samagotchi 0.19.0 → 0.20.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5b6bb51634467b04d3519fc2c42a778be2db25558565e8e872bc2fbdc17f5c76
-  data.tar.gz: 9f1e4b1bd71272126a3dea346b2b0f5125a608770a97832b17c42ec4a237156b
+  metadata.gz: c3b1a6860a8c22ed75259438c755633283385c12ffbc28a8fcb4c817f59114c5
+  data.tar.gz: 24f7c45ebe336077bc2d9a1e670d3313b364c48d5b28aef3624593705236f29e
 SHA512:
-  metadata.gz: b1b2eb7e4142061cce070830722bc88625cfc8b8301b97e836751ac9690d0e78984741afd747a6cc9ac42be6a0b59122bc49075273522629eda56f22327999d9
-  data.tar.gz: 6277d5a520c55f5b620f79936321c2536739409ef98a5a7b530e41505a2ffb17bd0bf04987fc0bf027c09a24dbedbea29f61affca2bf7f3a74218bbcf8651df8
+  metadata.gz: 9f1d9dec24344b223170728f80629a76d1db18697f752b2ce7135cf3569428a902f1cc18589a928184f7809bcbe3a20289281cd4cae6324bdd3f5bb1192cf860
+  data.tar.gz: 8bf9a7cf6dbaac98a7583987be61d98e06ddd3ab6a0b6f36423ae41a6aa530ef42479fa28139ad89b8253e61edce1a57013dd27d0a9bcbf5b31c080cea6f8801

data/CHANGELOG.md

@@ -8,6 +8,87 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.20.0] - 2026-10-03
+
+### Added
+
+- `guardrails.mode` (config.yml only): `auto`, the new default, or `strict`. Rules can be tagged `modes: [strict]`
+  to vote only in strict mode; a rule without `modes:` (every rule you wrote in config.yml) votes in both.
+  `/guardrails` shows the mode and marks the rules it leaves out `(strict only)`. See docs/guardrails.md#modes.
+- New guardrail rule keys: `skip_read_only: true` (a shell command that only reads, such as `ls`, `cat`, `rg`,
+  `sed -n` or `git log`, doesn't match), `touches: chi_dirs` (a shell command names a path in chi's real config,
+  hooks, approvals or bundles dir, or a `.git/hooks`) and `rm: outside_tmp` (an `rm -rf` reaches outside the tmp
+  dirs). A config.yml rule that uses one fails closed on an older chi.
+- Model speed and token stats. `/stats` has a speed line (the last generation's decode speed and the
+  session's average: exact from llama.cpp, estimated and marked `~` elsewhere), cached and reasoning
+  tokens, and the cost when the provider reports it (OpenRouter). The web's info bar shows the speed
+  next to `ctx`, updated after each generation, and the `ctx` tooltip there and on session cards lists
+  tokens in / cached / out (+ reasoning) and the cost, for that session only.
+
+### Changed
+
+- [BEHAVIOUR] Guardrails ask less by default (auto mode). The guardrails bundle (0.5.0) no longer asks before
+  `git rebase`, writes outside the session's repo (`write-outside-repo`) or git in another checkout
+  (`git-outside-repo`); `guardrails: { mode: strict }` in config.yml brings those back. Everything else still asks
+  in both modes, as do the small-model rules and chi's own protected paths.
+- [BEHAVIOUR] `shell-touches-chi` matches chi's real folders instead of text, and lets read-only commands through:
+  `ls ~/.config/samagotchi`, `rg samagotchi/hooks lib` and a scratch copy under `/tmp` no longer ask; `echo x >>
+  <config dir>/config.yml` and `cp hook .git/hooks/pre-commit` still do. A word it can't resolve falls back to the
+  old text match.
+- [BEHAVIOUR] `rm-rf-wide` no longer asks when every `rm -rf` target is inside a tmp dir (`rm -rf /tmp/x`);
+  `/tmp` itself, `/tmp/*`, a `$VAR` and a link out of tmp still ask.
+- [BEHAVIOUR] "Allow … in this repo" approvals hold for the whole repository, in every worktree of it, and the
+  ask names the repository (`in this repo (samagotchi)`) instead of the worktree folder. Approvals stored
+  before keep matching their exact folder.
+- `chi bundle status` shows a bundle whose recorded scope this chi doesn't know (one a newer chi wrote, or a hand
+  edit) as `scope=team (unknown)`, counted as one issue, instead of checking its files in the system memories;
+  the shipped-bundle update skips it (upgrade chi or reinstall), and `chi bundle diff` refuses it with a one-line
+  error instead of a stack trace.
+- The web model picker shows a model's configured sampling (`temperature=0.6 (hosts.work)`) as its row's tooltip;
+  `GET /api/models` has it as `sampling` on the models that have some.
+- The web shows a plugin card that is only a notice (info level, no buttons, one short line, such as check-in's
+  "Nudged the model at 105 tool calls.") as a one-line row, `▸ check-in: Nudged …`, that opens on a click, like the
+  tool rows and resolved questions; warn cards, cards with buttons and longer ones stay framed cards.
+- On a phone (a window under 900 px wide) the sessions strip's `hide` is in the top bar, where the `▾ N sessions`
+  pill comes back, with a finger-sized target, instead of the last column of the sideways-scrolling strip.
+- On a phone the web info bar shows `mem N` (the memories the session used; their names in the tooltip) after the
+  session's status, since the `mem: …` line is hidden there.
+- The web info bar's chips (model, ctx, speed, session time) are tinted over the card's glass instead of solid, and
+  the empty-history cover is see-through like the session panel.
+
+### Fixed
+
+- An MCP server that exits without a wait status no longer raises `NoMethodError`; its waiting calls fail with
+  "the server exited" instead of hanging.
+- A hook that raises is now logged (`hook_failed`) instead of being swallowed silently; the turn still goes on.
+- A hook's card (check-in, skills) now prints under its tool call's row: `tool_call_completed` is emitted before
+  `after_tool_call` fires.
+- When a hook corrects a tool call (known-names), the model is told what actually ran with a leading
+  `ran as: <tool> <args>` line.
+- MCP image content is described with a neutral `[image N: …]` line instead of claiming it was attached, which
+  was wrong for a model that can't see images.
+- An MCP `resource` block carrying an image `blob` is now attached like an `image` block instead of being
+  dropped to its URI text.
+- check-in's `nudge` mode no longer says "nudged" when the steer was dropped later; it says "nudge not sent" at
+  the turn's end.
+- A session started with an annotation (a web quote) is previewed by the note typed under the quote, not
+  `From your thinking: > …`; a quote with no note previews by its words.
+- A session that has only context notes so far (`chi note`, `send_note`) is previewed on its card and in the
+  lists as `note: …` instead of `—`, until a message is typed.
+- A web turn of images alone names each image once in the transcript a recap is written from, not twice.
+- `chi bootstrap` no longer says "loading the model?" for a slow test on a remote provider (OpenRouter and the
+  like); the hint is for a local server, where a slow answer is a model loading.
+- `chi bootstrap` says why it saved a host as `name-2` when the derived name is already taken (or a model id
+  starts with it), instead of silently picking another name.
+- `chi bundle upgrade` reports a hook or plugin file that is byte-identical to the installed one as "already up
+  to date" instead of "Updated".
+- `chi bundle upgrade --agent` from a git/zip/tar source no longer hands the agent an `incoming:` path that was
+  already deleted: the extracted source is kept until the agent step is done, then cleaned up.
+- `chi self` now checks a local `api: openai` host's reachability (a `GET <base>/models` with the same short
+  probe timeouts) and reports up/down with the ids it serves, instead of always saying "reported per turn".
+
+Update with `chi update`: guardrails moves to 0.5.0 (auto mode and the new rule keys; it needs chi 0.20.0), mcp to 0.4.1 (exit status, image lines, image blobs) and check-in to 0.2.1 (a dropped nudge says so). Restart `chi web` and running sessions afterwards (`chi sessions restart ID`).
+
 ## [0.19.0] - 2026-10-03
 
 ### Changed
@@ -1118,7 +1199,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.19.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.20.0...HEAD
+[0.20.0]: https://github.com/dm1try/samagotchi/compare/v0.19.0...v0.20.0
 [0.19.0]: https://github.com/dm1try/samagotchi/compare/v0.18.1...v0.19.0
 [0.18.1]: https://github.com/dm1try/samagotchi/compare/v0.18.0...v0.18.1
 [0.18.0]: https://github.com/dm1try/samagotchi/compare/v0.17.0...v0.18.0

data/docs/architecture.md

@@ -274,6 +274,12 @@ The metrics in `/state`, `/snapshot`, `/stats` and the SSE `snapshot`/`reset` fr
 newest turn the worker finished and any it hasn't saved yet (at most 20 turns), with their tool
 calls and the running turn's finished ones. The full history is the session's `analytics.json`,
 which `SessionMetrics#persist` rewrites after each turn; the web server merges the two by id.
+The totals' `tokens` block adds the cached and reasoning sums, the cost, the decode time and tokens
+behind the average speed (`avg_decode_tps`) and the last speeds (`last_decode_tps`,
+`last_prefill_tps`, `tps_source`: `server` or `estimate`). Each `generation_completed` event
+carries the generation's `speed` (`{decode_tps, source}`, null without one) and those running
+`tokens`: the Engine closes the generation in `SessionMetrics#finish_generation` before relaying
+it, so the web's info bar updates per generation without parsing chunk payloads.
 
 The page's frequent reads of `GET /api/sessions/:id` stay light too:
 - `?tail=1&recent=1` (each turn's end, a cancel, an answer display): `{tail, session: {id, status,

data/docs/cli.md

@@ -53,7 +53,9 @@ chi bootstrap                            # try localhost 8080, 11434, 1234, 8000
 - **The file.** With no config.yml it writes a small commented one:
   `default.model` as `<host>:<model>` and one `hosts:` entry named `local`
   (localhost), `lan` (an IP) or after the domain (`openrouter`); `--name`
-  sets it. An existing file is left as it is apart from the new entry, added
+  sets it. When that name is taken (or a model id starts with it), chi picks
+  `name-2` and says why, with `--name` to choose another. An existing file is
+  left as it is apart from the new entry, added
   at the end of its `hosts:` block (it gets a `hosts:` block, with a
   `default` entry for its `server:` first, when it has none), after a backup
   to `config.yml.bak-<time>`. `default.model` is set only when the file has
@@ -413,8 +415,17 @@ file and index line stay as they are; only this session doesn't see it.
 `/help` lists the commands this session takes, the installed bundles' too, each
 with a line on what it does. `/stats` shows the session's numbers: turns, tool
 calls (by tool, with errors), iterations, tokens in/out summed over every
-request, generation latency, cancellations, retries, context used and window,
-the prompt profile and the model the server says it ran. `/recap` is in
+request (with the cached and reasoning tokens when the server reports them),
+the decode speed, generation latency, cancellations, retries, context used
+and window, the prompt profile and the model the server says it ran, and the
+cost when the provider reports one (OpenRouter's `usage.cost`; no prices are
+guessed). The speed line is the last generation's and the session's average
+(weighted by tokens): llama.cpp reports it exactly (`87 tok/s out, 1.9k tok/s
+prompt (last, server)`); for other servers it is estimated from the first
+streamed chunk to the end and marked `~` (`~64 tok/s out (last, estimate)`).
+Generations under 8 tokens or 100 ms get no speed of their own, nor does a
+reply without server token counts or a non-streamed one. A delegated child
+keeps its own numbers: a parent's tokens and cost leave them out. `/recap` is in
 [Session recap](#session-recap), `/model` and `/models` in [Runtime Model
 Switch](#runtime-model-switch-assist-mode).
 

data/docs/configuration.md

@@ -243,7 +243,9 @@ or ending in `localhost`, `.local`, `.lan`, `.home`, `.home.arpa`, `.internal`,
 or `.ts.net` (Tailscale) is local: chi doesn't look names up. A remote
 host keeps its model list for 10 minutes, gets a 120-second first-token limit,
 and isn't asked for llama.cpp's `/props` (its context window and served model
-come from its model list and each turn). `remote: true` or `remote: false` on a
+come from its model list and each turn). A local `api: openai` host has no
+`/props`, so `chi self` GETs its `/models` with the same short probe timeouts
+and reports up/down with the ids it serves. `remote: true` or `remote: false` on a
 host decides it instead, e.g. for a llama.cpp behind an https proxy on the LAN:
 
 ```yaml
@@ -852,6 +854,7 @@ described in their own sections.
 | `image.max_bytes` | `3750000` | | See "Images". |
 | `image.max_per_request` | `20` | | See "Images". |
 | `guardrails.enabled` | `true` | | `false`: no rules, and hooks' asks are dropped (a deny still applies). config.yml only: a worker unsets any `SAMAGOTCHI_GUARDRAILS_*` it inherits. See [Guardrails](guardrails.md). |
+| `guardrails.mode` | `auto` | | Which rules vote: `auto` leaves out the rules tagged `modes: [strict]` (in the guardrails bundle: `git rebase`, writes and git outside the session's repo); `strict` runs them all. An unknown value warns and is `auto`. config.yml only. See [Guardrails](guardrails.md#modes). |
 | `guardrails.small_models` | `auto` | | Which models get the `models: small` rules: `auto` (32B or less by the size in the name, an MoE's active size), a list of globs, or `[]`. config.yml only. See [Guardrails](guardrails.md#rules-for-some-models). |
 | `guardrails.parent_approvals` | `off` | | What `chi answer` lets a parent agent allow on an approval: `off` (deny only) or `once` ("Allow once", never a wider scope). config.yml only: no environment variable (a parent can still pick the config dir with `XDG_CONFIG_HOME`). A convention for an honest parent, not a security boundary. See [Guardrails](guardrails.md#approvals-from-a-parent-agent). |
 | `log.file` | state dir | yes | See "Debug Log File". |

data/docs/guardrails.md

@@ -81,6 +81,13 @@ Allowing beyond "once" is stored in `$XDG_STATE_HOME/samagotchi/guardrails/appro
 | repo | this exact call in this repo (the cwd outside a repo), any session |
 | rule | anything this rule asks about in this repo |
 
+"This repo" is the git repository, not the folder: an approval given in one
+worktree holds in the main checkout and every other worktree of it (it is
+stored with the repository's common git dir as `repo`, and the worktree as
+`repo_root`). The ask names the repository (`Allow this call in this repo
+(samagotchi)`). An entry stored before chi 0.20 has no `repo` and still only
+matches its exact folder.
+
 A stored approval only relaxes an ask; a deny rule is never approvable.
 A file that doesn't parse is moved aside to `approvals.json.corrupt-<UTC time>`
 with one warning, and chi starts with no stored approvals (more asks, nothing lost).
@@ -137,7 +144,7 @@ grants no permission, so a parent may answer it either way by default.
 `turn.parent_continue: false` (config.yml only, like `parent_approvals`)
 makes parents stop-only. See [chi as a sub-agent](sub-agent.md#the-step-limit).
 
-The guardrails settings (`enabled`, `small_models`, `parent_approvals`) are
+The guardrails settings (`enabled`, `mode`, `small_models`, `parent_approvals`) are
 read from config.yml only: they have no environment variable, and a worker
 chi starts unsets every `SAMAGOTCHI_GUARDRAILS_*` it would inherit. What a
 parent's environment does choose is the config dir: `XDG_CONFIG_HOME` picks
@@ -182,6 +189,7 @@ commands that name them.
 ```yaml
 guardrails:
   enabled: true              # false: no rules, and hooks' asks are dropped (a deny still applies); config.yml only
+  mode: auto                 # or strict: also the rules tagged modes: [strict]; config.yml only
   rules:
     - id: git-push
       tool: shell            # execute + task_create; or a tool name, a glob, or a list
@@ -201,7 +209,41 @@ guardrails:
       scopes: [once, session, rule]
 ```
 
-A rule gives at least one of `tool`, `command`, `path` and `git`.
+A rule gives at least one of `tool`, `command`, `path`, `git`, `touches` and `rm`.
+
+`rm: outside_tmp` (shell tools) matches a command whose `rm -r -f` reaches
+outside the tmp folders (`$TMPDIR`, `/tmp`, `/var/tmp`): every such `rm` in a
+chain must name only paths inside one, resolved like `touches` (so
+`/tmp/../etc` and a link from `/tmp` to `/` are outside). The tmp folder
+itself, a glob (`/tmp/*`), a `$VAR` other than `$HOME`/`$TMPDIR`, an `rm`
+behind `sudo`/`xargs`/`sh -c` or in `$(…)`, and the tmp folder the session's
+repo is in count as outside.
+
+`touches: chi_dirs` (shell tools) matches a command that names a path in chi's
+own folders: the config folder (`config.yml`, `memories/`), the hooks folder,
+the approval store, installed bundles (`memories/.bundles`), the session repo's
+git hooks (`core.hooksPath` honoured) or any `.git/hooks` outside a tmp folder.
+Each word is read as a path against the folder the command is in by then
+(`cd`, `pushd`/`popd` and `( … )` followed), with `~`, `$HOME` and
+`$XDG_CONFIG_HOME`/`$XDG_STATE_HOME` expanded and symlinks resolved. So
+`/tmp/x/config/samagotchi/config.yml` and chi's own source
+(`lib/samagotchi/hooks/…`) don't match. A word it can't resolve (another
+`$VAR`, `$(…)`, a glob, a relative path after `cd $X`) or one that reads as a
+script (`sh -c '…'`, `ruby -e '…'`) is matched as text instead (`.config/samagotchi`,
+`samagotchi/config.yml`, `samagotchi/hooks`, `samagotchi/guardrails`,
+`memories/.bundles`, `.git/hooks`).
+
+`skip_read_only: true` lets a shell command through when it only reads:
+every command in it (split at `;`, `&&`, `||`, `|`) is `ls`, `cat`, `head`,
+`tail`, `wc`, `stat`, `du`, `grep`, `rg`, `find`, `tree`, `file`, `sort`,
+`uniq`, `cut`, `diff`, `echo`, `cd`, `sed`, `awk` or a reading `git`
+(`log`, `show`, `diff`, `status`, `branch` listing, …), with no option that
+writes or runs something (`sed -i`, `sed 's/a/b/w f'`, `find -delete`/`-exec`,
+`rg --pre`, `sort -o`, `awk` with `>`/`|`/`system(`, `git -c`, `git diff
+--ext-diff`, …) and no redirection other than to `/dev/null` or another fd.
+`$(…)`, backticks, `$VAR` (other than `$HOME`, `$XDG_*`, `$TMPDIR` and `$PWD`
+at a word's start), an env prefix, `sh -c`, `xargs`, `eval`, `sudo` and the
+like make a command not read-only. It errs towards asking.
 
 A tool name may be a glob, so one rule covers a plugin's tools (an MCP server's,
 say): `tool: "mcp_*"` or `tool: ["mcp_{git,gh}_*", web_fetch]` (`*`, `?`, `[…]` and
@@ -303,6 +345,38 @@ once per bundle version to restart the session (`chi sessions stop ID`, then
 older than the bundle) denies every tool call, as for a rule that doesn't
 parse, until chi is updated or the bundle uninstalled.
 
+### Modes
+
+`guardrails.mode` (config.yml only) picks how much is asked:
+
+- `auto`, the default: the rules tagged `modes: [strict]` don't vote. Asks
+  are kept for what is hard to undo or reaches chi itself.
+- `strict`: every rule votes.
+
+```yaml
+guardrails:
+  mode: strict
+  rules:
+    - id: no-docker
+      tool: shell
+      command: '\bdocker\b'
+      modes: [strict]        # or auto, or [auto, strict] (the same as leaving it out)
+      verdict: ask
+```
+
+A rule without `modes:` votes in every mode, so a rule you add to config.yml
+always applies unless you tag it. The core checks (protected paths, hooks)
+vote in both modes. In the guardrails bundle, `git-rebase`,
+`write-outside-repo` and `git-outside-repo` are strict only; its small-model
+rules (`models: small`) are untagged, so they ask a small model in both modes.
+`/guardrails` shows the mode on its first lines and marks the rules this mode
+leaves out `(strict only)`.
+
+A rule in config.yml that uses a key this chi doesn't know yet (`modes:`,
+`touches:`, `rm:`, `skip_read_only:` before 0.20) doesn't parse, and a rule
+that doesn't parse denies every tool call (see Failing closed). Bundles say
+which chi they need (`requires_chi`), so their rules don't hit this.
+
 ## The guardrails bundle
 
 ```sh
@@ -310,18 +384,22 @@ chi bundle install guardrails    # chi bootstrap installs it, with the core prof
 ```
 
 installs a default rule set plus a short memory telling the model not to
-route around a deny. It asks before `git push`, `reset --hard`, `clean -f`,
-`branch -D`, `rebase`, `filter-branch`/`filter-repo`; `rm -rf` on `/`, `~`,
-`$HOME` or `..` paths; `curl … | sh` and `base64 -d … | sh`; writes outside the
-session's repo (`write-outside-repo`) and git that changes another checkout
-(`git-outside-repo`: `cd ../main && git commit`, `git -C ../main add .`; it
-offers once, this session and "rule in this repo", the last stored for later
-sessions in that repo); shell commands that name chi's config, hooks or guardrails or
-`.git/hooks`; and answering chi's questions around `chi answer`: `chi --attach`
-or `chi -p` with stdin from a pipe, a here-string or a file
-(`chi-answer-piped`), and `curl`/`wget` to a session's `/answer` route
-(`chi-answer-http`), both once or for the session. `chi answer` itself isn't
-asked about. It denies writes into `.git/hooks`. The rules are in
+route around a deny. In both modes it asks before `git push`, `reset --hard`,
+`clean -f`, `branch -D`, `filter-branch`/`filter-repo`; `rm -rf` on `/`, `~`,
+`$HOME` or `..` paths, unless every target is inside a tmp folder; `curl … |
+sh` and `base64 -d … | sh`; shell commands that name a path in chi's config,
+hooks, approvals or bundles or a `.git/hooks` (`shell-touches-chi`, `touches:
+chi_dirs`), unless they only read (`skip_read_only`); and answering chi's
+questions around `chi answer`: `chi --attach` or `chi -p` with stdin from a
+pipe, a here-string or a file (`chi-answer-piped`), and `curl`/`wget` to a
+session's `/answer` route (`chi-answer-http`), both once or for the session.
+`chi answer` itself isn't asked about. It denies writes into `.git/hooks`.
+
+In strict mode (`guardrails: { mode: strict }`) it also asks before `git
+rebase`, writes outside the session's repo (`write-outside-repo`) and git that
+changes another checkout (`git-outside-repo`: `cd ../main && git commit`, `git
+-C ../main add .`; it offers once, this session and "rule in this repo", the
+last stored for later sessions in that repo). The rules are in
 `lib/samagotchi/bundles/guardrails/guardrails/rules.yml`.
 
 Small models (`models: small`, see above) get two more asks, in

data/docs/plugins.md

@@ -524,6 +524,11 @@ ctx.card(id: id, title: "Build finished", body: "no warnings left")  # replaces
   its line; the web shows a bubble only when the command answers with
   text or fails.
 - `level:` is `:info` or `:warn` (the warning colour).
+- An `:info` card with no actions and a body of one short line (up to 160
+  characters) is a notice: the web shows it as a one-line row,
+  `▸ check-in: Nudged the model at 105 tool calls.`, that opens on a click,
+  like a resolved question. A warn card, one with actions and one with more
+  to read stay framed cards.
 - `id:` names an earlier card to replace. Without one a new id is made. The
   web updates the card in place; the terminal prints it again, marked
   `(updated)`. A card that waits for something (a model's answer) shows

data/docs/sessions.md

@@ -65,7 +65,7 @@ chi sessions clean --dry-run --days 7            # test sessions older than 7 da
 **Ordering:**
 
 - `Session.list` / `SessionManager.list_sessions` / `GET /api/sessions?sort=&order=&limit=&offset=` default to `updated_at desc` (newest activity first). Also supports `created_at`, `asc`. `X-Total-Count` header when paginated.
-- Web UI (`chi web`): the page's scope is in its URL. Started in a git repo, `chi web` opens `/?dir=<that folder>`: that project's sessions, and new chats start in that folder; the header chip says `<project> · all`, and `all` opens the same place without `?dir` (every session; a new chat there starts in the server's own folder, shown on the start page, and cards name their folder; `← <project>` goes back to the project view it came from, or to the server's own project). One server serves every project: a second `chi web` (from another repo) finds it through `GET /api/info` and prints (with `--open`, opens) its page for its own folder instead of starting another. The 3 latest sessions sit above the chat (`hide ▴` puts them away behind a `▾ N sessions` pill, remembered; a window under 700 px tall hides them by itself, so a question or approval card in the stage keeps room, and the pill shows them until the window is tall again); "All sessions" (or `/`) opens every session at `#/sessions`, with a search over preview, id and status (Esc or Back returns). The open session is in the URL (`#/s/<id>`), so a reload or a copied link opens it again; the chi logo top left goes back to the empty start for a new chat. The message box grows with its text; drag its top edge to keep it taller (double-click resets). The info bar copies `chi --attach <id>` for a terminal. The start page's model picker (bottom left of the composer, the chosen name `▾`) chooses the model a new chat starts on; it opens a search list over the conversation (↓ or a click; downward when the start page leaves no room above): an empty search shows the last 5 picks (Recent) and then each host's model ids A–Z under the host, the default host first; typed words must each match the host or the id (a substring, else for 3+ characters the letters in order, so `deepseek4.1 fla` finds `openrouter · deepseek/deepseek-v4.1-flash`), ⏎ picks, Esc/Tab close, a pick puts the focus in the message box: `GET /api/models` lists the hosts' models as chi spells them (`{default, models: [{name, host, id}], warning?}`; bare for the default host, `host:model` for the others, from the same cached lists as `/models`, a bounded wait, a host that is down noted in `warning`), and `POST /api/sessions` takes `model` (blank means the default). The start page's first message goes as later ones do: `POST /api/sessions` with `idle: true` and `preview` (the message, which names the session until its turn is saved), then `POST /api/sessions/:id/turn`, so a failed first turn puts its prompt back in the composer too; a first line that is one of the new session's commands (`/model …`) goes to `POST /api/sessions/:id/command` instead, as later ones do. The browser remembers the last choice; a running session's model is in the info bar and changes only with `/model`. In the composer a line is a command when it is `!…` or starts with one of the session's command names (its `commands` list; `/stats`, `/exit` and the other terminal words get the page's own reply); an unknown `/word` (`/usr/bin/env is missing`) goes to the model as a prompt, as in a terminal; a one-word `/word` no command answers (`/modle`) is not sent: the page shows `Unknown command /modle. Did you mean /model? /help lists the commands.` (the "Did you mean" part only when a name is close). A `POST /turn` (or a session's first `prompt`) that is one of the worker's commands runs as that command too (`202 {status, command_id, session_id}`), so `chi send`, `chi -p` and a page whose command list lags all get the command. ↑/↓ in the composer walk the prompt history the TUI's ↑ walks ([Persistent Prompt History](cli.md#persistent-prompt-history)): ↑ with the caret on the first line, ↓ from the last line while browsing, ↓ past the newest brings the draft back; `GET /api/history` returns `{entries: [...]}`, oldest first (the page fetches it on focus and after each send). The server records a sent line in the routes once the worker took it (`POST /turn` accepted, a `!command` through `POST /command` or as a session's first line); `"history": false` in the body keeps it out (an image-only send).
+- Web UI (`chi web`): the page's scope is in its URL. Started in a git repo, `chi web` opens `/?dir=<that folder>`: that project's sessions, and new chats start in that folder; the header chip says `<project> · all`, and `all` opens the same place without `?dir` (every session; a new chat there starts in the server's own folder, shown on the start page, and cards name their folder; `← <project>` goes back to the project view it came from, or to the server's own project). One server serves every project: a second `chi web` (from another repo) finds it through `GET /api/info` and prints (with `--open`, opens) its page for its own folder instead of starting another. The 3 latest sessions sit above the chat (`hide ▴` puts them away behind a `▾ N sessions` pill, remembered; in a window under 900 px wide, where the strip scrolls sideways, `▴ hide` sits in the top bar where the pill comes back; a window under 700 px tall hides them by itself, so a question or approval card in the stage keeps room, and the pill shows them until the window is tall again); "All sessions" (or `/`) opens every session at `#/sessions`, with a search over preview, id and status (Esc or Back returns). The open session is in the URL (`#/s/<id>`), so a reload or a copied link opens it again; the chi logo top left goes back to the empty start for a new chat. The message box grows with its text; drag its top edge to keep it taller (double-click resets). The info bar copies `chi --attach <id>` for a terminal. It shows the context used (`ctx 42%`) and the last generation's decode speed (`87 tok/s`, `~64 tok/s` when estimated; see `/stats` in [cli.md](cli.md#session-commands)); hovering `ctx` there or on a session card lists the session's tokens in (summed over every request, with the cached share), out (with reasoning) and the cost when the provider reports one, for this session only. The start page's model picker (bottom left of the composer, the chosen name `▾`) chooses the model a new chat starts on; it opens a search list over the conversation (↓ or a click; downward when the start page leaves no room above): an empty search shows the last 5 picks (Recent) and then each host's model ids A–Z under the host, the default host first; typed words must each match the host or the id (a substring, else for 3+ characters the letters in order, so `deepseek4.1 fla` finds `openrouter · deepseek/deepseek-v4.1-flash`), ⏎ picks, Esc/Tab close, a pick puts the focus in the message box: `GET /api/models` lists the hosts' models as chi spells them (`{default, models: [{name, host, id, sampling?}], warning?}`; `sampling` is the model's configured request parameters as `/model` words them, the row's tooltip in the list; bare for the default host, `host:model` for the others, from the same cached lists as `/models`, a bounded wait, a host that is down noted in `warning`), and `POST /api/sessions` takes `model` (blank means the default). The start page's first message goes as later ones do: `POST /api/sessions` with `idle: true` and `preview` (the message, which names the session until its turn is saved), then `POST /api/sessions/:id/turn`, so a failed first turn puts its prompt back in the composer too; a first line that is one of the new session's commands (`/model …`) goes to `POST /api/sessions/:id/command` instead, as later ones do. The browser remembers the last choice; a running session's model is in the info bar and changes only with `/model`. In the composer a line is a command when it is `!…` or starts with one of the session's command names (its `commands` list; `/stats`, `/exit` and the other terminal words get the page's own reply); an unknown `/word` (`/usr/bin/env is missing`) goes to the model as a prompt, as in a terminal; a one-word `/word` no command answers (`/modle`) is not sent: the page shows `Unknown command /modle. Did you mean /model? /help lists the commands.` (the "Did you mean" part only when a name is close). A `POST /turn` (or a session's first `prompt`) that is one of the worker's commands runs as that command too (`202 {status, command_id, session_id}`), so `chi send`, `chi -p` and a page whose command list lags all get the command. ↑/↓ in the composer walk the prompt history the TUI's ↑ walks ([Persistent Prompt History](cli.md#persistent-prompt-history)): ↑ with the caret on the first line, ↓ from the last line while browsing, ↓ past the newest brings the draft back; `GET /api/history` returns `{entries: [...]}`, oldest first (the page fetches it on focus and after each send). The server records a sent line in the routes once the worker took it (`POST /turn` accepted, a `!command` through `POST /command` or as a session's first line); `"history": false` in the body keeps it out (an image-only send).
 - Web notifications: when a session needs you while the tab is hidden or behind another window (a question or a guardrail approval, a plugin card with buttons during a turn such as check-in's, a failed turn, a turn done after 10 s or more; a delegated session only for its questions, a canceled turn never), the page title counts it, `(N) Chi`, until you come back to the tab. The bell at the right of the top bar also turns on OS notifications ("needs an answer", "needs approval", "needs you", "turn failed", "done in 42 s", under the session's first message; a click opens the session): its first click asks the browser for the permission, and the choice is kept per browser. Any session of the page's scope counts, not only the open one. What was already so when the page loaded never counts, and several chi tabs show one notification per event. A chi tab in front tells the others (a `BroadcastChannel`), so while you look at one, the ones behind neither notify nor count what it shows; coming back to a tab clears those events in the other tabs' titles too. The hub's `session` frames carry what this needs: `pending_question` (`{id, kind}`, kind `question` or `approval`), `pending_card` (`{id, bundle}`: the running turn's card with actions, from `pending_card.json` that the worker keeps in the session's folder while one is open; a card without actions, such as loop-guard's, never counts) and `last_turn` (`{outcome, ended_at, seconds, origin}`, saved in the session's JSON as the engine ends each turn).
 - The web frontend is a zero-build ES-module stack in `lib/samagotchi/web/public/`: `data.js` (retrieval, typed SSE `openStream` for a session and `openEvents` for the session list), `sessions_list.js` (the list as a pure reducer over `GET /api/events`: a snapshot replaces it, an upsert keeps a known card in place, a removal drops it), `notify.js` (which of those events needs the user, for the notifications), `app.js` (presentation/state; a session with no live stream gets one when its `session` event says `bridge_up`, after one re-read: `event_seq` starts over in each worker, so a dropped stream is never resumed with its old cursor), `format.js` (pure formatters such as `previewOf`), `prompt_history.js` (the composer's ↑/↓ over the shared prompt history). Unit-tested via `npm test` (`node --test spec/web/public/*.test.js`).
 - Selecting a session in the web UI is read-only: `GET /api/sessions/:id` never spawns a worker (it reads a live worker's snapshot when one runs, else the session file). A prompt (`POST /turn`) or a command (`POST /command`) wakes the worker, and `/stream` briefly waits for a freshly-spawned bridge before answering. A caught-up SSE reconnect holds the stream open; `reset` markers are only sent for reconnects behind the ring window, or with a cursor from another worker (event ids are `<event_seq>-<epoch>`, one epoch per worker).

data/lib/samagotchi/bootstrap/config_writer.rb

@@ -95,20 +95,31 @@ module Samagotchi
       # +base+, with -2, -3… when the name is taken or is the prefix of a
       # model id (chi would read "qwen3:8b" as host qwen3, model 8b).
       def host_name(base, requested: nil, model_ids: [])
+        host_name_with_reason(base, requested: requested, model_ids: model_ids).first
+      end
+
+      # [name, reason]: reason is :taken when the name was suffixed because
+      # config.yml already has it, :model_prefix when a model id's prefix
+      # would read as a host, nil when the name is free as given.
+      def host_name_with_reason(base, requested: nil, model_ids: [])
         taken = current_hosts.keys
         if requested
           name = requested.to_s.strip
           raise Error, "--name must match #{ConfigFile::HOST_NAME_RE.source}" unless name.match?(ConfigFile::HOST_NAME_RE)
           raise Error, "config.yml already has a host named '#{name}'; pick another --name" if taken.include?(name.downcase)
 
-          return name
+          return [name, nil]
         end
 
         prefixes = [*model_ids, configured_default_model].compact.map { |id| id.to_s.split(":", 2).first.downcase }
         name = base
         n = 1
-        name = "#{base}-#{n += 1}" while taken.include?(name) || prefixes.include?(name)
-        name
+        reason = nil
+        while taken.include?(name) || prefixes.include?(name)
+          reason ||= taken.include?(name) ? :taken : :model_prefix
+          name = "#{base}-#{n += 1}"
+        end
+        [name, reason]
       end
 
       # Write the entry. @param fields [Hash] the hosts entry (string keys,

data/lib/samagotchi/bootstrap_command.rb

@@ -3,6 +3,7 @@
 require "rbconfig"
 require_relative "config"
 require_relative "model_profile"
+require_relative "host_registry"
 require_relative "bootstrap/probe"
 require_relative "bootstrap/config_writer"
 require_relative "bootstrap/bundles"
@@ -235,9 +236,11 @@ module Samagotchi
 
     def test(result, model, key_env)
       done = Queue.new
-      waiting = Thread.new do
-        @stdout.puts("test: waiting for an answer (loading the model?)…") if done.pop(timeout: LOADING_AFTER).nil?
-      end
+      waiting = if loading_hint?(result)
+                  Thread.new do
+                    @stdout.puts("test: waiting for an answer (loading the model?)…") if done.pop(timeout: LOADING_AFTER).nil?
+                  end
+                end
       seconds = @probe.test_turn(result.candidate, model, key_env: key_env)
       @stdout.puts(format("test: answered in %.1f s", seconds))
       true
@@ -249,17 +252,25 @@ module Samagotchi
       waiting&.join
     end
 
+    # The "loading the model?" hint fits a local server (a llama.cpp loading
+    # weights); a remote provider's slow answer is the network, not a load.
+    def loading_hint?(result)
+      !HostRegistry.remote_address?(result.candidate.scheme, result.candidate.host)
+    end
+
     # 0 written, 1 written but not as planned, nil with @exit on a refusal.
     def write(result, model, key_env, options)
       writer = Bootstrap::ConfigWriter.new(path: @config_path, env: @env)
       fields = host_fields(result.candidate, result.native?, key_env)
       ids = result.models.map(&:id)
-      name = begin
-        writer.host_name(Bootstrap::ConfigWriter.derived_name(result.candidate.host), requested: options[:name], model_ids: ids)
+      base = Bootstrap::ConfigWriter.derived_name(result.candidate.host)
+      name, reason = begin
+        writer.host_name_with_reason(base, requested: options[:name], model_ids: ids)
       rescue Bootstrap::ConfigWriter::Error => e
         @exit = usage_error(e.message)
         return nil
       end
+      explain_name(base, name, reason)
       outcome = writer.write(name: name, fields: fields, model: model, dry_run: options[:dry_run])
       code = report(outcome, model)
       return code unless INSTALLS_BUNDLES.include?(outcome.kind)
@@ -269,6 +280,16 @@ module Samagotchi
       code
     end
 
+    # One line when the name wasn't free as derived: why chi picked another.
+    def explain_name(base, name, reason)
+      case reason
+      when :taken
+        @stdout.puts("a host named #{base} already exists; saved as #{name}, use --name to choose")
+      when :model_prefix
+        @stdout.puts("a model id starts with #{base} (chi would read it as a host); saved as #{name}, use --name to choose")
+      end
+    end
+
     # The system bundle, core, and dev when a terminal says yes: one line
     # each. 1 when something failed.
     def install_bundles(dry_run: false)

data/lib/samagotchi/bundle_command.rb

@@ -263,6 +263,10 @@ module Samagotchi
       @stdout.puts "Provenance updated after interactive resolution."
       @stdout.puts "Upgrade resolved interactively."
       0
+    ensure
+      # An owned source (git/zip/tar) was kept for the incoming files above;
+      # the agent step is done with them now.
+      installer.cleanup_source!
     end
 
     def uninstall(rest)
@@ -353,9 +357,15 @@ module Samagotchi
           @stdout.puts "Bundle '#{name}' not installed."
           return 0
         end
-        @stdout.puts "Bundle: #{name} v#{st[:provenance][:version]} scope=#{st[:scope]} installed=#{st[:provenance][:installed_at]}"
-        @stdout.puts "Target: #{st[:target_dir]}"
+        @stdout.puts "Bundle: #{name} v#{st[:provenance][:version]} scope=#{status_scope(st)} installed=#{st[:provenance][:installed_at]}"
+        if st[:scope_error]
+          @stdout.puts "Target: (unknown scope: this chi can't resolve it; upgrade chi or reinstall the bundle)"
+        else
+          @stdout.puts "Target: #{st[:target_dir]}"
+        end
         st[:files].each do |k, info|
+          next @stdout.puts("  #{k}: unchecked") if info[:unchecked]
+
           mods = []
           mods << "conflict (kept your edits over v#{st[:provenance][:version]}: chi bundle diff #{name} #{k})" if info[:conflict]
           mods << "modified" if info[:modified]
@@ -409,15 +419,19 @@ module Samagotchi
           plugin = st[:plugin]
           mods += 1 if plugin && (plugin[:state] != "ok" || plugin[:requires_failure])
           mods += 1 if st[:hooks_requires_failure]
+          mods += 1 if st[:scope_error]
           plugin_info = plugin ? " plugin=#{plugin[:file]}" : ""
           includes = st[:provenance][:includes]
           includes_info = includes ? " includes=#{includes.join(",")}" : ""
-          @stdout.puts "  #{bname} v#{st[:provenance][:version]} scope=#{st[:scope]} files=#{st[:files].size}#{hook_info}#{plugin_info}#{includes_info} issues=#{mods}"
+          @stdout.puts "  #{bname} v#{st[:provenance][:version]} scope=#{status_scope(st)} files=#{st[:files].size}#{hook_info}#{plugin_info}#{includes_info} issues=#{mods}"
         end
       end
       return 0
     end
 
+    # "team (unknown)" for a scope this chi can't resolve (Status#bundle_status).
+    def status_scope(st) = st[:scope_error] ? "#{st[:scope]} (unknown)" : st[:scope]
+
     def diff(rest)
       args = rest.reject { |a| a.start_with?("--") }
       bname = args[0]
@@ -431,7 +445,11 @@ module Samagotchi
         @stderr.puts "Bundle '#{bname}' not installed"; return 1
       end
       scope = data[:scope]&.to_s || "system"
-      target_dir = Samagotchi::MemoryBundle::Installer.new(source: ".", name: bname, scope: scope).send(:resolve_target_dir, scope)
+      begin
+        target_dir = Samagotchi::MemoryPaths.scope_dir!(scope)
+      rescue ArgumentError => e
+        @stderr.puts "Bundle '#{bname}': #{e.message}"; return 1
+      end
       files = data[:files] || {}
       hooks = data[:hooks] || {}
       plugin_path = prov.plugin_path(data)

data/lib/samagotchi/bundles/check-in/manifest.yml

@@ -1,10 +1,10 @@
 ---
 name: check-in
-version: 0.2.0
+version: 0.2.1
 scope: system
 description: "Checks on a long turn: after N tool calls with no answer, a card asks the user (Nudge / Keep going / Stop), or the model is nudged to say what it has found"
 trust_level: reviewed
 plugin:
   file: plugin.rb
-  sha256: sha256:0a5ba60962206b3ec90bbaa0934a7284416aef495df8a70391d9ea47f7eb9ec1
+  sha256: sha256:afbd0ecf5a41eefe79786e089aa918728ebb0fed0e3b75f84d754a47ec6ade18
 requires_chi: ">= 0.3.0"

data/lib/samagotchi/bundles/check-in/plugin.rb

@@ -103,7 +103,11 @@ class Plugin
   def check_in(ctx, count, mode)
     case mode
     when "nudge"
-      ctx.notify("nudged the model after #{count} tool calls") if ctx.steer(message(count))
+      text = message(count)
+      if ctx.steer(text)
+        @mutex.synchronize { @nudge = { text: text, count: count } }
+        ctx.notify("nudged the model after #{count} tool calls")
+      end
     when "notify"
       ctx.notify("#{count} tool calls in this turn, no answer yet")
     else
@@ -117,15 +121,20 @@ class Plugin
     nudge_not_sent(event, ctx)
   end
 
-  # The card said "Nudged": if the turn ended before the nudge joined it
-  # (the model answered first, or the turn was stopped), the card says so.
+  # A nudge that was accepted but dropped before it joined the turn (the
+  # model answered first, or the turn was stopped): the card says so, or,
+  # for a mode nudge (no card), a notice does.
   def nudge_not_sent(event, ctx)
     id, nudge = @mutex.synchronize { [@card_id, @nudge] }
-    return unless id && nudge
+    return unless nudge
     return if steered?(event[:messages], nudge[:text])
 
     first = event[:status].to_s == "canceled" ? "The turn ended first" : "The answer came first"
-    ctx.card(id: id, title: "check-in", body: "#{first}; nudge not sent.")
+    if id
+      ctx.card(id: id, title: "check-in", body: "#{first}; nudge not sent.")
+    else
+      ctx.notify("#{first}; nudge not sent.", level: :warn)
+    end
   end
 
   # Whether this turn's messages (after its last prompt) have the steer.