samagotchi 0.143.0 → 0.145.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0403d20c85725cdd309a9b0ff24cc997c3effd60f37e42c9258de568b5e89944
-  data.tar.gz: aa1345c31e6d3ee3dbf578d6ed7298ec98f5c32caf67f304b75ac3caf3f2f886
+  metadata.gz: 6055a05533de1a37a9e9393effa720eb2ca93f0db2715d7f806f83cae3086a8d
+  data.tar.gz: ac0a46f034b62cf4c0b6968d6bb9b07fdf8bae8ab331f4745b4a597ef45dd8c9
 SHA512:
-  metadata.gz: 528d2c989d71eb722a9e66ede6c2ddd4a57387e74842034bf019a671abb2f3b7d50cb759c8628f6d86d611434a6772a9a3fc75f5886d7f42eea98f3b54bcef1c
-  data.tar.gz: d5078148478d31d778cb973d8ae7dac52696e5cfa9909f96b5ea33185d3c920f067aeea64417b7f64de1785047fc74f9c24bca3f4d4bfda75b792342c712ae22
+  metadata.gz: 7e0ab9f589c50aa6c3fa7bdb37b64e17d9963191fa1878e624dd33d68f296d31bd107a09eb8feb5ae7bd85b9c7f2e6bbf1ff1c296ae1fd938a828160c7c5a488
+  data.tar.gz: 34688115cd7554ed4f660ab131dfcccb4dd7d15e24f72c7e32f6802d1a2c422d80cfea3cef47f18afc689eb653fc36102b5726d45129202f157d91f1d1db09b7

data/CHANGELOG.md

@@ -7,6 +7,74 @@ and commands may change between minor versions. How releases are made:
 [docs/releasing.md](docs/releasing.md).
 ## [Unreleased]
 
+## [0.145.0] - 2026-11-02
+
+### Changed
+
+- On a phone, a web approval uses more of the screen, and a short one shows its question, command and Submit without
+  scrolling. A tall card can use the stage's raised height, as a long question already could.
+- The stage shrinks back once at the next step after you answer a question or approval, so no empty room stays under the
+  answered card. Otherwise it still only grows during a turn.
+- The web's approval card has no Deny radio. The Deny button denies in one tap, and a reason typed in the box now goes
+  with it. Terminals, `chi answer` and relayed approvals still answer Deny by its label.
+- On a phone or touch screen, the composer folds while a card's text field has focus and comes back afterwards. Your
+  saved fold and draft are untouched.
+- The session bar says "waiting" instead of "running" while a card blocks the turn.
+- A live answer's new line appears at once instead of fading in, which takes about a quarter off the CPU a streaming
+  answer uses on a Mac Studio.
+
+### Fixed
+
+- An approval card's folder and reason wrap at words instead of splitting them.
+- The text fields on web cards ask iOS Safari not to offer its AutoFill Contact bar.
+
+Update with `chi update`.
+
+## [0.144.0] - 2026-11-02
+
+### Changed
+
+- `chi update`'s re-check of the bundles chi doesn't ship warns about a reference to chi's internals only when this chi
+  no longer has it: the constant doesn't resolve, or the method the name gives isn't there. The row reads
+  `warn boundary plugin.rb: Samagotchi::OldInternal::Thing is gone from this chi, so this bundle may fail`; a name that
+  still works (`Samagotchi::Log`) gets no row, so the table stops repeating warnings about bundles that load fine.
+  `chi bundle check` (the author's own run) stays strict.
+- The web's session bar on a phone no longer swipes: id, status, model and ⚙ stay on the row, and ⋯ opens a bottom sheet with the
+  rest (toolkit, working set, participants, chain links, delegates, the telemetry, Continue, Archive, Stop, Delete). A dot on ⋯ says
+  when something there needs a look. See [docs/cli.md](docs/cli.md#the-session-bar-on-a-phone).
+- chi web uses much less CPU during a turn: about a fifth of a core less on a Mac Studio while a question waits or the model
+  is silent, and less while text streams. The stage's dot and running tick are now a slow opacity blink instead of a pulsing
+  ring, the spinners turn in small steps, and while a question or an approval blocks the turn they stand still, so movement
+  means chi is working. An in-turn card like check-in's keeps its dot blinking, as that turn goes on.
+
+### Fixed
+
+- An event with bytes JSON can't take (a plugin's card, say) no longer ends every stream that reaches it: it goes out scrubbed.
+- A waiting approval on the web page opens at its question and command, on a phone and on a desktop, when it arrives and when the page
+  loads on it. A card too tall for the stage showed its options with what it asks scrolled out of sight; the options are now a scroll
+  down the stage's one scroll.
+- `chi update` tells you a `chi web` started with `--port` runs old code; it only looked on `web.port`.
+- `chi self` finds a `chi web` started with `--port`; it said `not running on port N` for `web.port`.
+- `/guardrails` in chi web or an attached terminal shows all of its listing: a command's reply was cut at 4 KB, so with the core
+  bundle's rules System 1's section never showed and the text stopped mid-word. A reply now goes up to 64 KB, and a longer one ends
+  with a line saying it was cut.
+- A `!` command that prints bytes that aren't valid UTF-8 no longer breaks the session's page and attached terminals: its output
+  stopped every stream that reached it, on each reconnect. The bad bytes show as `?`, as they do in the saved conversation.
+- `/guardrails` no longer shows `System 1 (on):` when the settings mean nothing can be judged: it reads
+  `System 1 (on, but nothing is judged: system_one.host is not set):`, and likewise for a host that isn't in `hosts:`,
+  isn't `api: openai` or names no model.
+- A `bundles:` entry in config.yml for a bundle that isn't installed (or a key it doesn't take) warns once, not in every new session,
+  respawn and delegate; a changed finding warns again, as does one fixed and then back.
+- An answer with a line that opens and closes backticks itself (```` ```foo``` first ````) no longer loses every link after it: the source-links
+  and github-pr bundles and the web's file refs read it as inline code, not as a code block left open.
+- A session whose cost-cap, work-cap or check-in saved nothing no longer leaves an empty folder under `plugins/<bundle>/sessions/`.
+  `ctx.session_dir(create: false)` is the path with no folder made, for a bundle that only reads. `chi update` gets them
+  (cost-cap 0.2.5, work-cap 0.1.5, check-in 0.3.3).
+- A Stop that arrives on an empty reply ends the turn cancelled. It used to end
+  as "no answer: the model returned nothing".
+
+Update with `chi update` (the core profile 0.4.3): check-in 0.3.3, cost-cap 0.2.5 and work-cap 0.1.5 (these three need this chi), github-pr 0.6.2 and source-links 0.6.2.
+
 ## [0.143.0] - 2026-11-01
 
 ### Added
@@ -5481,7 +5549,9 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.143.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.145.0...HEAD
+[0.145.0]: https://github.com/dm1try/samagotchi/compare/v0.144.0...v0.145.0
+[0.144.0]: https://github.com/dm1try/samagotchi/compare/v0.143.0...v0.144.0
 [0.143.0]: https://github.com/dm1try/samagotchi/compare/v0.142.0...v0.143.0
 [0.142.0]: https://github.com/dm1try/samagotchi/compare/v0.141.0...v0.142.0
 [0.141.0]: https://github.com/dm1try/samagotchi/compare/v0.140.0...v0.141.0

data/docs/bundle-authoring.md

@@ -121,7 +121,7 @@ end
 `bundle.http.stub` stubs `ctx.http`; `bundle.question_asked(text, question:)` fires `:question_asked` and returns
 the refs; `sandbox.config`, `sandbox.fake_executable` and `bundle.install` cover setup.
 The full list is in [plugins.md, Testing a bundle](plugins.md#testing-a-bundle-experimental). The kit is
-experimental (it may change before chi 1.0). If a test needs a fake of chi's own (a stub of a `Samagotchi::`
+experimental (it may change before chi 1.0). A failing matcher that meets `ENV` prints `#<the process ENV, contents not shown>`, not your keys. If a test needs a fake of chi's own (a stub of a `Samagotchi::`
 class, a hand-built `ctx`), that is a gap in the kit: say so to the user rather than reaching into chi.
 
 ## Pitfalls

data/docs/cli.md

@@ -156,7 +156,8 @@ The loop for a bundle you're writing (the whole path: [bundle-authoring.md](bund
   never fires), `settings` (warn: a `--set` the manifest's `settings:` rules out, as config.yml's `bundles:` is told), `api` (warn: a `ctx.*` / `chi.*` call or a keyword this chi's API lacks, read from the source with
   Prism against the API's own classes, on a path that never runs too; written on a local `ctx` / `chi` itself, so a
   `s = ctx.sessions` variable isn't followed; a name the plugin guards with `respond_to?` is left), `boundary` (warn: a `Samagotchi::` name outside "Stable for bundles"; a shipped bundle's listed
-  exceptions aside) and `tests` (info: how to run them, or "no tests"). `--set KEY=VALUE` (repeatable, typed as
+  exceptions aside. On an installed bundle (`chi update`) only a name this chi no longer has is a row: the constant
+  doesn't resolve, or the method named isn't there) and `tests` (info: how to run them, or "no tests"). `--set KEY=VALUE` (repeatable, typed as
   `chi --set`) goes to `bundles: <name>:` in the sandbox's config.yml.
 
 ### Trying a bundle
@@ -314,7 +315,9 @@ done
   and each warning or error is a row under the bundle's name: `requires_chi`
   ruling this chi out, a plugin or hook that no longer loads, a hook on an event
   chi no longer fires, a `ctx`/`chi` call the API lacks, a reference to chi's
-  internals, a name chi now ships, or a hook or plugin edited since it was installed (it
+  internals that this chi no longer has (`Samagotchi::OldInternal::Thing is gone from this chi, so this bundle may
+  fail` — a name that still resolves gets no row, so a bundle reaching `Samagotchi::Log` isn't warned about on every
+  update), a name chi now ships, or a hook or plugin edited since it was installed (it
   doesn't load). What only an author can act on (shas, unlisted files, tests, a
   missing `requires_chi`, its floor, `trust_level`) is left out, and so are
   profiles. A clean bundle gets no row beyond its `skipped (not from chi)`.
@@ -350,8 +353,8 @@ done
   restarts: `chi sessions stop ID`, and the next prompt starts it on the new
   chi); it exits on its own only when nothing is attached (no web tab, no
   terminal, no reminder) and `session.idle_exit_minutes` pass (never with 0).
-  A new or woken worker always starts on the newest chi installed. A `chi web`
-  on `web.port` running an older chi needs a restart (Ctrl-C, then `chi web`):
+  A new or woken worker always starts on the newest chi installed. A running
+  `chi web` (on the port it was started with, else `web.port`) on an older chi needs a restart (Ctrl-C, then `chi web`):
   its page says so too. One from before workers started on the newest chi
   also starts its new sessions on its own version until then (the row says so).
 
@@ -1397,6 +1400,20 @@ access token", paste the token there (the part of the link after
   phone. The same sheet lists the other devices (a long-turns-done switch each, Remove), and `chi web push ls|rm|test`
   does it from the Mac (see [Phone notifications](configuration.md#phone-notifications-web-push)).
 
+#### The session bar on a phone
+
+At a phone's width (600 px or less) the session bar is one row with no swiping: the id (a tap copies it), the status, the model
+(cut short first), ⚙ and ⋯. ⋯ opens a bottom sheet with the rest:
+
+- a row for what the row has no room for, each opening what its chip opens on a wider screen: the model and the 🧰 toolkit (a tap
+  shows the full text a tooltip gives elsewhere), the working set (or the memories with `web.working_set` off), and, when the
+  session has them, participants, chain links, the parent, delegates, model notes and an older worker's Restart;
+- one line with ctx, speed, the clock and the folder;
+- Continue, Archive (or Unarchive), Stop and Delete, under the same rules and confirmations as the wider screen's buttons.
+
+A dot on ⋯ says something behind it needs a look: the accent when the working set changed or a participant is here, the warning
+colour when a delegate waits or the worker runs an older chi. The attached context's chips keep their own second line under the row.
+
 ### Remote sessions
 
 The session commands also reach another machine's sessions, through its chi

data/docs/configuration.md

@@ -127,7 +127,7 @@ own subsystems: `hosts:` (below), `models:` (see "Prompt profile" and
 `guardrails:` (see [Guardrails](guardrails.md)), `bundles:` (a bundle's
 settings for its hooks, see [Hooks: Settings](hooks.md#settings); a session's own
 `--set BUNDLE.KEY=VALUE`, for a key the bundle's manifest lists in `session_settings:`, lays over them, see
-[Per-session settings](plugins.md#per-session-settings); a name no installed bundle has, or a key its manifest's `settings:` rules out, warns at a session's start; `--set KEY=VALUE` does the same for a few core keys,
+[Per-session settings](plugins.md#per-session-settings); a name no installed bundle has, or a key its manifest's `settings:` rules out, warns at the start of the first session to find it and again only when the findings change or come back (a digest of the lines shown is stamped in `$XDG_STATE_HOME/samagotchi/bundles_warned`; the log has them from every session); `--set KEY=VALUE` does the same for a few core keys,
 see "Per-session settings" below),
 `memories:` and `append_system_prompt:` (see "Appended prompt files"). Their entry names (host names, model ids, aliases) are yours to
 choose. The `memories:` list is the persistent baseline for preloaded memory entries —

data/docs/guardrails.md

@@ -107,7 +107,9 @@ A file that doesn't parse is moved aside to `approvals.json.corrupt-<UTC time>`
 with one warning, and chi starts with no stored approvals (more asks, nothing lost).
 `/guardrails` lists the rules and approvals; `/guardrails revoke N` removes
 approval N. When System 1 is enabled or has judgments, it also shows this
-session's recent auto-allows and each rule's record summary. In System 1 `on`
+session's recent auto-allows and each rule's record summary, and its heading says
+when the settings mean nothing can be judged (`System 1 (on, but nothing is judged:
+system_one.host is not set):`; no request is made to check). In System 1 `on`
 mode, `/guardrails wrong [N]` flags the Nth newest auto-allowed call in this
 session as one System 1 should have asked about (default 1). The flag is
 appended to the judgments log; the rule asks again until its record is rebuilt.
@@ -1163,8 +1165,9 @@ written, and the call is denied without a card; a turn that stopped as the
 judgment came back opens no card either.
 
 `ruby script/system-one-probe HOST [MODEL]` asks three fixed approval-like
-questions through the client and prints each probability and the latency of
-the call — how a host is checked before any of this is turned on.
+questions, then a choice and a score question, through the client and prints
+each answer and the latency of the call — how a host is checked before any of
+this is turned on.
 
 ### Answering for the user: `on` mode
 

data/docs/hooks.md

@@ -489,10 +489,14 @@ notice is only added on top. A config hook (config.yml's own files) keeps its
 behaviour: no notice, just the log. A UI that joins later reads the same lines
 from `Engine#plugin_warning`.
 
+In the [bundle test kit](plugins.md#testing-a-bundle-experimental) a hook that raises raises
+`Testing::HookFailed` out of the call that fired it, under every `on_error`.
+
 ## Runtime Hook Registration
 
 You can also register hooks programmatically during a turn (they are cleared
-automatically after each `run_turn`):
+automatically after each `run_turn`; one that raises is logged, tells you once
+per event in a worker, as a bundle's does, and the next hook runs):
 
 ```ruby
 engine = Samagotchi::Engine.new

data/docs/internals/bridge.md

@@ -212,7 +212,8 @@ The Bridge exposes:
   `404` for an unknown id. A POST with a body because routes match exact paths.
 - `POST /session/:id/command` — a session command (`/model`, `/models`, `!rollback`, `!cmd`,
   `/continue`) for the worker loop; `202` with a `command_id` its `:command_ran` names, `400` when
-  the line isn't one. A `:command_ran` carries `thinking`, `reasoning_history` and `llm_context`
+  the line isn't one. A `:command_ran`'s `output` is the command's, up to `Worker::COMMAND_OUTPUT_LIMIT` (64 KiB of chars; past it
+  the text ends with a `[cut: N of M chars: …]` line, which the UIs print as they print the rest). It carries `thinking`, `reasoning_history` and `llm_context`
   (the summaries the next turn runs under) when the command changed them or the model, and
   `confirm: {line, text}` when a `/thinking` or `/reasoning-history` change from a `web:` or `tui:`
   client asks first (`CacheConfirm`; nothing changed, `line` applies it).

data/docs/internals/bundles.md

@@ -42,7 +42,7 @@ user-facing side (what a bundle owns, profiles, needs) is in [memory.md](../memo
 | `Builder` | `chi bundle build`: memories (+ the installed bundle's hooks, rules, plugin, scripts) → zip/tar/dir |
 | `Profile` | meta bundles (`includes:`): install the members, record which; `InstallResult#kept_own` names a new member's memory files the user already had, with other bytes (`kept_own_line`, printed by `chi bundle`, `chi update` and `chi bootstrap`); a dry run runs each member's Installer as a dry run too, so it names them as well |
 | `SystemBundle`, `ShippedUpdate` | the built-in system bundle (`ensure!` at Engine start, `sync` in `chi update`) and `chi update`'s upgrade of shipped bundles; both drive the Installer with `upgrade: true`. `ShippedUpdate.external` is the rest: what `chi update` only checks |
-| `InstalledCopy`, `BundleCommand::InstalledCheck` | `chi update`'s re-check of the bundles chi didn't ship ([docs/cli.md](../cli.md#updating)). `InstalledCopy` lays a record and its installed files out as a source folder (manifest.yml from `Manifest.write`, the files' own shas, memories from `bases/`); `InstalledCheck` forks per bundle (a plugin's `exit` or hang is that bundle's row; stdio to /dev/null, so `--json` stays parseable; `TIMEOUT`, then KILL of its group) and runs `Check.new(dir, installed: true)` there, which leaves out what only suits a source tree. The fork is the point: `Sandbox` swaps ENV and the plugin's code is arbitrary. `UpdateCommand#external_rows` makes the rows (`level`, never `failed`) and holds the check back while a newer gem is yet to take over (`@not_checked`), since a fork is this chi's code |
+| `InstalledCopy`, `BundleCommand::InstalledCheck` | `chi update`'s re-check of the bundles chi didn't ship ([docs/cli.md](../cli.md#updating)). `InstalledCopy` lays a record and its installed files out as a source folder (manifest.yml from `Manifest.write`, the files' own shas, memories from `bases/`); `InstalledCheck` forks per bundle (a plugin's `exit` or hang is that bundle's row; stdio to /dev/null, so `--json` stays parseable; `TIMEOUT`, then KILL of its group) and runs `Check.new(dir, installed: true)` there, which leaves out what only suits a source tree. Its `boundary` finding is narrower there than in a source tree: `Testing::Boundary.gone?` calls a reference gone only when its constant doesn't resolve or the object has no method the name names, so a bundle reaching `Samagotchi::Log` gets no row. lib loads lazily, so when a name doesn't resolve `gone?` requires every file of this chi's library in that same child and asks again (about 0.2 s, only for a bundle that reaches into chi at all); anything it can't read — a `const_get`, a require of a file that is there — is taken as still there. The fork is the point: `Sandbox` swaps ENV and the plugin's code is arbitrary. `UpdateCommand#external_rows` makes the rows (`level`, never `failed`) and holds the check back while a newer gem is yet to take over (`@not_checked`), since a fork is this chi's code |
 | `Uninstaller`, `Trash`, `Status`, `Listing` | remove, keep removed files, `chi bundle status`, `chi bundle list` |
 | `IndexUpdater`, `IndexSync` | the managed `index.md` lines (Installer; and the write/edit tools for memories) |
 | `EntrySize` | one memory's size in tokens: `memory.entry_warn_tokens`' crossing note after a memory write, `chi self`'s `big memories` row |

data/docs/internals/engine.md

@@ -811,7 +811,7 @@ Both loops:
   again, up to `retry.empty_answer` times (at most 3), with a hidden nudge (`TurnNote.empty_retry`) on the tail.
   The retry request runs at temperature 0.6 when the configured sampling sets no temperature; a configured one
   is kept. A length stop with the context at least 90% full is not retried. When the retries run out, the
-  Engine keeps a `TurnNote.empty` note as the turn's end.
+  Engine keeps a `TurnNote.empty` note as the turn's end. A Stop that lands on an empty reply ends the turn cancelled, in both loops.
 - **A refusal** (chat loop only): a finish reason `refusal` (Messages), or `content_filter` (OpenAI) with no text, is
   an empty answer never retried; text streamed before a refusal is not kept, and tool calls with it are not run. A
   `content_filter` with text keeps it, marked `ChatLoop::FILTERED_MARK`, also never retried. `ModelResult#refusal` is `{category:}` (from the response's

data/docs/internals/web-frontend.md

@@ -23,7 +23,7 @@ page. A factory dep a new version stops passing is the same hazard the other way
 out of `send_turn.js`, `session_actions.js` and `lists_view.js`); a page loaded before keeps all its old modules
 until a reload, so the risk is a mixed cache, not an open tab. `answer_fold.js`, `details_motion.js`,
 `turn_range.js`, `history_reveal.js`, `latest.js`, `session_payload.js`, `method_api.js`, `session_store.js`,
-`session_fields.js`, `feature_gates.js`, `revise_stack.js`, `revise_switch.js`, `shell_command.js`, `stale_params.js` and `popover_modal.js` are new modules for that reason.
+`session_fields.js`, `feature_gates.js`, `revise_stack.js`, `revise_switch.js`, `shell_command.js`, `stale_params.js`, `popover_modal.js` and `more_sheet.js` are new modules for that reason.
 
 ## Two pages, two models
 
@@ -210,6 +210,63 @@ createFamilyPop`) still place their own. Every popover behaves the same (`popove
 none behind. `model_picker.js`, `command_list.js` (listboxes: the focus stays in the input), `ref_menu.js` (a menu)
 and `update_sheet.js` (a native modal `<dialog>`) aren't popovers in that sense.
 
+**A phone's session bar** (`more_sheet.js`): CSS alone folds the chips and the bar's buttons away at 600 px or less
+(`display:none`, so the same `.meta` draws both layouts and `info_bar.js` knows nothing of it); they stay in the DOM.
+⋯'s sheet (`#infoMoreBtn`) draws its rows from the bar's model, and a row or an action clicks the real chip or button, so
+each keeps one set of handlers, confirmations and in-flight rules. A chip the sheet opens has no box to be placed at, so
+`chip_popover.js` places it, marks `aria-expanded` and gives focus back at the page's `[data-anchor-stand-in]` (⋯); that
+matters at exactly 600 px, where the CSS is a phone's but the shell (`SHEET_MAX`, `<`) still draws a popover, not a sheet.
+A new chip on the bar needs its place in that CSS's hidden list and a row in `moreRows`, and its attention state in the row, or
+it is lost on a phone. `app.js`'s `updateInfoBar` feeds the sheet (`update`) on every redraw; its rows and actions draw into
+fixed slots, so a row that joins keeps the focus where it was. The `narrowScreen` listener closes the sheet when the window grows.
+
+
+## The stage's height
+
+`stage_frame.js` is the one writer. The cap is a ceiling: 60% of the page, 80% with the cloud open, 85% while a card has
+the room, and never above the session panel. The frame is grow-only while a turn runs, so a change inside the stage
+never moves its top edge, with one exception: **the next step after a blocking card's answer lets the frame go, once**
+(`stage_view.js releaseHeldWait`, from `generationStarted`). The `held-wait` class says it is due: set with `waiting`,
+cleared there, so a later step, which calls it again, does nothing. What goes together: the live slots' waiting height, a
+raised cap, the tallest content seen (`forgetContent`). At the tap nothing moves: the card collapses to its line inside
+the held frame and the stage's scroll stays, unless the line would be above the view (a reader who scrolled down a card
+taller than the stage), when it comes back to the view's top (`settleAnsweredCard`).
+
+Two cards raise the cap: a model's own question whose reply overflows its slot (`drawRoom`, the question room, read from
+the reply's start with a pill to the card) and a blocking approval too tall for the stage's view, a delegate's relayed
+one too (`raiseForApproval`, `stage_frame.js fitsCap`). An approval gets the cap only: no room class and no pill, as it
+opens at its question and command (`revealTop`).
+
+## Frames
+
+During a turn the cost is frames, not code: JS, layout and style are each a few percent of a core, while an animation
+that updates at 60 fps keeps the compositor and GPU busy (25-50% of a core with nothing to show). Moving a pulse to
+`transform`/`opacity` on the compositor still costs most of that, because the composites go on; the update rate is what
+counts. So:
+
+- **An infinite animation is stepped, moves only `opacity` or `transform`, and stops when the turn waits.**
+  `spec/web/public/frames.test.js` reads every page and stylesheet for the first two (`.card.skeleton` is the allowed
+  exception: loading only), and for its off switch under `prefers-reduced-motion`.
+- The dot, a running tick and a live step's dot share `live-blink 2.4s steps(16)`. `steps()` applies per segment and the
+  keyframes have two, so that is 13 updates/s: a third keyframe would change the rate. The spinners are
+  `init-spin .8s steps(16)`, 20 updates/s.
+- A blocking card (`.turn-stage.waiting`: a question, an approval, a delegate's relayed one, whose parent's turn blocks on
+  it) stops them all, so movement means chi is working; `stage.spec.js`'s question scenario checks it, also after a
+  reload. An asking card (check-in) has no `.waiting`, as its turn goes on: its dot keeps blinking. `.init-spin` is
+  outside the stage (plugin setup only).
+- A one-shot fade on something that arrives many times a second is a recurring cost too. A live answer's new line
+  appears at once: its fade alone was about a quarter of the streaming answer's total on the Studio (24-25% of a core to
+  17-19%). The headline's `ts-fade` stays: turning it off saved nothing measurable.
+
+A running turn's text reaches the page at most every 100 ms (`turn_block.js FLUSH_MS`): a chunk only marks its step dirty,
+and `flush` writes the dirty steps, follows and runs `onChange`, which refreshes the stage on the next frame
+(`stage_view.js scheduleRefresh`, unthrottled: a collapse or a card stays immediate). The first chunk after a quiet
+interval flushes on the next frame, so a first token isn't late; one inside the interval sets a timer for the rest, which
+then asks for a frame, so a hidden tab's flush still pauses. A chunk that opens a step applies at once. What must not wait
+writes for itself: `generationCompleted` and a step's close write its text, a card's refresh reads the model.
+`reset`, `turnEnded` and `flush` itself cancel the timer. A frame already requested can't be cancelled that way, so it may
+run `flush` with nothing to write, which doesn't count as a flush for the interval.
+
 ## Stale answers
 
 The page switches sessions, reopens a popover or asks again while a fetch is out. An answer for the old ask must be
@@ -258,7 +315,7 @@ reach another device or the server.
 | Key | Module | What |
 |---|---|---|
 | `chi_model`, `chi_model_recent` | `model_pick.js`, `model_picker.js`, `start_page.js` | the start page's model and its recent list |
-| `chi_composer_collapsed` | `composer_fold.js` | the composer folded |
+| `chi_composer_collapsed` | `composer_fold.js` | the composer folded (a card's text field folds it for the time it has the focus on a narrow or touch screen, `composer_grip.js watchCardField`, on top of this and of the visit's state: neither is written) |
 | `chi_composer_floor` | `composer_grip.js`, `composer_mount.js` | the composer's dragged height |
 | `chi_strip_hidden` (`chi_zen`: the old name, read once) | app.js | the session strip hidden |
 | `chi_stage_collapsed` | `stage_view.js` | the stage collapsed |

data/docs/plugins.md

@@ -845,7 +845,7 @@ full label, `plugin.rb (bundle my-bundle)`.
 | `ctx.turn_author` | who wrote the running turn when it isn't the session's owner: a participant's `"p:<id>"` (`chi share`); nil for the owner's turns and between turns. Every hook event of such a turn carries the same as `author:`. The handler runs with the owner's power whatever the author ([hooks](hooks.md#participants-turns)). Needs chi 0.105.0 (guard it with `ctx.respond_to?(:turn_author)`) |
 | `ctx.settings` | the bundle's settings, frozen: config.yml's `bundles: <bundle>:` with the session's own `--set` values laid over it ([Per-session settings](#per-session-settings)); the config alone until the session is bound (in `register` and `chi.ctx`) |
 | `ctx.data_dir` | `$XDG_STATE_HOME/samagotchi/plugins/<bundle>/`, created on first use: what the bundle keeps across sessions |
-| `ctx.session_dir` | this session's own folder there, created on use, read now; nil with no session yet. chi removes it when the session is deleted, discarded or pruned, so don't build the path yourself. A `sessions/<id>.json` an older version of your bundle kept moves in as `state.json` (chi still removes one left there). Needs chi newer than 0.142.0 |
+| `ctx.session_dir` | this session's own folder there, created on use, read now; nil with no session yet. `ctx.session_dir(create: false)` is the same path with no folder made, for a read, so a session that saved nothing leaves none (a `File.read` of what isn't there raises `Errno::ENOENT`); needs chi newer than 0.143.0. chi removes it when the session is deleted, discarded or pruned, so don't build the path yourself. A `sessions/<id>.json` an older version of your bundle kept moves in as `state.json` (chi still removes one left there). Needs chi newer than 0.142.0 |
 | `ctx.log` | `ctx.log.info(:event, key: value)`: debug-log records tagged `plugins`, with `bundle=<bundle>` |
 | `ctx.messages` | the conversation, as a frozen copy, without the system prompt. While a turn runs, a session worker's (attached, web) adds that turn so far: its prompt, the model's text and the lines merged into it (no tool calls or thinking); the REPL's is the conversation before that turn. An entry may carry `at`, when it happened (docs/sessions.md, Message times) |
 | `ctx.messages_partial?` | whether `ctx.messages` leaves out a running turn (the REPL mid-turn), so a plugin can say what its answer is about |
@@ -1384,7 +1384,9 @@ that calls it, or for a real external bundle that does. No method on the chance
 and `Boundary::EXCEPTIONS` the per-bundle list of what each shipped bundle
 (and its specs) reaches beyond it, each with why: the APIs to design before
 that bundle could leave chi's repo. `spec/samagotchi/testing/boundary_spec.rb`
-fails on a reference in neither (docs/testing.md).
+fails on a reference in neither (docs/testing.md). In `chi update`'s re-check of
+an installed bundle the same scan warns only for a name this chi no longer has
+(`Boundary.gone?`): a reference that still resolves gets no row.
 
 **Used by shipped bundles today, but internal** (may change without notice; a
 bundle that needs one should ask for an API instead):

data/docs/releasing.md

@@ -28,7 +28,8 @@ can run the whole release; the user approves the notes before the tag and the
     one-line string). `release:bump` touches no other `requires_chi` but a
     profile's (next point);
   - a new `ctx.*` / `chi.*` call a plugin may make gets its release's version in `Plugin::Api::SINCE` once
-    released (`chi bundle check`'s `requires-chi-floor` reads it); an unreleased one waits there as a comment;
+    released (`chi bundle check`'s `requires-chi-floor` reads it); an unreleased one waits there as an `# Unreleased` comment, and
+    `release:check` fails while that comment is left: move each call up with the new version;
   - a new shipped bundle joins a profile (`includes:` in `core` or `dev`; a
     spec checks every bundle is in exactly one), and that profile's version
     goes up: `chi update` then installs only the new bundle for those who
@@ -71,7 +72,7 @@ as the GitHub release body.
 | `rake gem:validate`, `gem:build`, `gem:install`, `gem:clean` | Check the gemspec; build the gem into `pkg/`; build and install it locally; remove the built gems. |
 | `rake release:draft_changelog` | A draft Unreleased section from the commit subjects since the last tag, grouped. Stdout only. |
 | `rake release:bump[X.Y.Z]` | VERSION, the system manifest, Gemfile.lock, CHANGELOG, and `requires_chi: ">= X.Y.Z"` for each bundle marked `requires_chi_next` (the marker dropped), then a profile left below a member's `requires_chi` raised to it, with a patch bump of its version (none when it moved since the last tag) and named in the CHANGELOG's "Update with `chi update`" line. No commit. |
-| `rake release:check` | Clean tracked tree, VERSION == system bundle, a CHANGELOG section, no `requires_chi_next` left, `bundles:check`, `rake lint` (RuboCop) + `npm run lint` (the web frontend's ESLint), rspec (both roots: `spec` and the bundles' own `spec/`) + `rake bundles:specs` + npm test, `gem build`, then a clean install into a temp GEM_HOME that runs `chi --version`, `chi self` and `chi bundle list` with a temp HOME. Needs the network (gem dependencies). |
+| `rake release:check` | Clean tracked tree, VERSION == system bundle, a CHANGELOG section, no `requires_chi_next` left, no `# Unreleased` comment left in `Plugin::Api::SINCE`, `bundles:check`, `rake lint` (RuboCop) + `npm run lint` (the web frontend's ESLint), rspec (both roots: `spec` and the bundles' own `spec/`) + `rake bundles:specs` + npm test, `gem build`, then a clean install into a temp GEM_HOME that runs `chi --version`, `chi self` and `chi bundle list` with a temp HOME. Needs the network (gem dependencies). |
 | `rake release:notes[X.Y.Z]` | Prints the CHANGELOG section (default: the current VERSION). |
 
 ## Runbook

data/docs/testing.md

@@ -294,7 +294,7 @@ well formed (unique ids, known keys and labels, a rule that exists in its set).
 
 ```sh
 script/affected-specs                 # the specs for this branch's change, best first, at most 16
-bundle exec rspec $(script/affected-specs)
+script/affected-specs --run           # runs them; with no Ruby picks it says so and runs nothing
 script/affected-specs --why           # with the reason for each pick; --all: no cap; --run: runs them
 script/affected-specs A..B            # another range (A...B: from their merge-base); a single REV: vs the working tree
 ```

data/lib/samagotchi/bridge/sse_writer.rb

@@ -4,6 +4,7 @@ require "json"
 
 require_relative "client_event"
 require_relative "event_id"
+require_relative "../llm/utf8_scrub"
 
 module Samagotchi
   class Bridge
@@ -231,11 +232,20 @@ module Samagotchi
         lines << "id: #{EventId.format(seq, @epoch)}"
         event_type = data.is_a?(Hash) && (data[:type] || data["type"])
         lines << "event: #{event_type}" if event_type && !event_type.to_s.empty?
-        JSON.generate(data).each_line { |line| lines << "data: #{line.chomp}" }
+        frame_json(data).each_line { |line| lines << "data: #{line.chomp}" }
         io.write(lines.join("\r\n") + "\r\n\r\n")
         io.flush
       end
 
+      # An event holding bytes JSON can't take (a plugin's card, a tool's text)
+      # goes out scrubbed: raising here would end this stream, and every stream
+      # after it, for as long as the ring holds the event.
+      def frame_json(data)
+        JSON.generate(data)
+      rescue JSON::GeneratorError
+        JSON.generate(LLM::Utf8Scrub.call(data))
+      end
+
       def write_heartbeat(io)
         io.write(": ping\r\n\r\n")
         io.flush

data/lib/samagotchi/bundle_command/check.rb

@@ -403,8 +403,19 @@ module Samagotchi
         require_relative "../testing/boundary"
         known = shipped? ? Testing::Boundary::EXCEPTIONS.fetch(manifest.name, {}) : {}
         Testing::Boundary.scan(@dir).reject { |f| known.key?(f.reference) }.each do |finding|
-          add(:warn, :boundary, finding.file, "#{finding.reference} is internal to chi and may break on a chi upgrade",
-              fix: "use chi.* / ctx, or the names docs/plugins.md lists as stable")
+          if @installed
+            # `chi update` asks one question of a bundle it didn't write: what
+            # does this chi break of it. A name that still resolves is not a
+            # warning, so the table stays clear of rows that repeat while
+            # nothing is wrong.
+            next unless Testing::Boundary.gone?(finding.reference)
+
+            add(:warn, :boundary, finding.file, "#{finding.reference} is gone from this chi, so this bundle may fail",
+                fix: "use chi.* / ctx, or the names docs/plugins.md lists as stable")
+          else
+            add(:warn, :boundary, finding.file, "#{finding.reference} is internal to chi and may break on a chi upgrade",
+                fix: "use chi.* / ctx, or the names docs/plugins.md lists as stable")
+          end
         end
       end
 

data/lib/samagotchi/bundle_settings_check.rb

@@ -1,6 +1,10 @@
 # frozen_string_literal: true
 
+require "digest"
+require "fileutils"
+require_relative "atomic_file"
 require_relative "config"
+require_relative "paths"
 require_relative "session_config"
 require_relative "memory_bundle/provenance"
 
@@ -10,8 +14,11 @@ module Samagotchi
   # value's type a manifest's settings: rules out. A config file only warns:
   # the rest of it still runs, and `chi --set` is what refuses
   # (SessionConfig.check!, in the same words). A manifest with no settings:
-  # (a record from before them too) has its keys left alone.
+  # (a record from before them too) has its keys left alone. A digest of the
+  # lines last shown is stamped in $XDG_STATE_HOME/samagotchi/bundles_warned.
   module BundleSettingsCheck
+    STAMP_FILE = "bundles_warned"
+
     module_function
 
     # @param section [Hash{String => Hash}] ConfigFile.bundle_settings
@@ -29,6 +36,32 @@ module Samagotchi
       end
     end
 
+    # @return [String] the stamp of the lines last shown
+    def stamp_path(env: ENV) = File.join(Paths.state_dir(env: env), STAMP_FILE)
+
+    # The lines to show now: each worker checks the config, and all of them
+    # finding what the last one showed would repeat it in every session. None
+    # while +lines+ are the stamped ones (in any order); no lines clear the
+    # stamp, so the same typo made again is new. A stamp it can't read or
+    # write costs a repeated warning, never a session start.
+    # @param lines [Array<String>] #warnings
+    # @return [Array<String>] +lines+, or none
+    def unshown(lines)
+      stamp = stamp_path
+      if lines.empty?
+        FileUtils.rm_f(stamp)
+        return lines
+      end
+      digest = Digest::SHA256.hexdigest(lines.sort.join("\n"))
+      return [] if File.exist?(stamp) && File.read(stamp).strip == digest
+
+      FileUtils.mkdir_p(File.dirname(stamp))
+      AtomicFile.write(stamp, "#{digest}\n")
+      lines
+    rescue StandardError
+      lines
+    end
+
     # One bundle's +values+ against its record (or a manifest as one); none
     # while it declares no settings:.
     # @param bundle [MemoryBundle::InstalledBundle]

data/lib/samagotchi/bundles/check-in/manifest.yml

@@ -1,14 +1,14 @@
 ---
 name: check-in
-version: 0.3.1
+version: 0.3.3
 scope: system
 description: "Checks on a long turn: after N tool calls with no answer, a card asks the user (Nudge / Keep going / Stop), or the model is nudged to say what it has found"
 trust_level: reviewed
 plugin:
   file: plugin.rb
-  sha256: sha256:732f144471d146832d2f01a5e999463be789a35af476fbc5d97349091c07aea2
+  sha256: sha256:6580d6d19ac9beda871d88d3955abc5a319dd8b5aea225a06dee90b6daeeddce
 # check-in.progress asks System 1 (chi.judgment, new in 0.142.0);
-# ctx.session_dir is new in the next chi
-requires_chi: ">= 0.143.0"
+# ctx.session_dir is new in 0.143.0
+requires_chi: ">= 0.144.0"
 # config.yml bundles: check-in: (another key warns; an older chi ignores this)
 settings: [after, every, mode, message, ignore_tools]

data/lib/samagotchi/bundles/check-in/plugin.rb

@@ -236,15 +236,19 @@ class Plugin
   end
 
   def call_args(call)
-    args = call.is_a?(Hash) ? (call[:arguments] || call["arguments"] || call) : call
-    return args if args.is_a?(String)
+    return call if call.is_a?(String)
+    return JSON.generate(call) unless call.is_a?(Hash)
+
+    # A tool that isn't built in has its arguments on args: and, as JSON, in
+    # content: (or there alone, when none could be read): say them once.
+    args = call[:args]
+    return args.empty? ? call[:content].to_s : JSON.generate(args) if args.is_a?(Hash)
 
     # The tool's name is already in the entry and nil fields say nothing:
     # the cut should keep what the call asked for.
-    args = args.compact.except(:name, "name") if args.is_a?(Hash)
-    JSON.generate(args)
+    JSON.generate(call.compact.except(:name, "name"))
   rescue StandardError
-    args.to_s
+    call.to_s
   end
 
   def cut(text, limit)
@@ -389,7 +393,7 @@ class Plugin
   def read_state(ctx, id)
     return {} unless id
 
-    data = JSON.parse(File.read(state_file(ctx)))
+    data = JSON.parse(File.read(saved_file(ctx)))
     data.is_a?(Hash) ? data : {}
   rescue SystemCallError, JSON::ParserError
     {}
@@ -410,6 +414,9 @@ class Plugin
 
   def state_file(ctx) = File.join(ctx.session_dir, "state.json")
 
+  # For a read: a session with nothing saved keeps no folder.
+  def saved_file(ctx) = File.join(ctx.session_dir(create: false), "state.json")
+
   # --- helpers ---------------------------------------------------------------
 
   def calls = @mutex.synchronize { @count }

data/lib/samagotchi/bundles/core/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: core
-version: 0.4.2
+version: 0.4.3
 scope: system
 description: "Recommended safety set"
 trust_level: reviewed
 # Its members' highest floor (work-cap's: ctx.usage, raised at the release)
-requires_chi: ">= 0.143.0"
+requires_chi: ">= 0.144.0"
 includes:
 - loop-guard
 - check-in

data/lib/samagotchi/bundles/cost-cap/manifest.yml

@@ -1,15 +1,15 @@
 ---
 name: cost-cap
-version: 0.2.4
+version: 0.2.5
 scope: system
 description: "A per-session $ cap: at the cap the turn pauses on Continue (another cap's worth) / Stop, a warning at 80% goes to the user only; /cap shows or sets it"
 trust_level: reviewed
 plugin:
   file: plugin.rb
-  sha256: sha256:6101e5f4b2b454224ccc780637a84e429e90f179d8f37ba8681a1c5bf5d0c840
+  sha256: sha256:2d1f739ed0246d3d3040e0534cced2a1f621bdc5881fdde8b463df8a0501e477
 # ctx.cost is new in chi 0.83.0; ask_user's effects: in the next chi
-# ctx.session_dir is new in the next chi
-requires_chi: ">= 0.143.0"
+# ctx.session_dir is new in 0.143.0
+requires_chi: ">= 0.144.0"
 # session_settings: as a mapping of keys to types is new
 # chi --set cost-cap.cap=3: a session's own cap (ctx.settings["cap"]), a number or off
 session_settings: {cap: number}

data/lib/samagotchi/bundles/cost-cap/plugin.rb

@@ -247,7 +247,7 @@ class Plugin
   def state(ctx, session)
     return [nil, nil] unless session
 
-    path = state_file(ctx)
+    path = saved_file(ctx)
     saved = JSON.parse(File.read(path))
     raise JSON::ParserError, "not a JSON object" unless saved.is_a?(Hash)
     return [nil, nil] unless saved.key?("cap")
@@ -309,6 +309,9 @@ class Plugin
 
   def state_file(ctx) = File.join(ctx.session_dir, "state.json")
 
+  # For a read: a session with nothing saved keeps no folder.
+  def saved_file(ctx) = File.join(ctx.session_dir(create: false), "state.json")
+
   def money(value) = self.class.money(value)
 
   # Whether +key+ is new for the once-only notice kept in +ivar+ (and keep it).