samagotchi 0.130.0 → 0.131.0

data/lib/samagotchi/desktop/macos.rb

@@ -41,9 +41,11 @@ module Samagotchi
       BUILD_NAME = ".chi-helper-build"
       OLD_NAME = ".chi-helper-old"
       # Apps started by launchd get a bare env (no shell rc files), so the
-      # launch file carries what chi needs to find its gems and state. Only
-      # these, and only when set: no tokens, no runtime knobs.
+      # launch file carries what chi needs to find its gems, state and tools.
+      # Only these, and only when set: no tokens, no runtime knobs.
       ENV_ALLOWLIST = %w[XDG_CONFIG_HOME XDG_STATE_HOME GEM_HOME GEM_PATH RUBYLIB].freeze
+      # PATH is separately filtered to absolute dirs and frozen when written,
+      # so the helper's chi, workers and execute can find the shell's tools.
       # Without it Ruby reads stdin as US-ASCII and non-ASCII notes break.
       LANG = "en_US.UTF-8"
       # chi broadcast's default triage deadline, and the helper's seconds on
@@ -54,6 +56,17 @@ module Samagotchi
       # one launch-file section each, in this order.
       TERMINALS = %w[kitty tmux].freeze
 
+      # PATH dirs the helper can use from launchd's / working directory:
+      # keep absolute entries only, in order, once each.
+      def self.path_dirs(env)
+        env["PATH"].to_s.split(File::PATH_SEPARATOR).select { _1.start_with?("/") }.uniq
+      end
+
+      def self.baked_path(env)
+        dirs = path_dirs(env)
+        dirs.empty? ? nil : dirs.join(File::PATH_SEPARATOR)
+      end
+
       # Runs a command without a shell; [output, success].
       class Runner
         def run(argv)
@@ -76,7 +89,8 @@ module Samagotchi
 
       # The tmux: settings, or nil while tmux.enabled is off. The binary is
       # tmux.binary, else the tmux on +env+'s PATH ("" when there is none:
-      # see #warnings); the socket dir is where tmux puts `-L` sockets
+      # only absolute dirs are usable from launchd; see #warnings); the socket
+      # dir is where tmux puts `-L` sockets
       # ($TMUX_TMPDIR when it is a directory, else /tmp, then tmux-<uid>).
       # Both are frozen at bake time, like the rest of the launch file.
       def self.tmux_settings(get = Config.method(:get), env: ENV)
@@ -91,8 +105,7 @@ module Samagotchi
       end
 
       def self.path_tmux(env)
-        env["PATH"].to_s.split(File::PATH_SEPARATOR).reject(&:empty?).map { File.join(_1, "tmux") }
-                   .find { File.file?(_1) && File.executable?(_1) }.to_s
+        path_dirs(env).map { File.join(_1, "tmux") }.find { File.file?(_1) && File.executable?(_1) }.to_s
       end
 
       # Each switched-on terminal's settings by name ("kitty" => …).
@@ -148,10 +161,14 @@ module Samagotchi
       # `gem cleanup`), else this checkout's bin/chi. A section per terminal
       # switched on (TERMINALS order); the broadcast timeout when given.
       # The XDG dirs go in absolute (Paths): launchd starts the app in /,
-      # where a relative one would mean /<dir>.
+      # where a relative one would mean /<dir>. PATH is filtered to absolute,
+      # deduplicated dirs so chi, its workers and execute find shell tools;
+      # it is frozen at bake time.
       def launch_config
         env = { "LANG" => LANG }
         ENV_ALLOWLIST.each { |name| env[name] = @env[name] unless @env[name].to_s.empty? }
+        path = self.class.baked_path(@env)
+        env["PATH"] = path if path
         env.merge!(Paths.absolute_xdg(env: env, set: :key))
         config = { "version" => @version, "argv" => [@ruby, @chi_path], "env" => env, "sources_sha" => sources_sha }
         TERMINALS.each { |name| config[name] = @terminals[name] if @terminals[name] }
@@ -178,22 +195,55 @@ module Samagotchi
         launch["sources_sha"] != sources_sha || !launch_ok?(launch)
       end
 
-      # The launch file names another chi version or path than this one, or
-      # other terminal settings or broadcast timeout: refresh_launch_file
-      # fixes that without a rebuild.
+      # The launch file names an older chi version than this one (or none), or
+      # other terminal settings, broadcast timeout or a missing bakeable PATH:
+      # refresh_launch_file fixes that without a rebuild. A different argv or
+      # baked PATH, or a newer version, is intentional: the ruby, chi and PATH
+      # the helper runs change only with chi desktop install --force or upgrade.
       def launch_outdated?
         launch = read_launch
-        launch["version"] != @version || Array(launch["argv"]) != launch_config["argv"] ||
+        older_version?(launch["version"]) ||
           TERMINALS.map { launch[_1] } != TERMINALS.map { @terminals[_1] } ||
-          launch["broadcast_timeout"] != @broadcast_timeout
+          launch["broadcast_timeout"] != @broadcast_timeout || path_missing?(launch)
+      end
+
+      # Why chi update can't keep the launch file's ruby or chi: one of them
+      # is gone. nil when it runs, or has no usable argv (a refresh writes
+      # this chi's then).
+      def launch_problem
+        argv = usable_argv(read_launch)
+        missing = Array(argv).reject { |path| File.exist?(path) }
+        return nil if missing.empty?
+
+        "chi not found at #{missing.join(", ")}: run chi desktop install --force from the shell whose chi it should run"
+      end
+
+      # The chi version the launch file names, nil without one.
+      def launch_version = read_launch["version"]
+
+      # The launch file names a newer chi than this one: an older chi's
+      # chi update keeps the helper as it is (no rebuild from older sources).
+      def launch_newer?
+        Gem::Version.new(launch_version.to_s) > Gem::Version.new(@version)
+      rescue ArgumentError
+        false
       end
 
       # Rewrite the launch file for this chi and its settings, keeping
-      # the env it was installed with. The app reads it at each send: no restart.
+      # its argv and the env it was installed with; a PATH only when it has
+      # none (changing them takes chi desktop install --force or upgrade). A
+      # newer version stays. The app reads it at each send.
       def refresh_launch_file
         config = launch_config
-        env = read_launch["env"]
-        config["env"] = env if env.is_a?(Hash)
+        old = read_launch
+        config["argv"] = usable_argv(old) || config["argv"]
+        config["version"] = old["version"] unless older_version?(old["version"])
+        old_env = old["env"]
+        if old_env.is_a?(Hash)
+          config["env"] = old_env
+          path = self.class.baked_path(@env)
+          config["env"]["PATH"] = path if config["env"]["PATH"].to_s.empty? && path
+        end
         write_launch_file(config)
       end
 
@@ -242,7 +292,9 @@ module Samagotchi
 
       # @yield [String] progress lines
       # @param login [Boolean] also start the app at login
-      def install(force: false, login: false, &progress)
+      # @param keep_launch [Boolean] keep the launch file's ruby, chi and PATH
+      #   (chi update's rebuild) instead of baking this shell's
+      def install(force: false, login: false, keep_launch: false, &progress)
         raise Error, "already installed (#{app_version}); use chi desktop upgrade" if installed? && !force
 
         toolchain!
@@ -250,7 +302,7 @@ module Samagotchi
         progress&.call("building #{APP_NAME} #{@version} (can take a few minutes)…")
         built = build_app
         swap_in(built)
-        write_launch_file
+        write_launch_file(keep_launch: keep_launch)
         register_app
         self.login = true if login
         progress&.call("installed #{app_path}")
@@ -258,9 +310,9 @@ module Samagotchi
       end
 
       # Keeps the login item as it was.
-      def upgrade(&)
+      def upgrade(keep_launch: false, &)
         was_login = installed? && login == "enabled"
-        install(force: true, login: was_login, &)
+        install(force: true, login: was_login, keep_launch: keep_launch, &)
       end
 
       # SMAppService status as the app reports it ("enabled",
@@ -313,6 +365,7 @@ module Samagotchi
           launch_ok: launch_ok?(launch),
           stale: stale?,
           baked_dirs: env.select { |name, _| name.start_with?("XDG_") },
+          baked_path: env["PATH"],
           service: dump.include?(BUNDLE_ID),
           running: running,
           host_keys: host_keys
@@ -393,12 +446,39 @@ module Samagotchi
         {}
       end
 
+      # This chi is newer than the version the launch file names; a missing or
+      # unreadable version counts as older.
+      def older_version?(version)
+        Gem::Version.new(@version) > Gem::Version.new(version.to_s)
+      rescue ArgumentError
+        true
+      end
+
+      def usable_argv(launch)
+        argv = launch["argv"]
+        argv if argv.is_a?(Array) && !argv.empty? && argv.all? { |path| path.is_a?(String) && !path.empty? }
+      end
+
+      def path_missing?(launch)
+        return false unless self.class.baked_path(@env)
+
+        env = launch["env"]
+        !env.is_a?(Hash) || env["PATH"].to_s.empty?
+      end
+
       def launch_ok?(launch)
         argv = Array(launch["argv"])
         !argv.empty? && argv.all? { |path| File.exist?(path) }
       end
 
-      def write_launch_file(config = launch_config)
+      def write_launch_file(config = launch_config, keep_launch: false)
+        if keep_launch
+          old = read_launch
+          config["argv"] = usable_argv(old) || config["argv"]
+          old_env = old["env"]
+          old_path = old_env["PATH"] if old_env.is_a?(Hash)
+          config["env"]["PATH"] = old_path unless old_path.to_s.empty?
+        end
         FileUtils.mkdir_p(@support_dir)
         AtomicFile.write(launch_path, JSON.pretty_generate(config) + "\n")
       end

data/lib/samagotchi/desktop_command.rb

@@ -118,11 +118,12 @@ module Samagotchi
                   "#{s[:app_version] || "?"} (up to date: chi #{s[:chi_version]} changed nothing in it)"
                 end
       launch = s[:launch_argv].empty? ? "(none)" : s[:launch_argv].join(" ")
-      launch += s[:launch_ok] ? " (ok)" : " (missing: chi update)"
+      launch += s[:launch_ok] ? " (ok)" : " (missing: chi desktop install --force)"
       dirs = s[:baked_dirs].empty? ? "(defaults)" : s[:baked_dirs].map { |name, value| "#{name}=#{value}" }.join(" ")
+      path = path_row(s[:baked_path])
       service = s[:service] ? "registered" : "not registered (try chi desktop upgrade, or log out and back in)"
       running = s[:running] ? "running" : "not running (open -g \"#{s[:app_path]}\")"
-      rows = [["Chi Helper", version], ["app", s[:app_path]], ["runs chi", launch], ["state dirs", dirs],
+      rows = [["Chi Helper", version], ["app", s[:app_path]], ["runs chi", launch], ["state dirs", dirs], ["PATH", path],
               ["service", service], ["hotkey", hotkey(s[:hotkey])], ["process", running], ["at login", login(s[:login])]]
       rows << ["host keys", host_keys(s[:host_keys])] unless Array(s[:host_keys]).empty?
       @stdout.puts(format_rows(rows))
@@ -153,6 +154,10 @@ module Samagotchi
       end
     end
 
+    def path_row(path)
+      path.to_s.empty? ? "(none: macOS's default; chi update fills it, chi desktop install --force changes it)" : path
+    end
+
     def format_rows(rows)
       width = rows.map { |label, _| label.length }.max
       rows.map { |label, value| "#{label.ljust(width)}  #{value}" }.join("\n")

data/lib/samagotchi/engine.rb

@@ -16,6 +16,7 @@ require_relative "turn_note"
 require_relative "turn_endings"
 require_relative "turn_origin"
 require_relative "verify_anchor"
+require_relative "web/participant_view"
 require_relative "verdict"
 require_relative "model_profile"
 require_relative "effective_model"
@@ -1352,6 +1353,19 @@ module Samagotchi
       Array(@session&.messages).any? { |entry| entry[:role].to_s == "model" }
     end
 
+    # The latest known context size used by a request, for a cache-restart
+    # confirmation; nil before any request reports a count.
+    # @return [Integer, nil]
+    def cache_restart_tokens
+      used = @metrics.snapshot.dig(:context, :used_tokens)
+      used if used.is_a?(Integer)
+    end
+
+    # Whether a cache restart can invalidate preserved thinking blocks.
+    def cache_restart_anthropic?
+      effective_model.entry&.api.to_s == "anthropic"
+    end
+
     # What a thinking level change costs the effective model's prompt
     # cache (Thinking.cache_cost): :full, :provider or :tail.
     # @return [Symbol]
@@ -1646,13 +1660,28 @@ module Samagotchi
       return reject_verify_anchor(anchor, :reply_missing) unless reply
 
       quote_text = verify_comparison_text(anchor.quote)
-      answer_text = verify_comparison_text(reply[:content] || reply["content"])
-      return reject_verify_anchor(anchor, :quote_missing) if quote_text.empty? || !answer_text.include?(quote_text)
+      quoted = !quote_text.empty? && verify_quote_in?(quote_text, (reply[:content] || reply["content"]).to_s, source)
+      return reject_verify_anchor(anchor, :quote_missing) unless quoted
 
       anchor
     end
     private :verified_anchor
 
+    # Whether +quote_text+ is in +answer+ as the model wrote it, or as the
+    # pages show it: a page quotes its own text, which reads the session's
+    # folder relative, the home folder as ~ and a secret shape as
+    # [redacted] (a participant's page gets it so, ParticipantView::Redact;
+    # the owner's page rewrites its quote the same way, claim_link.js
+    # normalizeClaim, so claim links match both pages). +source+ is the
+    # session whose folder that is.
+    def verify_quote_in?(quote_text, answer, source)
+      return true if verify_comparison_text(answer).include?(quote_text)
+
+      viewer = Web::ParticipantView::Viewer.new(cwd: source.working_directory)
+      verify_comparison_text(Web::ParticipantView::Redact.text(answer, viewer)).include?(quote_text)
+    end
+    private :verify_quote_in?
+
     def verify_anchor_source_session(session, anchor)
       return session unless session.verify_fresh
 

data/lib/samagotchi/guardrails/rules.rb

@@ -112,8 +112,8 @@ module Samagotchi
             # A resolved match only adds an ask or a deny; were a verdict
             # ever to let a call through, a symlink into its glob must not.
             if resolved_match?
-              real_base ||= PathResolve.real(base)
-              forms += PathResolve.reals(p).map { |real| [real, real_base] }
+              real_base ||= targets.real_rule_base
+              forms += targets.real_forms(p).map { |real| [real, real_base] }
             end
             forms.any? do |form, from|
               candidate = absolute ? form : relative(form, from)

data/lib/samagotchi/guardrails/targets.rb

@@ -379,6 +379,19 @@ module Samagotchi
         @paths.any? { |p| Outside.outside?(p, root: @session_root) }
       end
 
+      # The resolved forms used by rules' path: globs, once per target path.
+      def real_forms(path)
+        @real_forms ||= {}
+        @real_forms[path] ||= PathResolve.reals(path)
+      end
+
+      # The resolved base used by rules' path: globs.
+      def real_rule_base
+        return @real_rule_base if defined?(@real_rule_base)
+
+        @real_rule_base = PathResolve.real(@repo_root || @cwd)
+      end
+
       # Where a shell call runs mutating git (ShellGitDirs: dirs, and
       # :unknown for one the text doesn't tell); [] for other tools.
       def git_dirs

data/lib/samagotchi/level_setting_command.rb

@@ -81,9 +81,10 @@ module Samagotchi
       return nil unless before && would
 
       cost = spec.cache_cost.call(@engine, before.level, would.level)
-      return nil unless CacheConfirm.needed?(cost: cost, history: @engine.history?, changed: would.level != before.level)
+      step = CacheConfirm.ask(line: "#{spec.name} #{word}", cost: cost, changed: would.level != before.level,
+                              engine: @engine)
+      return nil unless step
 
-      step = CacheConfirm.confirm(spec.name, word)
       [[listing(before), "Switching to #{would.level} restarts the prompt cache: #{spec.cost_notes[cost]}", step.text].join("\n"),
        false, step]
     end

data/lib/samagotchi/session.rb

@@ -14,6 +14,7 @@ require_relative "session_setup"
 require_relative "prompt_note"
 require_relative "working_set_pin"
 require_relative "session_review"
+require_relative "version"
 
 require_relative "paths"
 require_relative "project_scope"
@@ -351,17 +352,27 @@ module Samagotchi
     # saved.
     attr_accessor :opener
 
+    # The top-level keys of the session file this chi doesn't know (a newer
+    # chi's fields), frozen, string keys: #to_h writes them back after the
+    # FIELDS as they were. Never read by this chi.
+    attr_reader :extra_fields
+
+    # The chi version that last saved the loaded file (#to_h writes this
+    # chi's VERSION); nil for a file from 0.130.0 or older.
+    attr_reader :written_by
+
     def initialize(id:, mode:, model_name:, working_directory:, messages:, created_at:, updated_at:,
-                   metadata_version: METADATA_VERSION, status: STATUS_IDLE, last_prompt: "",
+                   metadata_version: METADATA_VERSION, written_by: nil, status: STATUS_IDLE, last_prompt: "",
                    first_preview: "", first_turn_id: nil, test_run: false, pending_question: nil,
                    used_memory_names: [], project_root: nil,
                    preloaded_memory_names: [], muted_memory_names: [], parent_id: nil, scratch: false,
                    last_turn: nil, model_typed: nil, delegate: false, llm_context: nil, prompt_notes: [],
                    continues: nil, thinking: nil, reasoning_history: nil, appended_prompt_files: [],
                    toolkit: nil, toolkit_origin: "chosen", settings: nil, interrupted_turn: nil, parent_answers: nil, title: nil,
-                   working_set_pins: [], review: nil, verdicts: nil, verify_fresh: nil)
+                   working_set_pins: [], review: nil, verdicts: nil, verify_fresh: nil, extra_fields: {})
       @id = id
       @metadata_version = metadata_version
+      @written_by = written_by
       @mode = mode
       @model_name = model_name
       @model_typed = model_typed
@@ -399,12 +410,25 @@ module Samagotchi
       self.verdicts = verdicts
       self.verify_fresh = verify_fresh
       self.interrupted_turn = interrupted_turn
+      @extra_fields = extra_fields.to_h { |key, value| [key.to_s, value] }.freeze
       @turn_checkpoint = nil
       @archived = false
       # #save's lock: one snapshot-and-write at a time (see #save).
       @save_lock = Mutex.new
     end
 
+    # Whether a chi newer than this one saved the loaded file: its
+    # written_by is a later version, or it has keys this chi doesn't know
+    # (a hand-edited or future file). The worker logs it (newer_writer).
+    def newer_writer?
+      return true unless @extra_fields.empty?
+
+      # correct?(nil) is true (a 0 version): a file without the field is no newer.
+      return false unless @written_by.is_a?(String) && Gem::Version.correct?(@written_by)
+
+      Gem::Version.new(@written_by) > Gem::Version.new(VERSION)
+    end
+
     # A `delegate` child: its turns report to its parent (ChildReports). A
     # child saved before the field is known by the memory every delegate
     # starts with; a fork is neither.
@@ -543,8 +567,24 @@ module Samagotchi
     # the way (symbols in memory, strings on disk); last_turn, prompt_notes
     # and pending_question are value objects in memory (LastTurn,
     # PromptNote, PendingQuestion).
+    #
+    # A new field: a chi older than it (from the release after 0.130.0)
+    # keeps the key as it was (#extra_fields) but doesn't honour it, and the
+    # next newer chi reads it again. So it must be safe to come back
+    # unchanged after an older chi ran turns on the session: static data, or
+    # append-only data the older chi never appends to (review, verify_fresh,
+    # first_turn_id, verdicts); a cursor into messages, which an older chi
+    # would have moved, needs a check against what it points at. Only
+    # top-level keys are kept: the value objects (SessionReview,
+    # VerifyFreshOrigin, Toolkit, LastTurn, PendingQuestion, InterruptedTurn,
+    # PromptNote, WorkingSetPin, LLMContextOverride) write their own members
+    # only, so an older chi still drops a new sub-key of one of them; add a
+    # top-level field when an older chi must keep it. A removed key would
+    # stay an extra forever: leave it out of the extras in .from_h then (no
+    # key was ever removed).
     FIELDS = {
       "metadata_version" => 1,
+      "written_by" => nil,
       "id" => REQUIRED,
       "mode" => REQUIRED,
       "model_name" => REQUIRED,
@@ -599,6 +639,7 @@ module Samagotchi
       end
       attrs[:settings] = SessionConfig::Settings.new(core: attrs.delete(:config_settings), bundles: attrs.delete(:bundle_settings))
       attrs[:messages] = messages ? Array(attrs[:messages]).map { |msg| symbolize_message_keys(msg) } : []
+      attrs[:extra_fields] = data.reject { |key, _| FIELDS.key?(key) }
       new(**attrs)
     end
 
@@ -720,8 +761,10 @@ module Samagotchi
       self
     end
 
-    # The session as #save writes it (FIELDS, in their order); a running
-    # turn's checkpoint (#turn_checkpoint) in place of its messages.
+    # The session as #save writes it: FIELDS, in their order, then the keys
+    # this chi doesn't know (#extra_fields, in the file's order; a FIELDS key
+    # wins); a running turn's checkpoint (#turn_checkpoint) in place of its
+    # messages.
     def to_h
       checkpoint = checkpointed
       FIELDS.keys.to_h do |key|
@@ -730,6 +773,7 @@ module Samagotchi
                   (checkpoint ? checkpoint[:messages] : @messages).map { |msg| scrub_utf8(stringify_message_keys(msg)) }
                 when "interrupted_turn" then (checkpoint ? checkpoint[:marker] : @interrupted_turn)&.to_file
                 when "pending_question" then @pending_question && scrub_utf8(@pending_question.to_file)
+                when "written_by" then VERSION
                 when "test_run" then !!@test_run
                 when "delegate" then @delegate
                 when "llm_context" then llm_context_file
@@ -755,6 +799,7 @@ module Samagotchi
                 end
         [key, value]
       end.reject { |key, value| value.nil? && OPTIONAL_FIELDS.include?(key) }
+        .merge(@extra_fields.reject { |key, _| FIELDS.key?(key) })
     end
 
     # The running turn's checkpoint, while the turn runs (#turn_checkpoint).

data/lib/samagotchi/session_commands.rb

@@ -59,7 +59,7 @@ module Samagotchi
     # /help's note per listed mid_turn (the web's command list says the same).
     MID_TURN_NOTES = { "anytime" => "mid-turn too", "depends" => "show: mid-turn too" }.freeze
 
-    # The commands that ask before a change that restarts the prompt cache
+    # Commands that may ask before a change that restarts the prompt cache
     # (CacheConfirm): #run passes them its confirm flag.
     CONFIRMING = %i[thinking reasoning_history toolkit].freeze
 
@@ -287,8 +287,8 @@ module Samagotchi
     # How help and errors name an entry (the shell's "!" is "!<cmd>").
     def self.display_name(entry) = entry.name == SHELL_BANG_PREFIX ? "#{SHELL_BANG_PREFIX}<cmd>" : entry.name
 
-    # @param confirm [Boolean] a costly /thinking or /reasoning-history
-    #   change asks first (CacheConfirm): true for a person at a web tab or
+    # @param confirm [Boolean] a costly setting change asks first
+    #   (CacheConfirm): true for a person at a web tab or
     #   a TUI; false applies it at once (chi send, a delegate, a plugin,
     #   chi -p)
     # @param as_parent [Boolean] a parent agent sent it (client cli:answer):
@@ -304,7 +304,7 @@ module Samagotchi
       return nil unless entry&.handler
       return run_bundle_command(entry, text) unless entry.source == "core"
 
-      # The two that may ask take the flag; the rest never ask.
+      # Only commands that may ask take the flag.
       return send(entry.id, text, confirm: confirm) if CONFIRMING.include?(entry.id)
       # Who sent it goes to its handler per call, never through an ivar:
       # an anytime command runs on another thread against this instance.

data/lib/samagotchi/toolkit_command.rb

@@ -54,8 +54,8 @@ module Samagotchi
       end
 
       cost = Toolkit.cache_cost(before.prompt_key, after.prompt_key)
-      if confirm && !yes && CacheConfirm.needed?(cost: cost, history: @engine.history?, changed: !cost.nil?)
-        step = CacheConfirm.confirm(NAME, words)
+      step = CacheConfirm.ask(line: "#{NAME} #{words}", cost: cost, changed: true, engine: @engine) if confirm && !yes
+      if step
         return [[change_line(before, after), reread_line(before, after), step.text].join("\n"), false, step]
       end
 

data/lib/samagotchi/tools/execute.rb

@@ -85,7 +85,10 @@ module Samagotchi
       # @param stop_reason [#call] the stop's reason (:signal: a signal to
       #   chi, :session_stopped: a session stop, which the result then names
       #   instead of the user)
-      # @param env [Hash, nil] added to the command's environment
+      # @param env [Hash, nil] added to the command's environment, over
+      #   chi's Ruby/Bundler variables scrubbed as task_create scrubs them
+      #   (TaskRuntime.sanitized_spawn_env); chi's callers build it, so it
+      #   may set those keys (task_create refuses them from the model)
       # @param on_timeout [Symbol, String, nil] :task or :kill (ON_TIMEOUT);
       #   nil reads execute.on_timeout
       def self.call(command, cwd: nil, cancelled: -> { false }, stop_reason: -> {}, env: nil, on_timeout: nil)
@@ -267,7 +270,7 @@ module Samagotchi
         # file, and each write lands at the end.
         ios = logs.map { |path| File.open(path, "a") }
         ios.each { |io| io.flock(File::LOCK_SH) }
-        ProcessGroup.spawn(env || {}, *Shell.argv(TaskRuntime.wrapped_shell_command(command, exit_code_path)),
+        ProcessGroup.spawn(TaskRuntime.sanitized_spawn_env.merge(env || {}), *Shell.argv(TaskRuntime.wrapped_shell_command(command, exit_code_path)),
                            chdir: cwd, in: File::NULL, out: ios[0], err: ios[1])
       ensure
         ios&.each(&:close)

data/lib/samagotchi/tools/task_runtime.rb

@@ -445,9 +445,11 @@ module Samagotchi
         "trap #{Shellwords.escape(write)} EXIT\n#{command}\n"
       end
 
+      # chi's own Ruby/Bundler setup, kept out of a command's environment
+      # (execute and task_create both spawn with it): run under `bundle
+      # exec`, chi would otherwise hand a project's `ruby -e` or
+      # `bundle exec` its Gemfile (RUBYOPT=-rbundler/setup, BUNDLE_GEMFILE).
       def sanitized_spawn_env
-        # Running from temporary directories can inherit Bundler-specific env
-        # (for example RUBYOPT=-rbundler/setup) that breaks plain `ruby -e`.
         {
           "RUBYOPT" => sanitized_rubyopt,
           "RUBYLIB" => nil,

data/lib/samagotchi/update_command.rb

@@ -250,9 +250,17 @@ module Samagotchi
       return row.tap { |r| r.status = "not installed" } unless helper.installed?
 
       row.from = helper.app_version
+      if (problem = helper.launch_problem)
+        return failed(row, problem)
+      end
+
+      if helper.launch_newer?
+        return up_to_date(row).tap { |r| r.status += " (kept: chi #{helper.launch_version} set it up; this chi is older)" }
+      end
+
       if helper.stale?
         row.to = VERSION
-        done(row, :update, @dry_run ? "rebuilds and restarts it" : "restarted") { helper.upgrade { nil } }
+        done(row, :update, @dry_run ? "rebuilds and restarts it" : "restarted") { helper.upgrade(keep_launch: true) { nil } }
       elsif helper.launch_outdated?
         helper.refresh_launch_file unless @dry_run
         up_to_date(row).tap { |r| r.status += @dry_run ? " (would refresh the launch file)" : " (launch file refreshed)" }

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.130.0"
+  VERSION = "0.131.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end