samagotchi 0.154.1 → 0.156.0

data/lib/samagotchi/bundles/inline-widgets/plugin.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+# The inline-widgets bundle (docs/bundles.md, The inline-widgets bundle): two
+# prompt sections that teach the model the ```chi-ui blocks chi web draws
+# (docs/internals/inline-widgets.md): picks, rows of options that fill the
+# user's reply, and walk, a scenario stepped through. The drawing is core's; this
+# bundle only says the blocks exist. Uninstalled, the prompt loses the sections
+# and blocks already in a history still draw.
+#
+# The text is eval 0013's round-2 hint, split in two. It is static, so the
+# prompt cache keeps: same text at every build. A delegate child's answer is
+# read by its parent, not drawn for a user, and a one-shot (-p --non-interactive)
+# prints to a terminal: neither gets a section.
+class Plugin
+  PICKS = <<~TEXT
+    The web UI draws fenced ```chi-ui code blocks (YAML inside) as interactive widgets; the terminal shows their source. Use one whenever it helps the user more than prose: a widget replaces the long explanation, it doesn't sit beside one. Never use one for what markdown shows well (tables, lists, key-value). At most one widget per answer; keep the prose around it to a few sentences and don't repeat the widget's content.
+
+    picks: whenever your answer leaves the user two or more things to decide (review findings, a plan's open decisions, which of several fixes to do), even if they didn't ask you to list them. The user clicks one option per row, can add a note, and the UI fills their reply.
+    ```chi-ui
+    type: picks
+    title: What to do with the findings
+    rows:
+      - id: "1"                       # unique, short; the user's reply names it
+        text: Bridge drops the replay buffer on reset    # the item, <= 80 chars
+        options:                      # 2-4 short options, one per line
+          - fix now
+          - skip
+          - later
+        recommended: fix now          # exactly one of the options
+        why: loses events a slow tab still needs        # optional, one short line
+    ```
+    Every row id unique; a row's options unique. Quote a value that starts with a quote or contains ": ".
+  TEXT
+
+  WALK = <<~TEXT
+    walk is the other ```chi-ui widget (the same rules: the web UI draws it, at most one widget per answer): a scenario the user steps through one step at a time: who does what, what the user sees, what happens behind it. Use it for "when does this happen / how does this work / what does the user go through" questions.
+    ```chi-ui
+    type: walk
+    title: A tab reconnects
+    actors: [user, web, worker]       # 2-5 short ids, unique
+    steps:
+      - id: s1                        # unique
+        actor: user                   # one of actors
+        does: reopens the laptop      # the action, <= 80 chars
+        sees: the page shows "reconnecting"     # optional: what the user sees at this step
+        behind: the tab sends GET /events with Last-Event-ID     # optional: what happens out of sight
+      - id: s2
+        actor: worker
+        does: checks the event id
+        cases:                        # optional: the step forks. List EVERY case, the usual one too
+          - when: the id is still buffered
+            goto: s3
+          - when: the id is too old
+            goto: s4
+      - id: s3
+        actor: worker
+        does: replays the missed events
+        next: end                     # optional: where to go after this step (default: the step below); end ends the walk here
+      - id: s4
+        actor: web
+        does: reloads the whole session
+        sees: the page redraws from the top
+    ```
+    A step needs `does` or `sees` (or both). Steps run in order unless `next` or `cases` say otherwise. Every id unique; every goto names a step; a next names another step or is `end`. Quote a value that starts with a quote or contains ": ".
+  TEXT
+
+  def register(chi)
+    chi.prompt_section("picks") { |ctx| PICKS if drawn?(ctx) }
+    chi.prompt_section("walk") { |ctx| WALK if drawn?(ctx) }
+  end
+
+  private
+
+  # Whether the session's answers reach a web page that draws them.
+  def drawn?(ctx) = ctx.frontend != :one_shot && !ctx.delegate?
+end

data/lib/samagotchi/bundles/system/config_modification_protocol.md

@@ -55,8 +55,8 @@ Only the nested form is read. An env name used as a top-level key (`SAMAGOTCHI_D
 **Excluded maps** (YAML-only, not part of the flat registry; skipped by scalar loader):
 
 - `model_aliases:` map of alias → model id (`ModelRef.parse`, through `HostRegistry#resolve`). Keys lowercased on write (`ConfigFile.write_model_alias!`). Values may be bare `model` or qualified `host:model` (hybrid; only `:` names a host, `org/model` is an id). Aliases apply once: never point an alias at another alias.
-- `hosts:` map of `name → {host, port | url, api, api_key_env, auth, dialect, profile, first_token_timeout, vision, sampling, thinking, enabled, models}` (`ConfigFile.hosts_config`, `host_registry.rb` `HostEntry`). Names lowercased; `url:` (http/https, optional path) replaces host/port, never both; `api_key_env:` names the env var holding the API key (never write a key into config.yml); `auth:` (`bearer|x-api-key`) is the header the key goes in (default `x-api-key` on `api: anthropic`, Bearer elsewhere); `dialect:` (`fireworks`, or `standard` for the default; `api: anthropic` only) adjusts the Messages wire for that provider (Bearer by default, no thinking `display`, no `cache_control`, `x-session-affinity`; `LLM::Dialect`, docs/configuration.md "Anthropic Messages hosts"); `first_token_timeout` (seconds, `0` = off; a negative or non-number warns and is ignored) overrides `server.first_token_timeout` for that host; `models:` (a map of model ids, or a plain list) declares ids the host serves whatever its `/v1/models` lists: no "doesn't list" warning, and a bare id routes there as if listed (`HostModel`); an entry may hold `price: {input, output, cache_read?, cache_write?}` in USD per 1M tokens (`ModelPrice`; an unset cache rate is the input rate), which estimates a cost the provider doesn't report or reports as 0 (`cost_estimate`, shown as `~$`), and `served: [ids] | any`, the models a gateway may answer that id with (no served-model warning for them); model settings stay in the root `models:`; a worker reads `hosts:` from the file as it starts (no environment variable sets hosts).
-- `models:` map of model id or alias → `{profile, vision, sampling, thinking, reasoning_history}` (`ConfigFile.model_settings`). `thinking:` (here, on a host, or `thinking.level` for every model) is `off|low|medium|high|default` (`Thinking`; unquoted `off` works, `on` is not a level; `default` = send nothing). Precedence: the session's own level (`/thinking LEVEL`, saved in the session; `chi --thinking` on a session run, `chi send --new --thinking`) > `chi web --thinking`/`SAMAGOTCHI_THINKING_LEVEL` > `models:` > `hosts.<name>.thinking` > `thinking.level` in config.yml > `default`. A `sampling:` key wins over the fields a level sends (`null` drops one); `docs/configuration.md` "Thinking". `reasoning_history:` (here or on a host) is `drop|turn|all`, which of its reasoning a chat host's model gets back. Precedence: the session's own level (`/reasoning-history LEVEL`, saved in the session) > `SAMAGOTCHI_REASONING_HISTORY` > `models:` > `hosts.<name>.reasoning_history` > `turn`; `docs/configuration.md` "Reasoning history". `/thinking` and `/reasoning-history` ask before a change that restarts the prompt cache; `--yes` applies it (`chi send` commands apply directly). `sampling:` (here or on a host) is a map of request fields passed to the provider as written (`temperature`, `top_p`, `presence_penalty`, `repeat_penalty`, …; a model's fields win over its host's per field; `null` = don't send; chi's own fields like `max_tokens`/`stream` are refused with a warning; `docs/configuration.md` "Sampling"). Keys match case-insensitively. `profile` (here or on a host) is `qwen36|gemma4`: the raw prompt format for native hosts. Precedence: `--profile`/`SAMAGOTCHI_MODEL_PROFILE` > `models:` > `hosts.<name>.profile` > the llama.cpp server's chat template > the name (`qwen`/`gemma`) > `qwen36` (`ModelProfile.resolve`). Set one when a model's name hides its family (e.g. a Qwen fine-tune under another name whose server publishes no template).
+- `hosts:` map of `name → {host, port | url, api, api_key_env, auth, dialect, profile, first_token_timeout, vision, sampling, thinking, enabled, models}` (`HostConfig.all`, `host_registry.rb` `HostEntry`). Names lowercased; `url:` (http/https, optional path) replaces host/port, never both; `api_key_env:` names the env var holding the API key (never write a key into config.yml); `auth:` (`bearer|x-api-key`) is the header the key goes in (default `x-api-key` on `api: anthropic`, Bearer elsewhere); `dialect:` (`fireworks`, or `standard` for the default; `api: anthropic` only) adjusts the Messages wire for that provider (Bearer by default, no thinking `display`, no `cache_control`, `x-session-affinity`; `LLM::Dialect`, docs/configuration.md "Anthropic Messages hosts"); `first_token_timeout` (seconds, `0` = off; a negative or non-number warns and is ignored) overrides `server.first_token_timeout` for that host; `models:` (a map of model ids, or a plain list) declares ids the host serves whatever its `/v1/models` lists: no "doesn't list" warning, and a bare id routes there as if listed (`HostModel`); an entry may hold `price: {input, output, cache_read?, cache_write?}` in USD per 1M tokens (`ModelPrice`; an unset cache rate is the input rate), which estimates a cost the provider doesn't report or reports as 0 (`cost_estimate`, shown as `~$`), and `served: [ids] | any`, the models a gateway may answer that id with (no served-model warning for them); model settings stay in the root `models:`; a worker reads `hosts:` from the file as it starts (no environment variable sets hosts).
+- `models:` map of model id or alias → `{profile, vision, sampling, thinking, reasoning_history}` (`ModelSettings.all`). `thinking:` (here, on a host, or `thinking.level` for every model) is `off|low|medium|high|default` (`Thinking`; unquoted `off` works, `on` is not a level; `default` = send nothing). Precedence: the session's own level (`/thinking LEVEL`, saved in the session; `chi --thinking` on a session run, `chi send --new --thinking`) > `chi web --thinking`/`SAMAGOTCHI_THINKING_LEVEL` > `models:` > `hosts.<name>.thinking` > `thinking.level` in config.yml > `default`. A `sampling:` key wins over the fields a level sends (`null` drops one); `docs/configuration.md` "Thinking". `reasoning_history:` (here or on a host) is `drop|turn|all`, which of its reasoning a chat host's model gets back. Precedence: the session's own level (`/reasoning-history LEVEL`, saved in the session) > `SAMAGOTCHI_REASONING_HISTORY` > `models:` > `hosts.<name>.reasoning_history` > `turn`; `docs/configuration.md` "Reasoning history". `/thinking` and `/reasoning-history` ask before a change that restarts the prompt cache; `--yes` applies it (`chi send` commands apply directly). `sampling:` (here or on a host) is a map of request fields passed to the provider as written (`temperature`, `top_p`, `presence_penalty`, `repeat_penalty`, …; a model's fields win over its host's per field; `null` = don't send; chi's own fields like `max_tokens`/`stream` are refused with a warning; `docs/configuration.md` "Sampling"). Keys match case-insensitively. `profile` (here or on a host) is `qwen36|gemma4`: the raw prompt format for native hosts. Precedence: `--profile`/`SAMAGOTCHI_MODEL_PROFILE` > `models:` > `hosts.<name>.profile` > the llama.cpp server's chat template > the name (`qwen`/`gemma`) > `qwen36` (`ModelProfile.resolve`). Set one when a model's name hides its family (e.g. a Qwen fine-tune under another name whose server publishes no template).
 - `hooks:` map of `hooks_dir` + per-event lists `{path, on_error}` (`Hooks::Loader.load`). `hooks_dir` may start with `~`.
 - `guardrails:` tool-call rules (`docs/guardrails.md`; read in `Engine#guardrail_rules`, parsed by `Guardrails::Rules.parse`): `enabled` (bool, default true; `false` drops rules and hooks' asks, a deny still applies; config.yml only, like every `guardrails` setting: no env variable), `parent_answers` (`soft`, the default: a parent agent's `chi answer` may deny, answer, Continue and give "Allow once"; `standard`: no allow; `hard`: deny, Stop and plain answers only; never a wider scope; replaces `parent_approvals` and `turn.parent_continue`; a convention for an honest parent, not a security boundary, and the user's choice: set it only when the user asks), `rules:` (list), `disable:` (a rule id or a list of them, `id` or `bundle:id`, switching off a bundle's or config rule without editing it), `small_models` (`auto`, the default: small = 32B or less read from the name; a glob or list of globs; `[]` for none). A rule takes only `id`, `tool`, `command`, `path`, `git`, `models`, `verdict`, `reason`, `scopes`: `id` required; at least one of `tool` (a name, `shell` = execute + task_create, a `File.fnmatch` glob like `"mcp_*"`, or a list), `command` (a Ruby regex on the shell command), `path` (a glob, or `outside_repo`: outside the session's repo, tmp folders and memory files excepted), `git` (only `outside_repo`: a shell call runs commit/add/reset/… in another checkout); `models` (optional: `small`, a model-name glob, or a list; without it the rule is for every model); `verdict` `ask|deny`; `scopes` (for `ask`) a subset of `once, session, repo, rule`. **Any parse error (an unknown key, a bad regex, no verdict) makes chi deny every tool call** until fixed, so validate with `YAML.safe_load` and keep the list shape. Rules are read again on the next tool call after config.yml or a bundle's rules change: no restart needed. Installed bundles' rule files (`chi bundle install guardrails`) add to them; `/guardrails` lists what loaded.
 

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.154.1
+version: 0.156.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:29c2f7df9f6c5acbc5ec17000a4490741e55e426af15ca0d81c8706edd9bd027
   self_map.md: sha256:709bd52710bf6c50334a89a10742ea1554c5985cc2d7c4e7571e526cc4479526
-  config_modification_protocol.md: sha256:f3f6545c93d59b624a2bf1766e26059520ffc7b236470dd9f1b51ab77312376d
+  config_modification_protocol.md: sha256:25ed2d4901f00eeea226db5eb2b75a05d6cdee4015ac8daa4bed624f745c3922
   memory_guide.md: sha256:8b7727b939b9c04486ca59859561023dcc319a73e0f5b47b3fcf5741edaa69e2
   delegated.md: sha256:a0d6ddcd4a8be06526d964898611775fd251cfd9d145a9d16afaccaa503597bd

data/lib/samagotchi/child_move.rb

@@ -18,27 +18,22 @@ module Samagotchi
   autoload :SessionContinue, File.expand_path("session_continue", __dir__)
 
   # A continue moving the previous link's open delegates to the chain's new
-  # link (SessionManager.continue_session), instead of archiving them with
+  # link (SessionContinue.run), instead of archiving them with
   # it. A moved child gets a parent override (Session::PARENT_FILE), never a
   # rewritten session file, so its live worker saving a stale copy changes
   # nothing; its worker reads the override for its rings and at each turn's
   # start (Bridge::FEATURES "reparent").
   #
   # #apply runs between the new link's save and its worker's spawn, while
-  # the link is #mark_starting (a ring from a moved child must not spawn a
-  # second worker from the child's process until the link's own holds it).
-  # Each step is idempotent,
-  # and an intent file (INTENT_FILE) in the new link's folder names the move
-  # until it is done: a worker that starts and finds one finishes the move
-  # (#adopt), and a failed continue moves the same children back.
+  # the link is marked starting (StartingMarker): a ring from a moved child
+  # must not spawn a second worker from the child's process until the link's
+  # own holds it. Each step is idempotent, and an intent file (INTENT_FILE)
+  # in the new link's folder names the move until it is done: a worker that
+  # starts and finds one finishes the move (#adopt), and a failed continue
+  # moves the same children back.
   module ChildMove
     # <new link dir>/move.json: {from, ids, noted}, while a move is under way.
     INTENT_FILE = "move.json"
-    # <new link dir>/starting: {pid, at}, from the move to the worker's spawn.
-    STARTING_FILE = "starting"
-    # A starting marker older than this, or whose process is gone, is left
-    # over from a continue that died: it holds nothing back.
-    STARTING_STALE = 60.0
     # Who the note to a moved child is from (ContextNote's label).
     NOTE_SOURCE = "session chain"
     # What a live child's worker must name in its sidecar to be moved.
@@ -206,44 +201,5 @@ module Samagotchi
              end
       SessionInbox.write_note(child_id, text: text, source: NOTE_SOURCE, state_dir: state_dir)
     end
-
-    # Hold off a worker for the continue's new link (#starting?) until its
-    # own worker holds it: written before the move, removed by that worker
-    # once it has the owner lock (Worker#start).
-    def mark_starting(session_id, state_dir:)
-      dir = Session.session_dir(session_id, state_dir: state_dir)
-      FileUtils.mkdir_p(dir)
-      AtomicFile.write(File.join(dir, STARTING_FILE), JSON.generate({ "pid" => Process.pid, "at" => Time.now.iso8601(3) }))
-    end
-
-    def clear_starting(session_id, state_dir:)
-      FileUtils.rm_f(File.join(Session.session_dir(session_id, state_dir: state_dir), STARTING_FILE))
-    end
-
-    # Whether a continue is moving delegates to +session_id+ right now: its
-    # marker is there, fresh, and the process that wrote it runs.
-    def starting?(session_id, state_dir:)
-      file = File.join(Session.session_dir(session_id, state_dir: state_dir), STARTING_FILE)
-      return false unless File.exist?(file)
-
-      data = JSON.parse(File.read(file))
-      return false if Time.now - Time.iso8601(data["at"].to_s) > STARTING_STALE
-
-      process_alive?(data["pid"].to_i)
-    rescue JSON::ParserError, ArgumentError, SystemCallError
-      false
-    end
-
-    # Signal 0 only asks whether the process exists.
-    def process_alive?(pid)
-      return false unless pid.positive?
-
-      Process.kill(0, pid)
-      true
-    rescue Errno::ESRCH
-      false
-    rescue Errno::EPERM
-      true
-    end
   end
 end

data/lib/samagotchi/children_status.rb

@@ -113,7 +113,7 @@ module Samagotchi
     # session counts loaded itself.
     def summary_of(session, state_dir:)
       live = WorkerLink.resolve(Session.session_dir(session.id, state_dir: state_dir), unlink: false).worker_owned?
-      { live: live, busy: live && session.status == Session::STATUS_RUNNING, status: session.status,
+      { live: live, busy: live && session.status == Session::STATUS_RUNNING, saved_status: session.status,
         updated_at: session.updated_at, waiting: session.waiting_question(live: live)&.dig(:kind),
         preview: session.last_prompt.to_s }
     end

data/lib/samagotchi/cli/parent_wait.rb

@@ -55,7 +55,7 @@ module Samagotchi
       def resolve(given)
         @session_id = @access.resolve(given)
       rescue ArgumentError => e
-        error_line("#{command_name}: #{e.is_a?(Session::AmbiguousId) ? e.message : "no session #{given}"}")
+        error_line("#{command_name}: #{e.message}")
         nil
       end
 

data/lib/samagotchi/config.rb

@@ -8,11 +8,14 @@ require_relative "config_text_edit"
 require_relative "log"
 require_relative "model_ref"
 require_relative "paths"
-require_relative "llm_context_strategy"
-require_relative "host_model"
 require_relative "config/restart_watch"
 
 module Samagotchi
+  # Which LLM context strategy a turn runs under; it reads Config.
+  autoload :LLMContextStrategy, File.expand_path("llm_context_strategy", __dir__)
+  # A hosts.<name>.models entry and its price; they read ConfigFile.
+  autoload :HostModel, File.expand_path("host_model", __dir__)
+  autoload :ModelPrice, File.expand_path("model_price", __dir__)
   # Parses the thinking: levels of host and model entries (it needs Config).
   autoload :Thinking, File.expand_path("thinking", __dir__)
   # One hosts: entry; it needs ConfigFile's readers.
@@ -89,6 +92,12 @@ module Samagotchi
       next_history_access next_matching_turn_display_poll_write
     ].freeze
 
+    # llm_context.policy's default: the sentence forget_outputs' description
+    # carries (ToolDeclarations::FORGET_OUTPUTS_POLICY), the plan's D7 line,
+    # adapted from CLM's steering example.
+    DEFAULT_LLM_CONTEXT_POLICY = "Tidy at subtask boundaries: once a subtask is done, forget its tool outputs and note " \
+                                 "what it established; keep anything you'll still edit against."
+
     ENTRIES = [
       # universal – env+config+cli
       Entry.new(key: "default.model",            yaml_path: %w[default model],            type: :string, default: nil,              expose: %i[env config cli], lifecycle: :new_session),
@@ -261,7 +270,7 @@ module Samagotchi
       # and hosts.<name>.llm_context_budget_tokens come first. Kept as written: LLMContextStrategy.parse_budget reads it.
       Entry.new(key: "llm_context.budget_tokens", yaml_path: %w[llm_context budget_tokens], type: :string, default: nil,           expose: %i[env config], lifecycle: :next_matching_turn_display_poll_write),
       # The policy sentence forget_outputs' description carries (the forget layer); blank: none.
-      Entry.new(key: "llm_context.policy",       yaml_path: %w[llm_context policy],       type: :string, default: LLMContextStrategy::DEFAULT_POLICY, expose: %i[env config], lifecycle: :worker_start),
+      Entry.new(key: "llm_context.policy",       yaml_path: %w[llm_context policy],       type: :string, default: DEFAULT_LLM_CONTEXT_POLICY, expose: %i[env config], lifecycle: :worker_start),
 
       # How much models think: off|low|medium|high|default, parsed by Thinking
       # (a :string, since YAML reads an unquoted off as false). The CLI flag
@@ -399,7 +408,7 @@ module Samagotchi
     # appended_prompt_files, Hooks::Loader, ConfigFile.bundle_settings.
     FREE_FORM_MAPS = %w[model_aliases hooks bundles memories append_system_prompt].freeze
     # Maps of named entries and the keys an entry may hold
-    # (ConfigFile.hosts_config, ConfigFile.model_settings).
+    # (HostConfig.all, ModelSettings.all).
     MAP_ENTRY_KEYS = {
       "hosts" => %w[host port url api api_key_env auth dialect profile first_token_timeout vision sampling thinking
                     reasoning_history enabled remote window_tokens steer_cut_after llm_context_strategy llm_context_apply llm_context_budget_tokens models].freeze,
@@ -408,6 +417,8 @@ module Samagotchi
     }.freeze
     # The keys a hosts.<name>.models entry may hold (HostModel.parse_map).
     HOST_MODEL_KEYS = %w[price served].freeze
+    # The keys a hosts.<name>.models.<id>.price may hold (ModelPrice.parse).
+    MODEL_PRICE_KEYS = %w[input cache_read cache_write output].freeze
     # Section keys beyond the registry's: guardrails' YAML rules (Engine#guardrail_rules).
     # And toolkit's kits (Toolkit.kits), and bundles' judgments' settings (SystemOne::JudgmentSettings).
     SECTION_EXTRA_KEYS = { "guardrails" => %w[rules disable].freeze, "toolkit" => %w[kits].freeze, "system_one" => %w[judgments].freeze }.freeze
@@ -887,9 +898,9 @@ module Samagotchi
       def price_key_problems(prefix, price)
         return [] unless price.is_a?(Hash)
 
-        (price.keys.map(&:to_s) - ModelPrice::KEYS).map do |k|
+        (price.keys.map(&:to_s) - MODEL_PRICE_KEYS).map do |k|
           # A renamed key is compared by its new name, so that name is the hint.
-          unknown_key_message("#{prefix}#{k}", RENAMED_PRICE_KEYS.fetch(k, k), ModelPrice::KEYS, prefix: prefix)
+          unknown_key_message("#{prefix}#{k}", RENAMED_PRICE_KEYS.fetch(k, k), MODEL_PRICE_KEYS, prefix: prefix)
         end
       end
 
@@ -1172,71 +1183,6 @@ module Samagotchi
     HOST_NAME_RE = /\A[a-z0-9][a-z0-9._-]*\z/i
     ENV_NAME_RE = /\A[A-Za-z_][A-Za-z0-9_]*\z/
 
-    # config.yml's hosts: by lowercased name; an entry that is disabled or
-    # invalid (warned) is left out. No entry left: "default", from
-    # server.host/port.
-    # @return [Hash{String => HostConfig}]
-    def hosts_config(env: ENV, path: global_path(env: env))
-      data = read_yaml(env: env, path: path)
-      raw_hosts = data[HOSTS_KEY] if data.is_a?(Hash)
-
-      normalized = {}
-      if raw_hosts.is_a?(Hash)
-        raw_hosts.each do |raw_name, raw_cfg|
-          host = HostConfig.parse(raw_name, raw_cfg)
-          normalized[host.name] = host if host
-        end
-        warn_duplicate_host_models(normalized)
-      end
-      normalized["default"] = default_host_config(data, env) if normalized.empty?
-      normalized
-    rescue StandardError => e
-      Log.error(:config, "hosts_config_failed", error: e.class.name, message: e.message)
-      {}
-    end
-
-    # The host chi uses when hosts: names none: server.host/port.
-    def default_host_config(data, env)
-      opts = { file_data: data, env: env, cli_overrides: Samagotchi::Config.cli_overrides }
-      host = Samagotchi::Config.resolve("server.host", **opts).to_s.strip
-      host = "localhost" if host.empty?
-      port = Samagotchi::Config.resolve("server.port", **opts).to_i
-      port = 8080 if port <= 0 || port > 65_535
-      HostConfig.new(name: "default", host: host, port: port)
-    end
-    private_class_method :default_host_config
-
-    # Two hosts declaring one id under hosts.<name>.models: a bare id goes
-    # where HostRegistry#host_for_model sends it (the default host when it
-    # declares the id, else the first in hosts: order); say so once.
-    def warn_duplicate_host_models(hosts)
-      declared = Hash.new { |h, k| h[k] = [] }
-      hosts.each { |name, cfg| cfg.models.each { |down, model| declared[down] << [name, model.id] } }
-      declared.each_value do |owners|
-        next if owners.size < 2
-
-        names = owners.map(&:first)
-        id = owners.first.last
-        goes = names.include?("default") ? "default" : "#{names.first} unless the default host lists it"
-        warn_once "Warning: #{names.map { |n| "hosts.#{n}.models" }.join(" and ")} #{names.size == 2 ? "both" : "all"} declare #{id}; " \
-                  "a bare #{id} goes to #{goes}"
-      end
-    end
-    private_class_method :warn_duplicate_host_models
-
-    # The names (lowercased) of the hosts entries with enabled: false, which
-    # hosts_config leaves out, from config.yml's hosts:.
-    # @return [Array<String>]
-    def disabled_host_names(env: ENV, path: global_path(env: env))
-      data = read_yaml(env: env, path: path)
-      raw = data[HOSTS_KEY] if data.is_a?(Hash)
-      return [] unless raw.is_a?(Hash)
-
-      raw.filter_map { |name, cfg| name.to_s.strip.downcase if cfg.is_a?(Hash) && HostConfig.disabled?(cfg) }
-    rescue StandardError # degrade-ok: Config↔Log: Log resolves its file and level through Config
-      []
-    end
-
     # Resolve the `recap:` section through the Config registry so scalar
     # recap settings share the single precedence path (CLI > ENV > file >
     # default). Returns false when explicitly disabled (file `recap: false`
@@ -1420,47 +1366,6 @@ module Samagotchi
       {}
     end
 
-    # The top-level `models:` map: per-model settings keyed by model id or
-    # alias (downcased), e.g. `models: {my-alias: {profile: qwen36}}`, each a
-    # ModelSettings; an entry that is not a map is skipped.
-    # @return [Hash{String => ModelSettings}]
-    def model_settings(env: ENV, path: global_path(env: env))
-      data = read_yaml(env: env, path: path)
-      raw = data[MODELS_KEY] if data.is_a?(Hash)
-      return {} unless raw.is_a?(Hash)
-
-      raw.each_with_object({}) do |(k, v), result|
-        key = k.to_s.strip.downcase
-        settings = ModelSettings.parse(key, v)
-        result[key] = settings if settings
-      end
-    rescue StandardError # degrade-ok: Config↔Log: Log resolves its file and level through Config
-      {}
-    end
-
-    # The first +names+ (model as typed, alias-resolved, bare, …) whose
-    # models: entry sets +field+ (a ModelSettings member; another name
-    # raises ArgumentError): a ModelSetting (key, value), or nil.
-    # VisionSupport and SamplingSettings look a model up the same way.
-    # @param models [Hash{String => ModelSettings}, nil] model_settings by default
-    # @return [ModelSetting, nil]
-    def model_setting(names, field, models: nil)
-      raise ArgumentError, "unknown models: field #{field.inspect}" unless ModelSettings.members.include?(field)
-
-      models ||= model_settings
-      Array(names).map { |name| name.to_s.strip.downcase }.reject(&:empty?).uniq.each do |key|
-        value = models[key]&.public_send(field)
-        return ModelSetting.new(key: key, value: value) unless value.nil?
-      end
-      nil
-    end
-
-    # +raw+ parsed against config.yml's hosts (or +hosts+) and aliases.
-    # @return [ModelRef]
-    def model_ref(raw, env: ENV, path: global_path(env: env), hosts: nil)
-      ModelRef.parse(raw, hosts: hosts || hosts_config(env: env, path: path), aliases: model_aliases(env: env, path: path))
-    end
-
     # Words /model takes as arguments (clear/default/none/off reset the
     # runtime model), so no alias may be named after one.
     RESERVED_MODEL_ALIASES = %w[clear default none off].freeze

data/lib/samagotchi/context_command.rb

@@ -428,8 +428,7 @@ module Samagotchi
       session = @access.show(id)
       Target.new(session_id: id, project_root: session.project_root, cwd: session.working_directory, label: id[0, 8])
     rescue ArgumentError => e
-      message = e.is_a?(Session::AmbiguousId) ? e.message : "no session #{given}"
-      error_line("#{command_name}: #{message}")
+      error_line("#{command_name}: #{e.message}")
       nil
     end
 

data/lib/samagotchi/context_window.rb

@@ -50,11 +50,11 @@ module Samagotchi
     # and vision look a model up), else hosts.<name>.window_tokens.
     # @param target [HostRegistry::ModelTarget]
     # @param names [Array<String>] HostRegistry#lookup_names
-    # @param models [Hash{String => ModelSettings}, nil] ConfigFile.model_settings (specs)
+    # @param models [Hash{String => ModelSettings}, nil] ModelSettings.all (specs)
     # @return [Resolved, nil]
     def setting(target, names:, models: nil)
-      models ||= ConfigFile.model_settings
-      tokens = ConfigFile.model_setting(names, :window_tokens, models: models)&.value
+      models ||= ModelSettings.all
+      tokens = ModelSettings.find(names, :window_tokens, models: models)&.value
       return Resolved.new(tokens: tokens, source: :model_setting) if positive_integer?(tokens)
 
       tokens = target&.entry&.window_tokens

data/lib/samagotchi/desktop/macos.rb

@@ -335,7 +335,7 @@ module Samagotchi
       # are left out. @return [Array<Hash>] name:, hosts:, state:
       def host_keys
         config_env = { "XDG_CONFIG_HOME" => launch_config_home }
-        hosts = ConfigFile.hosts_config(env: config_env).values.select(&:api_key_env).group_by(&:api_key_env)
+        hosts = HostConfig.all(env: config_env).values.select(&:api_key_env).group_by(&:api_key_env)
         hosts.map do |name, entries|
           state = if HostKeys.from_keychain(name, env: @env) then :keychain
                   elsif !@env[name].to_s.strip.empty? then :shell_only

data/lib/samagotchi/engine/context_judge.rb

@@ -2,137 +2,39 @@
 
 module Samagotchi
   class Engine
-    # The attached-context candidate judge (ContextJudge): its pass at an
-    # owner turn's start and for a late candidate, the asks it starts, and
-    # the cards it shows after the turn. Reads @context_cards_after_turn
-    # under @context_cards_mutex, @side_judgments, @host_registry, @session.
+    # The attached-context candidate judge (TurnStages::ContextJudge,
+    # forwarded): prepare_turn starts its pass, run_turn's ensure shows the
+    # cards it held, and a plugin's late candidate asks it. Reads
+    # @context_judge, @side_judgments, @host_registry, @turn_state, @session.
     module ContextJudgePart
       private
 
-      # The candidate judge (ContextJudge) at an owner turn's start, after
-      # the toolkit's ask settled: the session's candidates' status changes
-      # are logged (ContextCandidatesLog#look) and, unless
-      # context.candidates.mode is off, the proposed candidates due an ask
-      # are asked about the owner's prompts so far, this one included. Never
-      # a participant's turn, a review session or a Continue (no new prompt).
-      def start_context_judge(turn)
-        session = turn.session
-        return unless turn.prompt.is_a?(String) && OwnerPrompt.turn?(session: session, author: turn.origin.author)
-
-        context_judge_pass(session, ContextCandidates.owner_texts(session.messages) + [turn.prompt], phase: "turn")
-      end
-      private :start_context_judge
+      # The judge's stage (TurnStages::ContextJudge).
+      attr_reader :context_judge
 
       # A late proposal no owner prompt mentions (Plugin::Host
-      # #candidate_proposed: github-pr's init task runs beside the first
-      # turn): judged on the owner's prompts so far, the running turn's too.
+      # #candidate_proposed, maybe while the plugins load, before a session
+      # or the event log is there): TurnStages::ContextJudge#late_candidates
+      # on the session the Engine is on (none, or a review session: nothing,
+      # before anything else is read), the owner's prompts so far, the
+      # recorder and the sessions dir, all read now on the caller's thread.
       def judge_late_candidates
         session = @session
         return if session.nil? || session.review?
 
-        texts = ContextCandidates.owner_texts(plugin_messages)
-        context_judge_pass(session, texts, phase: "late") unless texts.empty?
-      end
-      private :judge_late_candidates
-
-      # One look at +session+'s candidates; the asks go to SideJudgments'
-      # :context kind, one thread asking each due candidate in turn.
-      def context_judge_pass(session, texts, phase:)
-        return if session.id.nil? || session.scratch
-
-        rows = ContextCandidates.with_status(session.id, project_root: session.project_root, state_dir: session_state_dir)
-        return if rows.empty?
-
-        log = ContextCandidatesLog.log_for(session_state_dir)
-        records = ContextCandidatesLog.records_for(log, session.id)
-        ContextCandidatesLog.look(log, session.id, rows, records) if phase == "turn"
-        settings = ContextJudge::Settings.from_config
-        return if settings.mode == "off"
-
-        jobs = ContextJudge.jobs(rows, records, session_id: session.id, texts: texts, settings: settings, phase: phase,
-                                                parent_attached: context_parent_attached(session))
-        return if jobs.empty?
-
-        client = system_one_recording(SystemOne::Client.from_config(host_registry: @host_registry, mode: "on", tag: :context),
-                                      ContextJudge::JUDGMENT, session, mode: settings.mode)
-        return unless client
-
-        start_context_asks(client, jobs, log, settings, context_choice(session, log, settings))
-      rescue StandardError => e
-        ContextJudge.warn(e)
+        @context_judge.late_candidates(session, messages: plugin_messages, recorder: system_one_recorder,
+                                                state_dir: session_state_dir)
       end
-      private :context_judge_pass
-
-      # @return [Thread, nil] the asks' thread, nil when none started
-      def start_context_asks(client, jobs, log, settings, choice)
-        if @side_judgments.in_flight?(:context)
-          Log.info(:context, "context_judge_in_flight_skipped", session_id: jobs.first.session_id)
-          return nil
-        end
-
-        @side_judgments.start(:context, warn: ContextJudge.method(:warn)) do
-          jobs.each { |job| choice.call(job, ContextJudge.ask(client: client, job: job, log: log, settings: settings)) }
-        end
-      end
-      private :start_context_asks
-
-      # What an answer does on the asks' thread (ContextCandidateChoice
-      # #after_judged: on mode attaches or cards; audit nothing). Taken on
-      # the caller's thread. The attach only writes the session's folder: its
-      # note comes with the next between-turn delivery, never into a running
-      # turn. A card shows only while this Engine is still on that session,
-      # and not in a running turn (it isn't the turn's: no "waiting for you"
-      # on it), but once it has ended.
-      # @return [#call] (job, fields)
-      def context_choice(session, log, settings)
-        session_id = session.id
-        project_root = session.project_root
-        state_dir = session_state_dir
-        show = lambda do |**card|
-          current = @session
-          next nil unless current.nil? || current.id == session_id
-
-          @context_cards_mutex.synchronize do
-            next @context_cards_after_turn << card if turn_running?
-
-            show_card(**card)
-          end
-        end
-        lambda do |job, fields|
-          ContextCandidateChoice.after_judged(job: job, fields: fields, settings: settings, project_root: project_root,
-                                              state_dir: state_dir, log: log, show_card: show)
-        end
-      end
-      private :context_choice
-
-      # The cards #context_choice held while a turn ran (#run_turn's ensure,
-      # after the turn flag is released).
-      def show_context_cards_after_turn
-        cards = @context_cards_mutex.synchronize { @context_cards_after_turn.slice!(0..) }
-        cards.each { |card| show_card(**card) }
-      rescue StandardError => e
-        ContextJudge.warn(e)
-      end
-      private :show_context_cards_after_turn
-
-      # A delegate child's parent's sources, by title (else name): the
-      # judge's started_from. nil for any other session (a chi send --new
-      # session has no parent; a fork isn't a delegate).
-      def context_parent_attached(session)
-        return nil unless session.delegate? && session.parent_id
 
-        parent_root = if Session.exist?(session.parent_id, state_dir: session_state_dir)
-                        Session.load(session.parent_id, state_dir: session_state_dir).project_root
-                      else
-                        session.project_root
-                      end
-        ContextSources.attached(session.parent_id, project_root: parent_root, state_dir: session_state_dir)
-                      .map { |attached| attached.source.title || attached.name }
-      rescue StandardError => e
-        Log.warn(:context, "context_parent_attached_failed", error: e.class.name, msg: e.message.to_s[0, 200])
-        []
+      # The stage over this Engine's side asks (built in
+      # #build_tools_and_plugins, before the plugins load: one may propose a
+      # candidate as it loads). Its two callables are the asks thread's late
+      # reads: the session the Engine is on and where a card goes, both as
+      # an answer comes.
+      def build_context_judge
+        TurnStages::ContextJudge.new(side_judgments: @side_judgments, host_registry: @host_registry, turn_state: @turn_state,
+                                     show_card: ->(**card) { show_card(**card) }, current_session: -> { @session })
       end
-      private :context_parent_attached
     end
   end
 end

data/lib/samagotchi/engine/guardrails.rb

@@ -76,11 +76,13 @@ module Samagotchi
       end
 
       # Ask the user to approve a call the gate voted `ask` on
-      # (GuardrailWiring#request_approval).
+      # (GuardrailWiring#request_approval), for the running turn (its
+      # author), else the last one. The gate's own asks come with their
+      # call's TurnContext instead.
       # @param verdict [Guardrails::Verdict]
       # @return [Guardrails::Verdict]
       def request_approval(verdict)
-        @guardrail_wiring.request_approval(verdict)
+        @guardrail_wiring.request_approval(verdict, turn_context || last_turn_context)
       end
     end
   end