samagotchi 0.35.0 → 0.37.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b598dac8dadadd4dd37861ed690d09d09926520c2295bc998def4d75c3716ea7
-  data.tar.gz: 9d30ebb820024929bbb2dc1267011af7eb5710b33a4ba9625489a74d111edfbd
+  metadata.gz: 15887ec5fe31be3f32d3e1bfa15b9cf5ca73b03e2101f6416eb2cfad4c2f477a
+  data.tar.gz: 2226f5343806c3171babc66d075fc57498af03d313f180458e4f6ee1801c7384
 SHA512:
-  metadata.gz: 2f40ed32d227d1017bc7abcba8ef40f5e38f2f7dd7876aa5f78a9290e5443489b8109183655a151a1345fef1fa3f3f49e5deafbac38059cdba3bec70b0585d71
-  data.tar.gz: 55aca343a9dc45e78791863286768c356e815dc1b9783993f2c4477edb991883a3c88ae208dd642137cab4c6ead58fc1d49228f201fefcd6878dd421c719af70
+  metadata.gz: 8986ea963bda07138d6874b9024a031c5c6c000d03bad8281c9c24f57a079234fab5de68efe08305dd38ea4f138bf7ef7b02637e310e69f061182bb17d01d8a3
+  data.tar.gz: d9e07e7a5bacd114b8916a538fa2265bbd5b43ed78373fc306766455788b75ef5c1b0eb21d054288887483c93385063293150339abf4e3d02284bc1320cd9509

data/CHANGELOG.md

@@ -8,6 +8,60 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.37.0] - 2026-10-07
+
+### Added
+
+- For plugin authors: a tool's `targets:` may return `acts_as:` (the tool a call stands for, like an MCP tool behind
+  a dispatcher), `args:` (the arguments it acts with) and `label:` (the name the approval question shows). A guardrail
+  rule's `tool:` then matches either name, and "allow this call" is keyed by both names and those arguments. It can't
+  name one of chi's own tools or another bundle's (dropped and logged). See [docs/plugins.md](docs/plugins.md#guardrails).
+- `chi broadcast` asks a small triage model about the sessions no tag matched, instead of skipping them: it reads the
+  note and each session's scope card and answers yes or no ("model: yes (p 0.91)" when the host gives logprobs,
+  graded by `broadcast.threshold`). The model is `broadcast.triage_model` (with `triage_host_ref` or
+  `triage_base_url`), else the recap's, else `default.model`; a ~9B instruct model or larger works well. Up to
+  `broadcast.triage_parallel` (4) requests run at once, all within `broadcast.triage_deadline` (20 s): a session not
+  judged by then, or whose request failed, gets the note anyway, and the summary line counts it ("1 unchecked: triage
+  deadline"). A first line naming one project ("shopfront/checkout") keeps the note to that project's sessions.
+  `--dry-run` runs triage too. See [docs/broadcast.md](docs/broadcast.md#triage).
+- `chi broadcast` prints the broadcast's id and logs each recipient's verdict (`~/.local/state/samagotchi/broadcast/log.jsonl`,
+  rotated at 2 MiB). `chi broadcast log [--last N] [--format json]` shows the last broadcasts and who got them, and
+  `chi broadcast deliver BROADCAST_ID ID...` gives one to sessions it skipped, after all. See
+  [docs/broadcast.md](docs/broadcast.md#the-triage-log).
+
+Update with `chi update` (mcp 0.5.1).
+
+## [0.36.0] - 2026-10-07
+
+### Added
+
+- `memory_write` with `name`, `scope` and `description` but no `content` changes only that memory's index line and
+  leaves its file as it is (see [docs/memory.md](docs/memory.md)).
+- `memory_write` with `name`, `scope` and `remove: true` removes a memory: its file (and model overlays) move to the
+  bundle trash, which `chi bundle trash` lists and empties, and its index line goes; a line left after the file was
+  deleted by hand goes too. A memory a bundle installed is refused (`chi bundle uninstall` owns it).
+- The coordinator bundle (0.2.0) keeps a project memory `handoff_<epic>` with what git and the session list can't
+  rebuild (the split, your decisions, its verdicts, follow-ups), its status in the index description, and resumes
+  from it in a new session after checking git and the session list; `/coordinate resume` picks up an open handoff.
+  When the work is done it marks the handoff DONE and asks whether to remove it. See
+  [docs/plugins.md](docs/plugins.md#the-coordinator-bundle).
+- The guardrails bundle (0.8.0) asks before every memory removal (`memory-remove`, once at a time). Guardrail rules
+  take `memory: remove`.
+- In the web, a file reference in an answer (`lib/foo.rb:28`, `lib/foo.rb:28-34`, in inline code too) links to that
+  line of the pull request the session reviews: the PR attached to it or named in your messages (a delegate child's
+  task too). Inside a changed hunk it opens the PR's Files changed view at the line, highlighted; elsewhere the file
+  at the PR's head. Display only; `bundles: github-pr: line_links: false` turns it off (github-pr 0.2.0; run
+  `chi update`). See [docs/context.md](docs/context.md#line-links).
+- `/mcp` shows roughly how many tokens each MCP server's tool definitions take in every request, and the total
+  (mcp 0.5.0; run `chi update`). See [docs/plugins.md](docs/plugins.md#the-mcp-bundle).
+
+### Fixed
+
+- `memory_write` with a blank `description` keeps the stored one instead of wiping it; a multi-line description is
+  written on one line (it left orphan lines in `index.md`), and one longer than 200 characters is refused.
+
+Update with `chi update` (coordinator 0.2.0 and guardrails 0.8.0, which need chi 0.36.0; github-pr 0.2.0, mcp 0.5.0).
+
 ## [0.35.0] - 2026-10-06
 
 ### Added
@@ -1751,7 +1805,9 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.35.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.37.0...HEAD
+[0.37.0]: https://github.com/dm1try/samagotchi/compare/v0.36.0...v0.37.0
+[0.36.0]: https://github.com/dm1try/samagotchi/compare/v0.35.0...v0.36.0
 [0.35.0]: https://github.com/dm1try/samagotchi/compare/v0.34.0...v0.35.0
 [0.34.0]: https://github.com/dm1try/samagotchi/compare/v0.33.0...v0.34.0
 [0.33.0]: https://github.com/dm1try/samagotchi/compare/v0.32.0...v0.33.0

data/README.md

@@ -120,7 +120,7 @@ chi web --open                            # web UI: this project's sessions (--s
 chi web --web-host lan                    # the web UI on your phone too: scan the QR code it prints
 chi sessions list                         # this project's saved sessions (--scope=all: every one)
 pbpaste | chi note --source slack <id>    # background context for a session (no turn)
-chi broadcast -m "payments API is down"   # the same for every session it concerns (a shared ticket, PR or link)
+chi broadcast -m "payments API is down"   # the same for every session it concerns (a shared tag, or a triage model says so)
 chi context add <PR URL> <id>             # attached context: chi keeps it fresh, the agent hears when it changes
 pbpaste | chi send -m "same bug?" <id>    # a message to a session, the clipboard quoted above it
 chi send --new --wait -m "review feat/x"  # a new session you can watch in the web; prints the answer
@@ -203,7 +203,7 @@ once, for the session, for the repo, or for the whole rule in the repo.
 - [Memory](docs/memory.md): scopes and model-specific overlays
 - [Sessions](docs/sessions.md): storage, retention, `chi sessions`
 - [Attached context](docs/context.md): `chi context`, sources, scopes, waking, the github-pr bundle, safety
-- [Broadcast](docs/broadcast.md): `chi broadcast`, who a note reaches, tags, what a session gets
+- [Broadcast](docs/broadcast.md): `chi broadcast`, who a note reaches, tags, triage, what a session gets, the triage log
 - [chi as a sub-agent](docs/sub-agent.md): `chi send --wait --format json`, `chi answer`, instructions for a parent agent
 - [Desktop helper](docs/desktop.md): `chi desktop`, the macOS "Send to chi" Service and hotkey
 - [Guardrails](docs/guardrails.md): allow / ask / deny for tool calls, rules, approvals

data/bin/chi

@@ -97,7 +97,7 @@ parser = OptionParser.new do |opts|
            chi web [--port PORT] [--open] [--scope=all]   the web UI
            chi sessions <list|stop|archive|unarchive|delete|prune|clean>
            chi note [--source NAME] [-m TEXT] ID...|--all   background context for sessions
-           chi broadcast [-m TEXT] [--all] [--dry-run]   a note for every session it may concern
+           chi broadcast [-m TEXT] [--all] [--dry-run] | log | deliver   a note for every session it may concern
            chi context <add|push|ls|show|refresh|rm|mute|unmute>   live external text attached to sessions
            chi send [-m TEXT] ID...|--new   a message into sessions, as if typed there
            chi answer ID --question QID --option N   answer a question a session waits on

data/docs/broadcast.md

@@ -12,6 +12,8 @@ chi broadcast -m "payments API returns 500 since 14:00 (PAY-123)"
 pbpaste | chi broadcast              # the note from stdin
 chi broadcast --dry-run -m "…"       # who would get it and why; nothing is delivered
 chi broadcast --all -m "deploy freeze until 18:00"   # every recipient, tag or not
+chi broadcast log                    # the last broadcasts and who got them
+chi broadcast deliver b-7f3a1c9e c0ffee12   # one it skipped, after all
 ```
 
 To tell one session or a few you picked, use `chi note ID...` instead.
@@ -47,30 +49,69 @@ so `acme/shop#42` doesn't match `acme/other#42`; `PR #42` with no repo matches
 pull request 42 of any repo. Words the default ticket pattern would take that
 are no ticket (`UTF-8`, `SHA-256`, `ISO-8601`, `GPT-4`, …) are left out.
 
-A session that shares no tag is skipped for now, listed as "no tag match (not
-checked: no triage yet)": a small triage model that reads the note and each
-session's scope card is the next step. Until then, `--all` reaches them all.
+A session that shares no tag goes to triage.
+
+## Triage
+
+A small model reads the note and each other recipient's scope card (below)
+and answers yes or no: would the agent working there want to know? A yes
+delivers the note, a no skips the session ("model: no"). `--all` skips tags
+and triage and reaches every recipient.
+
+- **The model:** `broadcast.triage_model` (with `broadcast.triage_host_ref` or
+  `broadcast.triage_base_url`, as the `recap.*` settings take them); with none
+  of them set, the [recap's](sessions.md) model, else `default.model`. A ~9B
+  dense instruct model or larger works well (qwen3.5-9b missed no session in
+  our tests and sent about one extra note per broadcast of 20 sessions);
+  4B-class models say yes to nearly everything. A local model keeps the
+  cards (your prompts, recaps) on your machine; a remote triage host is your
+  explicit choice. Thinking is off, and each answer is a word.
+- **A score, when the host gives one:** with logprobs (OpenAI, OpenRouter
+  for some models), the verdict is P(yes) of the answer's first token, shown as
+  "model: yes (p 0.83)", and a session needs `broadcast.threshold` (0.5). A
+  higher threshold drops real "this blocks you" notes first. A host that
+  refuses logprobs (llama.cpp's, some gateways) is asked again without them:
+  the plain answer counts as 1 or 0.
+- **A scope line:** when the note's first line names exactly one of the
+  recipients' projects as a word (`shopfront/checkout`, `infra / ci`), the
+  other projects' sessions, and sessions outside any project, are skipped:
+  "scope line names shopfront". Anything fuzzier ("for payments folks") is the
+  model's job; it sees the line too. A one-line note counts as its own first
+  line: with a project named after a common word (`web`, `docs`), "the web
+  composer docs moved" names it and keeps the note there.
+- **Fail open:** at most `broadcast.triage_parallel` (4) requests run at a
+  time, all within `broadcast.triage_deadline` (20 s; a local server's first
+  request after a pause can take 10 s). A session not judged by then, one
+  whose request failed, or one the model answered with neither yes nor no
+  gets the note anyway, "unchecked: triage deadline", and the summary line
+  counts them: a missed session is worse than an extra note. Without a
+  triage model to ask (settings that don't resolve) every such session gets
+  it unchecked, and chi says why.
 
 ## What it prints
 
 One line per recipient, the ones that got it first, then a summary:
 
 ```
-broadcast  "payments API returns 500 since 14:00 (PAY-123)"
+broadcast b-7f3a1c9e  "payments API returns 500 since 14:00 (PAY-123)"
 3f2a1c9e  delivered  ticket PAY-123 matches (branch)
 91ab02c4  delivered  link notion.so/team/checkout-v2 matches (messages); waits for its next start
-c0ffee12  skipped    no tag match (not checked: no triage yet)
+5e1f0a77  delivered  model: yes (p 0.91)
+77aa0b3c  delivered  unchecked: triage deadline
+c0ffee12  skipped    model: no
 d00dad00  skipped    open in a chi REPL
-delivered 2 · skipped 2
+delivered 4 · skipped 2 · 1 unchecked: triage deadline
 ```
 
-A session a worker runs adds the note within a few seconds (after a running
+The first line names the broadcast (`b-7f3a1c9e`): `chi broadcast log` and
+`chi broadcast deliver` take it. A session a worker runs adds the note within a few seconds (after a running
 turn); one with no worker gets it at its next start ("waits for its next
 start"). Nothing starts a turn anywhere.
 
 `--dry-run` prints the note's tags, each recipient's verdict ("would get it" or
-"skipped") and its scope card: what chi knows about it from local state, and
-what a triage model will read.
+"skipped"; triage runs) and its scope card: what chi knows about it from local
+state, and what the triage model reads. A line before them names the triage model
+and the setting it came from.
 
 ```
 3f2a1c9e  would get it  ticket PAY-123 matches (branch)
@@ -83,7 +124,8 @@ what a triage model will read.
 ```
 
 Exit status: 0 when it ran (skipped sessions included), 1 when it was refused,
-no session is active or a delivery failed, 2 for a usage error.
+no session is active or a delivery failed, 2 for a usage error. `chi broadcast
+deliver` exits 0 when every session named has the note now, 1 otherwise.
 
 ## What a session gets
 
@@ -96,7 +138,8 @@ payments API returns 500 since 14:00 (PAY-123)
 [END NOTE]
 ```
 
-With `--all` the line says "with every active session". The date is there
+With `--all` the line says "with every active session"; one that triage
+delivered says "with the sessions it may concern." and no reason. The date is there
 because a session with no worker may read it days later. The system prompt
 tells the model what a note from `broadcast` is: if it affects its current
 work, it says so briefly in its next answer, otherwise it ignores it, and it
@@ -107,9 +150,37 @@ plain note can't pass for a broadcast.
 The note and its line together are capped at 16 KiB like any note; the text
 may take up to 15872 bytes.
 
+## The triage log
+
+Each broadcast (not a `--dry-run`) leaves one line in
+`$XDG_STATE_HOME/samagotchi/broadcast/log.jsonl` (`~/.local/state/…`): its
+id, time, your text, the note's tags and each recipient's verdict (result,
+reason, P(yes), who decided, the session's tags). Scope cards are not kept:
+they quote your prompts. Past 2 MiB the file becomes `log.jsonl.1`, one old
+file kept. Sessions don't read it: a broadcast stays fire-and-forget.
+
+```sh
+chi broadcast log                  # the last 5 broadcasts
+chi broadcast log --last 20 --format json
+```
+
+```
+b-7f3a1c9e  2026-10-06 14:20  "payments API returns 500 since 14:00 (PAY-123)"
+  3f2a1c9e  delivered  ticket PAY-123 matches (branch)
+  c0ffee12  skipped    model: no
+  delivered 1 · skipped 1
+  2026-10-06 14:31 delivered anyway: c0ffee12
+```
+
+When triage skipped a session that needed the note, `chi broadcast deliver
+BROADCAST_ID ID...` (an id or the start of one, for both) gives it the logged
+text, dated when it was shared and saying you passed it on. A session that
+got it already is left alone. The log keeps it as a correction: labels for
+tuning `broadcast.threshold`, or for a classifier later.
+
 ## For you, not for an agent
 
-`chi broadcast` refuses to run inside a chi session (where
+`chi broadcast` (`log` and `deliver` too) refuses to run inside a chi session (where
 `SAMAGOTCHI_PARENT_SESSION` is set): "chi broadcast is for your user, not an
 agent". With the guardrails bundle, the `chi-broadcast` rule also asks before
 any shell command that runs it, once at a time, and only you may allow it
@@ -121,9 +192,17 @@ any shell command that runs it, once at a time, and only you may allow it
 |---|---|---|
 | `broadcast.active_hours` | `8` | A session with no worker or REPL counts when its last turn ended within this many hours. |
 | `broadcast.ticket_pattern` | `\b[A-Z][A-Z0-9]+-\d+\b` | A Ruby regex for ticket ids; an invalid one warns and the default is used. |
+| `broadcast.triage_model` | recap's, else `default.model` | The triage model, a model ref (`box:qwen3.5-9b`). |
+| `broadcast.triage_host_ref` | none | A `hosts:` name for it. |
+| `broadcast.triage_base_url` | none | An OpenAI API base for it instead. |
+| `broadcast.triage_parallel` | `4` | Triage requests at a time. |
+| `broadcast.triage_deadline` | `20` | Seconds triage may take in all; the rest get the note unchecked. |
+| `broadcast.threshold` | `0.5` | The P(yes) a session needs when the host gives logprobs. |
 
 ```yaml
 broadcast:
   active_hours: 12
   ticket_pattern: '\b(?:PAY|OPS)-\d+\b'
+  triage_model: box:qwen3.5-9b
+  triage_deadline: 30
 ```

data/docs/configuration.md

@@ -742,7 +742,8 @@ One record is one line, plus indented payload lines at debug level:
   control characters (terminal colours in tool output) are escaped.
 - Tags: `turn` (a session's event trail), `http` (model requests),
   `worker`, `bridge`, `web`, `attached`, `repl`, `idle`, `recap`, `hooks`,
-  `plugins`, `guardrails`, `config`, `memory`, `model` (debug dumps), `context` (attached context fetches).
+  `plugins`, `guardrails`, `config`, `memory`, `model` (debug dumps), `context` (attached context fetches),
+  `broadcast` (chi broadcast's triage).
 - The format is parsed by `Samagotchi::LogLine` (`parse`, `each_record`);
   keep tools that read it on that parser.
 
@@ -884,6 +885,12 @@ described in their own sections.
 | `recap.sentences` | `2-4` | yes | Recap length, `N` or `N-M` (1–10). |
 | `broadcast.active_hours` | `8` | | `chi broadcast` reaches a session a worker or a chi REPL runs, or whose last turn ended within this many hours. See [Broadcast](broadcast.md). |
 | `broadcast.ticket_pattern` | `\b[A-Z][A-Z0-9]+-\d+\b` | | A Ruby regex for ticket ids; one in the note and in a session's branch (any case) or prompts delivers the broadcast there. See [Broadcast](broadcast.md). |
+| `broadcast.triage_model` | recap's | | The model that judges a recipient no tag matched (a model ref, as `recap.model`); unset: the recap's model, else `default.model`. A ~9B dense instruct model or larger; 4B-class ones say yes to nearly everything. See [Broadcast](broadcast.md#triage). |
+| `broadcast.triage_host_ref` | none | | A `hosts:` name for the triage model. |
+| `broadcast.triage_base_url` | none | | An OpenAI API base for the triage model instead (`http://h:8081/v1`). |
+| `broadcast.triage_parallel` | `4` | | Triage requests at a time. |
+| `broadcast.triage_deadline` | `20` | | Seconds triage may take in all; a recipient not judged by then gets the note unchecked. |
+| `broadcast.threshold` | `0.5` | | The P(yes) a recipient needs, when the triage host gives logprobs; a plain yes or no is 1 or 0. |
 | `session.shared` | `true` | | Plain `chi` runs its session in a worker and attaches; `--no-shared` per run. |
 | `session.idle_exit_minutes` | `30` | yes | An unused worker exits after this; `0` = never. |
 | `session.keep_empty` | `false` | | Keep sessions nothing happened in. |

data/docs/context.md

@@ -184,6 +184,43 @@ It needs [`gh`](https://cli.github.com), logged in (`gh auth login`).
 - It wakes for a review requesting changes, checks turning red, and the PR
   merged or closed. Comments alone never wake.
 
+### Line links
+
+In the web, a file reference in an answer links to that line of the pull
+request the session reviews: `lib/foo.rb:28` and `lib/foo.rb:28-34`, also in
+inline code (`` `lib/foo.rb:28` ``). The model writes plain references; the
+links are display only (the model's text stays as it was), and terminals
+show the answer as it is.
+
+- **Which PR**: the session's attached PRs (the branch's, `chi context add
+  <PR URL>`, "+ URL") and the PR URLs in your messages, newest first (a
+  delegate child's task counts: a parent that names the PR there gets links
+  in the child's answers). PR URLs in tool output or answers don't count.
+- **Which file**: a file the PR changes, by its path, a renamed file's old
+  path, a bare name only one PR file has (`source_links.rb:28`), or an
+  absolute path into a checkout (a child's worktree). Any other file isn't
+  linked, nor is a path several of the session's PRs change.
+- **Where to**: the line in the PR's **Files changed**, highlighted, when it
+  is inside a changed hunk (a removed file: on its old side); else the file
+  at the PR's head commit (a removed one: at its base), which has every
+  line.
+- Code blocks, markdown links and URLs are left alone.
+- The PR's files are read with `gh api` in the background when a turn
+  starts (and when a PR is attached while it runs), at most once a minute,
+  and read again only when the PR's head moved; the answer is linked from
+  what was read.
+  So the first answer of a very short turn may come without links, and
+  after a push links may be a few lines off until the next read. Without
+  `gh` or its login, nothing is linked.
+
+Turn it off:
+
+```yaml
+bundles:
+  github-pr:
+    line_links: false
+```
+
 ## Safety
 
 A command source runs **outside the guardrails gate**, every few minutes,

data/docs/guardrails.md

@@ -244,7 +244,12 @@ guardrails:
       scopes: [once, session, rule]
 ```
 
-A rule gives at least one of `tool`, `command`, `path`, `git`, `touches` and `rm`.
+A rule gives at least one of `tool`, `command`, `path`, `git`, `touches`, `rm` and `memory`.
+
+`memory: remove` matches a `memory_write` with `remove: true` (it moves a
+memory into the bundle trash). Nothing else asks about it: a memory's file is
+never outside the repo (below), so without such a rule any session, a delegate
+child included, removes a memory unasked.
 
 `rm: outside_tmp` (shell tools) matches a command whose `rm -r -f` reaches
 outside the tmp folders (`$TMPDIR`, `/tmp`, `/var/tmp`): every such `rm` in a
@@ -287,6 +292,21 @@ A plugin tool whose `targets:` name no command or path (an MCP tool) is asked
 about with its arguments (`mcp_x_sum: a=20 b=22`), and an approval of "this
 call" is keyed by them.
 
+A plugin tool that runs other tools for the model (a dispatcher such as
+`mcp_call`) can say, in its `targets:`, which tool a call acts as (`acts_as:`)
+and with which arguments (`args:`). A rule's `tool:` then matches the call's
+own name **or** the tool it acts as: `tool: mcp_github_*` fires for an
+`mcp_call` that acts as `mcp_github_merge_pull_request`, and `tool: mcp_call`
+fires whatever it acts as. The question names the tool it acts as (by the
+`label:` its `targets:` gives, if any: display only) and shows its arguments, and an approval of "this call" is keyed by the real name, the
+alias and those arguments (`/guardrails` lists it as
+`mcp_call>mcp_github_merge_pull_request:number=7 …`), so it never covers a
+direct call of that tool, nor a direct call's approval it. A tool can't act as
+one of chi's own tools or another bundle's tool: that `acts_as:` is dropped
+(and logged as `plugin_acts_as_dropped`), and the call is matched by its own
+name only. Hooks and loop-guard's `ignore_tools` still see the call's own
+name.
+
 ```yaml
     - id: mcp-ask
       tool: "mcp_*"          # every MCP tool (the mcp bundle's mcp_<server>_<tool>)
@@ -408,7 +428,7 @@ rules (`models: small`) are untagged, so they ask a small model in both modes.
 leaves out `(strict only)`.
 
 A rule in config.yml that uses a key this chi doesn't know yet (`modes:`,
-`touches:`, `rm:`, `skip_read_only:` before 0.20) doesn't parse, and a rule
+`touches:`, `rm:`, `skip_read_only:` before 0.20, `memory:` before 0.36) doesn't parse, and a rule
 that doesn't parse denies every tool call (see Failing closed). Bundles say
 which chi they need (`requires_chi`), so their rules don't hit this.
 
@@ -429,7 +449,10 @@ hooks, approvals, bundles or attached context sources, or a `.git/hooks`
 time: a command chi will run every few minutes outside the guardrails; see
 [Attached context](context.md#safety)); `chi broadcast` (`chi-broadcast`,
 once at a time and only by the user: it is the user's command, which also
-refuses to run inside a session; see [Broadcast](broadcast.md)); and answering chi's
+refuses to run inside a session; see [Broadcast](broadcast.md)); removing a
+memory with `memory_write remove: true` (`memory-remove`, once at a time:
+a delegate child could otherwise remove its parent's handoff unasked; see
+[Memory](memory.md)); and answering chi's
 questions around `chi answer`: `chi --attach` or `chi -p` with stdin from a
 pipe, a here-string or a file (`chi-answer-piped`), and `curl`/`wget` to a
 session's `/answer` route (`chi-answer-http`), both once or for the session.

data/docs/hooks.md

@@ -424,7 +424,7 @@ stripped of surrounding whitespace, except file text, an edit's
 | `write` | — | `path` | `content` |
 | `edit` | — | `path` | `old_text`, `new_text`, `start_line`, `end_line` |
 | `memory_read` | `name` | — | `scope` |
-| `memory_write` | — | `name` | `content`, `scope`, `description`, `current_model_only` |
+| `memory_write` | — | `name` | `content`, `scope`, `description`, `current_model_only`, `remove` |
 | `task_create` | `command` | — | `cwd`, `env` |
 | `task_get` | `id` or `task_id` | — | — |
 | `task_list` | — | — | — |

data/docs/memory.md

@@ -15,6 +15,9 @@ Tool behavior:
 - If `scope` is provided (`project` or `system`), only that scope is read.
 - If `scope` is omitted, read falls back from project to system.
 - `memory_write`: `scope` is required (`project` or `system`). The entry name is passed via the `name` parameter (not `path` — the file tools use `path`). On success, the return value includes the full file path. For a small change to an existing memory (a step, a line) the model is told to `edit` that file rather than rewrite it all with `memory_write`.
+- `memory_write`'s `description` is the managed `index.md` line's text: one line (whitespace and newlines collapse to single spaces), at most 200 characters (longer is refused, since every session's prompt for the repo carries it). A missing or blank one keeps the line's description.
+- `memory_write` with `name`, `scope` and `description` but no `content` changes only that entry's index line (its size and date are refreshed; the date becomes today) and leaves the file as it is: a skill that keeps its status in a memory's description changes it without resending the body. The memory must exist in that scope; the form is refused for `index` and with `current_model_only`.
+- `memory_write` with `name`, `scope` and `remove: true` (no content, description or `current_model_only`) removes a memory: its file and its model overlays (`<name>.<key>.md`, not a dotted memory with an index line of its own) move into one dir of the bundle trash, `memory-<name>-<time>` under `memories/.bundles/.trash/`, which `chi bundle trash` lists and empties, and its index line is dropped. When the file is already gone (deleted by hand), the dangling line is dropped alone. A memory a bundle owns (an installed bundle's record lists it, or its line says `· from <bundle>`) is refused: `chi bundle uninstall` removes it. `index` can't be removed. The guardrails bundle's `memory-remove` rule asks before every removal, once at a time (see [Guardrails](guardrails.md#the-guardrails-bundle)).
 - `write`/`edit` that change a `*.md` right in a scope dir refresh its managed `index.md` line (date, bytes; the description is kept), as `memory_write` does. A memory created with `write` gets a line with no description; any other `.md` written there gets a line too. Model overlays (`<name>.<key>.md` next to `<name>.md`), files in another project's folder and files changed by `execute` are left out.
 
 ## Model-Specific Memory Overlays

data/docs/plugins.md

@@ -162,8 +162,8 @@ in the chat path's `tools:`, after chi's own tools.
   it raises, the default is shown. Both are saved with the call's result, so
   a web page reloaded later shows the same row: the web server doesn't run
   plugins.
-- `targets`: `->(args) { { paths: [...], command: "…", cwd: "…" } }`, each
-  key optional, says what a call acts on, for [guardrails](#guardrails).
+- `targets`: `->(args) { { paths: [...], command: "…", cwd: "…", acts_as: "…", args: {…}, label: "…" } }`,
+  each key optional, says what a call acts on, for [guardrails](#guardrails).
 
 The block returns the result text. If it starts with `Error:`, it counts as
 a failure. If it raises, the model gets `Error: <message>`. To return images
@@ -234,6 +234,27 @@ is what `targets:` says:
   paths (chi's config, …) match them.
 - `command:`: a shell command the call runs; `command:` rules match it.
 - `cwd:`: where it runs, for the repo root and relative paths.
+- `acts_as:`: the tool a call stands for, when the tool runs other tools
+  (the mcp bundle's `mcp_call`). Rules keyed by that tool's name match the
+  call too, as well as rules on the tool's own name. It can't be one of
+  chi's own tools or another bundle's tool: that is dropped (and logged).
+- `args:`: the arguments it acts with (a Hash), when they aren't the call's
+  own (a dispatcher's inner arguments). A call with no `command:` or
+  `paths:` is asked about with them, and "allow this call" is keyed by them.
+- `label:`: what the approval question names the call by (`github: x`), in
+  place of the tool's `label` (or, with `acts_as:`, that tool's). Display
+  only: rules and approvals don't read it. One line of at most 80
+  characters, else it is ignored (and logged).
+
+```ruby
+targets: ->(args) { { acts_as: "mcp_#{args["server"]}_#{args["tool"]}", args: args["args"],
+                      label: "#{args["server"]}: #{args["tool"]}" } }
+```
+
+An approval of an `acts_as:` call keys on the tool's own name as well
+(`mcp_call>mcp_github_x:…`), so it never stands in for an approval of the
+tool it acts as, nor that one for it. Hooks see the call's own name, and so
+does loop-guard's `ignore_tools`.
 
 A tool without `targets:` is matched by its name only. A `targets:` that
 raises counts as nothing (it is logged). See [guardrails.md](guardrails.md).
@@ -836,6 +857,13 @@ bundles:
   closed, then TERM and KILL go to the server's process group.
 - **`/mcp`** (anytime) shows a card with the servers, their state (cached
   (not started), running with its pid, failed, stopped) and their tools.
+  A cached or running server's line says roughly how many tokens its tool
+  definitions take (`~4,232 tokens`), and the last line totals the servers
+  whose tools the model has: what every request carries. It is an estimate:
+  the definitions' JSON as the chat API gets it (`api: openai`), divided by
+  4. The native prompts (Gemma, Qwen) render a flatter schema, so there they
+  take less. The log records each server's estimate when it changes
+  (`mcp_tools_estimated`).
 - The server's stderr goes to the debug log (`plugins` records, bundle=mcp).
 - **Guardrails.** A rule's `tool:` can be a glob, so one rule covers every
   MCP tool:
@@ -1137,7 +1165,9 @@ nothing without `gh`, a repository or an open PR), and resolves PR URLs for
 `chi context add` and the web's "+ URL". Its script prints the PR as text
 and a summary of what changed in counts, authors and states only; it wakes
 the session for a review requesting changes, checks turning red, or the PR
-merged or closed. See [Attached context](context.md#github-prs-the-github-pr-bundle).
+merged or closed. In the web, a `path:line` in an answer links to that line
+of the session's PR ([Line links](context.md#line-links)). See [Attached
+context](context.md#github-prs-the-github-pr-bundle).
 
 ## The coordinator bundle
 
@@ -1163,10 +1193,27 @@ by themselves there.
   agent may have merged the branch already), merges `--ff-only` and never
   pushes unless you ask. After a merge it stops the
   child and removes only the worktrees and branches it made.
+- **A handoff memory.** The conversation is lost when the session ends, so
+  the skill keeps a project memory `handoff_<epic-slug>` with only what git
+  and the session list can't rebuild: the split (branch, worktree, child id
+  per task), your decisions, its verdicts and the follow-ups. Its index
+  description is the status, descriptive only and naming the session that
+  owns it ("OPEN coordinator handoff calc-v2 (session ab12cd34): 2/3 merged",
+  later "DONE: …"): every session in the repo sees that line. The model saves
+  a decision there before acting on it, and changes the status with
+  `memory_write`'s description-only form. When everything is done it marks
+  the handoff DONE and asks whether to remove it (`memory_write remove:
+  true`, which the guardrails bundle asks you to confirm). Children are told
+  not to touch it.
+- **Resume.** A new coordinator session (or one asked "where were we?")
+  reads the open handoff, checks it against git and the session list (git
+  wins; mismatches are reported) and goes on from the first open step.
 - **`/coordinate <goal>`** sends this session a turn asking the model to
   follow the skill for the goal (in a `--no-shared` REPL it shows the text to
   send yourself). Asking "do this in parallel" works too: the index line leads
-  the model to the skill.
+  the model to the skill. **`/coordinate resume`** asks it to resume this
+  project's open handoff; with several open it shows a card with a Resume
+  action each (`/coordinate resume <name>` picks one), with none it says so.
 - **`/children [all]`** shows the session's children as a card, newest first,
   one line each: `` `ab12cd34` · running · fix/flaky · "fix the flaky spec" ``,
   `` `9a8b7c6d` · done · feat/x · reported · "All 12 specs pass" `` (`not