samagotchi 0.4.0 → 0.5.0

data/lib/samagotchi/thinking.rb

@@ -99,6 +99,17 @@ module Samagotchi
       end
     end
 
+    # Whether a chat host's /props (+props+, Client::ServerProps) says its
+    # chat template takes no effort (llama.cpp's
+    # chat_template_caps.supports_reasoning_effort: false), so +level+'s
+    # reasoning_effort is ignored. false when it doesn't say.
+    def effort_ignored?(level, props)
+      return false unless EFFORTS.include?(level) && props&.answered? && props.body.is_a?(Hash)
+
+      caps = props.body["chat_template_caps"]
+      caps.is_a?(Hash) && caps["supports_reasoning_effort"] == false
+    end
+
     # The native prompt's switch for +level+ under +profile+.
     # @param profile [ModelProfile]
     # @return [Native]

data/lib/samagotchi/tool_activity.rb

@@ -31,13 +31,63 @@ module Samagotchi
     module_function
 
     # @param registry [Tools::Registry, nil] the session's tools
-    def tool_activity_event(tool_name, call, result, registry: nil)
-      {
+    # @param cwd [String, nil] what a file tool's title is relative to (the
+    #   worker runs in its session's working directory)
+    def tool_activity_event(tool_name, call, result, registry: nil, cwd: Dir.pwd)
+      event = {
         action: tool_activity_action(tool_name, registry: registry),
         tool: tool_name,
         params: tool_activity_params(tool_name, call, registry: registry),
         status: tool_activity_status(result, tool_name)
       }
+      title = tool_title(tool_name, call, cwd: cwd)
+      event[:title] = title if title
+      event
+    end
+
+    # What the call did, for a web row's one line ("edit lib/a.rb", the
+    # command without its "cd … &&"): a file tool's path relative to +cwd+
+    # when it is under it, a command's first line, a memory's name; nil for
+    # the other tools (a plugin's row keeps its preview, the params).
+    # +params+ stays the full key=value line (the TUI, the guardrails).
+    def tool_title(tool_name, call, cwd: nil)
+      text = case tool_name
+             when Tools::Read::NAME, Tools::MemoryRead::NAME then call[:content]
+             when Tools::Write::NAME, Tools::Edit::NAME, Tools::MemoryWrite::NAME then call[:path]
+             when Tools::Execute::NAME, Tools::TaskCreate::NAME then command_title(call[:content])
+             end
+      text = text.to_s.strip
+      return nil if text.empty?
+
+      case tool_name
+      when Tools::Read::NAME, Tools::Write::NAME, Tools::Edit::NAME
+        path = relative_path(text, cwd)
+        path.length > TOOL_ACTIVITY_PREVIEW_LIMIT ? "…#{path[-(TOOL_ACTIVITY_PREVIEW_LIMIT - 1)..]}" : path
+      else
+        text = text.gsub(/\s+/, " ")
+        text.length > TOOL_ACTIVITY_PREVIEW_LIMIT ? "#{text[0, TOOL_ACTIVITY_PREVIEW_LIMIT - 1]}…" : text
+      end
+    end
+
+    # A leading "cd <dir> &&" / "cd <dir>;" goes: the model's habit, and it
+    # eats the line.
+    LEADING_CD = /\Acd\s+(?:"[^"]*"|'[^']*'|\S+)\s*(?:&&|;)\s*/
+
+    def command_title(command)
+      line = command.to_s.lines.map(&:strip).find { |l| !l.empty? }.to_s
+      line.sub(LEADING_CD, "")
+    end
+
+    # +path+ relative to +cwd+ when it is inside it, compared by path
+    # components ("/p/app-2" is not inside "/p/app"); else as given.
+    def relative_path(path, cwd)
+      return path if cwd.to_s.empty? || !path.start_with?("/")
+
+      parts = File.expand_path(path).split("/")
+      base = File.expand_path(cwd).split("/")
+      return path unless parts.length > base.length && parts[0, base.length] == base
+
+      parts.drop(base.length).join("/")
     end
 
     def tool_activity_action(tool_name, registry: nil)

data/lib/samagotchi/tool_runner.rb

@@ -48,6 +48,9 @@ module Samagotchi
       started = { type: :tool_call_started, iteration: iteration, call_count: call_count, call_index: call_index,
                   tool: call[:name], call: call.dup, params: params }
       started[:label] = label if label
+      # The worker runs in its session's working directory.
+      title = ToolActivity.tool_title(call[:name], call, cwd: Dir.pwd)
+      started[:title] = title if title
       emit(on_stream_event, started)
 
       # The ask comes after tool_call_started: the UI shows the tool line,

data/lib/samagotchi/tools/execute.rb

@@ -195,8 +195,8 @@ module Samagotchi
       def self.output_block(label, content)
         return nil if content.nil? || content.empty?
 
-        truncate_at_bytes = OutputGuardrails.env_positive_int("SAMAGOTCHI_EXECUTE_TRUNCATE_AT_BYTES", OutputGuardrails::DEFAULT_TRUNCATE_AT_BYTES)
-        preview_bytes = OutputGuardrails.env_positive_int("SAMAGOTCHI_EXECUTE_PREVIEW_BYTES", OutputGuardrails::DEFAULT_PREVIEW_BYTES)
+        truncate_at_bytes = OutputGuardrails.config_positive_int("execute.truncate_at_bytes", OutputGuardrails::DEFAULT_TRUNCATE_AT_BYTES)
+        preview_bytes = OutputGuardrails.config_positive_int("execute.preview_bytes", OutputGuardrails::DEFAULT_PREVIEW_BYTES)
         bytes = content.bytesize
         return "#{label}:\n#{content}" if bytes <= truncate_at_bytes
 
@@ -220,7 +220,7 @@ module Samagotchi
       def self.telemetry_lines_for(content)
         OutputGuardrails.telemetry_lines_for(
           content: content,
-          threshold_env: "SAMAGOTCHI_EXECUTE_TELEMETRY_THRESHOLD_PCT",
+          threshold_key: "execute.telemetry_threshold_pct",
           threshold_default: OutputGuardrails::DEFAULT_TELEMETRY_THRESHOLD_PCT,
           token_key: "estimated_tokens_for_command_output",
           pct_key: "estimated_window_pct_for_command_output"

data/lib/samagotchi/tools/output_guardrails.rb

@@ -13,13 +13,14 @@ module Samagotchi
 
       module_function
 
-      def env_positive_int(key, default)
-        value = ENV.fetch(key, default.to_s).to_i
+      # The config setting +key+ (read.*, execute.*, context.*) when positive, else +default+.
+      def config_positive_int(key, default)
+        value = Samagotchi::Config.get(key).to_i
         value.positive? ? value : default
       end
 
-      def env_positive_float(key, default)
-        value = ENV.fetch(key, default.to_s).to_f
+      def config_positive_float(key, default)
+        value = Samagotchi::Config.get(key).to_f
         value.positive? ? value : default
       end
 
@@ -57,10 +58,10 @@ module Samagotchi
         build_preview_parts(head: head, tail: tail, total_bytes: content.bytesize)
       end
 
-      def telemetry_lines_for(content:, threshold_env:, threshold_default:, token_key:, pct_key:)
-        chars_per_token = env_positive_float("SAMAGOTCHI_CONTEXT_CHARS_PER_TOKEN", DEFAULT_CHARS_PER_TOKEN)
+      def telemetry_lines_for(content:, threshold_key:, threshold_default:, token_key:, pct_key:)
+        chars_per_token = config_positive_float("context.chars_per_token", DEFAULT_CHARS_PER_TOKEN)
         window_tokens = ContextWindow.current.tokens
-        telemetry_threshold_pct = env_positive_float(threshold_env, threshold_default)
+        telemetry_threshold_pct = config_positive_float(threshold_key, threshold_default)
 
         estimated_tokens = (content.length / chars_per_token).ceil
         estimated_window_pct = (estimated_tokens.to_f / window_tokens) * 100.0

data/lib/samagotchi/tools/read.rb

@@ -52,9 +52,9 @@ module Samagotchi
 
         size = File.size(path)
 
-        hard_max_bytes = OutputGuardrails.env_positive_int("SAMAGOTCHI_READ_HARD_MAX_BYTES", DEFAULT_HARD_MAX_BYTES)
-        truncate_at_bytes = OutputGuardrails.env_positive_int("SAMAGOTCHI_READ_TRUNCATE_AT_BYTES", OutputGuardrails::DEFAULT_TRUNCATE_AT_BYTES)
-        preview_bytes = OutputGuardrails.env_positive_int("SAMAGOTCHI_READ_PREVIEW_BYTES", OutputGuardrails::DEFAULT_PREVIEW_BYTES)
+        hard_max_bytes = OutputGuardrails.config_positive_int("read.hard_max_bytes", DEFAULT_HARD_MAX_BYTES)
+        truncate_at_bytes = OutputGuardrails.config_positive_int("read.truncate_at_bytes", OutputGuardrails::DEFAULT_TRUNCATE_AT_BYTES)
+        preview_bytes = OutputGuardrails.config_positive_int("read.preview_bytes", OutputGuardrails::DEFAULT_PREVIEW_BYTES)
 
         if size > hard_max_bytes
           return "Error: file too large: #{path} (#{size} bytes, hard limit #{hard_max_bytes} bytes)."
@@ -105,7 +105,7 @@ module Samagotchi
       def self.telemetry_lines_for(content)
         OutputGuardrails.telemetry_lines_for(
           content: content,
-          threshold_env: "SAMAGOTCHI_READ_TELEMETRY_THRESHOLD_PCT",
+          threshold_key: "read.telemetry_threshold_pct",
           threshold_default: OutputGuardrails::DEFAULT_TELEMETRY_THRESHOLD_PCT,
           token_key: "estimated_tokens_for_preview",
           pct_key: "estimated_window_pct_for_preview"

data/lib/samagotchi/update_command.rb

@@ -9,6 +9,7 @@ require_relative "memory_bundle/shipped_update"
 require_relative "memory_bundle/system_bundle"
 require_relative "session"
 require_relative "version"
+require_relative "web/lan"
 
 module Samagotchi
   # `chi update`: brings an installed chi up to date in one go: the system
@@ -64,7 +65,7 @@ module Samagotchi
       @platform = platform || ->(register:) { Desktop::MacOS.new(register: register) }
       @supported = supported
       @state_dir = state_dir
-      @web = web || [Config.get("web.host").to_s, Config.get("web.port").to_i]
+      @web = web || [Web::Lan.local_host(Config.get("web.host")), Config.get("web.port").to_i]
     end
 
     # @return [Integer] 0 nothing failed, 1 a part failed (or a checkout), 2 usage

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -70,9 +70,8 @@ module Samagotchi
 
       # @param bridge_wait_timeout [Float] bounded seconds to wait for a
       #   freshly-spawned worker's bridge before answering POST /api/sessions.
-      # @param turn_view [Boolean] the page's per-turn view (web.turn_view,
-      #   the default); false is the classic row of bubbles; ?view=turn|chat
-      #   overrides it for one page load
+      # @param view ["turn", "stage", "chat"] the page's view of a turn
+      #   (web.view); ?view=turn|stage|chat overrides it for one page load
       # @param annotate_presets [String, Array] the quick replies next to
       #   Annotate (web.annotate_presets, "|"-separated); "" shows none. The
       #   page parses them (annotate_presets.js).
@@ -82,11 +81,15 @@ module Samagotchi
       #   (built from the config on first use)
       # @param models_wait_timeout [Float] bounded seconds GET /api/models
       #   waits for the hosts' lists
+      # @param lan [Hash, nil] LAN mode (web.host: lan): { ip:, token: },
+      #   the address the server also listens on and its access token (a
+      #   String, or a Web::Token::Source that follows the file); nil:
+      #   loopback only, no token
       def initialize(manager: nil, session_class: nil, state_dir: nil, public_dir: nil,
-                     bridge_wait_timeout: BRIDGE_WAIT_TIMEOUT, markdown: false, turn_view: true, hub: nil,
+                     bridge_wait_timeout: BRIDGE_WAIT_TIMEOUT, markdown: false, view: "turn", hub: nil,
                      annotate_presets: Config::BY_KEY["web.annotate_presets"].default,
                      events_heartbeat: EVENTS_HEARTBEAT, events_queue: EVENTS_QUEUE,
-                     registry: nil, models_wait_timeout: MODELS_WAIT_TIMEOUT)
+                     registry: nil, models_wait_timeout: MODELS_WAIT_TIMEOUT, lan: nil)
         @manager = manager || SessionManager
         @registry = registry
         @models_wait_timeout = models_wait_timeout
@@ -97,12 +100,15 @@ module Samagotchi
         @public_dir = public_dir || File.expand_path("public", __dir__)
         @bridge_wait_timeout = bridge_wait_timeout
         @markdown_renderer = MarkdownRenderer.new(enabled: markdown)
-        @turn_view = turn_view
+        @view = view
         @annotate_presets = annotate_presets.is_a?(Array) ? annotate_presets.join("|") : annotate_presets.to_s
         @hub = hub
         @events_heartbeat = events_heartbeat
         @events_queue = events_queue
         @server_running = -> { true }
+        @lan = lan
+        @refused_mutex = Mutex.new
+        @refused_logged = {}
       end
 
       def call(env)
@@ -116,7 +122,12 @@ module Samagotchi
 
       def route(env)
         req = Rack::Request.new(env)
-        return forbidden unless localhost?(req)
+        return forbidden unless local_host_header?(env)
+        return cross_origin if cross_site?(env)
+        if @lan && !LOOPBACK_PEERS.include?(env["REMOTE_ADDR"].to_s)
+          denied = token_gate(req)
+          return denied if denied
+        end
 
         case [req.request_method, req.path_info]
         when ["GET", "/"], ["GET", "/index.html"]
@@ -199,15 +210,140 @@ module Samagotchi
                                    ms: ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round)
       end
 
-      def localhost?(req)
-        # Only 127.0.0.1 / ::1 / localhost are allowed. The socket is bound to
-        # 127.0.0.1, but an explicit Host check prevents DNS-rebind tricks.
-        host = req.host.to_s.downcase.split(":").first
-        %w[127.0.0.1 ::1 localhost].include?(host)
+      LOOPBACK_NAMES = %w[127.0.0.1 [::1] localhost].freeze
+      LOOPBACK_PEERS = %w[127.0.0.1 ::1 ::ffff:127.0.0.1].freeze
+
+      # Only 127.0.0.1 / [::1] / localhost (any port), and in LAN mode the
+      # LAN address, are answered. The socket is bound to those, but a Host
+      # check stops DNS-rebinding pages. It reads the raw Host header:
+      # Rack's req.host trusts X-Forwarded-Host, which such a page could
+      # set. A request with no Host (HTTP/1.0) is answered only for a
+      # loopback peer.
+      def local_host_header?(env)
+        host = env["HTTP_HOST"].to_s
+        return LOOPBACK_PEERS.include?(env["REMOTE_ADDR"].to_s) if host.empty?
+
+        name = host.downcase.sub(/:\d*\z/, "")
+        LOOPBACK_NAMES.include?(name) || (!@lan.nil? && name == @lan[:ip])
+      end
+
+      TOKEN_COOKIE = "chi_token"
+      # 400 days, the longest a browser keeps a cookie (Chrome's cap). No
+      # Secure: the LAN page is plain http. Lax, not Strict: a token link
+      # opened from another site (a web messenger) makes its 303 chain
+      # cross-site, and a Strict cookie wouldn't ride on the redirected GET;
+      # the cross-site check already refuses what Strict would add.
+      TOKEN_COOKIE_ATTRIBUTES = "HttpOnly; SameSite=Lax; Path=/; Max-Age=34560000"
+      REFUSED_LOG_INTERVAL = 60.0
+
+      # LAN mode, a peer that isn't this machine (the peer is the socket's
+      # address, REMOTE_ADDR: never X-Forwarded-For or req.ip, which trust
+      # headers a phone could send): every route needs the access token, as
+      # the chi_token cookie or an Authorization: Bearer header. The page
+      # with ?token= trades it for the cookie and a 303 to itself without
+      # it, so the token doesn't stay in the phone's history.
+      # @return [Array, nil] the response that refuses it, or nil to go on
+      def token_gate(req)
+        token = current_token
+        if req.get? && ["/", "/index.html"].include?(req.path_info) && req.params.key?("token")
+          return token_redirect(req, token) if token_match?(req.params["token"], token)
+        else
+          auth = req.get_header("HTTP_AUTHORIZATION").to_s[/\ABearer +(\S+)\z/, 1]
+          return nil if token_match?(auth, token) || token_match?(req.cookies[TOKEN_COOKIE], token)
+        end
+
+        unauthorized(req)
+      end
+
+      def current_token
+        token = @lan[:token]
+        token.respond_to?(:current) ? token.current : token
+      end
+
+      def token_match?(given, token)
+        return false if given.nil? || given.empty? || token.nil? || token.empty?
+
+        Rack::Utils.secure_compare(given, token)
+      end
+
+      # The same page (and its other parameters, as they were written), the
+      # token traded for the cookie.
+      def token_redirect(req, token)
+        query = req.query_string.split("&").reject { |pair| pair.split("=", 2).first == "token" }.join("&")
+        location = query.empty? ? req.path_info : "#{req.path_info}?#{query}"
+        [303, { "Location" => location, "Set-Cookie" => "#{TOKEN_COOKIE}=#{token}; #{TOKEN_COOKIE_ATTRIBUTES}",
+                "Cache-Control" => "no-store", "Content-Length" => "0" }, []]
+      end
+
+      def unauthorized(req)
+        log_refused(req.get_header("REMOTE_ADDR").to_s, req.path_info)
+        return error_response(401, "unauthorized", "chi web on the LAN needs its access token") if req.path_info.start_with?("/api/")
+
+        body = UNAUTHORIZED_PAGE
+        [401, { "Content-Type" => "text/html; charset=utf-8", "Content-Length" => body.bytesize.to_s, "Cache-Control" => "no-store" },
+         [body]]
+      end
+
+      # At most once a minute per peer: a phone with an old link retries.
+      def log_refused(peer, path)
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        due = @refused_mutex.synchronize do
+          @refused_logged.delete_if { |_, at| now - at >= REFUSED_LOG_INTERVAL } if @refused_logged.size > 64
+          last = @refused_logged[peer]
+          (last.nil? || now - last >= REFUSED_LOG_INTERVAL).tap { |fresh| @refused_logged[peer] = now if fresh }
+        end
+        Log.warn(:web, "unauthorized", peer: peer, path: path) if due
+      end
+
+      # What a phone sees without the token. The field is for a home-screen
+      # web app: it has its own cookies, and the QR code opens the browser.
+      UNAUTHORIZED_PAGE = <<~HTML
+        <!doctype html>
+        <html lang="en"><head><meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>chi web: access token needed</title>
+        <style>
+          :root { color-scheme: light dark; }
+          body { font: 16px/1.5 -apple-system, system-ui, sans-serif; max-width: 30rem; margin: 3rem auto; padding: 0 1rem; }
+          input { font: inherit; width: 100%; box-sizing: border-box; padding: .5rem; margin: .5rem 0; }
+          button { font: inherit; padding: .4rem 1rem; }
+        </style></head>
+        <body>
+        <h1>chi web</h1>
+        <p>This page needs chi web's access token. Open the LAN link chi web printed in its terminal, or scan its QR code.</p>
+        <form method="get" action="/">
+          <label for="token">Or paste the token:</label>
+          <input id="token" name="token" autocomplete="off" autocapitalize="off" spellcheck="false">
+          <button type="submit">Open</button>
+        </form>
+        </body></html>
+      HTML
+
+      # Another website's page in the desktop browser can send "simple"
+      # requests here (a text/plain POST needs no preflight) and would start
+      # sessions that run commands. Refused: any request but GET/HEAD from
+      # another site (Sec-Fetch-Site cross-site/same-site, or an Origin other
+      # than exactly this server's: another local port and "null" are
+      # foreign), and GETs of /api/* the same way (no blind reads, no SSE
+      # subscriptions). The page itself is same-origin; curl, Net::HTTP and
+      # chi's own clients send neither header and pass. A link followed from
+      # another site still opens the page (a top-level GET).
+      def cross_site?(env)
+        foreign = %w[cross-site same-site].include?(env["HTTP_SEC_FETCH_SITE"].to_s.downcase)
+        origin = env["HTTP_ORIGIN"]
+        foreign ||= !origin.nil? && origin.downcase != "http://#{env["HTTP_HOST"].to_s.downcase}"
+        return false unless foreign
+
+        !%w[GET HEAD].include?(env["REQUEST_METHOD"]) || env["PATH_INFO"].to_s.start_with?("/api/")
+      end
+
+      def cross_origin
+        error_response(403, "cross_origin", "requests from other websites are refused")
       end
 
       def forbidden
-        error_response(403, "forbidden", "only 127.0.0.1 is allowed")
+        names = @lan ? "127.0.0.1, [::1], localhost and #{@lan[:ip]}" : "127.0.0.1, [::1] and localhost"
+        error_response(403, "forbidden", "only the host names #{names} are answered")
       end
 
       # The page's scope: ?dir=<folder> lists that folder's project (every
@@ -248,7 +384,7 @@ module Samagotchi
           session_to_json(s, status: displayed_status(s, owner: owner), owner: owner, root_cache: roots)
         end
         # Expose total via header for pagination (total unordered count)
-        headers = { "Content-Type" => "application/json; charset=utf-8", "Cache-Control" => "no-store", "Access-Control-Allow-Origin" => "*" }
+        headers = { "Content-Type" => "application/json; charset=utf-8", "Cache-Control" => "no-store" }
         # Compute total without limit/offset for header
         if limit || offset.positive?
           total = if @state_dir
@@ -269,7 +405,7 @@ module Samagotchi
         all = @hub.snapshot(project_root: root, sort: sort, order: order)
         page = all.drop(offset)
         page = page.first(limit) if limit
-        headers = { "Content-Type" => "application/json; charset=utf-8", "Cache-Control" => "no-store", "Access-Control-Allow-Origin" => "*" }
+        headers = { "Content-Type" => "application/json; charset=utf-8", "Cache-Control" => "no-store" }
         headers["X-Total-Count"] = all.size.to_s if limit || offset.positive?
         body = JSON.generate(page)
         headers["Content-Length"] = body.bytesize.to_s
@@ -294,7 +430,7 @@ module Samagotchi
       # is chi web, and it knows ?dir (features).
       def handle_info
         json_response(200, { app: "chi-web", version: Samagotchi::VERSION, pid: Process.pid, cwd: Dir.pwd,
-                             features: ["dir"] })
+                             features: ["dir"], lan: @lan && @lan[:ip] })
       end
 
       # The models a new session can start on, spelled as chi spells them
@@ -480,7 +616,8 @@ module Samagotchi
         json_response(200, {
           session: session_json,
           history: read_history(id),
-          messages: messages_for_display(raw_messages, parts: req.params["parts"] == "1"),
+          messages: messages_for_display(raw_messages, parts: req.params["parts"] == "1",
+                                                       cwd: session.respond_to?(:working_directory) ? session.working_directory : nil),
           failed_turn: failed_turn_for(session, raw_messages),
           current_turn: current_turn,
           queued: turn_snapshot ? Array(turn_snapshot["queued"]) : [],
@@ -889,8 +1026,7 @@ module Samagotchi
           "Content-Type" => "text/event-stream",
           "Cache-Control" => "no-cache",
           "Connection" => "keep-alive",
-          "X-Accel-Buffering" => "no",
-          "Access-Control-Allow-Origin" => "*"
+          "X-Accel-Buffering" => "no"
         }
 
         # Handlers that buffer enumerable bodies before responding (rackup's
@@ -924,8 +1060,7 @@ module Samagotchi
           "Content-Type" => "text/event-stream",
           "Cache-Control" => "no-cache",
           "Connection" => "keep-alive",
-          "X-Accel-Buffering" => "no",
-          "Access-Control-Allow-Origin" => "*"
+          "X-Accel-Buffering" => "no"
         }
         body = EventsBody.new(hub: @hub, project_root: root, heartbeat: @events_heartbeat, capacity: @events_queue,
                               server_running: @server_running)
@@ -1159,7 +1294,9 @@ module Samagotchi
       #   assistant message also carries what it did (MessageParts: thinking,
       #   tool calls with params and output), and a message with nothing to
       #   show but that (a text-less step) is kept with empty content
-      def messages_for_display(msgs, parts: false)
+      # @param cwd [String, nil] the session's working directory (the parts'
+      #   tool titles are relative to it)
+      def messages_for_display(msgs, parts: false, cwd: nil)
         filtered = []
         list = Array(msgs)
         list.each_with_index do |m, index|
@@ -1179,7 +1316,7 @@ module Samagotchi
           next if role == "tool_response"
 
           stripped = Samagotchi::OutputFormatter.strip_markup(content)
-          did = parts && %w[model assistant].include?(role) ? message_parts(list, index) : nil
+          did = parts && %w[model assistant].include?(role) ? message_parts(list, index, cwd) : nil
           next if stripped.empty? && did.nil?
 
           norm_role = role == "model" ? "assistant" : role
@@ -1222,9 +1359,9 @@ module Samagotchi
 
       # The parts of the assistant message at +index+, with the tool_response
       # messages right after it.
-      def message_parts(list, index)
+      def message_parts(list, index, cwd = nil)
         responses = list.drop(index + 1).take_while { |r| (r[:role] || r["role"]).to_s == "tool_response" }
-        MessageParts.for_message(list[index], responses)
+        MessageParts.for_message(list[index], responses, cwd: cwd)
       end
 
       # The last message messages_for_display shows as an answer, as a list of
@@ -1280,7 +1417,7 @@ module Samagotchi
       # nothing here: the list call answers 400 and the page says so.
       def index_data_attributes(req)
         attrs = { "sessions-dir" => sessions_dir_label, "server-dir" => home_label(Dir.pwd) }
-        attrs["turn-view"] = "1" if turn_view?(req.params["view"])
+        attrs["view"] = view_name(req.params["view"])
         # Always there: an empty one means no presets, not the default.
         attrs["annotate-presets"] = @annotate_presets
         dir, = scope_dir(req.params["dir"])
@@ -1301,19 +1438,17 @@ module Samagotchi
         attrs.map { |key, value| %(data-#{key}="#{Rack::Utils.escape_html(value)}") }.join(" ")
       end
 
-      # The turn view for this page load: ?view=turn or ?view=chat wins,
-      # anything else leaves the config's choice.
-      def turn_view?(param)
-        case param
-        when "turn" then true
-        when "chat" then false
-        else @turn_view
-        end
+      VIEWS = Config::BY_KEY["web.view"].enum_values
+
+      # The view for this page load: ?view=turn|stage|chat wins, anything
+      # else leaves the config's choice (web.view).
+      def view_name(param)
+        VIEWS.include?(param) ? param : @view
       end
 
       def json_response(status, payload)
         body = JSON.generate(payload)
-        [status, { "Content-Type" => "application/json; charset=utf-8", "Content-Length" => body.bytesize.to_s, "Cache-Control" => "no-store", "Access-Control-Allow-Origin" => "*" }, [body]]
+        [status, { "Content-Type" => "application/json; charset=utf-8", "Content-Length" => body.bytesize.to_s, "Cache-Control" => "no-store" }, [body]]
       end
 
       # The request body, "" when there is none: WEBrick (through rackup)

data/lib/samagotchi/web/lan.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "socket"
+
+module Samagotchi
+  module Web
+    # web.host beyond loopback: `lan` (this machine's private IPv4 address)
+    # or one of its IPv4 addresses. chi web then listens on 127.0.0.1 and
+    # that address; the local tools (a second chi web, chi update) keep
+    # talking to 127.0.0.1 (local_host). IPv6 LAN addresses aren't offered.
+    module Lan
+      LOOPBACK_NAMES = %w[127.0.0.1 ::1 localhost].freeze
+      # Interfaces `lan` never picks: VPN tunnels, bridges, VMs and
+      # containers, Apple's low-latency link.
+      SKIPPED = /\A(utun|bridge|docker|vboxnet|vmnet|llw)/
+      PRIVATE = [IPAddr.new("10.0.0.0/8"), IPAddr.new("172.16.0.0/12"), IPAddr.new("192.168.0.0/16")].freeze
+
+      Address = Struct.new(:ip, :interface, keyword_init: true) do
+        def to_s = "#{ip} (#{interface})"
+      end
+
+      # The address chi web adds, the other private ones `lan` could have
+      # picked (said in the startup lines), and whether it isn't a private
+      # one (an explicit Tailscale or public address: a warning).
+      Choice = Struct.new(:ip, :interface, :others, :public, keyword_init: true)
+
+      class Error < StandardError; end
+
+      module_function
+
+      # Does this web.host ask for LAN access? `lan`, or an IPv4 address
+      # that isn't loopback or 0.0.0.0 (never bound: every interface).
+      def wanted?(setting)
+        setting = setting.to_s.strip
+        return true if setting == "lan"
+
+        ip = ipv4(setting)
+        !ip.nil? && !ip.loopback? && ip != IPAddr.new("0.0.0.0")
+      end
+
+      # Where this machine reaches its own chi web: the loopback address
+      # for `lan` or a LAN address, ::1 and localhost as they are, and
+      # 127.0.0.1 for anything else (chi web binds that instead).
+      def local_host(setting)
+        setting = setting.to_s.strip
+        %w[::1 localhost].include?(setting) ? setting : "127.0.0.1"
+      end
+
+      # @param ifaddrs [Array<Socket::Ifaddr>] this machine's interfaces
+      # @return [Choice]
+      # @raise [Error] `lan` with no private address, or an address that
+      #   isn't this machine's
+      def choose(setting, ifaddrs: Socket.getifaddrs)
+        setting = setting.to_s.strip
+        mine = addresses(ifaddrs)
+        if setting == "lan"
+          candidates = mine.select { |a| private?(a.ip) && !a.interface.match?(SKIPPED) }
+          raise Error, "web.host is lan, but this machine has no private IPv4 address on the network (Wi-Fi off?)" if candidates.empty?
+
+          first, *others = candidates
+          return Choice.new(ip: first.ip, interface: first.interface, others: others, public: false)
+        end
+
+        found = mine.find { |a| a.ip == setting }
+        raise Error, "web.host is #{setting}, which isn't an address of this machine" unless found
+
+        others = mine.select { |a| a.ip != found.ip && private?(a.ip) && !a.interface.match?(SKIPPED) }
+        Choice.new(ip: found.ip, interface: found.interface, others: others, public: !private?(found.ip))
+      end
+
+      # This machine's IPv4 addresses on interfaces that are up, loopback
+      # left out, in the system's order.
+      def addresses(ifaddrs)
+        ifaddrs.filter_map do |ifa|
+          addr = ifa.addr
+          next unless addr&.ipv4?
+          next if ifa.flags.nobits?(Socket::IFF_UP) || ifa.flags.anybits?(Socket::IFF_LOOPBACK)
+
+          Address.new(ip: addr.ip_address, interface: ifa.name)
+        end.uniq(&:ip)
+      end
+
+      def private?(ip)
+        addr = ipv4(ip)
+        !addr.nil? && PRIVATE.any? { |net| net.include?(addr) }
+      end
+
+      def ipv4(text)
+        return nil unless text.to_s.match?(/\A\d{1,3}(\.\d{1,3}){3}\z/)
+
+        addr = IPAddr.new(text)
+        addr.ipv4? ? addr : nil
+      rescue IPAddr::Error
+        nil
+      end
+    end
+  end
+end