samagotchi 0.123.0 → 0.124.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8b284b838ef7182e859040f2955be576abe43fda373a9a96c094bd701ef8837c
-  data.tar.gz: d776a399ac831dd9a62405f58f5eb9c9843b83b021f82a52361fe32d4f49aba9
+  metadata.gz: e85ff88270cf7569d21ff95bba739199ceb3c53d32675b1648a18363ca5482cd
+  data.tar.gz: d9f539982d7c41b94ad40d17368041f2debed8040ebc48a27776486fe2476dc9
 SHA512:
-  metadata.gz: 1a590e517591c610712641c7496a916afad37502d3784669bbb58a582a5e8522246dc9c6a2bdcaad8b5fc9ad4d8c7b7bab95e52eeea012bf075af9d481e52680
-  data.tar.gz: 4e7917cc27174b89e870f6f6d768001de752b35f332f942f7c9223fab22a0614c2bb32839e79c6038282ed5a86f994e038a4cd8b2a1a3a83b3c2f52320309827
+  metadata.gz: e3496206b25f1d329a3a915c075cefe5e0c3e1fc40b71694128c7d3fee633fc65447686efbb4c8f4f19e0872998cecb2f269db67a7428b9b519a9cc5b6469bd3
+  data.tar.gz: 3ed82d4bb9b01288f391e2d68d9eba5b71492fa66f411d7a5fd25276ac68425f8432979fd0d4d59882b741a2dfa79bcb0810fc74e3b2c7e66bb590e0c5bdbccc

data/CHANGELOG.md

@@ -7,6 +7,24 @@ and commands may change between minor versions. How releases are made:
 [docs/releasing.md](docs/releasing.md).
 ## [Unreleased]
 
+## [0.124.0] - 2026-10-27
+
+### Added
+
+- The desktop helper's panel lists and sends to the sessions of the remotes `chi remote add` keeps: a section per
+  remote ("on studio") after this Mac's rows, each row tagged with its machine, "→ studio" in the hint while one is
+  ticked, one call per machine at once; a remote that doesn't answer within 4 s or refuses shows one line, and this
+  Mac's rows don't wait for it. A remote with a session also gets a "New session on studio in <folder>" row, in its
+  newest session's folder, on that remote's default model. The Everyone row, the model chooser and agents stay on
+  this Mac.
+- chi web updates chi from its page: the notice's **Update** installs the release it names in a progress sheet
+  that lists kept edits, then offers **Restart workers** (each worker on an older chi; a busy one says what holds
+  it) and **Restart chi web** (in place: same port, token, flags and Tailscale Serve). `chi update --to VERSION`
+  installs an exact release; `--json` prints its rows as JSON.
+
+Update with `chi update` (it rebuilds the desktop helper), then restart `chi web` and the session workers
+(`chi sessions restart`). From the next release on, chi web's Update button does this from its page.
+
 ## [0.123.0] - 2026-10-27
 
 ### Added
@@ -4695,7 +4713,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.123.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.124.0...HEAD
+[0.124.0]: https://github.com/dm1try/samagotchi/compare/v0.123.0...v0.124.0
 [0.123.0]: https://github.com/dm1try/samagotchi/compare/v0.122.0...v0.123.0
 [0.122.0]: https://github.com/dm1try/samagotchi/compare/v0.121.1...v0.122.0
 [0.121.1]: https://github.com/dm1try/samagotchi/compare/v0.121.0...v0.121.1

data/bin/chi

@@ -18,6 +18,15 @@ rescue Samagotchi::ConfigFile::RemovedApi => e
 end
 require "samagotchi"
 
+# A web self-restart re-enters through the installed wrapper: its marker and
+# the worker starters to adopt leave ENV before anything spawns with it
+# (Server.take_restart_env!); a restarted chi web skips the first-run hint.
+web_restarted = false
+if ENV.key?("SAMAGOTCHI_WEB_RESTARTED") || ENV.key?("SAMAGOTCHI_WEB_ADOPT_PIDS")
+  require "samagotchi/web/server"
+  web_restarted = Samagotchi::Web::Server.take_restart_env!
+end
+
 # `chi self`: print version, source dir, config/memory/session paths, model and
 # bundles (read-only, offline) — lets the agent find its own code and state.
 if ARGV[0] == "self"
@@ -221,7 +230,7 @@ chi_update_hint = lambda do
 end
 
 if options[:web]
-  chi_update_hint.call
+  chi_update_hint.call unless web_restarted
   require "samagotchi/web/server"
   port = options[:web_port] || Samagotchi::Config.get("web.port")
   markdown = options[:web_markdown]
@@ -233,7 +242,9 @@ if options[:web]
                                       annotate_presets: Samagotchi::Config.get("web.annotate_presets"),
                                       editor: Samagotchi::Config.get("web.editor"),
                                       start_dir: options[:start_dir] || Samagotchi::Config.get("web.start_dir"),
-                                      start_dir_from: options[:start_dir] ? :flag : :config)
+                                      start_dir_from: options[:start_dir] ? :flag : :config,
+                                      restarted: web_restarted,
+                                      restart_argv: Samagotchi::RunOptions.web_restart_argv(options))
 end
 
 # --resume and --attach take a unique id prefix too, like git.

data/docs/architecture.md

@@ -551,6 +551,24 @@ version than the server itself still means restart chi web (its workers already
 web runs in) it names `start_dir`, the folder it starts in (`web.start_dir`, `--start-dir`;
 `Web::StartDir`), which a second `chi web` given another one mentions.
 
+The owner's update routes publish progress and results as `chi_update` events with an
+`operation` (`install` or `workers`), `state`, and `rows`; install events also name the target
+`version` and may include a progress line. The hub retains the latest event for a reconnecting
+tab's snapshot. `POST /api/update` decides itself whether this install can take a gem
+(`UpdateCheck.blocked_reason`: a checkout, Bundler, an unwritable gem dir → 409 `update_blocked`), so
+it holds with `update.notify: off`; a child that prints no rows fails with its own last line, and a
+done install refreshes the hub's installed version (`SessionHub#refresh_installed`) before its `done`.
+Worker restarts target every worker older than the version installed now (refreshed the same way)
+and publish per-session results. Only one of an install, a worker restart pass and a web restart runs
+at a time (409 `update_running`). `POST /api/update/restart_web` (409 `restart_unavailable` without a
+chi wrapper to exec) schedules WEBrick shutdown only after its response is sent; after the hub and
+listener stop, `Server` execs the RubyGems chi wrapper with every flag chi web was started with, as
+`RunOptions`' parser recorded them (`RunOptions.web_restart_argv`), but the one-shot `--open` and
+`--new-token`. The re-entry (`SAMAGOTCHI_WEB_RESTARTED`, taken out of ENV first by
+`Server.take_restart_env!`) skips the first-run update hint, adopts live worker-starter PIDs (workers
+themselves are detached), and adopts an exact Tailscale Serve handler. A failed exec, or a restarted
+chi web that doesn't start for any reason, turns off only that exact adopted handler.
+
 The page's scope is in its URL, and the server picks the default: `?dir=<folder>` is that folder's
 project (the list, the events stream and a new chat follow it), `?scope=all` every session, and a bare
 `/` the start folder's project when that folder is in a repo (`App#index_data_attributes` writes
@@ -786,4 +804,4 @@ A map of the parts the overview above doesn't name (paths under `lib/samagotchi/
 | Stores | `reminder_store.rb` (`ReminderStore`), `recap_store.rb` (`RecapStore`) | A session's reminders, and its idle recap (`recap.json`). |
 | Setup and update | `bootstrap_command.rb`, `bootstrap/`, `update_command.rb`, `gem_update.rb` | `chi bootstrap` (first config.yml, system bundle, core profile) and `chi update` (the gem, shipped bundles, the macOS helper). |
 | Process groups | `process_group.rb` (`ProcessGroup`) | A command in a process group of its own, stopped as a group (TERM, grace, KILL): execute, tasks, context fetches, the mcp bundle's servers. |
-| Desktop | `desktop.rb`, `desktop/macos.rb`, `desktop_command.rb`, `desktop/macos/*.swift` | `chi desktop`, the macOS "Send to chi" helper ([desktop.md](desktop.md)). The helper's Swift side: the panel (`Panel.swift`), the chi CLI runner (`ChiRunner.swift`), agent terminals behind `AgentTerminal` (`AgentTerminal.swift`, `Kitty.swift`, `Tmux.swift`; `ChiHelper --agents` is their CLI seam). |
+| Desktop | `desktop.rb`, `desktop/macos.rb`, `desktop_command.rb`, `desktop/macos/*.swift` | `chi desktop`, the macOS "Send to chi" helper ([desktop.md](desktop.md)). The helper's Swift side: the panel (`Panel.swift`), the chi CLI runner (`ChiRunner.swift`), the session rows and the chi calls a send makes (`Sessions.swift`: `SendPlan`; `ChiHelper --sessions` and `--send-plan` are their CLI seams), agent terminals behind `AgentTerminal` (`AgentTerminal.swift`, `Kitty.swift`, `Tmux.swift`; `ChiHelper --agents` is their CLI seam). |

data/docs/cli.md

@@ -34,7 +34,7 @@
 - `chi desktop install|upgrade|uninstall|status` — the macOS "Send to chi" helper: a Service and a ⌃⌥⌘N hotkey that send text or images to a session (live, stopped or new) as a message (⏎, a turn runs) or a context note (⌘⏎) (see [Desktop helper](desktop.md))
 - `chi models [--format text|json] [--timeout S] [TEXT]` — list the models every configured host offers, as the names `--model` takes (see [Listing the models](#listing-the-models))
 - `chi self` — print version, source dir (checkout or installed gem), config/memory/session paths, model/host and bundles. Run by a session's `execute`, the `model` row (and host, loop, profile, thinking, served model) is **that session's** model, labelled `(this session <id8>; default …)`; elsewhere it is the default, `(default)`. `model key` is the memory overlay key (`<name>.<key>.md`), and `model notes` the model notes a prompt of that model loads (`model_notes_deepseek (system, 612 chars)`, `none`; inside a session its `--mute` list is left out). `chi self --model` prints only the model a new session starts on, an alias resolved to its target (the desktop helper's hint)
-- `chi update [--dry-run] [--no-gem] [--no-bundles] [--no-desktop]` — update an installed chi: the gem, the system bundle, the shipped bundles you installed and the desktop helper, in one table (see [Updating](#updating))
+- `chi update [--dry-run] [--to VERSION] [--json] [--no-gem] [--no-bundles] [--no-desktop]` — update an installed chi: the gem, the system bundle, the shipped bundles you installed and the desktop helper, in one table (see [Updating](#updating))
 - `chi bundle install|upgrade|uninstall|status|diff|list|build|trash|new|test|check` — manage memory bundles (see [Bundle hooks](hooks.md#bundle-hooks-unified-workflow-bundle)); `list` shows the installed ones and the ones shipped with chi, which `install <name>` installs; `core` and `dev` are profiles that install a set of them (see [Bundle profiles](memory.md#bundle-profiles-core-and-dev),  [Guardrails](guardrails.md), [Plugins](plugins.md#the-btw-bundle), [the mcp bundle](plugins.md#the-mcp-bundle) [the loop-guard bundle](plugins.md#the-loop-guard-bundle), [the check-in bundle](plugins.md#the-check-in-bundle) and [the skills bundle](plugins.md#the-skills-bundle)). `trash` lists and empties the bundle trash (moved files from uninstalls/upgrades). A usage error (an unknown subcommand or flag, a missing argument, a bad `build --scope`) exits 2, as for the other subcommands. Plain `chi` and `chi web` exit 1 on an unknown flag, a flag missing its value or a stray argument. `new`, `test` and `check` are for writing one: see [Writing a bundle](#writing-a-bundle-new-test-check)
 
 - `chi guardrails replay [--dry-run] [--threshold T] [--model M]` — seed System 1's record from the approvals this machine's sessions already answered: each ask is judged by the configured model and written to `guardrails/judgments.jsonl` with the answer the user gave, then a per-rule table prints (asks, allowed, denied, would-be auto-allows, false allows, asks with no judgment). A parent agent's answer is not the user's: only its deny is replayed, and only where the parent could have allowed. `--dry-run` judges without writing, `--threshold` overrides `guardrails.system_one.threshold` for the table, `--model` the configured model for this run. Exit 2 when `guardrails.system_one.mode` is off or no `host` is set; a usage error exits 2 (see [System 1](guardrails.md#system-1-experimental))
@@ -233,13 +233,26 @@ Also shipped, not installed: dev (mcp, skills, source-links) (chi bundle install
 done
 ```
 
+- `--to VERSION` installs exactly that gem version instead of checking for the
+  newest release. It must be newer than the running chi; an equal or older
+  version is refused.
+- `--json` writes the component rows as one JSON array on stdout. Each row has
+  `component`, `from`, `to`, `status`, `failed` and `kept` fields; `kept` is an
+  array of edited filenames. Install progress is written to stderr.
+
 - **chi web update notices.** By default, chi web checks RubyGems about 30
   seconds after it starts and every 24 hours after that. Once a stable release
   is at least 24 hours old and newer than both the running chi and the newest
-  installed one, the page shows its version, a link to that RubyGems release,
-  and a button to copy `chi update`. The notice is once per version per
-  browser: a reload or a chi web restart doesn't repeat it.
-  `update.notify: off` disables checking; `update.check_hours` and
+  installed one, the owner's page shows its version and a link to that
+  RubyGems release. When the install is unblocked, **Update** installs that
+  exact release and opens a progress sheet with component results and any
+  edited files kept. A blocked install instead shows the reason and a command
+  to copy. After installation, the notice and the sheet's footer offer
+  **Restart workers** and **Restart chi web**; the sheet reports worker results
+  (a busy worker's refusal says what holds it) and waits for chi web to
+  reconnect, and keeps the other restart in reach. The notice is once per version per browser: a reload or a chi
+  web restart doesn't repeat it. `update.notify: off` disables checking;
+  `update.check_hours` and
   `update.min_age_hours` tune the interval and release age (see
   [configuration](configuration.md#all-settings)). If the gem can't be updated
   in place, the notice gives the blocker and its command instead.
@@ -1325,6 +1338,8 @@ CHI_REMOTE=studio chi context push claude-outbox ab12 < answer.json
   studio (http://192.168.1.29:4567): connection refused`, exit 1; with
   `--format json` an `error` object).
 - Plain http, the same as the phone's: use it on your home network.
+- The macOS desktop helper's panel lists and sends to a remote's sessions too: see
+  [Desktop helper: Remote sessions](desktop.md#remote-sessions).
 
 A session there in this terminal (the attached TUI, through that machine's
 chi web; its worker stays there):

data/docs/desktop.md

@@ -41,7 +41,7 @@ alias as the model it names).
 
 ### Everyone it concerns
 
-The second row, **Everyone it concerns** (⌘B), shares a note with every session it may concern instead of the ones
+The second row, **Everyone it concerns (this Mac)** (⌘B), shares a note with every session it may concern instead of the ones
 you pick: ⌘⏎ (the **Broadcast** button) runs [`chi broadcast`](broadcast.md) with the line, then the text, on stdin.
 chi picks the sessions (a shared ticket, PR or link, else a small triage model), so the preselected session doesn't
 count: the row is ticked alone, like the new row. Write it the way you'd tell a colleague: a first line such as
@@ -51,6 +51,8 @@ count: the row is ticked alone, like the new row. Write it the way you'd tell a
   skipped 2 · 1 unchecked: triage deadline`), and **stays open**: Esc closes. Which sessions got it and why:
   `chi broadcast log` in a terminal.
 - A broadcast is a text note: ⏎ and images beep. The source field and Send are hidden (its source is `broadcast`).
+- It reaches this Mac's sessions only (`chi broadcast` runs on this machine only), never a
+  [remote's](#remote-sessions).
 - It may take `broadcast.triage_deadline` (20 s) and 10 s more before the helper stops it ("the note may be partly
   delivered"). The helper reads that from its launch file: after changing the deadline, run `chi update` (or
   `chi desktop upgrade`).
@@ -106,6 +108,46 @@ thumbnails sit under the message line, 48 px high, the file name as a tooltip; h
   the panel closes; files from Finder are sent as they are, never touched. A send with images may take up to 30 s
   (converting, a worker starting) before the panel gives up.
 
+## Remote sessions
+
+The panel also lists the sessions of the other machines `chi remote add` keeps (see
+[Remote sessions](cli.md#remote-sessions)), say the Studio's from a laptop: select text or take a screenshot here,
+and it lands in a session running there.
+
+- **Which:** every remote in `chi remote ls` that has a token, asked at each open (a remote you don't want in the
+  panel: `chi remote rm` it). No `chi update` or `chi desktop upgrade` after adding one.
+- **Where:** after this Mac's rows, one section per remote under an **on studio** divider: its live sessions, then up
+  to 3 recent ones, as for this Mac. Each row carries a grey **studio** tag and its whole folder path (that machine's
+  home may differ from this one's). ⌘1…⌘9 number this Mac's rows first, then the remotes' in order; past nine, a row
+  is clicked.
+- **Not twice:** a session shows once, where it is listed first (this Mac, then the remotes in `chi remote ls` order),
+  so two remotes for the same Studio (its LAN address and its ts.net name), or a remote that is this Mac, don't
+  list or send to it twice.
+- **Wrong machine:** both machines likely have the same paths. While a remote's row is ticked the message line's hint
+  ends in **→ studio**, and **→ studio** shows beside Send (it stays there while you type). The last choice is
+  preselected while it is still live, a remote's row too; the "only one live session" rule picks this Mac's only,
+  never a remote's. A remote that answers after this Mac's list never changes what is ticked: it is preselected only
+  when nothing is (so a remembered remote row is ticked when the remote answers first, or when this Mac has live
+  sessions but none was remembered).
+- **Keys:** ⏎ and ⌘⏎ work as for this Mac's sessions (`chi --remote studio send …`, `chi --remote studio note …`;
+  a note to a stopped session there waits for its next start). Images go along (`--image`: chi uploads them). With
+  rows of several machines ticked, the helper runs one call per machine at once and shows one line: `sent · studio:
+  sent`. ⌥⏎ (paste) beeps on a remote's row as on this Mac's.
+- **Down or refused:** this Mac's rows show as soon as they are in; each remote's fill in as it answers. A remote's
+  two lists run at once and get 4 s together: one that doesn't answer shows **studio: no answer within 4 s** under
+  its divider, one that chi gives up on by itself (connection refused, the token refused) the first line of chi's
+  error. The previous open's rows for it are never reused: a stale row could send to a stopped worker.
+- **New session there:** a remote with a session has its own new row under its divider, **New session on studio in
+  proj**: the folder is that remote's most recently updated session's (live first, then recent), whole and not
+  checked on this Mac. A remote with no session has no new row (never a guess at its home). It is ticked alone like
+  this Mac's new row (ticking it clears the sessions, and the reverse), is never preselected and has no ⌘ number (⌘0
+  stays this Mac's). ⏎ runs `chi --remote studio send --new --dir <that folder>` with the message and images, and
+  shows `studio: started 1a2b3c4d…` for 3 s. It starts on the remote's default model, never `--model`: its hint
+  says **remote default**, and ⌘M or a click on it beeps with "Model choice is for this Mac's sessions" (`chi models`
+  answers for this Mac's hosts).
+- **What stays on this Mac:** the model chooser, the **Everyone it concerns** row (`chi broadcast` is local only)
+  and the agents in kitty and tmux.
+
 ## Agents in kitty and tmux
 
 The panel can also send to agent CLIs (claude, codex, gemini, aider, …) running in
@@ -276,8 +318,14 @@ The helper uses only these commands, so it could ship on its own later:
   (`delivered N · skipped M…`); exit 0 when it ran, 1 when refused or a delivery failed.
 - `chi self --model` → the model a new session starts on (the panel's hint).
 - `chi models --format json` → the models the hosts offer (the new-session model picker).
-
-Each call is stopped after 10 s, a send with images after 30 s, a broadcast after the launch file's
+- `chi remote ls --format json` → `[{name, url, token}]` (never the token itself): the remotes whose sessions the
+  panel lists. A name goes on only when it has a token and passes chi's own rule (letters, digits, `_`, `-`, not
+  starting with `-`). An older chi without `chi remote` lists none.
+- `chi --remote NAME sessions list …`, `chi --remote NAME send …` and `chi --remote NAME note …`: the same calls on a
+  remote's sessions. `CHI_REMOTE` is taken out of the helper's environment, so this Mac's calls never go remote.
+
+Each call is stopped after 10 s, a remote's two lists after 4 s, a send of text to a remote after 15 s (waking a
+stopped worker there), a send with images after 30 s, a broadcast after the launch file's
 `broadcast_timeout` (`broadcast.triage_deadline` + 10 s; 30 s when it has none). A stopped `chi note` or `chi
 broadcast` says the note may be partly delivered.
 

data/docs/testing.md

@@ -301,7 +301,8 @@ to install). It refuses when the folder or the branch already exists.
 
 `SAMAGOTCHI_MACOS_BUILD=1 bundle exec rspec spec/desktop` also compiles the macOS helper (`:macos_build`, needs the
 Command Line Tools) and runs `ChiHelper` against a fake kitty and, when a `tmux` is on PATH, a real one (private
-`-L` servers under a temp `TMUX_TMPDIR`, killed after). Without the variable they are filtered out (CI's runs), and
+`-L` servers under a temp `TMUX_TMPDIR`, killed after), and its `--sessions`, `--send-plan` and `--broadcast` seams
+against a fake chi (a `/bin/sh` script as the launch file's argv). Without the variable they are filtered out (CI's runs), and
 `script/affected-specs` doesn't pick them for a Swift change: run them by hand after editing
 `lib/samagotchi/desktop/macos/`.
 

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.123.0
+version: 0.124.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/desktop/macos/App.swift

@@ -5,7 +5,9 @@
 // directly by chi desktop) manages the login item and exits;
 // `ChiHelper --agents list|send` is the agent terminals' seam (AgentTerminal.swift),
 // `ChiHelper --model-pick` the model chooser's (Models.swift),
-// `ChiHelper --broadcast` the Everyone row's (Broadcast.swift).
+// `ChiHelper --broadcast` the Everyone row's (Broadcast.swift),
+// `ChiHelper --sessions` and `--send-plan` the session rows' and their
+// sends' (Sessions.swift).
 import AppKit
 import ServiceManagement
 
@@ -111,6 +113,12 @@ struct ChiHelperMain {
     if args.count >= 2, args[1] == "--broadcast" {
       exit(broadcastCommand(Array(args.dropFirst(2))))
     }
+    if args.count >= 2, args[1] == "--sessions" {
+      exit(sessionsCommand(Array(args.dropFirst(2))))
+    }
+    if args.count >= 2, args[1] == "--send-plan" {
+      exit(sendPlanCommand(Array(args.dropFirst(2))))
+    }
     let app = NSApplication.shared
     let delegate = AppDelegate()
     app.delegate = delegate

data/lib/samagotchi/desktop/macos/ChiRunner.swift

@@ -36,7 +36,8 @@ enum ChiError: Error, CustomStringConvertible {
 }
 
 /// One session from `chi sessions list --format json`: a live one, or a
-/// recent stopped one (listed below the live ones; a message wakes it).
+/// recent stopped one (listed below the live ones; a message wakes it), on
+/// this Mac or on a remote (`chi --remote NAME sessions list`).
 struct LiveSession: Decodable, Identifiable, Equatable {
   let id: String
   let desc: String?
@@ -45,6 +46,9 @@ struct LiveSession: Decodable, Identifiable, Equatable {
   let owner: String?
   let updatedAt: String?
   var recent = false
+  /// The remote it was listed on (set by the helper, never decoded); nil:
+  /// this Mac.
+  var remote: String?
 
   enum CodingKeys: String, CodingKey {
     case id, desc, cwd, busy, owner
@@ -54,7 +58,13 @@ struct LiveSession: Decodable, Identifiable, Equatable {
   /// Only UUID-shaped ids go into chi's argv, so nothing can turn into a flag.
   var valid: Bool { UUID(uuidString: id) != nil }
 
-  var shortCwd: String { cwd.map(Self.shorten) ?? "" }
+  /// The row's key in the selection, ⌘ numbers and the remembered choice:
+  /// "studio:<id>" on a remote, the plain id on this Mac (so a choice
+  /// remembered before remotes still counts).
+  var key: String { remote.map { "\($0):\(id)" } ?? id }
+
+  /// A remote's home may differ from this Mac's: its path stays whole.
+  var shortCwd: String { remote == nil ? cwd.map(Self.shorten) ?? "" : cwd ?? "" }
 
   /// A path with the home folder as "~".
   static func shorten(_ path: String) -> String {
@@ -83,7 +93,43 @@ struct LiveSession: Decodable, Identifiable, Equatable {
   }
 }
 
+/// The remotes `chi remote ls` keeps (`chi remote add`): a name goes into
+/// argv only when it came from that answer and passes chi's own rule.
+enum Remotes {
+  /// One row of `chi remote ls --format json`; the token itself never
+  /// leaves chi, only whether there is one.
+  struct Entry: Decodable {
+    let name: String
+    let token: Bool?
+  }
+
+  /// chi's `Remotes::NAME`: no leading "-", so never a flag.
+  static func valid(_ name: String) -> Bool {
+    name.range(of: "\\A[A-Za-z0-9][A-Za-z0-9_-]{0,39}\\z", options: .regularExpression) != nil
+  }
+
+  /// The names with a token (one without can't reach that chi web), in
+  /// chi's order.
+  static func names(_ entries: [Entry]) -> [String] {
+    var seen = Set<String>()
+    return entries.filter { $0.token == true && valid($0.name) && seen.insert($0.name).inserted }.map(\.name)
+  }
+}
+
+/// A remote's part of the panel: its rows, or why there are none.
+struct RemoteSection: Equatable {
+  let name: String
+  var sessions: [LiveSession] = []
+  /// "studio: no answer within 4 s", or the first line of chi's stderr.
+  var error: String?
+  var loading = true
+}
+
 final class ChiRunner {
+  /// A remote's two lists together: chi's own open timeout is 5 s, so a
+  /// down host is stopped here before chi says anything.
+  static let remoteBudget: TimeInterval = 4
+
   static let supportDir = NSString(string: "~/Library/Application Support/Chi Helper").expandingTildeInPath
   static let launchPath = supportDir + "/launch.json"
 
@@ -125,30 +171,75 @@ final class ChiRunner {
       completion(.failure(.failed("\(error)"))); return
     }
 
+    var env = ProcessInfo.processInfo.environment.merging(config.env ?? [:]) { _, baked in baked }
+    // chi reads CHI_REMOTE for every call without --remote: one from the
+    // shell would send this Mac's rows to a remote. --remote is the only way.
+    env["CHI_REMOTE"] = nil
     ProcessRunner.run(executable: config.argv[0], args: Array(config.argv.dropFirst()) + args,
-                      env: ProcessInfo.processInfo.environment.merging(config.env ?? [:]) { _, baked in baked },
-                      stdin: stdin, timeout: timeout ?? self.timeout, queue: queue, completion: completion)
+                      env: env, stdin: stdin, timeout: timeout ?? self.timeout, queue: queue, completion: completion)
   }
 
   /// The live sessions, oldest started first, then up to +recentCount+
   /// stopped ones, newest first. The live order is by creation so ⌘1…⌘9
   /// stay on their sessions as turns update them; a new one comes last.
   /// A session a chi REPL holds is in neither: it takes no notes or
-  /// messages. A failed second call just leaves "recent" empty.
-  func sessions(recentCount: Int = 3, completion: @escaping (Result<[LiveSession], ChiError>) -> Void) {
-    list(["--live", "--sort", "created_at", "--order", "asc"]) { result in
+  /// messages. A failed second call just leaves "recent" empty. Calls
+  /// back on +queue+ (a headless seam waits on another one).
+  func sessions(recentCount: Int = 3, queue: DispatchQueue = .main,
+                completion: @escaping (Result<[LiveSession], ChiError>) -> Void) {
+    list(Self.liveFlags, queue: queue) { result in
       guard case .success(let live) = result else { completion(result); return }
-      self.list(["--limit", "20"]) { recent in
-        let liveIds = Set(live.map(\.id))
-        let stopped = ((try? recent.get()) ?? [])
-          .filter { $0.owner == nil && !liveIds.contains($0.id) }
-          .prefix(recentCount)
-          .map { session -> LiveSession in var session = session; session.recent = true; return session }
-        completion(.success(live + stopped))
+      self.list(Self.recentFlags, queue: queue) { recent in
+        completion(.success(Self.rows(live: live, recent: recent, recentCount: recentCount)))
       }
     }
   }
 
+  private static let liveFlags = ["--live", "--sort", "created_at", "--order", "asc"]
+  private static let recentFlags = ["--limit", "20"]
+
+  /// The live rows, then up to +recentCount+ of the recent list that are
+  /// neither live nor a REPL's; a failed recent list adds none.
+  private static func rows(live: [LiveSession], recent: Result<[LiveSession], ChiError>, recentCount: Int) -> [LiveSession] {
+    let liveIds = Set(live.map(\.id))
+    let stopped = ((try? recent.get()) ?? [])
+      .filter { $0.owner == nil && !liveIds.contains($0.id) }
+      .prefix(recentCount)
+      .map { session -> LiveSession in var session = session; session.recent = true; return session }
+    return live + stopped
+  }
+
+  /// `chi remote ls --format json`: the remotes with a token, in chi's
+  /// order; none when it fails (an older chi has no `remote`).
+  func remotes(queue: DispatchQueue = .main, completion: @escaping ([String]) -> Void) {
+    run(["remote", "ls", "--format", "json"], queue: queue) { result in
+      guard case .success(let r) = result, r.status == 0, !r.timedOut,
+            let entries = try? JSONDecoder().decode([Remotes.Entry].self, from: Data(r.stdout.utf8)) else {
+        completion([]); return
+      }
+      completion(Remotes.names(entries))
+    }
+  }
+
+  /// A remote's rows as sessions(...) lists this Mac's, each tagged with
+  /// +name+. Its two lists run at once under one budget (each is a chi boot
+  /// and two requests); the failure is the panel's line for that remote.
+  func sessions(remote name: String, recentCount: Int = 3, queue: DispatchQueue = .main,
+                completion: @escaping (Result<[LiveSession], ChiError>) -> Void) {
+    var live: Result<[LiveSession], ChiError>?
+    var recent: Result<[LiveSession], ChiError>?
+    // Both answer on +queue+, one at a time.
+    let finish = {
+      guard let live, let recent else { return }
+      completion(live.map { rows in
+        Self.rows(live: rows, recent: recent, recentCount: recentCount)
+          .map { session -> LiveSession in var session = session; session.remote = name; return session }
+      })
+    }
+    list(Self.liveFlags, remote: name, queue: queue) { live = $0; finish() }
+    list(Self.recentFlags, remote: name, queue: queue) { recent = $0; finish() }
+  }
+
   /// The model a new session starts on (`chi self --model`: the config's
   /// default, as chi resolves it), or nil when none is configured or chi
   /// can't say. Only a single line counts: nothing that looks like a whole
@@ -180,17 +271,38 @@ final class ChiRunner {
     }
   }
 
-  private func list(_ flags: [String], completion: @escaping (Result<[LiveSession], ChiError>) -> Void) {
+  /// @param remote a remote's name: `--remote NAME` first, the remote
+  ///   budget, and its two failure lines (no answer in time, or the first
+  ///   line of chi's stderr: it names the remote and why)
+  private func list(_ flags: [String], remote: String? = nil, queue: DispatchQueue = .main,
+                    completion: @escaping (Result<[LiveSession], ChiError>) -> Void) {
+    let prefix = remote.map { ["--remote", $0] } ?? []
+    let timeout = remote == nil ? self.timeout : Self.remoteBudget
     // Every project's sessions: the helper isn't in any one project (an
     // older chi ignores the flag).
-    run(["sessions", "list"] + flags + ["--scope=all", "--format", "json"]) { result in
+    run(prefix + ["sessions", "list"] + flags + ["--scope=all", "--format", "json"], timeout: timeout,
+        queue: queue) { result in
       switch result {
       case .failure(let error): completion(.failure(error))
       case .success(let r):
-        if r.timedOut { completion(.failure(.failed("chi sessions list took over \(Int(self.timeout)) s"))); return }
+        if r.timedOut {
+          let message = remote.map { "\($0): no answer within \(Int(timeout)) s" } ?? "chi sessions list took over \(Int(timeout)) s"
+          completion(.failure(.failed(message)))
+          return
+        }
         guard r.status == 0, let data = r.stdout.data(using: .utf8),
               let sessions = try? JSONDecoder().decode([LiveSession].self, from: data) else {
           let detail = r.stderr.isEmpty ? r.stdout : r.stderr
+          if let remote {
+            // chi's own line names the remote and why; Ruby's warnings
+            // ("…: warning: …") before it aren't the reason.
+            let line = r.status == 0 ? nil : detail.split(whereSeparator: \.isNewline).map(String.init)
+              .first { !$0.contains("warning:") && !$0.trimmingCharacters(in: .whitespaces).isEmpty }
+            let fallback = r.status == 0 ? "\(remote): chi sessions list answered no session list"
+                                         : "\(remote): chi sessions list failed (exit \(r.status))"
+            completion(.failure(.failed(line ?? fallback)))
+            return
+          }
           completion(.failure(.failed("chi sessions list failed (exit \(r.status)): \(detail.prefix(400))")))
           return
         }

data/lib/samagotchi/desktop/macos/Images.swift

@@ -88,9 +88,10 @@ enum ImageIntake {
   static let sentMaxAge: TimeInterval = 7 * 86_400
 
   /// The paths an agent paste names: an image the helper wrote is copied to
-  /// sentDir first (the send deletes the original), with no spaces in its
-  /// name; a file of the user's is named as it is. Call before any send
-  /// job starts. An image that can't be copied is left out.
+  /// sentDir first (the helper deletes the original after the send; chi's
+  /// send copies what it reads and leaves it), with no spaces in its name;
+  /// a file of the user's is named as it is. Call before any send job
+  /// starts. An image that can't be copied is left out.
   static func keepForPaste(_ images: [PanelImage]) -> [String] {
     images.compactMap { image in
       guard image.temp else { return image.url.path }