samagotchi 0.148.0 → 0.150.0

data/lib/samagotchi/bundles/coordinator/plugin.rb

@@ -42,7 +42,8 @@
 # itself (the core child-boundary guardrail), in every mode: nothing to set up.
 #
 # The coordinator toolkit is lean plus the tools that run children
-# (delegate, delegate_result, list_sessions). /coordinate puts the session
+# (delegate, delegate_result, list_sessions) and objectives (the skill's
+# moves). /coordinate puts the session
 # on it before it asks the model (ctx.use_toolkit), which chi allows only
 # before the session's first model reply and outside a turn: otherwise it
 # says to run /toolkit coordinator, unless the session declares delegate
@@ -84,7 +85,7 @@ class Plugin
   def initialize(_settings = {}); end
 
   TOOLKIT = "coordinator"
-  TOOLKIT_TOOLS = %w[delegate delegate_result list_sessions].freeze
+  TOOLKIT_TOOLS = %w[delegate delegate_result list_sessions objectives].freeze
   CODING_TOOLKIT = "coding"
   CODING_PROMPT = "- Be concise in your responses\n- Show file paths clearly when working with files"
 

data/lib/samagotchi/bundles/coordinator/skill_coordinator.md

@@ -109,6 +109,13 @@ If the request is a new goal, say which handoffs are open (one line each) and go
    description to "DONE: …" and ask the user whether to remove it (memory_write name, scope and
    remove: true).
 
+## Objectives
+If this session has an OBJECTIVES note: when a branch's verdict, merge or blocker moves an objective, record it with
+`objectives` (action: move, the id, a one-line note, evidence: a sha or a test count), not per command.
+A move or a `done` is never approval to merge. A user's "not yet" on an objective a branch serves, or their changing
+what it asks, counts as "the user said to hold" that branch (step 6), until the user says otherwise; their marking it
+done isn't a hold. The user edits the list with /objectives; you don't.
+
 ## End of day
 When the user ends the day (`/coordinate end`, "that's all for today"), before you answer:
 1. Check where things stand: for each branch in your handoff `git log --oneline <default>..<branch>` and
@@ -167,3 +174,5 @@ participants: a manager or a teammate brings new context (a priority, a scope ch
   owner's Apply updates the handoff and re-plans, nothing started or merged there (0.6.0)
 - 2026-11-04 step 6: a branch verified with no doubts that can fast-forward merges with no question when chi's git-merge
   rule asks: the merge is chi's approval to give or pass; anything else asks as before (0.7.0)
+- 2026-11-04 Objectives: record a move with the objectives tool; a move or a done never approves a merge; a user's
+  "not yet" or changed objective is a hold until they say otherwise (0.8.0)

data/lib/samagotchi/bundles/decision-card/manifest.yml

@@ -0,0 +1,13 @@
+---
+name: decision-card
+version: 0.2.0
+scope: system
+description: "In a session with objectives, a long answer ending in a question gets a card: a short summary and the question, answered in the composer"
+trust_level: reviewed
+plugin:
+  file: plugin.rb
+  sha256: sha256:e628d84ab9521f7e8e5f3bc69da97fe00e574082412ea24e9f3f1c6234ad31a9
+# ctx.objectives and ctx.turn_running? are new after 0.148.0
+requires_chi: ">= 0.149.0"
+# config.yml bundles: decision-card: (another key warns; an older chi ignores this)
+settings: [min_chars, tail_chars, model, timeout, max_tokens]

data/lib/samagotchi/bundles/decision-card/plugin.rb

@@ -0,0 +1,280 @@
+# frozen_string_literal: true
+
+# The decision-card bundle (docs/bundles.md, The decision-card bundle): in a
+# session with objectives, an answer that is long and ends in a question gets a
+# card with a short summary and the question, so the question isn't lost at the
+# bottom of a long read. The user answers in the composer: the card has no
+# buttons, so it invents no options, and it asks nothing of anyone.
+#
+# The gate costs nothing: the answer's length and tail, read from the event
+# (event[:answer]: the stored message may still hold the native loop's thought),
+# then the list (ctx.objectives). Only then one side request (ctx.ask_model), on
+# a thread: the turn's end isn't held, and the web's answer doesn't wait for it.
+# Nothing goes in the conversation: the card is the Bridge's (cards.json, capped),
+# and uninstalling the bundle leaves a session as it was.
+#
+# A card may be late: a one-slot local server answers a side request after the
+# running one. A new turn means the user replied or moved on, so it cancels the
+# request (which frees the slot for that turn), and a card still to come is
+# dropped. One already shown folds to a line at the owner's next turn. The request
+# starts at once, ahead of the turn-end warm-up, so that the warm-up is the last
+# thing in a one-slot server's slot. The card waits for the turn to be over (the
+# hook runs inside it): shown earlier, it would belong to that turn's block, which
+# the web collapses.
+#
+# A failed request shows nothing: it is only logged.
+#
+# /short is the same seam on demand: the last answer's short version, in a card,
+# for any long answer (the web's objectives offer it), its model and its limits
+# the card's. Nothing enters the conversation here either.
+#
+# Settings (config.yml, bundles: decision-card:):
+#   min_chars: 1200   how long an answer is long
+#   tail_chars: 300   how far from the end the question may be
+#   model: nil        a cheap configured model ("host:id", an alias); nil is the session's
+#   timeout: 120      seconds the side request may take
+#   max_tokens: 300   the side answer's limit
+class Plugin
+  TITLE = "A question for you"
+  SYSTEM = "You read the end of a working session for a busy user. You only report what is written; you don't " \
+           "continue the task, and you don't answer the question."
+  # What the side request asks, in the three parts #parse reads.
+  REQUEST = <<~PROMPT
+    The assistant's last answer above may end by asking the user something. The session's objectives are:
+
+    %<list>s
+
+    Reply with exactly these three lines:
+    SUMMARY: what the answer says, in one or two plain sentences, at most 40 words
+    QUESTION: the question it asks the user, in one sentence, in its own words
+    OBJECTIVES: the ids of the objectives that question concerns, or none
+
+    If it asks the user nothing they have to decide, write QUESTION: none. Don't offer options or say which you would pick.
+  PROMPT
+  PART = /\A[\s*_#>-]*(summary|question|objectives)[\s*_]*:[\s*_]*(.*?)[\s*_]*\z/i
+  OBJECTIVE_ID = /\bO\d+\b/i
+  SUMMARY_CHARS = 500
+  QUESTION_CHARS = 300
+  # An :info card with no actions and one line up to 160 characters is a notice row (docs/plugins.md, Cards).
+  FOLDED_CHARS = 160
+  # A question mark that ends a word (not a URL's), with the marks that may close it.
+  SHORT_TITLE = "Short version"
+  SHORT_CUT_OFF = "No short version: the session stopped before it came."
+  SHORT_BUSY = "a turn is running: /short works on its answer, after this turn"
+  # Under the answer. Two paragraphs also keep it a card: a short body alone is a collapsed notice row.
+  SHORT_NOTE = "_Asked on demand, not added to the conversation._"
+  SHORT_REQUEST = "Give the assistant's last answer above in two or three plain sentences, at most 60 words. Say what it " \
+                  "found or did, and anything it asks the user. Add nothing it doesn't say."
+  QUESTION_MARK = /[?？؟](?=[\s"'”’»」』)*_\]…]|\.(?:\s|\z)|\z)/
+  CODE = /```.*?(?:```|\z)|~~~.*?(?:~~~|\z)|`[^`\n]*`|^(?: {4}|\t)[^\n]*/m
+  # What a side answer says for "nothing to decide", however it words it.
+  NO_QUESTION = %r{\A(?:none\b|n/a\b|no questions?\b|there (?:is|are) no questions?\b)}i
+  TURN_END_POLL = 0.02
+
+  # One answer's side request: the session it is for, and how to cancel it.
+  Ask = Data.define(:session_id, :cancel)
+  # A card on screen, to fold when the owner's next turn starts.
+  Shown = Data.define(:id, :question)
+  # What the side answer said: Item ids the list has, in its order.
+  Reading = Data.define(:summary, :question, :ids)
+
+  def initialize(settings = {})
+    @min_chars = positive(settings["min_chars"]) || 1200
+    @tail_chars = positive(settings["tail_chars"]) || 300
+    model = settings["model"].to_s.strip
+    @model = model.empty? ? nil : model
+    @timeout = positive_number(settings["timeout"]) || 120
+    @max_tokens = positive(settings["max_tokens"]) || 300
+    @mutex = Mutex.new
+    @ask = nil
+    @shown = []
+    @shorts = {}
+    @thread = nil
+  end
+
+  def register(chi)
+    chi.on(:before_turn) { |event, ctx| turn_started(event, ctx) }
+    chi.on(:after_turn) { |event, ctx| turn_ended(event, ctx) }
+    chi.service(:short_requests, eager: true) do |svc|
+      svc.on_stop { @mutex.synchronize { @shorts.keys }.each { |id| end_short(id, SHORT_CUT_OFF) } }
+      true
+    end
+    chi.command("/short", "the last answer's short version, in a card; nothing enters the conversation", anytime: true) do |_args, ctx|
+      short(ctx)
+    end
+  end
+
+  # The side request's thread is done. Nothing in chi waits for it: it is for specs.
+  def settle = @thread&.join
+
+  private
+
+  # Any turn makes a request in flight stale, and the slot matters. Only the
+  # owner's answers a shown card: a reminder or a child's report has no prompt
+  # (a wake runs as a continue), and a participant's has an author.
+  def turn_started(event, ctx)
+    owner = !event[:author] && !event[:prompt].to_s.strip.empty?
+    ask, shown = @mutex.synchronize do
+      taken = [@ask, owner ? @shown : []]
+      @ask = nil
+      @shown = [] if owner
+      taken
+    end
+    ask&.cancel&.cancel!(:new_turn)
+    shown.each { |card| fold(ctx, card) }
+  end
+
+  def fold(ctx, shown)
+    ctx.card(id: shown.id, title: "Asked", body: cut(shown.question, FOLDED_CHARS))
+  end
+
+  # On the command's own thread. Not beside a turn: ctx.messages holds that turn so
+  # far, so its "last answer" would be interim text.
+  # @return [String, nil] what the command answers: only why there is no card
+  def short(ctx)
+    return SHORT_BUSY if ctx.turn_running?
+
+    messages = ctx.messages
+    answer = last_answer(messages) or return "no answer to shorten yet"
+
+    id = ctx.card(title: SHORT_TITLE, body: "…")
+    @mutex.synchronize { @shorts[id] = ctx }
+    reply = ctx.ask_model(messages: exchange(last_prompt(messages), answer), prompt: SHORT_REQUEST, system: SYSTEM,
+                          timeout: @timeout, max_tokens: @max_tokens, model: @model)
+    end_short(id, "#{reply.strip}\n\n#{SHORT_NOTE}")
+    nil
+  rescue StandardError => e
+    end_short(id, "No short version: #{e.message}") if id
+    nil
+  end
+
+  # Once per card, whichever comes first: its answer, or the worker leaving with
+  # the request still out (chi waits 3 s for a command, then this service stops,
+  # while a card can still reach the UIs). A worker killed outright runs neither:
+  # its "…" stays, a one-line row.
+  def end_short(id, body)
+    ctx = @mutex.synchronize { @shorts.delete(id) } or return
+
+    ctx.card(id: id, title: SHORT_TITLE, body: body)
+  end
+
+  # @return [String, nil] the newest non-empty answer's text
+  def last_answer(messages)
+    found = Array(messages).reverse_each.find do |message|
+      %w[model assistant].include?(field(message, :role).to_s) && !field(message, :content).to_s.strip.empty?
+    end
+    found && field(found, :content).to_s
+  end
+
+  def turn_ended(event, ctx)
+    return unless event[:status].to_s == "completed"
+    # A participant's question is for the participant, on the owner's model; a
+    # one-shot run ends before any card is read.
+    return if event[:author] || ctx.frontend == :one_shot
+
+    answer = event[:answer]
+    return unless answer && answer.length >= @min_chars && question_at_tail?(answer)
+
+    prompt = last_prompt(event[:messages])
+    ask = Ask.new(session_id: ctx.session_id, cancel: Samagotchi::CancellationController.new)
+    @mutex.synchronize { @ask = ask }
+    @thread = Thread.new { ask_for_card(ctx, ask, answer, prompt) }
+  end
+
+  # @return [String, nil] the owner's text the turn answers
+  def last_prompt(messages)
+    prompt = Array(messages).reverse_each.find { |message| field(message, :role).to_s == "user" && field(message, :kind).to_s.empty? }
+    prompt && field(prompt, :content).to_s
+  end
+
+  def field(message, key) = message[key] || message[key.to_s]
+
+  def question_at_tail?(answer)
+    prose = answer.gsub(CODE, "").rstrip
+    prose[-[@tail_chars, prose.length].min..].to_s.match?(QUESTION_MARK)
+  end
+
+  # On its own thread. Nothing here reaches the user but the card.
+  def ask_for_card(ctx, ask, answer, prompt)
+    list = ctx.objectives
+    return unless list.items.any? { |item| item.status == "active" }
+
+    reply = ctx.ask_model(messages: exchange(prompt, answer), prompt: format(REQUEST, list: list.text), system: SYSTEM,
+                          timeout: @timeout, max_tokens: @max_tokens, cancel: ask.cancel, model: @model)
+    reading = parse(reply, list)
+    return ctx.log.info("no_card", reason: "the side answer named no question and summary") unless reading
+
+    sleep(TURN_END_POLL) while ctx.turn_running? && current?(ask)
+    show(ctx, ask, reading, list)
+  rescue Samagotchi::Plugin::ModelCancelled
+    ctx.log.info("no_card", reason: "a new turn started")
+  rescue StandardError => e
+    ctx.log.warn("no_card", reason: "#{e.class}: #{e.message}"[0, 300])
+  end
+
+  def exchange(prompt, answer)
+    [prompt && { role: "user", content: prompt }, { role: "model", content: answer }].compact
+  end
+
+  def current?(ask) = @mutex.synchronize { @ask.equal?(ask) }
+
+  # Under the mutex, as a new turn's start is: a card shows before that start
+  # takes it (and folds it), or not at all.
+  def show(ctx, ask, reading, list)
+    @mutex.synchronize do
+      next ctx.log.info("no_card", reason: "a new turn started") unless @ask.equal?(ask) && ctx.session_id == ask.session_id
+
+      @ask = nil
+      id = ctx.card(title: title(reading), body: body(reading, list))
+      @shown << Shown.new(id: id, question: reading.question)
+    end
+  end
+
+  def title(reading) = reading.ids.empty? ? TITLE : "#{TITLE} · #{reading.ids.join(", ")}"
+
+  def body(reading, list)
+    concerns = reading.ids.map { |id| "Concerns #{id} #{list.find(id).text}" }
+    [reading.summary, "**#{reading.question}**", *concerns].join("\n\n")
+  end
+
+  # The reply's three parts, however a small model marked them up. Lines after a
+  # part's own belong to it.
+  # @return [Reading, nil] nil without both a summary and a question
+  def parse(reply, list)
+    parts = Hash.new { |hash, key| hash[key] = [] }
+    current = nil
+    reply.to_s.each_line do |line|
+      if (part = line.strip.match(PART))
+        current = part[1].downcase
+        parts[current] << part[2]
+      elsif current
+        parts[current] << line.strip
+      end
+    end
+    summary = clean(parts["summary"], SUMMARY_CHARS)
+    question = clean(parts["question"], QUESTION_CHARS)
+    return nil if summary.empty? || question.empty? || question.match?(NO_QUESTION)
+
+    Reading.new(summary: summary, question: question, ids: ids(parts["objectives"], list))
+  end
+
+  def clean(lines, limit) = cut(lines.join(" ").gsub(/[[:space:]]+/, " ").strip, limit)
+
+  # Display only: a named id the list has and hasn't dropped.
+  def ids(lines, list)
+    named = lines.join(" ").scan(OBJECTIVE_ID).map(&:upcase)
+    list.items.reject { |item| item.status == "dropped" }.map(&:id) & named
+  end
+
+  def cut(text, limit) = text.length > limit ? "#{text[0, limit - 1]}…" : text
+
+  def positive_number(value)
+    number = Float(value.to_s, exception: false)
+    number&.positive? ? number : nil
+  end
+
+  def positive(value)
+    number = Integer(value.to_s, exception: false)
+    number&.positive? ? number : nil
+  end
+end

data/lib/samagotchi/bundles/dev/manifest.yml

@@ -1,10 +1,10 @@
 ---
 name: dev
-version: 0.7.4
+version: 0.7.6
 scope: system
 description: "Developer tools"
 trust_level: reviewed
-requires_chi: ">= 0.140.0"
+requires_chi: ">= 0.150.0"
 includes:
 - known-names
 - mcp
@@ -17,3 +17,4 @@ includes:
 - codex-peer
 - ruby
 - model-notes
+- decision-card

data/lib/samagotchi/bundles/github-pr/manifest.yml

@@ -1,17 +1,17 @@
 ---
 name: github-pr
-version: 0.6.2
+version: 0.6.3
 scope: system
 description: Proposes the branch's open GitHub pull request to a session, attached once you mention it (#N, the branch or its URL), and attaches any PR URL with chi context add or the web's "+ URL"; the agent gets a note when reviews, comments, checks or its state change; in the web, a path:line in an answer links to that line of the PR; the auto_attach setting can attach the PR at once instead, or do nothing
 trust_level: reviewed
-requires_chi: ">= 0.140.0"
+requires_chi: ">= 0.150.0"
 needs:
 - command: gh
   why: reads the pull request
   hint: brew install gh, then gh auth login
 plugin:
   file: plugin.rb
-  sha256: sha256:114e999c49d4d427b7570e3f4bec8db5565ee0dd1a99f2f5ec3000748a1aec3a
+  sha256: sha256:82f8c76d38f314c3503eef3a5de0f8c0b20d0bb5bf4a3daebca43b60d00f8c7a
 scripts:
   pr_context.rb: sha256:a883d2780e89c68c0d7b6d5e0fcb22c273f17bb167e79064e0e99db6bd2ee6f0
 context_providers:

data/lib/samagotchi/bundles/github-pr/plugin.rb

@@ -5,6 +5,7 @@ require "json"
 require "open3"
 require "time"
 require "tmpdir"
+require "samagotchi/git_env"
 
 # github-pr: a session on a branch with an open GitHub PR gets the PR
 # proposed as a candidate (docs/context.md, Candidates) when its worker
@@ -334,7 +335,7 @@ class Plugin
 
   # stdout of a command that succeeded within COMMAND_SECONDS, else nil.
   def run(ctx, *command, chdir: ctx.cwd)
-    Open3.popen2(*command, chdir: chdir, err: File::NULL, pgroup: true) do |stdin, stdout, wait|
+    Open3.popen2(Samagotchi::GitEnv::UNSET, *command, chdir: chdir, err: File::NULL, pgroup: true) do |stdin, stdout, wait|
       stdin.close
       reader = Thread.new { stdout.read }
       unless wait.join(COMMAND_SECONDS)

data/lib/samagotchi/bundles/known-names/hooks/known_names.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "samagotchi/git_env"
+
 # A before_tool_call guard against near-misses of protected identifiers in
 # a tool call's command or paths: the user's home folder name, login, git
 # name and email, the repo name, and any names from config. A local model
@@ -187,7 +189,7 @@ class KnownNames
   end
 
   def git_config(root, key)
-    IO.popen(["git", "-C", root, "config", "--get", key], err: File::NULL, &:read).to_s.strip
+    IO.popen(Samagotchi::GitEnv::UNSET, ["git", "-C", root, "config", "--get", key], err: File::NULL, &:read).to_s.strip
   rescue StandardError
     ""
   end

data/lib/samagotchi/bundles/known-names/manifest.yml

@@ -1,6 +1,7 @@
 ---
 name: known-names
-version: 0.1.8
+version: 0.1.9
+requires_chi: ">= 0.150.0"
 scope: system
 description: Catches a near-miss of a protected name (home folder, login, git name, repo name, names from config) in a tool call and rejects it with the right spelling; mode ask / correct optional
 trust_level: reviewed
@@ -8,7 +9,7 @@ files:
   known_names.md: sha256:d5348b95b6c655017b541910b36e384220da280818160201f6ec9a50e1e4287c
 hooks:
   known_names.rb:
-    sha256: sha256:a851637e9292f825dc5b8877cd060184de976aa4297b114dab412a89fa3cf091
+    sha256: sha256:d7eed0dd0f418d8099a147ed124c6e6062b8c752035dd6b5aa5e926e29941c8b
     event: before_tool_call
     on_error: log
     priority: 50

data/lib/samagotchi/bundles/source-links/hooks/source_links.rb

@@ -2,6 +2,7 @@
 
 # Loaded through module_eval: it requires what it uses.
 require "open3"
+require "samagotchi/git_env"
 require "samagotchi/ref"
 
 # An after_turn (and question_asked) hook that links the source refs the
@@ -621,8 +622,7 @@ class SourceLinks
   end
 
   def read_remote(dir, name)
-    out, status = Open3.capture2({ "GIT_DIR" => nil, "GIT_WORK_TREE" => nil },
-                                 "git", "-C", dir, "remote", "get-url", name, err: File::NULL)
+    out, status = Open3.capture2(Samagotchi::GitEnv::UNSET, "git", "-C", dir, "remote", "get-url", name, err: File::NULL)
     unless status.success?
       Samagotchi::Log.debug(:hooks, "source_links_no_remote", remote: name, exit: status.exitstatus)
       return nil

data/lib/samagotchi/bundles/source-links/manifest.yml

@@ -1,15 +1,15 @@
 ---
 name: source-links
-version: 0.6.2
+version: 0.6.3
 scope: system
 description: Links source refs (JIRA tickets, GitHub issues, …) in the model's answer — inline links in the web, refs in a waiting question's reply, and a one-line note after the turn (note false turns it off); sources are configured patterns
 trust_level: reviewed
-requires_chi: ">= 0.98.0"
+requires_chi: ">= 0.150.0"
 files:
   source_links.md: sha256:ace01a0f7c308a0ae54ece714c31c0e6d7a49c372d98111030e6d268320bed3a
 hooks:
   source_links.rb:
-    sha256: sha256:7e3fafb843f1a9006b1a42f4ec647b41a358d814515cd0be73b60eb08b898992
+    sha256: sha256:21d7a9f7c381c653b126b625feed0e0b6422eaa84c8dfe716b6c5b41644a33b3
     events: [after_turn, question_asked]
     on_error: log
     priority: 90

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.148.0
+version: 0.150.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:29c2f7df9f6c5acbc5ec17000a4490741e55e426af15ca0d81c8706edd9bd027
-  self_map.md: sha256:c9ece2d56c63fb0f9842963cb0b123e89abadec888645d7a765a2578ceefee3a
+  self_map.md: sha256:e695f78f858c29ccfef2ed6f9d6dd86d0ec067ed704a5a1956c01e53617948a1
   config_modification_protocol.md: sha256:8896d1d364ce835040f69b504518d43dbdf959b93fdd9b10f87a8de61cae84a8
-  memory_guide.md: sha256:64c3fa0703a3bdd8ae33b9e7cb341caa88a205c289d767f4877b38dfa6629fda
+  memory_guide.md: sha256:bfe9f13e8a6c929056fe531c4c74c7e05d0f17f025191c1a111c8e7dfd224fd6
   delegated.md: sha256:a0d6ddcd4a8be06526d964898611775fd251cfd9d145a9d16afaccaa503597bd

data/lib/samagotchi/bundles/system/memory_guide.md

@@ -114,9 +114,9 @@ Bundles are versioned directories/zips/tar.gz/git URLs with a `manifest.yml` and
 | Command | Purpose |
 |---------|---------|
 | `install <source> [--scope system\|project] [--force]` | Install from dir/zip/tar.gz/git URL. `--force` overwrites existing entries, otherwise skips them; a skipped file stays the user's (not recorded, never upgraded or removed by the bundle). Writes provenance to `.bundles/<name>/` (base snapshots + `manifest.json`) and updates `index.md`. Warns on double-brace placeholders and checksum mismatches (strict mode). |
-| `upgrade <source> [--force] [--dry-run] [--agent]` | 3-way merge upgrade (base vs current vs incoming) per `Merger.classify`: `install` (new file), `noop` (current==incoming), `fast_forward` (current==base, not edited → auto-update), `keep` (incoming==base → preserve local edits), `conflict` (both edited → warn, needs `--force` or interactive `memory_write` resolution). Pruned files (removed from new bundle) are kept if locally edited, otherwise warned. |
+| `upgrade <source> [--force] [--dry-run] [--agent]` | 3-way merge upgrade (base vs current vs incoming) per `Merger::Upgrade#outcome` (`Merger.classify`, then a text merge where both sides changed): `install` (new file), `noop` (current==incoming), `fast_forward` (current==base, not edited → auto-update), `keep` (incoming==base → preserve local edits), `merged` (both edited, a text merge with `git` comes out clean → the file takes it, the old one goes to the bundle trash, and entries both sides added under a `Changelog` heading are kept), `conflict` (both edited, a real conflict, or no `git` or base → the file stays untouched and marked, reported as `X stays behind 0.8.0: …` with why and what it missed, needs a retry, `--force`, which copies it to the trash first, or interactive `memory_write` resolution). A marked file is retried at the same version: the system bundle's at each chi start and on `chi update`, another shipped bundle's on `chi update`, any other bundle's on `chi bundle upgrade`. A file marked by an older chi merges normally when its recorded base is a version chi shipped (an installed samagotchi gem still has it); otherwise it merges only if the bundle takes out or rewords no line it still holds, and if it does, it stays behind until resolved by hand, with `--agent` or with `--force`, and the retry can't fix that. Pruned files (removed from new bundle) are kept if locally edited, otherwise warned. |
 | `uninstall <bundle> [--force]` | Moves the bundle's memory files to `.bundles/.trash/<bundle>-<time>/` (refuses locally edited ones unless `--force`; keeps a file another installed bundle also lists), removes their `index.md` lines, deletes the provenance dir. |
-| `status [<bundle>]` | Provenance + per-file `ok|modified|missing|no-index` vs stored checksum and base snapshot; a model overlay (`<name>.<key>.md`) has no index line and reads `ok (model overlay)`. |
+| `status [<bundle>]` | Provenance + per-file `ok|modified|missing|unreadable|no-index` vs stored checksum and base snapshot, and what stays behind or merged at a chi start; `issues=` counts files behind, missing or unreadable, not edits; a model overlay (`<name>.<key>.md`) has no index line and reads `ok (model overlay)`. |
 | `diff <bundle> [file]` | Prints `base` (provenance snapshot) vs `current` (on-disk) for each file. |
 | `list` | Lists installed bundles (`name v<version> scope files installed_at`, plus the shipped version when newer) and the bundles shipped with chi that are not installed (`install <name>` installs one), grouped under their profile; an installed profile shows `includes=` and `left out=`. |
 | `build [--scope system\|project] [--name NAME] [--version VER] [--description DESC] [--out PATH] [FILES...]` | **Inverse of install** — builds a shareable bundle from local memories and installed hooks. Infers `zip` vs `dir`/`tar.gz` from `--out` extension; default `chi_system_memories.zip` (system) or `chi_<repo>_memories.zip` (project, named after the project root) v`1.0.0` in `Dir.pwd`. `FILES...` is an optional allowlist of memory basenames (`identity` or `identity.md`); if omitted, all `*.md` except `index.md`/hidden/non-md and the memories other installed bundles own (each named in a `Left out` line) are included. Installed hooks are copied to `hooks/` with their manifest metadata. Computes `sha256:` checksums and writes `manifest.yml` via `Manifest.write`. No provenance write. |
@@ -138,7 +138,7 @@ chi bundle install https://github.com/org/bundle.git#v1.2.0 --scope system --for
 
 # check what would change and upgrade
 chi bundle upgrade ./my-bundle --dry-run
-chi bundle upgrade ./my-bundle  # auto-merges, warns on conflicts
+chi bundle upgrade ./my-bundle  # merges your edits, warns on a real conflict
 
 # share again after editing
 chi bundle build --scope system --out updated.zip
@@ -155,9 +155,9 @@ chi bundle build --scope system --out updated.zip
 2. **Prefer project scope** for repo decisions; `system` for cross-project identity/preferences.
 3. **One concept per file:** small files merge and share better than monoliths.
 4. **Use bundles for sharing:** `build` → zip → share → `install`. Do not copy raw `~/.config` paths in docs — give `chi bundle install <url>` instructions.
-5. **Respect local edits:** installs skip existing files by default; use `--force` only when the user explicitly wants overwrite. Upgrades preserve edits (`keep`) or report `conflict` — guide the user to resolve via `memory_read`/`memory_write` or `chi bundle diff <bundle>` + `--force`.
+5. **Respect local edits:** installs skip existing files by default; use `--force` only when the user explicitly wants overwrite. Upgrades preserve edits (`keep`, `merged`) or report `conflict`, leaving the file behind — guide the user to resolve via `memory_read`/`memory_write` or `chi bundle diff <bundle>` + `--force`.
 6. **Keep secrets out:** never write tokens/keys to memories — they are plain files and go into bundles.
 
 ## Current system bundle
 
-`samagotchi-system` (`lib/samagotchi/bundles/system/manifest.yml`) ships `identity.md` + `self_map.md` + `config_modification_protocol.md` + `delegated.md` + this guide itself. It is auto-installed/upgraded on first `Engine` creation (`SystemBundle.ensure!`) — no manual install needed. Its files are managed by chi: a newer chi upgrades them (a 3-way merge keeps local edits and reports conflicts), so put your own preferences in separate memories rather than editing these.
+`samagotchi-system` (`lib/samagotchi/bundles/system/manifest.yml`) ships `identity.md` + `self_map.md` + `config_modification_protocol.md` + `delegated.md` + this guide itself. It is auto-installed/upgraded on first `Engine` creation (`SystemBundle.ensure!`) — no manual install needed. Its files are managed by chi: a newer chi upgrades them (a text merge keeps local edits, and a real conflict leaves the file behind), so put your own preferences in separate memories rather than editing these.

data/lib/samagotchi/bundles/system/self_map.md

@@ -83,7 +83,7 @@
   `file:line`. Read the source `chi self` reports, not some other checkout on disk.
 - Installed gem files and bundled memories (`identity`, `memory_guide`,
   `config_modification_protocol`, `self_map`, `delegated`) are managed: don't edit them
-  (local edits conflict on upgrade).
+  (an upgrade merges local edits when it can, and a real conflict leaves the file behind).
   Put notes in my own memories. Guidance for some models only is a model note
   (`model_notes_<name>`, first line `models: <glob>`; memory_guide); a model-only
   addition to one memory is an overlay on it (`current_model_only: true`), and it

data/lib/samagotchi/chi_home.rb

@@ -6,6 +6,7 @@ require "open3"
 require "rbconfig"
 require "time"
 require_relative "atomic_file"
+require_relative "bundler_env"
 require_relative "installed_gem"
 require_relative "log"
 require_relative "paths"
@@ -33,8 +34,9 @@ module Samagotchi
     # Where `mise` usually is when PATH doesn't have it (launchd's bare PATH).
     MISE_DIRS = ["/opt/homebrew/bin", "/usr/local/bin", File.join(Dir.home, ".local", "bin")].freeze
     # What a probe of another Ruby must not inherit: they would move it off
-    # its own gems.
-    PROBE_UNSET = %w[GEM_HOME GEM_PATH RUBYOPT RUBYLIB BUNDLE_GEMFILE BUNDLE_BIN_PATH].freeze
+    # its own gems. BUNDLER_SETUP alone does: RubyGems requires what it names at
+    # boot, and a bundle with a path then replaces GEM_HOME and GEM_PATH.
+    PROBE_UNSET = (%w[GEM_HOME GEM_PATH] + BundlerEnv::CHILD_RUBY).freeze
     PROBE = "require 'json'; print JSON.generate('ruby' => RbConfig.ruby, 'gem_home' => Gem.dir, " \
             "'gem_path' => Gem.path.join(File::PATH_SEPARATOR))"
     GEMSPEC = /\Asamagotchi-(#{Gem::Version::VERSION_PATTERN})\.gemspec\z/

data/lib/samagotchi/chi_shim.rb

@@ -3,6 +3,7 @@
 require "fileutils"
 require "shellwords"
 require_relative "atomic_file"
+require_relative "bundler_env"
 require_relative "chi_home"
 require_relative "log"
 require_relative "paths"
@@ -25,7 +26,7 @@ module Samagotchi
     # ruby: unset before the exec.
     UNSET = "unset RUBYOPT RUBYLIB RUBYGEMS_GEMDEPS GEMRC LD_PRELOAD LD_LIBRARY_PATH DYLD_INSERT_LIBRARIES " \
             "DYLD_LIBRARY_PATH\n" \
-            "for v in $(/usr/bin/env | /usr/bin/sed -n 's/^\\(BUNDLE[A-Za-z0-9_]*\\)=.*/\\1/p'); do unset \"$v\"; done\n"
+            "for v in $(/usr/bin/env | /usr/bin/sed -n 's/^\\(#{BundlerEnv::PREFIX}[A-Za-z0-9_]*\\)=.*/\\1/p'); do unset \"$v\"; done\n"
 
     module_function
 

data/lib/samagotchi/child_env.rb

@@ -20,16 +20,23 @@ module Samagotchi
     # (Tools::Builtins.parent_env): that session's, not a child chi's.
     SESSION_MARKERS = %w[SAMAGOTCHI_PARENT_SESSION SAMAGOTCHI_SESSION_MODEL SAMAGOTCHI_SESSION_THINKING
                          SAMAGOTCHI_SESSION_REASONING_HISTORY].freeze
+    # "1" in the chi update an automatic run starts (Web::UpdateOps): no person
+    # reads its rows. An env marker, so it reaches the chi a hand-over or the home
+    # execs, and an older chi that doesn't know it simply ignores it.
+    UNATTENDED_UPDATE = "SAMAGOTCHI_UPDATE_UNATTENDED"
 
     module_function
 
     # The keys of +env+ a child chi must not inherit: the guardrails
     # settings, the session markers, a smoke's fake "newest installed"
-    # (InstalledVersions::ENV_KEY, for the spawner's notices only) and the
-    # worker's project env marker and record (a child worker applies its own).
+    # (InstalledVersions::ENV_KEY, for the spawner's notices only), the
+    # worker's project env marker and record (a child worker applies its own) and
+    # an automatic update's marker (a session someone starts from one isn't it; the
+    # update's own hand-over execs, which this doesn't touch).
     # @return [Array<String>]
     def spawner_keys(env = ENV)
-      env.each_key.select { |key| key.start_with?(GUARDRAILS_PREFIX) } + SESSION_MARKERS + [InstalledVersions::ENV_KEY, ProjectEnv::MARKER_ENV, ProjectEnv::ORIG_ENV]
+      env.each_key.select { |key| key.start_with?(GUARDRAILS_PREFIX) } + SESSION_MARKERS +
+        [InstalledVersions::ENV_KEY, ProjectEnv::MARKER_ENV, ProjectEnv::ORIG_ENV, UNATTENDED_UPDATE]
     end
 
     # #spawner_keys mapped to nil: Process.spawn unsets a key mapped to nil.

data/lib/samagotchi/config.rb

@@ -241,6 +241,12 @@ module Samagotchi
       Entry.new(key: "context.candidates.offer_threshold", yaml_path: %w[context candidates offer_threshold], type: :float, default: 0.6, expose: %i[config], lifecycle: :next_matching_turn_display_poll_write),
       Entry.new(key: "context.candidates.reask_after_turns", yaml_path: %w[context candidates reask_after_turns], type: :integer, default: 3, expose: %i[config], lifecycle: :next_matching_turn_display_poll_write),
 
+      # Check this (ObjectivesCheck): a cheap configured model for its one side request; nil is the session's.
+      Entry.new(key: "objectives.check_model", yaml_path: %w[objectives check_model], type: :string, default: nil, expose: %i[config], lifecycle: :next_matching_turn_display_poll_write),
+      # System 1 on the objectives (ObjectivesAudit): audit saves a yes/no per active objective on what comes in and goes
+      # out, acted on by nothing; off (no conversation text goes to a System 1 host for it). Host and model: system_one.*.
+      Entry.new(key: "objectives.system_one", yaml_path: %w[objectives system_one], type: :enum, default: "off", expose: %i[config], enum_values: %w[off audit], lifecycle: :next_matching_turn_display_poll_write),
+
       # What the model is sent of the conversation (LLMContextStrategy, LLMContextView): none, or a list of layers
       # (stale, forget; "|"-separated or a YAML list); forget (the model's forget_outputs) is experimental.
       # models.<key>.llm_context_strategy and hosts.<name>.llm_context_strategy come first.
@@ -416,7 +422,7 @@ module Samagotchi
     # Names core keeps, as a judgment's first word: a bundle can't declare one and
     # system_one.judgments can't set one (Record and Similar are model-blind, so a
     # swapped model would inherit a clean record and could auto-allow).
-    RESERVED_JUDGMENTS = %w[approvals context guardrails toolkit].freeze
+    RESERVED_JUDGMENTS = %w[approvals context guardrails objectives toolkit].freeze
 
     # What a :bool value reads as (Config.coerce!), YAML 1.1's words and 1/0.
     BOOL_WORDS = { "1" => true, "true" => true, "yes" => true, "on" => true,