ -140,7 +144,7 @@ module Samagotchi
       archived = archive.archived - already
       begin
         spawn_continuation(previous, prompt: prompt, preview: preview, choice: checked.choice, state_dir: state_dir,
-                                     move: plan.move)
+                                     move: plan.move, client_id: client_id)
       rescue StandardError
         # Nothing started: the delegates go back, what this archived goes
         # back to the lists, and a new link saved before its worker failed
@@ -201,7 +205,7 @@ module Samagotchi
 
     # The new link, holding off any worker but its own (StartingMarker.fresh?)
     # while +move+ goes to it.
-    private_class_method def self.spawn_continuation(previous, prompt:, preview:, choice:, state_dir:, move:)
+    private_class_method def self.spawn_continuation(previous, prompt:, preview:, choice:, state_dir:, move:, client_id: nil)
       recap = RecapStore.read(Session.session_dir(previous.id, state_dir: state_dir))
       start = prompt.to_s.strip.empty? ? nil : prompt
       preview = previous.first_preview if preview.to_s.strip.empty? && start.nil?
@@ -218,7 +222,7 @@ module Samagotchi
         prompt: start, preview: preview, title: previous.title, working_directory: previous.working_directory,
         model_name: choice.model, setup: SessionSetup.of(previous), review: previous.review,
         continues: previous.id, note: SessionChain.note_text(previous, recap: recap, state_dir: state_dir),
-        note_source: SessionChain::NOTE_SOURCE, state_dir: state_dir, before_spawn: before_spawn
+        note_source: SessionChain::NOTE_SOURCE, state_dir: state_dir, before_spawn: before_spawn, client_id: client_id
       )
       link.moved_children = move
       link.moved_context = moved_context

data/lib/samagotchi/session_manager/spawn.rb

@@ -54,12 +54,16 @@ module Samagotchi
       # @param scratch [Boolean] a `chi scratch` session (its terminal's
       #   AttachLauncher): its worker runs a scratch Engine and deletes it
       #   once its last client is gone
+      # @param client_id [String, nil] who sent +prompt+ when no person did
+      #   (a ClientId: a delegating parent, a schedule's chain link): its
+      #   first turn's origin (Session#first_turn_client_id)
       # @return [Session] with #seed_images_dropped: refs whose file was gone,
       #   and #model_warning: an id its host's saved list doesn't have
       def spawn_session(prompt:, mode: "assist", working_directory: nil, model_name: nil, state_dir: nil,
                         memories: [], muted_memories: [], parent_id: nil, messages: [], images_from: nil,
                         preview: nil, title: nil, delegate: false, setup: SessionSetup.new, continues: nil, note: nil,
-                        note_source: "chi", before_spawn: nil, review: nil, verify_fresh: nil, scratch: false)
+                        note_source: "chi", before_spawn: nil, review: nil, verify_fresh: nil, scratch: false,
+                        client_id: nil)
         sd = state_dir || Session.default_state_dir
         # The resolved ref is stored (a resumed session keeps its model when an
         # alias is retargeted), with the name as typed beside it. A wrong host
@@ -98,7 +102,10 @@ module Samagotchi
         # for it can name it (chi send --new --wait, chi web's create): the
         # worker runs it with that origin, and its reply file and last_turn
         # carry the id.
-        session.first_turn_id = SecureRandom.uuid unless prompt.to_s.strip.empty?
+        unless prompt.to_s.strip.empty?
+          session.first_turn_id = SecureRandom.uuid
+          session.first_turn_client_id = client_id
+        end
         # The worker takes last_prompt and clears it, and messages are saved at
         # the turn's end: until then this is the only preview a list has.
         session.first_preview = Session.preview_of(preview.to_s.strip.empty? ? prompt : preview)

data/lib/samagotchi/session_manager/worker_command.rb

@@ -3,10 +3,10 @@
 module Samagotchi
   class SessionManager
     # CROSS-VERSION CONTRACT: this boot string, the entry it names
-    # (WorkerBoot.run_session_loop(id, state_dir:)), the legacy forwarder
-    # below, the env keys spawn_options sets and the input/ file
-    # format are read by a NEWER chi than the one writing them. Change them
-    # only additively (spec/worker_contract_spec.rb).
+    # (WorkerBoot.run_session_loop(id, state_dir:)), the env keys
+    # spawn_options sets and the input/ file format are read by a NEWER chi
+    # than the one writing them. Change them only additively
+    # (spec/worker_contract_spec.rb).
     BOOT_FALLBACK_ENV = "SAMAGOTCHI_BOOT_FALLBACK"
     # "1" in a worker spawn_options started: it traps signals (WorkerSignals).
     # WorkerBoot.run_session_loop deletes it from ENV as it reads it.
@@ -28,9 +28,9 @@ module Samagotchi
 
     # WorkerCommand: the worker's command line and env (CROSS-VERSION
     # CONTRACT: spec/worker_contract_spec.rb); the worker process itself is
-    # WorkerBoot (worker_boot.rb). The boot command loads it directly; the
-    # forwarder (run_session_loop) remains for older boot strings. Calls no
-    # other part. Meant to be loaded through samagotchi/session_manager.
+    # WorkerBoot (worker_boot.rb), which the boot command loads directly.
+    # Calls no other part. Meant to be loaded through
+    # samagotchi/session_manager.
     module WorkerCommandPart
       # Build the opts hash passed to Process.spawn for a forked worker. The
       # child inherits this process's ENV and reads config.yml itself (as it
@@ -94,18 +94,6 @@ module Samagotchi
         opts
       end
 
-      # The worker's legacy entry for boot strings written by older chi
-      # (CROSS-VERSION CONTRACT: spec/worker_contract_spec.rb): it forwards to
-      # WorkerBoot.run_session_loop, which runs the worker process. Looked up
-      # by name on purpose: a constant reference here would put SessionManager
-      # back into one cycle with Worker, Engine and Bridge (the class map).
-      # REMOVE in the next release: boot strings name WorkerBoot since this
-      # one (see ~/.claude/plans/arch-worker-boot.md).
-      def run_session_loop(session_id, state_dir: nil, **)
-        require_relative "../worker_boot"
-        Samagotchi.const_get(:WorkerBoot).run_session_loop(session_id, state_dir: state_dir, **)
-      end
-
       # The worker's command line. Run from an installed gem, the worker
       # activates the newest installed samagotchi (`>= 0.a`, prereleases
       # count), whoever spawns it: an old chi web, chi send or --attach then

data/lib/samagotchi/state_format.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  # A versioned JSON state-file schema. Missing members must be required or
+  # declare the format version and default that introduced them.
+  class StateFormat
+    REQUIRED = Object.new.freeze
+
+    Member = Data.define(:name, :introduced_in, :default, :persisted) do
+      def required? = introduced_in.nil?
+      def defaulted? = !required?
+      def persisted? = persisted
+    end
+
+    Record = Data.define(:attributes, :extra, :raw, :missing) do
+      def readable? = missing.empty?
+
+      def to_h
+        return raw unless readable?
+
+        extra.transform_keys(&:to_s).merge(attributes.transform_keys(&:to_s))
+      end
+    end
+
+    Document = Data.define(:version, :extra, :entries)
+
+    class InvalidDocument < StandardError; end
+
+    def self.required(name)
+      Member.new(name: name.to_sym, introduced_in: nil, default: REQUIRED, persisted: true)
+    end
+
+    def self.added(name, in_version:, default:)
+      Member.new(name: name.to_sym, introduced_in: in_version, default: default, persisted: true)
+    end
+
+    def self.extra(name, in_version:)
+      Member.new(name: name.to_sym, introduced_in: in_version, default: ->(_attributes) { {} }, persisted: false)
+    end
+
+    attr_reader :members
+
+    def initialize(version:, members:)
+      @version = version
+      @members = members.freeze
+      @extra_member = members.find { |member| !member.persisted? }
+      raise ArgumentError, "a state format can declare only one extra member" if members.count { |member| !member.persisted? } > 1
+      raise ArgumentError, "duplicate state format members" unless members.map(&:name).uniq == members.map(&:name)
+
+      members.each do |member|
+        required = member.required? && member.default.equal?(REQUIRED)
+        defaulted = member.defaulted? && member.introduced_in.is_a?(Integer) &&
+                    member.introduced_in.positive? && member.introduced_in <= version &&
+                    !member.default.equal?(REQUIRED)
+        next if required || defaulted
+
+        raise ArgumentError, "#{member.name} must be required or have an introduction version and default"
+      end
+    end
+
+    def read(data, collection:)
+      raise InvalidDocument, "the state file must contain a JSON object" unless data.is_a?(Hash)
+
+      collection = collection.to_s
+      entries = Array(data[collection]).map { |raw| read_record(raw) }
+      known = %w[version updated_at] + [collection]
+      stored_version = data["version"]
+      stored_version = 0 unless stored_version.is_a?(Integer) && stored_version >= 0
+
+      Document.new(version: [@version, stored_version].max,
+                   extra: data.reject { |key, _value| known.include?(key.to_s) },
+                   entries: entries)
+    end
+
+    def write(document, collection:, updated_at:)
+      document.extra.transform_keys(&:to_s).merge(
+        "version" => [document.version, @version].max,
+        "updated_at" => updated_at,
+        collection.to_s => document.entries.map(&:to_h)
+      )
+    end
+
+    private
+
+    def read_record(raw)
+      unless raw.is_a?(Hash)
+        missing = members.select(&:required?).map(&:name)
+        return Record.new(attributes: {}, extra: {}, raw: raw, missing: missing)
+      end
+
+      attributes = {}
+      missing = []
+      members.each do |member|
+        next unless member.persisted?
+
+        key = member.name.to_s
+        if raw.key?(key)
+          attributes[member.name] = raw[key]
+        elsif member.required?
+          missing << member.name
+        else
+          attributes[member.name] = default_value(member.default, attributes)
+        end
+      end
+
+      known = members.select(&:persisted?).map { |member| member.name.to_s }
+      extra = raw.reject { |key, _value| known.include?(key.to_s) }
+      extra = default_value(@extra_member.default, attributes).merge(extra) if @extra_member
+      Record.new(attributes: attributes, extra: extra, raw: raw, missing: missing)
+    end
+
+    def default_value(default, attributes)
+      value = default.respond_to?(:call) ? default.call(attributes) : default
+      value = value.dup if value.is_a?(Hash) || value.is_a?(Array)
+      value
+    end
+  end
+end

data/lib/samagotchi/tools/context_read.rb

@@ -51,8 +51,13 @@ module Samagotchi
         @own = ContextSources.session_location(peers.session_id, state_dir: @state_dir)
         # The Engine's PeerView knows the session's project; a plain Peers
         # (specs, a bare kernel) has only its folder.
-        root = peers.respond_to?(:project_root) ? peers.project_root : ProjectScope.root_for(peers.cwd)
-        @attached = ContextSources.attached(peers.session_id, project_root: root, state_dir: @state_dir)
+        root, id = if peers.respond_to?(:project_root)
+                     [peers.project_root, peers.project_id]
+                   else
+                     found = ProjectScope.project_for(peers.cwd)
+                     [found&.root, found&.id]
+                   end
+        @attached = ContextSources.attached(peers.session_id, project_root: root, project_id: id, state_dir: @state_dir)
         @max_chars = [max_chars.to_i, MIN_CHARS].max
         @now = now
         # The peer bundles' declared sources (PeerSources), through the

data/lib/samagotchi/tools/delegate.rb

@@ -13,6 +13,10 @@ require_relative "../child_reports"
 require_relative "../worker_link"
 
 module Samagotchi
+  # Loaded on the first task (a leaf; the bundle test kit's load budget,
+  # spec/samagotchi/testing/sandbox_spec.rb).
+  autoload :CommandIntake, File.expand_path("../command_intake", __dir__)
+
   # Loaded on first use: this autoload keeps SessionManager and its ~80
   # files unloaded until the delegate/session path needs them.
   autoload :SessionManager, File.expand_path("../session_manager", __dir__)
@@ -53,6 +57,9 @@ module Samagotchi
 
         task = content.to_s.strip
         return "Error: give the task, the child's first message" if task.empty?
+        # The child's intake takes no shell line from its parent: say so
+        # now, so the model rewrites the task (a /word one is the child's text).
+        return "Error: #{CommandIntake::REFUSED}" if CommandIntake.shell_line?(task)
 
         sd = peers.state_dir || Session.default_state_dir
         parent = Session.load(peers.session_id, state_dir: sd)
@@ -172,7 +179,8 @@ module Samagotchi
                                  parent_answers: parent.parent_answers)
         child = SessionManager.spawn_session(prompt: task, working_directory: folder,
                                              model_name: child_model(model, parent), memories: CHILD_MEMORIES,
-                                             parent_id: parent.id, delegate: true, setup: setup, state_dir: state_dir)
+                                             parent_id: parent.id, delegate: true, setup: setup, state_dir: state_dir,
+                                             client_id: ClientId.delegate(parent.id))
         DelegateWait.mark_started(parent.id, child, state_dir: state_dir)
         # The line for a task that names a worktree while the child runs in
         # the parent's folder (no cwd: given): the child still starts.
@@ -358,7 +366,7 @@ module Samagotchi
 
         # Only a reply after this delivery counts as the follow-up's.
         DelegateWait.mark_seen(parent.id, child, state_dir: state_dir)
-        delivered = SessionManager.deliver_turn(id, prompt: task, client_id: "#{ClientId::DELEGATE_PREFIX}#{parent.id[0, 8]}",
+        delivered = SessionManager.deliver_turn(id, prompt: task, client_id: ClientId.delegate(parent.id),
                                                     state_dir: state_dir)
         case delivered.status
         when :accepted

data/lib/samagotchi/turn_stages/context_judge.rb

@@ -89,7 +89,8 @@ module Samagotchi
       def pass(session, texts, phase:, state_dir:, recorder:)
         return if session.id.nil? || session.scratch
 
-        rows = ContextCandidates.with_status(session.id, project_root: session.project_root, state_dir: state_dir)
+        rows = ContextCandidates.with_status(session.id, project_root: session.project_root,
+                                                         project_id: session.project_id, state_dir: state_dir)
         return if rows.empty?
 
         log = ContextCandidatesLog.log_for(state_dir)
@@ -134,6 +135,7 @@ module Samagotchi
       def choice(session, log, settings, state_dir)
         session_id = session.id
         project_root = session.project_root
+        project_id = session.project_id
         show = lambda do |**card|
           current = @current_session.call
           next nil unless current.nil? || current.id == session_id
@@ -146,6 +148,7 @@ module Samagotchi
         end
         lambda do |job, fields|
           ContextCandidateChoice.after_judged(job: job, fields: fields, settings: settings, project_root: project_root,
+                                              project_id: project_id,
                                               state_dir: state_dir, log: log, show_card: show)
         end
       end
@@ -156,12 +159,9 @@ module Samagotchi
       def parent_attached(session, state_dir)
         return nil unless session.delegate? && session.parent_id
 
-        parent_root = if Session.exist?(session.parent_id, state_dir: state_dir)
-                        Session.load(session.parent_id, state_dir: state_dir).project_root
-                      else
-                        session.project_root
-                      end
-        ContextSources.attached(session.parent_id, project_root: parent_root, state_dir: state_dir)
+        parent = Session.exist?(session.parent_id, state_dir: state_dir) ? Session.load(session.parent_id, state_dir: state_dir) : session
+        ContextSources.attached(session.parent_id, project_root: parent.project_root, project_id: parent.project_id,
+                                                   state_dir: state_dir)
                       .map { |attached| attached.source.title || attached.name }
       rescue StandardError => e
         Log.warn(:context, "context_parent_attached_failed", error: e.class.name, msg: e.message.to_s[0, 200])

data/lib/samagotchi/update_command.rb

@@ -356,7 +356,7 @@ module Samagotchi
       notes = file_notes(row, update.name, update.to || update.from, update.merged, update.behind, update.trash_copy, earlier: earlier)
       case update.status
       when :would_update, :updated
-        notes = [adds(update.adds), *notes, replaced(update.replaced), *update.kept_own, update.note].compact
+        notes = [adds(update.added_files), adds(update.adds), *notes, replaced(update.replaced), *update.kept_own, update.note].compact
         done(row, :update, notes.empty? ? nil : notes.join("; "))
       when :would_merge, :merged, :up_to_date then same_version(row, [*notes, update.note, update.manifest].compact, changed: Array(update.merged).any?)
       when :skipped then skipped(row, [update.note, *notes].join("; "))
@@ -522,7 +522,7 @@ module Samagotchi
       row
     end
 
-    # A profile's new members: "+ btw".
+    # New memory files or profile members: "+ file".
     def adds(members)
       members.nil? || members.empty? ? nil : "+ #{members.join(", ")}"
     end

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.159.0"
+  VERSION = "0.160.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -1030,7 +1030,7 @@ module Samagotchi
 
         # One normal form for the decision, the mkdir and the realpath (a `..` after a symlink would differ).
         dir = File.expand_path(dir)
-        outcome = ProjectInit.call(dir, home: home)
+        outcome = ProjectInit.call(dir, home: home, state_dir: default_state_dir)
         return error_response(422, outcome.reason.to_s, outcome.message) if outcome.kind == :refused
 
         if outcome.kind == :git
@@ -1455,7 +1455,8 @@ module Samagotchi
         body = { session_id: id, sources: rows, can_add_url: ContextProviders.any? }
         # The candidates too, for chi context ls (no UI shows them yet).
         if full
-          body[:candidates] = ContextCandidates.with_status(id, project_root: session.project_root, state_dir: default_state_dir)
+          body[:candidates] = ContextCandidates.with_status(id, project_root: session.project_root, project_id: session.project_id,
+                                                            state_dir: default_state_dir)
                                                .map { |candidate, status| candidate.to_h.merge("name" => candidate.name, "status" => status) }
         end
         json_response(200, body)
@@ -1573,8 +1574,8 @@ module Samagotchi
       end
 
       def attached_context(session, shadowed: false)
-        ContextSources.attached(session.id, project_root: session.project_root, state_dir: default_state_dir,
-                                            shadowed: shadowed)
+        ContextSources.attached(session.id, project_root: session.project_root, project_id: session.project_id,
+                                            state_dir: default_state_dir, shadowed: shadowed)
       end
 
       # @return [ContextSources::Attached, nil]

data/lib/samagotchi/web/session_access_routes.rb

@@ -101,7 +101,7 @@ module Samagotchi
           brief: true,
           session: { id: session.id, status: session.status, title: session.title,
                      display_title: session.display_title, project_root: session.project_root,
-                     working_directory: session.working_directory, model_name: session.model_name,
+                     project_id: session.project_id, working_directory: session.working_directory, model_name: session.model_name,
                      model_typed: session.model_typed, parent_answers: session.parent_answers,
                      owner: owner&.kind },
           pending_question: session.pending_question&.to_file
@@ -492,8 +492,8 @@ module Samagotchi
       # @raise [ArgumentError] no such session
       def context_target(id)
         session = session_access.show(id)
-        ContextCommand::Target.new(session_id: id, project_root: session.project_root, cwd: session.working_directory,
-                                   label: id[0, 8])
+        ContextCommand::Target.new(session_id: id, project_root: session.project_root, project_id: session.project_id,
+                                   cwd: session.working_directory, label: id[0, 8])
       end
     end
   end

data/lib/samagotchi/worker.rb

@@ -4,6 +4,7 @@ require "fileutils"
 require "securerandom"
 
 require_relative "client_id"
+require_relative "command_intake"
 require_relative "config"
 require_relative "engine"
 require_relative "guardrails/parent_policy"
@@ -338,7 +339,7 @@ module Samagotchi
                                         predecessor: @session.continues)
       # Its attached context's notes (ContextSources).
       @context_absorber = ContextAbsorber.new(session_id: @session_id, state_dir: @state_dir,
-                                              project_root: @session.project_root,
+                                              project_root: @session.project_root, project_id: @session.project_id,
                                               peer_sources: @engine.peer_sources, peer_turns: -> { @wakes.peer_turns })
       # What comes in between turns, and how each kind is saved.
       @inbound = WorkerInbound.new(session: @session, state_dir: @state_dir, session_dir: @session_dir, engine: @engine,
@@ -468,8 +469,8 @@ module Samagotchi
       # Attached context's commands, in the background; a new text wakes
       # the loop to absorb it. Not activity: the idle exit stops it.
       @context_poller = ContextPoller.new(session_id: @session_id, state_dir: @state_dir,
-                                          project_root: @session.project_root, cwd: @session.working_directory,
-                                          on_change: -> { @waker.wake }).start
+                                          project_root: @session.project_root, project_id: @session.project_id,
+                                          cwd: @session.working_directory, on_change: -> { @waker.wake }).start
       @scratch_watch = start_scratch_watch if @session.scratch
     end
 
@@ -759,14 +760,15 @@ module Samagotchi
     end
 
     # The first prompt (spawn_session's): a delegate child's task, which is
-    # its parent's although no client sent it. Its turn carries the id
-    # spawn_session gave it, so a wait for it (--new --wait) names it.
+    # its parent's. Its turn carries the id spawn_session gave it, so a
+    # wait for it (--new --wait) names it, and its sender
+    # (WorkerInbound#initial_origin).
     # A Verify fresh child's is a Verify turn on its claim (its verdict is
     # recorded and forwarded to the parent).
     def run_initial_prompt(prompt)
       @initial_turn = true
       fresh = @session.verify_fresh
-      run_prompt(WorkerInbound::Prompt.new(text: prompt, origin: TurnOrigin.new(enqueued_id: @session.first_turn_id),
+      run_prompt(WorkerInbound::Prompt.new(text: prompt, origin: @inbound.initial_origin,
                                            anchors: { verify: fresh&.anchor }))
     ensure
       @initial_turn = false
@@ -1215,6 +1217,8 @@ module Samagotchi
     #   the cards and notices it showed, held: they follow its command_ran,
     #   as its output
     def run_command_line(command)
+      return [shell_refused(command), []] if CommandIntake.refused?(command.line, command.client_id)
+
       @engine.holding_announcements do
         command_result(command) do
           @commands.run(command.line, confirm: confirm?(command), as_parent: as_parent?(command), user_ui: user_ui?(command))
@@ -1222,6 +1226,14 @@ module Samagotchi
       end
     end
 
+    # A shell line from a sender that may not run one (CommandIntake: a
+    # delegate's task, a schedule's prompt, a plugin's message): not run,
+    # its command_ran an error with the one refusal text.
+    def shell_refused(command)
+      Log.warn(:worker, "shell_line_refused", client_id: command.client_id)
+      SessionCommands::Result.new(status: :error, output: CommandIntake::REFUSED, changed: [])
+    end
+
     # Whether +command+ asks before a costly /thinking or /reasoning-history
     # change (CacheConfirm): only a person at a web tab or a TUI sees the
     # question; chi send, a delegate, a plugin and a card's action apply it.