samagotchi 0.10.1 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7fbd9765613c81776d1a8d62e1edacd50cc426843dcae07d2c0e6a11ebe80972
-  data.tar.gz: 8ed4b10801de4650ded6cd223d7723055acd8d0fa1ed3e98af36fe2cb174c403
+  metadata.gz: 9668c1088aa3739aa60890e07c7d04cf41fb87debf9683b6cd42b6e6e61ee265
+  data.tar.gz: ecfd58cc93c0dee8d867936c75754f854da34cf436dce28fcbc442e7f61c6ec2
 SHA512:
-  metadata.gz: fd72e187dab11b52fa7ba403eeecd3ea29b43b2e2364b31cce773279cbbadb18c0539e30f16fed5e76ae849f82c31e76e300cb2f6a419699c127c7396cc14263
-  data.tar.gz: 4abd84f3c1a83d0afa57239709919c9753c4eb8037503532e5a373a6ef3d0e674cfee330d15a717c50c48b11e5adf2be6611178c13aaf26fa4237fb89ed030e4
+  metadata.gz: cd2b82ad80038fb47d35a7b76177312521548a61764963697bebe2cb3b5389fd2d604debba118a87bca43077f2f350b7a0c5f63878df73c5ad75382951246ca0
+  data.tar.gz: ef64847c760b05f8b6ee084fcd39b0ffc2595de21538c388ee7dc8c37f59a952bf4f55b2cf8db8df8187cf4600dd890e996bb94473a9af4e3e99a8cef8ed48af

data/CHANGELOG.md

@@ -8,6 +8,97 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.12.0] - 2026-10-02
+
+### Added
+
+- `chi models [--format json] [--timeout S] [TEXT]` lists the names `--model` takes from every host (default first,
+  then `host:id`, then aliases), waiting at most 4 s for the hosts; exit 1 when no host listed.
+- The desktop helper chooses the model for a new session: ⌘M (or a click on the new row's model) opens a searchable
+  chooser of every host's models and aliases; the pick and five recent ones are remembered. Run `chi desktop upgrade`.
+
+### Changed
+
+- `chi self --model` prints an alias default as the ref it resolves to (`box:gemma-small`, not `small`).
+
+### Fixed
+
+- A failed turn's messages and its `turn_failed` event reach a joining client together (a snapshot taken in between
+  could show one without the other).
+- A Ctrl-C while an `after_turn` or `session_end` hook runs no longer cancels the turn that already answered: the
+  answer stays in the session (it was replaced with a cancel note and a second end event).
+- A web Stop sent right as a turn starts (while chi asks the model server for its settings, a first turn's /props
+  probe) cancels the turn at once; it used to answer "not running" and the turn ran on. A failed probe there now ends
+  the turn as failed instead of leaving the session marked running.
+- Reminders keep firing on their own while a session is idle. A reminder that a prompt's turn delivered just as the
+  idle check found it due, or a reminder turn that failed before it started, could stop them until the next prompt.
+
+Update with `chi update` (no bundle changes); run `chi desktop upgrade` for the desktop helper's model chooser.
+
+## [0.11.0] - 2026-10-01
+
+### Added
+
+- The web composer has the TUI's prompt history: ↑/↓ walk the prompts typed in either (↑ with the caret on the first
+  line; ↓ past the newest brings your draft back). A running TUI picks up lines typed in the web, or in another
+  terminal, without a restart.
+- Hooks and plugins: `:after_tool_call` carries the call's `status` (`ok`, `error`, `blocked` or `stopped`), the one its
+  activity line shows, worked out from the full output (`output:` is capped).
+- The `skills` bundle (0.1.5) tells a failed step by that `status` instead of matching the output's wording: an
+  execute killed by a signal now counts as failed, and an `Error:` line in the output of a command that exited 0 no
+  longer does. It needs this chi.
+
+### Changed
+
+- The prompt history keeps 100 entries (was 20), is written under a lock and replaced whole (no lost lines when two
+  chi processes write at once), and is now mode 0600.
+- With an OpenAI-compatible chat host (`api: openai`), the context value in the REPL's status line and the web's ctx
+  meter now moves during a turn, before each request, and the model gets the same short `[CONTEXT: …]` line the
+  llama.cpp loop gives it once usage rises past 40 % (`context.status_thresholds`). Before the host reports its first
+  token counts, the value is an estimate.
+- Model aliases apply once (an alias pointing to another alias sends that name as written; chi warns at start), and a
+  session stores the resolved model (`box:gemma-small` for `tiny`) plus the name it was typed as (`model_typed`), so a
+  resumed session keeps its model when an alias is retargeted. With a `default.model` alias, memory overlays and the
+  guardrails' `models:` rules now go by the alias's target (an overlay saved under the alias is still read).
+- Breaking: only `:` names a host in a model ref. `/` is part of the id, so `openai/gpt-4o` (an OpenRouter id) goes to
+  the default host as written even when a host is named `openai`. chi always wrote `host:`; a hand-written
+  `host/model` in `default.model`, an alias or a saved session warns at start (fix it with `host:model`).
+- `/models` shows a `host:model` alias only under its own host.
+- Breaking: an unqualified model name is routed by exact id only. It goes to the default host when that host lists it,
+  else to the first host in `hosts:` order that does (it was whichever host answered `/models` first), else to the
+  default host; substring routing is gone (`/model gemma` no longer picks a local host listing `gemma-…`: use
+  `box:gemma` or the exact id). chi warns at start about a host named like a model family (`qwen3`, `llama`, …).
+- `recap.model` is a model ref like any other: an alias is applied, and `recap: {model: box:x}` with no `host_ref` recaps
+  on `box` (it turned recap off). Breaking: `recap: {host_ref: a, model: b:x}` now warns and turns recap off instead of
+  silently asking `a` for `x`.
+
+### Fixed
+
+- `recap: {host_ref: openrouter, model: openai/gpt-4o}` sent `gpt-4o`.
+- An alias in `default.model`, the web's new-session model, `chi send --new --model` or a plugin fork was sent to the
+  server as the alias, not its target; `chi self` named a different model than the worker sent.
+- `/model box:tiny` (an alias for `box:gemma-small`) sent `box:gemma-small` to box; `/model openrouter:tiny` is now
+  refused (the alias names host `box`), in the TUI and as a web 400.
+- `models: {small: …}` now applies after `chi --model small` and after resuming such a session.
+- A TUI already waiting at `>` shows a prompt just typed in the web (or another terminal) at the first ↑, instead of
+  only from the next prompt on.
+- The `known-names` bundle checks the name in `~name` (that user's home folder): `ls ~myname` is no longer rejected
+  as a near miss of `myname`, and `ls ~mynmae` is caught.
+- `chi sessions` usage errors exit 2, as every other command's: an unknown subcommand, `stop` with no ids, a bad
+  `list --format` or `--scope`, and now also an unknown flag or a flag missing its value for `list`, `prune` and
+  `clean` (they were ignored). Each prints what was wrong and the usage on stderr. A session that is unknown or
+  refused still exits 1.
+- With a llama.cpp, mlx or oMLX server (no `api: openai`), an empty answer cut short because the context is full
+  (90 % or more) is no longer asked again, as `retry.empty_answer` documents and as with OpenAI-compatible chat
+  hosts; a thinking loop cut by the output cap still is. These loops' `generation_completed` events and log lines now
+  carry the `finish_reason` too.
+- With an OpenAI-compatible chat host, an answer of only whitespace is an empty answer, as with llama.cpp: asked again
+  (`retry.empty_answer`) instead of saved, and with no retry left the turn says the model returned an empty answer.
+- `--no-interrupt` (and `no_interrupt: true`) now raises the tool-call limit to 1000 in the in-process REPL with an
+  OpenAI-compatible chat host too; it only applied to llama.cpp, mlx and oMLX hosts there.
+
+Update with `chi update` (bundles: known-names 0.1.4, skills 0.1.5).
+
 ## [0.10.1] - 2026-10-01
 
 ### Fixed
@@ -578,7 +669,9 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.10.1...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.12.0...HEAD
+[0.12.0]: https://github.com/dm1try/samagotchi/compare/v0.11.0...v0.12.0
+[0.11.0]: https://github.com/dm1try/samagotchi/compare/v0.10.1...v0.11.0
 [0.10.1]: https://github.com/dm1try/samagotchi/compare/v0.10.0...v0.10.1
 [0.10.0]: https://github.com/dm1try/samagotchi/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/dm1try/samagotchi/compare/v0.8.1...v0.9.0

data/bin/chi

@@ -23,13 +23,13 @@ if ARGV[0] == "self"
   if %w[-h --help help].include?(ARGV[1])
     puts "Usage: chi self [--model]"
     puts "  Print version, source dir, config/memory/session paths, model/host and bundles."
-    puts "  --model  print only the model a new session starts on (exit 1 when none is configured)"
+    puts "  --model  print only the model a new session starts on, an alias resolved (exit 1 when none is configured)"
     exit 0
   end
   require "samagotchi/self_report"
   # The desktop helper's hint for its "New session" row: offline and quick.
   if ARGV[1] == "--model"
-    model = Samagotchi::SelfReport.model_name
+    model = Samagotchi::SelfReport.model_ref_name
     puts model if model
     exit(model ? 0 : 1)
   end
@@ -49,6 +49,8 @@ SUBCOMMANDS = {
   "bootstrap" => ["samagotchi/bootstrap_command", "BootstrapCommand"],
   # bring an installed chi up to date
   "update" => ["samagotchi/update_command", "UpdateCommand"],
+  # the models --model takes, from every host (--format, --timeout)
+  "models" => ["samagotchi/models_command", "ModelsCommand"],
   # the native "Send to chi" helper
   "desktop" => ["samagotchi/desktop_command", "DesktopCommand"],
   # install, upgrade, uninstall, status, diff, list, build (--scope, --force, …)
@@ -94,6 +96,7 @@ parser = OptionParser.new do |opts|
            chi send [-m TEXT] ID...|--new   a message into sessions, as if typed there
            chi bundle <install|upgrade|uninstall|status|diff|list|build>
            chi desktop <install|upgrade|uninstall|status>   macOS "Send to chi" helper
+           chi models [--format json] [TEXT]   the models --model takes, from every host
            chi self                         version, paths, model and bundles
            chi update [--dry-run]           update this chi, its bundles and the desktop helper
     (each subcommand takes --help)

data/docs/architecture.md

@@ -159,7 +159,7 @@ agent logic and can be used without any terminal rendering; the UI is a thin lay
 engine = Samagotchi::Engine.new(mode: :assist, model_name: "gemma4", memories: [])
 session = Samagotchi::Session.new_session(mode: "assist", model_name: "gemma4", working_directory: Dir.pwd)
 
-engine.run_turn(session, "hello", on_event: nil)   # => KernelLoop::Result (`.output`)
+engine.run_turn(session, "hello", on_event: nil)   # => LLM::ModelResult (`.output`)
 ```
 
 #### The `on_event` seam
@@ -169,7 +169,7 @@ forwards the raw `KernelLoop` events unchanged (the low-level contract) and adds
 higher-level events so UIs get clean turn boundaries without inferring them:
 
 - `:turn_started` — `{ session_id:, prompt: }`
-- `:turn_completed` — `{ result: }` (the final `KernelLoop::Result`)
+- `:turn_completed` — `{ result: }` (the final `LLM::ModelResult`)
 - `:turn_canceled` — `{ cancellation_reason: }`
 
 Every event is a `Hash` with a `:type` symbol key; the sink must not raise (the Engine
@@ -269,6 +269,11 @@ a hub; an `App.new` without one answers both routes `503 no_hub`.
 
 ## Model loops and adapters
 
+A model ref (`--model`, `/model`, `default.model`, an alias's target) is parsed
+by one pure resolver, `ModelRef.parse` (host prefix, alias), given the configured
+hosts and aliases; `HostRegistry` routes a name that names no host (its model
+index after `/models`) and builds the `ModelTarget`.
+
 Engine picks the loop from the effective model's host (`HostRegistry#resolve`):
 
 | Loop | Class | Host | Talks through |
@@ -297,6 +302,20 @@ hook's `stop_generation` cancels the generation's own controller (a child of
 the turn's, `CancellationController#generation`), and each loop takes the cut
 as an empty answer and asks again.
 
+Both loops keep one `EmptyAnswerRetry` per turn (the `retry.empty_answer`
+budget, the hidden nudge, the retry's sampling), and both end each
+generation's `:generation_completed` with a `finish_reason`: the chat host's
+own, or for the raw-prompt loop what `Client::Transport#finish_reason_from`
+reads from the stream's last payload (llama.cpp `/completion`'s `stop_type`:
+`limit` is `length`, `eos` and a stop word are `stop`; `/v1/completions` sends
+its own). An empty answer with a `length` stop and the context 90 % full or
+more is not asked again (a full window, not a thinking loop); with no finish
+reason it is. Both also keep one `ContextStatus` per turn: before each request
+it estimates how full the window is (the server's last count plus what the turn
+appended since), emits `:context_status` on a bucket change, and on a rise past
+the second threshold puts the model's own `[CONTEXT: …]` line on the tail as a
+system message (docs/internals/context-telemetry.md).
+
 **Adapters.** `Client` (raw-prompt servers) and `LLM::OpenAIChat` (one per host,
 `HostRegistry#adapter_for`) share `LLM::HTTP`: timeouts, TLS for https, a line
 reader for streamed bodies, the retry loop (`retry.*`; network errors, 429 and
@@ -311,8 +330,8 @@ conversation (the prompt plus completed tool iterations) and emits
 `:turn_failed` with `error_kind:`, `retryable:`, `host:` and a one-line
 `summary:`, which the REPL, the attached TUI and the web show.
 
-**Usage and models.** `ModelResult#usage` is an `LLM::Usage` (server counts, else
-a chars/4 estimate, else zeros; never nil). Model lists are `LLM::ModelInfo`
+**Usage and models.** A turn's token counts are `SessionMetrics`', read from the
+stream events (server counts, else a chars/4 estimate). Model lists are `LLM::ModelInfo`
 (`HostRegistry#list_all_models`); the context window comes from the running
 server (`/props`), then the host's model list, then config.
 

data/docs/cli.md

@@ -15,11 +15,12 @@
 - `chi web --web-host lan` — the Web UI on your home network too, for your phone: a link with an access token and its QR code (see [chi web on your phone](#chi-web-on-your-phone)); `chi web --new-token` replaces the token
 - `chi web --web-markdown` — opt in to sanitized Markdown rendering for completed assistant messages
 - `chi web --web-view turn` — draw turns with the turn view (each turn as one block of steps, the running one at the bottom of the history) instead of the default stage view (the running turn pinned above the composer); `?view=stage|turn` on the page URL overrides it (see [Web views](#web-views))
-- `chi sessions list|stop|archive|unarchive|delete|prune|clean` — manage persisted sessions; `list` shows this git project's, `list --scope=all` every one, a delegated session with `↳ <parent>`, `list --archived` the archived ones too (see [Sessions](sessions.md))
+- `chi sessions list|stop|archive|unarchive|delete|prune|clean` — manage persisted sessions; `list` shows this git project's, `list --scope=all` every one, a delegated session with `↳ <parent>`, `list --archived` the archived ones too (see [Sessions](sessions.md)). A usage error (an unknown subcommand or flag, a flag missing its value, `stop` or `delete` with no ids, a bad `list --format` or `--scope`) exits 2; an unknown or refused session exits 1
 - `chi note [--source NAME] [-m TEXT] (ID|PREFIX)... | --all` — add a context note (TEXT or stdin) to sessions: background the model sees on its next turn; it starts no turn (see [Sessions: Context notes](sessions.md#context-notes))
 - `chi send [-m TEXT] [--image PATH]... (ID|PREFIX)...` — send a message to sessions as if typed there: a turn starts (or a running one picks it up); piped stdin goes above `-m` as quoted context, and `--image` attaches images (see [Sessions: Sending a message](sessions.md#sending-a-message)); `--new` starts a session with it instead, and `--wait` prints the answer (`--wait ID` with no message waits for the next reply without sending; see [Starting a session](sessions.md#starting-a-session))
 - `chi desktop install|upgrade|uninstall|status` — the macOS "Send to chi" helper: a Service and a ⌃⌥⌘N hotkey that send text to live sessions as context notes (see [Desktop helper](desktop.md))
-- `chi self` — print version, source dir (checkout or installed gem), config/memory/session paths, model/host and bundles; `chi self --model` prints only the model a new session starts on (the desktop helper's hint)
+- `chi models [--format text|json] [--timeout S] [TEXT]` — list the models every configured host offers, as the names `--model` takes (see [Listing the models](#listing-the-models))
+- `chi self` — print version, source dir (checkout or installed gem), config/memory/session paths, model/host and bundles; `chi self --model` prints only the model a new session starts on, an alias resolved to its target (the desktop helper's hint)
 - `chi update [--dry-run] [--no-gem] [--no-bundles] [--no-desktop]` — update an installed chi: the gem, the system bundle, the shipped bundles you installed and the desktop helper, in one table (see [Updating](#updating))
 - `chi bundle install|upgrade|uninstall|status|diff|list|build` — manage memory bundles (see [Bundle hooks](hooks.md#bundle-hooks-unified-workflow-bundle)); `list` shows the installed ones and the ones shipped with chi, which `install <name>` installs; `core` and `dev` are profiles that install a set of them (see [Bundle profiles](memory.md#bundle-profiles-core-and-dev),  [Guardrails](guardrails.md), [Plugins](plugins.md#the-btw-bundle), [the mcp bundle](plugins.md#the-mcp-bundle) [the loop-guard bundle](plugins.md#the-loop-guard-bundle), [the check-in bundle](plugins.md#the-check-in-bundle) and [the skills bundle](plugins.md#the-skills-bundle)). A usage error (an unknown subcommand or flag, a missing argument, a bad `build --scope`) exits 2, as for every other command
 
@@ -66,6 +67,29 @@ chi bootstrap                            # try localhost 8080, 11434, 1234, 8000
   A bundle that fails to install makes the exit 1. `--dry-run` says what it
   would install.
 
+### Listing the models
+
+`chi models` asks every host in `hosts:` for its models, in parallel, and prints the names `--model` (and
+`chi send --new --model`, `/model`) takes, one per line:
+
+```sh
+$ chi models
+gemma-4                          # the default (default.model), first
+splash:incoai/Qwen3.8-27B-Splash # another host's id: host:id
+openrouter:qwen/qwen3.8-27b
+small -> box:gemma-small         # an alias and the ref it resolves to
+$ chi models qwen                # only the names containing "qwen" (any case)
+```
+
+- A default-host id is bare, except one with a `:` (`qwen3:8b`), which is written `<host>:qwen3:8b` so it can't
+  read as a host name. An id that an alias of the same name hides is left out.
+- Each run lists anew (no cache); `--timeout S` caps the wait for the hosts (default 4 s). A host that fails or doesn't
+  answer in time is noted on stderr (`chi models: box: no answer in 4 s`).
+- `--format json` prints one object: `default` (and `default_typed` when it was set as an alias), `default_host`,
+  `models` (`name`, `host`, `id`), `aliases` (`name`, `ref`, `host`) and `warnings`. The desktop helper's model
+  chooser reads it.
+- Exit 0 when any host listed its models, 1 when none did (the default is still printed), 2 on a usage error.
+
 ### Updating
 
 `chi update` brings an installed chi up to date and prints one table:
@@ -576,13 +600,13 @@ access token", paste the token there (the part of the link after
 In interactive assist mode, you can switch the request model without restarting:
 
 - `/model <name>`: set a session-scoped model override.
-- `/model host:model` or `/model host/alias`: qualified host routing (`host:alias` expands alias bare, alias may itself be `host:model` — hybrid).
+- `/model host:model` or `/model host:alias`: qualified host routing (only `:` names a host; `openai/gpt-4o` is a model id). `host:alias` applies the alias; an alias whose target names another host is refused (`alias 'tiny' names host 'box', not 'openrouter'`). Aliases apply once: an alias pointing to another alias sends that name as written.
 - `/model --default <name>`: set session model and persist as new default in `config.yml` (also updates `SAMAGOTCHI_DEFAULT_MODEL` for future sessions; supports `host:model` full ref).
 - `/model <name> --alias <alias>`: create alias for current effective model (alias value may be bare or `host:model`).
 - `/model`: show the effective model (and default when diverged: `runtime model: <effective> (default: <default>, profile=<name>, <source>)`, e.g. `profile=qwen36, server (chat_template)`).
 - `/model clear` (or `default`/`none`/`off`): clear the session override, reverting to the configured default.
 - `/guardrails`: the guardrail rules (by source), what failed to load, and your stored approvals, numbered; `/guardrails revoke N` removes approval N (see [Guardrails](guardrails.md)).
-- `/models`: list model ids aggregated across all `hosts:` (grouped `host (host:port):` with per-host `unreachable` warnings, e.g. an unset `api_key_env`; lists cached 60s, 10 minutes for a remote host; lazy — no startup prefill). At most 20 ids per host, then `… and N more`; `/models <text>` lists every id containing `<text>` (any case), e.g. `/models qwen` on OpenRouter.
+- `/models`: list model ids aggregated across all `hosts:` (an alias shows next to its id: a bare alias on every host listing the id, a `host:model` one only under its host; grouped `host (host:port):` with per-host `unreachable` warnings, e.g. an unset `api_key_env`; lists cached 60s, 10 minutes for a remote host; lazy — no startup prefill). At most 20 ids per host, then `… and N more`; `/models <text>` lists every id containing `<text>` (any case), e.g. `/models qwen` on OpenRouter.
 
 Notes:
 
@@ -640,17 +664,34 @@ This is separate from verbose mode:
 
 ## Persistent Prompt History
 
-Assist mode keeps a small persistent prompt history across restarts.
+Assist mode keeps a persistent prompt history across restarts, one for every
+chi prompt: the REPL, attached mode and the `chi web` composer (↑/↓ there)
+share it.
 
 - Default history file: `$XDG_STATE_HOME/samagotchi/history.json`
 - XDG fallback when unset: `~/.local/state/samagotchi/history.json`
-- Optional override: `SAMAGOTCHI_HISTORY_FILE=/custom/path/history.json`
-- Stored entries: most recent `20` prompts
-- Format: JSON array of prompt strings
+- Optional override: `history.file` in the config, or
+  `SAMAGOTCHI_HISTORY_FILE=/custom/path/history.json`
+- Stored entries: most recent `100` prompts (and `!commands`; not `/commands`
+  or `!rollback`)
+- Format: JSON array of prompt strings, mode 0600. Each write holds
+  `<file>.lock` and replaces the file whole, so a TUI and the web writing at
+  once keep both lines (a symlinked history file becomes a regular file).
 
 Behavior details:
 
 - Prompt history is loaded on startup before the first `>` prompt.
+- A running REPL or attached TUI picks up the lines other chi processes (the
+  web, another terminal) added: before each `>` prompt and on the first ↑ at
+  an open one (Ctrl-P, vi `k` too), when the file changed, its new lines join
+  the ↑ list after the ones already there, without a
+  restart. A `/command` you typed stays under ↑ too. `chi scratch` keeps its
+  own list and writes nothing.
+- The web records a prompt once its session's worker took it (a refused or
+  timed-out send isn't saved), a `!command` likewise; an image-only message
+  isn't saved. `chi send`, `delegate` and plugin turns aren't typed at a
+  prompt and aren't saved. With `chi web --web-host lan` the list is served to
+  token holders (`GET /api/history`), as the sessions are.
 - Only real user prompts are persisted.
 - Continue-flow inputs (`yes`, `no`, `no, <reason>`, `/continue`) are not persisted as prompts.
 - In assist mode, pressing `Tab` on an `@`-prefixed token (for example `@lib/sama`) completes project file and directory paths while preserving the `@` prefix.

data/docs/configuration.md

@@ -47,7 +47,10 @@ hosts:
 # (on a paid remote host that is one small request per idle window).
 # host_ref + model pin another model: host_ref asks that host's OpenAI API (its
 # url:, else http://host:port/v1) with its api_key_env; base_url is an OpenAI API
-# base as given (e.g. http://h:8081/v1). recap: false turns it off.
+# base as given (e.g. http://h:8081/v1). model is a model ref like any other: an
+# alias is applied, and its host:/the alias's host picks the host when host_ref
+# is left out (a model naming another host than host_ref turns recap off with a
+# warning). recap: false turns it off.
 recap:
   # host_ref: small-box
   # model: your-small-model-id
@@ -480,18 +483,31 @@ To explicitly route requests to a named model in llama.cpp, set:
 
 When `default.model` is unset or blank, Samagotchi fails fast with a clear startup/configuration error.
 
-With several `hosts:`, an unqualified model name goes to the host whose `/models`
-list has it (after `/models` ran), by exact id first, then by substring. A
-**remote** host (one with `api_key_env:` or an `https` url) is only chosen by exact
-id, `host:model` or an alias, never by a substring, and its model list is kept for
-10 minutes (60s for local hosts). For a chat host the context window comes from
+**The default host** is the host named `default`, else the first one under
+`hosts:` (without `hosts:`, the `server:` section).
+
+With several `hosts:`, `host:model` (or an alias naming a host) pins the host.
+An unqualified model name goes to the default host when its `/models` list has
+that exact id, else to the first host in `hosts:` order whose list has it, else
+to the default host. Only exact ids count, never a substring: `/model gemma` on
+a box that lists `gemma-3-12b` needs `box:gemma` or the exact id. The lists are
+known only after `/models` ran (nothing is fetched before the first turn), so
+until then an unqualified name goes to the default host; use `host:model` to pin
+one. A **remote** host (one with `api_key_env:` or an `https` url) keeps its model
+list for 10 minutes (60s for local hosts). For a chat host the context window comes from
 the running server (llama.cpp's `/props`), else the window the host's model list
 gives (`context_length`, `context_window`, `max_model_len` or llama.cpp's
 `meta.n_ctx`), else `context.window_tokens`.
 
-A `:` in a model name is often part of the id (`qwen3:8b`, `mistral:7b`,
+Only `:` names a host: `/` is part of a model id (`openai/gpt-4o` is an
+OpenRouter id and goes to the default host as written, even with a host named
+`openai`). A `default.model`, an alias or a saved session that still says
+`host/model` gets a warning at start; fix it with `host:model`. A `:` in a model
+name is often part of the id (`qwen3:8b`, `mistral:7b`,
 `unsloth/Qwen3-8B-GGUF:Q4_K_M`), so the part before the first `:` picks a host
-only when it is a configured host's name. An unknown prefix is refused with an
+only when it is a configured host's name. chi warns at start about a host named
+like a model family (`qwen3`, `llama`, `gemma`, …): `qwen3:8b` would go to that
+host as `8b`. An unknown prefix is refused with an
 error naming it and the configured hosts (with a "did you mean" for a near
 miss) when either
 - the rest is an `org/model` id (`nosuch:anthropic/claude-sonnet-4`), or
@@ -504,6 +520,23 @@ alias, `/model`, `chi send --new --model`, the web's new-session model and a
 delegate's model. Any other unknown prefix (`nosuch:x`) is sent to the default
 host as the model id.
 
+### Model aliases
+
+`model_aliases:` maps a name to a model id or `host:model`. An alias works
+wherever a model name does (`--model`, `default.model`, `/model`, the web's
+new-session model, `chi send --new --model`, a delegate's or fork's model, the
+`models:` keys) and the server is sent its target:
+
+- Aliases apply once. An alias whose target is another alias sends that name as
+  written, and chi warns about it at start ("aliases don't chain").
+- `host:alias` applies the alias on that host. When the alias's target names
+  another host, the model is refused (`alias 'tiny' names host 'box', not
+  'openrouter'`).
+- An alias named like a real model id shadows that id, also as `host:<id>`.
+- A session stores the resolved ref (`box:your-small-model-id`) plus the name it
+  was typed as, so a resumed session keeps its model when an alias is
+  retargeted, and `models: {small: …}` still applies to it.
+
 ## Llama Network Retry Behavior
 
 Transient network failures are retried automatically with exponential backoff.
@@ -734,8 +767,8 @@ described in their own sections.
 | `server.read_timeout` | `600` | yes | Read timeout, seconds. |
 | `server.first_token_timeout` | 120 remote, off local | | Seconds to the first token; `0` = off. `hosts.<name>.first_token_timeout` wins. |
 | `recap.enabled` | on | | `false` (or `recap: false`) turns the idle recap off. |
-| `recap.model` | session's | yes | Model that writes the recap. |
-| `recap.host_ref` | session's | yes | A `hosts:` name to ask (`host:` is accepted too). |
+| `recap.model` | session's | yes | Model that writes the recap: an id, alias or `host:model` (the host then picks where to ask). |
+| `recap.host_ref` | session's | yes | A `hosts:` name to ask (`host:` is accepted too, also a host name, not a model ref). |
 | `recap.base_url` | none | yes | An OpenAI API base to ask instead (`http://h:8081/v1`). |
 | `recap.inactivity` | `180` | yes | Idle seconds before a recap. |
 | `recap.timeout` | `30` | yes | Seconds a recap request may take. |
@@ -789,7 +822,7 @@ described in their own sections.
 | `web.markdown` | `false` | yes | Render answers as Markdown in `chi web`. |
 | `web.view` | `stage` | yes | How `chi web` draws a turn: `stage` (the running turn pinned above the composer) or `turn` (one block per turn in the history). See [CLI](cli.md#web-views). |
 | `web.annotate_presets` | `Agreed\|Could you please elaborate?` | yes | Quick replies next to Annotate in `chi web`, `\|`-separated (a YAML list works too); `""` in the file or on the CLI leaves only Annotate (an empty env value means the default). See [CLI](cli.md#web-annotate-presets). |
-| `history.file` | state dir | | Prompt history path. |
+| `history.file` | state dir | | Prompt history path, shared by the TUI and the web composer. |
 | `no_interrupt` | `false` | `--no-interrupt` | Raise the tool-call limit of a turn to 1000; a top-level key. |
 | `no_default_input` | `false` | `--no-default-input` | Don't pre-fill `default.input`; a top-level key. |
 | `skip_agent_md` | `false` | | Don't load AGENT.md; a top-level key (see below). |

data/docs/desktop.md

@@ -35,8 +35,30 @@ The first row, **New session in <folder>** (⌘0), starts a session with the mes
 that of the most recently updated live session, else of the newest recent one, else your home folder. It is ticked
 alone (ticking it clears the sessions and the reverse) and is preselected when no session is live. ⌘⏎ on it beeps: a
 note needs a session. After the send the panel shows `started <id>…` for 3 s. On its right, in grey, the row names
-the model the new session starts on (`chi self --model`: `default.model` from config.yml, or its env override); it
-is left out when none is configured.
+the model the new session starts on (`chi self --model`: `default.model` from config.yml, or its env override; an
+alias as the model it names).
+
+### Choosing the model
+
+Click the model on the new row, or press **⌘M**, to choose another one for the new session. The chooser takes the
+place of the session list: a search field (focused), then **Default (<model>)** (`Default (small → box:gemma-small)`
+for an alias), your recent picks and every host's
+models and aliases (from [`chi models`](cli.md#listing-the-models)), at most nine at a time.
+
+- Type to search: every word must match the host or the id; names starting with what you typed rank first. A name
+  no host lists is offered at the bottom as "not listed" and sent as typed (a host that is down, a model just added).
+- ↑/↓ and ⏎, a click, or ⌘1…⌘9 pick; Esc (or ⌘M) closes the chooser only, a second Esc the panel. While an input
+  method is composing, ⏎, the arrows and Esc are its own.
+- The row then shows the pick in the accent colour, and ⏎ sends `chi send --new --model <name>`, the name exactly as
+  the chooser shows it; Default sends no `--model`. An existing session keeps its model (switch it there with `/model`).
+- The pick is remembered for the next open (and the last five in the recent list), for every folder. A remembered
+  model no host lists any more falls back to the default, with a note in the panel.
+- The list is fetched again at each open; the previous one shows meanwhile ("Loading models…" the first time after
+  the helper starts). Hosts that failed or took over 4 s are named under the list; the default and the recent picks
+  still work.
+
+The chooser needs a chi with `chi models`: an older helper works with a newer chi, not the reverse
+(`chi desktop upgrade` after updating chi).
 
 A session open in a `chi --no-shared` REPL isn't listed: it takes no notes or messages.
 

data/docs/guardrails.md

@@ -223,7 +223,8 @@ call's command, `cwd` or paths (never a write's content) that is within one
 edit of a known name shorter than 10 characters, or two edits of a longer
 one, is a near miss. Tokens and names shorter than `min_length` (6) are
 skipped, as is a token that equals another known name. A token with a shell
-glob (`*?[]{}`, as in `ls -d samagotchi*`) is not checked.
+glob (`*?[]{}`, as in `ls -d samagotchi*`) is not checked. In `~name` (that
+user's home folder) the name after `~` is what is checked.
 
 By default (`mode: reject`) the call is denied with advice in place of the
 usual tail, so the model retries it corrected:

data/docs/hooks.md

@@ -55,7 +55,7 @@ The plugin class must respond to `#call(event)` — duck-typed, no base class re
 | `:after_generation` | After LLM returns (both loops); not after a generation a hook cut (`stop_generation`) | `{ type: :after_generation, iteration: N, response: "...", messages: [...] (the conversation as sent) }` |
 | `:generation_progress` | While the response streams, in batches (see [Watching the stream](#watching-the-stream)) | `{ type: :generation_progress, iteration: N, thinking: "..." (new since the last fire), text: "..." (new visible text), thinking_chars: N, text_chars: N (this generation so far), elapsed_ms: N }` |
 | `:before_tool_call` | Before tool dispatch (and before `tool_call_started`) | `{ type: :before_tool_call, iteration: N, call: {...}, params: "...", guardrail: Verdict, context: {...}, targets: {...}, blocked: false, block_reason: nil }` |
-| `:after_tool_call` | After tool execution | `{ type: :after_tool_call, iteration: N, tool: "read", output: "..." }` |
+| `:after_tool_call` | After tool execution | `{ type: :after_tool_call, iteration: N, tool: "read", output: "..." (capped at max_tool_output_chars), status: "ok" \| "error" \| "blocked" \| "stopped" }` |
 | `:session_end` | After every turn (turn-level lifecycle) | `{ type: :session_end, session_id: "..." }` |
 
 Every event also carries the hook runtime (next section): `hook:` (the label
@@ -348,7 +348,8 @@ is sticky too), and the model gets `[<tool>] Error: blocked by guardrail: <reaso
 (default reason `blocked by hook`). A verdict's deny reads
 `[<tool>] Error: denied by guardrail (<rule or hook>): <reason>. … Do not retry it …`
 (after a user's Deny on an ask: `[<tool>] Error: The user declined this call… It needed approval (<rule or hook>): <reason>. …`).
-Either way the activity status is `blocked`, and `:after_tool_call` still fires.
+Either way the activity status is `blocked`, and `:after_tool_call` still fires,
+with `status: "blocked"`.
 Only `:before_tool_call` votes.
 
 **Mutating params (legacy):**

data/docs/internals/context-telemetry.md

@@ -10,8 +10,10 @@ resumed session's line already names):
 
 `[CONTEXT: about 55% of the context window is in use (estimated; bucket=40plus). context moderate — prefer targeted and range reads over full-file dumps]`
 
-The native loop only (the chat loop has no context status). The event carries
-a `status` string using this prefix:
+Both loops do this, before each request (`ContextStatus`, one per turn). The
+chat loop's estimate counts the conversation's text and tool calls, not the
+tool schemas it sends, until the host's first count (its `usage`). The event
+carries a `status` string using this prefix:
 
 `CONTEXT_STATUS ...`
 

data/docs/sessions.md

@@ -1,6 +1,6 @@
 # Sessions
 
-Sessions are plain files — no DB. Each session is `~/.local/state/samagotchi/sessions/<uuid>.json` (XDG-aware via `XDG_STATE_HOME`) plus a sidecar dir `<uuid>/` with `input/`/`notes/`/`output/`/`owner.lock`/`bridge.json` (`Session.session_dir`). Besides the messages and turn state, the JSON keeps `used_memory_names` (what the session read), `preloaded_memory_names` (`--memory`) and `muted_memory_names` (`--mute`), the last two written before the worker starts so a respawn builds the same prompt, and `parent_id`, the session that delegated this one (see *Delegating*; `null` otherwise); files from before those keys read as empty lists and no parent.
+Sessions are plain files — no DB. Each session is `~/.local/state/samagotchi/sessions/<uuid>.json` (XDG-aware via `XDG_STATE_HOME`) plus a sidecar dir `<uuid>/` with `input/`/`notes/`/`output/`/`owner.lock`/`bridge.json` (`Session.session_dir`). Besides the messages and turn state, the JSON keeps `used_memory_names` (what the session read), `preloaded_memory_names` (`--memory`) and `muted_memory_names` (`--mute`), the last two written before the worker starts so a respawn builds the same prompt, and `parent_id`, the session that delegated this one (see *Delegating*; `null` otherwise); files from before those keys read as empty lists and no parent. `model_name` is the resolved model ref (an alias applied, `host:id` when it names a host), so a resumed session keeps its model when an alias is retargeted; `model_typed` is the name it was given as when that differs (an alias), for the `models:` lookup after a resume (`null` otherwise).
 
 **Retention (file-based, opt-out via env):**
 
@@ -61,9 +61,9 @@ chi sessions clean --dry-run --days 7            # test sessions older than 7 da
 **Ordering:**
 
 - `Session.list` / `SessionManager.list_sessions` / `GET /api/sessions?sort=&order=&limit=&offset=` default to `updated_at desc` (newest activity first). Also supports `created_at`, `asc`. `X-Total-Count` header when paginated.
-- Web UI (`chi web`): the page's scope is in its URL. Started in a git repo, `chi web` opens `/?dir=<that folder>`: that project's sessions, and new chats start in that folder; the header chip says `<project> · all`, and `all` opens the same place without `?dir` (every session; a new chat there starts in the server's own folder, shown on the start page, and cards name their folder; `← <project>` goes back to the project view it came from, or to the server's own project). One server serves every project: a second `chi web` (from another repo) finds it through `GET /api/info` and prints (with `--open`, opens) its page for its own folder instead of starting another. The 3 latest sessions sit above the chat; "All sessions" (or `/`) opens every session at `#/sessions`, with a search over preview, id and status (Esc or Back returns). The open session is in the URL (`#/s/<id>`), so a reload or a copied link opens it again; the chi logo top left goes back to the empty start for a new chat. The message box grows with its text; drag its top edge to keep it taller (double-click resets). The info bar copies `chi --attach <id>` for a terminal. The start page's model picker (bottom left of the composer, the chosen name `▾`) chooses the model a new chat starts on; it opens a search list over the conversation (↓ or a click; downward when the start page leaves no room above): an empty search shows the last 5 picks (Recent) and then each host's model ids A–Z under the host, the default host first; typed words must each match the host or the id (a substring, else for 3+ characters the letters in order, so `deepseek4.1 fla` finds `openrouter · deepseek/deepseek-v4.1-flash`), ⏎ picks, Esc/Tab close, a pick puts the focus in the message box: `GET /api/models` lists the hosts' models as chi spells them (`{default, models: [{name, host, id}], warning?}`; bare for the default host, `host:model` for the others, from the same cached lists as `/models`, a bounded wait, a host that is down noted in `warning`), and `POST /api/sessions` takes `model` (blank means the default). The start page's first message goes as later ones do: `POST /api/sessions` with `idle: true` and `preview` (the message, which names the session until its turn is saved), then `POST /api/sessions/:id/turn`, so a failed first turn puts its prompt back in the composer too; a first command line (`/model …`) still starts the session as its `prompt`. The browser remembers the last choice; a running session's model is in the info bar and changes only with `/model`.
+- Web UI (`chi web`): the page's scope is in its URL. Started in a git repo, `chi web` opens `/?dir=<that folder>`: that project's sessions, and new chats start in that folder; the header chip says `<project> · all`, and `all` opens the same place without `?dir` (every session; a new chat there starts in the server's own folder, shown on the start page, and cards name their folder; `← <project>` goes back to the project view it came from, or to the server's own project). One server serves every project: a second `chi web` (from another repo) finds it through `GET /api/info` and prints (with `--open`, opens) its page for its own folder instead of starting another. The 3 latest sessions sit above the chat; "All sessions" (or `/`) opens every session at `#/sessions`, with a search over preview, id and status (Esc or Back returns). The open session is in the URL (`#/s/<id>`), so a reload or a copied link opens it again; the chi logo top left goes back to the empty start for a new chat. The message box grows with its text; drag its top edge to keep it taller (double-click resets). The info bar copies `chi --attach <id>` for a terminal. The start page's model picker (bottom left of the composer, the chosen name `▾`) chooses the model a new chat starts on; it opens a search list over the conversation (↓ or a click; downward when the start page leaves no room above): an empty search shows the last 5 picks (Recent) and then each host's model ids A–Z under the host, the default host first; typed words must each match the host or the id (a substring, else for 3+ characters the letters in order, so `deepseek4.1 fla` finds `openrouter · deepseek/deepseek-v4.1-flash`), ⏎ picks, Esc/Tab close, a pick puts the focus in the message box: `GET /api/models` lists the hosts' models as chi spells them (`{default, models: [{name, host, id}], warning?}`; bare for the default host, `host:model` for the others, from the same cached lists as `/models`, a bounded wait, a host that is down noted in `warning`), and `POST /api/sessions` takes `model` (blank means the default). The start page's first message goes as later ones do: `POST /api/sessions` with `idle: true` and `preview` (the message, which names the session until its turn is saved), then `POST /api/sessions/:id/turn`, so a failed first turn puts its prompt back in the composer too; a first command line (`/model …`) still starts the session as its `prompt`. The browser remembers the last choice; a running session's model is in the info bar and changes only with `/model`. ↑/↓ in the composer walk the prompt history the TUI's ↑ walks ([Persistent Prompt History](cli.md#persistent-prompt-history)): ↑ with the caret on the first line, ↓ from the last line while browsing, ↓ past the newest brings the draft back; `GET /api/history` returns `{entries: [...]}`, oldest first (the page fetches it on focus and after each send). The server records a sent line in the routes once the worker took it (`POST /turn` accepted, a `!command` through `POST /command` or as a session's first line); `"history": false` in the body keeps it out (an image-only send).
 - Web notifications: when a session needs you while the tab is hidden or behind another window (a question or a guardrail approval, a plugin card with buttons during a turn such as check-in's, a failed turn, a turn done after 10 s or more; a delegated session only for its questions, a canceled turn never), the page title counts it, `(N) Chi`, until you come back to the tab. The bell at the right of the top bar also turns on OS notifications ("needs an answer", "needs approval", "needs you", "turn failed", "done in 42 s", under the session's first message; a click opens the session): its first click asks the browser for the permission, and the choice is kept per browser. Any session of the page's scope counts, not only the open one. What was already so when the page loaded never counts, and several chi tabs show one notification per event. A chi tab in front tells the others (a `BroadcastChannel`), so while you look at one, the ones behind neither notify nor count what it shows; coming back to a tab clears those events in the other tabs' titles too. The hub's `session` frames carry what this needs: `pending_question` (`{id, kind}`, kind `question` or `approval`), `pending_card` (`{id, bundle}`: the running turn's card with actions, from `pending_card.json` that the worker keeps in the session's folder while one is open; a card without actions, such as loop-guard's, never counts) and `last_turn` (`{outcome, ended_at, seconds, origin}`, saved in the session's JSON as the engine ends each turn).
-- The web frontend is a zero-build ES-module stack in `lib/samagotchi/web/public/`: `data.js` (retrieval, typed SSE `openStream` for a session and `openEvents` for the session list), `sessions_list.js` (the list as a pure reducer over `GET /api/events`: a snapshot replaces it, an upsert keeps a known card in place, a removal drops it), `notify.js` (which of those events needs the user, for the notifications), `app.js` (presentation/state; a session with no live stream gets one when its `session` event says `bridge_up`, after one re-read: `event_seq` starts over in each worker, so a dropped stream is never resumed with its old cursor), `format.js` (pure formatters such as `previewOf`). Unit-tested via `npm test` (`node --test spec/web/public/*.test.js`).
+- The web frontend is a zero-build ES-module stack in `lib/samagotchi/web/public/`: `data.js` (retrieval, typed SSE `openStream` for a session and `openEvents` for the session list), `sessions_list.js` (the list as a pure reducer over `GET /api/events`: a snapshot replaces it, an upsert keeps a known card in place, a removal drops it), `notify.js` (which of those events needs the user, for the notifications), `app.js` (presentation/state; a session with no live stream gets one when its `session` event says `bridge_up`, after one re-read: `event_seq` starts over in each worker, so a dropped stream is never resumed with its old cursor), `format.js` (pure formatters such as `previewOf`), `prompt_history.js` (the composer's ↑/↓ over the shared prompt history). Unit-tested via `npm test` (`node --test spec/web/public/*.test.js`).
 - Selecting a session in the web UI is read-only: `GET /api/sessions/:id` never spawns a worker (it reads a live worker's snapshot when one runs, else the session file). A prompt (`POST /turn`) or a command (`POST /command`) wakes the worker, and `/stream` briefly waits for a freshly-spawned bridge before answering. A caught-up SSE reconnect holds the stream open; `reset` markers are only sent for reconnects behind the ring window, or with a cursor from another worker (event ids are `<event_seq>-<epoch>`, one epoch per worker).
 
 **Test-session hygiene:**

data/lib/samagotchi/bootstrap/config_writer.rb

@@ -93,7 +93,7 @@ module Samagotchi
 
       # The entry's name: +requested+ as given (it must be free), else
       # +base+, with -2, -3… when the name is taken or is the prefix of a
-      # model id (chi would read "openai/gpt-x" as host openai, model gpt-x).
+      # model id (chi would read "qwen3:8b" as host qwen3, model 8b).
       def host_name(base, requested: nil, model_ids: [])
         taken = current_hosts.keys
         if requested
@@ -104,7 +104,7 @@ module Samagotchi
           return name
         end
 
-        prefixes = [*model_ids, configured_default_model].compact.map { |id| id.to_s.split(%r{[:/]}, 2).first.downcase }
+        prefixes = [*model_ids, configured_default_model].compact.map { |id| id.to_s.split(":", 2).first.downcase }
         name = base
         n = 1
         name = "#{base}-#{n += 1}" while taken.include?(name) || prefixes.include?(name)

data/lib/samagotchi/bridge.rb

@@ -153,7 +153,7 @@ module Samagotchi
       @capture_handle = @engine.subscribe(observer: capture_observer)
       @accumulator_handle = @engine.subscribe(observer: @accumulator)
       # A plugin's ctx.messages mid-turn holds the turn so far (plan O1).
-      @engine.running_turn_messages = -> { @accumulator.current_messages } if @engine.respond_to?(:running_turn_messages=)
+      @engine.running_turn_messages = -> { @accumulator.current_messages }
       @cards_handle = @engine.subscribe(observer: @cards)
       # One a worker that died left is not open.
       @pending_card.clear
@@ -180,7 +180,7 @@ module Samagotchi
       end
       @capture_handle&.unsubscribe
       @accumulator_handle&.unsubscribe
-      @engine.running_turn_messages = nil if @engine.respond_to?(:running_turn_messages=)
+      @engine.running_turn_messages = nil
       @cards_handle&.unsubscribe
       @pending_card_handle&.unsubscribe
       @pending_card&.clear
@@ -217,7 +217,7 @@ module Samagotchi
           continue_offer: @accumulator.continue_offer,
           guardrail_warning: @engine.guardrail_warning,
           plugin_warning: @engine.plugin_warning,
-          init_tasks: @engine.respond_to?(:init_tasks) ? @engine.init_tasks : [],
+          init_tasks: @engine.init_tasks,
           cards: @cards.list,
           commands: command_registry.listing,
           event_seq: seq,
@@ -242,7 +242,7 @@ module Samagotchi
 
     # The Engine's commands: the built-ins and its plugins'.
     def command_registry
-      @engine.respond_to?(:command_registry) ? @engine.command_registry : SessionCommands.builtin_registry
+      @engine.command_registry
     end
 
     # The single shared capture observer: appends every event to the ring.

data/lib/samagotchi/bundles/known-names/hooks/known_names.rb

@@ -6,7 +6,8 @@
 # that once misspelled a name in a path keeps copying the wrong spelling;
 # a rejection that names the right one breaks the loop.
 #
-# A token with a shell glob (*?[]{}) is not checked.
+# A token with a shell glob (*?[]{}) is not checked. In "~name" the name
+# after "~" is checked.
 #
 # Settings (config.yml, `bundles: known-names:`), all optional:
 #   names: [jonathandoe]         names to protect besides the derived ones
@@ -21,8 +22,9 @@ class KnownNames
   DERIVATIONS = %w[home user git repo].freeze
   DEFAULT_MIN_LENGTH = 6
   # Splits a command or path into tokens; each token's [-_.] parts are
-  # candidates too.
-  TOKEN_SPLIT = %r{[/\s"'=:,;|&()<>@]+}.freeze
+  # candidates too. "~" splits: in "~name" (that user's home) the name
+  # after it is what is checked.
+  TOKEN_SPLIT = %r{[/\s"'=:,;|&()<>@~]+}.freeze
   PART_SPLIT = /[-_.]+/.freeze
   # A candidate with a shell glob character is not checked: `workato*`
   # is a pattern over the name, not a misspelling of it.