samagotchi 0.129.0 → 0.130.1

data/lib/samagotchi/system_one/self_protect.rb

@@ -3,7 +3,8 @@
 require_relative "../config"
 require_relative "../memory_paths"
 require_relative "../paths"
-require_relative "../guardrails/protected_paths"
+require_relative "../guardrails/chi_dirs"
+require_relative "../guardrails/path_resolve"
 require_relative "../guardrails/parent_approvals"
 require_relative "../guardrails/shell_lex"
 require_relative "../guardrails/shell_paths"
@@ -17,10 +18,12 @@ module Samagotchi
     # "System 1"). The memories dir is deliberately not one of them:
     # reading and appending a memory file stays eligible.
     #
-    # A shell command's words are resolved as Guardrails::ShellPaths
-    # resolves them (cd chains, ~, $HOME and the XDG dirs, symlinks, `..`
-    # both ways), under chi's env and the call's env: when the caller hands
-    # its Targets; one landing in chi's dirs outside the memories refuses.
+    # A file tool's paths and a shell command's words are judged against
+    # the same dirs (.chi_dirs: chi's whole state dir among them). The
+    # words are resolved as Guardrails::ShellPaths resolves them (cd
+    # chains, ~, $HOME and the XDG dirs, symlinks, `..` both ways), under
+    # chi's env and the call's env: when the caller hands its Targets; one
+    # landing in chi's dirs outside the memories refuses.
     # The memories text is taken out of the command (the exemption) only
     # when its text shows no climb (CLIMB: a `..`, a `$`, backticks, a `~`
     # other than the home one, `cd -`) and every word either resolved or is
@@ -77,6 +80,7 @@ module Samagotchi
         command = fetch(approval, :command).to_s
         words = command.empty? ? nil : words(command, cwd: fetch(approval, :cwd), targets: targets)
         return true if words&.chi
+        return true if chi_paths?(approval)
         # The test that makes an ask user_only (ParentApprovals#chi_files?:
         # chi's dirs as the command spells them), minus the memories.
         return true if Guardrails::ParentApprovals.chi_files?(beyond_memories(approval, exempt: exempt?(command, words)))
@@ -84,14 +88,28 @@ module Samagotchi
         command.match?(DEFAULT_STATE_TEXT)
       end
 
+      # Whether a path of the approval lands in chi's dirs (#chi_dirs: its
+      # whole state dir too, as a command's words are judged) outside the
+      # memories dir, or in its installed bundles.
+      def chi_paths?(approval)
+        memories = Guardrails::PathResolve.real(MemoryPaths.system_dir)
+        bundles = Guardrails::PathResolve.real(MemoryPaths.bundles_dir)
+        dirs = chi_dirs
+        Array(fetch(approval, :paths)).map(&:to_s).reject(&:empty?).any? do |path|
+          Guardrails::PathResolve.reals(path).any? do |real|
+            dirs.any? { |dir| Guardrails::PathResolve.within?(real, dir) } && !memory?(real, memories, bundles)
+          end
+        end
+      end
+
       # The approval's facts without what is in the memories dir (not its
       # installed bundles): the paths under it, and its spellings in the
       # command when +exempt+ (.exempt?).
       def beyond_memories(approval, exempt:)
-        memories = Guardrails::ProtectedPaths.real(MemoryPaths.system_dir)
-        bundles = Guardrails::ProtectedPaths.real(MemoryPaths.bundles_dir)
+        memories = Guardrails::PathResolve.real(MemoryPaths.system_dir)
+        bundles = Guardrails::PathResolve.real(MemoryPaths.bundles_dir)
         paths = Array(fetch(approval, :paths)).map(&:to_s).reject do |path|
-          Guardrails::ProtectedPaths.reals(path).all? { |real| memory?(real, memories, bundles) }
+          Guardrails::PathResolve.reals(path).all? { |real| memory?(real, memories, bundles) }
         end
         command = fetch(approval, :command).to_s
         command = command.gsub(memories_text) { |text| text.include?("/.bundles") ? text : "" } if exempt
@@ -107,8 +125,8 @@ module Samagotchi
       # The command's words resolved (ShellPaths::Walk) from +cwd+ (else
       # this process's dir) under each of the call's shell envs: Words.
       def words(command, cwd:, targets:)
-        memories = Guardrails::ProtectedPaths.real(MemoryPaths.system_dir)
-        bundles = Guardrails::ProtectedPaths.real(MemoryPaths.bundles_dir)
+        memories = Guardrails::PathResolve.real(MemoryPaths.system_dir)
+        bundles = Guardrails::PathResolve.real(MemoryPaths.bundles_dir)
         dirs = chi_dirs
         tokens = Guardrails::ShellLex.lex(command)
         plain = !Guardrails::ShellLex.unterminated?(command) &&
@@ -124,8 +142,8 @@ module Samagotchi
             walk.step(simple).each do |word, path|
               next plain &&= known && data?(word) unless path
 
-              chi ||= Guardrails::ProtectedPaths.reals(path).any? do |real|
-                dirs.any? { |dir| Guardrails::ShellPaths.within?(real, dir) } && !memory?(real, memories, bundles)
+              chi ||= Guardrails::PathResolve.reals(path).any? do |real|
+                dirs.any? { |dir| Guardrails::PathResolve.under?(real, dir) } && !memory?(real, memories, bundles)
               end
             end
           end
@@ -148,15 +166,12 @@ module Samagotchi
       end
 
       # chi's own dirs (ParentApprovals.chi_dirs) and its whole state dir
-      # (DEFAULT_STATE_TEXT's), resolved.
-      def chi_dirs
-        [*Guardrails::ParentApprovals.chi_dirs, Paths.state_dir]
-          .map { |dir| Guardrails::ProtectedPaths.real(dir.to_s.chomp("/")) }.reject(&:empty?).uniq
-      end
+      # (DEFAULT_STATE_TEXT's), resolved (Guardrails::ChiDirs.self_protect).
+      def chi_dirs = Guardrails::ChiDirs.self_protect
 
       # Whether +real+ is in the memories dir and not in its installed bundles.
       def memory?(real, memories, bundles)
-        Guardrails::ProtectedPaths.within?(real, memories) && !Guardrails::ProtectedPaths.within?(real, bundles)
+        Guardrails::PathResolve.within?(real, memories) && !Guardrails::PathResolve.within?(real, bundles)
       end
 
       # The memories dir as a command spells it: the default
@@ -164,7 +179,7 @@ module Samagotchi
       # rest of that shell word.
       def memories_text
         dir = ConfigFile.config_dir
-        prefixes = [".config/samagotchi", dir, Guardrails::ProtectedPaths.real(dir)]
+        prefixes = [".config/samagotchi", dir, Guardrails::PathResolve.real(dir)]
                    .map { |prefix| Regexp.escape(prefix.to_s.chomp("/")) }.uniq
         word = WORD_END.sub("[", "[^")
         Regexp.new("(?:#{prefixes.join("|")})/memories(?=/|#{WORD_END}|\\z)(?:/#{word}*)?")

data/lib/samagotchi/terminal_ui.rb

@@ -716,6 +716,8 @@ module Samagotchi
           max_iterations: max_iterations,
           cancel_controller: cancellation_controller,
           pending_input: method(:drain_steering),
+          # A steering line waits (#steer_line): a running task_wait ends for it.
+          input_waiting: -> { !@pending_input_queue.empty? },
           continue: continue,
           images: images,
           resumed: resumed,

data/lib/samagotchi/tool_declarations.rb

@@ -221,7 +221,7 @@ module Samagotchi
       },
       {
         name: "task_wait",
-        description: "Wait for a background task to finish. Polls every 0.5s until completion, a log pattern matches, or timeout. Timed-out waits include a bounded output tail.",
+        description: "Wait for a background task to finish. Polls every 0.5s until completion, a log pattern matches, a message from the user arrives, or timeout. Timed-out waits include a bounded output tail.",
         parameters: {
           type: "object",
           properties: {

data/lib/samagotchi/tools/builtins.rb

@@ -86,7 +86,8 @@ module Samagotchi
         end,
         TaskWait::NAME => lambda do |call, kctx|
           TaskWait.call(call[:content], timeout: call[:timeout], tail_lines: call[:tail_lines],
-                                        done_pattern: call[:done_pattern], cancelled: cancelled_proc(kctx))
+                                        done_pattern: call[:done_pattern], cancelled: cancelled_proc(kctx),
+                                        message_waiting: input_waiting_proc(kctx))
         end,
         Execute::NAME => lambda do |call, kctx|
           Execute.call(call[:content], cwd: call[:cwd], cancelled: cancelled_proc(kctx), stop_reason: stop_reason_proc(kctx),
@@ -188,6 +189,14 @@ module Samagotchi
         -> { !!peers&.cancelled? }
       end
 
+      # A person's message waits for the turn's next boundary
+      # (Engine#input_waiting?, through its PeerView): a task_wait returns on
+      # it. A kernel whose peers can't tell: never.
+      def input_waiting_proc(kctx)
+        peers = kctx.peers
+        -> { peers.respond_to?(:input_waiting?) && !!peers.input_waiting? }
+      end
+
       # The running turn's stop reason (:signal, :manual, …), nil without one.
       def stop_reason_proc(kctx)
         peers = kctx.peers

data/lib/samagotchi/tools/execute.rb

@@ -85,7 +85,10 @@ module Samagotchi
       # @param stop_reason [#call] the stop's reason (:signal: a signal to
       #   chi, :session_stopped: a session stop, which the result then names
       #   instead of the user)
-      # @param env [Hash, nil] added to the command's environment
+      # @param env [Hash, nil] added to the command's environment, over
+      #   chi's Ruby/Bundler variables scrubbed as task_create scrubs them
+      #   (TaskRuntime.sanitized_spawn_env); chi's callers build it, so it
+      #   may set those keys (task_create refuses them from the model)
       # @param on_timeout [Symbol, String, nil] :task or :kill (ON_TIMEOUT);
       #   nil reads execute.on_timeout
       def self.call(command, cwd: nil, cancelled: -> { false }, stop_reason: -> {}, env: nil, on_timeout: nil)
@@ -267,7 +270,7 @@ module Samagotchi
         # file, and each write lands at the end.
         ios = logs.map { |path| File.open(path, "a") }
         ios.each { |io| io.flock(File::LOCK_SH) }
-        ProcessGroup.spawn(env || {}, *Shell.argv(TaskRuntime.wrapped_shell_command(command, exit_code_path)),
+        ProcessGroup.spawn(TaskRuntime.sanitized_spawn_env.merge(env || {}), *Shell.argv(TaskRuntime.wrapped_shell_command(command, exit_code_path)),
                            chdir: cwd, in: File::NULL, out: ios[0], err: ios[1])
       ensure
         ios&.each(&:close)

data/lib/samagotchi/tools/peers.rb

@@ -23,6 +23,10 @@ module Samagotchi
       def cancelled?
         cancelled.respond_to?(:call) ? !!cancelled.call : !!cancelled
       end
+
+      # A person's message waits for the turn's next boundary: never here
+      # (Engine::PeerView asks the running turn).
+      def input_waiting? = false
     end
   end
 end

data/lib/samagotchi/tools/task_runtime.rb

@@ -445,9 +445,11 @@ module Samagotchi
         "trap #{Shellwords.escape(write)} EXIT\n#{command}\n"
       end
 
+      # chi's own Ruby/Bundler setup, kept out of a command's environment
+      # (execute and task_create both spawn with it): run under `bundle
+      # exec`, chi would otherwise hand a project's `ruby -e` or
+      # `bundle exec` its Gemfile (RUBYOPT=-rbundler/setup, BUNDLE_GEMFILE).
       def sanitized_spawn_env
-        # Running from temporary directories can inherit Bundler-specific env
-        # (for example RUBYOPT=-rbundler/setup) that breaks plain `ruby -e`.
         {
           "RUBYOPT" => sanitized_rubyopt,
           "RUBYLIB" => nil,

data/lib/samagotchi/tools/task_wait.rb

@@ -14,13 +14,23 @@ module Samagotchi
       # A handed-over execute keeps stderr in a log of its own: at most this
       # many of its last lines follow the output tail.
       STDERR_TAIL_LINES_MAX = 10
+      # The note of a wait a waiting message ended (wait_result:
+      # message_waiting); %<id>s is the task's id. "The user" whoever sent
+      # it: the merged message itself names its sender.
+      MESSAGE_WAITING_NOTE = [
+        "note: a message from the user is waiting; the task is STILL RUNNING.",
+        "  Read the message first. To keep waiting after it: task_wait %<id>s. If it is no longer needed: task_stop %<id>s."
+      ].join("\n").freeze
 
       def self.name = NAME
 
       # @param cancelled [#call] true once the user stopped the turn: the
       #   wait returns then, and the task keeps running
+      # @param message_waiting [#call] true once a person's message waits for
+      #   the turn's next boundary (Engine#input_waiting?): the wait returns
+      #   then, so the model reads it, and the task keeps running
       def self.call(task_id, timeout: TIMEOUT_DEFAULT, tail_lines: TAIL_LINES_DEFAULT, done_pattern: nil,
-                    cancelled: -> { false })
+                    cancelled: -> { false }, message_waiting: -> { false })
         timeout = TIMEOUT_DEFAULT if blank?(timeout)
         tail_lines = TAIL_LINES_DEFAULT if blank?(tail_lines)
         timeout = timeout.to_i
@@ -48,6 +58,7 @@ module Samagotchi
           end
 
           return cancelled_response(task_id, tail_lines, started) if cancelled.call
+          return message_waiting_response(task_id, tail_lines, started) if message_waiting.call
 
           break if monotonic_time > deadline
 
@@ -80,6 +91,20 @@ module Samagotchi
       end
       private_class_method :cancelled_response
 
+      # A message waits: the wait ends so the model reads it at the next
+      # boundary. A task that finished meanwhile gives its finished result,
+      # as after a Stop.
+      def self.message_waiting_response(task_id, tail_lines, started)
+        record, error = TaskRuntime.get_record(task_id)
+        return error if error
+        return finished_response(record, tail_lines) unless record.running?
+
+        note = [format(MESSAGE_WAITING_NOTE, id: task_id), "waited: #{(monotonic_time - started).round}s"]
+        format_response(record, wait_result: "message_waiting", output_tail: output_tail(record, tail_lines),
+                                tail_lines: tail_lines, extra: note)
+      end
+      private_class_method :message_waiting_response
+
       # A finished task's text, as task_wait gives it: its status lines and
       # always the log's last lines (a test run's summary, an error), then a
       # stderr_tail when the record has a non-empty one. A task the user

data/lib/samagotchi/turn_state.rb

@@ -5,7 +5,8 @@ require "monitor"
 module Samagotchi
   # A session's turn as other threads see it: whether one runs, its cancel
   # controller and event sink, the plugin steers waiting for its next
-  # boundary, and the activity clock the idle jobs read.
+  # boundary, whether a person's message waits for it (its caller's
+  # input_waiting: probe), and the activity clock the idle jobs read.
   #
   # The turn thread writes it (Engine#begin_turn, #release_turn); the idle
   # scheduler, the bridge's request threads, plugin threads and the UIs
@@ -24,6 +25,8 @@ module Samagotchi
       @sink = nil
       @thread = nil
       @ended = false
+      @input_waiting = nil
+      @input_waiting_warned = false
       @steers = []
       @carried_steers = []
     end
@@ -67,20 +70,24 @@ module Samagotchi
     end
 
     # A turn begins, on the calling thread (the turn's own): running, with
-    # its controller and sink, in one step.
-    def begin!(controller:, sink:)
+    # its controller, sink and input_waiting probe, in one step.
+    # @param input_waiting [#call, nil] true while a person's message waits
+    #   for the turn's next boundary (Engine#input_waiting?); nil: never
+    def begin!(controller:, sink:, input_waiting: nil)
       @lock.synchronize do
         @running = true
         @controller = controller
         @sink = sink
         @thread = Thread.current
         @ended = false
+        @input_waiting = input_waiting
+        @input_waiting_warned = false
         @steers.concat(@carried_steers)
         @carried_steers = []
       end
     end
 
-    # The turn is over: not running, no controller, sink or steers.
+    # The turn is over: not running, no controller, sink, probe or steers.
     # @return [Array<Hash>] the steers it never took ({text:, source:})
     def finish!
       @lock.synchronize do
@@ -89,6 +96,7 @@ module Samagotchi
         @sink = nil
         @thread = nil
         @ended = false
+        @input_waiting = nil
         @steers.tap { @steers = [] }
       end
     end
@@ -118,6 +126,17 @@ module Samagotchi
       end
     end
 
+    # @return [#call, nil] the running turn's input_waiting probe (called
+    #   outside the lock), nil outside a turn or for a turn given none
+    def input_waiting
+      @lock.synchronize { @running ? @input_waiting : nil }
+    end
+
+    # A probe failed: true the first time in a turn (warn then), false after.
+    def input_waiting_failed!
+      @lock.synchronize { !@input_waiting_warned.tap { @input_waiting_warned = true } }
+    end
+
     # Cancel the running turn, if any (outside the lock).
     # @return [Boolean] whether a cancellation was triggered
     def cancel!(reason)

data/lib/samagotchi/update_command.rb

@@ -250,9 +250,17 @@ module Samagotchi
       return row.tap { |r| r.status = "not installed" } unless helper.installed?
 
       row.from = helper.app_version
+      if (problem = helper.launch_problem)
+        return failed(row, problem)
+      end
+
+      if helper.launch_newer?
+        return up_to_date(row).tap { |r| r.status += " (kept: chi #{helper.launch_version} set it up; this chi is older)" }
+      end
+
       if helper.stale?
         row.to = VERSION
-        done(row, :update, @dry_run ? "rebuilds and restarts it" : "restarted") { helper.upgrade { nil } }
+        done(row, :update, @dry_run ? "rebuilds and restarts it" : "restarted") { helper.upgrade(keep_launch: true) { nil } }
       elsif helper.launch_outdated?
         helper.refresh_launch_file unless @dry_run
         up_to_date(row).tap { |r| r.status += @dry_run ? " (would refresh the launch file)" : " (launch file refreshed)" }

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.129.0"
+  VERSION = "0.130.1"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -55,6 +55,7 @@ require_relative "../review_start"
 require_relative "../parent_answers_command"
 require_relative "../guardrails/parent_policy"
 require_relative "markdown_renderer"
+require_relative "token"
 require_relative "capabilities"
 require_relative "editor"
 require_relative "../message_parts"
@@ -431,6 +432,10 @@ module Samagotchi
       end
 
       TOKEN_COOKIE = "chi_token"
+      # The owner's cookie holds the token, but on the LAN a loopback
+      # peer's holds Token.loopback_cookie (#owner_cookie_value): a cookie
+      # for 127.0.0.1 goes to every server on any of its ports (a dev
+      # server that logs headers), and that value works nowhere else.
       # 400 days, the longest a browser keeps a cookie (Chrome's cap). No
       # Secure: the LAN page is plain http. Lax, not Strict: a token link
       # opened from another site (a web messenger) makes its 303 chain
@@ -459,22 +464,24 @@ module Samagotchi
       # The request's Principal, as #route resolved it.
       def principal(req) = req.env.fetch(PRINCIPAL_ENV)
 
-      # LAN mode, a peer that isn't this machine (the peer is the socket's
-      # address, REMOTE_ADDR: never X-Forwarded-For or req.ip, which trust
-      # headers a phone could send): every route needs the access token, as
-      # the chi_token cookie or an Authorization: Bearer header. The page
-      # with ?token= trades it for the cookie and a 303 to itself without
-      # it, so the token doesn't stay in the phone's history.
+      # LAN mode: every route needs the access token, from a phone and from
+      # this machine's loopback too (a pair participant's shell runs here),
+      # as the chi_token cookie or an Authorization: Bearer header; only
+      # GATE_FREE_PATHS and chi's token-less /api/info probe
+      # (ProxyGate#probe_info?) are answered without it. The page with
+      # ?token= (or a link's #code=, POST /api/token) trades it for the
+      # cookie and a 303 to itself without it, so the token doesn't stay in
+      # the browser's history.
       # @return [Array(Principal, nil), Array(nil, Array)] the request's
       #   principal (#principal_for), or the response that refuses it
       def token_gate(req)
         principal = principal_for(req)
         return [nil, refused_token(req)] if principal.nil?
 
-        # The cookie gets the token that was presented: the owner's, or the
-        # participant's grant's.
+        # The cookie gets the participant's grant's token, or the owner's
+        # cookie value (the loopback one on the LAN's 127.0.0.1).
         if token_trade?(req)
-          token = req.env[GRANT_TOKEN_ENV] || current_token
+          token = req.env[GRANT_TOKEN_ENV] || owner_cookie_value(req)
           return [nil, token_redirect(req, token)] unless fragment_trade?(req)
           return [nil, form_trade_redirect(req, token)] if form_post?(req)
 
@@ -489,9 +496,11 @@ module Samagotchi
       # the access token; a participant for a live grant's token (a chp_
       # one, looked up only when no owner token was given), wherever the
       # request comes from, this machine's loopback too; with neither, the
-      # owner for a peer the gate doesn't ask (no LAN mode, or this
-      # machine's loopback), else nil. An ended or unknown grant's token is
-      # nil anywhere: it never falls back to the owner.
+      # owner only on a chi web that asks no token (loopback only: no LAN
+      # mode, no web.public_url), else nil. The owner's cookie on the LAN's
+      # loopback is the loopback value (#loopback_cookie: it stands for the
+      # token in +given+). An ended or unknown grant's
+      # token is nil anywhere: it never falls back to the owner.
       # @return [Principal, nil]
       # With web.public_url (ProxyGate) every request needs a token, and a
       # proxied one is #proxied_principal's.
@@ -510,12 +519,39 @@ module Samagotchi
       # through the proxy (curl, chi's own callers) presents the Bearer
       # header only: no cookie, and no trade that would set one. A cookie for
       # 127.0.0.1 goes to every server on any of its ports. A LAN peer
-      # (web.host lan) keeps the LAN's token link and cookie.
+      # (web.host lan) keeps the LAN's token link and cookie; a loopback
+      # peer of a LAN chi web reads its cookie through #loopback_cookie.
       def presented_tokens(req)
         return [traded_token(req)] if token_trade?(req)
         return [bearer_token(req)] if direct_public?(req)
 
-        [bearer_token(req), req.cookies[token_cookie_name(req)]]
+        cookie = req.cookies[token_cookie_name(req)]
+        [bearer_token(req), loopback_cookie_peer?(req) ? loopback_cookie(cookie) : cookie]
+      end
+
+      # A loopback peer of a LAN chi web, whose owner cookie holds the
+      # loopback value. With web.public_url, #direct_public? takes the
+      # Bearer only. A request with a proxy's trace (one the user forwards
+      # to loopback by hand) is the LAN's: a leaked loopback value must not
+      # work from off this machine through it.
+      def loopback_cookie_peer?(req)
+        !@lan.nil? && @public_url.nil? && LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s) &&
+          !proxy_trace?(req.env)
+      end
+
+      # What a trade sets as the owner's cookie.
+      def owner_cookie_value(req)
+        loopback_cookie_peer?(req) ? Token.loopback_cookie(current_token) : current_token
+      end
+
+      # A loopback peer's cookie: the loopback value stands for the owner's
+      # token, a grant's chp_ token is itself, and anything else, the token
+      # itself included (a 0.130.0 cookie, #refused_token clears it), is
+      # nothing.
+      def loopback_cookie(value)
+        return current_token if token_match?(value, Token.loopback_cookie(current_token))
+
+        Grants.token?(value) ? value : nil
       end
 
       def direct_public?(req)
@@ -595,11 +631,10 @@ module Samagotchi
         "#{token_cookie_name(req)}=; #{token_cookie_attributes(req).sub(/Max-Age=\d+/, "Max-Age=0")}"
       end
 
-      def token_required?(req)
-        return true if @public_url
-
-        @lan && !LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s)
-      end
+      # Whether the gate asks this request for a token: on a chi web on the
+      # LAN or behind a proxy, every request does, this machine's loopback
+      # too. Only a loopback-only chi web takes loopback as the owner.
+      def token_required?(_req) = !(@public_url || @lan).nil?
 
       # The page opened with ?token= (a gated request, or a grant's token
       # anywhere): its token is traded for the cookie, whatever else the
@@ -621,10 +656,15 @@ module Samagotchi
       # The 401 for a request #principal_for refused: an ended grant's, else
       # unauthorized. On a peer the gate doesn't ask, a grant's cookie that
       # no longer works is cleared too, so the browser it was left in (the
-      # owner's, who opened a participant link) is the owner's again.
+      # owner's, who opened a participant link) is the owner's again. A
+      # LAN chi web's loopback peer whose cookie is the token itself (set
+      # before the loopback value) has it cleared, so it stops riding to
+      # the other local ports.
       def refused_token(req)
         response = grant_bound_response(req) || grant_ended_response(req) || unauthorized(req)
-        return response if token_required?(req) || !Grants.token?(req.cookies[token_cookie_name(req)])
+        cookie = req.cookies[token_cookie_name(req)]
+        stale = loopback_cookie_peer?(req) && token_match?(cookie, current_token)
+        return response unless stale || (!token_required?(req) && Grants.token?(cookie))
 
         status, headers, body = response
         [status, headers.merge("Set-Cookie" => cleared_token_cookie(req)), body]
@@ -903,7 +943,11 @@ module Samagotchi
 
       def unauthorized_detail(req, reason)
         return "chi web behind the proxy: #{reason || "needs its access token"}" if proxied?(req)
-        return "chi web on the LAN needs its access token" unless @public_url
+
+        unless @public_url
+          here = LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s)
+          return "chi web on the LAN needs its access token#{", on this machine too" if here}"
+        end
 
         detail = "chi web with web.public_url needs its access token, on this machine too"
         direct_public?(req) ? "#{detail}; open its public address #{@public_url.origin}/ instead" : detail
@@ -941,7 +985,7 @@ module Samagotchi
       # the proxy too.
       def self.public_unauthorized_page(page)
         page.sub('<form method="get" action="/">', '<form method="post" action="/api/token">')
-            .sub("Open the link chi web printed in its terminal (LAN, or Proxied behind an\nauth proxy), or scan its QR code.",
+            .sub("Open the link chi web printed in its terminal (Local on this machine, LAN, or\nProxied behind an auth proxy), or scan its QR code.",
                  "Open the Proxied link chi web printed in its terminal (it works once; chi web again prints a new " \
                  "one), or paste the token from its web-token file.")
       end
@@ -961,8 +1005,8 @@ module Samagotchi
         </style></head>
         <body>
         <h1>chi web</h1>
-        <p>This page needs chi web's access token. Open the link chi web printed in its terminal (LAN, or Proxied behind an
-        auth proxy), or scan its QR code.</p>
+        <p>This page needs chi web's access token. Open the link chi web printed in its terminal (Local on this machine, LAN, or
+        Proxied behind an auth proxy), or scan its QR code.</p>
         <p id="trade" hidden></p>
         <form method="get" action="/">
           <label for="token">Or paste the token:</label>

data/lib/samagotchi/web/participant_review.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "participant_view"
+require_relative "token"
 require_relative "participant_stream_filter"
 require_relative "participant_exposure"
 require_relative "../session_metrics"
@@ -39,10 +40,16 @@ module Samagotchi
 
       # Who reads: the participant (their author), or the owner through the
       # participant view (nobody's own). The session's folder places tool
-      # paths; the owner's token is never shown.
+      # paths; the owner's token is never shown, nor (LAN) its loopback
+      # cookie value.
       def participant_viewer(req, session)
         author = principal(req).owner? ? nil : principal(req).grant.author
-        ParticipantView::Viewer.new(author: author, cwd: session.working_directory, secrets: [(@lan || @public_url) && current_token].compact)
+        ParticipantView::Viewer.new(author: author, cwd: session.working_directory, secrets: owner_secrets)
+      end
+
+      def owner_secrets
+        token = (@lan || @public_url) && current_token
+        [token, @lan && Token.loopback_cookie(token)].compact
       end
 
       # GET /api/sessions/:id/review: the participant page's data, always

data/lib/samagotchi/web/proxy_gate.rb

@@ -74,6 +74,12 @@ module Samagotchi
         return true if @public_url.host?(env["HTTP_HOST"])
         return true if @public_url.identity_env && env.key?(@public_url.identity_env)
 
+        proxy_trace?(env)
+      end
+
+      # Whether a request carries a proxy's trace (ProxyTrace: X-Forwarded-*,
+      # Forwarded, X-Real-IP, a known identity header).
+      def proxy_trace?(env)
         names = env[RAW_NAMES_ENV] || env.keys.filter_map { |key| ProxyTrace.env_name(key) }
         names.any? { |name| ProxyTrace.header?(name) }
       end
@@ -124,13 +130,15 @@ module Samagotchi
         participant_principal(req, grant_tokens, identity: identity, proxied: true)
       end
 
-      # chi's own probe of a chi web behind a proxy (InfoProbe: a second chi
-      # web, chi share, chi update) sends no token: GET /api/info from this
+      # chi's own probe of a chi web that asks this machine for its token
+      # (behind a proxy, or on the LAN: InfoProbe from a second chi web, chi
+      # share, chi update, chi self) sends no token: GET /api/info from this
       # machine, not through the proxy, with no token at all, gets the
-      # fields it checks (nothing secret), so no probe ever hands the token
-      # to whatever listens on the port.
+      # fields it checks (nothing secret: its start folder is a path on this
+      # machine), so no probe ever hands the token to whatever listens on
+      # the port. Any token or cookie makes it an ordinary request.
       def probe_info?(req)
-        return false unless @public_url && req.get? && req.path_info == "/api/info"
+        return false unless (@public_url || @lan) && req.get? && req.path_info == "/api/info"
         return false unless App::LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s) && !proxied?(req)
 
         req.get_header("HTTP_AUTHORIZATION").nil? && req.get_header("HTTP_COOKIE").nil?
@@ -138,7 +146,7 @@ module Samagotchi
 
       def probe_info
         json_response(200, { app: "chi-web", version: Samagotchi::VERSION, pid: Process.pid, features: App::INFO_FEATURES,
-                             lan: @lan && @lan[:ip] })
+                             lan: @lan && @lan[:ip], start_dir: start_dir })
       end
 
       def proxy_refuse(req, reason)