samagotchi 0.18.1 → 0.20.0

data/lib/samagotchi/model_overlay.rb

@@ -49,5 +49,44 @@ module Samagotchi
     # Regex matching overlay file names: /<something>.<lowercase-dashed-key>.md\z
     # Useful for tooling, tests, and future index suppression.
     OVERLAY_SUFFIX_PATTERN = /\.([a-z0-9\-]+)\.md\z/
+
+    # The base file name (`tips.md`) an overlay-looking name
+    # (`tips.qwen3.md`) would belong to, or nil when it doesn't match the
+    # suffix pattern.
+    def self.base_file_for(path)
+      match = File.basename(path.to_s).match(OVERLAY_SUFFIX_PATTERN)
+      return nil unless match
+
+      stem = File.basename(path.to_s).delete_suffix(match[0])
+      stem.empty? ? nil : "#{stem}.md"
+    end
+
+    # Whether +path+ is a model overlay: its name matches the suffix pattern
+    # and its base `<stem>.md` exists in one of +base_dirs+ (default: the
+    # file's own dir) or is one of +base_names+. A memory whose name has a
+    # dot and a sibling of the same stem reads as an overlay too (a
+    # leftover ambiguity).
+    def self.overlay_file?(path, base_dirs: [File.dirname(path.to_s)], base_names: [])
+      base = base_file_for(path)
+      return false unless base
+
+      base_names.map { |n| File.basename(n.to_s) }.include?(base) ||
+        base_dirs.compact.any? { |dir| File.file?(File.join(dir, base)) }
+    end
+
+    # How a bundle's installer, status and uninstaller tell an overlay
+    # (they agree, so a line the installer left out isn't "no-index"): the
+    # base is one of +bundle_files+ (basenames), or it is nowhere in
+    # +target_dir+ (an orphan overlay; it loads once the base exists).
+    # A base only in +target_dir+ (an installed memory, maybe the user's
+    # own) counts too: the installer warns, so the dot-name ambiguity
+    # (notes.v2.md next to a user's notes.md) is visible.
+    def self.bundle_overlay?(file_key, bundle_files:, target_dir:)
+      base = base_file_for(file_key)
+      return false unless base
+
+      overlay_file?(file_key, base_dirs: [target_dir], base_names: bundle_files) ||
+        !File.file?(File.join(target_dir, base))
+    end
   end
 end

data/lib/samagotchi/model_profile.rb

@@ -11,6 +11,10 @@ module Samagotchi
   #   gemma4  — Gemma 4 format
   class ModelProfile
     MODEL_ENV = "SAMAGOTCHI_DEFAULT_MODEL"
+    # Set beside MODEL_ENV for a worker spawned by a `chi --model X`: X is
+    # that run's default, not one its commands' chi should inherit
+    # (SessionManager.spawn_options, Tools::Builtins.parent_env).
+    MODEL_FROM_CLI_ENV = "SAMAGOTCHI_DEFAULT_MODEL_FROM_CLI"
     # No model anywhere (--model, default.model in config.yml, the env): a
     # first run before any config. An ArgumentError, as before.
     MissingModel = Class.new(ArgumentError)

data/lib/samagotchi/relay_desk.rb

@@ -63,6 +63,15 @@ module Samagotchi
       end
     end
 
+    # Whether a relay is open, or settled recently enough that its child
+    # may still ask about it: a restart would drop them.
+    def active?
+      @mutex.synchronize do
+        prune
+        !@relays.empty?
+      end
+    end
+
     private
 
     def prune

data/lib/samagotchi/self_report.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require "json"
+require "net/http"
+require "uri"
 require_relative "version"
 require_relative "config"
 require_relative "context_window"
@@ -11,6 +13,8 @@ require_relative "model_overlay"
 require_relative "thinking"
 require_relative "served_model"
 require_relative "host_registry"
+require_relative "llm/http"
+require_relative "llm/api_key"
 require_relative "tools/memory"
 require_relative "hooks/loader"
 require_relative "memory_bundle/provenance"
@@ -194,7 +198,9 @@ module Samagotchi
 
     # chi self's one server call: a single-model llama.cpp answers any name
     # with the model it loaded, and its /props names it (model_alias). One
-    # GET with the probe's short timeouts; a remote host isn't asked.
+    # GET with the probe's short timeouts; a remote host isn't asked. A local
+    # chat host (api: openai) has no /props, so it gets a GET <base>/models
+    # with the same timeouts: up/down and the ids it serves.
     def served_model_for(model, env)
       registry = HostRegistry.new(env: env)
       target = registry.resolve(model)
@@ -202,7 +208,7 @@ module Samagotchi
       bare = target.bare_model
       return "-" unless entry
       return "reported per turn (remote host)" if entry.remote?
-      return NO_PROPS if entry.chat?
+      return chat_served_model_for(entry, bare, env) if entry.chat?
 
       client = registry.client_for(entry)
       props = client.server_props(model: bare)
@@ -217,6 +223,36 @@ module Samagotchi
       "unknown (#{e.class})"
     end
 
+    # A local chat host's reachability: one GET <base>/models with the
+    # native probe's short timeouts (Client's /props probe), no retry. Up
+    # with the ids it serves, down when it doesn't answer.
+    def chat_served_model_for(entry, bare, env)
+      uri = URI("#{entry.openai_base_url}/models")
+      request = Net::HTTP::Get.new(uri)
+      http = LLM::HTTP.new(label: entry.name, open_timeout: Client::CONTEXT_WINDOW_PROBE_OPEN_TIMEOUT,
+                           read_timeout: Client::CONTEXT_WINDOW_PROBE_READ_TIMEOUT,
+                           retry_policy: LLM::HTTP::RetryPolicy.none,
+                           api_key: LLM::ApiKey.for(entry.api_key_env, host: entry.host, env: env))
+      response = http.fetch(uri, request, retries: false, check_status: false, log_fields: { purpose: "models" })
+      return "down (HTTP #{response.code})" unless response.code.to_s == "200"
+
+      ids = chat_model_ids(response.body)
+      return "up (no models listed)" if ids.empty?
+
+      note = ids.any? { |id| id.casecmp?(bare.to_s) } ? "" : " (not #{bare})"
+      "up: #{ids.join(", ")}#{note}"
+    rescue StandardError
+      "down (the server didn't answer; is it running?)"
+    end
+
+    def chat_model_ids(body)
+      parsed = JSON.parse(body.to_s)
+      data = parsed.is_a?(Hash) ? parsed["data"] : parsed
+      Array(data).filter_map { |raw| raw.is_a?(Hash) ? (raw["id"] || raw[:id]).to_s : raw.to_s }.reject(&:empty?)
+    rescue JSON::ParserError
+      []
+    end
+
     # Offline, so no /props probe: where nothing is configured, a native
     # llama.cpp host's chat template decides at runtime.
     def profile_for(model, env)

data/lib/samagotchi/session.rb

@@ -5,6 +5,7 @@ require "json"
 require "securerandom"
 require "time"
 require_relative "atomic_file"
+require_relative "context_note"
 
 require_relative "paths"
 require_relative "project_scope"
@@ -413,27 +414,55 @@ module Samagotchi
 
     # Derive and cache the first user-message preview in the session record.
     # Returns true if the cached value was set or updated.
+    # A session with only context notes so far previews by its first note
+    # ("note: …"), until a message is typed.
     def compute_first_preview!
-      return false if @first_preview && !@first_preview.empty?
+      from_note = note_preview
+      return false if @first_preview && !@first_preview.empty? && @first_preview != from_note
 
       first_user = @messages.find { |m| m[:role].to_s == "user" || m["role"].to_s == "user" }
-      return false unless first_user
-
-      preview = self.class.preview_of(first_user[:content] || first_user["content"])
-      return false if preview.empty?
+      preview = first_user ? self.class.preview_of(first_user[:content] || first_user["content"]) : from_note.to_s
+      return false if preview.empty? || preview == @first_preview
 
       @first_preview = preview
       true
     end
 
+    # The web's annotation labels (annotations.js sourceLabel), each on its
+    # own line above a quote.
+    QUOTE_LABEL_RE = /\AFrom (?:your thinking|your earlier step|the .{1,80} call|my earlier message):\z/
+
     # A prompt as a one-line preview: whitespace collapsed, cut at 80 chars.
+    # A quoted or annotated message previews by what was typed under the
+    # quote; a quote alone by its words, without the "> " markers or label.
     def self.preview_of(text)
-      norm = text.to_s.gsub(/\s+/, " ").strip
+      norm = preview_words(text.to_s).gsub(/\s+/, " ").strip
       norm.length > 80 ? "#{norm[0, 80]}…" : norm
     end
 
+    def self.preview_words(text)
+      lines = text.lines.map(&:strip)
+      quoted = lines.select { |line| line.start_with?(">") }
+      return text if quoted.empty?
+
+      own = lines.reject { |line| line.start_with?(">") || QUOTE_LABEL_RE.match?(line) }.join("\n")
+      return own unless own.strip.empty?
+
+      quoted.map { |line| line.sub(/\A(?:>[ \t]?)+/, "") }.join("\n")
+    end
+    private_class_method :preview_words
+
     private
 
+    # @return [String, nil] the first context note as a preview
+    def note_preview
+      note = @messages.find { |m| ContextNote.note?(m) }
+      return nil unless note
+
+      text = self.class.preview_of(ContextNote.text_of(note))
+      text.empty? ? nil : self.class.preview_of("note: #{text}")
+    end
+
     def stringify_message_keys(hash)
       hash.each_with_object({}) { |(k, v), h| h[k.to_s] = v }
     end

data/lib/samagotchi/session_commands.rb

@@ -234,6 +234,9 @@ module Samagotchi
       rules = @engine.guardrail_rules
       approvals = @engine.guardrail_approvals.entries
       lines = ["guardrails: #{rules.enabled? ? "on" : "off (guardrails.enabled: false; denies still apply)"}"]
+      lines << if rules.mode == "strict" then "mode: strict (every rule votes)"
+               else "mode: auto (rules marked strict only don't vote; guardrails.mode: strict in config.yml for those)"
+               end
       name = @engine.guardrail_model_name
       key = @engine.model_key
       lines << "model: #{name || "none"} — #{Guardrails::ModelSize.describe(name, key)}"
@@ -253,9 +256,14 @@ module Samagotchi
           ("command /#{shorten_pattern(rule.command.source)}/" if rule.command),
           ("path #{rule.path}" if rule.path),
           ("git #{rule.git}" if rule.git),
-          ("models #{rule.models.join(",")}" if rule.models)
+          ("touches #{rule.touches}" if rule.touches),
+          ("rm #{rule.rm}" if rule.rm),
+          ("models #{rule.models.join(",")}" if rule.models),
+          ("modes #{rule.modes.join(",")}" if rule.modes),
+          ("skip_read_only" if rule.skip_read_only)
         ].compact.join(", ")
         off = "disabled (guardrails.disable) — " if rules.disabled?(rule)
+        off ||= "(#{rule.modes.join(", ")} only) — " unless rule.for_mode?(rules.mode)
         off ||= "off for this model — " unless rule.for_model?(name, key)
         lines << "  #{idx + 1}. #{rule.id}: #{off}#{rule.verdict} (#{match}) — #{rule.reason} [#{rule.source}]"
       end
@@ -277,7 +285,10 @@ module Samagotchi
 
     def approval_line(entry)
       what = entry["key"] ? entry["key"].tr("\n", " ") : "any call rule #{entry["rule"]} asks about"
-      where = entry["scope"] == "session" ? "session #{entry["session_id"].to_s[0, 8]}" : "in #{entry["repo_root"]}"
+      where = if entry["scope"] == "session" then "session #{entry["session_id"].to_s[0, 8]}"
+              elsif entry["repo"] then "in repo #{entry["repo"]}"
+              else "in #{entry["repo_root"]}"
+              end
       rule = entry["rule"] ? " (rule #{entry["rule"]}, #{entry["source"]})" : ""
       "#{entry["scope"]}: #{what} — #{where}#{rule}, #{entry["created_at"]}"
     end

data/lib/samagotchi/session_manager.rb

@@ -19,7 +19,9 @@ require_relative "bridge_client"
 require_relative "worker_sidecar"
 require_relative "log"
 require_relative "log_path"
+require_relative "model_profile"
 require_relative "installed_gem"
+require_relative "installed_versions"
 require_relative "recap_store"
 require_relative "archive_store"
 require_relative "image_store"
@@ -191,6 +193,7 @@ module Samagotchi
       # A worker gets no CLI args: --model, --thinking, --log-level and the
       # other flags this chi was started with.
       child_env.merge!(Config.cli_env)
+      child_env[ModelProfile::MODEL_FROM_CLI_ENV] = "1" if child_env.key?(ModelProfile::MODEL_ENV)
       # And the spawner's debug log, absolute: a relative log.file would
       # otherwise land in the worker's (the session's) directory.
       log_path = begin LogPath.resolve rescue nil end
@@ -204,10 +207,25 @@ module Samagotchi
       # key mapped to nil. config.yml no longer reads them; this keeps an
       # older or future env-exposed one out as well.
       ENV.each_key { |key| child_env[key] = nil if key.start_with?(GUARDRAILS_ENV_PREFIX) }
+      # A smoke's fake "newest installed" is for this process's notices only.
+      child_env[InstalledVersions::ENV_KEY] = nil
+      # A gem-mode worker activates the newest installed chi itself: under
+      # `bundle exec` (a Gemfile that has samagotchi) Bundler's RUBYOPT would
+      # hold it to the bundle's version, and its badge would never clear.
+      child_env.merge!(unbundled_env_changes) if InstalledGem.spec
       opts[:env] = child_env unless child_env.empty?
       opts
     end
 
+    # What Bundler changed in ENV (RUBYOPT, BUNDLE_*), mapped back to the
+    # values from before it (nil: unset); {} outside Bundler.
+    private_class_method def self.unbundled_env_changes(env = ENV.to_h)
+      return {} unless defined?(::Bundler) && ::Bundler.respond_to?(:unbundled_env)
+
+      clean = ::Bundler.unbundled_env
+      (env.keys | clean.keys).each_with_object({}) { |key, changes| changes[key] = clean[key] unless clean[key] == env[key] }
+    end
+
     GUARDRAILS_ENV_PREFIX = "SAMAGOTCHI_GUARDRAILS_"
 
     # List all sessions, reading status from persisted session.json files.
@@ -409,6 +427,10 @@ module Samagotchi
       # status is turn state, not liveness: a new worker runs no turn yet,
       # and must not find the session stopped (it would exit): neither the
       # marker nor a status field from before it.
+      # One this process just spawned may not hold the lock yet (a slow
+      # start, deliver_turn's second resume): it would only lose it.
+      return session if still_starting?(session.id, state_dir: sd)
+
       Session.clear_stopped(session.id, state_dir: sd)
       session.status = Session::STATUS_IDLE
       session.save(state_dir: sd)
@@ -416,6 +438,36 @@ module Samagotchi
       session
     end
 
+    # How long after a spawn a resume trusts that worker to take the
+    # session, while it runs (and the session wasn't stopped since).
+    WORKER_START_GRACE = 30.0
+
+    @spawns = {}
+    @spawns_mutex = Mutex.new
+
+    # A worker this process spawned for the session within
+    # WORKER_START_GRACE is still running, and no stop came since.
+    private_class_method def self.still_starting?(session_id, state_dir:)
+      return false if Session.stopped_marker?(session_id, state_dir: state_dir)
+
+      at, waiter = @spawns_mutex.synchronize { @spawns[[state_dir, session_id]] }
+      return false unless at && waiter.respond_to?(:alive?) && waiter.alive?
+
+      Process.clock_gettime(Process::CLOCK_MONOTONIC) - at < WORKER_START_GRACE
+    end
+
+    private_class_method def self.note_spawn(session_id, state_dir:, waiter:)
+      @spawns_mutex.synchronize do
+        @spawns.delete_if { |_, (_, w)| !(w.respond_to?(:alive?) && w.alive?) }
+        @spawns[[state_dir, session_id]] = [Process.clock_gettime(Process::CLOCK_MONOTONIC), waiter]
+      end
+    end
+
+    # Forget the spawns #still_starting? remembers (specs).
+    def self.forget_spawns
+      @spawns_mutex.synchronize { @spawns.clear }
+    end
+
     # Read any new output files from a session directory.
     # Optionally filters to only files newer than `since_time`.
     def self.read_responses(session_id, since_time: nil, state_dir: nil)
@@ -423,6 +475,85 @@ module Samagotchi
                                 since_time: since_time)
     end
 
+    # A restart that can't happen now. reason: :not_running (no live worker:
+    # the next prompt starts one on the newest chi anyway), :unsupported (a
+    # worker from before restarts, running +version+: stop it instead), a
+    # WorkerIdleExit#hold_for_restart hold (:turn_running, :reminders, ...),
+    # or :failed (the worker answered something else).
+    class RestartRefused < StandardError
+      attr_reader :session_id, :reason, :version
+
+      def initialize(session_id, reason, version: nil)
+        @session_id = session_id
+        @reason = reason.to_sym
+        @version = version
+        super(RestartRefused.words(session_id, @reason, version))
+      end
+
+      HOLDS = {
+        starting: "its worker is still starting",
+        turn_running: "a turn is running",
+        input_queued: "a prompt is queued",
+        continue_offered: "the step-limit question waits for an answer",
+        question_pending: "a question or approval waits for an answer",
+        reminders: "it has reminders, which a restart would drop",
+        command_running: "a /btw (or another command) is still running",
+        relays_open: "a delegate's approval relayed here is open or just answered",
+        background_tasks: "background tasks it started are still running"
+      }.freeze
+
+      # What the CLI and the web say.
+      def self.words(session_id, reason, version = nil)
+        case reason
+        when :not_running
+          "session #{session_id} has no running worker; the next prompt starts one on the newest chi"
+        when :unsupported
+          "session #{session_id}'s worker runs chi #{version || "(older)"}, which can't restart: " \
+            "chi sessions stop #{session_id}, then any prompt starts it on the newest chi"
+        when :failed then "session #{session_id}'s worker didn't take the restart"
+        else "not now: #{HOLDS.fetch(reason, reason.to_s.tr("_", " "))}"
+        end
+      end
+    end
+
+    # What a restart did: the worker's version before and after (nil when
+    # the new worker hadn't published its Bridge within the wait).
+    Restarted = Struct.new(:session_id, :from_version, :version, keyword_init: true)
+
+    RESTART_WAIT = 10.0
+
+    # Hand a session to a new worker on the newest chi installed: ask its
+    # worker (POST /exit restart: true), which leaves only when nothing would
+    # be lost and starts its successor (Worker#exit_request), then wait up to
+    # +wait+ seconds for the successor's Bridge. Web tabs and attached
+    # terminals reconnect to it.
+    # @return [Restarted]
+    # @raise [OwnedByTUI] a chi REPL owns the session
+    # @raise [RestartRefused]
+    # @raise [ArgumentError] no such session
+    def self.restart_session(session_id, state_dir: nil, wait: RESTART_WAIT, client_id: "cli:restart")
+      sd = state_dir || Session.default_state_dir
+      Session.load(session_id, state_dir: sd) # ArgumentError for none
+      owner = refuse_tui!(session_id, state_dir: sd)
+      dir = Session.session_dir(session_id, state_dir: sd)
+      sidecar = owner&.worker? && WorkerSidecar.live(dir, unlink: false)
+      raise RestartRefused.new(session_id, :not_running) unless sidecar
+      unless sidecar.features.include?("restart")
+        raise RestartRefused.new(session_id, :unsupported, version: sidecar.version)
+      end
+
+      reply = BridgeClient.new(session_id: session_id, port: sidecar.port).request_exit(client_id: client_id, restart: true)
+      raise RestartRefused.new(session_id, reply.json&.fetch("reason", nil) || :failed) if reply.status == 409
+      raise RestartRefused.new(session_id, :failed) unless reply.status == 200
+
+      Log.info(:worker, "restart", sid: session_id, from: sidecar.version, by: client_id)
+      fresh = BridgeClient.poll(wait, interval: 0.1) do
+        found = WorkerSidecar.live(dir, unlink: false)
+        found if found && found.started_at != sidecar.started_at
+      end
+      Restarted.new(session_id: session_id, from_version: sidecar.version, version: fresh&.version)
+    end
+
     # Stop a session by sending TERM to its process.
     # With +wait+ (seconds), also wait for the owner to let go of the session,
     # so a resume right after spawns a fresh worker instead of finding the
@@ -638,7 +769,7 @@ module Samagotchi
     # @param poll_interval [Numeric, nil] seconds between the loop's fallback
     #   ticks (nil: Worker::FALLBACK_TICK_SECONDS); queued turns wake it at once
     # A stopped session's worker exits 0 and a crashed one 1, there.
-    # @return [Symbol] :idle_exit or :exit_requested
+    # @return [Symbol] :idle_exit, :exit_requested or :restart
     def self.run_session_loop(session_id, state_dir: nil, owner_wait: OwnerLock::DEFAULT_WAIT,
                               idle_exit_minutes: nil, poll_interval: nil)
       # A worker inherits chi's locale (LC_ALL=C too): read files as UTF-8.
@@ -652,7 +783,10 @@ module Samagotchi
       # Kept in a class ivar so the lock's File lives as long as the worker.
       @owner_lock = OwnerLock.acquire(session_dir, kind: "worker", wait: owner_wait)
       exit(0) unless @owner_lock
-      Log.info(:worker, "start", cwd: Dir.pwd)
+      # Set by the boot string when the newest installed chi didn't load.
+      fallback = ENV.delete(BOOT_FALLBACK_ENV)
+      Log.info(:worker, "start", cwd: Dir.pwd, version: VERSION)
+      Log.warn(:worker, "boot_fallback", version: VERSION, error: fallback) if fallback
       worker = Worker.new(session_id: session_id, state_dir: sd, session_dir: session_dir,
                           idle_exit_minutes: idle_exit_minutes, poll_interval: poll_interval)
       result = begin
@@ -672,7 +806,10 @@ module Samagotchi
       # Only after the release: a writer that still saw this worker as the
       # owner may have queued input since the last check. Either it finds no
       # owner after its write and wakes one, or this finds its input.
-      if %i[idle_exit exit_requested].include?(result) && !SessionInbox.find_new_input_files(session_dir).empty?
+      # A restart starts its successor here, on the newest chi installed
+      # (worker_command), once this one's lock is free.
+      if result == :restart ||
+         (%i[idle_exit exit_requested].include?(result) && !SessionInbox.find_new_input_files(session_dir).empty?)
         resume_session(session_id, state_dir: sd)
       elsif worker.discard?
         discard_left_session(session_id, state_dir: sd, default_model: worker.default_model)
@@ -707,16 +844,31 @@ module Samagotchi
       session.save(state_dir: state_dir)
     end
 
-    # The worker's command line: this chi's lib/ and ruby. Run from an
-    # installed gem, the worker activates that gem first, so its dependencies
-    # resolve as the gemspec pins them (reline ~> 0.6.3) rather than to the
-    # newest installed version. A source checkout (bin/chi, bundle exec)
-    # keeps the plain -I lib.
+    # The worker's command line. Run from an installed gem, the worker
+    # activates the newest installed samagotchi (`>= 0.a`, prereleases
+    # count), whoever spawns it: an old chi web, chi send or --attach then
+    # starts new workers on the newest chi rather than on its own. Activating
+    # the gem also makes its dependencies resolve as its gemspec pins them
+    # (reline ~> 0.6.3). Should that fail (a broken newest install), the
+    # worker falls back to the spawner's own version and logs why.
+    #
+    # A source checkout (bin/chi, bundle exec; InstalledGem.spec is nil
+    # there) keeps the plain -I lib: a worktree's bin/chi spawns its own code.
+    #
+    # CROSS-VERSION CONTRACT: this boot string, run_session_loop(id,
+    # state_dir:), the env keys spawn_options sets and the input/ file
+    # format are read by a NEWER chi than the one writing them. Change them
+    # only additively (spec/worker_contract_spec.rb).
+    BOOT_FALLBACK_ENV = "SAMAGOTCHI_BOOT_FALLBACK"
+
     def self.worker_command(session_id, state_dir:, gem_spec: InstalledGem.spec)
       boot = "require 'samagotchi/session_manager'; " \
              "Samagotchi::SessionManager.run_session_loop('#{session_id}', state_dir: #{state_dir.inspect})"
-      boot = "gem 'samagotchi', '= #{gem_spec.version}'; #{boot}" if gem_spec
-      [RbConfig.ruby, "-I", File.expand_path("..", __dir__), "-e", boot]
+      return [RbConfig.ruby, "-I", File.expand_path("..", __dir__), "-e", boot] unless gem_spec
+
+      activate = "begin; gem 'samagotchi', '>= 0.a'; rescue LoadError => e; " \
+                 "ENV['#{BOOT_FALLBACK_ENV}'] = e.message; gem 'samagotchi', '= #{gem_spec.version}'; end"
+      [RbConfig.ruby, "-e", "#{activate}; #{boot}"]
     end
 
     private_class_method def self.spawn_worker_for_session(session, state_dir:)
@@ -729,6 +881,8 @@ module Samagotchi
       env = opts.delete(:env)
       command = worker_command(session.id, state_dir: state_dir)
       pid = env ? Process.spawn(env, *command, **opts) : Process.spawn(*command, **opts)
+      # Reaped when it exits: a long-lived spawner (chi web) keeps no zombies.
+      note_spawn(session.id, state_dir: state_dir, waiter: Process.detach(pid))
       Log.info(:worker, "spawn", sid: session.id, child_pid: pid)
       pid
     end
@@ -831,7 +985,8 @@ module Samagotchi
         raise OwnedByTUI, session_id
       end
       # A worker that idle-exited since the resume never reads it either:
-      # wake a new one. (The exiting worker also looks for input it left.)
+      # wake a new one. (The exiting worker also looks for input it left;
+      # one the first resume spawned that is still starting is left be.)
       manager.resume_session(session_id, state_dir: state_dir) if owner.nil?
       { status: :accepted, ack: { status: "accepted", enqueued_id: enqueued_id, session_id: session_id } }
     end