samagotchi 0.52.0 → 0.53.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 98660ef911df1f010a45ded3190d0017793fc4e01c1229860ab523a7d2825ffd
-  data.tar.gz: 2c1eab9152f8fba6efa7507d17dde3deb54a0e5bbd26a56a61f23f54d3d38a15
+  metadata.gz: f1d170176f088bc87560a05b7596d57925d955011cc5818b93f5ae33ae2b1f55
+  data.tar.gz: 941c3bd879e09b78144ede81d4c6cf4724f9ca3a7ce8fa62f0174524a26f25bf
 SHA512:
-  metadata.gz: d85715550f95d875ced247c2642c04183507fbb2d85bf6f1201e62a3fb2471ba27c27a110dee57046a716a38e139acd8aaf5dbc7ea0ded2051c486056bb115fb
-  data.tar.gz: 25591f45d69afe94d02ebabfce8887cfb126bf0c1b21ed74cc172ecbcfe881990f3431f43cde1b5b2c8801684102f628afbf4446bc2acab77fc50ef2ca6ff7f7
+  metadata.gz: ddc3c2d02b18137887e5e90f636b23dd3ea44461f33a723e4033d58f4cfcd9c7be3267db9cc3349aba1d3af6b73a398415696e3af2c8fdad6662704944dad189
+  data.tar.gz: bd8bded906f5e3855c8f63ab081582b601d4b5332bb10e9ed5a7dff36e185851583c95d28e8b3528ece4d8b34463cc6e65fd16bb95bf2c493de502d9efa79775

data/CHANGELOG.md

@@ -8,6 +8,31 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.53.0] - 2026-10-10
+
+### Changed
+
+- Web: the `think` chip's level popover is a lit-html template (it was built as an HTML string); it looks and works
+  as before.
+
+### Fixed
+
+- `/model X` (and `/model X --default`, `/model clear`, and a successful `/model X --alias NAME`) now carry the
+  model's thinking level in the same place the plain `/model` reply does; a switch that fails to persist its alias
+  is unchanged.
+- `chi bundle build --name <profile>` (an installed profile such as `core`) is refused with a line saying why: it used
+  to build a plain bundle of the scope's other memories under the profile's name, without its `includes:` and with
+  its trust level, which reinstalled over the profile would lose its members.
+- Web: Tab completion in the composer offers `/cut` (`/cu` + Tab); the terminals' own commands (`/stats`,
+  `/exit` …) stay out of it.
+- `chi -p /stats --non-interactive` (and `/exit`, `/recap` … — the terminals' own commands) is refused with a line
+  on stderr, as `chi send` refuses them, instead of going to the model as a prompt; it exits 1 and makes no session.
+- A turn that fails on its host under a model alias says what the alias became: `--model splash` (an alias with no
+  host) failing on host `main` adds `(splash is an alias: gemma-x on host main)` to the error line.
+- `chi sessions prune`, the lazy sweep and the TUI's discard-on-exit no longer crash on a session folder whose
+  `analytics.json` or `cards.json` is broken (not JSON or the wrong shape): every caller now keeps that folder like any
+  other not-empty one, so one corrupt file no longer stops the whole retention sweep.
+
 ## [0.52.0] - 2026-10-10
 
 ### Added
@@ -2387,7 +2412,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.52.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.53.0...HEAD
+[0.53.0]: https://github.com/dm1try/samagotchi/compare/v0.52.0...v0.53.0
 [0.52.0]: https://github.com/dm1try/samagotchi/compare/v0.51.0...v0.52.0
 [0.51.0]: https://github.com/dm1try/samagotchi/compare/v0.50.0...v0.51.0
 [0.50.0]: https://github.com/dm1try/samagotchi/compare/v0.49.0...v0.50.0

data/docs/releasing.md

@@ -79,9 +79,12 @@ The agent does each step and stops where the user has to say yes.
 8. **The user approves the `release` environment** in the Actions run
    (Review deployments → Approve).
 9. **Watch the run.** `gh run watch` (or `gh run list --workflow release.yml`).
-   It checks that the tag is `v` + VERSION and on main, builds the gem, pushes
-   it with a trusted-publishing token and creates the GitHub release with the
-   notes and the .gem attached.
+   It doesn't run the suites again: it checks that the CI workflow succeeded
+   on the tagged commit as a push to main (waiting while that run is still
+   going, stopping if it failed or never ran) and runs the full
+   `bundles:check`. Then it checks that the tag is `v` + VERSION and on main,
+   builds the gem, pushes it with a trusted-publishing token and creates the
+   GitHub release with the notes and the .gem attached.
 10. **Verify the published gem** in a clean GEM_HOME:
     ```sh
     tmp=$(mktemp -d)

data/docs/testing.md

@@ -15,9 +15,11 @@ bug) or a broken spec: fix it, or disable that line with the reason (`# rubocop:
 No spec reads your own setup. The suite points `XDG_CONFIG_HOME` and `XDG_STATE_HOME` at temp folders,
 clears your `SAMAGOTCHI_*` environment, and keeps every spec off the network (WebMock).
 
-The web specs run in plain node. One that renders with lit-html (`turn_view.js`, `vendor/lit-html.js`) needs a DOM:
-`import "./dom_shim.js";` as its first import (happy-dom, a devDependency only, never shipped; about 0.3 s per spec
-file that loads it). The shim's `htmlOf(nodes)` and `canon(html)` compare markup without lit's marker comments.
+The web specs run in plain node. One that renders with lit-html (`turn_view.js`, `thinking_chip.js`,
+`vendor/lit-html.js`) needs a DOM: `import "./dom_shim.js";` as its first import (happy-dom, a devDependency only,
+never shipped; about 0.3 s per spec file that loads it). The shim's `htmlOf(nodes)` and `canon(html)` compare markup
+without lit's marker comments. happy-dom 20 picks the wrong option of a `<select>` whose options lit inserted with
+`?selected`: read the option marked `selected` (`option[selected]`), not `select.value`; the browser follows the mark.
 
 ## Worktrees
 

data/lib/samagotchi/analytics_file.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Samagotchi
+  # A session's analytics.json: the SessionMetrics snapshot with every turn
+  # and tool record, saved next to the session file (<session dir>/
+  # analytics.json). SessionMetrics#persist writes it; the session lists,
+  # `chi sessions stats`, the web's timing and a collector loading an earlier
+  # process's records read it. The records stay string-keyed hashes as
+  # saved: their keys grow over versions and every reader treats each one
+  # as optional.
+  module AnalyticsFile
+    NAME = "analytics.json"
+
+    module_function
+
+    # @param session_dir [String]
+    # @return [String]
+    def path(session_dir)
+      File.join(session_dir, NAME)
+    end
+
+    # The parsed file, string-keyed; nil when it is missing, unreadable,
+    # not JSON or not an object (an older or broken file reads as none).
+    # @param session_dir [String]
+    # @return [Hash, nil]
+    def read(session_dir)
+      data = JSON.parse(File.read(path(session_dir)))
+      data.is_a?(Hash) ? data : nil
+    rescue JSON::ParserError, SystemCallError
+      nil
+    end
+  end
+end

data/lib/samagotchi/bundle_command.rb

@@ -397,13 +397,10 @@ module Samagotchi
         if hooks.any?
           @stdout.puts "  Hooks (#{hooks.size}):"
           hooks.each do |hk, meta|
-            m = meta.is_a?(Hash) ? meta.transform_keys(&:to_s) : {}
-            event = m["event"] || ""
-            on_error = m["on_error"] || "skip"
-            prio = m["priority"] || 100
+            hook = Samagotchi::MemoryBundle::BundleHook.parse(meta)
             hook_path = File.join(Samagotchi::MemoryBundle::Provenance.new(name: name).hooks_dir, hk.to_s)
             exists = File.exist?(hook_path) ? "ok" : "missing"
-            @stdout.puts "    #{hk}: event=#{event} on_error=#{on_error} priority=#{prio} [#{exists}]"
+            @stdout.puts "    #{hk}: event=#{hook.event} on_error=#{hook.on_error} priority=#{hook.priority} [#{exists}]"
           end
           @stdout.puts "    requires_chi: #{st[:provenance][:requires_chi]}" if st[:hooks_requires_failure]
           @stdout.puts "    not loaded: #{st[:hooks_requires_failure]}" if st[:hooks_requires_failure]
@@ -496,10 +493,7 @@ module Samagotchi
           @stdout.puts File.exist?(cur) ? File.read(cur) : "(missing)"
           # Show hook metadata
           meta = hooks[file_arg.to_sym] || hooks[file_arg]
-          if meta
-            m = meta.transform_keys(&:to_s)
-            @stdout.puts "--- metadata: event=#{m["event"]} on_error=#{m["on_error"]} priority=#{m["priority"]} sha256=#{m["sha256"]}"
-          end
+          @stdout.puts hook_metadata_line(meta) if meta
         elsif plugin_file && [plugin_file, "plugin/#{plugin_file}"].include?(file_arg)
           show_plugin.call
         else
@@ -529,10 +523,7 @@ module Samagotchi
           @stdout.puts "--- current (on-disk) ---"
           @stdout.puts File.exist?(cur) ? File.read(cur) : "(missing)"
           meta = hooks[k.to_sym] || hooks[k]
-          if meta
-            m = meta.transform_keys(&:to_s)
-            @stdout.puts "--- metadata: event=#{m["event"]} on_error=#{m["on_error"]} priority=#{m["priority"]} sha256=#{m["sha256"]}"
-          end
+          @stdout.puts hook_metadata_line(meta) if meta
           @stdout.puts ""
         end
         if plugin_file
@@ -586,6 +577,11 @@ module Samagotchi
       "includes=#{here.join(",")}#{"  left out=#{gone.join(",")}" unless gone.empty?}"
     end
 
+    def hook_metadata_line(meta)
+      hook = Samagotchi::MemoryBundle::BundleHook.parse(meta)
+      "--- metadata: event=#{hook.event} on_error=#{hook.on_error} priority=#{hook.priority} sha256=#{hook.sha256}"
+    end
+
     def build(rest)
       parsed = parse_flags(BUILD_FLAGS, rest, "build", help: BUILD_HELP)
       return parsed if parsed.is_a?(Integer)

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.52.0
+version: 0.53.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/engine.rb

@@ -504,6 +504,20 @@ module Samagotchi
     end
     private :record_prompt_notes
 
+    # A failed turn's one line (the error's #summary). A host's failure
+    # under an alias says what the alias became (HostRegistry#alias_note):
+    # "host main" alone doesn't tell --model splash's user it was splash.
+    # @return [String]
+    def failure_summary(error)
+      summary = error.respond_to?(:summary) ? error.summary : error.message
+      return summary unless error.is_a?(LLM::ProviderError) && error.host
+
+      note = @host_registry.alias_note(@effective_model_name)
+      note && note.end_with?("on host #{error.host}") ? "#{summary} (#{note})" : summary
+    rescue StandardError
+      summary
+    end
+
     # +name+'s resolved ref (ModelRef#ref).
     def model_ref_for(name)
       @host_registry.model_ref(name).ref
@@ -2119,7 +2133,7 @@ module Samagotchi
       failed[:kept_steps] = steps if steps
       # A provider error says what kind it is, for one line per kind in the UIs.
       if error.is_a?(LLM::ProviderError)
-        failed.merge!(error_kind: error.kind, retryable: error.retryable?, host: error.host, summary: error.summary)
+        failed.merge!(error_kind: error.kind, retryable: error.retryable?, host: error.host, summary: failure_summary(error))
       end
       failed
     end

data/lib/samagotchi/hooks/bundle_loader.rb

@@ -3,6 +3,7 @@
 require_relative "registry"
 require "digest"
 require_relative "../log"
+require_relative "../memory_bundle/bundle_hook"
 require_relative "../memory_bundle/provenance"
 require_relative "../memory_bundle/manifest"
 require_relative "../version"
@@ -44,7 +45,8 @@ module Samagotchi
         #
         # @param bundle_name [String]
         # @param hooks_dir [String] directory containing the bundle's .rb hook files
-        # @param metadata [Hash] basename => { event:, on_error:, priority: }
+        # @param metadata [Hash] basename => { event:, on_error:, priority:,
+        #   sha256: } (MemoryBundle::BundleHook.parse reads it)
         # @param registry [Samagotchi::Hooks::Registry]
         # @param failures [Guardrails::LoadFailures, nil] collects hooks that
         #   failed to load
@@ -64,14 +66,13 @@ module Samagotchi
             basename = raw_basename.to_s
             next if basename.empty?
 
-            meta = ->(key) { raw_meta && (raw_meta[key] || raw_meta[key.to_s]) }
-            event = meta.call(:event).to_s
+            hook = MemoryBundle::BundleHook.parse(raw_meta)
             # A hook with no declared event cannot be auto-registered.
-            next if event.empty?
+            next if hook.event.empty?
 
-            event_sym = event.to_sym
-            on_error = (meta.call(:on_error) || "skip").to_s
-            priority = (meta.call(:priority) || 100).to_i
+            event_sym = hook.event.to_sym
+            on_error = hook.on_error
+            priority = hook.priority
             fail_closed = on_error == "fail_closed" && event_sym == :before_tool_call
             what = "hook #{basename} (bundle #{bundle_name})"
             file = hooks_dir && File.join(hooks_dir, basename)
@@ -79,7 +80,7 @@ module Samagotchi
               failures&.add(what, "the file is missing", required: true) if fail_closed
               next
             end
-            if (mismatch = too_old || sha_mismatch(file, meta.call(:sha256), required: fail_closed))
+            if (mismatch = too_old || sha_mismatch(file, hook.sha256, required: fail_closed))
               Log.warn(:hooks, "bundle_hook_mismatch", echo: "[samagotchi:hooks] bundle '#{bundle_name}' hook '#{basename}' not loaded: #{mismatch}", bundle: bundle_name, hook: basename.to_s)
               failures&.add(what, mismatch, required: fail_closed)
               next

data/lib/samagotchi/host_registry.rb

@@ -273,6 +273,19 @@ module Samagotchi
       ModelTarget.new(model: raw_model, entry: entry, bare_model: bare, client: client_for(entry))
     end
 
+    # What the alias +raw_model+ became, for an error that names only the
+    # host ("splash is an alias: gemma-x on host main"), or nil when it
+    # isn't an alias. An alias without a host of its own goes where a bare
+    # id goes (#host_for_model), often the default host the user never typed.
+    # @return [String, nil]
+    def alias_note(raw_model)
+      ref = model_ref(raw_model)
+      return nil unless ref.alias_name
+
+      target = resolve(raw_model)
+      "#{ref.alias_name} is an alias: #{target.bare_model} on host #{target.entry.name}"
+    end
+
     # The model id sent for +full_ref+: its alias applied, a known host
     # prefix stripped ("box:gemma" → "gemma").
     def bare_name(full_ref)

data/lib/samagotchi/memory_bundle/builder.rb

@@ -3,6 +3,7 @@
 require "digest"
 require "fileutils"
 require "tmpdir"
+require_relative "bundle_hook"
 require_relative "manifest"
 require_relative "placeholder"
 require_relative "../context_providers"
@@ -50,6 +51,8 @@ module Samagotchi
         validate_version!(resolved_version)
         raise BuildError, "invalid scope: #{@scope}" unless %w[system project].include?(@scope)
 
+        refuse_profile!(resolved_name)
+
         # Collect *.md files, excluding index.md and hidden files
         all_md = Dir.glob(File.join(target_dir, "*.md")).sort
         candidates = all_md.reject { |p| File.basename(p) == "index.md" }
@@ -110,20 +113,9 @@ module Samagotchi
             # Skip if hook file missing on disk
             next unless File.exist?(src)
 
-            # meta may be symbol-keyed
-            m = meta.is_a?(Hash) ? meta.transform_keys(&:to_s) : {}
-            sha = (m["sha256"] || m["checksum"] || "").to_s
-            if sha.empty?
-              sha = "sha256:#{Digest::SHA256.hexdigest(File.read(src))}"
-            elsif !sha.start_with?("sha256:")
-              sha = "sha256:#{sha}"
-            end
-            hooks_map[basename] = {
-              "sha256" => sha,
-              "event" => (m["event"] || "").to_s,
-              "on_error" => (m["on_error"] || "skip").to_s,
-              "priority" => (m["priority"] || 100).to_i
-            }
+            hook = BundleHook.parse(meta)
+            hook = hook.with(sha256: BundleHook.of_file(src).sha256) if hook.sha256.empty?
+            hooks_map[basename] = hook
             hooks_to_copy << [src, basename]
           end
         else
@@ -132,13 +124,7 @@ module Samagotchi
           if Dir.exist?(local_hooks_dir)
             Dir.glob(File.join(local_hooks_dir, "*.rb")).sort.each do |src|
               basename = File.basename(src)
-              sha = Digest::SHA256.hexdigest(File.read(src))
-              hooks_map[basename] = {
-                "sha256" => "sha256:#{sha}",
-                "event" => "",
-                "on_error" => "skip",
-                "priority" => 100
-              }
+              hooks_map[basename] = BundleHook.of_file(src)
               hooks_to_copy << [src, basename]
             end
           end
@@ -268,6 +254,22 @@ module Samagotchi
 
       private
 
+      # An installed profile (meta bundle) ships only its includes: a build
+      # under its name would make a plain bundle of the scope's memories,
+      # without the includes, carrying the profile's trust_level.
+      def refuse_profile!(name)
+        require_relative "profile"
+        data = Provenance.new(name: name).read
+        return unless Profile.installed_meta?(name, data)
+
+        shipped = File.join(SourceNormalizer::SHIPPED_DIR, name)
+        members = Profile.recorded(data, File.file?(File.join(shipped, "manifest.yml")) ? Manifest.read(dir: shipped) : nil)
+        raise BuildError, "#{name} is an installed profile (includes: #{members.join(", ")}): it ships only its includes, " \
+                          "so a build can't remake it; pick another --name for these memories"
+      rescue JSON::ParserError, SystemCallError, Manifest::ValidationError
+        nil
+      end
+
       # The installed bundle's scripts its record lists, file name => path
       # in its scripts/ (a missing one is left out); {} without a record.
       def installed_scripts(prov, prov_data)

data/lib/samagotchi/memory_bundle/bundle_hook.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Samagotchi
+  module MemoryBundle
+    # One hook's metadata, as a bundle's manifest.yml declares it and its
+    # installed record (manifest.json) keeps it: the file's sha256
+    # ("sha256:<hex>", "" when none is recorded), the event it registers
+    # for ("" when none: it isn't loaded), on_error (skip, log or
+    # fail_closed) and priority. The one place the defaults live.
+    class BundleHook < Data.define(:sha256, :event, :on_error, :priority)
+      DEFAULT_ON_ERROR = "skip"
+      DEFAULT_PRIORITY = 100
+
+      def initialize(sha256: "", event: "", on_error: DEFAULT_ON_ERROR, priority: DEFAULT_PRIORITY)
+        super
+      end
+
+      # @param raw [Hash, BundleHook, nil] string keys (manifest.yml) or
+      #   symbol keys (a read record); missing or blank values get the
+      #   defaults
+      def self.parse(raw)
+        return raw if raw.is_a?(BundleHook)
+
+        h = raw.is_a?(Hash) ? raw.transform_keys(&:to_s) : {}
+        on_error = h["on_error"].to_s.strip
+        new(sha256: prefixed(h["sha256"]), event: h["event"].to_s.strip,
+            on_error: on_error.empty? ? DEFAULT_ON_ERROR : on_error,
+            priority: (h["priority"] || DEFAULT_PRIORITY).to_i)
+      end
+
+      # A hook known only by its file (no declared event): its sha, the defaults.
+      def self.of_file(path)
+        new(sha256: "sha256:#{Digest::SHA256.hexdigest(File.binread(path))}")
+      end
+
+      # "sha256:<hex>" from either form, "" for none.
+      def self.prefixed(sha)
+        sha = sha.to_s.strip
+        sha.empty? || sha.start_with?("sha256:") ? sha : "sha256:#{sha}"
+      end
+
+      # The sha's hex, "" when none is recorded.
+      def hex = sha256.delete_prefix("sha256:")
+
+      # The string-keyed form manifest.yml and manifest.json hold.
+      def to_record = to_h.transform_keys(&:to_s)
+    end
+  end
+end

data/lib/samagotchi/memory_bundle/installer.rb

@@ -3,6 +3,7 @@
 require "fileutils"
 require "digest"
 require_relative "../memory_paths"
+require_relative "bundle_hook"
 require_relative "provenance"
 require_relative "manifest"
 require_relative "source"
@@ -180,7 +181,7 @@ module Samagotchi
             discovered = Dir.glob(File.join(normalized_dir, "hooks", "*.rb")).map { |p| File.basename(p) }
             discovered.each do |bn|
               # Build minimal metadata so copy still happens (event unknown -> skipped by loader but copied for integrity)
-              hook_entries[bn] = { sha256: "", event: "", on_error: "skip", priority: 100 }
+              hook_entries[bn] = BundleHook.new
             end
           end
 
@@ -206,7 +207,7 @@ module Samagotchi
             if @upgrade && existing_provenance && File.exist?(dest) && !@force
               prev_meta = existing_provenance[:hooks] ? (existing_provenance[:hooks][basename.to_sym] || existing_provenance[:hooks][basename]) : nil
               if prev_meta
-                prev_sha = prev_meta[:sha256] || prev_meta["sha256"]
+                prev_sha = BundleHook.parse(prev_meta).sha256
                 if File.exist?(dest) && !Provenance.recorded_sha(prev_sha).empty? && !Provenance.sha_matches?(dest, prev_sha)
                   @warnings << "Hook #{basename} was locally modified; overwriting"
                 end
@@ -403,8 +404,7 @@ module Samagotchi
             hooks_files_for_provenance.each do |basename, path|
               next unless File.exist?(path)
 
-              sha = Digest::SHA256.hexdigest(File.read(path))
-              hooks_for_provenance[basename] = { "sha256" => "sha256:#{sha}", "event" => "", "on_error" => "skip", "priority" => 100 }
+              hooks_for_provenance[basename] = BundleHook.of_file(path)
             end
           end
           Provenance.new(name: @name).write(

data/lib/samagotchi/memory_bundle/manifest.rb

@@ -4,6 +4,7 @@ require "yaml"
 require "digest"
 require "fileutils"
 require_relative "../context_providers"
+require_relative "bundle_hook"
 
 module Samagotchi
   module MemoryBundle
@@ -53,7 +54,8 @@ module Samagotchi
       BUNDLE_NAME = /\A[A-Za-z0-9][A-Za-z0-9_-]*\z/
 
       # files: name → "sha256:<hex>" (both forms); file_descriptions: name →
-      # the description a mapping gave, for the files that have one.
+      # the description a mapping gave, for the files that have one; hooks:
+      # name → BundleHook.
       attr_reader :name, :version, :scope, :description, :files, :file_descriptions, :hooks, :trust_level, :plugin, :requires_chi, :needs, :includes,
                   :scripts, :context_providers
 
@@ -99,13 +101,7 @@ module Samagotchi
 
       # Returns sha256 hex for a hook basename (e.g. "guardrails.rb").
       def checksum_for_hook(basename)
-        raw = @hooks[basename]
-        return nil unless raw
-
-        sha = raw[:sha256] || raw["sha256"]
-        return nil unless sha
-
-        sha.to_s.start_with?("sha256:") ? sha.to_s[7..] : sha.to_s
+        @hooks[basename]&.hex
       end
 
       # @return [String, nil] the plugin's sha256 hex, "sha256:" stripped
@@ -142,14 +138,7 @@ module Samagotchi
           text = file_descriptions[key].to_s.strip
           [key, text.empty? ? sha : { "sha256" => sha, "description" => text }]
         end
-        if hooks && !hooks.empty?
-          # Normalize hooks to string-keyed with sha256 prefix preserved
-          manifest["hooks"] = hooks.transform_keys(&:to_s).transform_values do |v|
-            h = v.transform_keys(&:to_s)
-            h["sha256"] = h["sha256"].to_s.start_with?("sha256:") ? h["sha256"].to_s : "sha256:#{h["sha256"]}" if h["sha256"]
-            h
-          end
-        end
+        manifest["hooks"] = hooks.to_h { |k, v| [k.to_s, BundleHook.parse(v).to_record] } if hooks && !hooks.empty?
         manifest["trust_level"] = trust_level.to_s if trust_level && !trust_level.to_s.empty?
         if plugin
           sha = plugin[:sha256].to_s
@@ -306,18 +295,7 @@ module Samagotchi
           next unless k.is_a?(String) && !k.empty?
           next unless v.is_a?(Hash)
 
-          sha = (v["sha256"] || v[:sha256] || "").to_s
-          sha = "sha256:#{sha}" unless sha.empty? || sha.start_with?("sha256:")
-          event = (v["event"] || v[:event] || "").to_s.strip
-          on_error = (v["on_error"] || v[:on_error] || "skip").to_s.strip
-          on_error = "skip" if on_error.empty?
-          priority = (v["priority"] || v[:priority] || 100).to_i
-          acc[k] = {
-            sha256: sha,
-            event: event,
-            on_error: on_error,
-            priority: priority
-          }
+          acc[k] = BundleHook.parse(v)
         end
       end
     end

data/lib/samagotchi/memory_bundle/provenance.rb

@@ -6,6 +6,7 @@ require "date"
 require "fileutils"
 require_relative "../atomic_file"
 require_relative "../memory_paths"
+require_relative "bundle_hook"
 
 module Samagotchi
   module MemoryBundle
@@ -177,22 +178,14 @@ module Samagotchi
         hooks_map = {}
         # existing hooks for pruning
         existing_hooks = existing && existing[:hooks] ? existing[:hooks] : {}
-        # Normalize incoming hooks (basename => metadata hash)
+        # Incoming hooks: basename => BundleHook (or its metadata hash)
         normalized_hooks = {}
         if hooks.is_a?(Hash)
           hooks.each do |k, v|
             next unless k.is_a?(String) && !k.empty?
-            next unless v.is_a?(Hash)
-
-            hv = v.transform_keys(&:to_sym)
-            sha = (hv[:sha256] || "").to_s
-            sha = "sha256:#{sha}" unless sha.empty? || sha.start_with?("sha256:")
-            normalized_hooks[k] = {
-              sha256: sha,
-              event: (hv[:event] || "").to_s,
-              on_error: (hv[:on_error] || "skip").to_s,
-              priority: (hv[:priority] || 100).to_i
-            }
+            next unless v.is_a?(Hash) || v.is_a?(BundleHook)
+
+            normalized_hooks[k] = BundleHook.parse(v)
           end
         end
         # Prune stale hook bases
@@ -210,12 +203,10 @@ module Samagotchi
         # compares against it, and a declared sha can be wrong (installing
         # only warns about that).
         hooks_files = {} unless hooks_files.is_a?(Hash)
-        normalized_hooks.each do |k, meta|
+        normalized_hooks.each do |k, hook|
           src = hooks_files[k] || hooks_files[k.to_sym]
-          if src && File.exist?(src.to_s)
-            meta = meta.merge(sha256: "sha256:#{Digest::SHA256.hexdigest(File.read(src.to_s))}")
-          end
-          hooks_map[k] = meta.transform_keys(&:to_s)
+          hook = hook.with(sha256: BundleHook.of_file(src.to_s).sha256) if src && File.exist?(src.to_s)
+          hooks_map[k] = hook.to_record
           next unless src && File.exist?(src.to_s)
 
           begin

data/lib/samagotchi/send_command.rb

@@ -481,26 +481,8 @@ module Samagotchi
     # (a bundle's too).
     def command_like?(text) = text.to_s.lstrip.start_with?("/", "!")
 
-    # The UI-only built-in command +text+ (stripped) is a line of (/stats,
-    # /exit, …), or nil: the worker never runs it, so chi send must not pass
-    # it on. What the UIs run: the line as the entry's match takes it — bare
-    # "exit" too (/exit's match), but not with arguments ("/exit --delete" is
-    # a UI line; "/stats please" is a prompt), as in a terminal.
-    # @return [Commands::Registry::Entry, nil]
-    def local_command(text)
-      line = text.to_s.strip
-      return nil unless command_like?(line) || line.match?(/\Aexit\z/i)
-
-      entry = SessionCommands.builtin_registry.lookup_local(line)
-      # Only the exact line the UI runs: "/stats please" is a prompt, and
-      # "/exit --delete" is left to the worker (the TUI runs it as /exit, the
-      # worker answers its unknown-command way). Bare "exit" is /exit's line
-      # as its match takes it; the reply names the command, /exit.
-      return nil unless entry
-      return entry if line == entry.name
-
-      line.match?(/\Aexit\z/i) ? entry : nil
-    end
+    # @return [Commands::Registry::Entry, nil] SessionCommands.ui_only_entry
+    def local_command(text) = SessionCommands.ui_only_entry(text)
 
     # A UI-only command: nothing is sent (with --new, no session is created
     # either). /stats points at its model-free reader and names the session;
@@ -525,13 +507,7 @@ module Samagotchi
       CLI::Exit::FAILED
     end
 
-    # Why a UI-only command isn't sent: /stats points at its model-free
-    # reader (naming the session when there is one).
-    def local_refusal(name, id)
-      return "#{name} is a terminal and web command; chi send doesn't run it" unless name == "/stats"
-
-      "#{name} is a terminal and web command; use chi sessions stats #{id ? id[0, 8] : "ID"}"
-    end
+    def local_refusal(name, id) = SessionCommands.ui_only_refusal(name, id, runner: "chi send")
 
     # --wait after a message that ran as a session command: no reply comes
     # for it. Its output shows where the session is open.

data/lib/samagotchi/session_commands.rb

@@ -141,6 +141,34 @@ module Samagotchi
       @builtin_registry ||= register_builtins(Commands::Registry.new).freeze
     end
 
+    # The UI-only built-in command +text+ is a line of (/stats, /exit, …), or
+    # nil: neither a worker nor a one-shot run (chi send, chi -p
+    # --non-interactive) runs it, so they refuse it rather than send it to
+    # the model as a prompt. What the UIs run: the line as the entry's match
+    # takes it — bare "exit" too (/exit's match), but not with arguments
+    # ("/exit --delete" is a UI line; "/stats please" is a prompt), as in a
+    # terminal.
+    # @return [Commands::Registry::Entry, nil]
+    def self.ui_only_entry(text)
+      line = text.to_s.strip
+      return nil unless line.start_with?("/", "!") || line.match?(/\Aexit\z/i)
+
+      entry = builtin_registry.lookup_local(line)
+      return nil unless entry
+      return entry if line == entry.name
+
+      line.match?(/\Aexit\z/i) ? entry : nil
+    end
+
+    # Why a UI-only command isn't run by +runner+ ("chi send"): /stats points
+    # at its model-free reader (naming the session +id+ when there is one).
+    # @return [String]
+    def self.ui_only_refusal(name, id, runner:)
+      return "#{name} is a terminal and web command; #{runner} doesn't run it" unless name == "/stats"
+
+      "#{name} is a terminal and web command; use chi sessions stats #{id ? id[0, 8] : "ID"}"
+    end
+
     # The name of this chi's own session command +line+ is (one a worker
     # runs), or nil. A worker that answers such a line unknown_command runs
     # an older chi that doesn't have it yet (/llm-context against 0.39.0):
@@ -488,7 +516,7 @@ module Samagotchi
 
         key = alias_name.strip.downcase
         warn_prefix = previous ? "warning: overwriting alias '#{key}' (#{previous} -> #{model_name}); " : ""
-        base = persist_default ? "runtime model set to #{model_name}#{model_note} and default updated" : "runtime model set to #{model_name}#{model_note}"
+        base = persist_default ? "runtime model set to #{model_name}#{model_note} and default updated#{thinking_note}" : "runtime model set to #{model_name}#{model_note}#{thinking_note}"
         ["#{warn_prefix}#{base}; alias '#{key}' -> '#{model_name}' persisted", true]
       else
         return ["--default requires a model name: usage /model --default <name> or /model <name> [--default]", false] if arg.empty?
@@ -497,14 +525,14 @@ module Samagotchi
           return ["--default cannot be combined with clear/default/none/off", false] if persist_default
 
           switch_model(@default_model)
-          return ["runtime model reset to #{model_name}#{model_note}#{notes_note}", true]
+          return ["runtime model reset to #{model_name}#{model_note}#{thinking_note}#{notes_note}", true]
         end
 
         switch_model(arg, persist_default: persist_default)
         if persist_default
-          ["runtime model set to #{model_name}#{model_note} and default updated#{notes_note}", true]
+          ["runtime model set to #{model_name}#{model_note} and default updated#{thinking_note}#{notes_note}", true]
         else
-          ["runtime model set to #{model_name}#{model_note}#{notes_note}", true]
+          ["runtime model set to #{model_name}#{model_note}#{thinking_note}#{notes_note}", true]
         end
       end
     end

data/lib/samagotchi/session_manager.rb

@@ -6,6 +6,7 @@ require "time"
 require "securerandom"
 require "rbconfig"
 require_relative "client_id"
+require_relative "analytics_file"
 require_relative "atomic_file"
 require_relative "config"
 require_relative "delivery"
@@ -974,7 +975,7 @@ module Samagotchi
     # session keeps. "pid" is the pid file workers wrote until 2026-10-01:
     # nothing writes or reads it now, but a folder from before still has one
     # and is still empty.
-    EMPTY_SKELETON_FILES = ["pid", "owner.lock", WorkerSidecar::FILE, "analytics.json"].freeze
+    EMPTY_SKELETON_FILES = ["pid", "owner.lock", WorkerSidecar::FILE, AnalyticsFile::NAME].freeze
     EMPTY_DIRS = [SessionInbox::INPUT_DIR, SessionInbox::NOTES_DIR, "images"].freeze
     EMPTY_SKELETON_DIRS = (EMPTY_DIRS + [SessionInbox::OUTPUT_DIR]).freeze
 
@@ -1058,17 +1059,48 @@ module Samagotchi
         path = File.join(dir, name)
         if EMPTY_SKELETON_DIRS.include?(name)
           File.directory?(path) && (!EMPTY_DIRS.include?(name) || Dir.empty?(path))
-        elsif name == "analytics.json"
-          Array(JSON.parse(File.read(path))["turn_records"]).empty?
+        elsif name == AnalyticsFile::NAME
+          analytics_empty?(path)
         # Cards and notices from before any turn (Bridge::CardStore).
         elsif name == "cards.json"
-          JSON.parse(File.read(path))["turns"].to_i.zero?
+          cards_empty?(path)
         else
           EMPTY_SKELETON_FILES.include?(name)
         end
       end
     end
 
+    # A folder's analytics.json is empty only when it is a JSON object with
+    # an empty turn_records array. Anything unreadable, not JSON, not an
+    # object, the wrong type, or turn_records the wrong shape reads as
+    # "not empty": a broken analytics keeps the folder instead of crashing
+    # the retention sweep (or of a wrong-shape one reading as empty).
+    def self.analytics_empty?(path)
+      data = read_json(path)
+      turns = data.is_a?(Hash) ? data["turn_records"] : nil
+      turns.is_a?(Array) && turns.empty?
+    end
+
+    # A folder's cards.json is empty only when it is a JSON object whose
+    # turns is an integer zero. Anything unreadable, not JSON, not an
+    # object, the wrong type, or turns not an integer reads as "not empty":
+    # a broken or wrong-shape cards file keeps the folder instead of
+    # raising (Array#/Hash#to_i) or reading as empty.
+    def self.cards_empty?(path)
+      data = read_json(path)
+      turns = data.is_a?(Hash) ? data["turns"] : nil
+      turns.is_a?(Integer) && turns.zero?
+    end
+
+    # A session-dir JSON file's contents, or nil when it is missing,
+    # unreadable, not JSON or not an object (mirrors AnalyticsFile#read): a
+    # broken file reads as none, so its folder is kept, not deleted.
+    def self.read_json(path)
+      JSON.parse(File.read(path))
+    rescue JSON::ParserError, SystemCallError
+      nil
+    end
+
     # Delete one session: its <id>.json, the whole <id>/ directory
     # (history sidecars, input, output, notes, images) and its attached
     # context (ContextSources: its sources, subscriptions, mute markers). The CLI, the TUI's

data/lib/samagotchi/session_metrics.rb

@@ -5,6 +5,7 @@ require "monitor"
 require "time"
 require "fileutils"
 require "securerandom"
+require_relative "analytics_file"
 require_relative "atomic_file"
 require_relative "token_usage"
 require_relative "model_price"
@@ -172,8 +173,8 @@ module Samagotchi
     # @param budget_tokens [Integer, Proc, nil] see .saved_context_pct
     # @return [SavedSummary, nil]
     def self.saved_summary(session_dir, budget_tokens: nil)
-      data = JSON.parse(File.read(File.join(session_dir, "analytics.json")))
-      return nil unless data.is_a?(Hash)
+      data = AnalyticsFile.read(session_dir)
+      return nil unless data
 
       tokens = data["tokens"].is_a?(Hash) ? data["tokens"] : {}
       count = ->(key) { tokens[key].is_a?(Numeric) ? tokens[key] : 0 }
@@ -182,7 +183,7 @@ module Samagotchi
                        reasoning_sum: count.call("reasoning_sum"), cost_sum: count.call("cost_sum"),
                        cost_estimate_sum: count.call("cost_estimate_sum"),
                        memory_index: data["memory_index"].is_a?(Hash) ? data["memory_index"] : nil)
-    rescue JSON::ParserError, SystemCallError, TypeError
+    rescue TypeError
       nil
     end
 
@@ -217,10 +218,10 @@ module Samagotchi
     def self.saved_tool_records(session_dir, turn_id)
       return [] if turn_id.to_s.empty?
 
-      records = JSON.parse(File.read(File.join(session_dir, "analytics.json")))["tool_records"]
+      records = AnalyticsFile.read(session_dir)&.dig("tool_records")
       Array(records).select { |r| r.is_a?(Hash) && r["turn_id"] == turn_id }
                     .sort_by { |r| [r["iteration"].to_i, r["call_index"].to_i] }
-    rescue JSON::ParserError, SystemCallError, TypeError
+    rescue TypeError
       []
     end
 
@@ -234,9 +235,9 @@ module Samagotchi
     def self.saved_turn_record(session_dir, turn_id)
       return nil if turn_id.to_s.empty?
 
-      records = JSON.parse(File.read(File.join(session_dir, "analytics.json")))["turn_records"]
+      records = AnalyticsFile.read(session_dir)&.dig("turn_records")
       Array(records).find { |r| r.is_a?(Hash) && r["id"] == turn_id }
-    rescue JSON::ParserError, SystemCallError, TypeError
+    rescue TypeError
       nil
     end
 
@@ -422,8 +423,7 @@ module Samagotchi
       # (XDG) location; passing an explicit nil would override it and break
       # File.join.
       FileUtils.mkdir_p(dir = session_dir(sid, state_dir || @state_dir))
-      path = File.join(dir, "analytics.json")
-      AtomicFile.write(path, JSON.pretty_generate(data) + "\n")
+      AtomicFile.write(AnalyticsFile.path(dir), JSON.pretty_generate(data) + "\n")
       @mutex.synchronize { @persisted_turns = [@persisted_turns, turn_count].max }
       true
     rescue StandardError
@@ -977,11 +977,8 @@ module Samagotchi
     # broken file, or an older shape: nothing, or zeros where keys are
     # missing). Caller holds the mutex.
     def load_persisted
-      path = File.join(session_dir(@session_id, @state_dir), "analytics.json")
-      return unless File.file?(path)
-
-      prior = JSON.parse(File.read(path))
-      return unless prior.is_a?(Hash)
+      prior = AnalyticsFile.read(session_dir(@session_id, @state_dir))
+      return unless prior
 
       loaded_turns = loaded_records(prior["turn_records"])
       @turn_records = loaded_turns + @turn_records
@@ -1004,12 +1001,10 @@ module Samagotchi
       @memory_index ||= symbolized(prior["memory_index"]) if prior["memory_index"].is_a?(Hash)
       # The window last seen, until this process's first generation reports.
       window = prior["context"].is_a?(Hash) ? prior["context"] : {}
-      if window["window_tokens"] && @context_window_tokens.nil?
-        @context_window_tokens = window["window_tokens"]
-        @context_window_source = window["window_source"]
-      end
-    rescue JSON::ParserError, SystemCallError
-      nil
+      return unless window["window_tokens"] && @context_window_tokens.nil?
+
+      @context_window_tokens = window["window_tokens"]
+      @context_window_source = window["window_source"]
     end
 
     def symbolized(hash)

data/lib/samagotchi/sessions_command.rb

@@ -5,6 +5,7 @@ require_relative "session"
 require_relative "session_manager"
 require_relative "session_retention"
 require_relative "project_scope"
+require_relative "analytics_file"
 require_relative "session_metrics"
 require_relative "recap_store"
 require_relative "session_delete_command"
@@ -337,10 +338,10 @@ module Samagotchi
           return [TerminalUI::EventRenderer.deep_symbolize_keys(body), true, nil]
         end
       end
-      return [nil, false, nil] unless File.file?(File.join(dir, "analytics.json"))
+      return [nil, false, nil] unless File.file?(Samagotchi::AnalyticsFile.path(dir))
 
       snapshot = Samagotchi::SessionMetrics.new.tap { |m| m.session_id = session.id }.saved_snapshot
-      note = live_worker?(session.id) ? "(no live worker answered; from the saved analytics.json)" : nil
+      note = live_worker?(session.id) ? "(no live worker answered; from the saved #{Samagotchi::AnalyticsFile::NAME})" : nil
       [snapshot, false, note]
     end
 

data/lib/samagotchi/terminal_ui/formatting.rb

@@ -20,7 +20,7 @@ module Samagotchi
       # (no UI: the same text from the CLI).
       # @return [String] "(no metrics yet)" without a snapshot
       def self.format_session_metrics(snapshot)
-        (@formatter ||= Object.new.extend(Formatting)).send(:format_session_metrics, snapshot)
+        (@formatter ||= Object.new.extend(Formatting)).format_session_metrics(snapshot)
       end
 
       def format_tool_activity_line(activity, duration_ms: nil)
@@ -543,6 +543,8 @@ module Samagotchi
         value.length > width ? value[0, width] : value
       end
 
+      public
+
       # Render the analytics snapshot as a compact, user-facing report. Raw event
       # logs (debug-only) are intentionally excluded; this surface is for the REPL
       # and `chi sessions stats` (the module function above).
@@ -607,6 +609,8 @@ module Samagotchi
         lines.join("\n")
       end
 
+      private
+
       # " (25.0% of the 64000 budget)" when the session's llm_context budget
       # is set and smaller than the window, else " (12.5%)": the live meter
       # counts against the smaller of the two (ContextStatus#counted_against),

data/lib/samagotchi/terminal_ui.rb

@@ -238,6 +238,10 @@ module Samagotchi
       # --non-interactive with no --prompt is a harmless no-op exit: build
       # nothing and return (no transient session, no banner).
       return if @non_interactive && @prompt.nil?
+      # A UI-only command (/stats, /exit …) isn't run without the REPL, and
+      # isn't a prompt either: refused as chi send refuses it, before any
+      # session is made (bin/chi exits 1).
+      return refuse_one_shot_ui_command if @non_interactive && SessionCommands.ui_only_entry(@prompt)
 
       session = @resume_session || @engine.store_model!(Session.new_session(
         mode: "assist",
@@ -348,7 +352,7 @@ module Samagotchi
     # so the session is kept and `chi --resume` takes it up again.
     # @return [Symbol] :turn_failed
     def one_shot_failed(session, error)
-      warn "Error: #{error.respond_to?(:summary) ? error.summary : error.message}"
+      warn "Error: #{@engine.failure_summary(error)}"
       if !@scratch && Session.exist?(session.id)
         warn "chi: the session is kept with your prompt; continue it with: chi --resume #{session.id}"
       end
@@ -371,6 +375,14 @@ module Samagotchi
       :turn_failed if result.status == :error
     end
 
+    # `chi -p /stats --non-interactive`: why it doesn't run, on stderr.
+    # @return [Symbol] :turn_failed
+    def refuse_one_shot_ui_command
+      name = SessionCommands.ui_only_entry(@prompt).name
+      warn "chi: refused: #{SessionCommands.ui_only_refusal(name, @resume_session&.id, runner: "--non-interactive")}"
+      :turn_failed
+    end
+
     # Ctrl-C in a -p --non-interactive turn: the Engine kept the prompt and
     # a cancel note in the session (it saves only a failed turn), so save
     # it here: `chi --resume` takes it up again. A scratch session goes in

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.52.0"
+  VERSION = "0.53.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/app.rb

@@ -9,6 +9,7 @@ require "uri"
 require "rack"
 require "rack/request"
 
+require_relative "../analytics_file"
 require_relative "../client_id"
 require_relative "../delivery"
 require_relative "../answer_tail"
@@ -1722,13 +1723,7 @@ module Samagotchi
       end
 
       def read_analytics(session_id)
-        path = File.join(@session_class.session_dir(session_id, state_dir: default_state_dir), "analytics.json")
-        return {} unless File.file?(path)
-
-        data = JSON.parse(File.read(path))
-        data.is_a?(Hash) ? data : {}
-      rescue JSON::ParserError, SystemCallError
-        {}
+        AnalyticsFile.read(@session_class.session_dir(session_id, state_dir: default_state_dir)) || {}
       end
 
       def merge_timing_records(persisted, live)

data/lib/samagotchi/web/public/app.js

@@ -126,7 +126,6 @@ const llmContextNewControl = createLlmContextControl({
 // in the session's worker.
 const thinkingControl = createThinkingControl({
   el: infoTextEl,
-  escapeHtml,
   summary: () => (selected ? current.thinking : null),
   session: () => selected,
   running: () => liveTurn.running,
@@ -139,7 +138,6 @@ let newChatThinking = null;
 const newChatThinkingSummary = () => (modelPickEl.hidden ? null : modelPicker.chosenRow()?.thinking || null);
 const thinkingNewControl = createThinkingControl({
   el: thinkingNewEl,
-  escapeHtml,
   summary: newChatThinkingSummary,
   kind: NEW_CHAT,
   choice: () => newChatThinking,

data/lib/samagotchi/web/public/command_complete.js

@@ -4,17 +4,22 @@
 
 // The commands to offer while the composer holds one "/word" being typed
 // (no space or newline yet): the session's slash commands that start with
-// it, by name. The terminal UIs' own (local: /stats, /exit …) don't run here.
+// it, by name. A UI's own (local) one is offered only when its uis name
+// the web (/cut); the terminals' own (/stats, /exit …) don't run here.
 export function commandMatches(commands, text) {
   const typed = String(text || "");
   if (!/^\/\S*$/.test(typed)) return [];
   const needle = typed.toLowerCase();
   return (Array.isArray(commands) ? commands : [])
-    .filter((c) => c && !c.local && typeof c.name === "string" && c.name.startsWith("/"))
+    .filter((c) => c && runsInWeb(c) && typeof c.name === "string" && c.name.startsWith("/"))
     .filter((c) => c.name.toLowerCase().startsWith(needle))
     .sort((a, b) => a.name.localeCompare(b.name));
 }
 
+function runsInWeb(command) {
+  return !command.local || (Array.isArray(command.uis) && command.uis.includes("web"));
+}
+
 // What picking +name+ does to the composer: {text, send}. The name
 // completes with a space for its arguments; ⏎ on a name already typed in
 // full sends it as it is (⏎ on "/help" runs /help).

data/lib/samagotchi/web/public/thinking_chip.js

@@ -12,6 +12,7 @@
 // nothing is sent unless the user sets one.
 
 import { NEW_CHAT, SESSION, popoverPlace } from "./llm_context_chip.js";
+import { html, nothing, render } from "./vendor/lit-html.js";
 
 export const LEVELS = ["off", "low", "medium", "high"];
 const DEFAULT = "default";
@@ -36,6 +37,8 @@ export function chipModel(summary, { kind = SESSION } = {}) {
   return { text: `think ${summary.level}${own ? ` · ${kind}` : ""}`, title, own };
 }
 
+// The session bar's chip, as a string: the info bar is still built as one
+// (app.js); it becomes a template when the info bar moves to lit.
 export function chipHtml(summary, escapeHtml) {
   const chip = chipModel(summary);
   if (!chip) return "";
@@ -50,32 +53,31 @@ export function commandLine(level, initial = null) {
   return `/thinking ${level}`;
 }
 
-function option(value, label, chosen, escapeHtml) {
-  return `<option value="${escapeHtml(value)}"${value === chosen ? " selected" : ""}>${escapeHtml(label)}</option>`;
-}
-
 // "Now: low (session)", "Now: default (the model's own)".
 export function nowText(summary) {
   return `Now: ${summary.level} (${summary.source || "the model's own"})`;
 }
 
-// The popover's form. For the new chat (kind NEW_CHAT), +summary+ is the
-// model's and +choice+ the level the form shows.
-export function formHtml(summary, escapeHtml, { running = false, kind = SESSION, choice = null } = {}) {
+const option = (value, label, chosen) => html`<option value=${value} ?selected=${value === chosen}>${label}</option>`;
+
+// The popover's form (a lit-html template). For the new chat (kind
+// NEW_CHAT), +summary+ is the model's and +choice+ the level the form
+// shows; +now+ is the summary its "Now:" line reads (refresh passes a
+// newer one, the rest stays as the form opened).
+export function formTemplate(summary, { running = false, kind = SESSION, choice = null, now = summary } = {}) {
   const fresh = kind === NEW_CHAT;
   const chosen = (fresh ? choice : summary.own) || DEFAULT;
   const follow = summary.own && !fresh ? "follow the model" : `follow the model (${summary.level})`;
   const when = fresh ? "For the new chat's first turn on; not remembered for the next one."
     : "From the next turn's start. On Gemma the whole prompt is read again; a hosted API may restart its cache.";
-  return `<form class="think-form llmctx-form"><div class="ctx-pop-head"><strong>Thinking</strong>` +
-    `<span class="ctx-pop-kind">${fresh ? NEW_CHAT : "this session"}</span>` +
-    `<button type="button" class="ctx-pop-close" data-act="close" aria-label="Close">×</button></div>` +
-    `<div class="ctx-pop-meta think-now">${escapeHtml(nowText(summary))}</div>` +
-    `<label class="llmctx-field"><span>Level</span><select name="level">` +
-    option(DEFAULT, follow, chosen, escapeHtml) +
-    LEVELS.map((level) => option(level, level, chosen, escapeHtml)).join("") + `</select></label>` +
-    `<div class="ctx-pop-meta">${when}${running ? " A turn is running: it applies after this turn." : ""}</div>` +
-    `<div class="ctx-pop-actions"><button type="submit" class="llmctx-set">Set</button></div></form>`;
+  return html`<form class="think-form llmctx-form"><div class="ctx-pop-head"><strong>Thinking</strong
+    ><span class="ctx-pop-kind">${fresh ? NEW_CHAT : "this session"}</span
+    ><button type="button" class="ctx-pop-close" data-act="close" aria-label="Close">×</button></div
+    ><div class="ctx-pop-meta think-now">${nowText(now)}</div
+    ><label class="llmctx-field"><span>Level</span><select name="level">${option(DEFAULT, follow, chosen)}${
+      LEVELS.map((level) => option(level, level, chosen))}</select></label
+    ><div class="ctx-pop-meta">${when}${running ? " A turn is running: it applies after this turn." : ""}</div
+    ><div class="ctx-pop-actions"><button type="submit" class="llmctx-set">Set</button></div></form>`;
 }
 
 // The chip's popover, as createLlmContextControl's: el is where the chip
@@ -86,7 +88,7 @@ export function formHtml(summary, escapeHtml, { running = false, kind = SESSION,
 // and choose(next) takes a Set's (null for "follow the model"). id and
 // anchor (the chip's selector) keep it apart from the llm ctx control on
 // the same element.
-export function createThinkingControl({ el, escapeHtml, summary, session = () => null, running = () => false, run,
+export function createThinkingControl({ el, summary, session = () => null, running = () => false, run,
                                         kind = SESSION, choice = () => null, choose = null,
                                         id = "thinkingPopover", anchor: anchorSel = "[data-think-chip]",
                                         doc = document, win = window }) {
@@ -99,6 +101,11 @@ export function createThinkingControl({ el, escapeHtml, summary, session = () =>
   doc.body.appendChild(pop);
   let initial = null;
   let openFor = null;
+  // What the open form was drawn from: the model's or session's summary
+  // and the form's options. A closed popover is empty, so each open draws
+  // a fresh form (an unsent pick is gone).
+  let shown = null;
+  const draw = (now) => render(formTemplate(shown.data, { ...shown.opts, now }), pop);
 
   function place(anchor) {
     const width = Math.min(320, win.innerWidth - 32);
@@ -117,7 +124,8 @@ export function createThinkingControl({ el, escapeHtml, summary, session = () =>
     if (!data) return;
     initial = (fresh ? choice() : data.own) || DEFAULT;
     openFor = session();
-    pop.innerHTML = formHtml(data, escapeHtml, { running: running(), kind, choice: choice() });
+    shown = { data, opts: { running: running(), kind, choice: choice() } };
+    draw(data);
     pop.hidden = false;
     place(anchor);
   }
@@ -126,17 +134,19 @@ export function createThinkingControl({ el, escapeHtml, summary, session = () =>
     pop.hidden = true;
     initial = null;
     openFor = null;
+    shown = null;
+    render(nothing, pop);
   }
 
   function isOpen() { return !pop.hidden; }
 
-  // A new summary: an open form keeps the user's pick; only "Now:" follows.
+  // A new summary: an open form keeps the user's pick; only "Now:" follows
+  // (the same template again: lit writes that line alone).
   function refresh() {
     if (!isOpen()) return;
     const data = summary();
     if (!data || session() !== openFor) return close();
-    const now = pop.querySelector(".think-now");
-    if (now) now.textContent = nowText(data);
+    draw(data);
   }
 
   el.addEventListener("click", (e) => {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: samagotchi
 version: !ruby/object:Gem::Version
-  version: 0.52.0
+  version: 0.53.0
 platform: ruby
 authors:
 - Dmitry Dedov
@@ -146,6 +146,7 @@ files:
 - docs/sub-agent.md
 - docs/testing.md
 - lib/samagotchi.rb
+- lib/samagotchi/analytics_file.rb
 - lib/samagotchi/answer_command.rb
 - lib/samagotchi/answer_display.rb
 - lib/samagotchi/answer_tail.rb
@@ -332,6 +333,7 @@ files:
 - lib/samagotchi/log_subscriber.rb
 - lib/samagotchi/memory_bundle.rb
 - lib/samagotchi/memory_bundle/builder.rb
+- lib/samagotchi/memory_bundle/bundle_hook.rb
 - lib/samagotchi/memory_bundle/index_size.rb
 - lib/samagotchi/memory_bundle/index_sync.rb
 - lib/samagotchi/memory_bundle/index_updater.rb