samagotchi 0.84.0 → 0.86.0

data/lib/samagotchi/terminal_ui.rb

@@ -67,6 +67,8 @@ module Samagotchi
     COMMAND_QUEUED = "(queued: runs after this turn)"
     # /detach is the attached terminal's; the REPL owns its session.
     REPL_DETACH_NOTE = "(not attached: this session runs in this terminal; /exit ends it)"
+    # /unqueue is the attached terminal's (its worker's queued input files).
+    REPL_UNQUEUE_NOTE = "(/unqueue is the attached terminal's; here a line queued with /queue TEXT runs after the turn)"
     IMAGE_LINE_WAITS = "(a line with images runs as the next turn)"
 
     # Raised when another process (a `chi web` worker or another chi) owns the
@@ -293,7 +295,7 @@ module Samagotchi
       claim_session!(session.id) unless @owner_lock
       # A turn a worker died in (TurnCheckpoint): ended as canceled, with its
       # note, before this REPL's first turn appends after it.
-      session.save if @resume_session && TurnCheckpoint.settle(session)
+      session.save if @resume_session && TurnCheckpoint.settle(session, session_dir: Session.session_dir(session.id))
       keep_cards(session)
       # Saved at once, so a process killed before its first turn leaves a
       # file the sweep knows to delete.
@@ -828,7 +830,7 @@ module Samagotchi
     end
 
     def answer_continue_offer(session, input)
-      answer = @commands.continue_answer(input)
+      answer = @commands.continue_answer(input, as_parent: as_parent?)
       if answer.decision == :invalid
         # The read left no echo: the line shows above its error.
         @surface.commit("#{paint(QUESTION_PROMPT, 33)}#{input}")
@@ -874,7 +876,9 @@ module Samagotchi
         command = if command_registry.anytime?(input)
                     @engine.running_anytime { @commands.run(input, confirm: confirm) }
                   else
-                    @commands.run(input, confirm: confirm)
+                    # A parent's /continue yes is held to guardrails.parent_answers.
+                    parent = TurnFlow.continue_yes?(input) && as_parent? ? { as_parent: true } : {}
+                    @commands.run(input, confirm: confirm, **parent)
                   end
         if command
           show_command_result(command)
@@ -1159,6 +1163,7 @@ module Samagotchi
       case local_command(input)
       when :stats then @surface.commit("\nmodel> session stats:\n#{format_session_metrics(@engine.stats_snapshot)}")
       when :recap then @surface.commit("\nmodel> #{handle_recap_command}")
+      when :unqueue then @surface.commit(REPL_UNQUEUE_NOTE)
       else return false
       end
       true
@@ -1576,15 +1581,16 @@ module Samagotchi
         end
 
         begin
-          parent = parent_answers? ? { client_id: ClientId::CLI_ANSWER } : {}
+          parent = as_parent? ? { client_id: ClientId::CLI_ANSWER } : {}
           @engine.answer_question(id: prompt.id, selected: answer.selected, freeform: answer.freeform, **parent)
           close_question_widget(prompt, prompt.answer_text(answer))
           return true
         rescue QuestionDesk::Refused => e
-          # A parent's allow guardrails.parent_approvals doesn't let through:
-          # the question stays open for a deny (or the end of the input).
+          # A parent's pick its strategy doesn't let through
+          # (Guardrails::ParentPolicy): the question stays open for a deny
+          # (or the end of the input).
           echo_choice(raw)
-          @surface.commit(Guardrails::ParentApprovals.message(e.reason, typed: true))
+          @surface.commit(e.detail(typed: true))
           next
         rescue ArgumentError => e
           @surface.commit("Invalid: #{e.message}. Try again.")
@@ -1597,8 +1603,8 @@ module Samagotchi
     end
 
     # Whether the answers typed here are a parent agent's (piped stdin, an
-    # agent marker): QuestionDesk holds them to guardrails.parent_approvals.
-    def parent_answers?
+    # agent marker): QuestionDesk holds them to Guardrails::ParentPolicy.
+    def as_parent?
       Guardrails::ParentApprovals.parent_process?
     end
 

data/lib/samagotchi/testing/boundary.rb

@@ -79,9 +79,6 @@ module Samagotchi
           "Samagotchi::Session.new_session" => "spec: #{SESSION} (ctx.delegate?, ctx.fork?, ctx.context read it)",
           "Samagotchi::ContextSources.session_location" => "spec: reads and removes the session's sources (added_by), " \
                                                             "which ctx.context.list doesn't show",
-          'require "samagotchi/memory_bundle/installer"' => "spec: for Installer",
-          "Samagotchi::MemoryBundle::Installer.new" => "spec: installs the bundle so its context provider resolves: " \
-                                                       "needs a kit install helper",
           'require "samagotchi/context_providers"' => "spec: for ContextProviders",
           "Samagotchi::ContextProviders.resolve" => "spec: the manifest's URL provider through chi's own resolver",
           'require "samagotchi/answer_display"' => "spec: for AnswerDisplay",

data/lib/samagotchi/testing/bundle.rb

@@ -240,6 +240,13 @@ module Samagotchi
         failing { entry.handler.call({ name: name.to_s, args: stringify(args) }, nil) }
       end
 
+      # Install this bundle's dir into its sandbox as chi does and load the
+      # installed copy with chi's loaders (Install.run, with its settings):
+      # what a test of the installed bundle needs (its scripts, context
+      # providers), and the install warnings and load failures.
+      # @return [Install::Result]
+      def install(force: false) = Install.run(@dir, settings: @settings, sandbox: @sandbox, force: force)
+
       # Run the chi.init blocks in order, as chi's init tasks do.
       # @return [Array] their results
       def run_inits = failing { @inits.map { |init| init.block.call } }

data/lib/samagotchi/testing/host.rb

@@ -27,8 +27,9 @@ module Samagotchi
           messages: -> { recorder[:messages] },
           messages_partial: -> { recorder[:messages_partial] },
           notify: ->(text, level, label, fallback_for: nil) { recorder.notify(text, level, label, fallback_for) },
-          ask_user: lambda { |question:, options:, header:, allow_freeform:, hook:|
-            recorder.ask_user(question: question, options: options, header: header, allow_freeform: allow_freeform, hook: hook)
+          ask_user: lambda { |question:, options:, header:, allow_freeform:, hook:, effects: nil|
+            recorder.ask_user(question: question, options: options, header: header, allow_freeform: allow_freeform, hook: hook,
+                              effects: effects)
           },
           cancelled: -> { recorder[:cancelled] },
           card: ->(**card) { recorder.card(**card) },
@@ -88,8 +89,9 @@ module Samagotchi
       def build(recorder)
         Hooks::Runtime.new(
           notify: ->(text:, level:, hook:, fallback_for: nil) { recorder.notify(text, level, hook, fallback_for) },
-          ask_user: lambda { |question:, options:, header:, allow_freeform:, hook:|
-            recorder.ask_user(question: question, options: options, header: header, allow_freeform: allow_freeform, hook: hook)
+          ask_user: lambda { |question:, options:, header:, allow_freeform:, hook:, effects: nil|
+            recorder.ask_user(question: question, options: options, header: header, allow_freeform: allow_freeform, hook: hook,
+                              effects: effects)
           },
           stop_turn: ->(reason:, hook:) { recorder.stop(:turn, reason, hook) },
           steer: ->(text:, hook:) { recorder.steer(text, hook) },

data/lib/samagotchi/testing/install.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require_relative "../extension_load"
+require_relative "../guardrails/load_failures"
+require_relative "../memory_bundle/installer"
+require_relative "../memory_bundle/provenance"
+require_relative "../hooks"
+require_relative "bundle"
+require_relative "sandbox"
+require_relative "recorder"
+require_relative "host"
+
+module Samagotchi
+  module Testing
+    # A bundle as chi installs and loads it, unlike Bundle (its source as it
+    # is): MemoryBundle::Installer copies it into the sandbox's state (sha256
+    # and requires_chi checked), then chi's own loaders load what is
+    # installed (ExtensionLoad: the bundle hooks, then the plugins). What
+    # failed names the bundle's source files, not the installed copies.
+    #
+    #   result = Samagotchi::Testing::Install.run("path/to/bundle", settings: { "every" => 3 })
+    #   result.warnings, result.plugin_failures, result.hook_failures, result.registered[:commands]
+    module Install
+      # warnings: the Installer's; plugin_failures / hook_failures:
+      # [Guardrails::LoadFailures::Failure] of this bundle, each location
+      # in the source dir; registered: what it registered (#registered).
+      Result = Data.define(:name, :warnings, :plugin_failures, :hook_failures, :registered) do
+        def failures = plugin_failures + hook_failures
+        def ok? = failures.empty?
+      end
+
+      module_function
+
+      # Install the bundle at +dir+ into +sandbox+ (default Sandbox.current,
+      # else one of its own, left before returning) and load it.
+      # @param settings [Hash] config.yml `bundles: <name>:` (written to the
+      #   sandbox's config.yml)
+      # @param force [Boolean] the Installer's --force (a name chi ships)
+      # @return [Result]
+      # @raise [MemoryBundle::Installer::InstallError] what the Installer refused
+      def run(dir, settings: {}, sandbox: nil, force: false)
+        return Sandbox.with { |own| run(dir, settings: settings, sandbox: own, force: force) } if sandbox.nil? && Sandbox.current.nil?
+
+        sandbox ||= Sandbox.current
+        dir = File.expand_path(dir)
+        name = MemoryBundle::Manifest.read(dir: dir).name
+        sandbox.config("bundles" => { name => settings })
+        installer = MemoryBundle::Installer.new(source: dir, name: name, scope: "system", force: force)
+        installer.run
+        load_installed(name, dir, installer.warnings, sandbox)
+      end
+
+      def load_installed(name, dir, warnings, sandbox)
+        inits = []
+        # A session's values, as an Engine's host gives them (only what the loaders register matters).
+        host = Host.build(Recorder.new(cwd: sandbox.work_dir))
+        hook_failures = Guardrails::LoadFailures.new
+        plugin_failures = Guardrails::LoadFailures.new
+        extension = ExtensionLoad.new(hook_failures: hook_failures)
+        registries = Plugin::Registries.new(
+          commands: SessionCommands.register_builtins(Commands::Registry.new),
+          tools: Tools::Builtins.registry, hooks: extension.hooks,
+          context_for: lambda { |bundle, bundle_settings, label|
+            Plugin::Context.new(bundle: bundle, label: label, settings: bundle_settings, host: host)
+          },
+          services: Plugin::Services.new, stage_tools: ->(*) {},
+          init: ->(_bundle, label, _plugin_label, **, &_block) { inits << { label: label } },
+          toolkits: [], tool_index: Tools::ToolIndex.new, peer_sources: PeerSources.new
+        )
+        extension.load_plugins(registries, failures: plugin_failures)
+        installed = File.join(MemoryBundle::Provenance.bundles_dir, name)
+        Result.new(name: name, warnings: warnings.dup,
+                   plugin_failures: own(plugin_failures, name, installed, dir),
+                   hook_failures: own(hook_failures, name, installed, dir),
+                   registered: registered(registries, name, inits))
+      ensure
+        registries&.services&.stop_all
+      end
+      private_class_method :load_installed
+
+      # What bundle +name+ registered, from the registries it loaded into:
+      # commands ([name, mid_turn, annotation labels]), tools, hooks per
+      # event ([bundle, hook, priority]; Hooks::EVENTS, then any other event
+      # the bundle registered for), inits, toolkits, tool sources and
+      # peer sources.
+      # @param inits [Array<Hash>] {label:} of each chi.init
+      # @return [Hash]
+      def registered(registries, name, inits)
+        {
+          commands: registries.commands.entries.select { |e| e.source == name }.map { |e| [e.name, e.mid_turn, e.annotations.map(&:label)] },
+          tools: registries.tools.by_source(name).map(&:name),
+          hooks: hooks_of(registries.hooks, name),
+          inits: inits.map { |init| init[:label] },
+          toolkits: Array(registries.toolkits).map(&:name),
+          tool_sources: registries.tool_index.sources.map(&:label),
+          peer_sources: registries.peer_sources.names
+        }
+      end
+
+      def hooks_of(hooks, name)
+        own = ->(event) { hooks.bundle_hook_names(event).select { |bundle, _, _| bundle == name } }
+        others = (hooks.bundle_events - Hooks::EVENTS).to_h { |event| [event, own.call(event)] }.reject { |_, list| list.empty? }
+        Hooks::EVENTS.to_h { |event| [event, own.call(event)] }.merge(others)
+      end
+      private_class_method :hooks_of
+
+      # +failures+' entries for bundle +name+, their location moved from the
+      # installed copy to the source dir.
+      def own(failures, name, installed, dir)
+        failures.list.select { |f| f.what.end_with?("(bundle #{name})") }.map do |failure|
+          # The plugin is installed into plugin/, the hooks into hooks/.
+          location = failure.location&.sub(%r{\A#{Regexp.escape(installed)}/(?:plugin/)?}, "#{dir}/")
+          failure.dup.tap { |copy| copy.location = location }
+        end
+      end
+      private_class_method :own
+    end
+  end
+end

data/lib/samagotchi/testing/recorder.rb

@@ -2,6 +2,7 @@
 
 require_relative "../plugin/card"
 require_relative "../plugin/context"
+require_relative "../guardrails/parent_policy"
 
 module Samagotchi
   module Testing
@@ -12,8 +13,11 @@ module Samagotchi
     Steer = Data.define(:text, :hook)
     # A stop_turn or stop_generation (+kind+ :turn or :generation).
     Stop = Data.define(:kind, :reason, :hook)
-    # An ask_user question.
-    Question = Data.define(:question, :options, :header, :allow_freeform, :hook)
+    # An ask_user question; effects: its options' tags as the bundle gave
+    # them (label => effect), nil for none.
+    Question = Data.define(:question, :options, :header, :allow_freeform, :hook, :effects) do
+      def initialize(effects: nil, **) = super
+    end
     # An ask_model request: the request Context built (SideQuestion), its
     # limits, cancel controller and the model: it named (nil: the session's;
     # the kit doesn't check it against any hosts), and +source+, the asking
@@ -100,9 +104,14 @@ module Samagotchi
       end
 
       # The next queued answer (#answers), nil with none (no one to ask).
-      def ask_user(question:, options:, header:, allow_freeform:, hook:)
+      # Effects chi would refuse (a label the options don't have, an
+      # unknown effect: Guardrails::ParentPolicy.option_tags) ask no one, as
+      # in chi: nil, nothing recorded, no answer taken.
+      def ask_user(question:, options:, header:, allow_freeform:, hook:, effects: nil)
+        return nil if Guardrails::ParentPolicy.option_tags(options, effects) == false
+
         record(@questions, Question.new(question: question, options: options, header: header,
-                                        allow_freeform: allow_freeform, hook: hook))
+                                        allow_freeform: allow_freeform, hook: hook, effects: effects))
         answer = @mutex.synchronize { @answers.shift }
         answer.respond_to?(:call) ? answer.call(@questions.last) : answer
       end

data/lib/samagotchi/testing.rb

@@ -22,5 +22,6 @@ require_relative "testing/recording_api"
 require_relative "testing/waiting"
 require_relative "testing/fake_executable"
 require_relative "testing/bundle"
+require_relative "testing/install"
 require_relative "testing/helpers"
 require_relative "testing/boundary"

data/lib/samagotchi/tools/builtins.rb

@@ -118,7 +118,8 @@ module Samagotchi
 
       # What execute and task_create export into the commands they run: a
       # chi started there answers as a parent agent
-      # (Guardrails::ParentApprovals.parent_process?), even under a PTY
+      # (Guardrails::ParentApprovals.parent_process?, held to
+      # Guardrails::ParentPolicy), even under a PTY
       # wrapper. The session's id, "chi" without one. And the model the
       # session runs on (SAMAGOTCHI_SESSION_MODEL, read live, so right after
       # /model), which chi self reports; unset when unknown, so a value

data/lib/samagotchi/tools/delegate_wait.rb

@@ -305,10 +305,15 @@ module Samagotchi
       # The tool's last line follows #reports_mode.
       def waiting_text(child_id, pending, report: false, reports: "off")
         text = "Child #{child_id} is #{ParentReport.question_text(pending, session_id: child_id)}"
-        if ParentReport.continue?(pending)
+        if ParentReport.continue?(pending) && ParentReport.may_continue?(pending)
           text += "The child ran out of steps before it answered. Decide: continue it (run the chi answer command " \
                   "above with execute) if it is getting somewhere; send it a narrower follow-up with delegate " \
                   "session: #{child_id} (that drops the question); or stop it and report back to your user.\n"
+        elsif ParentReport.continue?(pending)
+          # guardrails.parent_answers: hard: continuing is the user's.
+          text += "The child ran out of steps before it answered. Decide: send it a narrower follow-up with delegate " \
+                  "session: #{child_id} (that drops the question); or stop it (the chi answer Stop command above, " \
+                  "with execute) and report back to your user, who may continue it.\n"
         end
         return "#{text}#{REPORT_NEXT_REPLY}" if report
         return "#{text}delegate_result #{child_id} waits again once it is answered." if reports == "off"

data/lib/samagotchi/tools/task_runtime.rb

@@ -100,15 +100,15 @@ module Samagotchi
       # between (failed, no exit code) is corrected; a stopped task (its
       # stop flag on disk) is left as task_stop records it.
       # The thread is named EXIT_STATUS_THREAD (a spec joins them before it
-      # removes the tasks' folder).
+      # removes the tasks' folder) here, before it returns: named from
+      # inside, a thread not yet scheduled was missed by that join.
       # @return [Thread]
       def record_exit_status(waiter, path, task_id:)
         # Absolute now: safe against a later chdir.
         record_path = File.expand_path(metadata_path(task_id))
         path = File.expand_path(path)
-        Thread.new do
+        thread = Thread.new do
           Thread.current.report_on_exception = false
-          Thread.current.name = EXIT_STATUS_THREAD
           code = status_code(waiter.value)
           next if code.nil? || record_at(record_path)&.stop_requested_by
 
@@ -117,6 +117,8 @@ module Samagotchi
         rescue StandardError => e
           Log.debug(:turn, "task_exit_code_failed", id: task_id, error: e.class.name, msg: e.message)
         end
+        thread.name = EXIT_STATUS_THREAD
+        thread
       end
 
       # A Process::Status as a shell reports one: its exit status, or

data/lib/samagotchi/turn_checkpoint.rb

@@ -1,9 +1,14 @@
 # frozen_string_literal: true
 
+require "fileutils"
+require "json"
 require "time"
+require_relative "atomic_file"
 require_relative "interrupted_turn"
+require_relative "last_turn"
 require_relative "log"
 require_relative "session"
+require_relative "session_inbox"
 require_relative "steer"
 require_relative "turn_note"
 
@@ -39,9 +44,12 @@ module Samagotchi
     # last_turn is left as it was: a new last_turn saved idle here, before
     # the turn a `chi send --wait` started this worker for, would end that
     # wait at once as the sent turn's (ReplyWait compares last_turn), with
-    # the dead turn's outcome.
+    # the dead turn's outcome. A mark with an enqueued_id records the dead
+    # turn's end under that id instead (+session_dir+, #settled_turn): only
+    # a wait for that very turn (ReplyWait's turn:) reads it.
+    # @param session_dir [String, nil] where to record it; nil: nowhere
     # @return [InterruptedTurn, nil] the mark settled, nil when there was none
-    def self.settle(session)
+    def self.settle(session, session_dir: nil)
       mark = session.interrupted_turn
       return nil unless mark
 
@@ -54,9 +62,63 @@ module Samagotchi
       session.messages = messages + [note]
       session.status = Session::STATUS_IDLE if session.status == Session::STATUS_RUNNING
       session.interrupted_turn = nil
+      record_settled(session_dir, mark, seconds) if session_dir
       mark
     end
 
+    # Where a per-input terminal outcome is kept: input/settled/<enqueued_id>,
+    # outside the *.json glob like SessionInbox's removed tombstones.
+    SETTLED_DIR = "settled"
+    WORKER_STOPPED = "worker_stopped"
+
+    # The terminal outcome recorded for +enqueued_id+.
+    # @return [LastTurn, nil] nil when no settle recorded one
+    def self.settled_turn(session_dir, enqueued_id)
+      id = enqueued_id.to_s
+      return nil unless SessionInbox::ENQUEUED_ID_NAME.match?(id)
+
+      raw = File.read(File.join(session_dir, SessionInbox::INPUT_DIR, SETTLED_DIR, id))
+      LastTurn.from_file(JSON.parse(raw)) || settled_record(id)
+    rescue Errno::ENOENT, Errno::ENOTDIR
+      nil
+    rescue JSON::ParserError, SystemCallError
+      # The file says the turn was settled even when it can't be read.
+      settled_record(id)
+    end
+
+    def self.settled_record(id, ended_at: nil, seconds: nil)
+      LastTurn.new(outcome: "canceled", cancel_reason: WORKER_STOPPED, ended_at: ended_at, seconds: seconds, enqueued_id: id)
+    end
+    private_class_method :settled_record
+
+    # A file-delivered command ends its sender's wait without running a
+    # turn. Keep a terminal outcome under the same per-input settled path.
+    def self.record_command_outcome(session_dir, enqueued_id)
+      id = enqueued_id.to_s
+      return if id.empty? || !SessionInbox::ENQUEUED_ID_NAME.match?(id)
+
+      dir = File.join(session_dir, SessionInbox::INPUT_DIR, SETTLED_DIR)
+      FileUtils.mkdir_p(dir)
+      record = LastTurn.new(outcome: "completed", ended_at: Time.now.iso8601(3), enqueued_id: id)
+      AtomicFile.write(File.join(dir, id), JSON.generate(record.to_file))
+    rescue SystemCallError, IOError => e
+      Log.warn(:worker, "command_outcome_write_failed", error: e.class.name, msg: e.message, enqueued_id: id)
+    end
+
+    def self.record_settled(session_dir, mark, seconds)
+      id = mark.enqueued_id.to_s
+      return unless SessionInbox::ENQUEUED_ID_NAME.match?(id)
+
+      dir = File.join(session_dir, SessionInbox::INPUT_DIR, SETTLED_DIR)
+      FileUtils.mkdir_p(dir)
+      record = settled_record(id, ended_at: Time.now.iso8601(3), seconds: seconds)
+      AtomicFile.write(File.join(dir, id), JSON.generate(record.to_file))
+    rescue SystemCallError => e
+      # The settle goes on; a wait for that turn runs to its timeout.
+      Log.warn(:worker, "settled_turn_write_failed", error: e.class.name, msg: e.message)
+    end
+    private_class_method :record_settled
+
     # @param session [Session] the worker's session (saved as a whole)
     # @param clock [#call] monotonic seconds (specs)
     def initialize(session:, state_dir:, interval: INTERVAL, clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })

data/lib/samagotchi/turn_flow.rb

@@ -23,6 +23,16 @@ module Samagotchi
 
     # Read an answer to the continue offer.
     # @return [Array(Symbol, String|nil)] [:resume | :abort | :abort_with_reason | :invalid, reason]
+    # Whether +line+ is a /continue that continues the turn (/continue,
+    # /continue yes): what a parent agent's must be checked for.
+    def self.continue_yes?(line)
+      text = line.to_s.strip
+      return false unless text.match?(/\A#{Regexp.escape(CONTINUE_COMMAND)}(\s|\z)/)
+
+      answer = text.delete_prefix(CONTINUE_COMMAND).strip
+      continue_decision(answer.empty? ? CONTINUE_COMMAND : answer).first == :resume
+    end
+
     def self.continue_decision(input)
       normalized = input.to_s.strip
       return [:resume, nil] if normalized.empty?

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.84.0"
+  VERSION = "0.86.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -166,6 +166,7 @@ module Samagotchi
         ["GET", %r{\A/api/sessions/([^/]+)/output\z}, :handle_output],
         ["POST", %r{\A/api/sessions/([^/]+)/cancel\z}, :handle_cancel],
         ["POST", %r{\A/api/sessions/([^/]+)/tasks/([^/]+)/stop\z}, :handle_task_stop],
+        ["POST", %r{\A/api/sessions/([^/]+)/turn/([^/]+)/dequeue\z}, :handle_dequeue_turn],
         ["POST", %r{\A/api/sessions/([^/]+)/stop\z}, :handle_stop],
         ["POST", %r{\A/api/sessions/([^/]+)/restart\z}, :handle_restart],
         ["POST", %r{\A/api/sessions/([^/]+)/archive\z}, :handle_archive],
@@ -925,14 +926,10 @@ module Samagotchi
         state = nil unless state.is_a?(Hash)
         if state
           status, used, notes = state.values_at("status", "used_memory_names", "prompt_notes")
-          # No session file read here: the folder the answer's file refs must
-          # stay under is the worker's (its tail's working_directory), else the
-          # hub's session list entry's (a worker from before the field, or read
-          # through its snapshot); nil then without a hub or before it saw the
-          # session: refs aren't checked.
-          cwd = tail["working_directory"]
-          cwd = @hub&.working_directory(id) unless cwd.is_a?(String) && !cwd.empty?
-          messages = last_assistant_for_display([tail["answer"]].compact, cwd: cwd)
+          answer = tail["answer"]
+          cwd = tail_working_directory(id, tail, answer)
+          answer = without_file_refs(answer) unless cwd
+          messages = last_assistant_for_display([answer].compact, cwd: cwd)
         else
           session = @session_class.load(id, state_dir: default_state_dir)
           status = displayed_status(session)
@@ -955,6 +952,35 @@ module Samagotchi
         error_response(404, "not_found", e.message)
       end
 
+      # The folder the live tail's answer's file refs must stay under: the
+      # worker's (its tail's working_directory), else the hub's session list
+      # entry's (a worker from before the field, or read through its
+      # snapshot), else, only when the answer has refs to check, the session
+      # file's, as the full read takes it. nil when none is known: the
+      # caller drops the file refs rather than show them unchecked.
+      # @return [String, nil]
+      def tail_working_directory(id, tail, answer)
+        known = ->(dir) { dir.is_a?(String) && !dir.empty? }
+        cwd = tail["working_directory"]
+        cwd = @hub&.working_directory(id) unless known.call(cwd)
+        return cwd if known.call(cwd)
+        return nil unless answer.is_a?(Hash) && (answer[AnswerRefs::KEY.to_s] || answer[AnswerRefs::KEY])
+
+        cwd = @session_class.load(id, state_dir: default_state_dir).working_directory
+        known.call(cwd) ? cwd : nil
+      rescue ArgumentError, KeyError, SystemCallError
+        nil
+      end
+
+      # +answer+ without its file refs (the rest kept), for a read that
+      # knows no folder to check them against.
+      def without_file_refs(answer)
+        return answer unless answer.is_a?(Hash)
+
+        key = [AnswerRefs::KEY.to_s, AnswerRefs::KEY].find { |name| answer[name].is_a?(Array) } or return answer
+        answer.merge(key => answer[key].reject { |ref| ref.is_a?(Hash) && (ref["kind"] || ref[:kind]).to_s == Ref::FILE })
+      end
+
       # ?timing=1: the whole timing (every record, analytics.json merged with
       # the live ones) and turn_count, when the page's merge comes up short.
       # The worker's GET state, never its messages.
@@ -1339,6 +1365,33 @@ module Samagotchi
         error_response(404, "not_found", e.message)
       end
 
+      # POST /api/sessions/:id/turn/:enqueued_id/dequeue {client_id?}: the ×
+      # on a queued bubble takes the message back before it runs
+      # (Bridge#handle_dequeue_turn). Straight to the live worker, never
+      # through deliver_turn: a removal must not wake one, and a stopped
+      # worker's queued file is the next worker's (503 not_live). 200
+      # {status, enqueued_id, prompt}; 409 already_started / not_queued and
+      # 404 unknown_enqueued_id pass through; the rest as every relay.
+      def handle_dequeue_turn(req, id, enqueued_id)
+        @session_class.load(id, state_dir: default_state_dir)
+        body = request_body(req)
+        parsed = body.nil? || body.strip.empty? ? nil : parse_json(body)
+        client_id = (parsed["client_id"] if parsed.is_a?(Hash))
+
+        request = ->(client) { client.dequeue(enqueued_id: enqueued_id, client_id: client_id) }
+        relay(id, bridge_client(id), request, what: "the message was not removed", cant: "remove queued messages") do |reply|
+          body = reply.json || {}
+          case reply.status
+          when 200 then json_response(200, { status: body["status"], enqueued_id: enqueued_id, prompt: body["prompt"].to_s, session_id: id })
+          when 409 then json_response(409, { error: body["error"] || "already_started", detail: body["detail"], enqueued_id: enqueued_id, session_id: id }.compact)
+          when 404
+            json_response(404, { error: "unknown_enqueued_id", enqueued_id: enqueued_id, session_id: id }) if body["error"] == "unknown_enqueued_id"
+          end
+        end
+      rescue ArgumentError => e
+        error_response(404, "not_found", e.message)
+      end
+
       def handle_stop(_req, id)
         # Bounded, so a Rack thread isn't held long; a worker still exiting
         # after it just means an immediate resume finds it (rare).
@@ -1544,7 +1597,7 @@ module Samagotchi
           return [200, headers.merge("rack.hijack" => hijack), []]
         end
 
-        query = req.query_string.to_s.empty? ? "" : "?#{req.query_string}"
+        query = stream_query(req)
         [200, headers, ProxyStreamBody.new(host: DEFAULT_HOST, port: bridge_port, session_id: id, query: query, headers: req.env,
                                            server_running: @server_running)]
       end
@@ -1588,13 +1641,26 @@ module Samagotchi
         [200, headers, body]
       end
 
+      # The stream's query as the worker's Bridge gets it ("?..." or ""):
+      # every parameter but `raw`. `?raw=1` is the worker port's debugging view
+      # (a chunk's provider payload); a browser never gets it through here.
+      # Keys are compared decoded, as the Bridge reads them.
+      def stream_query(req)
+        pairs = req.query_string.to_s.split("&").reject do |pair|
+          URI.decode_www_form_component(pair.split("=", 2).first.to_s) == "raw"
+        rescue ArgumentError
+          false
+        end
+        pairs.empty? ? "" : "?#{pairs.join("&")}"
+      end
+
       # Rack hijack lambda (env["rack.hijack?"] truthy): pipes the bridge's SSE
       # frames directly to the client socket until it disconnects. The handler
       # (WEBrick via rackup) has already sent the status line + headers, so
       # only body bytes go to the socket here.
       def sse_hijack(id, req, port)
         lambda do |io|
-          query = req.query_string.to_s.empty? ? "" : "?#{req.query_string}"
+          query = stream_query(req)
           body = ProxyStreamBody.new(host: DEFAULT_HOST, port: port, session_id: id, query: query, headers: req.env,
                                      server_running: @server_running)
           body.each { |chunk| io.write(chunk) }

data/lib/samagotchi/web/public/app.js

@@ -92,6 +92,7 @@ import { currentGen } from "./turn_model.js";
 import { toolName } from "./activity.js";
 import { toastBottom } from "./toast_place.js";
 import { createToasts } from "./toasts.js";
+import { createUnqueue } from "./unqueue.js";
 
 const $ = (s) => document.querySelector(s);
 const topStripEl = $("#topStrip");
@@ -1801,6 +1802,22 @@ composerEl.addEventListener("drop", (e) => {
   e.preventDefault();
   addImageFiles(files);
 });
+// The × on a message queued for after the turn takes it back (unqueue.js).
+const unqueue = createUnqueue({
+  sessionId: () => selected,
+  clientId,
+  toast: (text) => showToast(text),
+  // Edit: the removed text back into an empty composer (never over a draft).
+  putBack: (text) => {
+    if (promptEl.value.trim() || chips.length) return false;
+    openForVisit();
+    promptEl.value = text;
+    fitPrompt();
+    promptEl.focus();
+    return true;
+  },
+});
+turnRoots().forEach((root) => root.addEventListener("click", (e) => { unqueue.onClick(e); }));
 turnRoots().forEach((root) => root.addEventListener("click", (e) => {
   const img = e.target.closest("img.thumb");
   if (!img) return;