samagotchi 0.20.0 → 0.21.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c3b1a6860a8c22ed75259438c755633283385c12ffbc28a8fcb4c817f59114c5
-  data.tar.gz: 24f7c45ebe336077bc2d9a1e670d3313b364c48d5b28aef3624593705236f29e
+  metadata.gz: f9d794c2749a0f1293cb16d7afeb7e023f38dd8798532e4dcb2d0e9fcb575af1
+  data.tar.gz: 8ade3692c344214cc8cdbe90c1fb8539242639f7cbf8707c751a8d2b02f9548a
 SHA512:
-  metadata.gz: 9f1d9dec24344b223170728f80629a76d1db18697f752b2ce7135cf3569428a902f1cc18589a928184f7809bcbe3a20289281cd4cae6324bdd3f5bb1192cf860
-  data.tar.gz: 8bf9a7cf6dbaac98a7583987be61d98e06ddd3ab6a0b6f36423ae41a6aa530ef42479fa28139ad89b8253e61edce1a57013dd27d0a9bcbf5b31c080cea6f8801
+  metadata.gz: b3eb054e3b0dd3ded63ef8de4bfff37d8d36971dbe02107ac2e30114fadc12563807d4c7bdc4d3fdf8b801a7bd8250fcb5e73a547604b0feba7382abfdff0ee7
+  data.tar.gz: 168c3cfef2a37c4f5e3f6e2782b614a546f8307793e41af0efe200b2afa8d100b725889e5bb8fcf520fa7c2a0be18faa4cedb10a9ddf573bedac162a1404f133

data/CHANGELOG.md

@@ -8,6 +8,52 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.21.0] - 2026-10-04
+
+### Added
+
+- The debug log's generation_completed line names the OpenRouter provider that served it (provider=).
+
+### Fixed
+
+- loop-guard cuts thinking that loops in short sentences ("I'll write it. Go. OK. Writing."),
+  which it skipped before: such a loop ran for minutes to the provider's output cap. New settings
+  `thinking.short_run` (24) and `thinking.short_distinct` (6).
+- loop-guard's thinking watch no longer goes blind for the rest of a generation after an empty thinking
+  chunk (a FrozenError, logged as `plugin_hook_failed`), so it now sees every generation's thinking.
+- loop-guard no longer stops a whole turn for a thinking loop that comes long after the model recovered from
+  its first one: after `thinking.forget_after` (10) steps with no loop, the next loop is cut and retried again.
+- A turn a plugin stopped now says who did it, `✕ turn stopped by loop-guard` (the web: `✕ stopped by
+  loop-guard`), instead of `✕ canceled (by a hook)`, also after a reload of the web page.
+- An attached `/exit` the worker reads only after the TUI stopped waiting (a frozen or sleeping worker) no
+  longer stops it later: the request is dropped, as late turns and commands are.
+- The attached `/exit` (and `/exit --delete`, `/archive`) in an empty session no longer claims the session is
+  already gone: a note arriving before the worker stops keeps it, so it says it will be discarded if nothing
+  arrives.
+- Archiving a session (`/archive`, `chi sessions archive`, the web) with a prompt still queued or a step-limit
+  question open is refused with a message saying so, instead of stopping the worker and leaving the queued
+  prompt to run on the next resume.
+- `/exit` right after a `/detach` and `chi --attach` no longer says "another UI is attached" and leaves the worker
+  up: the worker notices a closed stream at once instead of at its next 15-second heartbeat.
+- Leaving chi's terminal UI (`/exit`, `/detach`, Ctrl-D) no longer can leave a stray cursor report such as
+  `^[[12;1R` at the shell prompt: input nobody read is dropped before the terminal is handed back.
+- Joining a running turn (web or `chi --attach`) while the model is holding before its first token now shows
+  the step it's on, as a live view does, instead of the previous step still live.
+- Web: sending into a session whose worker was already up (but the page didn't know) no longer draws
+  that worker's earlier turns a second time: the page re-reads the session instead.
+- Web without the session events stream (fetched list): a re-fetched list now badges and notifies like the
+  live list does.
+- Web: a session deleted while the page had lost the session events stream (or between two fetches of the
+  list) no longer keeps its question or card counted in the tab title's badge until the tab comes to front.
+- Web on a phone: the session footer's archive, stop and delete buttons are icons (the words stay as their
+  accessible names and tooltips), so the status and `mem N` chips beside them are in sight again.
+- Web: with several chi tabs in the background, a session that needs you shows one OS notification, not one
+  per tab (every tab still counts it in its title).
+- chi web: a session stream whose worker took the connection and froze before answering no longer holds the
+  request forever; it gives up after 5 s per attempt.
+
+Update with `chi update`: loop-guard moves to 0.3.1 (short-sentence loops, forget_after, the blind-watch fix). Restart `chi web` and running sessions afterwards (`chi sessions restart ID`).
+
 ## [0.20.0] - 2026-10-03
 
 ### Added
@@ -1199,7 +1245,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.20.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.21.0...HEAD
+[0.21.0]: https://github.com/dm1try/samagotchi/compare/v0.20.0...v0.21.0
 [0.20.0]: https://github.com/dm1try/samagotchi/compare/v0.19.0...v0.20.0
 [0.19.0]: https://github.com/dm1try/samagotchi/compare/v0.18.1...v0.19.0
 [0.18.1]: https://github.com/dm1try/samagotchi/compare/v0.18.0...v0.18.1

data/docs/architecture.md

@@ -170,7 +170,8 @@ higher-level events so UIs get clean turn boundaries without inferring them:
 
 - `:turn_started` — `{ session_id:, prompt: }`
 - `:turn_completed` — `{ result: }` (the final `LLM::ModelResult`)
-- `:turn_canceled` — `{ cancellation_reason: }`
+- `:turn_canceled` — `{ cancellation_reason:, cancelled_by: }` (`cancelled_by`: the bundle or hook label that
+  stopped it, for `cancellation_reason: :hook`; else nil)
 
 Every event is a `Hash` with a `:type` symbol key; the sink must not raise (the Engine
 rescues sink errors). A new UI (web, API) supplies its own `on_event` and

data/docs/cli.md

@@ -844,7 +844,8 @@ Behavior notes:
   `partial progress kept; !rollback restores the pre-turn state` under it (a canceled continue is back where it
   started). A failed turn ends with `✕ turn failed: <summary> · 2.0s` and a dim `prompt restored for retry`. The
   REPL and attached mode say the same; the web says `✕ canceled (Ctrl-C)` (`stopped` for its Stop button,
-  `by a hook` for a hook's).
+  `by a hook` for a hook's). A turn a bundle's plugin stopped names it: `✕ turn stopped by loop-guard` (the web:
+  `✕ stopped by loop-guard`).
 - Visible text the canceled request had streamed stays in the conversation, marked `[interrupted]`, so the next
   message (or a continue) picks up from the half-finished reply; the canceled request's thinking and any unfinished
   tool call are dropped.

data/docs/plugins.md

@@ -831,16 +831,22 @@ minutes, until the provider's output cap ends it with no answer. loop-guard
 watches the thinking while it streams ([Watching the
 stream](hooks.md#watching-the-stream)) and cuts it:
 
-- The thinking is cut into sentences; short ones (under `min_words`) are
-  skipped. Two sentences count as the same when their words and word pairs
-  mostly match (`similarity`), so a reworded round ("Hmm, …", a synonym, a
-  swapped clause) still counts.
+- The thinking is cut into sentences. Two sentences of `min_words` or more
+  count as the same when their words and word pairs mostly match
+  (`similarity`), so a reworded round ("Hmm, …", a synonym, a swapped
+  clause) still counts.
 - A loop is a cycle of 1 to `max_period` sentences seen `repeats` times in a
   row, over at least `min_span_sentences` sentences and `min_span_chars`
   chars; or one sentence `max_same` times anywhere in the generation. One
   sentence over and over must be near-identical (`similarity` + 0.4), and a
   longer cycle must hold different sentences: a list of templated sentences
   ("Now I need to open the file <path> and …" for 14 paths) is no loop.
+- Short sentences (under `min_words`) are a loop of their own when
+  `short_run` of them come in a row with at most `short_distinct` different
+  ones among them ("I'll write it. Go. OK. Writing. Go. OK."). Normal
+  thinking has short sentences too ("Hmm.", "Fine."), but spread out or all
+  different (code lines); a longer sentence ends the run, and lines inside a
+  ```` ``` ```` code block don't count.
 - Nothing triggers before `min_chars` of thinking. The watch sees a loop
   within one batch (2000 chars, or a second) of its third cycle.
 
@@ -851,11 +857,16 @@ What happens (`action: retry`, the default):
    `loop-guard> thinking repeats itself (3 sentences ×3, 4k chars, 8 s): cut`
    and `↻ cut by loop-guard, asking again (1/1)`.
 2. If the retry loops too, the turn is stopped ("stopped the turn: …", "✕
-   turn canceled (hook)") with a card that quotes the repeated sentences.
+   turn stopped by loop-guard") with a card that quotes the repeated
+   sentences.
+3. A loop is forgotten after `forget_after` good steps in a row (generations
+   with no loop): a model that recovered and made progress gets its next
+   loop cut and retried again, not the turn stopped. `forget_after: 0`
+   never forgets: the turn's second loop stops it.
 
 The cut uses the `retry.empty_answer` budget: with `retry.empty_answer: 0`
-the first loop ends the turn as cancelled (hook), with the notice and no
-card. `action: stop` stops the turn at the first loop; `action: notify` only
+the first loop ends the turn as stopped by loop-guard, with the notice and
+no card. `action: stop` stops the turn at the first loop; `action: notify` only
 warns, once per generation.
 
 ```yaml
@@ -871,7 +882,10 @@ bundles:
       min_span_sentences: 6   # a loop spans at least this many sentences…
       min_span_chars: 600     # …and this many chars
       max_same: 8             # one sentence this many times in one generation is a loop
-      min_words: 5            # shorter sentences are ignored
+      min_words: 5            # shorter sentences only count toward a short run
+      short_run: 24           # this many short sentences in a row…
+      short_distinct: 6       # …with at most this many different ones is a loop
+      forget_after: 10        # good steps in a row that forget a loop; 0: never
 ```
 
 Not watched:

data/docs/sessions.md

@@ -15,7 +15,7 @@ A session is deleted if **expired by age OR overflow by count** (unless `keep_st
 
 **Worker idle exit:** a background worker (plain `chi`, Web UI sessions) exits after `SAMAGOTCHI_SESSION_IDLE_EXIT_MINUTES` (`session.idle_exit_minutes`, default `30`, `0`=never) with no turn running or queued, no client on its stream (an open web tab or attached terminal keeps it), no reminder registered and no continue offer (the step-limit question) waiting for an answer. It removes `bridge.json` and frees `owner.lock`; the next prompt or `--attach` wakes a new worker (`WorkerIdleExit`, `SessionManager.run_session_loop`). A client can also ask the worker to exit right away (Bridge `POST /session/:id/exit`; `/exit` in an attached terminal does, `/detach` doesn't): the same rules apply without the timeout (even with `0`), and the asker's own stream doesn't count. The reply names what keeps it up. The session's status stays as it was, not `stopped`. With `"restart": true` (a worker whose sidecar lists the `restart` feature) the worker hands the session to a new worker on the newest chi installed: it leaves, then starts its successor once its lock is free, keeping even an empty session and writing no recap. Clients' streams don't hold a restart (a web tab and an attached terminal reconnect to the new worker); what would be lost does: a turn running or queued, a continue offer, a question or approval waiting, reminders, a `/btw` (or another anytime command) still running, a delegate's approval relay open or settled in the last 10 minutes, and background tasks this conversation started that still run (`WorkerIdleExit#hold_for_restart`; 409 `held` with `reason`). What lives only in the worker's memory goes: the event history a late client replays, the kept `/btw` answers, a plugin's in-memory state.
 
-**Empty sessions:** a session nothing happened in is deleted when it is left, so `chi` → `/exit` leaves no trace. Empty means: no messages, no turn tried (a failed turn leaves a `last_prompt` and keeps it), no memory used, no pending question, nothing in `input/`, `notes/` or `images/`, nothing in its dir beyond the worker's skeleton, mode `assist`, and the default model. A session on another model (`/model`, `--model`) counts as prepared and stays (`SessionManager.discardable?`). The worker checks as it idle-exits or leaves on a client's request and deletes it once its lock is free, checking again first. The attached `/exit` then says `Detached; the session was empty, so it is discarded.` The REPL (`--no-shared`) does the same at `/exit` or Ctrl-D. The retention sweep catches those killed first: empty sessions over an hour old with no live owner, whatever `DAYS`/`MAX`, and skeleton-only dirs with no `*.json`. `session.keep_empty: true` (env `SAMAGOTCHI_SESSION_KEEP_EMPTY`) turns all of it off.
+**Empty sessions:** a session nothing happened in is deleted when it is left, so `chi` → `/exit` leaves no trace. Empty means: no messages, no turn tried (a failed turn leaves a `last_prompt` and keeps it), no memory used, no pending question, nothing in `input/`, `notes/` or `images/`, nothing in its dir beyond the worker's skeleton, mode `assist`, and the default model. A session on another model (`/model`, `--model`) counts as prepared and stays (`SessionManager.discardable?`). The worker checks as it idle-exits or leaves on a client's request and deletes it once its lock is free, checking again first. The attached `/exit` then says `Detached; the session is empty: it will be discarded if nothing arrives before its worker stops.` (a note or prompt landing first keeps it). The REPL (`--no-shared`) does the same at `/exit` or Ctrl-D. The retention sweep catches those killed first: empty sessions over an hour old with no live owner, whatever `DAYS`/`MAX`, and skeleton-only dirs with no `*.json`. `session.keep_empty: true` (env `SAMAGOTCHI_SESSION_KEEP_EMPTY`) turns all of it off.
 
 **Attached by default:** plain `chi` and `chi --resume ID` run their session in a background worker and attach to it (`session.shared`, default `true`; env `SAMAGOTCHI_SESSION_SHARED`). The worker runs in the session's `working_directory`, so `!commands` and tools see the directory the session was started in. `session.shared: false` keeps the in-process REPL, `--no-shared` does for one run; a session the REPL has open can't be attached ("close it there first"). See [CLI: Sharing a session](cli.md#sharing-a-session).
 
@@ -25,7 +25,7 @@ A session is deleted if **expired by age OR overflow by count** (unless `keep_st
 
 **Deleting a session:** `chi sessions delete ID...`, `/exit --delete` in a terminal and the Web UI's delete all go through `SessionManager.delete_session`: it resolves a unique prefix, removes `<id>.json` and the whole `<id>/` dir, and returns what it removed. A session a plain REPL has open (`owner.lock` kind `tui`) is always refused. One a worker runs is refused unless the caller asks to stop it: then it stops the worker as `chi sessions stop` does and deletes once `owner.lock` is free (`--force` on the CLI, 10 s; the web always, 2 s; `/exit --delete` after the worker agreed to exit, 10 s). A worker that outlives the wait leaves the session in place. The web's route is `DELETE /api/sessions/:id` (200 `{status: "deleted", session_id, stopped}`; 409 `owned_by_tui` or `still_stopping`; 404).
 
-<a id="archiving-a-session"></a>**Archiving a session:** `chi sessions archive ID...`, `/archive` in a terminal and the Web UI's `archive` go through `SessionManager.archive_session`: it writes `<id>/archived` (`{"archived_at": …}`; not a session.json field, which every save rewrites) for the session and its delegated children. `Session.list` leaves archived sessions out unless `include_archived:`, and everything built on it follows: `chi sessions list` (`--archived` shows them, `[archived]`), the summaries (`--live`, json/tsv, the desktop panel, the agent's `list_sessions`) and the retention prune, which neither deletes nor counts them against `max_count`. `children_of` (max_children, `delegate_result`) still sees them, and `--resume`/`--attach ID`, `chi send`/`chi note ID` reach them as before. Refused: a turn running in the session or in one of its children (naming the child; 409 `busy` on the web), a plain REPL owning it (`owned_by_tui`), a `chi scratch` session (`scratch`). A live idle worker is stopped first, and the marker is written even if it is still shutting down. Input a human typed brings a session back (`{"unarchived_at": …}`): a prompt from the web, an attached or plain terminal or `chi send` (origin `web:*`, `tui:*`, `cli:send`, none), steering merged into a running turn, a `/continue` answer or a question answered (the step-limit question too); a delegate's follow-up, a plugin's turn, a reminder, the idle recap, a note and just opening it don't. A child's input brings only the child back. The retention sweep ages an unarchived session from when it was unarchived, so unarchiving an old session doesn't let the next sweep take it. `/archive` leaves the session first, as `/exit` does, then archives it: in an attached terminal the worker is asked to exit (one that stays up for another UI is stopped by the archive; a running turn refuses it), and an empty session is discarded instead; `chi scratch` refuses it. `chi sessions unarchive ID...` and the web's `unarchive` bring back the whole family. Web routes: `POST /api/sessions/:id/archive` (200 `{status, session_id, archived, stopped, discarded}`, ids) and `POST /api/sessions/:id/unarchive` (200 `{status, session_id, unarchived}`). The session hub and `GET /api/sessions` keep archived sessions, `archived: true` in their summaries: the page leaves them out of the strip, its count and the list at render, and "include archived" by the all-sessions search shows them, dimmed with an `archived` badge. The info bar marks a session whose live worker runs an older chi than the newest installed (`worker_version` in its summary): `chi 0.18.1 · Restart`, which asks to confirm and calls `POST /api/sessions/:id/restart` (a refusal's reason shows in a toast); a worker from before restarts shows `chi sessions stop ID` instead. The info bar reads `archive · stop · delete` (`unarchive` on an archived one); archiving the open session stays on it, with an Undo toast.
+<a id="archiving-a-session"></a>**Archiving a session:** `chi sessions archive ID...`, `/archive` in a terminal and the Web UI's `archive` go through `SessionManager.archive_session`: it writes `<id>/archived` (`{"archived_at": …}`; not a session.json field, which every save rewrites) for the session and its delegated children. `Session.list` leaves archived sessions out unless `include_archived:`, and everything built on it follows: `chi sessions list` (`--archived` shows them, `[archived]`), the summaries (`--live`, json/tsv, the desktop panel, the agent's `list_sessions`) and the retention prune, which neither deletes nor counts them against `max_count`. `children_of` (max_children, `delegate_result`) still sees them, and `--resume`/`--attach ID`, `chi send`/`chi note ID` reach them as before. Refused: a turn running in the session or in one of its children (naming the child; 409 `busy` on the web), a prompt queued in `input/` (it would run on the next resume) or a live worker's step-limit question still open, in it or a child (409 `busy` too), a plain REPL owning it (`owned_by_tui`), a `chi scratch` session (`scratch`). A live idle worker is stopped first, and the marker is written even if it is still shutting down. Input a human typed brings a session back (`{"unarchived_at": …}`): a prompt from the web, an attached or plain terminal or `chi send` (origin `web:*`, `tui:*`, `cli:send`, none), steering merged into a running turn, a `/continue` answer or a question answered (the step-limit question too); a delegate's follow-up, a plugin's turn, a reminder, the idle recap, a note and just opening it don't. A child's input brings only the child back. The retention sweep ages an unarchived session from when it was unarchived, so unarchiving an old session doesn't let the next sweep take it. `/archive` leaves the session first, as `/exit` does, then archives it: in an attached terminal the worker is asked to exit (one that stays up for another UI is stopped by the archive; a running turn, a queued prompt or an open step-limit question refuses it), and an empty session is discarded instead; `chi scratch` refuses it. `chi sessions unarchive ID...` and the web's `unarchive` bring back the whole family. Web routes: `POST /api/sessions/:id/archive` (200 `{status, session_id, archived, stopped, discarded}`, ids) and `POST /api/sessions/:id/unarchive` (200 `{status, session_id, unarchived}`). The session hub and `GET /api/sessions` keep archived sessions, `archived: true` in their summaries: the page leaves them out of the strip, its count and the list at render, and "include archived" by the all-sessions search shows them, dimmed with an `archived` badge. The info bar marks a session whose live worker runs an older chi than the newest installed (`worker_version` in its summary): `chi 0.18.1 · Restart`, which asks to confirm and calls `POST /api/sessions/:id/restart` (a refusal's reason shows in a toast); a worker from before restarts shows `chi sessions stop ID` instead. The info bar reads `archive · stop · delete` (`unarchive` on an archived one); archiving the open session stays on it, with an Undo toast.
 
 **Lazy sweep:** automatic prune runs only while `chi web` runs, at most once per `session.sweep_interval_hours` (default 24): the web's session hub gives it a chance on its periodic full scan, and `GET /api/sessions` does too. No cron, and a terminal-only chi never sweeps. Manual prune is always available.
 

data/lib/samagotchi/bridge/sse_writer.rb

@@ -39,6 +39,8 @@ module Samagotchi
     class SSEWriter
       DEFAULT_MAX_QUEUE = 1024
       DEFAULT_HEARTBEAT_INTERVAL = 15.0
+      # Queued by the hang-up watcher (#watch_hangup) to wake #drain!.
+      HANGUP = Object.new.freeze
 
       # @param engine [Samagotchi::Engine] the owning engine (live fan-out)
       # @param ring [Samagotchi::Bridge::RingBuffer] shared capture buffer
@@ -77,6 +79,7 @@ module Samagotchi
         @foreign_cursor = !cursor_epoch.nil? && cursor_epoch != @epoch
         @high_water = @foreign_cursor ? 0 : cursor_seq
         @handle = nil
+        @hung_up = false
       end
 
       # Non-blocking enqueue used as the per-connection live observer. Any
@@ -97,6 +100,7 @@ module Samagotchi
       # the client disconnects or the bridge stops.
       def serve!(io)
         write_sse_headers(io)
+        watcher = watch_hangup(io)
         begin
           if @join_with_snapshot
             # Subscribe and snapshot as one step of the event log, then go live.
@@ -119,11 +123,36 @@ module Samagotchi
           # Client hung up; nothing to do.
         ensure
           @engine.unsubscribe(handle: @handle) if @handle
+          watcher&.kill
         end
       end
 
       private
 
+      # A client that hangs up is noticed now, not at the next write (a
+      # heartbeat, up to its interval away): the Bridge stops counting its
+      # stream (Bridge#open_streams_except), so an attached /exit from the
+      # TUI attached after it isn't held by it. A thread waits for the
+      # socket to read EOF and wakes #drain!. A client sends nothing after
+      # its request; bytes it does send are dropped. Real sockets only.
+      def watch_hangup(io)
+        return nil unless io.is_a?(IO)
+
+        Thread.new do
+          loop do
+            case io.read_nonblock(4096, exception: false)
+            when nil then break
+            when :wait_readable then io.wait_readable
+            end
+          end
+        rescue IOError, SystemCallError
+          nil
+        ensure
+          @hung_up = true
+          @queue.push(HANGUP)
+        end.tap { |thread| thread.report_on_exception = false }
+      end
+
       def replay!(io, snapshot_seq)
         from_seq = @high_water
         oldest = @ring.oldest_seq
@@ -146,6 +175,9 @@ module Samagotchi
       def drain!(io)
         loop do
           payload = @queue.pop(@heartbeat_interval)
+          # The watcher's flag, not only its HANGUP: an overflow can drop that.
+          break if @hung_up
+
           if payload
             if payload.is_a?(Hash) && payload[:sse_reset]
               emit_reset(io)

data/lib/samagotchi/bridge/turn_accumulator.rb

@@ -38,8 +38,8 @@ module Samagotchi
       end
 
       # @return [Hash, nil] a copy of the turn in progress: prompt, origin,
-      #   continue, ordered parts (thinking / text / tool / input / steer /
-      #   reminder / notice), pending_question and the last event_seq folded
+      #   continue, ordered parts (generation / thinking / text / tool /
+      #   input / steer / reminder / notice), pending_question and the last event_seq folded
       #   in. A finished tool part keeps the live row's action and duration_ms
       #   too, a running one the time it has run so far (elapsed_ms), so a
       #   join times its row from its start. A notice part holds the event
@@ -101,7 +101,9 @@ module Samagotchi
       # The turn in progress (#current_turn's shape, symbol keys) as the live
       # events that would have drawn it, in order, as turn_events.js
       # snapshotEvents replays it for the web (spec/shared/turn_snapshot.json
-      # pins both): a generation_chunk per thinking or text part (a
+      # pins both): a generation_started per generation part (a join during
+      # a hold shows the step the model is on), a generation_chunk per
+      # thinking or text part (a
       # generation_completed closes text before the next step's), a tool's
       # tool_call_started and, once finished, its tool_call_completed (with
       # the live activity: action, tool, params, status), a merged_input
@@ -123,6 +125,9 @@ module Samagotchi
         end
         Array(turn[:parts]).each do |part|
           case part[:kind]
+          when "generation"
+            close_text.call
+            events << { type: :generation_started, iteration: part[:iteration] }
           when "thinking" then events << { type: :generation_chunk, text: "", thinking: part[:text], iteration: part[:iteration] }
           when "text"
             close_text.call if !text_iteration.nil? && text_iteration != part[:iteration]
@@ -233,6 +238,8 @@ module Samagotchi
       def fold_turn_event(event)
         parts = @turn[:parts]
         case event[:type]
+        when :generation_started
+          parts << { kind: "generation", iteration: event[:iteration] }
         when :generation_chunk
           if event.key?(:text)
             # Profile-split stream: thinking and visible text separately.

data/lib/samagotchi/bridge.rb

@@ -134,7 +134,8 @@ module Samagotchi
 
     # Streams held by anyone but +client_id+: a client's own stream (or two,
     # while it reconnects and the old one isn't noticed dead yet) doesn't
-    # count. A closed stream counts until its next write fails (heartbeat).
+    # count. A closed stream stops counting once its writer reads the
+    # hang-up (SSEWriter#watch_hangup).
     # @return [Integer]
     def open_streams_except(client_id)
       @mutex.synchronize { @open_streams - (client_id ? @streams_by_client[client_id] : 0) }
@@ -698,7 +699,10 @@ module Samagotchi
     # event log held, so no POST /turn lands between its check and its
     # answer; it leaves from its loop after this reply.
     # 200 {status: "exiting", discard?: the session is empty and goes} ({status: "restarting"} for a restart), or 409
-    # {status: "held", reason:} naming what keeps it up. Returns [headers, status, body].
+    # {status: "held", reason:} naming what keeps it up. A past +deadline+
+    # (see #handle_post_turn), checked with the event log held: 408
+    # deadline_passed, the worker not asked (its client said it didn't stop).
+    # Returns [headers, status, body].
     def handle_exit_request(session_id, body)
       return [{}, 501, { error: "exit_unavailable" }] unless @on_exit_request
 
@@ -709,7 +713,15 @@ module Samagotchi
       delete = fetched(parsed, "delete") == true
       restart = fetched(parsed, "restart") == true
       options = restart ? { delete: delete, restart: true } : { delete: delete }
-      reason = @engine.synchronize_events { @on_exit_request.call(client_id, **options) }
+      deadline = fetched(parsed, "deadline")
+      return BAD_DEADLINE unless deadline_valid?(deadline)
+
+      reason = @engine.synchronize_events do
+        next :expired if expired?("exit_expired", deadline, sid: session_id, client_id: client_id)
+
+        @on_exit_request.call(client_id, **options)
+      end
+      return deadline_passed("exit request") if reason == :expired
       if reason.nil?
         return [{}, 200, { status: "restarting", session_id: @session_id }] if restart
 
@@ -849,7 +861,7 @@ module Samagotchi
     end
 
     # The 408 for a request read after its deadline: +what+ (turn, command,
-    # answer, dismissal) was dropped.
+    # answer, dismissal, exit request) was dropped.
     def deadline_passed(what)
       [{}, 408, { error: "deadline_passed", detail: "the #{what} arrived after its client stopped waiting; not run" }]
     end

data/lib/samagotchi/bridge_client.rb

@@ -20,6 +20,10 @@ module Samagotchi
     # A reply's status line; its code is group 1.
     STATUS_LINE = %r{\AHTTP/1\.[01] (\d{3})}
     STREAM_CONNECT_ATTEMPTS = 3
+    # Seconds #stream waits for the Bridge's response headers, per attempt:
+    # a worker that took the connection and froze must not hold the web's
+    # proxy thread (as EventStream::HEADER_TIMEOUT for the TUI's).
+    STREAM_HEADER_TIMEOUT = 5.0
     # Seconds #stream waits for bytes before it asks `running` again.
     STREAM_POLL = 0.5
     # Seconds a one-shot request waits for the whole reply. Every route
@@ -28,7 +32,7 @@ module Samagotchi
     # raises Errno::ECONNREFUSED. The event stream has no such limit.
     READ_TIMEOUT = 30
     # Share of the read timeout a request's deadline allows (25 s of 30): the
-    # Bridge drops a turn, command, answer or dismissal it reads after the
+    # Bridge drops a turn, command, answer, dismissal or exit it reads after the
     # deadline, so one this client timed out on, and said did not go
     # through, never runs when a frozen worker wakes. The rest covers the
     # write and the reply.
@@ -159,13 +163,14 @@ module Samagotchi
     # POST /session/:id/exit: ask the worker to exit now (+restart+: hand
     # the session to a new worker, a worker with the "restart" feature). 200
     # = it will (status "exiting"/"restarting"), 409 = something keeps it up (reason), 404 with
-    # error "not_found" = a worker older than the route.
+    # error "not_found" = a worker older than the route, 408 = too late.
     # @param client_id [String] the asking UI, whose own streams don't hold
     # @return [Response]
     def request_exit(client_id:, delete: false, restart: false)
       body = { client_id: client_id }
       body[:delete] = true if delete
       body[:restart] = true if restart
+      body[:deadline] = deadline
       post("exit", body, read_body: true)
     end
 
@@ -258,7 +263,8 @@ module Samagotchi
     # @param running [#call, nil] asked before every read, and every
     #   STREAM_POLL seconds of silence: the stream ends once it returns
     #   false. A quiet stream is never cut otherwise.
-    def stream(query: "", last_event_id: nil, running: nil)
+    # @param header_timeout [Float] see STREAM_HEADER_TIMEOUT
+    def stream(query: "", last_event_id: nil, running: nil, header_timeout: STREAM_HEADER_TIMEOUT)
       sock = nil
       # Absorb the probe→connect race around a resumed worker's bridge:
       # the sidecar probe can succeed a moment before the worker dies (or
@@ -266,7 +272,7 @@ module Samagotchi
       # avoid the silent empty-200 that EventSource would otherwise keep
       # re-opening.
       STREAM_CONNECT_ATTEMPTS.times do |attempt|
-        sock, = connect_stream(query: query, last_event_id: last_event_id)
+        sock, = connect_stream(query: query, last_event_id: last_event_id, timeout: header_timeout)
         break if sock
 
         sleep(0.15 * (attempt + 1))
@@ -302,7 +308,7 @@ module Samagotchi
     end
 
     # Open GET /session/:id/stream and read past the response headers.
-    # @param timeout [Float, nil] give up when the headers don't start in time
+    # @param timeout [Float, nil] give up when the headers aren't all in by then
     # @return [Array(TCPSocket, Integer), nil] the socket positioned at the
     #   body and the HTTP status, or nil when the Bridge can't be reached
     def connect_stream(query: "", last_event_id: nil, timeout: nil)
@@ -310,10 +316,9 @@ module Samagotchi
       lei = last_event_id.to_s.strip
       last_event_line = lei.empty? ? "" : "Last-Event-ID: #{lei}\r\n"
       sock.write("GET /session/#{@session_id}/stream#{query} HTTP/1.1\r\nHost: #{@host}:#{@port}\r\nAccept: text/event-stream\r\n#{last_event_line}Connection: keep-alive\r\n\r\n")
-      raise Errno::ETIMEDOUT if timeout && !sock.wait_readable(timeout)
-
-      status = sock.gets.to_s[STATUS_LINE, 1].to_i
-      while (line = sock.gets)
+      deadline = timeout && (Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout)
+      status = header_line(sock, deadline).to_s[STATUS_LINE, 1].to_i
+      while (line = header_line(sock, deadline))
         break if line.strip.empty?
       end
       [sock, status]
@@ -324,6 +329,25 @@ module Samagotchi
 
     private
 
+    # One line of the response headers, or nil at EOF; raises
+    # Errno::ETIMEDOUT once +deadline+ (monotonic, nil: none) has passed. A
+    # line read in pieces, so a Bridge that stops mid-line can't hold it.
+    def header_line(sock, deadline)
+      return sock.gets unless deadline
+
+      line = +""
+      loop do
+        remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        raise Errno::ETIMEDOUT unless remaining.positive? && sock.wait_readable(remaining)
+
+        char = sock.getc
+        return line.empty? ? nil : line if char.nil?
+
+        line << char
+        return line if char == "\n"
+      end
+    end
+
     # When this client stops waiting for a reply, as epoch seconds (see
     # DEADLINE_SHARE). Wall clock: the worker runs on this machine and reads
     # the same one.

data/lib/samagotchi/bundle_command.rb

@@ -200,6 +200,10 @@ module Samagotchi
     end
 
     # Runs +installer+, prints its summary, then yields the manifest.
+    # Ensures the extracted source dir is cleaned up even if an exception
+    # occurs between installer.run and the block (e.g. summary,
+    # print_hooks_and_plugin). The block (upgrade_conflicts) still sees
+    # the files because cleanup happens after the block returns or raises.
     # @return [Integer] the block's exit status, or 1 after "<failed> failed: …"
     def run_installer(installer, failed:)
       _nd, manifest = installer.run
@@ -208,6 +212,8 @@ module Samagotchi
     rescue Samagotchi::MemoryBundle::Installer::InstallError => e
       @stderr.puts "#{failed} failed: #{e.message}"
       1
+    ensure
+      installer.cleanup_source!
     end
 
     def print_hooks_and_plugin(manifest, plugin: true)

data/lib/samagotchi/bundles/loop-guard/manifest.yml

@@ -1,10 +1,10 @@
 ---
 name: loop-guard
-version: 0.2.2
+version: 0.3.1
 scope: system
 description: "Breaks loops: the same tool call with the same result again and again in one turn is denied with advice (after a few denies the turn stops with a card), and thinking that repeats itself while it streams is cut and the model asked again"
 trust_level: reviewed
 plugin:
   file: plugin.rb
-  sha256: sha256:e62c68d1a2280adf55b150488d0d85bbbc35ffce54dfed387a86adceb85e4d34
+  sha256: sha256:32d04fa3f4b3394e80160dd780615a4a1ddeb3be0f2e327a6497c7766dbd9f11
 requires_chi: ">= 0.6.0"

data/lib/samagotchi/bundles/loop-guard/plugin.rb

@@ -24,6 +24,9 @@
 #   thinking:          the thinking watch (ThinkingWatch::DEFAULTS)
 #     watch: true      false: the tool-call guard only
 #     action: retry    retry (cut, ask again; then stop) | stop | notify
+#     forget_after: 10 good steps (generations with no loop) in a row after a
+#                      cut loop, and the next loop is cut again, not stopped;
+#                      0: never forget, the turn's second loop stops it
 require "digest"
 
 # Sees thinking repeat itself, from the deltas of one generation.
@@ -44,12 +47,19 @@ require "digest"
 #   of 2 or more needs a cycle of distinct sentences (not all alike), and a
 #   period of 1 (one sentence over and over) needs `similarity` +
 #   SAME_MARGIN (0.9 by default: near-identical);
-# - the same sentence max_same times in the generation, in any order.
+# - the same sentence max_same times in the generation, in any order;
+# - a short run: short_run short sentences (under min_words) in a row, at
+#   most short_distinct different ones among the last short_run ("I'll
+#   write it. Go. OK. Writing. Go."). Normal thinking has short sentences
+#   too ("Hmm.", "Fine."), but spread out, or in runs of different ones
+#   (code lines); a sentence of min_words or more ends the run, one with no
+#   letters or digits neither counts nor ends it. Lines inside a ``` code
+#   block are not short sentences.
 # Nothing triggers before min_chars of thinking. O(new chars) per feed.
 class ThinkingWatch
   DEFAULTS = { "watch" => true, "action" => "retry", "min_chars" => 2000, "repeats" => 3, "max_period" => 6,
                "similarity" => 0.5, "min_span_sentences" => 6, "min_span_chars" => 600, "max_same" => 8,
-               "min_words" => 5 }.freeze
+               "min_words" => 5, "short_run" => 24, "short_distinct" => 6, "forget_after" => 10 }.freeze
   ACTIONS = %w[retry stop notify].freeze
   MAX_CARRY = 400
   # One sentence again and again needs this much more alike than a cycle.
@@ -68,10 +78,13 @@ class ThinkingWatch
     out = DEFAULTS.dup
     out["watch"] = !%w[false no off 0].include?(raw["watch"].to_s.downcase) if raw.key?("watch")
     out["action"] = raw["action"].to_s if ACTIONS.include?(raw["action"].to_s)
-    %w[min_chars repeats max_period min_span_sentences min_span_chars max_same min_words].each do |key|
+    %w[min_chars repeats max_period min_span_sentences min_span_chars max_same min_words short_run
+       short_distinct].each do |key|
       number = Integer(raw[key].to_s, exception: false)
       out[key] = number if number&.positive?
     end
+    forget = Integer(raw["forget_after"].to_s, exception: false)
+    out["forget_after"] = forget if forget && forget >= 0
     similarity = Float(raw["similarity"].to_s, exception: false)
     out["similarity"] = similarity if similarity && similarity.positive? && similarity <= 1
     out["repeats"] = 2 if out["repeats"] < 2
@@ -87,12 +100,17 @@ class ThinkingWatch
     @min_span_chars = settings["min_span_chars"]
     @max_same = settings["max_same"]
     @min_words = settings["min_words"]
+    @short_run = settings["short_run"]
+    @short_distinct = settings["short_distinct"]
     @same_similarity = [@similarity + SAME_MARGIN, 0.95].min
     @carry = +""
     @window = [] # the last max_period + 1 sentences
     @run = Array.new(@max_period + 1, 0)
     @run_chars = Array.new(@max_period + 1, 0) # chars of the run's sentences plus the first cycle's
     @counts = Hash.new(0)
+    @short_count = 0  # short sentences in a row
+    @short_window = [] # the last short_run of them, [key, text]
+    @in_code = false
     @thinking_chars = 0
   end
 
@@ -115,7 +133,9 @@ class ThinkingWatch
   # The complete sentences in the carry; the unfinished tail stays.
   def sentences
     parts = @carry.split(SPLIT, -1)
-    @carry = parts.pop.to_s
+    # An empty carry splits into no parts: nil.to_s is frozen, and the next
+    # feed's << would raise (the watch went blind for that generation).
+    @carry = +parts.pop.to_s
     if @carry.length > MAX_CARRY
       cut = @carry.rindex(" ", MAX_CARRY) || MAX_CARRY
       parts << @carry[0, cut]
@@ -125,8 +145,13 @@ class ThinkingWatch
   end
 
   def add(text)
+    if text.strip.start_with?("```")
+      @in_code = !@in_code
+      return nil
+    end
     words = text.downcase.gsub(/[^[:alnum:]]+/, " ").split
-    return nil if words.length < @min_words
+    short = short_loop(text.strip, words) unless @in_code
+    return (short if @thinking_chars >= @min_chars) if words.length < @min_words
 
     key = words.join(" ")
     sentence = Sentence.new(text: text.strip, words: words.map(&:hash).uniq,
@@ -140,6 +165,25 @@ class ThinkingWatch
     cycle || (same >= @max_same ? Loop.new(period: 1, times: same, sentences: [sentence.text], chars: nil) : nil)
   end
 
+  def short_loop(text, words)
+    return nil if words.empty?
+
+    if words.length >= @min_words
+      @short_count = 0
+      @short_window.clear
+      return nil
+    end
+    @short_count += 1
+    @short_window << [words.join(" "), text]
+    @short_window.shift if @short_window.length > @short_run
+    return nil if @short_window.length < @short_run
+
+    distinct = @short_window.uniq(&:first)
+    return nil if distinct.length > @short_distinct
+
+    Loop.new(period: distinct.length, times: @short_count / distinct.length, sentences: distinct.first(3).map(&:last), chars: nil)
+  end
+
   def count(key)
     return @counts[key] += 1 if @counts.key?(key) || @counts.size < MAX_DISTINCT
 
@@ -209,6 +253,7 @@ class Plugin
     return unless @thinking["watch"]
 
     chi.on(:before_generation) do |_event|
+      good_step if @watch
       @watch = ThinkingWatch.new(@thinking)
       @watch_done = false
     end
@@ -242,6 +287,16 @@ class Plugin
     end
   end
 
+  # The generation before this one ended with no loop: a good step. After
+  # forget_after of them in a row the turn's loops are forgotten, so a loop
+  # long after the model recovered is cut and retried, not stopped.
+  def good_step
+    return @good_steps = 0 if @watch_done
+
+    @good_steps += 1
+    @thinking_loops = 0 if @good_steps == @thinking["forget_after"]
+  end
+
   def stop_thinking(ctx, found, what)
     return unless ctx.stop_turn("the model's thinking kept repeating itself (#{what})")
 
@@ -261,6 +316,7 @@ class Plugin
     @denials = 0
     @pending = nil
     @thinking_loops = 0
+    @good_steps = 0
     @watch = nil
   end