samagotchi 0.3.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 950fbee37d2110efad37f8d3f8981144f49af9a2ccf75649d5953b1fe7773260
-  data.tar.gz: aaad7adb0e9aa3c81b601df48fde4ebab965862ed954454c8b79e2de841f0789
+  metadata.gz: 94cd11abcfad07ad2843b4e0fc2eea368d77ab6080403d308db906270a1832c6
+  data.tar.gz: 21ac6e7093ee196d98e2ba50979cdbb28f1a3a10ab0e9cac9bad01c88a078daf
 SHA512:
-  metadata.gz: 1b4d092f263192c242dead3ae0c556758a38af2f01285dc590362d698696a31d38801c70e64ff85daa33067ceda92be7687915024d1e81802bd0a2c365cc292d
-  data.tar.gz: 7a06a4d47dea9168e40b0ae0ba7bc6cbfe1b377ba9ac29a998d19f0ee17a766de3186786894deea8b6765a78e21b14e3e7ece8238ab401354c43a5eba4d1815b
+  metadata.gz: fa39259864928d70d8cf830d0c7cc15c6865cea75d383484979897800a9f79d6f9fa4d79df3700285d9871e8d0cf5420e9af7c0143ab08e71182befa287b52af
+  data.tar.gz: 24f0fe6863767b628c1eec6957bf6cf33d8966b45f8b2cbdfd7ab268d6c323835dba8ff09fbdd9359775263693228a7a11f0d125cf0a38d7f044d6932ca7c4b9

data/CHANGELOG.md

@@ -8,6 +8,165 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-09-30
+
+### Security
+
+- `chi web` and the worker Bridge refuse requests from other websites. Before,
+  a page open in your browser could start a session that runs commands, or
+  read your sessions and their output. Please update if you run `chi web`.
+
+### Added
+
+- Skills: a memory named `skill_<name>` holds the steps of a task you did with
+  chi. Say "let's memorize this" and chi saves it; next time it reads and
+  follows it, and fixes a step that turned out different in the same turn
+  (docs/memory.md, Skills). The system bundle's identity and memory guide
+  teach it.
+- The `skills` bundle (`chi bundle install skills`): `/skill save [name]
+  [--system]`, `/skill list`, `/skill show`, `/skill diff`; older versions of
+  each skill kept (`history_keep`) with a one-line diff after every update;
+  a nudge when a followed skill's step fails and the model goes on without
+  fixing it (docs/plugins.md, The skills bundle).
+- `chi web --web-host lan` (`web.host: lan`, or one of this machine's IPv4
+  addresses): the web UI on your phone. chi web also listens on the LAN
+  address and prints a link with an access token and its QR code; every
+  request from another machine needs the token, which the page keeps in a
+  cookie. `chi web --new-token` replaces it; `chi self` says when chi web runs
+  on the LAN. Plain http: for a home network only. New runtime dependency:
+  `rqrcode_core`.
+- A third web view, `web.view: stage` (`--web-view stage`): the running turn
+  sits above the composer, its tool calls in an expandable cloud, and hands
+  off smoothly into the history when it ends. `web.view: turn | stage | chat`
+  replaces `web.turn_view` (turn stays the default).
+- The start page's model picker is searchable: models grouped by host, your
+  last 5 picks first, every typed word matched ("deepseek4.1 fla" finds
+  `openrouter · deepseek/deepseek-v4.1-flash`), arrow keys, Enter and Esc.
+
+### Changed
+
+- config.yml edits apply without restarting `chi web`: new sessions read the
+  file, and running ones pick up settings they read each time (retries,
+  limits, log level). Old flat `UPPER_CASE` keys and `backend:` are no longer
+  read; they warn as unknown keys.
+- The terminal REPL (`chi --no-shared`, `chi scratch`) shows turns the way
+  the attached terminal does, and all three UIs end a turn with the same
+  words ("✕ turn canceled (Ctrl-C) · 3.1s", "✕ turn failed: …"); a provider
+  retry shows as a dim line. The REPL-only settings `thinking.ui`,
+  `thinking.render_interval` and `status.width_mode` / `max_width` /
+  `fixed_width` are gone.
+- `session.keep_status` defaults to none: a session left "running" by a
+  crashed worker is cleaned up like any other; a session with a live worker
+  is never removed.
+- `chi send --image` to a model that can't take images is refused before
+  anything is sent, with the reason, instead of failing in the session.
+- A low/medium/high thinking level on a llama.cpp chat host whose template
+  ignores it says so once.
+- The web answers `/stats`, `/recap` and `/detach` itself (they're terminal
+  commands) instead of showing a worker error.
+- Piped input to an attached chi (`echo "do X" | chi`, `chi -p X` with no
+  terminal) waits for its turns to end and exits 1 if one failed, instead of
+  detaching at once.
+
+### Fixed
+
+- OpenRouter's "overloaded" error sent inside an HTTP 200 is retried like a
+  503 instead of failing the turn.
+- The context line the model sees during a long tool loop counts the tool
+  output added since the last request, so the model knows when to wrap up.
+- `chi send --wait` no longer hangs when the turn fails very fast (for
+  example right after an earlier failure); it says the turn failed and why.
+- On Linux the system prompt now gets the "prefer rg" hint when rg is
+  installed (the check only worked on macOS).
+- `chi sessions list --live` shows the test sessions of a test run.
+- `chi -p` with no terminal (stdin from a pipe or /dev/null) sends its prompt
+  once: a failed turn re-sent it in a loop (hundreds of requests a second),
+  and an attached `chi -p` didn't send it at all.
+
+Update with `chi update`. Bundle added: skills 0.1.0 (`chi bundle install
+skills`).
+
+## [0.4.0] - 2026-09-30
+
+### Added
+
+- `chi update`: brings an installed chi up to date in one command: the gem
+  from rubygems, then the system bundle, the shipped bundles you installed and
+  the desktop helper (rebuilt only when its sources changed), shown in one
+  table. Your edits to bundle files are kept and reported, running workers and
+  an old `chi web` are only reported, `--dry-run` shows the plan, and
+  `--no-gem` / `--no-bundles` / `--no-desktop` (or `update.*` in config.yml)
+  skip parts. The first start of a new chi version says in one line when
+  something can be updated.
+- A thinking level per model, host or run: `thinking: off | low | medium |
+  high | default` (`models.<key>.thinking`, `hosts.<name>.thinking`,
+  `thinking.level`, `--thinking LEVEL`). Chat hosts get the matching request
+  fields; native Qwen and Gemma turn thinking off. chi says once when a level
+  can't work on a host, and a host that refuses the thinking fields (gpt-oss
+  on OpenRouter) is asked again without them. `/model` and `chi self` show
+  the level.
+- Edit previews: an edit/write approval shows the diff it would make, in the
+  web card and in the terminal, and every edit/write row gets a
+  "diff +3 −1" that opens to the change (live, after a reload and on a join).
+- `chi send --image PATH` (repeatable, up to 20): images go with the message
+  as attachments, the same as the web composer's chips; converted and
+  downscaled once, then copied into each session. Works with `--new` (the
+  session starts idle, then gets the message with its images) and `--wait`.
+  A missing file or a non-image stops the send before anything goes out.
+- The desktop helper takes images: a clipboard screenshot, image files from
+  Finder's Send to chi, other apps' image data, or a drop on the panel; they
+  show as thumbnails and go with the message.
+- source-links 0.3.0: `#12` links to the current project's repo (from its git
+  remote) and `owner/repo#12` to that repo; `url:` templates take `{1}`,
+  `{name}`, `{repo}` and `{host}`, with `remote:` and `remote_host:` per
+  source, and the note lists each link once.
+- The web shows when the provider is asked again after an error ("↻ retrying
+  (503) in 3 s, 1/2") or a turn waits for a plugin's setup.
+
+### Changed
+
+- A model named with a host that isn't configured (`nosuch:org/model`, or a
+  provider's name like `openrouter:x`) is an error that names the host and
+  lists the configured ones, in the CLI, `chi send --new`, the web and
+  `/model`, instead of going to the default host.
+- The terminal no longer rewrites `#word` into a memory reference: "PR #1"
+  and "#ff0000" reach the model as typed (Tab still completes `#name`).
+- A question you dismiss reaches the model as dismissed, not as a tool
+  error, so it keeps asking when it should.
+- `/quit` works in the REPL like `/exit`, and the web answers it too;
+  `/stats` and `/recap` take trailing words in both terminals.
+- A delegated session gets reworded rules: the answer first, then evidence,
+  then what's unverified; follow-up messages arrive as new turns.
+
+### Fixed
+
+- A llama.cpp server started with `--api-key` works: the key in
+  `api_key_env` is sent on every request (it got 401). A 401/403 from any host
+  now says which variable to check or to set `api_key_env`.
+- A bundle upgrade that keeps your edited file no longer disables the
+  bundle's plugin, and the system bundle stops warning about the same edit on
+  every start.
+- One bundle with a broken manifest.json no longer stops the hooks of the
+  bundles after it from loading.
+- A long-running worker picks up edited guardrail rules.
+- `write` without content fails instead of emptying the file.
+- Per-model `vision:` follows a model alias, like `profile:` and `sampling:`.
+- A timeout of 0 in config means the default on llama.cpp hosts too (it was a
+  0-second timeout).
+- A reminder turn drops a pending continue offer, so a later "no" can't roll
+  the reminder back.
+- More than 8 options in `ask_user_question` is always an error (one path
+  silently used the first 8).
+- A memory read with a comma list counts each name in the REPL and the web.
+- `/archive` or `/quit` typed during a REPL turn no longer goes to the model
+  as text; `EXIT --DELETE` works in any case in an attached terminal.
+- `chi bundle status` finds index lines again (it said "no-index" for every
+  file).
+
+Update with `chi update` (new in this version: from 0.3.0, run
+`gem install samagotchi` once, then `chi update`). Bundle moved:
+source-links 0.3.0.
+
 ## [0.3.0] - 2026-09-29
 
 ### Added
@@ -153,6 +312,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.5.0...HEAD
+[0.5.0]: https://github.com/dm1try/samagotchi/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/dm1try/samagotchi/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/dm1try/samagotchi/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/dm1try/samagotchi/releases/tag/v0.2.0

data/README.md

@@ -1,7 +1,11 @@
 # samagotchi
 
-An agent harness that relies heavily on memory. Samagotchi is the engine; chi
-(pronounced "chee") is its short name and CLI command.
+chi is a local-first, human-in-the-loop agent harness. It remembers what you
+teach it, as memories and skills, and corrects them when a step turns out
+different. You stay in the loop from the terminal or the browser.
+
+Samagotchi is the engine; chi (pronounced "chee") is its short name and CLI
+command.
 
 > **Pre-1.0:** config and commands may change between minor versions (0.2 →
 > 0.3); the [CHANGELOG](CHANGELOG.md) says what changed. chi is used daily and
@@ -32,6 +36,22 @@ bin/chi self
 `bin/chi` runs the checkout; `bundle exec rake gem:install` installs it as a
 local gem, which puts `chi` on your PATH.
 
+### Updating
+
+```sh
+chi update --dry-run    # what would change
+chi update              # the gem, then the bundles and the desktop helper
+```
+
+`chi update` installs the newest samagotchi from rubygems.org (old versions
+stay installed: running sessions still use them), then brings the rest up to
+the new version: the system bundle, the bundles chi ships that you installed,
+and the macOS helper (rebuilt only when its sources changed). Memory files you
+edited are kept, and the table says which. Running sessions move to the new
+chi when their worker idles out (30 min) or on `chi sessions stop ID`; a
+running `chi web` needs a restart. From a checkout, `git pull` instead. See
+[CLI: Updating](docs/cli.md#updating).
+
 ## Set up
 
 Point chi at your model server; it works out the rest and writes
@@ -87,6 +107,7 @@ chi --no-shared                           # the plain in-process REPL
 chi -p "explain lib/" --non-interactive   # one turn, print the answer, exit
 chi --resume <session-id>                 # continue a saved session
 chi web --open                            # web UI: this project's sessions (--scope=all: every one)
+chi web --web-host lan                    # the web UI on your phone too: scan the QR code it prints
 chi sessions list                         # this project's saved sessions (--scope=all: every one)
 pbpaste | chi note --source slack <id>    # background context for a session (no turn)
 pbpaste | chi send -m "same bug?" <id>    # a message to a session, the clipboard quoted above it
@@ -97,6 +118,12 @@ chi send --new --wait -m "review feat/x"  # a new session you can watch in the w
 
 `/model` switches models, Ctrl-C cancels a turn, and Ctrl-D or `/detach` detaches (the session keeps running; `chi --attach ID` comes back). `/exit` detaches and stops the session's worker too, unless something still needs it (a running turn, another UI); `chi --resume ID` picks the conversation up again. `/exit --delete` also deletes the session once the worker has gone; `chi sessions delete ID` deletes one from the shell. `/archive` (or `chi sessions archive ID`) hides a session from every list and keeps it for good; `chi sessions list --archived` finds it again.
 
+`chi web --web-host lan` opens the web UI to your home network with an
+access token: anyone with the printed link (or its QR code) can run commands
+as you, and it is plain http, readable by anyone on the same Wi-Fi. Use it at
+home, never on a shared network, and `chi web --new-token` if a link leaks.
+See [chi web on your phone](docs/cli.md#chi-web-on-your-phone).
+
 ### Context notes
 
 `chi note` pushes text into one or more sessions as background, not as a

data/bin/chi

@@ -14,7 +14,7 @@ end
 require "optparse"
 require "samagotchi/config"
 
-Samagotchi::ConfigFile.load_global_env!
+Samagotchi::ConfigFile.load!
 require "samagotchi"
 
 # `chi self`: print version, source dir, config/memory/session paths, model and
@@ -50,7 +50,7 @@ if ARGV[0] == "sessions"
     puts "  delete [--force] ID...   # delete sessions for good (IDs or unique prefixes); --force stops a live worker first"
     puts "  prune [--dry-run] [--days N] [--keep N] [--keep-status running,...] [--test-only]"
     puts "  clean [--dry-run] [--days N]   # test sessions (SAMAGOTCHI_ENV=test, CI) and leftover chi scratch ones: all of them, or those older than N days"
-    puts "Defaults: days=14 keep=500 keep_status=running (env overrides: SAMAGOTCHI_SESSION_RETENTION_DAYS etc.)"
+    puts "Defaults: days=14 keep=500 keep_status=none (config: session.retention_days, session.max_count, session.keep_status)"
     exit 0
   end
   dry_run = sessions_args.include?("--dry-run")
@@ -110,10 +110,12 @@ if ARGV[0] == "sessions"
     project = scope == "all" || cwd ? nil : Samagotchi::ProjectScope.root_for(Dir.pwd)
     scope_note = ->(count) { "#{count} session(s) in #{File.basename(project)} (--scope=all: every project)" }
     # The picker (chi note from a script): filters apply before the limit,
-    # and test runs stay out.
+    # and test runs stay out, unless this is one (SAMAGOTCHI_ENV=test, CI):
+    # then its own sessions are what it looks for.
     if live || cwd || (format && format != "text")
       summaries = Samagotchi::SessionManager.session_summaries(
-        live: live, cwd: cwd, limit: limit || (live ? 10 : nil), include_tests: false, project_root: project,
+        live: live, cwd: cwd, limit: limit || (live ? 10 : nil), include_tests: Samagotchi::Session.test_session_env?,
+        project_root: project,
         include_archived: include_archived
       )
       case format
@@ -142,7 +144,7 @@ if ARGV[0] == "sessions"
           end
           # A delegated session points at its parent.
           child = summary[:parent_short_id] ? "  ↳ #{summary[:parent_short_id]}" : ""
-          flag = summary[:scratch] ? " [scratch]" : ""
+          flag = summary[:scratch] ? " [scratch]" : (summary[:test_run] ? " [test]" : "")
           flag += " [archived]" if summary[:archived]
           ctx = Samagotchi::SessionMetrics.context_label(summary[:ctx_pct])
           puts "#{summary[:id]}  #{state.ljust(8)}  #{ctx.ljust(8)}  #{summary[:updated_at]}  #{desc}#{flag}#{child}"
@@ -257,6 +259,12 @@ if ARGV[0] == "bootstrap"
   exit Samagotchi::BootstrapCommand.new(ARGV[1..] || []).run
 end
 
+# `chi update`: bring an installed chi up to date, before OptionParser (its own flags)
+if ARGV[0] == "update"
+  require "samagotchi/update_command"
+  exit Samagotchi::UpdateCommand.new(ARGV[1..] || []).run
+end
+
 # `chi desktop`: the native "Send to chi" helper, before OptionParser (its own flags)
 if ARGV[0] == "desktop"
   require "samagotchi/desktop_command"
@@ -372,7 +380,7 @@ if ARGV[0] == "bundle"
     lines << ""
     lines << "Your task: resolve each conflict by editing the file in place using the memory_write tool."
     lines << "Use memory_read to inspect current content if needed. The correct scope for memory_write is the bundle's scope."
-    lines << "When all conflicts are resolved, type /exit to finish. If you abort, the upgrade will not be applied."
+    lines << "When all conflicts are resolved, type /exit to finish. If you stop early, the files stay as they are (the rest of the upgrade is already applied)."
     lines.join("\n")
   end
 
@@ -529,7 +537,7 @@ if ARGV[0] == "bundle"
           ans = begin; $stdin.gets; rescue => _e; nil; end
           launch = ans && ans.strip.downcase.start_with?("y")
         else
-          puts "Non-interactive terminal — aborting. Re-run with --force to overwrite or --agent in a TTY."
+          puts "Non-interactive terminal: kept your edits in the file(s) above; the rest is upgraded. Re-run with --force to take the bundle's version, or --agent in a TTY to merge."
           exit 2
         end
         if launch
@@ -537,37 +545,15 @@ if ARGV[0] == "bundle"
           puts "Launching interactive session for conflict resolution… (/exit when done)"
           require "samagotchi/terminal_ui"
           Samagotchi::TerminalUI.new(prompt: prompt).run
-          # After session, re-check if conflicts resolved by re-reading current files vs incoming
-          # Simple heuristic: if user edited files, current != base now but we assume resolved if file exists
-          # Re-run upgrade without conflicts? User already edited in place, so we need to write provenance now
-          # Update provenance to reflect resolved state
-          if manifest
-            # Re-collect provenance files from target dir for this bundle
-            prov_files = {}
-            target_scope = scope || provenance.read[:scope]&.to_s || "system"
-            target_dir = Samagotchi::MemoryBundle::Installer.new(source: expanded_source, name: bundle_name, scope: target_scope).send(:resolve_target_dir, target_scope)
-            # Actually reuse provenance write with current target files for bundle keys
-            bundle_files = installer.conflicts.keys + installer.results.select { |_, r| %w[installed updated].include?(r[:status]) }.keys
-            # Fallback: collect all md that exist and were in installer results
-            all_keys = installer.results.keys
-            all_keys.each do |k|
-              p = File.join(target_dir, k)
-              prov_files[k] = p if File.exist?(p)
-            end
-            if prov_files.any?
-              Samagotchi::MemoryBundle::Provenance.new(name: bundle_name).write(
-                files: prov_files,
-                scope: target_scope,
-                version: manifest.version,
-                source_path: expanded_source
-              )
-              puts "Provenance updated after interactive resolution."
-            end
-          end
+          # The installer already recorded the upgrade (conflicted files
+          # kept their old base); the resolved files now start from the
+          # bundle's version.
+          Samagotchi::MemoryBundle::Provenance.new(name: bundle_name).resolve_conflicts(installer.conflicts)
+          puts "Provenance updated after interactive resolution."
           puts "Upgrade resolved interactively."
           exit 0
         else
-          puts "Upgrade aborted due to conflicts. Resolve manually or re-run with --force."
+          puts "Kept your edits in the file(s) above; the rest is upgraded. chi bundle diff #{bundle_name} FILE shows the base; re-run with --force to take the bundle's version."
           exit 2
         end
       end
@@ -637,6 +623,7 @@ if ARGV[0] == "bundle"
       puts "Target: #{st[:target_dir]}"
       st[:files].each do |k, info|
         mods = []
+        mods << "conflict (kept your edits over v#{st[:provenance][:version]}: chi bundle diff #{name} #{k})" if info[:conflict]
         mods << "modified" if info[:modified]
         mods << "missing" if info[:missing]
         mods << "no-index" unless info[:index_present]
@@ -806,6 +793,7 @@ if ARGV[0] == "bundle"
         line += "  (shipped v#{b.upgrade.version}: chi bundle upgrade #{b.upgrade.source})" if b.upgrade
         puts line
       end
+      puts "  (or all at once: chi update)" if installed.any?(&:upgrade)
     end
     unless available.empty?
       puts ""
@@ -913,15 +901,9 @@ scratch = ARGV[0] == "scratch"
 ARGV.shift if scratch
 
 # no_interrupt / no_default_input start from config.yml or the env; the flags below turn them on.
-options = { verbose: false, no_interrupt: Samagotchi::Config.get("no_interrupt"), non_interactive: false, no_default_input: Samagotchi::Config.get("no_default_input"), web: false, web_port: nil, web_open: false, web_markdown: nil, web_turn_view: nil }
+options = { verbose: false, no_interrupt: Samagotchi::Config.get("no_interrupt"), non_interactive: false, no_default_input: Samagotchi::Config.get("no_default_input"), web: false, web_port: nil, web_open: false, web_markdown: nil, web_view: nil }
 cli_overrides = {}
 
-if ARGV.any? { |arg| arg == "--backend" || arg.start_with?("--backend=") }
-  warn "Error: --backend was removed. A host's api: in config.yml picks the loop " \
-       "(api: openai for the chat API; see docs/configuration.md)."
-  exit 1
-end
-
 # Strict kebab enforcement: --recap_base_url is unknown (OptionParser would otherwise accept _ as -)
 ARGV.each do |arg|
   next unless arg.start_with?("--") && arg.include?("_")
@@ -930,7 +912,7 @@ ARGV.each do |arg|
   base = arg.split("=", 2).first
   # If dashed version is a known flag (registry or hardcoded), reject underscore variant
   dashed = base.tr("_", "-")
-  known = %w[--prompt --resume --attach --shared --no-shared --model --memory --mute --no-interrupt --non-interactive --verbose --no-default-input --port --open] + Samagotchi::Config.cli_entries.map(&:cli_flag)
+  known = %w[--prompt --resume --attach --shared --no-shared --model --thinking --memory --mute --no-interrupt --non-interactive --verbose --no-default-input --port --open --new-token] + Samagotchi::Config.cli_entries.map(&:cli_flag)
   if known.include?(dashed) || known.include?(base)
     warn "Unknown option: #{arg} (did you mean #{dashed}?)"
     exit 1
@@ -949,6 +931,7 @@ parser = OptionParser.new do |opts|
            chi bundle <install|upgrade|uninstall|status|diff|list|build>
            chi desktop <install|upgrade|uninstall|status>   macOS "Send to chi" helper
            chi self                         version, paths, model and bundles
+           chi update [--dry-run]           update this chi, its bundles and the desktop helper
     (each subcommand takes --help)
 
   BANNER
@@ -959,6 +942,8 @@ parser = OptionParser.new do |opts|
   opts.on("--model NAME", "Model selector (runtime only, overrides --resume) [alias for --default-model]") { |m| options[:model] = m; cli_overrides["default.model"] = m }
   opts.on("--profile NAME", Samagotchi::ModelProfile::NAMES,
           "Prompt profile for every model in this run (#{Samagotchi::ModelProfile::NAMES.join('|')}) [alias for --model-profile]") { |p| cli_overrides["model.profile"] = p }
+  opts.on("--thinking LEVEL", Samagotchi::Thinking::LEVELS.map(&:to_s), "How much the model thinks this run: off|low|medium|high|default (outranks config.yml; " \
+                              "sessions already running keep theirs) [env SAMAGOTCHI_THINKING_LEVEL]") { |l| cli_overrides["thinking.level"] = l }
   opts.on("--memory NAME", "Preload a memory entry into the system prompt (repeatable; a comma list too)") { |m| (options[:memories] ||= []) << m }
   opts.on("--mute NAME", "Hide a memory from this session: not in the prompt, refused by memory_read (repeatable; a comma list too)") { |m| (options[:muted] ||= []) << m }
   opts.on("--no-interrupt", "Raise the tool call limit to 1000 iterations (useful for long tasks)") { options[:no_interrupt] = true; cli_overrides["no_interrupt"] = true }
@@ -967,12 +952,12 @@ parser = OptionParser.new do |opts|
   opts.on("--no-default-input", "Skip default REPL input prefill") { options[:no_default_input] = true; cli_overrides["no_default_input"] = true }
   opts.on("--port PORT", "Port for `chi web` (default: 4567, env SAMAGOTCHI_WEB_PORT)") { |p| options[:web_port] = p.to_i; cli_overrides["web.port"] = p.to_s }
   opts.on("--open", "Open browser for `chi web`") { options[:web_open] = true }
+  opts.on("--new-token", "`chi web`: replace the LAN access token (web.host: lan); links and QR codes made with the old one stop working") { options[:new_token] = true }
   opts.on("--scope VALUE", %w[project all],
           "Which sessions `chi web` and `chi sessions list` show: project (the default: this folder's git project; " \
           "every session outside a repo) or all") { |v| options[:scope] = v }
   # Accepted values of string entries that the registry doesn't type as enums.
-  value_hints = { "thinking.ui" => "spinner|off", "status.line" => "on|off", "status.width_mode" => "terminal_cap|fixed",
-                  "web.host" => "127.0.0.1|::1|localhost", "recap.sentences" => "N|N-M",
+  value_hints = { "status.line" => "on|off", "web.host" => "127.0.0.1|::1|localhost|lan|IP", "recap.sentences" => "N|N-M",
                   "web.annotate_presets" => "text|text" }
   # Universal config flags (implicit convention: ENV SAMAGOTCHI_* ↔ YAML dotted ↔ CLI --kebab)
   # Generated from Samagotchi::Config registry — Option A: snake leaf in YAML, kebab in CLI.
@@ -980,7 +965,7 @@ parser = OptionParser.new do |opts|
     next if %w[no_interrupt no_default_input].include?(entry.key)
     next if entry.key == "web.port" # already handled as --port
     next if entry.key == "default.model" # alias --model above
-    next if %w[web.markdown web.turn_view].include?(entry.key) # handled below with explicit inverse flags
+    next if entry.key == "web.markdown" # handled below with explicit inverse flags
     case entry.type
     when :bool
       # --[no-]: a bool that defaults to on is only useful switched off.
@@ -1000,8 +985,6 @@ parser = OptionParser.new do |opts|
   end
   opts.on("--web-markdown", "Render finalized LLM Markdown in `chi web` (requires optional commonmarker gem)") { options[:web_markdown] = true; cli_overrides["web.markdown"] = true }
   opts.on("--no-web-markdown", "Disable Markdown rendering in `chi web`") { options[:web_markdown] = false; cli_overrides["web.markdown"] = false }
-  opts.on("--web-turn-view", "Show each turn in `chi web` as one block of steps (the live one at the bottom; the default); ?view=turn|chat overrides per page") { options[:web_turn_view] = true; cli_overrides["web.turn_view"] = true }
-  opts.on("--no-web-turn-view", "Show turns in `chi web` as the classic row of bubbles instead of the turn view") { options[:web_turn_view] = false; cli_overrides["web.turn_view"] = false }
   # Strict underscore rejection: --recap_base_url etc. are not registered and will raise OptionParser::InvalidOption
   opts.on("--version", "Print chi's version") { puts "chi #{Samagotchi::VERSION}"; exit }
   opts.on("-h", "--help", "Show help") { puts opts; exit }
@@ -1022,6 +1005,10 @@ if stray
   warn "Error: #{web || scratch ? "unexpected argument" : "unknown command"} #{stray} (see chi --help)"
   exit 1
 end
+if options[:new_token] && !web
+  warn "Error: --new-token goes with chi web (chi web --new-token)"
+  exit 1
+end
 
 # A scratch session is new, runs here and goes when it ends.
 if scratch
@@ -1032,16 +1019,9 @@ if scratch
   end
 end
 
-# Apply CLI precedence: CLI > ENV > file
-unless cli_overrides.empty?
-  Samagotchi::Config.reload!(cli_overrides: cli_overrides)
-  # Keep ENV in sync for legacy readers still using ENV directly
-  cli_overrides.each do |k, v|
-    entry = Samagotchi::Config.find_by_key(k)
-    next unless entry&.env_exposed?
-    ENV[entry.env_key] = v.to_s
-  end
-end
+# Apply CLI precedence: CLI > ENV > file. Workers this chi spawns get
+# these through their env (Config.cli_env).
+Samagotchi::Config.reload!(cli_overrides: cli_overrides) unless cli_overrides.empty?
 
 # The debug log (Samagotchi::LogPath, level log.level) for every command.
 # -v (the plain REPL only): debug records, each mirrored to stderr.
@@ -1064,27 +1044,35 @@ when "web"
       options[:web_markdown] = true
     elsif arg == "--no-web-markdown"
       options[:web_markdown] = false
-    elsif arg == "--web-turn-view"
-      options[:web_turn_view] = true
-    elsif arg == "--no-web-turn-view"
-      options[:web_turn_view] = false
+    elsif arg == "--web-view" && Samagotchi::Config::BY_KEY["web.view"].enum_values.include?(web_args[i + 1])
+      options[:web_view] = web_args[i + 1]
+    elsif arg.start_with?("--web-view=") && Samagotchi::Config::BY_KEY["web.view"].enum_values.include?(arg.split("=", 2).last)
+      options[:web_view] = arg.split("=", 2).last
     elsif arg.start_with?("--port=")
       options[:web_port] = arg.split("=", 2).last.to_i
     end
   end
 end
 
+# The first interactive start of a new installed chi says what `chi update` would update.
+chi_update_hint = lambda do
+  require "samagotchi/installed_gem"
+  require "samagotchi/update_hint"
+  if Samagotchi::UpdateHint.wanted?(prompt: options[:prompt], non_interactive: options[:non_interactive],
+                                    tty: $stdin.tty? && $stdout.tty?, installed: Samagotchi::InstalledGem.spec)
+    Samagotchi::UpdateHint.show
+  end
+end
+
 if options[:web]
+  chi_update_hint.call
   require "samagotchi/web/server"
-  port = options[:web_port] || Samagotchi::Config.get("web.port") || 4567
-  # legacy env fallback
-  port = ENV.fetch("SAMAGOTCHI_WEB_PORT", port.to_s).to_i rescue port.to_i
+  port = options[:web_port] || Samagotchi::Config.get("web.port")
   markdown = options[:web_markdown]
   markdown = Samagotchi::Config.get("web.markdown") if markdown.nil?
-  turn_view = options[:web_turn_view]
-  turn_view = Samagotchi::Config.get("web.turn_view") if turn_view.nil?
+  view = options[:web_view] || Samagotchi::Config.get("web.view")
   exit Samagotchi::Web::Server.launch(port: port, scope: options[:scope] || "project", open_browser: options[:web_open],
-                                      markdown: markdown, turn_view: turn_view,
+                                      markdown: markdown, view: view, new_token: options[:new_token],
                                       annotate_presets: Samagotchi::Config.get("web.annotate_presets"))
 end
 
@@ -1143,6 +1131,7 @@ if options[:memories] || options[:muted]
   end
 end
 
+chi_update_hint.call
 require "samagotchi/launch_mode"
 launch, launch_note = if scratch
                         [:repl, nil]
@@ -1182,7 +1171,7 @@ if launch == :attached
 end
 
 begin
-  Samagotchi::TerminalUI.new(
+  ended = Samagotchi::TerminalUI.new(
     prompt: options[:prompt],
     session_id: options[:resume],
     no_interrupt: options[:no_interrupt] || options[:non_interactive],
@@ -1193,6 +1182,8 @@ begin
     model_name: options[:model],
     scratch: scratch
   ).run
+  # `chi -p X </dev/null`: the turn failed (nothing was sent again).
+  exit 1 if ended == :turn_failed
 rescue Samagotchi::TerminalUI::SessionBusy, Samagotchi::TerminalUI::SessionNotFound, Samagotchi::ModelProfile::MissingModel => e
   warn "Error: #{e.message}"
   exit 1