samagotchi 0.47.0 → 0.49.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 31cacb8f3d63a915a92684dcac667920837f96675f9c4256e3962cbfd95df5ef
-  data.tar.gz: 29668be85fcc4178f470f15d8f2a1d1745cccb2a4e0391649ef85f8b5a5ad9bd
+  metadata.gz: ca248891309ffde628ce6c03c2bbd35fa946f7fa669978c30d1478a0f236a920
+  data.tar.gz: 50e85c20fa0882c5caeeaf7a2c141dd46a443c5f725d60120e194ada9152871c
 SHA512:
-  metadata.gz: e4c46bb7eee9e046679b9d4ca15540b17f6b1e15f92756c3c55d7733fb8d313b3e5b12b5077027950dc7f1671d46a11d6aaac1aa72ce3d4668475e87aa0ebea3
-  data.tar.gz: 86e41f7cd8fe707cc8ad6914a72ce183b824f86d6bbc4c953a356ff9d5709776e49c0b254734f2e675061de8d26c2c66bfcd538fe9d8f28f5f4d7d727b7decbc
+  metadata.gz: e6ce68e65e80c48433bdb55706aaa19790ab6a140f81550f63420c1f4574d1e423a2dd356a01fda3534234331eacfb9a03151e3fa83b602d027d039ad44c76ab
+  data.tar.gz: a476e538ff5913c82625a18c8e23b822bc402f7ed206724debe65c95863a1ab7ab2606823befae4c44a0e265b3a8a45eafcf08c6b2215a27dab4bd6c03ac98ec

data/CHANGELOG.md

@@ -8,6 +8,53 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.49.0] - 2026-10-09
+
+### Added
+
+- Native Gemma 4 on llama.cpp (with `--mmproj`) sees images: `@path`, `read` on an image and the web's pasted images
+  reach it, as they do Qwen 3.6. Before, chi refused with "profile gemma4 has no image template yet".
+- Plugins: `ctx.frontend` says what runs the session: `:repl` (the REPL, `-p` without `--non-interactive`),
+  `:one_shot` (`-p --non-interactive`) or `:worker` (a session worker: the web, an attached TUI).
+
+### Changed
+
+- github-pr 0.4.0: line links read the PR's files (`gh api`) only in a session worker (the web, an attached chi), not
+  in the REPL, `chi -p` or a scratch session, whose answers no web page shows while they run. `bundles: github-pr:
+  line_links: always` reads in the REPL and `-p` too; `false` still turns it off. The PR lookup and attach are
+  unchanged. See [Line links](docs/context.md#line-links).
+
+### Fixed
+
+- Web: a command queued mid-turn (`/model X`) shows its bubble after the turn's answer once it runs, not among the
+  turn's rows above the answer.
+- A background task whose process exited and whose pid another process reused since no longer reads as running in
+  `task_list`, `task_get` and `task_wait` until a `task_stop`: each read checks the process's start time.
+- A continue that died after noting its moved delegates no longer notes them again when the new link's worker
+  finishes the move: `move.json` records who was told.
+- An attached chi watching a `-p --non-interactive` run says a question there was dismissed because no one could
+  answer it (`(dismissed: no one to answer in a non-interactive run)`), as the run itself does, not
+  `(question cancelled)`.
+
+Update with `chi update`: it updates github-pr (0.4.0: line links only where the web can show them). If you set
+`line_links: true` to get links in the REPL, set `line_links: always` instead.
+
+## [0.48.0] - 2026-10-09
+
+### Changed
+
+- Continuing a session moves its open delegates to the new link instead of refusing: running, waiting, live or with
+  an unreported reply, at any depth below. They stay unarchived, fold under the new link, and their reports (one
+  each, none lost or repeated) reach it; each gets a note naming its new parent. Only a delegate on an older chi's
+  worker (restart it) or open in a chi REPL still refuses the continue. See
+  [docs/sessions.md](docs/sessions.md#session-chains).
+  - Web: the continue toast counts the delegates that moved (`1 open delegate moved`); `POST /api/sessions` with
+    `continues` answers `moved: [ids]`.
+  - CLI: `chi send --new --continues` prints `started (continues 3fa2c1d0; 2 delegates moved)`.
+
+Update with `chi update` (no bundle changed), then restart `chi web`. A delegate whose worker started on an older
+chi refuses to move until it is restarted.
+
 ## [0.47.0] - 2026-10-09
 
 ### Added
@@ -2215,7 +2262,9 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.47.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.49.0...HEAD
+[0.49.0]: https://github.com/dm1try/samagotchi/compare/v0.48.0...v0.49.0
+[0.48.0]: https://github.com/dm1try/samagotchi/compare/v0.47.0...v0.48.0
 [0.47.0]: https://github.com/dm1try/samagotchi/compare/v0.46.1...v0.47.0
 [0.46.1]: https://github.com/dm1try/samagotchi/compare/v0.46.0...v0.46.1
 [0.46.0]: https://github.com/dm1try/samagotchi/compare/v0.45.0...v0.46.0

data/docs/configuration.md

@@ -904,7 +904,7 @@ Whether a model can see images is found out before a turn with images is sent:
 
 - a native llama.cpp host: `/props` must report `modalities.vision` (the server
   runs with `--mmproj`) and a media marker, and the prompt profile must know the
-  chat template's image wrapping (qwen36 does; gemma4 not yet);
+  chat template's image wrapping (qwen36 and gemma4 do);
 - mlx and oMLX hosts: no (not verified with recent chi versions);
 - an OpenAI-API host: a local llama.cpp's `/props`, else the host's model list
   (OpenRouter's `architecture.input_modalities`); when it doesn't say, the image

data/docs/context.md

@@ -258,13 +258,20 @@ show the answer as it is.
   So the first answer of a very short turn may come without links, and
   after a push links may be a few lines off until the next read. Without
   `gh` or its login, nothing is linked.
+- **Where it reads**: only in a session worker (the web, an attached chi),
+  whose answers the web shows while the session runs. The REPL and
+  `chi -p` read nothing (no `gh api` calls), so their answers have no links,
+  in the web too; a scratch session never reads. The PR itself is still
+  attached and its context still reaches the model everywhere.
 
-Turn it off:
+`line_links:` takes `false` (off), `true` (the default: a worker only) or
+`always` (the REPL and `chi -p` read too, so their answers are linked when
+you open the session in the web later):
 
 ```yaml
 bundles:
   github-pr:
-    line_links: false
+    line_links: false   # or always
 ```
 
 ## Safety

data/docs/internals/background-tasks.md

@@ -19,7 +19,7 @@ Behavior:
 
 - `execute`, `task_create` and the `!cmd` shell bang run the command in a non-login shell: `/bin/sh -c` on Linux; on macOS, when `/bin/zsh` is there, `/bin/zsh --emulate sh +o ignore_braces +o sh_glob -o bash_rematch +o bsd_echo -c` (macOS's `/bin/sh` is bash 3.2, which can't parse an apostrophe in a heredoc inside `"$( )"`, the usual commit message shape). That mode reads no rc files and keeps POSIX word splitting, unmatched globs left as is, `{1..3}`, `[[ … =~ (…) ]]` with `BASH_REMATCH`, arrays, `$'…'`, `&>` and echo expanding `\t`. Bash-only builtins and variables (`shopt`, `BASH_VERSION`, `${!prefix*}`, `read -p`) are not there.
 - Task metadata and output are persisted under `tmp/tasks/`.
-- A task record keeps its process's pid and start time (`pid_started`). Before `task_stop` signals, the pid must still lead its own process group and must not have started at another time; otherwise the pid was reused by another process, nothing is signalled and the task ends as failed. A start time that can't be read at that moment (a failed `ps`) falls back to the group check, as does a record without `pid_started` (from an older chi). `task_get`, `task_list` and `task_wait`'s polls check the group only (no `ps` per poll).
+- A task record keeps its process's pid and start time (`pid_started`). Before `task_stop` signals, the pid must still lead its own process group and must not have started at another time; otherwise the pid was reused by another process, nothing is signalled and the task ends as failed. A start time that can't be read at that moment (a failed `ps`) falls back to the group check, as does a record without `pid_started` (from an older chi). `task_get`, `task_list`, `task_wait`'s polls and the running-task lists (a cancelled turn's note, a worker's idle exit) make the same check, so a task whose pid was reused reads as exited (failed) at once, not as running until a `task_stop`; on macOS that is one `ps` per running task per check (~5 ms).
 - Task listing is workspace-scoped (current project only).
 - `task_get` returns metadata and `output_path`; use `read` for output contents.
 - `task_wait` accepts `timeout`, `tail_lines` (maximum 100), and `done_pattern` (a regular expression string).

data/docs/plugins.md

@@ -505,6 +505,7 @@ full label, `plugin.rb (bundle my-bundle)`.
 | `ctx.repo_root` | the git checkout holding `cwd`, or nil |
 | `ctx.scratch?` | whether the session is a `chi scratch` one (deleted when it ends) |
 | `ctx.delegate?` | whether the session is a delegate child: a task another session handed over |
+| `ctx.frontend` | what runs the session, read now: `:repl` (the REPL, `-p` without `--non-interactive`), `:one_shot` (`-p --non-interactive`: one turn, then exit) or `:worker` (a session worker: the web, an attached TUI). Only a worker's answers reach the web while it runs; a REPL's show there once the session is opened. Until the host sets it (while the plugins load, inside `Engine.new`) it reads `:one_shot`, so read it in hooks and init tasks, not in `register` |
 | `ctx.fork?` | whether the session is a fork (`ctx.sessions.fork`): it has a parent but isn't a delegate child, and started from a conversation, so its first prompt isn't its first user message |
 | `ctx.model` | the model the session runs on now: its resolved ref (`host:id`), right after `/model` too |
 | `ctx.model_key` | that model's memory overlay key (`<name>.<key>.md`, what `memory_write current_model_only` writes) |
@@ -1240,8 +1241,9 @@ nothing without `gh`, a repository or an open PR), and resolves PR URLs for
 `chi context add` and the web's "+ URL". Its script prints the PR as text
 and a summary of what changed in counts, authors and states only; it wakes
 the session for a review requesting changes, checks turning red, or the PR
-merged or closed. In the web, a `path:line` in an answer links to that line
-of the session's PR ([Line links](context.md#line-links)). `auto_attach:
+merged or closed. In the web, a `path:line` in a worker's answer links to
+that line of the session's PR ([Line links](context.md#line-links); `line_links:
+always` for the REPL and `chi -p` too). `auto_attach:
 offer` asks with a card first (`/pr-attach N`, `/pr-decline N`), `off`
 attaches nothing ([Attach, offer or off](context.md#attach-offer-or-off)).
 See [Attached context](context.md#github-prs-the-github-pr-bundle).

data/docs/sessions.md

@@ -182,7 +182,7 @@ chi send --new --continues last:3fa2 -m "new day"      # the next link of 3fa2's
 - Exit codes with `--wait`: 0 answered; 3 the turn waits for an answer from you (a question, a hook's question, a guardrail approval, or the step-limit question: see [chi as a sub-agent](sub-agent.md#the-step-limit)), and the session keeps waiting: stderr gets the whole question (`waiting for an answer (approval): …`, its text, the numbered options, whether free text is allowed) and how to answer it (`chi answer ID --question QID --option N`, or `chi --attach ID`, the web); 4 `--timeout S` passed with the turn still running (it goes on; wait again); 1 the turn ended without a reply (canceled, failed or empty), the worker failed or vanished, or the session was stopped; 130 on Ctrl-C, which leaves the turn running (`still running: chi --attach ID`). There is no default timeout.
 - `--format json` (with `--wait`) prints one JSON object on stdout however the wait ends, for a script or a parent agent (see [chi as a sub-agent](sub-agent.md)): `{"status":"answered","session_id":…,"text":…}`; `{"status":"question",…,"question":{"id","kind","header","text","options","multi_select","allow_freeform","approval"},"answer_with":"chi answer ID --question QID --option N"}`, where `kind` is `question` (the model's), `hook` or `approval` (with the tool, command, cwd, rule, reason and offered scopes); `{"status":"running",…,"detail":…}` (exit 4, and on Ctrl-C); and `failed`, `canceled`, `no_answer`, `error`, `worker_gone` or `stopped` with a `detail` line (exit 1); `failed` adds `error_kind` and `retryable`, `canceled` adds `cancel_reason` and `stopped_by`, when known. A failure before the wait (no such session, a busy one) is `error` too. A usage error (exit 2) prints no JSON.
 - `--wait ID` with no message (no `-m`, nothing piped) sends nothing: it waits for the session's next reply and prints and exits as above. A running session is fine (that is the point), so after exit 3, 4 or 130 an agent waits again this way while the user answers in the web or `chi --attach`; the question pending when it starts doesn't count again. An idle session with no worker waits until something wakes one. With `--new`, or two ids, it is a usage error (exit 2).
-- `--continues ID` (with `--new`) starts the next link of that session's chain instead (see *Session chains*): in its folder, on its model and LLM context, so `--dir`, `--model` and `--llm-context*` are refused beside it; `ID` may be a prefix or `last:ID`, the chain's latest link. Without a message the new link starts idle; `--wait` then has nothing to wait for (a usage error). It prints `<full id>  started (continues 3fa2c1d0)`; a refusal (continued already, naming the next link; a delegate still open; a turn running) is `chi send: refused: …`, exit 1.
+- `--continues ID` (with `--new`) starts the next link of that session's chain instead (see *Session chains*): in its folder, on its model and LLM context, so `--dir`, `--model` and `--llm-context*` are refused beside it; `ID` may be a prefix or `last:ID`, the chain's latest link. Without a message the new link starts idle; `--wait` then has nothing to wait for (a usage error). It prints `<full id>  started (continues 3fa2c1d0)`, with `; 2 delegates moved` inside the parentheses when open delegates moved to it; a refusal (continued already, naming the next link; an open delegate that can't move; a turn running) is `chi send: refused: …`, exit 1.
 - The 16 KiB cap applies: `git diff | chi send --new …` on a big diff is refused; name the branch in the message instead and let the session read it.
 - A session nobody attaches to stalls at its first question or guardrail ask until someone answers it (`chi answer`, the web, `chi --attach`), and its worker stays up meanwhile: it doesn't idle-exit while a question waits (`chi sessions list` shows it as `waiting`; `chi sessions stop ID` frees it). Otherwise it idle-exits after `session.idle_exit_minutes` like any worker. These are ordinary sessions: delete them like any other.
 
@@ -195,10 +195,12 @@ A session can **continue** an earlier one: "the next day of the same routine" (a
 - **What it copies:** the previous link's folder, its model (the name it was typed as, so an alias holds) and its own LLM context values. Its preview is the previous link's (until its first message is saved), unless it starts with a message.
 - **The carry note:** the new link starts with a context note from `session chain` (shown in its transcript as `note from session chain`), queued before its worker spawns, so its first turn sees it: `This session continues 3fa2c1d0 (2026-10-08), the previous link of its chain. Its recap, as of 2026-10-08 18:02:` and the previous link's recap (`recap.json`; cut at 8000 characters). No recap (fewer user turns than a recap needs, recaps off, none written in time): `… It left no recap.` Never more than the recap: no transcript. An idle new link holding only the note is kept, not discarded as empty.
 - **The recap first:** a previous link with a live worker is asked for a recap (the Bridge's `POST /recap`) and given up to 30 s to write it; one with none wrote its recap when its worker left.
-- **The previous link is archived** before the new one starts, by the archive's own rules (see *Archiving a session*): a turn running, a prompt queued or the step-limit question refuse it, a live idle worker is stopped, a plain REPL's session is refused. Its delegates are archived with it, as any archive does; so a continue is **refused while a delegate is still open** (at any depth, checked again after the recap wait): running, waiting for an answer, with a live worker, or with a reply its parent wasn't given (`ContinueRefused`, naming them). Wait for them, stop or archive them, then continue.
+- **The previous link is archived** before the new one starts, by the archive's own rules (see *Archiving a session*): a turn running, a prompt queued or the step-limit question refuse it, a live idle worker is stopped, a plain REPL's session is refused. Its finished delegates are archived with it, as any archive does.
+- **Its open delegates move to the new link** instead: each direct delegate that is running, waiting for an answer, has a live worker or a reply its parent wasn't given, or has such a delegate below it (checked again after the recap wait, so one delegated meanwhile moves too). It moves with its own delegates, stays unarchived, and from then on is the new link's: its card folds under the new link, its reports ring the new link (an idle one runs a wake turn for them, as for its own delegates), `delegate_result` and the `⑂` chip count it there, and what its parent was already told (`delegates.json`) and any report still waiting come along, so nothing is reported twice. A moved delegate gets a context note from `session chain`, `Your parent session is now 4b7e9a01 (…), the next link of its session chain: …`, as its system prompt keeps naming the parent it started with. The move writes `<child>/parent.json` (`{parent_id, from, at}`) beside the child's session file, never the file itself, so a live child worker saving its own copy changes nothing; every reader applies it (a later move overwrites it; it is never removed). A continue is **refused for an open delegate that can't move** (`ContinueRefused`, naming it): one whose live worker runs an older chi (`older chi worker 0.46.1; restart it`: `chi sessions restart <id>`, or stop it) or that is open in a chi REPL (close it there). An older `chi web` or CLI still running shows a moved delegate under the archived link until it is restarted.
+- **If the continue fails part-way:** a new link that fails to start gives its moved delegates back before it is deleted (each gets a note saying so; its worker is stopped first, if one started, and a worker that won't stop is reported, the link left), with any report one of them rang it with meanwhile; the previous link, back in the lists, is woken for reports waiting. A continue that dies in the middle leaves a `move.json` in the new link's folder: the new link's next worker finishes that move (only the delegates it names, and without a second note to one already told) as it starts. Until the new link's own worker holds it, a ring from a moved delegate doesn't start another (a `starting` marker in its folder, which that worker removes; a stale one, over 60 s old or from a process that is gone, is ignored). An open delegate below an archived delegate refuses the continue (`under archived …`): unarchive that one, or archive this one.
 - **Refused too:** a link that is continued already (naming the link that continues it; continue that one, or `last:<id>`), a previous link whose folder is gone, and one whose model names a host config.yml no longer has. A refusal starts nothing and archives nothing; a new link that fails to start puts back what was archived. Every refusal that can be known up front (the archive's ones included) comes before the recap wait. One continue of a session runs at a time (a lock in its folder; other chains don't wait), so a double click finds the first one's link and is refused, while a `last:<id>` continue that waited follows the chain to its new end.
-- **Web:** `POST /api/sessions` takes `continues: "<id, prefix or last:id>"`, with `idle: true` (a new link waiting for its first message, previewed by the previous link's, or `preview`) or a `prompt`, and not `dir`, `model` or `llm_context` (400 `invalid_continues`: the previous link's are taken). 201 is the new session's summary, `continues` set; 404 `not_found`; 400 `ambiguous_id` for a prefix of several sessions, `invalid_model` for a model whose host is gone; 409 `continued` with `next_id` (the link that continues it already, which the page opens instead), `open_children` with `ids`, `folder_gone`, `busy`, `scratch` or `owned_by_tui`. Every session summary carries `continues`.
-- **The page:** the info bar's `continue →` continues the open session (`continues: <id>, idle: true`; it reads `continuing…` through the recap wait) and opens the new link with `Continue where we left off.` in the composer, not sent (the same line for every chain; a draft already there stays instead); the previous link is archived, a toast says so. A link continued already has no `continue →`: its `→` link goes to the next link (a stale page's continue answered 409 `continued` opens `next_id`). A continue refused for open delegates shows a toast that names each one (its preview and why the server says it is open: `running`, `waiting`, `live`, `unreported reply`), each a link to its page; any other refusal shows the server's words. The info bar of a link carries `← 2026-10-08` (the previous link's day) and, on an earlier link, `2026-10-10 →`, each a link with its preview and id in the tooltip. A link whose title is the opener and nothing else (its first message once sent) shows its chain's first link's title instead, on its card, in the popover and in its info bar's title line, display only (its messages and data keep the opener; its own title when the first link is gone). The lists fold a chain into the card of its latest listed link, whatever the earlier links' archived state (typing in an archived link brings it back, folded there still), their delegates with them: the card's `↩ day N` chip (`day N of M` when later links aren't listed) opens a popover of the other links, newest first (`day N`, its date, its recap's first sentence or its preview, `archived`), a click opens one; the chip shows a live dot or `waiting` for a link that has a worker or waits on the user, and a waiting link puts its chain's card first. All sessions folds nothing while a search is typed or "include archived" is on: every link is a card of its own then, its chip `day N of M`, with its own delegates folded in, so a search finds an earlier link and its delegates.
+- **Web:** `POST /api/sessions` takes `continues: "<id, prefix or last:id>"`, with `idle: true` (a new link waiting for its first message, previewed by the previous link's, or `preview`) or a `prompt`, and not `dir`, `model` or `llm_context` (400 `invalid_continues`: the previous link's are taken). 201 is the new session's summary, `continues` set, with `moved`: the ids of the delegates that moved to it (`[]` for none); 404 `not_found`; 400 `ambiguous_id` for a prefix of several sessions, `invalid_model` for a model whose host is gone; 409 `continued` with `next_id` (the link that continues it already, which the page opens instead), `open_children` with `ids` (open delegates that can't move), `folder_gone`, `busy`, `scratch` or `owned_by_tui`. Every session summary carries `continues`.
+- **The page:** the info bar's `continue →` continues the open session (`continues: <id>, idle: true`; it reads `continuing…` through the recap wait) and opens the new link with `Continue where we left off.` in the composer, not sent (the same line for every chain; a draft already there stays instead); the previous link is archived, a toast says so (`Continued 3fa2c1d0 in 4b7e9a01; 3fa2c1d0 is archived; 1 open delegate moved`), and a moved delegate's card folds under the new link. A link continued already has no `continue →`: its `→` link goes to the next link (a stale page's continue answered 409 `continued` opens `next_id`). A continue refused for open delegates that can't move shows a toast that names each one (its preview and what the server says to do: `older chi worker 0.46.1; restart it`, `open in a chi REPL; close it there`), each a link to its page; any other refusal shows the server's words. The info bar of a link carries `← 2026-10-08` (the previous link's day) and, on an earlier link, `2026-10-10 →`, each a link with its preview and id in the tooltip. A link whose title is the opener and nothing else (its first message once sent) shows its chain's first link's title instead, on its card, in the popover and in its info bar's title line, display only (its messages and data keep the opener; its own title when the first link is gone). The lists fold a chain into the card of its latest listed link, whatever the earlier links' archived state (typing in an archived link brings it back, folded there still), their delegates with them: the card's `↩ day N` chip (`day N of M` when later links aren't listed) opens a popover of the other links, newest first (`day N`, its date, its recap's first sentence or its preview, `archived`), a click opens one; the chip shows a live dot or `waiting` for a link that has a worker or waits on the user, and a waiting link puts its chain's card first. All sessions folds nothing while a search is typed or "include archived" is on: every link is a card of its own then, its chip `day N of M`, with its own delegates folded in, so a search finds an earlier link and its delegates.
 - **CLI:** `chi send --new --continues (ID|PREFIX|last:ID) [-m TEXT]` (see *Starting a session*).
 - **Which link:** an id, a unique prefix, or `last:<id or prefix>`, the latest link of the chain that session is in. It walks the links that still exist: a deleted link in the middle (`chi sessions delete`, the retention sweep of an unarchived one) ends the walk before it, so `last:` of an earlier link then names that earlier link, and continuing it starts a second line beside the links after the gap; name a link after the gap instead. A trigger names the chain this way: `chi send` to an archived link would bring it back (a human's input), not continue the chain.
 
@@ -219,7 +221,7 @@ The `delegate` tool hands a task to a **child session**: an ordinary chi session
   - No relay where the parent can't host one (a `--no-shared` REPL, `--non-interactive`) or isn't waiting (`wait: false` until the next `delegate_result`): the approval waits on the child, with the web's bell, and the result's question block says to deny it or leave it for the user. The model's own questions and hooks' questions come back to the model as before. A grandchild's (a plugin's `ctx.sessions.fork` can make one) is relayed hop by hop: `delegate ab12 → cd34 asks:`.
 - **Delegate reports: a child's reply comes back by itself.** When a child ends a turn that was its parent's (its task, a follow-up, a continue the parent answered, a reminder: not a turn its user typed into it directly), it rings the parent: a small file in the parent's `children/` dir, written after the child's turn is saved. So does a question the parent's model decides (the child's own `ask_user_question`, the step-limit continue; not an approval or a hook's question, which the user answers on the child's card), the turn after such a question whoever starts it, and the child's worker crashing. The parent reads the child as `delegate_result` would and hands its model a **report**: the same text (`session:`, `status:`, the reply), under its own header (`[Delegate report, delivered by chi …; not your user's message. Tell your user what it found …]`), as an input message with `source: "delegate_report"`.
   - Parent mid-turn: the report joins the turn at its next iteration boundary (a "delegate report" bubble in the web, `delegate report> ab12cd34 answered: …` in the attached terminal).
-  - Parent idle: it runs a turn for the report (a *wake turn*, `last_turn.origin: "delegate_report"`) within the worker's 5 s tick, or wakes a worker for it when the parent's has idle-exited. Several reports that wait together are one turn and one message. A stopped, archived or scratch parent, or one open in a `--no-shared` REPL, is not woken: the rings wait on disk and join the next turn it runs (the user's message first). A worker just started (`chi send` to a stopped parent) runs no wake turn in its first 2 s, so the message it was started for goes first.
+  - Parent idle: it runs a turn for the report (a *wake turn*, `last_turn.origin: "delegate_report"`) within the worker's 5 s tick, or wakes a worker for it when the parent's has idle-exited. Several reports that wait together are one turn and one message. A stopped, archived or scratch parent, or one open in a `--no-shared` REPL, is not woken: the rings wait on disk and join the next turn it runs (the user's message first). An archived parent that a later link continues wakes that link instead, which takes the rings its moved delegates left there (see *Session chains*). A worker just started (`chi send` to a stopped parent) runs no wake turn in its first 2 s, so the message it was started for goes first.
   - The parent's cursor per child (the newest reply it was given and the child as it was then) is in its `delegates.json`, shared with `delegate_result` and `wait: true`: a reply the model already had is never reported again, also after the parent's worker restarts. A ring is deleted only when the turn that took its report stays in the conversation (completed, canceled, or failed but kept: one that got to tool steps, or a reminder or continue turn, which keep what they read); a turn rolled back (a failed one that got nowhere, a canceled continue turn) leaves it for the next one (and the report isn't handed back to the composer). So the model reads each report once, unless a later `!rollback` erases a kept turn (what it read goes with it).
   - Limits: `session.max_wakes` (default `10`) wake turns in a row with no human input; past it the reports wait for the next message and the UIs show `N delegate reports waiting; they join your next message`. A wake turn that fails, or is stopped before the model call (a Stop, a `before_turn` hook's cancel), pauses wakes until the next human input; its reports' rings stay, so they join that input's turn, and a failure's note tells the model so. A continue offer waiting in the parent takes the reports into its continue turn instead.
   - `session.delegate_reports`: `wake` (default), `queue` (no wake turns: reports join the parent's next turn) or `off` (no rings; only `delegate_result` asks, as before). Env `SAMAGOTCHI_SESSION_DELEGATE_REPORTS`, `SAMAGOTCHI_SESSION_MAX_WAKES`.

data/lib/samagotchi/bridge.rb

@@ -474,7 +474,9 @@ module Samagotchi
     # than a version.
     # restart: POST /exit takes "restart": true (WorkerIdleExit#hold_for_restart).
     # task_stop: POST tasks/stop (#handle_task_stop), the web's stop-task button.
-    FEATURES = %w[restart task_stop].freeze
+    # reparent: the worker reads Session::PARENT_FILE (its rings, each turn's
+    # start), so a continue may move it to the chain's new link (ChildMove).
+    FEATURES = %w[restart task_stop reparent].freeze
 
     # The routes, by method and what follows /session/:id/: a handler takes
     # the session id and the request body and returns [headers, status, body].

data/lib/samagotchi/bundles/github-pr/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: github-pr
-version: 0.3.3
+version: 0.4.0
 scope: system
 description: Attaches the branch's open GitHub pull request to a session as context (and any PR URL with chi context add or the web's "+ URL"); the agent gets a note when reviews, comments, checks or its state change; in the web, a path:line in an answer links to that line of the PR; the auto_attach setting can offer the PR with a card first, or attach nothing
 trust_level: reviewed
@@ -11,7 +11,7 @@ needs:
   hint: brew install gh, then gh auth login
 plugin:
   file: plugin.rb
-  sha256: sha256:f68b53bfb552e35c9b151ee42cc10c07923481fc3d5496f023422e388df6719a
+  sha256: sha256:2510f8e5bfc77b2a6343b47d56bf6be9da09fd8741f52928462945a55d83f0ce
 scripts:
   pr_context.rb: sha256:a883d2780e89c68c0d7b6d5e0fcb22c273f17bb167e79064e0e99db6bd2ee6f0
 context_providers:

data/lib/samagotchi/bundles/github-pr/plugin.rb

@@ -23,8 +23,11 @@ require "tmpdir"
 # model's text stays as it was. The after_turn hook links from a per-PR
 # cache and never runs gh (the web holds the answer until the hooks are
 # done); before_turn, before_generation and the init task fill the cache
-# off the turn's thread. `bundles: github-pr: line_links: false` turns it
-# off.
+# off the turn's thread (`gh api`), in a session worker only: the REPL and
+# -p --non-interactive show no web page while they run (ctx.frontend; a chi
+# without it counts as a worker), and a scratch session never fetches.
+# `bundles: github-pr: line_links:` false turns it off, "always" fetches in
+# the REPL and -p too (still not for a scratch session).
 #
 # `bundles: github-pr: auto_attach:` says what the init task does with the
 # branch's open PR: `attach` (the default), `offer` (a card with Attach and
@@ -37,6 +40,8 @@ class Plugin
   COMMAND_SECONDS = 20
   # before_generation looks for a newly attached PR at most this often.
   GENERATION_CHECK_SECONDS = 30
+  # line_links' values: off, a worker's only (the default), every frontend.
+  LINE_LINKS_MODES = { false => :off, true => :worker, "always" => :always }.freeze
   # auto_attach's values (YAML's bare true/false: attach/off).
   AUTO_ATTACH_MODES = { "attach" => :attach, "offer" => :offer, "off" => :off, true => :attach, false => :off }.freeze
   # /pr-attach and /pr-decline take a PR number (`42` or `#42`).
@@ -50,6 +55,7 @@ class Plugin
     @cache = PrCache.new
     @generation_checked_at = nil
     @warned_mode = false
+    @warned_line_links = false
   end
 
   def register(chi)
@@ -58,13 +64,13 @@ class Plugin
       # Inline (an init task has its own thread), whatever the attach
       # returned (attached already, a child, a scratch session), and after
       # it, so a PR it just attached is warm for the first answer.
-      refresh(ctx, attached_prs(ctx)) if line_links?(ctx)
+      refresh(ctx, attached_prs(ctx)) if prefetch?(ctx)
       summary
     end
     chi.on(:before_turn) do |event, ctx|
       # The prompt too: messages is the history before this turn, and a
       # delegate child's task is its first prompt.
-      kick(ctx, attached_prs(ctx) + PrRef.from_messages(event[:messages], prompt: event[:prompt])) if line_links?(ctx)
+      kick(ctx, attached_prs(ctx) + PrRef.from_messages(event[:messages], prompt: event[:prompt])) if prefetch?(ctx)
       log_first_prompt(event, ctx)
     end
     chi.command("/pr-attach", "Attach the PR this session was offered: /pr-attach 42", anytime: true) do |args, ctx|
@@ -150,7 +156,34 @@ class Plugin
 
   private
 
-  def line_links?(ctx) = ctx.settings["line_links"] != false
+  # `bundles: github-pr: line_links:`: :off, :worker (true or unset) or
+  # :always; an unknown value (a quoted "false") is :worker, logged once.
+  def line_links_mode(ctx)
+    value = ctx.settings["line_links"]
+    return :worker if value.nil?
+
+    LINE_LINKS_MODES.fetch(value.is_a?(String) ? value.strip.downcase : value) do
+      ctx.log.warn(:pr_line_links_unknown, value: value.to_s[0, 40]) unless @warned_line_links
+      @warned_line_links = true
+      :worker
+    end
+  end
+
+  def line_links?(ctx) = line_links_mode(ctx) != :off
+
+  # Whether to fetch PR data for line links (gh api): not for a scratch
+  # session (gone at exit), and by default only in a session worker, the
+  # one frontend whose answers the web shows while it runs. A chi before
+  # ctx.frontend (0.49.0) counts as a worker.
+  def prefetch?(ctx)
+    return false if ctx.scratch?
+
+    case line_links_mode(ctx)
+    when :off then false
+    when :always then true
+    else (ctx.respond_to?(:frontend) ? ctx.frontend : :worker) == :worker
+    end
+  end
 
   def offer_card_id(number) = "github-pr-offer-#{number}"
 
@@ -275,7 +308,7 @@ class Plugin
   # A PR attached while the turn runs (a parent attaching it right after
   # `delegate wait: false`), checked at most every GENERATION_CHECK_SECONDS.
   def check_attached(ctx)
-    return unless line_links?(ctx)
+    return unless prefetch?(ctx)
     return if @generation_checked_at && now - @generation_checked_at < GENERATION_CHECK_SECONDS
 
     @generation_checked_at = now

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.47.0
+version: 0.49.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/child_move.rb

@@ -0,0 +1,249 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "time"
+require_relative "atomic_file"
+require_relative "session"
+require_relative "session_inbox"
+require_relative "worker_sidecar"
+require_relative "log"
+require_relative "tools/delegate_cursor"
+
+module Samagotchi
+  # Loaded on first use: session_manager requires terminal_ui, which
+  # requires KernelLoop and so the tools (a require cycle otherwise).
+  autoload :SessionManager, File.expand_path("session_manager", __dir__)
+
+  # A continue moving the previous link's open delegates to the chain's new
+  # link (SessionManager.continue_session), instead of archiving them with
+  # it. A moved child gets a parent override (Session::PARENT_FILE), never a
+  # rewritten session file, so its live worker saving a stale copy changes
+  # nothing; its worker reads the override for its rings and at each turn's
+  # start (Bridge::FEATURES "reparent").
+  #
+  # #apply runs between the new link's save and its worker's spawn, while
+  # the link is #mark_starting (a ring from a moved child must not spawn a
+  # second worker from the child's process until the link's own holds it).
+  # Each step is idempotent,
+  # and an intent file (INTENT_FILE) in the new link's folder names the move
+  # until it is done: a worker that starts and finds one finishes the move
+  # (#adopt), and a failed continue moves the same children back.
+  module ChildMove
+    # <new link dir>/move.json: {from, ids, noted}, while a move is under way.
+    INTENT_FILE = "move.json"
+    # <new link dir>/starting: {pid, at}, from the move to the worker's spawn.
+    STARTING_FILE = "starting"
+    # A starting marker older than this, or whose process is gone, is left
+    # over from a continue that died: it holds nothing back.
+    STARTING_STALE = 60.0
+    # Who the note to a moved child is from (ContextNote's label).
+    NOTE_SOURCE = "session chain"
+    # What a live child's worker must name in its sidecar to be moved.
+    FEATURE = "reparent"
+
+    # What a continue does with the previous link's children: +move+ the
+    # direct children whose subtree has an open node (they go to the new
+    # link, their subtrees with them), +refuse+ the open ones it can't move
+    # (SessionManager::OpenChild, why: an older chi worker or a chi REPL).
+    Plan = Data.define(:move, :refuse)
+    # A move under way: from the session, the children moved, and those
+    # already sent their note (so a move finished again notes no one twice).
+    Intent = Data.define(:from, :ids, :noted) do
+      def initialize(from:, ids:, noted: []) = super
+    end
+
+    module_function
+
+    # @param open [Array<SessionManager::OpenChild>] the previous link's open
+    #   nodes, at any depth (SessionManager.open_children)
+    # @return [Plan]
+    def plan(prev_id, open:, state_dir:)
+      open_ids = open.map(&:id)
+      move = []
+      refuse = []
+      SessionManager.children_of(prev_id, state_dir: state_dir).each do |row|
+        subtree = [row[:id], *SessionManager.descendant_ids(row[:id], state_dir)]
+        next if (subtree & open_ids).empty?
+
+        if row[:archived]
+          # An open delegate below an archived one: the archive's cascade
+          # would take it, the move doesn't (only unarchived ones move).
+          refuse.concat(open.select { |c| subtree.include?(c.id) }.map do |c|
+            c.with(why: "under archived #{row[:id][0, 8]}; unarchive that one or archive this one")
+          end)
+          next
+        end
+
+        why = unmovable(row[:id], state_dir: state_dir)
+        if why
+          refuse << SessionManager::OpenChild.new(id: row[:id], short_id: row[:id][0, 8], why: why)
+        else
+          move << row[:id]
+        end
+      end
+      Plan.new(move: move, refuse: refuse)
+    end
+
+    # Why a child's live owner keeps it from moving: a chi REPL holds its
+    # own Session and never reads the override; a worker on an older chi
+    # neither. A worker with no sidecar yet is starting, on the newest chi
+    # installed (SessionManager.worker_command): it moves.
+    # @return [String, nil]
+    def unmovable(child_id, state_dir:)
+      owner = SessionManager.session_owner(child_id, state_dir: state_dir) or return nil
+      return "open in a chi REPL; close it there" if owner.tui?
+
+      sidecar = WorkerSidecar.live(Session.session_dir(child_id, state_dir: state_dir), unlink: false)
+      return nil if sidecar.nil? || sidecar.features.include?(FEATURE)
+
+      "older chi worker#{" #{sidecar.version}" if sidecar.version}; restart it"
+    end
+
+    # Move +ids+ (direct children of +from+) to +to+: the intent, the
+    # cursors +to+ lacks (delegates.json), the overrides, the rings waiting
+    # in +from+'s children/, a note to each child, then the intent goes.
+    # Safe to run again on the same move: the intent records each child
+    # noted, and a run finishing it (#adopt) notes only the rest. A crash
+    # between a note and its record notes that child twice (better than
+    # none).
+    # @param undo [Boolean] a failed continue moving them back: its note says so
+    def apply(ids, from:, to:, state_dir:, undo: false)
+      return if ids.empty?
+
+      intent = Intent.new(from: from, ids: ids)
+      left = read_intent(to, state_dir: state_dir)
+      intent = intent.with(noted: left.noted & ids) if left && left.from == from && left.ids.sort == ids.sort
+      write_intent(to, intent, state_dir: state_dir)
+      copy_cursors(ids, from: from, to: to, state_dir: state_dir)
+      ids.each { |id| Session.reparent(id, to: to, from: from, state_dir: state_dir) }
+      move_rings(ids, from: from, to: to, state_dir: state_dir)
+      (ids - intent.noted).each do |id|
+        note_child(id, to: to, undo: undo, state_dir: state_dir)
+        intent = intent.with(noted: intent.noted + [id])
+        write_intent(to, intent, state_dir: state_dir)
+      end
+      clear_intent(to, state_dir: state_dir)
+      Log.info(:worker, undo ? "delegates_moved_back" : "delegates_moved", from: from[0, 8], to: to[0, 8], count: ids.size)
+    end
+
+    # The rings in +from+'s children/ from children whose parent is +to+
+    # now (a failed continue's link, before it is deleted: a child that
+    # read the override just before the undo rang it).
+    def return_rings(from:, to:, state_dir:)
+      ids = SessionInbox.find_ring_files(Session.session_dir(from, state_dir: state_dir)).filter_map do |file|
+        id = SessionInbox.read_ring(file)&.dig(:child_id)
+        id if Session.valid_id?(id) && Session.parent_override(id, state_dir: state_dir) == to
+      end
+      move_rings(ids.uniq, from: from, to: to, state_dir: state_dir)
+    end
+
+    # A worker starting for +session_id+ finishes a move its continue left
+    # half done (the intent file is still there): only those children, never
+    # the predecessor's others.
+    # @return [Array<String>] the ids moved, [] with no intent
+    def adopt(session_id, state_dir:)
+      intent = read_intent(session_id, state_dir: state_dir) or return []
+      apply(intent.ids, from: intent.from, to: session_id, state_dir: state_dir)
+      intent.ids
+    rescue StandardError => e
+      Log.warn(:worker, "delegates_adopt_failed", sid: session_id[0, 8], error: e.class.name, msg: e.message)
+      []
+    end
+
+    # @return [Intent, nil]
+    def read_intent(session_id, state_dir:)
+      data = JSON.parse(File.read(File.join(Session.session_dir(session_id, state_dir: state_dir), INTENT_FILE)))
+      return nil unless data.is_a?(Hash) && Session.valid_id?(data["from"]) && data["ids"].is_a?(Array)
+
+      noted = data["noted"].is_a?(Array) ? data["noted"].select { |id| Session.valid_id?(id) } : []
+      Intent.new(from: data["from"], ids: data["ids"].select { |id| Session.valid_id?(id) }, noted: noted)
+    rescue JSON::ParserError, SystemCallError
+      nil
+    end
+
+    def write_intent(session_id, intent, state_dir:)
+      dir = Session.session_dir(session_id, state_dir: state_dir)
+      FileUtils.mkdir_p(dir)
+      AtomicFile.write(File.join(dir, INTENT_FILE), JSON.generate({ "from" => intent.from, "ids" => intent.ids, "noted" => intent.noted }))
+    end
+
+    def clear_intent(session_id, state_dir:)
+      FileUtils.rm_f(File.join(Session.session_dir(session_id, state_dir: state_dir), INTENT_FILE))
+    end
+
+    def copy_cursors(ids, from:, to:, state_dir:)
+      cursors = Tools::DelegateCursors.read(from, state_dir: state_dir).slice(*ids)
+      Tools::DelegateCursors.merge(to, cursors, state_dir: state_dir)
+    end
+
+    # A ring keeps its file name (its time orders the rings).
+    def move_rings(ids, from:, to:, state_dir:)
+      rings = SessionInbox.find_ring_files(Session.session_dir(from, state_dir: state_dir)).select do |file|
+        ids.include?(SessionInbox.read_ring(file)&.dig(:child_id))
+      end
+      return if rings.empty?
+
+      dir = File.join(Session.session_dir(to, state_dir: state_dir), SessionInbox::CHILDREN_DIR)
+      FileUtils.mkdir_p(dir)
+      rings.each do |file|
+        File.rename(file, File.join(dir, File.basename(file)))
+      rescue Errno::ENOENT
+        nil # taken meanwhile
+      end
+    end
+
+    # The child's system prompt names the parent it started with for its
+    # whole life (a prompt-cache miss each time it changed): a note tells a
+    # running one where its notes and reports go now.
+    def note_child(child_id, to:, state_dir:, undo: false)
+      text = if undo
+               "Your parent session is #{to[0, 8]} (#{to}) again: the continue that moved you to its next link " \
+                 "failed. Send notes there, and your reports reach it."
+             else
+               "Your parent session is now #{to[0, 8]} (#{to}), the next link of its session chain: send notes " \
+                 "there, and your reports reach it."
+             end
+      SessionInbox.write_note(child_id, text: text, source: NOTE_SOURCE, state_dir: state_dir)
+    end
+
+    # Hold off a worker for the continue's new link (#starting?) until its
+    # own worker holds it: written before the move, removed by that worker
+    # once it has the owner lock (Worker#start).
+    def mark_starting(session_id, state_dir:)
+      dir = Session.session_dir(session_id, state_dir: state_dir)
+      FileUtils.mkdir_p(dir)
+      AtomicFile.write(File.join(dir, STARTING_FILE), JSON.generate({ "pid" => Process.pid, "at" => Time.now.iso8601(3) }))
+    end
+
+    def clear_starting(session_id, state_dir:)
+      FileUtils.rm_f(File.join(Session.session_dir(session_id, state_dir: state_dir), STARTING_FILE))
+    end
+
+    # Whether a continue is moving delegates to +session_id+ right now: its
+    # marker is there, fresh, and the process that wrote it runs.
+    def starting?(session_id, state_dir:)
+      file = File.join(Session.session_dir(session_id, state_dir: state_dir), STARTING_FILE)
+      return false unless File.exist?(file)
+
+      data = JSON.parse(File.read(file))
+      return false if Time.now - Time.iso8601(data["at"].to_s) > STARTING_STALE
+
+      process_alive?(data["pid"].to_i)
+    rescue JSON::ParserError, ArgumentError, SystemCallError
+      false
+    end
+
+    # Signal 0 only asks whether the process exists.
+    def process_alive?(pid)
+      return false unless pid.positive?
+
+      Process.kill(0, pid)
+      true
+    rescue Errno::ESRCH
+      false
+    rescue Errno::EPERM
+      true
+    end
+  end
+end