samagotchi 0.128.0 → 0.130.0

data/lib/samagotchi/terminal_ui.rb

@@ -716,6 +716,8 @@ module Samagotchi
           max_iterations: max_iterations,
           cancel_controller: cancellation_controller,
           pending_input: method(:drain_steering),
+          # A steering line waits (#steer_line): a running task_wait ends for it.
+          input_waiting: -> { !@pending_input_queue.empty? },
           continue: continue,
           images: images,
           resumed: resumed,

data/lib/samagotchi/tool_declarations.rb

@@ -221,7 +221,7 @@ module Samagotchi
       },
       {
         name: "task_wait",
-        description: "Wait for a background task to finish. Polls every 0.5s until completion, a log pattern matches, or timeout. Timed-out waits include a bounded output tail.",
+        description: "Wait for a background task to finish. Polls every 0.5s until completion, a log pattern matches, a message from the user arrives, or timeout. Timed-out waits include a bounded output tail.",
         parameters: {
           type: "object",
           properties: {

data/lib/samagotchi/tools/builtins.rb

@@ -86,7 +86,8 @@ module Samagotchi
         end,
         TaskWait::NAME => lambda do |call, kctx|
           TaskWait.call(call[:content], timeout: call[:timeout], tail_lines: call[:tail_lines],
-                                        done_pattern: call[:done_pattern], cancelled: cancelled_proc(kctx))
+                                        done_pattern: call[:done_pattern], cancelled: cancelled_proc(kctx),
+                                        message_waiting: input_waiting_proc(kctx))
         end,
         Execute::NAME => lambda do |call, kctx|
           Execute.call(call[:content], cwd: call[:cwd], cancelled: cancelled_proc(kctx), stop_reason: stop_reason_proc(kctx),
@@ -188,6 +189,14 @@ module Samagotchi
         -> { !!peers&.cancelled? }
       end
 
+      # A person's message waits for the turn's next boundary
+      # (Engine#input_waiting?, through its PeerView): a task_wait returns on
+      # it. A kernel whose peers can't tell: never.
+      def input_waiting_proc(kctx)
+        peers = kctx.peers
+        -> { peers.respond_to?(:input_waiting?) && !!peers.input_waiting? }
+      end
+
       # The running turn's stop reason (:signal, :manual, …), nil without one.
       def stop_reason_proc(kctx)
         peers = kctx.peers

data/lib/samagotchi/tools/peers.rb

@@ -23,6 +23,10 @@ module Samagotchi
       def cancelled?
         cancelled.respond_to?(:call) ? !!cancelled.call : !!cancelled
       end
+
+      # A person's message waits for the turn's next boundary: never here
+      # (Engine::PeerView asks the running turn).
+      def input_waiting? = false
     end
   end
 end

data/lib/samagotchi/tools/task_wait.rb

@@ -14,13 +14,23 @@ module Samagotchi
       # A handed-over execute keeps stderr in a log of its own: at most this
       # many of its last lines follow the output tail.
       STDERR_TAIL_LINES_MAX = 10
+      # The note of a wait a waiting message ended (wait_result:
+      # message_waiting); %<id>s is the task's id. "The user" whoever sent
+      # it: the merged message itself names its sender.
+      MESSAGE_WAITING_NOTE = [
+        "note: a message from the user is waiting; the task is STILL RUNNING.",
+        "  Read the message first. To keep waiting after it: task_wait %<id>s. If it is no longer needed: task_stop %<id>s."
+      ].join("\n").freeze
 
       def self.name = NAME
 
       # @param cancelled [#call] true once the user stopped the turn: the
       #   wait returns then, and the task keeps running
+      # @param message_waiting [#call] true once a person's message waits for
+      #   the turn's next boundary (Engine#input_waiting?): the wait returns
+      #   then, so the model reads it, and the task keeps running
       def self.call(task_id, timeout: TIMEOUT_DEFAULT, tail_lines: TAIL_LINES_DEFAULT, done_pattern: nil,
-                    cancelled: -> { false })
+                    cancelled: -> { false }, message_waiting: -> { false })
         timeout = TIMEOUT_DEFAULT if blank?(timeout)
         tail_lines = TAIL_LINES_DEFAULT if blank?(tail_lines)
         timeout = timeout.to_i
@@ -48,6 +58,7 @@ module Samagotchi
           end
 
           return cancelled_response(task_id, tail_lines, started) if cancelled.call
+          return message_waiting_response(task_id, tail_lines, started) if message_waiting.call
 
           break if monotonic_time > deadline
 
@@ -80,6 +91,20 @@ module Samagotchi
       end
       private_class_method :cancelled_response
 
+      # A message waits: the wait ends so the model reads it at the next
+      # boundary. A task that finished meanwhile gives its finished result,
+      # as after a Stop.
+      def self.message_waiting_response(task_id, tail_lines, started)
+        record, error = TaskRuntime.get_record(task_id)
+        return error if error
+        return finished_response(record, tail_lines) unless record.running?
+
+        note = [format(MESSAGE_WAITING_NOTE, id: task_id), "waited: #{(monotonic_time - started).round}s"]
+        format_response(record, wait_result: "message_waiting", output_tail: output_tail(record, tail_lines),
+                                tail_lines: tail_lines, extra: note)
+      end
+      private_class_method :message_waiting_response
+
       # A finished task's text, as task_wait gives it: its status lines and
       # always the log's last lines (a test run's summary, an error), then a
       # stderr_tail when the record has a non-empty one. A task the user

data/lib/samagotchi/turn_state.rb

@@ -5,7 +5,8 @@ require "monitor"
 module Samagotchi
   # A session's turn as other threads see it: whether one runs, its cancel
   # controller and event sink, the plugin steers waiting for its next
-  # boundary, and the activity clock the idle jobs read.
+  # boundary, whether a person's message waits for it (its caller's
+  # input_waiting: probe), and the activity clock the idle jobs read.
   #
   # The turn thread writes it (Engine#begin_turn, #release_turn); the idle
   # scheduler, the bridge's request threads, plugin threads and the UIs
@@ -24,6 +25,8 @@ module Samagotchi
       @sink = nil
       @thread = nil
       @ended = false
+      @input_waiting = nil
+      @input_waiting_warned = false
       @steers = []
       @carried_steers = []
     end
@@ -67,20 +70,24 @@ module Samagotchi
     end
 
     # A turn begins, on the calling thread (the turn's own): running, with
-    # its controller and sink, in one step.
-    def begin!(controller:, sink:)
+    # its controller, sink and input_waiting probe, in one step.
+    # @param input_waiting [#call, nil] true while a person's message waits
+    #   for the turn's next boundary (Engine#input_waiting?); nil: never
+    def begin!(controller:, sink:, input_waiting: nil)
       @lock.synchronize do
         @running = true
         @controller = controller
         @sink = sink
         @thread = Thread.current
         @ended = false
+        @input_waiting = input_waiting
+        @input_waiting_warned = false
         @steers.concat(@carried_steers)
         @carried_steers = []
       end
     end
 
-    # The turn is over: not running, no controller, sink or steers.
+    # The turn is over: not running, no controller, sink, probe or steers.
     # @return [Array<Hash>] the steers it never took ({text:, source:})
     def finish!
       @lock.synchronize do
@@ -89,6 +96,7 @@ module Samagotchi
         @sink = nil
         @thread = nil
         @ended = false
+        @input_waiting = nil
         @steers.tap { @steers = [] }
       end
     end
@@ -118,6 +126,17 @@ module Samagotchi
       end
     end
 
+    # @return [#call, nil] the running turn's input_waiting probe (called
+    #   outside the lock), nil outside a turn or for a turn given none
+    def input_waiting
+      @lock.synchronize { @running ? @input_waiting : nil }
+    end
+
+    # A probe failed: true the first time in a turn (warn then), false after.
+    def input_waiting_failed!
+      @lock.synchronize { !@input_waiting_warned.tap { @input_waiting_warned = true } }
+    end
+
     # Cancel the running turn, if any (outside the lock).
     # @return [Boolean] whether a cancellation was triggered
     def cancel!(reason)

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.128.0"
+  VERSION = "0.130.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -118,6 +118,9 @@ module Samagotchi
       # Seconds GET /api/models waits for the hosts' lists before answering
       # with what it has (the listing goes on and fills the registry's cache).
       MODELS_WAIT_TIMEOUT = 4.0
+      # The one refusal for an update operation (an install, a workers
+      # restart, a chi web restart) asked while another one runs: 409 update_running.
+      UPDATE_RUNNING = "a chi update operation is already running; try again when it ends"
       EVENTS_POLL = 1.0
 
       # A callable the event loops ask whether the server still runs;
@@ -456,12 +459,14 @@ module Samagotchi
       # The request's Principal, as #route resolved it.
       def principal(req) = req.env.fetch(PRINCIPAL_ENV)
 
-      # LAN mode, a peer that isn't this machine (the peer is the socket's
-      # address, REMOTE_ADDR: never X-Forwarded-For or req.ip, which trust
-      # headers a phone could send): every route needs the access token, as
-      # the chi_token cookie or an Authorization: Bearer header. The page
-      # with ?token= trades it for the cookie and a 303 to itself without
-      # it, so the token doesn't stay in the phone's history.
+      # LAN mode: every route needs the access token, from a phone and from
+      # this machine's loopback too (a pair participant's shell runs here),
+      # as the chi_token cookie or an Authorization: Bearer header; only
+      # GATE_FREE_PATHS and chi's token-less /api/info probe
+      # (ProxyGate#probe_info?) are answered without it. The page with
+      # ?token= (or a link's #code=, POST /api/token) trades it for the
+      # cookie and a 303 to itself without it, so the token doesn't stay in
+      # the browser's history.
       # @return [Array(Principal, nil), Array(nil, Array)] the request's
       #   principal (#principal_for), or the response that refuses it
       def token_gate(req)
@@ -486,9 +491,9 @@ module Samagotchi
       # the access token; a participant for a live grant's token (a chp_
       # one, looked up only when no owner token was given), wherever the
       # request comes from, this machine's loopback too; with neither, the
-      # owner for a peer the gate doesn't ask (no LAN mode, or this
-      # machine's loopback), else nil. An ended or unknown grant's token is
-      # nil anywhere: it never falls back to the owner.
+      # owner only on a chi web that asks no token (loopback only: no LAN
+      # mode, no web.public_url), else nil. An ended or unknown grant's
+      # token is nil anywhere: it never falls back to the owner.
       # @return [Principal, nil]
       # With web.public_url (ProxyGate) every request needs a token, and a
       # proxied one is #proxied_principal's.
@@ -592,11 +597,10 @@ module Samagotchi
         "#{token_cookie_name(req)}=; #{token_cookie_attributes(req).sub(/Max-Age=\d+/, "Max-Age=0")}"
       end
 
-      def token_required?(req)
-        return true if @public_url
-
-        @lan && !LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s)
-      end
+      # Whether the gate asks this request for a token: on a chi web on the
+      # LAN or behind a proxy, every request does, this machine's loopback
+      # too. Only a loopback-only chi web takes loopback as the owner.
+      def token_required?(_req) = !(@public_url || @lan).nil?
 
       # The page opened with ?token= (a gated request, or a grant's token
       # anywhere): its token is traded for the cookie, whatever else the
@@ -702,7 +706,7 @@ module Samagotchi
             false
           end
         end
-        return error_response(409, "update_running", "an update is already running") if already_running
+        return error_response(409, "update_running", UPDATE_RUNNING) if already_running
 
         @hub.publish_update(state: "running", rows: [], operation: "install", version: version)
         Thread.new { perform_update(version) }
@@ -774,7 +778,7 @@ module Samagotchi
             false
           end
         end
-        return error_response(409, "update_running", "a chi update operation is already running") if already_running
+        return error_response(409, "update_running", UPDATE_RUNNING) if already_running
 
         @hub.publish_update(state: "running", rows: [], operation: "workers")
         Thread.new { perform_worker_restarts }
@@ -834,7 +838,7 @@ module Samagotchi
           @update_running = true # held for good once restarting: the exec ends this process
           false
         end
-        return error_response(409, "update_running", "a chi update operation is running; restart chi web when it ends") if busy
+        return error_response(409, "update_running", UPDATE_RUNNING) if busy
 
         case @restart_web.call
         when true then return json_response(202, { state: "restarting" })
@@ -900,7 +904,11 @@ module Samagotchi
 
       def unauthorized_detail(req, reason)
         return "chi web behind the proxy: #{reason || "needs its access token"}" if proxied?(req)
-        return "chi web on the LAN needs its access token" unless @public_url
+
+        unless @public_url
+          here = LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s)
+          return "chi web on the LAN needs its access token#{", on this machine too" if here}"
+        end
 
         detail = "chi web with web.public_url needs its access token, on this machine too"
         direct_public?(req) ? "#{detail}; open its public address #{@public_url.origin}/ instead" : detail
@@ -938,7 +946,7 @@ module Samagotchi
       # the proxy too.
       def self.public_unauthorized_page(page)
         page.sub('<form method="get" action="/">', '<form method="post" action="/api/token">')
-            .sub("Open the link chi web printed in its terminal (LAN, or Proxied behind an\nauth proxy), or scan its QR code.",
+            .sub("Open the link chi web printed in its terminal (Local on this machine, LAN, or\nProxied behind an auth proxy), or scan its QR code.",
                  "Open the Proxied link chi web printed in its terminal (it works once; chi web again prints a new " \
                  "one), or paste the token from its web-token file.")
       end
@@ -958,8 +966,8 @@ module Samagotchi
         </style></head>
         <body>
         <h1>chi web</h1>
-        <p>This page needs chi web's access token. Open the link chi web printed in its terminal (LAN, or Proxied behind an
-        auth proxy), or scan its QR code.</p>
+        <p>This page needs chi web's access token. Open the link chi web printed in its terminal (Local on this machine, LAN, or
+        Proxied behind an auth proxy), or scan its QR code.</p>
         <p id="trade" hidden></p>
         <form method="get" action="/">
           <label for="token">Or paste the token:</label>
@@ -1721,8 +1729,7 @@ module Samagotchi
                            outcome.is_a?(WorkerLink::Leaving) || outcome.is_a?(WorkerLink::Stale) ||
                              outcome.is_a?(WorkerLink::Skew) ||
                              (outcome.is_a?(WorkerLink::Starting) && outcome.stuck)
-                         end,
-                         host: DEFAULT_HOST)
+                         end)
       end
 
       def stream_link_error(id, link)
@@ -1741,7 +1748,7 @@ module Samagotchi
       def stream_open_error(id, outcome)
         return error_response(503, "not_live", WorkerLink.unanswered(id)) if outcome.is_a?(BridgeClient::StreamOpen::Unreachable)
         return error_response(503, "not_live", WorkerLink.not_live(id)) if outcome.reason == :unknown_session
-        return error_response(502, "bridge_secret", BridgeSecret.refused(id)) if outcome.reason == :bridge_secret
+        return error_response(502, BridgeSecret::ERROR, BridgeSecret.refused(id)) if outcome.reason == :bridge_secret
 
         error_response(502, "bridge_error", outcome.detail || "the session's worker answered #{outcome.status}")
       end
@@ -1752,7 +1759,7 @@ module Samagotchi
       # @return [WorkerLink::Live, WorkerLink::None, WorkerLink::Stale]
       def worker_link(session_id)
         dir = @session_class.session_dir(session_id, state_dir: default_state_dir)
-        WorkerLink.resolve(dir, unlink: true, host: DEFAULT_HOST)
+        WorkerLink.resolve(dir, unlink: true)
       rescue StandardError
         WorkerLink::None.new
       end

data/lib/samagotchi/web/proxy_gate.rb

@@ -124,13 +124,15 @@ module Samagotchi
         participant_principal(req, grant_tokens, identity: identity, proxied: true)
       end
 
-      # chi's own probe of a chi web behind a proxy (InfoProbe: a second chi
-      # web, chi share, chi update) sends no token: GET /api/info from this
+      # chi's own probe of a chi web that asks this machine for its token
+      # (behind a proxy, or on the LAN: InfoProbe from a second chi web, chi
+      # share, chi update, chi self) sends no token: GET /api/info from this
       # machine, not through the proxy, with no token at all, gets the
-      # fields it checks (nothing secret), so no probe ever hands the token
-      # to whatever listens on the port.
+      # fields it checks (nothing secret: its start folder is a path on this
+      # machine), so no probe ever hands the token to whatever listens on
+      # the port. Any token or cookie makes it an ordinary request.
       def probe_info?(req)
-        return false unless @public_url && req.get? && req.path_info == "/api/info"
+        return false unless (@public_url || @lan) && req.get? && req.path_info == "/api/info"
         return false unless App::LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s) && !proxied?(req)
 
         req.get_header("HTTP_AUTHORIZATION").nil? && req.get_header("HTTP_COOKIE").nil?
@@ -138,7 +140,7 @@ module Samagotchi
 
       def probe_info
         json_response(200, { app: "chi-web", version: Samagotchi::VERSION, pid: Process.pid, features: App::INFO_FEATURES,
-                             lan: @lan && @lan[:ip] })
+                             lan: @lan && @lan[:ip], start_dir: start_dir })
       end
 
       def proxy_refuse(req, reason)

data/lib/samagotchi/web/public/app.js

@@ -60,7 +60,7 @@ import { createSystemOneWrongAction } from "./system_one_wrong.js";
 import { appendQuote } from "./annotations.js";
 import { applyComposerText, applyRowTemplate, fetchApply } from "./review_apply.js";
 import { CHECK_NOT_ON_PAGE, nameVerdictCards, ownerCheckHash } from "./verdict_card.js";
-import { freshURL, placeVerdictWithFresh, settleRunning } from "./verdict_fresh.js";
+import { freshURL, placeVerdictWithFresh, redrawFresh, settleRunning } from "./verdict_fresh.js";
 import { authorBadge, nameUnnamedBadges } from "./participant_names.js";
 import { parsePresets } from "./annotate_presets.js";
 import { createAnnotateBar } from "./annotate_bar.js";
@@ -590,8 +590,13 @@ function copyUpdateCommand(command) {
 function followSelectedSession(sess) {
   current.owner = sess.owner || null;
   current.workerVersion = sess.worker_version || null;
+  const verifyWas = verifyWorkerUnavailable(current.workerFeatures, current.bridgeUp);
   current.workerFeatures = Array.isArray(sess.worker_features) ? sess.worker_features : [];
   current.bridgeUp = sess.bridge_up === true;
+  // The Verify gate flipped (a restart brought the feature): the cards' Verify fresh part follows.
+  if (verifyWas !== verifyWorkerUnavailable(current.workerFeatures, current.bridgeUp)) {
+    redrawFresh(historyEl, verifyFreshState());
+  }
   const streaming = !!(streamControl && streamControl.live);
   if (!streaming) current.status = sess.status;
   updateInfoBar();
@@ -1356,6 +1361,7 @@ function placeVerdict(record) {
 
 // The owner's Verify fresh on an unclear verdict's card (verdict_fresh.js):
 // always theirs to start; its running check links to the child's session.
+const verifyFreshErrors = {};
 function verifyFreshState() {
   const id = selected;
   const unavailable = verifyWorkerUnavailable(current.workerFeatures, current.bridgeUp);
@@ -1363,6 +1369,7 @@ function verifyFreshState() {
   return {
     verdicts: current.verdicts || [],
     running: current.verifyFresh,
+    errors: verifyFreshErrors,
     canStart: !!id && !unavailable,
     unavailableReason: unavailable ? VERIFY_UNAVAILABLE : null,
     start: async (of) => {

data/lib/samagotchi/web/public/participant.js

@@ -434,12 +434,14 @@ function renderThread() {
 // participant starts one while their grant could run a turn now
 // (can_comment); the owner looking through the participant view never
 // does, and no one here gets a link to the child's session.
+const freshErrors = {};
 function verifyFreshState() {
   if (!Array.isArray(data.fresh_running)) data.fresh_running = [];
   const unavailable = data.session?.verify_unavailable === true;
   return {
     verdicts: data.verdicts || [],
     running: data.fresh_running,
+    errors: freshErrors,
     canStart: !unavailable && !ownerView && !ended && !!data.viewer?.can_comment,
     unavailableReason: unavailable ? VERIFY_UNAVAILABLE : null,
     start: async (of) => {

data/lib/samagotchi/web/public/verdict_fresh.js

@@ -29,7 +29,8 @@ export function settleRunning(running, record) {
 // Places a session verdict as the pages draw them: an original verdict's
 // card (verdict_card.js) with its Verify fresh part, or a fresh verdict on
 // its original's card. +fresh+: {verdicts (all of the session's), running
-// (the page's own array; a start adds to it), canStart, start(of) → Promise
+// (the page's own array; a start adds to it), errors (the page's own
+// object, check id → the last start error, so a redraw shows it again), canStart, start(of) → Promise
 // of {ok, child_id, error}, childHref(id) → a link to the child or null}.
 export function placeVerdictWithFresh(root, record, opts = {}, fresh = {}) {
   if (record?.fresh) {
@@ -43,6 +44,11 @@ export function placeVerdictWithFresh(root, record, opts = {}, fresh = {}) {
   return card;
 }
 
+// Every verdict card under +root+ drawn again from +fresh+ (the gate changed).
+export function redrawFresh(root, fresh = {}) {
+  for (const card of root?.querySelectorAll?.(".verify-verdict") || []) renderFresh(card, fresh);
+}
+
 // The card's Verify fresh part, drawn again from +fresh+: the fresh
 // verdicts, the running check, else the button (an unclear verdict, and a
 // viewer who could run a turn now).
@@ -100,10 +106,11 @@ export function renderFresh(card, fresh = {}) {
     part.append(button);
   }
 
-  if (card.dataset.freshError) {
+  const error = (fresh.errors ||= {})[of];
+  if (error) {
     const line = doc.createElement("p");
     line.className = "verify-fresh-error";
-    line.textContent = card.dataset.freshError;
+    line.textContent = error;
     part.append(line);
   }
   if (part.childNodes.length) card.append(part);
@@ -120,12 +127,12 @@ async function startFresh(card, button, fresh) {
     result = { ok: false, error: error?.message };
   }
   if (result?.ok) {
-    delete card.dataset.freshError;
+    if (fresh.errors) delete fresh.errors[of];
     if (fresh.running && !fresh.running.some((entry) => runningOf(entry) === of)) {
       fresh.running.push(result.child_id ? { of, child_id: result.child_id } : of);
     }
   } else {
-    card.dataset.freshError = result?.error || "Couldn't start a fresh check.";
+    (fresh.errors ||= {})[of] = result?.error || "Couldn't start a fresh check.";
   }
   renderFresh(card, fresh);
 }

data/lib/samagotchi/web/server.rb

@@ -118,11 +118,15 @@ module Samagotchi
           puts "chi web already runs on port #{port} (pid #{found["pid"]}): #{url}"
           other_start = start_given && other_start_line(found["start_dir"], start_dir)
           puts other_start if other_start
-          puts running_lan_lines(found["lan"], port) if found["lan"]
           running_public = public_url || Running.live_public_url(probe: ->(at) { probe(host, at) })
+          # On the LAN this machine's page needs the token too: the link
+          # printed and opened here carries an owner's one-time code.
+          here = found["lan"] && !running_public && Token.read(Token.path) ? local_owner_link(url) : nil
+          puts local_lines(here) if here
+          puts running_lan_lines(found["lan"], port) if found["lan"]
           puts running_public_lines(running_public) if running_public
           puts lan_off_line(setting) if new_token && !found["lan"]
-          open_url(url) if open_browser
+          open_url(here ? local_owner_link(url) : url) if open_browser
           0
         when :other
           warn in_use_message(port)
@@ -388,6 +392,10 @@ module Samagotchi
           on_bound&.call
           record_running(running_path, port, public_url)
           puts "Chi Web on #{url} (public: #{File.expand_path("public", __dir__)})"
+          # On the LAN (no web.public_url) this machine's page needs the
+          # token too: a one-time owner's code in the link instead.
+          local = lan && !public_url
+          puts local_lines(local_owner_link(url, codes: owner_codes(state_dir))) if local
           puts lan_lines(ip: lan.ip, port: port, token: Token.read(token_path), others: lan.others, public: lan.public) if lan
           if public_url
             puts public_lines(public_url, token: Token.read(token_path), codes: owner_codes(state_dir), notes: public_notes)
@@ -395,8 +403,12 @@ module Samagotchi
           puts "Press Ctrl-C to stop."
           $stdout.flush # a log file isn't line-buffered
           if open_browser
-            # With web.public_url the page opens through the proxy.
-            open_target = public_url ? public_url.link(owner_codes(state_dir).issue(kind: :owner, ttl: LinkCodes::OWNER_TTL)) : url
+            # With web.public_url the page opens through the proxy; on the
+            # LAN with a one-time owner's code (#code=, its own).
+            open_target = if public_url then public_url.link(owner_codes(state_dir).issue(kind: :owner, ttl: LinkCodes::OWNER_TTL))
+                          elsif local then local_owner_link(url, codes: owner_codes(state_dir))
+                          else url
+                          end
             Thread.new do
               sleep 0.8
               open_url(open_target)
@@ -518,6 +530,19 @@ module Samagotchi
         lines
       end
 
+      # This machine's page on the LAN (web.host lan, no web.public_url),
+      # whose loopback needs the token too: +url+ with an owner's one-time
+      # code in its fragment (token_fragment.js trades it for the cookie on
+      # 127.0.0.1), never the token. One code per link.
+      def self.local_owner_link(url, codes: owner_codes)
+        "#{url}#code=#{codes.issue(kind: :owner, ttl: LinkCodes::OWNER_TTL)}"
+      end
+
+      def self.local_lines(link)
+        ["Local: #{link}   ← opens chi web as you once, within #{LinkCodes::OWNER_TTL / 60} minutes " \
+         "(chi web again prints a new one; the LAN link works here too)"]
+      end
+
       # The owner's one-time link codes, next to the grants.
       def self.owner_codes(state_dir = nil) = LinkCodes.for_grants(Grants.path(state_dir: state_dir))