@pimote/pimote 0.6.0 → 0.8.0

package/client/build/index.html

@@ -12,12 +12,12 @@
     <link rel="icon" type="image/png" sizes="192x192" href="/pwa/icon-192.png" />
     <link rel="icon" type="image/png" sizes="512x512" href="/pwa/icon-512.png" />
     <link rel="apple-touch-icon" href="/pwa/icon-192.png" />
-    <link href="/_app/immutable/entry/start.BNnDRfmt.js" rel="modulepreload">
-		<link href="/_app/immutable/chunks/DHiuV2ft.js" rel="modulepreload">
-		<link href="/_app/immutable/chunks/DegHYiTr.js" rel="modulepreload">
+    <link href="/_app/immutable/entry/start.DUfrZpFg.js" rel="modulepreload">
+		<link href="/_app/immutable/chunks/DMWd5mk8.js" rel="modulepreload">
+		<link href="/_app/immutable/chunks/COcpV1OD.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/B8lQCytv.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/5FogVG_p.js" rel="modulepreload">
-		<link href="/_app/immutable/entry/app.DZYoujEP.js" rel="modulepreload">
+		<link href="/_app/immutable/entry/app.DW3BNxC_.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/CHncfsjL.js" rel="modulepreload">
 		<link href="/_app/immutable/chunks/D1hYfEew.js" rel="modulepreload">
 		
@@ -26,15 +26,15 @@
     <div style="display: contents">
 			<script>
 				{
-					__sveltekit_8yi2la = {
+					__sveltekit_113ntip = {
 						base: ""
 					};
 
 					const element = document.currentScript.parentElement;
 
 					Promise.all([
-						import("/_app/immutable/entry/start.BNnDRfmt.js"),
-						import("/_app/immutable/entry/app.DZYoujEP.js")
+						import("/_app/immutable/entry/start.DUfrZpFg.js"),
+						import("/_app/immutable/entry/app.DW3BNxC_.js")
 					]).then(([kit, app]) => {
 						kit.start(app, element);
 					});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pimote/pimote",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Web client and embedded server for pi with multi-session browser access, streaming, and extension UI support",
   "type": "module",
   "license": "MIT",
@@ -73,7 +73,7 @@
     "typescript-eslint": "^8.58.0"
   },
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "^0.76.0",
+    "@earendil-works/pi-coding-agent": "^0.79.1",
     "@fontsource-variable/jetbrains-mono": "^5.2.8",
     "@streamparser/json": "^0.0.22",
     "patch-package": "^8.0.1",

package/server/dist/config.js

@@ -1,4 +1,4 @@
-import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { readFile, writeFile, mkdir, rename } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { PIMOTE_CONFIG_PATH } from './paths.js';
 export const CONFIG_PATH = PIMOTE_CONFIG_PATH;
@@ -93,6 +93,9 @@ export async function ensureVapidKeys(config) {
     existing.vapidPublicKey = keys.publicKey;
     existing.vapidPrivateKey = keys.privateKey;
     await mkdir(dirname(CONFIG_PATH), { recursive: true });
-    await writeFile(CONFIG_PATH, JSON.stringify(existing, null, 2) + '\n', 'utf-8');
+    // Atomic write (tmp + rename) so a crash mid-write can't corrupt the config.
+    const tmpPath = CONFIG_PATH + '.tmp';
+    await writeFile(tmpPath, JSON.stringify(existing, null, 2) + '\n', 'utf-8');
+    await rename(tmpPath, CONFIG_PATH);
     return config;
 }

package/server/dist/event-buffer.js

@@ -192,6 +192,15 @@ export class EventBuffer {
                     error: sdkEvent.error ?? '',
                     ...(sdkEvent.extensionName ? { extensionName: sdkEvent.extensionName } : {}),
                 };
+            case 'tree_navigation_start':
+                return {
+                    ...base,
+                    type: 'tree_navigation_start',
+                    targetId: sdkEvent.targetId ?? '',
+                    summarizing: sdkEvent.summarizing ?? false,
+                };
+            case 'tree_navigation_end':
+                return { ...base, type: 'tree_navigation_end' };
             default:
                 // Unknown event type — pass through as agent_start (shouldn't happen)
                 return { ...base, type: 'agent_start' };

package/server/dist/extension-ui-bridge.js

@@ -51,28 +51,44 @@ export function createExtensionUIBridge(slot, pushNotificationService, options)
     async function dialogWithTimeout(requestId, requestEvent, opts, fallback) {
         const responsePromise = waitForSlotUiResponse(slot, requestId, requestEvent);
         const racers = [responsePromise];
+        let timeoutHandle;
+        let abortListener;
+        const signal = opts?.signal;
         if (opts?.timeout) {
-            racers.push(new Promise((resolve) => setTimeout(() => resolve(fallback), opts.timeout)));
+            racers.push(new Promise((resolve) => {
+                timeoutHandle = setTimeout(() => resolve(fallback), opts.timeout);
+            }));
         }
-        if (opts?.signal) {
-            if (opts.signal.aborted) {
+        if (signal) {
+            if (signal.aborted) {
                 // Remove the pending entry we just created — no one will respond to it
                 slot.sessionState.pendingUiResponses.delete(requestId);
                 return fallback;
             }
             racers.push(new Promise((resolve) => {
-                opts.signal.addEventListener('abort', () => resolve(fallback), { once: true });
+                abortListener = () => resolve(fallback);
+                signal.addEventListener('abort', abortListener, { once: true });
             }));
         }
         if (racers.length === 1)
             return responsePromise;
-        const result = await Promise.race(racers);
-        // If timeout or abort won the race, the pending entry is stale — the server
-        // has already moved on. Remove it so it won't be replayed on reconnect.
-        if (slot.sessionState.pendingUiResponses.has(requestId)) {
-            slot.sessionState.pendingUiResponses.delete(requestId);
+        try {
+            const result = await Promise.race(racers);
+            // If timeout or abort won the race, the pending entry is stale — the server
+            // has already moved on. Remove it so it won't be replayed on reconnect.
+            if (slot.sessionState.pendingUiResponses.has(requestId)) {
+                slot.sessionState.pendingUiResponses.delete(requestId);
+            }
+            return result;
+        }
+        finally {
+            // Clear the timeout timer (keeps the event loop from staying alive / firing
+            // pointlessly) and detach the abort listener if the response won the race.
+            if (timeoutHandle !== undefined)
+                clearTimeout(timeoutHandle);
+            if (signal && abortListener)
+                signal.removeEventListener('abort', abortListener);
         }
-        return result;
     }
     const ui = {
         // ---- Dialog methods (send + wait for response) ----

package/server/dist/file-references.js

@@ -0,0 +1,123 @@
+import { execFile } from 'node:child_process';
+import { accessSync, constants } from 'node:fs';
+import { homedir } from 'node:os';
+import { delimiter, isAbsolute, join, resolve } from 'node:path';
+/**
+ * Candidate executable names for `fd`. Debian/Ubuntu ship the binary as
+ * `fdfind` to avoid a name clash, so both are tried.
+ */
+const FD_BINARY_NAMES = ['fd', 'fdfind'];
+/**
+ * Common install directories to probe in addition to `PATH`. The server process
+ * is often launched with a minimal `PATH` that omits these, so an `fd` installed
+ * via cargo, Homebrew, or pi's own bin dir would otherwise be invisible.
+ */
+function fdSearchDirs() {
+    const home = homedir();
+    const pathDirs = (process.env.PATH ?? '').split(delimiter).filter((d) => d.length > 0);
+    const extraDirs = [join(home, '.pi', 'agent', 'bin'), join(home, '.cargo', 'bin'), join(home, '.local', 'bin'), '/usr/local/bin', '/usr/bin', '/opt/homebrew/bin'];
+    return [...pathDirs, ...extraDirs];
+}
+/**
+ * Resolve an `fd` executable to an absolute path, probing `PATH` and common
+ * install dirs for both `fd` and `fdfind`. Returns `null` when none is found.
+ */
+export function resolveFdPath(dirs = fdSearchDirs()) {
+    for (const dir of dirs) {
+        for (const name of FD_BINARY_NAMES) {
+            const candidate = join(dir, name);
+            try {
+                accessSync(candidate, constants.X_OK);
+                return candidate;
+            }
+            catch {
+                // Not here; keep probing.
+            }
+        }
+    }
+    return null;
+}
+/** Cap on the number of fd results requested. */
+const MAX_RESULTS = 50;
+/**
+ * Compute `@`-file-path autocomplete suggestions for the given prefix, resolved
+ * against `cwd`. Returns `{ items: [], fdAvailable: false }` when `fd` is
+ * missing so the caller can emit a one-time warning.
+ */
+export async function completeFileRefs(input) {
+    const { cwd, prefix } = input;
+    const fdPath = input.fdPath ?? resolveFdPath() ?? 'fd';
+    const runFd = input.runFd ?? defaultRunFd;
+    const { quoted, scope, query } = parsePrefix(prefix);
+    const baseDir = resolveBaseDir(scope, cwd);
+    const args = ['--type', 'f', '--type', 'd', '--hidden', '--follow', '--exclude', '.git', '--max-results', String(MAX_RESULTS), '--base-directory', baseDir];
+    if (query !== '') {
+        // `--` ends fd's option parsing so a query starting with `-` is treated as a
+        // positional pattern, not a flag (matches the TUI's walkDirectoryWithFd).
+        args.push('--', query);
+    }
+    const invocation = { fdPath, baseDir, query, args };
+    const { available, lines } = await runFd(invocation);
+    if (!available) {
+        return { items: [], fdAvailable: false };
+    }
+    const items = lines.map((line) => mapLineToItem(line, scope, quoted));
+    return { items, fdAvailable: true };
+}
+/**
+ * Parse the raw `@`-token into the quoting flag, the typed directory scope (the
+ * text up to and including the last `/`), and the fd query pattern (the trailing
+ * segment after the last `/`).
+ */
+function parsePrefix(prefix) {
+    let rest = prefix.startsWith('@') ? prefix.slice(1) : prefix;
+    let quoted = false;
+    if (rest.startsWith('"')) {
+        quoted = true;
+        rest = rest.slice(1);
+    }
+    const lastSlash = rest.lastIndexOf('/');
+    if (lastSlash === -1) {
+        return { quoted, scope: '', query: rest };
+    }
+    return { quoted, scope: rest.slice(0, lastSlash + 1), query: rest.slice(lastSlash + 1) };
+}
+/** Resolve the typed scope string to an absolute search root against `cwd`. */
+function resolveBaseDir(scope, cwd) {
+    if (scope === '') {
+        return cwd;
+    }
+    if (scope.startsWith('~/')) {
+        return resolve(homedir(), scope.slice(2));
+    }
+    if (isAbsolute(scope)) {
+        return resolve(scope);
+    }
+    return resolve(cwd, scope);
+}
+/** Map one fd output line to an inserted-token autocomplete item. */
+function mapLineToItem(line, scope, quoted) {
+    const path = scope + line;
+    const needsQuote = quoted || path.includes(' ');
+    const value = needsQuote ? `@"${path}"` : `@${path}`;
+    return { value, label: line };
+}
+/**
+ * Default fd runner: spawns the real `fd` binary. On spawn `ENOENT` reports
+ * `available: false`; on any other failure degrades to `available: true` with no
+ * lines; on success splits stdout into non-empty lines.
+ */
+const defaultRunFd = (invocation) => new Promise((resolvePromise) => {
+    execFile(invocation.fdPath, invocation.args, (error, stdout) => {
+        if (error) {
+            if (error.code === 'ENOENT') {
+                resolvePromise({ available: false, lines: [] });
+                return;
+            }
+            resolvePromise({ available: true, lines: [] });
+            return;
+        }
+        const lines = stdout.split('\n').filter((l) => l.length > 0);
+        resolvePromise({ available: true, lines });
+    });
+});

package/server/dist/git-branch.js

@@ -1,19 +1,22 @@
-import { execFileSync } from 'node:child_process';
-/** Resolve the current git branch for a directory. Returns null if not a git repo or detached. */
-export function getGitBranch(cwd) {
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+/** Resolve the current git branch for a directory. Returns null if not a git repo or detached.
+ *  Async (non-blocking): callers must not run this on the event loop synchronously. */
+export async function getGitBranch(cwd) {
     // Guard against inherited Git env vars forcing resolution to another repo.
     const env = { ...process.env };
     delete env.GIT_DIR;
     delete env.GIT_WORK_TREE;
-    const runGit = (args) => {
+    const runGit = async (args) => {
         try {
-            const value = execFileSync('git', args, {
+            const { stdout } = await execFileAsync('git', args, {
                 cwd,
                 env,
                 encoding: 'utf-8',
                 timeout: 2000,
-                stdio: ['ignore', 'pipe', 'ignore'],
-            }).trim();
+            });
+            const value = stdout.trim();
             return value || null;
         }
         catch {
@@ -21,11 +24,11 @@ export function getGitBranch(cwd) {
         }
     };
     // Best signal for the checked-out branch (works with linked worktrees).
-    const current = runGit(['branch', '--show-current']);
+    const current = await runGit(['branch', '--show-current']);
     if (current)
         return current;
     // Fallback for older Git versions / unusual setups.
-    const abbrevRef = runGit(['rev-parse', '--abbrev-ref', 'HEAD']);
+    const abbrevRef = await runGit(['rev-parse', '--abbrev-ref', 'HEAD']);
     if (!abbrevRef || abbrevRef === 'HEAD')
         return null;
     return abbrevRef;

package/server/dist/login-orchestrator.js

@@ -0,0 +1,114 @@
+// LoginOrchestrator — server singleton driving interactive OAuth provider login.
+//
+// See docs/plans/provider-login.md → "Login Orchestrator". Owns references to
+// the shared pi-SDK AuthStorage + ModelRegistry. Responsibilities:
+//   - list OAuth providers with logged-in status
+//   - run a single login flow at a time (in-flight guard → "busy")
+//   - translate a connection-bound transport into pi's OAuthLoginCallbacks
+//   - on success call modelRegistry.refresh()
+//
+// Pure-ish and unit-testable: the AuthStorage / ModelRegistry dependencies are
+// expressed as the narrow structural seams below (LoginAuthStorage /
+// LoginModelRegistry), which the real pi-SDK classes satisfy. Tests inject
+// in-memory fakes plus a fake LoginTransport.
+/** Thrown by runLogin when a flow is already in progress. */
+export class LoginBusyError extends Error {
+    constructor() {
+        super('A login flow is already in progress');
+        this.name = 'LoginBusyError';
+    }
+}
+export class LoginOrchestrator {
+    authStorage;
+    modelRegistry;
+    busy = false;
+    requestCounter = 0;
+    constructor(authStorage, modelRegistry) {
+        this.authStorage = authStorage;
+        this.modelRegistry = modelRegistry;
+    }
+    /** List OAuth providers with logged-in status (from getOAuthProviders + getAuthStatus). */
+    listProviders() {
+        return this.authStorage.getOAuthProviders().map((p) => ({
+            id: p.id,
+            name: p.name,
+            loggedIn: this.authStorage.getAuthStatus(p.id).configured,
+        }));
+    }
+    /** Whether a login flow is currently running. */
+    isBusy() {
+        return this.busy;
+    }
+    /**
+     * Log out from `providerId`: clear its stored credential and refresh the
+     * model registry so the provider's models drop out of selection. Synchronous
+     * on the AuthStorage side; independent of the single-flight login guard.
+     */
+    logout(providerId) {
+        this.authStorage.logout(providerId);
+        this.modelRegistry.refresh();
+    }
+    /**
+     * Run a login flow for `providerId`, driving the transport. Resolves when the
+     * flow ends; emits a terminal `done` step itself (success or failure). Throws
+     * LoginBusyError if a flow is already in progress.
+     */
+    async runLogin(providerId, transport) {
+        // Synchronous in-flight guard (before the first await) so a concurrent
+        // runLogin issued in the same tick rejects while the first is in flight.
+        if (this.busy) {
+            throw new LoginBusyError();
+        }
+        this.busy = true;
+        const providerName = this.authStorage.getOAuthProviders().find((p) => p.id === providerId)?.name ?? providerId;
+        const nextRequestId = () => `login-${++this.requestCounter}`;
+        const callbacks = {
+            onAuth: (info) => {
+                transport.emit({ kind: 'auth', url: info.url, instructions: info.instructions });
+            },
+            onDeviceCode: (info) => {
+                transport.emit({
+                    kind: 'device_code',
+                    userCode: info.userCode,
+                    verificationUri: info.verificationUri,
+                    expiresInSeconds: info.expiresInSeconds,
+                });
+            },
+            onProgress: (message) => {
+                transport.emit({ kind: 'progress', message });
+            },
+            onPrompt: (prompt) => transport.requestInput({
+                requestId: nextRequestId(),
+                message: prompt.message,
+                placeholder: prompt.placeholder,
+                allowEmpty: prompt.allowEmpty,
+            }),
+            onManualCodeInput: () => transport.requestInput({
+                requestId: nextRequestId(),
+                message: 'Paste the authorization code',
+            }),
+            onSelect: (prompt) => transport.requestSelect({
+                requestId: nextRequestId(),
+                message: prompt.message,
+                options: prompt.options,
+            }),
+            signal: transport.signal,
+        };
+        try {
+            await this.authStorage.login(providerId, callbacks);
+            this.modelRegistry.refresh();
+            transport.emit({ kind: 'done', success: true, providerName });
+        }
+        catch (err) {
+            transport.emit({
+                kind: 'done',
+                success: false,
+                providerName,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+        finally {
+            this.busy = false;
+        }
+    }
+}

package/server/dist/push-infrastructure.js

@@ -67,7 +67,18 @@ export class WebPushSender {
         webpush.setVapidDetails('mailto:' + vapidEmail, vapidPublicKey, vapidPrivateKey);
     }
     async sendNotification(subscription, payload) {
-        const response = await webpush.sendNotification(subscription, payload);
-        return { statusCode: response.statusCode };
+        try {
+            const response = await webpush.sendNotification(subscription, payload);
+            return { statusCode: response.statusCode };
+        }
+        catch (err) {
+            // web-push rejects with a WebPushError for any non-2xx status (including
+            // 404/410 for dead subscriptions). Surface the status code so callers can
+            // prune expired subscriptions; rethrow anything that isn't an HTTP error.
+            if (err instanceof webpush.WebPushError) {
+                return { statusCode: err.statusCode };
+            }
+            throw err;
+        }
     }
 }

package/server/dist/push-notification.js

@@ -46,21 +46,28 @@ export class PushNotificationService {
         if (this.suppressionPredicate?.(payload.sessionId)) {
             return;
         }
-        const expiredEndpoints = [];
         const payloadStr = JSON.stringify(payload);
-        for (const sub of this.subscriptions) {
-            try {
-                const result = await this.sender.sendNotification(sub, payloadStr);
-                if (result.statusCode === 410) {
-                    expiredEndpoints.push(sub.endpoint);
+        // Snapshot deliberately: `this.subscriptions` is reassigned by add/remove,
+        // and we hold this list across awaits. Fan out in parallel rather than
+        // serializing behind the slowest endpoint.
+        const subs = this.subscriptions;
+        const results = await Promise.allSettled(subs.map((sub) => this.sender.sendNotification(sub, payloadStr)));
+        const expired = new Set();
+        results.forEach((result, i) => {
+            if (result.status === 'fulfilled') {
+                // 404 Not Found and 410 Gone both mean the subscription is dead.
+                if (result.value.statusCode === 404 || result.value.statusCode === 410) {
+                    expired.add(subs[i].endpoint);
                 }
             }
-            catch (err) {
-                console.warn('[PushNotificationService] Failed to send notification:', err.message ?? err);
+            else {
+                console.warn('[PushNotificationService] Failed to send notification:', result.reason?.message ?? result.reason);
             }
-        }
-        if (expiredEndpoints.length > 0) {
-            this.subscriptions = this.subscriptions.filter((s) => !expiredEndpoints.includes(s.endpoint));
+        });
+        if (expired.size > 0) {
+            // Prune against the CURRENT array (which may have changed during the
+            // awaits), removing only the endpoints we just found dead.
+            this.subscriptions = this.subscriptions.filter((s) => !expired.has(s.endpoint));
             await this.store.save(this.subscriptions);
         }
     }

package/server/dist/server.js

@@ -132,10 +132,26 @@ export async function createServer(config, sessionManager, folderIndex, pushNoti
     sessionManager.onGitBranchChange = (sessionId, folderPath) => {
         WsHandler.broadcastSidebarUpdate(sessionId, folderPath, sessionManager, clientRegistry);
     };
+    // A re-key collision is about to evict the slot holding this ID. Tell its
+    // owning client its session went away before the runtime is disposed.
+    sessionManager.onSlotEvicted = (sessionId) => {
+        const ownerClientId = sessionManager.getSlot(sessionId)?.connection?.connectedClientId;
+        if (ownerClientId)
+            clientRegistry.get(ownerClientId)?.sendDisplacedEvent(sessionId);
+    };
     const wss = new WebSocketServer({ noServer: true });
     const clientRegistry = new Map();
     httpServer.on('upgrade', (req, socket, head) => {
-        const url = new URL(req.url ?? '', `http://${req.headers.host}`);
+        // Only pathname/searchParams are read, so a fixed base is sufficient — and
+        // avoids an uncaught `new URL` throw when a malformed Host header arrives.
+        let url;
+        try {
+            url = new URL(req.url ?? '/', 'http://localhost');
+        }
+        catch {
+            socket.destroy();
+            return;
+        }
         if (url.pathname === '/ws') {
             wss.handleUpgrade(req, socket, head, (ws) => {
                 wss.emit('connection', ws, req);
@@ -146,7 +162,14 @@ export async function createServer(config, sessionManager, folderIndex, pushNoti
         }
     });
     wss.on('connection', (ws, req) => {
-        const url = new URL(req.url ?? '', `http://${req.headers.host}`);
+        let url;
+        try {
+            url = new URL(req.url ?? '/', 'http://localhost');
+        }
+        catch {
+            ws.close();
+            return;
+        }
         const clientId = url.searchParams.get('clientId') ?? crypto.randomUUID();
         console.log(`[pimote] WebSocket client connected (clientId=${clientId})`);
         // Version check — if the client's build version doesn't match the server's,

package/server/dist/session-cost.js

@@ -1,9 +1,33 @@
 /**
  * Pure cost summation helper for the per-session lifetime dollar cost surfaced
  * in the pimote StatusBar. No I/O, no SDK session coupling beyond a structural
- * (duck-typed) view of the session branch entries.
+ * (duck-typed) view of the session entries.
  *
- * See docs/plans/cost-accumulation.md.
+ * Callers pass the session manager's full entry log (getEntries()), so the
+ * figure spans ALL branches in the session file — not just the current leaf's
+ * branch. Because it is a pure fold recomputed on every get_session_meta call,
+ * it is correct across live session switches and reload-from-disk without any
+ * stateful accumulator: the session manager rehydrates every entry from the
+ * JSONL on load, and the sum is derived fresh from those entries.
+ *
+ * What this figure CAPTURES:
+ * - Every assistant turn across every branch, counted exactly once (branching
+ *   is append-only, so prior turns are never duplicated).
+ * - Tool-call token cost: a tool result is billed as input on the FOLLOWING
+ *   assistant turn, so it is already inside that turn's usage.cost.total. The
+ *   toolResult/user entries themselves carry no usage and are correctly skipped.
+ * - Cache-aware pricing: usage.cost.total is pi's pre-computed dollar amount
+ *   that already prices input/output/cacheRead/cacheWrite at their own model
+ *   rates. We sum total, so we inherit cache pricing rather than re-deriving it.
+ *
+ * What this figure EXCLUDES (cannot be recovered from the session file):
+ * - Compaction and branch-summary LLM calls. Those are billed API calls, but
+ *   CompactionEntry / BranchSummaryEntry carry no usage/cost field, so their
+ *   spend is invisible here.
+ * - Any assistant turn whose provider did not populate usage.cost.total (e.g. a
+ *   model with no pricing metadata): that turn contributes 0 (silent undercount).
+ *
+ * See docs/plans/cost-accumulation.md and docs/reviews/codebase-audit.md.
  */
 /**
  * Sum usage.cost.total over assistant message entries in the branch.