samagotchi 0.5.1 → 0.7.0

data/lib/samagotchi/bundles/loop-guard/plugin.rb

@@ -11,18 +11,185 @@
 # before_turn resets them (a new user message can make an old call right
 # again); steering merged mid-turn does not.
 #
+# It also watches the model's thinking while it streams (the
+# :generation_progress hook): thinking that goes round in the same few
+# sentences is cut (stop_generation) and the model asked again; if the
+# retry loops too, the turn is stopped with a card. See ThinkingWatch.
+#
 # Settings (config.yml, bundles: loop-guard:):
 #   deny_after: 2      same call + same result this many times -> deny the next
 #   stop_after: 4      stop the turn at this many loop-guard denies
 #   ignore_tools: [task_wait, task_get, delegate_result, list_sessions, list_reminders]
 #   mode: deny         deny | notify (warn once per call, never deny or stop)
+#   thinking:          the thinking watch (ThinkingWatch::DEFAULTS)
+#     watch: true      false: the tool-call guard only
+#     action: retry    retry (cut, ask again; then stop) | stop | notify
 require "digest"
 
+# Sees thinking repeat itself, from the deltas of one generation.
+#
+# The thinking is cut into sentences (at . ! ? and newlines; a run-on over
+# MAX_CARRY chars at its last space). Each sentence of min_words or more is
+# normalized (lower case, letters and digits). Two sentences are alike when
+# the mean of their word-set and word-bigram-set overlaps (Jaccard) is at
+# least `similarity`: a reworded one ("Hmm, …", a synonym, a swapped
+# clause) scores 0.4-0.9, two different ones rarely over 0.15. Two ways to
+# see a loop:
+# - a cycle: for each period p up to max_period, run[p] counts sentences in
+#   a row alike the one p before. A cycle seen `repeats` times (run[p] >=
+#   p * (repeats - 1)) is a loop once the looping stretch (run[p] + p
+#   sentences) spans min_span_sentences and min_span_chars. Templated
+#   sentences ("Now I need to open the file <path> and …") are alike too,
+#   and an enumeration of them makes every period's run grow, so: a period
+#   of 2 or more needs a cycle of distinct sentences (not all alike), and a
+#   period of 1 (one sentence over and over) needs `similarity` +
+#   SAME_MARGIN (0.9 by default: near-identical);
+# - the same sentence max_same times in the generation, in any order.
+# Nothing triggers before min_chars of thinking. O(new chars) per feed.
+class ThinkingWatch
+  DEFAULTS = { "watch" => true, "action" => "retry", "min_chars" => 2000, "repeats" => 3, "max_period" => 6,
+               "similarity" => 0.5, "min_span_sentences" => 6, "min_span_chars" => 600, "max_same" => 8,
+               "min_words" => 5 }.freeze
+  ACTIONS = %w[retry stop notify].freeze
+  MAX_CARRY = 400
+  # One sentence again and again needs this much more alike than a cycle.
+  SAME_MARGIN = 0.4
+  MAX_DISTINCT = 5000
+  SPLIT = /(?<=[.!?])\s+|\n+/
+
+  Loop = Struct.new(:period, :times, :sentences, :chars, keyword_init: true)
+  Sentence = Struct.new(:text, :words, :bigrams, :key, :length, keyword_init: true)
+
+  attr_reader :thinking_chars
+
+  # @param settings [Hash] the thinking: settings (string keys), over DEFAULTS
+  def self.settings(raw)
+    raw = {} unless raw.is_a?(Hash)
+    out = DEFAULTS.dup
+    out["watch"] = !%w[false no off 0].include?(raw["watch"].to_s.downcase) if raw.key?("watch")
+    out["action"] = raw["action"].to_s if ACTIONS.include?(raw["action"].to_s)
+    %w[min_chars repeats max_period min_span_sentences min_span_chars max_same min_words].each do |key|
+      number = Integer(raw[key].to_s, exception: false)
+      out[key] = number if number&.positive?
+    end
+    similarity = Float(raw["similarity"].to_s, exception: false)
+    out["similarity"] = similarity if similarity && similarity.positive? && similarity <= 1
+    out["repeats"] = 2 if out["repeats"] < 2
+    out
+  end
+
+  def initialize(settings = DEFAULTS)
+    @min_chars = settings["min_chars"]
+    @repeats = settings["repeats"]
+    @max_period = settings["max_period"]
+    @similarity = settings["similarity"]
+    @min_span_sentences = settings["min_span_sentences"]
+    @min_span_chars = settings["min_span_chars"]
+    @max_same = settings["max_same"]
+    @min_words = settings["min_words"]
+    @same_similarity = [@similarity + SAME_MARGIN, 0.95].min
+    @carry = +""
+    @window = [] # the last max_period + 1 sentences
+    @run = Array.new(@max_period + 1, 0)
+    @run_chars = Array.new(@max_period + 1, 0) # chars of the run's sentences plus the first cycle's
+    @counts = Hash.new(0)
+    @thinking_chars = 0
+  end
+
+  # @param delta [String] new thinking
+  # @return [Loop, nil] the loop, once it is seen
+  def feed(delta)
+    delta = delta.to_s
+    @thinking_chars += delta.length
+    @carry << delta
+    found = nil
+    sentences.each do |text|
+      loop_seen = add(text)
+      found ||= loop_seen
+    end
+    found
+  end
+
+  private
+
+  # The complete sentences in the carry; the unfinished tail stays.
+  def sentences
+    parts = @carry.split(SPLIT, -1)
+    @carry = parts.pop.to_s
+    if @carry.length > MAX_CARRY
+      cut = @carry.rindex(" ", MAX_CARRY) || MAX_CARRY
+      parts << @carry[0, cut]
+      @carry = @carry[cut..].to_s.lstrip
+    end
+    parts
+  end
+
+  def add(text)
+    words = text.downcase.gsub(/[^[:alnum:]]+/, " ").split
+    return nil if words.length < @min_words
+
+    key = words.join(" ")
+    sentence = Sentence.new(text: text.strip, words: words.map(&:hash).uniq,
+                            bigrams: words.each_cons(2).map { |pair| pair.join(" ").hash }.uniq, key: key, length: text.length)
+    same = count(key)
+    cycle = cycle_loop(sentence)
+    @window << sentence
+    @window.shift if @window.length > @max_period + 1
+    return nil if @thinking_chars < @min_chars
+
+    cycle || (same >= @max_same ? Loop.new(period: 1, times: same, sentences: [sentence.text], chars: nil) : nil)
+  end
+
+  def count(key)
+    return @counts[key] += 1 if @counts.key?(key) || @counts.size < MAX_DISTINCT
+
+    0
+  end
+
+  def cycle_loop(sentence)
+    found = nil
+    (1..@max_period).each do |p|
+      before = @window[-p]
+      if before && similarity(sentence, before) >= (p == 1 ? @same_similarity : @similarity)
+        # The run starts after one whole cycle: its chars count too.
+        @run_chars[p] = @window.last(p).sum(&:length) if @run[p].zero?
+        @run[p] += 1
+        @run_chars[p] += sentence.length
+      else
+        @run[p] = 0
+        @run_chars[p] = 0
+        next
+      end
+      next if found || @run[p] < p * (@repeats - 1)
+      next if @run[p] + p < @min_span_sentences || @run_chars[p] < @min_span_chars
+
+      cycle = @window.last(p - 1) + [sentence]
+      next if p > 1 && cycle.each_cons(2).all? { |a, b| similarity(a, b) >= @similarity }
+
+      found = Loop.new(period: p, times: (@run[p] + p) / p, sentences: cycle.map(&:text), chars: @run_chars[p])
+    end
+    found
+  end
+
+  def similarity(a, b)
+    return 1.0 if a.key == b.key
+
+    (jaccard(a.words, b.words) + jaccard(a.bigrams, b.bigrams)) / 2
+  end
+
+  def jaccard(a, b)
+    shared = (a & b).size
+    all = a.size + b.size - shared
+    all.zero? ? 0.0 : shared.to_f / all
+  end
+end
+
 class Plugin
   DEFAULT_IGNORE = %w[task_wait task_get delegate_result list_sessions list_reminders].freeze
   # Built-in tools carry flat fields; plugin and unknown tools carry args:.
   KEY_FIELDS = %i[content path start_line end_line cwd env scope].freeze
   SHORT_CHARS = 60
+  THOUGHT_CHARS = 80
   SOURCE = "bundle loop-guard"
 
   def initialize(settings = {})
@@ -31,6 +198,7 @@ class Plugin
     @stop_after = positive(settings["stop_after"]) || 4
     @ignore = settings.key?("ignore_tools") ? Array(settings["ignore_tools"]).map(&:to_s) : DEFAULT_IGNORE
     @mode = settings["mode"].to_s == "notify" ? :notify : :deny
+    @thinking = ThinkingWatch.settings(settings["thinking"])
     reset
   end
 
@@ -38,10 +206,52 @@ class Plugin
     chi.on(:before_turn) { |_event| reset }
     chi.on(:before_tool_call) { |event, ctx| before(event, ctx) }
     chi.on(:after_tool_call) { |event| after(event) }
+    return unless @thinking["watch"]
+
+    chi.on(:before_generation) do |_event|
+      @watch = ThinkingWatch.new(@thinking)
+      @watch_done = false
+    end
+    chi.on(:generation_progress) { |event, ctx| progress(event, ctx) }
   end
 
   private
 
+  # A stretch of streamed thinking. The first loop in a turn is cut and the
+  # model asked again (action retry); a second one, or action stop, stops
+  # the turn with a card; action notify only warns, once per generation.
+  def progress(event, ctx)
+    return if @watch.nil? || @watch_done
+
+    found = @watch.feed(event[:thinking])
+    return unless found
+
+    @watch_done = true
+    what = "#{found.period == 1 ? "one sentence" : "#{found.period} sentences"} ×#{found.times}, " \
+           "#{(@watch.thinking_chars / 1000.0).round}k chars, #{(event[:elapsed_ms].to_i / 1000.0).round} s"
+    case @thinking["action"]
+    when "notify"
+      ctx.notify("thinking repeats itself (#{what})", level: :warn)
+    when "retry"
+      @thinking_loops += 1
+      return stop_thinking(event, ctx, found, what) if @thinking_loops > 1
+
+      ctx.notify("thinking repeats itself (#{what}): cut", level: :warn) if event[:stop_generation]&.call("its thinking kept repeating itself")
+    else
+      stop_thinking(event, ctx, found, what)
+    end
+  end
+
+  def stop_thinking(event, ctx, found, what)
+    return unless event[:stop_turn]&.call("the model's thinking kept repeating itself (#{what})")
+
+    lines = found.sentences.first(3).map { |sentence| "- \"#{cut(sentence, THOUGHT_CHARS)}\"" }
+    ctx.card(title: "loop-guard stopped the turn",
+             body: "The model's thinking kept repeating itself:\n\n#{lines.join("\n")}\n\n" \
+                   "Try: ask for a smaller step, or change the model's sampling (`sampling:` in config.yml).",
+             level: :warn)
+  end
+
   def reset
     @last_result = {}  # key => result hash
     @results = Hash.new(0) # [key, result hash] => times it ran with that result
@@ -50,6 +260,8 @@ class Plugin
     @warned = {}       # key => true once notified this turn
     @denials = 0
     @pending = nil
+    @thinking_loops = 0
+    @watch = nil
   end
 
   def before(event, ctx)
@@ -147,8 +359,8 @@ class Plugin
     text.empty? ? "no output" : cut(text)
   end
 
-  def cut(text)
-    text.length > SHORT_CHARS ? "#{text[0, SHORT_CHARS - 1]}…" : text
+  def cut(text, max = SHORT_CHARS)
+    text.length > max ? "#{text[0, max - 1]}…" : text
   end
 
   def positive(value)

data/lib/samagotchi/bundles/system/config_modification_protocol.md

@@ -92,6 +92,9 @@ bundles:
     deny_after: 2              # same call + same result N times in a turn -> deny the next
     stop_after: 4              # stop the turn at this many denies
     mode: deny                 # deny | notify (warn only); ignore_tools: [task_wait, ...]
+    thinking:                  # the watch on thinking that repeats itself
+      watch: true              # false: the tool-call guard only
+      action: retry            # retry (cut, ask again; then stop) | stop | notify
   check-in:
     after: 50                  # tool calls in one turn with no answer before the first check
     every: 50                  # then again every N more

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.5.1
+version: 0.7.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:b7d59a1e824f0918c28a38d40105e8abd1ff68ebab1810fd1dcf52cd3b72e7c0
-  self_map.md: sha256:59ca83f92d11bc6bdc69f3111b3b8e1189280499ae955b10043ff993387b4550
-  config_modification_protocol.md: sha256:71ff60549574c4be7d4c70801582a19d5d9ec6d5be87f5867f9aa113e5484f21
+  self_map.md: sha256:93c788fadaf98adeb8946b4a357d2372bd6ebb439042d7cef8dda8fb44187315
+  config_modification_protocol.md: sha256:24e95727488daa80ac3008e020d8be098c7a1882153b7a61aba35450f72b86b7
   memory_guide.md: sha256:43be77156562f1eac369c248045e35ccd89e87d1f7f95a9286be72521b058e87
   delegated.md: sha256:0a71d5dfa7127df2d51cb5f0e7214240ed88777e36559430a8724c796d7ae561

data/lib/samagotchi/bundles/system/self_map.md

@@ -32,7 +32,8 @@
   child sessions and services (e.g. MCP server processes). Shipped: `btw` (`/btw` side question),
   `mcp` (MCP server tools; a screenshot comes as a picture), `guardrails` (rules), `known-names` (typo guard), `source-links`
   (turns source refs like JIRA-123 in an answer into links in the web, and a one-line note), `loop-guard`
-  (denies a repeated tool call with the same result, stops the turn after a few), `check-in` (after N tool
+  (denies a repeated tool call with the same result, stops the turn after a few, and cuts thinking that
+  repeats itself, asking me again), `check-in` (after N tool
   calls with no answer, a card asks the user to nudge me, let me go on or stop; `/checkin`), `skills` (`/skill save|list|show|diff`,
   keeps older versions of `skill_*` memories). `chi bundle list`
   shows installed + available; `chi bundle install <name>`. Settings: config.yml `bundles: <name>:`

data/lib/samagotchi/cancellation_controller.rb

@@ -5,22 +5,31 @@ module Samagotchi
   # calls every listener registered with #on_cancel (a listener added after
   # the cancel runs at once). The HTTP layer listens to abort an in-flight
   # request; the loops poll #cancelled? between steps.
+  #
+  # #generation gives one model request a child controller: cancelled with
+  # the turn, or alone by #cancel_generation! (a plugin cutting a looping
+  # generation while the turn goes on).
   class CancellationController
     def initialize
       @mutex = Mutex.new
       @cancelled = false
       @reason = nil
+      @detail = nil
       @listeners = {}
       @next_listener_id = 0
+      @generation = nil
     end
 
-    def cancel!(reason = :manual)
+    # @param detail [Object, nil] what the canceller says about it (a cut
+    #   generation's {by:, reason:})
+    def cancel!(reason = :manual, detail = nil)
       listeners = []
       @mutex.synchronize do
         return false if @cancelled
 
         @cancelled = true
         @reason = reason
+        @detail = detail
         listeners = @listeners.values
         @listeners = {}
       end
@@ -41,6 +50,38 @@ module Samagotchi
       @mutex.synchronize { @reason }
     end
 
+    def detail
+      @mutex.synchronize { @detail }
+    end
+
+    # Yields a child controller for one generation: it is cancelled when
+    # this one is, and #cancel_generation! cancels it alone. Gone after the
+    # block.
+    def generation
+      child = CancellationController.new
+      listener_id = on_cancel { |reason| child.cancel!(reason) }
+      @mutex.synchronize { @generation = child }
+      yield child
+    ensure
+      @mutex.synchronize { @generation = nil if @generation.equal?(child) }
+      remove_listener(listener_id)
+    end
+
+    # The running generation was cancelled (cut, or with the turn).
+    def generation_cancelled?
+      child = @mutex.synchronize { @generation }
+      child ? child.cancelled? : false
+    end
+
+    # Cancel the running generation only. False with none, or when it was
+    # already cancelled (cut before, or the turn was cancelled).
+    def cancel_generation!(reason = :hook, detail = nil)
+      child = @mutex.synchronize { @generation }
+      return false unless child
+
+      child.cancel!(reason, detail)
+    end
+
     def on_cancel(&block)
       raise ArgumentError, "block required" unless block
 

data/lib/samagotchi/config.rb

@@ -135,6 +135,11 @@ module Samagotchi
       Entry.new(key: "update.gem",               yaml_path: %w[update gem],               type: :bool,    default: true,            expose: %i[env config]),
       Entry.new(key: "update.bundles",           yaml_path: %w[update bundles],           type: :bool,    default: true,            expose: %i[env config]),
       Entry.new(key: "update.desktop",           yaml_path: %w[update desktop],           type: :bool,    default: true,            expose: %i[env config]),
+      # The desktop helper's kitty targets (Desktop::MacOS.kitty_settings): listen_on copied from kitty.conf (unset = none),
+      # the kitty binary, and the foreground programs listed, "|"-separated (a YAML list works too; "*" = every window).
+      Entry.new(key: "kitty.listen_on",          yaml_path: %w[kitty listen_on],          type: :string, default: nil,              expose: %i[env config]),
+      Entry.new(key: "kitty.binary",             yaml_path: %w[kitty binary],             type: :string, default: "/Applications/kitty.app/Contents/MacOS/kitty", expose: %i[env config]),
+      Entry.new(key: "kitty.agents",             yaml_path: %w[kitty agents],             type: :string, default: "claude|codex|gemini|aider|opencode|cursor-agent|amp|goose", expose: %i[env config]),
 
       Entry.new(key: "read.truncate_at_bytes",        yaml_path: %w[read truncate_at_bytes],        type: :integer, default: 65_536,   expose: %i[env config cli]),
       Entry.new(key: "read.preview_bytes",            yaml_path: %w[read preview_bytes],            type: :integer, default: 12_288,   expose: %i[env config cli]),
@@ -148,8 +153,8 @@ module Samagotchi
       Entry.new(key: "web.port",                 yaml_path: %w[web port],                 type: :integer, default: 4567,            expose: %i[env config cli]),
       Entry.new(key: "web.host",                 yaml_path: %w[web host],                 type: :string, default: "127.0.0.1",     expose: %i[env config cli]),
       Entry.new(key: "web.markdown",             yaml_path: %w[web markdown],             type: :bool,    default: false,           expose: %i[env config cli]),
-      # The page's view of a turn: turn (one block of generations, the live one at the bottom), stage (the running turn pinned above the composer) or chat (a row of bubbles); ?view= overrides it per page load.
-      Entry.new(key: "web.view",                 yaml_path: %w[web view],                 type: :enum,    default: "turn",         expose: %i[env config cli], enum_values: %w[turn stage chat]),
+      # The page's view of a turn: stage (the running turn pinned above the composer) or turn (one block of generations, the live one at the bottom); ?view= overrides it per page load.
+      Entry.new(key: "web.view",                 yaml_path: %w[web view],                 type: :enum,    default: "stage",        expose: %i[env config cli], enum_values: %w[stage turn]),
       # Quick replies next to Annotate in the page's selection bubble, "|"-separated (a YAML list works too); "" leaves only Annotate.
       Entry.new(key: "web.annotate_presets",     yaml_path: %w[web annotate_presets],     type: :string, default: "Agreed|Could you please elaborate?", expose: %i[env config cli]),
 

data/lib/samagotchi/desktop/macos/App.swift

@@ -2,7 +2,8 @@
 // (text, or images: files in Finder, a picture in Preview), the hotkey with
 // the clipboard (a screenshot too). No Dock icon (LSUIElement); it stays
 // running after the first launch. `ChiHelper --login on|off|status` (run
-// directly by chi desktop) manages the login item and exits.
+// directly by chi desktop) manages the login item and exits;
+// `ChiHelper --kitty list|send` is the kitty targets' seam (Kitty.swift).
 import AppKit
 import ServiceManagement
 
@@ -97,6 +98,9 @@ struct ChiHelperMain {
     if args.count >= 2, args[1] == "--login" {
       exit(loginCommand(args.count >= 3 ? args[2] : ""))
     }
+    if args.count >= 2, args[1] == "--kitty" {
+      exit(kittyCommand(Array(args.dropFirst(2))))
+    }
     let app = NSApplication.shared
     let delegate = AppDelegate()
     app.delegate = delegate

data/lib/samagotchi/desktop/macos/ChiRunner.swift

@@ -7,13 +7,8 @@ struct LaunchConfig: Decodable {
   let version: String?
   let argv: [String]
   let env: [String: String]?
-}
-
-struct ChiResult {
-  let status: Int32
-  let stdout: String
-  let stderr: String
-  let timedOut: Bool
+  /// Agents in kitty windows (Kitty.swift); nil = none.
+  let kitty: KittySettings?
 }
 
 enum ChiError: Error, CustomStringConvertible {
@@ -83,29 +78,31 @@ final class ChiRunner {
   static let launchPath = supportDir + "/launch.json"
 
   let timeout: TimeInterval
+  let launchPath: String
 
-  init(timeout: TimeInterval = 10) {
+  /// @param launchPath another launch file (a test harness's), not the app's
+  init(timeout: TimeInterval = 10, launchPath: String = ChiRunner.launchPath) {
     self.timeout = timeout
+    self.launchPath = launchPath
   }
 
   func loadLaunch() throws -> LaunchConfig {
-    guard let data = FileManager.default.contents(atPath: Self.launchPath) else {
-      throw ChiError.noLaunchFile(Self.launchPath)
+    guard let data = FileManager.default.contents(atPath: launchPath) else {
+      throw ChiError.noLaunchFile(launchPath)
     }
     let config: LaunchConfig
     do { config = try JSONDecoder().decode(LaunchConfig.self, from: data) } catch {
-      throw ChiError.failed("Unreadable launch file \(Self.launchPath): \(error.localizedDescription)")
+      throw ChiError.failed("Unreadable launch file \(launchPath): \(error.localizedDescription)")
     }
-    guard !config.argv.isEmpty else { throw ChiError.failed("Empty argv in \(Self.launchPath)") }
+    guard !config.argv.isEmpty else { throw ChiError.failed("Empty argv in \(launchPath)") }
     for path in config.argv where path.hasPrefix("/") && !FileManager.default.fileExists(atPath: path) {
       throw ChiError.missing(path)
     }
     return config
   }
 
-  /// Runs `chi <args>`, with stdin written from a background queue and
-  /// stdout/stderr drained as they come (no pipe deadlock near the 16 KiB
-  /// note cap). Calls back on the main queue.
+  /// Runs `chi <args>` through ProcessRunner (no pipe deadlock near the
+  /// 16 KiB note cap). Calls back on the main queue.
   /// @param timeout this call's limit instead of the runner's
   func run(_ args: [String], stdin: Data? = nil, timeout: TimeInterval? = nil,
            completion: @escaping (Result<ChiResult, ChiError>) -> Void) {
@@ -116,59 +113,9 @@ final class ChiRunner {
       completion(.failure(.failed("\(error)"))); return
     }
 
-    let process = Process()
-    process.executableURL = URL(fileURLWithPath: config.argv[0])
-    process.arguments = Array(config.argv.dropFirst()) + args
-    process.environment = ProcessInfo.processInfo.environment.merging(config.env ?? [:]) { _, baked in baked }
-    process.currentDirectoryURL = URL(fileURLWithPath: NSHomeDirectory())
-    let out = Pipe(), err = Pipe(), input = Pipe()
-    process.standardOutput = out
-    process.standardError = err
-    process.standardInput = stdin == nil ? FileHandle.nullDevice : input
-
-    let lock = NSLock()
-    var outData = Data(), errData = Data()
-    out.fileHandleForReading.readabilityHandler = { handle in
-      let chunk = handle.availableData
-      lock.lock(); outData.append(chunk); lock.unlock()
-    }
-    err.fileHandleForReading.readabilityHandler = { handle in
-      let chunk = handle.availableData
-      lock.lock(); errData.append(chunk); lock.unlock()
-    }
-
-    var timedOut = false
-    process.terminationHandler = { proc in
-      out.fileHandleForReading.readabilityHandler = nil
-      err.fileHandleForReading.readabilityHandler = nil
-      let restOut = out.fileHandleForReading.readDataToEndOfFile()
-      let restErr = err.fileHandleForReading.readDataToEndOfFile()
-      lock.lock()
-      outData.append(restOut); errData.append(restErr)
-      let result = ChiResult(status: proc.terminationStatus,
-                             stdout: String(decoding: outData, as: UTF8.self),
-                             stderr: String(decoding: errData, as: UTF8.self),
-                             timedOut: timedOut)
-      lock.unlock()
-      DispatchQueue.main.async { completion(.success(result)) }
-    }
-
-    do { try process.run() } catch {
-      completion(.failure(.failed("Could not start \(config.argv[0]): \(error.localizedDescription)")))
-      return
-    }
-    if let stdin {
-      DispatchQueue.global().async {
-        try? input.fileHandleForWriting.write(contentsOf: stdin)
-        try? input.fileHandleForWriting.close()
-      }
-    }
-    DispatchQueue.global().asyncAfter(deadline: .now() + (timeout ?? self.timeout)) {
-      if process.isRunning {
-        lock.lock(); timedOut = true; lock.unlock()
-        process.terminate()
-      }
-    }
+    ProcessRunner.run(executable: config.argv[0], args: Array(config.argv.dropFirst()) + args,
+                      env: ProcessInfo.processInfo.environment.merging(config.env ?? [:]) { _, baked in baked },
+                      stdin: stdin, timeout: timeout ?? self.timeout, completion: completion)
   }
 
   /// The live sessions, then up to +recentCount+ stopped ones, newest
@@ -188,6 +135,18 @@ final class ChiRunner {
     }
   }
 
+  /// The model a new session starts on (`chi self --model`: the config's
+  /// default, as chi resolves it), or nil when none is configured or chi
+  /// can't say. Only a single line counts: nothing that looks like a whole
+  /// `chi self` report ends up as the hint.
+  func defaultModel(completion: @escaping (String?) -> Void) {
+    run(["self", "--model"]) { result in
+      guard case .success(let r) = result, r.status == 0, !r.timedOut else { completion(nil); return }
+      let model = r.stdout.trimmingCharacters(in: .whitespacesAndNewlines)
+      completion(model.isEmpty || model.contains("\n") ? nil : model)
+    }
+  }
+
   private func list(_ flags: [String], completion: @escaping (Result<[LiveSession], ChiError>) -> Void) {
     // Every project's sessions: the helper isn't in any one project (an
     // older chi ignores the flag).

data/lib/samagotchi/desktop/macos/Images.swift

@@ -27,7 +27,11 @@ struct PanelImage: Identifiable, Equatable {
 }
 
 enum ImageIntake {
-  static let tempDir = URL(fileURLWithPath: NSTemporaryDirectory()).appendingPathComponent("chi-helper", isDirectory: true)
+  /// $TMPDIR when set (launchd sets it; a spec points it elsewhere), else
+  /// the user's temp folder.
+  static let tempRoot = URL(fileURLWithPath: ProcessInfo.processInfo.environment["TMPDIR"].flatMap { $0.isEmpty ? nil : $0 }
+    ?? NSTemporaryDirectory(), isDirectory: true)
+  static let tempDir = tempRoot.appendingPathComponent("chi-helper", isDirectory: true)
 
   /// A pasteboard's content for the panel, in this order: image files
   /// (Finder ⌘C, a Service on files) with no text; else its text, as before
@@ -78,9 +82,40 @@ enum ImageIntake {
     }
   }
 
-  /// At launch: what a helper that quit mid-send left.
-  static func sweep() {
+  /// Images pasted into kitty windows, kept for the agent to read after
+  /// the send: never deleted by it, swept at launch after a week.
+  static let sentDir = tempRoot.appendingPathComponent("chi-helper-sent", isDirectory: true)
+  static let sentMaxAge: TimeInterval = 7 * 86_400
+
+  /// The paths a kitty paste names: an image the helper wrote is copied to
+  /// sentDir first (the send deletes the original), with no spaces in its
+  /// name; a file of the user's is named as it is. Call before any send
+  /// job starts. An image that can't be copied is left out.
+  static func keepForPaste(_ images: [PanelImage]) -> [String] {
+    images.compactMap { image in
+      guard image.temp else { return image.url.path }
+      let ext = image.url.pathExtension.isEmpty ? "png" : image.url.pathExtension
+      let copy = sentDir.appendingPathComponent("\(UUID().uuidString).\(ext)")
+      do {
+        try FileManager.default.createDirectory(at: sentDir, withIntermediateDirectories: true)
+        try FileManager.default.copyItem(at: image.url, to: copy)
+        return copy.path
+      } catch {
+        return nil
+      }
+    }
+  }
+
+  /// At launch: what a helper that quit mid-send left, and pasted images
+  /// older than a week.
+  static func sweep(now: Date = Date()) {
     try? FileManager.default.removeItem(at: tempDir)
+    let fm = FileManager.default
+    for name in (try? fm.contentsOfDirectory(atPath: sentDir.path)) ?? [] {
+      let url = sentDir.appendingPathComponent(name)
+      let modified = (try? fm.attributesOfItem(atPath: url.path)[.modificationDate] as? Date) ?? now
+      if now.timeIntervalSince(modified) > sentMaxAge { try? fm.removeItem(at: url) }
+    }
   }
 }