samagotchi 0.28.0 → 0.30.0

data/lib/samagotchi/kernel_loop.rb

@@ -197,7 +197,8 @@ module Samagotchi
         emit(turn, type: :generation_cancelled, iteration: turn.iteration, reason: e.reason,
                    stopped_by: turn.cancel_controller&.stopped_by)
         return cancelled_result(turn.conversation, tool_activity: turn.tool_activity, reason: e.reason,
-                                                   partial_assistant_text: turn.buffer)
+                                                   partial_assistant_text: turn.buffer,
+                                                   streamed_thinking: turn.streamed_thinking)
       end
       finish(turn)
     rescue StandardError => e
@@ -239,8 +240,8 @@ module Samagotchi
     # context tracker and the retry budget, the tool activity, the visible
     # text streamed so far (salvaged on a cancel), the Qwen recovery state,
     # the prefill, and what the caller gave.
-    Turn = Struct.new(:conversation, :context, :empty_retry, :tool_activity, :buffer, :qwen_attempts, :qwen_partial,
-                      :prefill, :pending_tool_calls, :model_name, :pending_input, :on_stream_event,
+    Turn = Struct.new(:conversation, :context, :empty_retry, :tool_activity, :buffer, :streamed_thinking, :qwen_attempts,
+                      :qwen_partial, :prefill, :pending_tool_calls, :model_name, :pending_input, :on_stream_event,
                       :cancel_controller, :cap, :emit, :iteration, :empty_steps, :ended_empty, keyword_init: true)
     # One request: the prompt and its images as sent, the images' token
     # estimate, and the window it was measured against.
@@ -258,7 +259,8 @@ module Samagotchi
       conversation = prepare_conversation(messages)
       Turn.new(
         conversation: conversation, context: ContextStatus.new(conversation: conversation),
-        empty_retry: EmptyAnswerRetry.new, empty_steps: [], tool_activity: [], buffer: +"", qwen_attempts: 0, qwen_partial: nil,
+        empty_retry: EmptyAnswerRetry.new, empty_steps: [], tool_activity: [], buffer: +"", streamed_thinking: +"",
+        qwen_attempts: 0, qwen_partial: nil,
         # Qwen with thinking off: an empty thought after the cue, so the model
         # answers at once. Kept in the turn's model messages, so each tool-loop
         # prompt starts with what the server already has cached.
@@ -329,6 +331,9 @@ module Samagotchi
       generation = Generation.new(usage: nil, served_model: nil, streamed_thinking: 0)
       fire_hook(:before_generation, { type: :before_generation, iteration: turn.iteration }) if @hooks
       buffer_mark = turn.buffer.length
+      # A cancel salvages only this generation's thinking: the earlier
+      # steps' is on their own messages already.
+      turn.streamed_thinking = +""
       generation.response = with_generation(turn.cancel_controller) do |generation_controller|
         request_generation(
           request.prompt,
@@ -342,6 +347,7 @@ module Samagotchi
             generation.usage = nil
             generation.cache = nil
             generation.streamed_thinking = 0
+            turn.streamed_thinking = +""
             generation.finish_reason = nil
             turn.emit.call({ type: :generation_retrying, iteration: turn.iteration }.merge(retry_event)) if turn.on_stream_event
           },
@@ -368,17 +374,25 @@ module Samagotchi
       generation.finish_reason = chunk[:finish_reason] if chunk[:finish_reason]
       split = stream_splitter.feed(chunk[:content])
       turn.buffer << split[:text]
+      turn.streamed_thinking << split[:thinking].to_s
       generation.streamed_thinking += split[:thinking].to_s.length
       return unless turn.on_stream_event
 
       event = { type: :generation_chunk, iteration: turn.iteration, content: chunk[:content], text: split[:text],
-                thinking: split[:thinking], payload: chunk[:payload] }
+                thinking: split[:thinking], payload: event_payload(chunk[:payload]) }
       # A chunk of a tool call (its bytes are dropped from both lanes): a
       # steer doesn't cut this generation (Engine#cut_for_steer).
       event[:tool_call] = true if split[:tool]
       emit(turn, **event)
     end
 
+    # The payload a :generation_chunk event carries: llama.cpp's last chunk
+    # echoes the whole rendered prompt, which nothing reads and every SSE
+    # client would get (the kernel's own reads keep the full payload).
+    def event_payload(payload)
+      payload.is_a?(Hash) ? payload.except("prompt") : payload
+    end
+
     # The payload's prompt-cache counts, kept as the largest seen.
     def note_cache_counts(generation, payload)
       counts = TokenUsage.from_payload(payload)
@@ -618,7 +632,7 @@ module Samagotchi
       ModelProfile.required_model_name(override)
     end
 
-    def cancelled_result(conversation, tool_activity:, reason:, partial_assistant_text: "")
+    def cancelled_result(conversation, tool_activity:, reason:, partial_assistant_text: "", streamed_thinking: "")
       partial = partial_assistant_text.to_s.strip
       conversation = duplicate_conversation(conversation)
       # Salvage the already-streamed visible reply (thought/tool_call lanes
@@ -626,7 +640,13 @@ module Samagotchi
       # cannot leak) so a follow-up steering message continues with the model's
       # half-finished work in context instead of losing it.
       unless partial.empty?
-        conversation << { role: "model", content: "#{partial}\n[interrupted]", interrupted: true }
+        message = { role: "model", content: "#{partial}\n[interrupted]", interrupted: true }
+        # The thinking this generation streamed goes with it (the chat loop's
+        # with_thinking key, which MessageParts reads and the prompt doesn't):
+        # without it, reloading the cut step shows the empty answer it isn't.
+        thinking = streamed_thinking.to_s
+        message[:thinking] = thinking unless thinking.strip.empty?
+        conversation << message
       end
       LLM::ModelResult.new(
         text: "",

data/lib/samagotchi/llm/chat_loop.rb

@@ -338,8 +338,8 @@ module Samagotchi
             return canceled(iteration, @cancel_controller.reason) if @cancel_controller&.cancelled?
 
             inject_pending_input(iteration)
-            response, partial = generate(iteration)
-            return canceled(iteration, response, partial) if partial
+            response, partial, thought = generate(iteration)
+            return canceled(iteration, response, partial, thought) if partial
 
             if response.cut
               outcome = after_cut(iteration, response)
@@ -468,7 +468,7 @@ module Samagotchi
                                                messages: AnswerDisplay.strip_all(@conversation).map(&:dup).freeze })
           [response, nil]
         rescue RequestCancelled => e
-          [e.reason, streamed]
+          [e.reason, streamed, thought]
         end
 
         # The request runs under the generation's own controller (the turn
@@ -593,11 +593,17 @@ module Samagotchi
         end
 
         # The text streamed before the cancel stays, marked [interrupted],
-        # as the native loop's salvage does.
-        def canceled(iteration, reason, partial = "")
+        # as the native loop's salvage does; the reasoning this generation
+        # streamed rides along on the message (with_thinking's key).
+        def canceled(iteration, reason, partial = "", thinking = "")
           emit(type: :generation_cancelled, iteration: iteration, reason: reason, stopped_by: @cancel_controller&.stopped_by)
           visible = @loop.strip_model_thought(partial.to_s).strip
-          @conversation << { role: "model", content: "#{visible}\n[interrupted]", interrupted: true } unless visible.empty?
+          unless visible.empty?
+            message = { role: "model", content: "#{visible}\n[interrupted]", interrupted: true }
+            thought = thinking.to_s
+            message[:thinking] = thought unless thought.strip.empty?
+            @conversation << message
+          end
           conversation = @loop.plain(@conversation)
           conversation.last[:interrupted] = true unless visible.empty?
           ModelResult.new(text: "", conversation: conversation, canceled: true,

data/lib/samagotchi/memory_bundle/installer.rb

@@ -303,6 +303,7 @@ module Samagotchi
         # Like the rules, the bundle's plugin replaces an earlier one.
         plugin_file_for_provenance = install_plugin(manifest, normalized_dir, provenance)
         warn_hooks_requires_chi(manifest, all_hooks_in_bundle)
+        warn_rules_requires_chi(manifest, incoming_rules)
 
         # Files the previous version shipped and this one doesn't.
         if @upgrade && existing_provenance && existing_provenance[:files]
@@ -559,6 +560,19 @@ module Samagotchi
         end
       end
 
+      # GuardrailWiring#bundle_rules doesn't read the rules of a bundle whose
+      # requires_chi this chi doesn't meet, and a session that never loaded
+      # them records a required load failure (the gate refuses guarded calls
+      # until chi is updated): say so at install, as the hooks warning does.
+      def warn_rules_requires_chi(manifest, rule_files)
+        return if manifest.nil? || rule_files.empty?
+
+        if (failure = Manifest.requires_chi_failure(manifest.requires_chi, Samagotchi::VERSION))
+          @warnings << "Bundle #{@name}: its guardrail rules won't load: #{failure}; until chi is updated " \
+                       "(chi update), guarded tool calls are refused"
+        end
+      end
+
       # Copy the manifest's plugin file into the bundle's plugin/ dir,
       # warning when its sha256 differs from the declared one or this chi
       # doesn't meet requires_chi (the Engine then won't load it).

data/lib/samagotchi/model_list_store.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "json"
+require "fileutils"
+
+require_relative "atomic_file"
+require_relative "log"
+require_relative "paths"
+
+module Samagotchi
+  # The model ids each host last listed, saved in
+  # <state dir>/model_lists.json for the processes that spawn a worker but
+  # never list a host themselves: `chi send --new --model` and the
+  # `delegate` tool warn about an unknown model id up front from it
+  # (ModelProfile.model_warning) instead of only the worker's first turn
+  # failing. It is a cache of the hosts' own lists, so it never raises: no
+  # file, an unreadable one or bad JSON reads as no list at all. Only a
+  # successful listing writes (a host that is down keeps the ids we know),
+  # and a list older than TTL_SECONDS is no evidence about the host any
+  # more.
+  #
+  #   { "<host name>" => { "ids" => ["…"], "at" => <epoch seconds> } }
+  module ModelListStore
+    FILE = "model_lists.json"
+    # When a saved list is too old to say what a host serves: a model may
+    # have been added or removed since.
+    TTL_SECONDS = 7 * 24 * 60 * 60
+
+    # One host's saved list: the ids it listed and when (+at+, epoch
+    # seconds).
+    Saved = Data.define(:host, :ids, :at) do
+      def age(now: Time.now.to_i) = now.to_i - at.to_i
+
+      # Too old to check an id against (ModelProfile.model_warning): a model
+      # may have been added or removed since.
+      def stale?(now: Time.now.to_i) = age(now: now) > ModelListStore::TTL_SECONDS
+
+      # A host's own list spells its ids, and resolution matches them by
+      # case (the registry's model index is downcased): so does this.
+      def known?(id) = ids.any? { |known| known.casecmp?(id.to_s.strip) }
+    end
+
+    module_function
+
+    # @return [String] <state home>/samagotchi/model_lists.json
+    def path(env: ENV)
+      File.join(Paths.state_dir(env: env), FILE)
+    end
+
+    # Every saved list by host name, the lists as [Saved] (empty without a
+    # file, with bad JSON, or with nothing readable in it).
+    # @return [Hash{String => Saved}]
+    def read(env: ENV)
+      all(env: env).each_with_object({}) do |(name, entry), acc|
+        list = saved_from(name, entry)
+        acc[name] = list if list
+      end
+    end
+
+    # One host's saved list.
+    # @return [Saved, nil] nil without a file, with bad JSON, or with no
+    #   entry for the host
+    def find(host, env: ENV)
+      read(env: env)[host.to_s.strip.downcase]
+    end
+
+    # Save the ids +host+ just listed, keeping every other host's entry.
+    # Best effort: a store that can't be written never fails the listing
+    # that found the ids. An empty list is not saved (it is no evidence the
+    # host serves nothing: keep the ids we know).
+    # @return [Saved, nil] what was saved, nil when nothing was
+    def save(host, ids, at: Time.now.to_i, env: ENV)
+      name = host.to_s.strip.downcase
+      list = Array(ids).map { |id| id.to_s.strip }.reject(&:empty?).uniq
+      return nil if name.empty? || list.empty?
+
+      file = path(env: env)
+      FileUtils.mkdir_p(File.dirname(file))
+      # Under the lock, so two workers listing a host at once (or two
+      # threads of one registry) never drop each other's entries.
+      File.open("#{file}.lock", File::RDWR | File::CREAT, 0o600) do |lock|
+        lock.flock(File::LOCK_EX)
+        entries = all(env: env)
+        entries[name] = { "ids" => list, "at" => at.to_i }
+        AtomicFile.write(file, JSON.pretty_generate(entries) + "\n")
+      end
+      Saved.new(host: name, ids: list, at: at.to_i)
+    rescue StandardError => e
+      Log.warn(:model, "model_list_save_failed", host: host.to_s, error: e.class.name, msg: e.message.to_s[0, 200])
+      nil
+    end
+
+    # The whole file, host names downcased: {name => entry}.
+    # @return [Hash]
+    def all(env: ENV)
+      data = JSON.parse(File.read(path(env: env)))
+      return {} unless data.is_a?(Hash)
+
+      data.each_with_object({}) do |(name, entry), acc|
+        acc[name.to_s.strip.downcase] = entry if entry.is_a?(Hash)
+      end
+    rescue StandardError
+      {}
+    end
+
+    # One +entry+ of the file as a Saved, or nil when it holds no ids or no
+    # time.
+    def saved_from(name, entry)
+      ids = Array(entry["ids"]).map { |id| id.to_s.strip }.reject(&:empty?)
+      at = entry["at"].to_i
+      return nil if ids.empty? || at <= 0
+
+      Saved.new(host: name, ids: ids, at: at)
+    end
+    private_class_method :saved_from
+  end
+end

data/lib/samagotchi/model_profile.rb

@@ -179,6 +179,49 @@ module Samagotchi
       raise UnknownHost, "unknown host '#{host}' in model '#{ref}'#{hint}; the configured hosts are #{names.join(", ")}"
     end
 
+    # A warning when +model_name+ resolves to a model id a host's saved
+    # list doesn't have (ModelListStore: what a `chi models`, a /models or
+    # the web's GET /api/models last listed for that host), else nil.
+    # Called where a session is spawned without listing the hosts itself
+    # (`chi send --new --model`, the delegate tool), so a typo is
+    # named before the worker's first turn fails on it. Only a warning: some
+    # hosts serve ids they don't list (a one-model llama.cpp server takes any
+    # name, OpenRouter's :nitro variants), so the session starts anyway.
+    # Never asks a host.
+    #
+    # Only a ref that names a host is checked (its alias resolved first, as
+    # ModelRef.parse does), and only against that host's own list: a bare id
+    # goes to whichever host lists it (HostRegistry#host_for_model), so no
+    # single list can judge it. Nothing is checked either without a saved
+    # list for the host or with one older than ModelListStore::TTL_SECONDS
+    # (a week: the host may serve different models by now).
+    # @param hosts [Hash, nil] the hosts a prefix may name (a HostRegistry's
+    #   entries); config.yml's by default
+    # @param lists [#read] ModelListStore by default
+    # @return [String, nil]
+    def self.model_warning(model_name, env: ENV, hosts: nil, lists: nil)
+      require_relative "config"
+      require_relative "model_list_store"
+      hosts ||= Samagotchi::ConfigFile.hosts_config(env: env)
+      lists ||= Samagotchi::ModelListStore
+      parsed = Samagotchi::ConfigFile.model_ref(model_name, env: env, hosts: hosts)
+      host = parsed.host_name
+      return nil unless host
+
+      list = lists.read(env: env)[host.to_s.strip.downcase]
+      return nil if list.nil? || list.stale? || list.known?(parsed.id)
+
+      unknown_model_message(parsed.id, host, list.ids)
+    end
+
+    # The warning for an id the host doesn't list, with up to three close
+    # ids (Config.near_names) when there are any.
+    def self.unknown_model_message(id, host, ids)
+      near = Samagotchi::Config.near_names(id, ids).first(3)
+      hint = near.empty? ? "" : " (did you mean: #{near.join(", ")}?)"
+      "host '#{host}' doesn't list model '#{id}'#{hint}; started it anyway; `chi models` lists what the hosts serve"
+    end
+
     # The prefix of "box:x" when box is a host config.yml has with
     # enabled: false (left out of +hosts+), else nil.
     def self.disabled_host_prefix(ref, hosts, env)

data/lib/samagotchi/send_command.rb

@@ -241,9 +241,10 @@ module Samagotchi
 
     # A worker session like the web start page's: saved as running with the
     # message before its worker spawns, so lists and the web show it at
-    # once. The full id, so a script can pass it on. Only the model's host
-    # is checked here (in spawn_session, as in the web): a wrong model id
-    # fails in the worker.
+    # once. The full id, so a script can pass it on. The model's host is
+    # checked here (in spawn_session, as in the web): an unknown one is
+    # refused before anything is spawned; an id the host's saved model list
+    # doesn't have starts with a warning on stderr.
     # @return [Integer] the exit status
     def run_new(prompt, options)
       images = !@images.empty?
@@ -264,6 +265,7 @@ module Samagotchi
         error_line("chi send: could not start a session: #{e.message}")
         return 1
       end
+      error_line("chi send: warning: #{session.model_warning}") if session.model_warning
       if through_worker
         return 1 unless deliver_new(session, prompt)
       else

data/lib/samagotchi/session.rb

@@ -79,6 +79,11 @@ module Samagotchi
     # sets it); not saved.
     attr_accessor :seed_images_dropped
 
+    # The warning for a model id its host's saved list doesn't have
+    # (ModelProfile.model_warning; SessionManager.spawn_session sets it);
+    # not saved.
+    attr_accessor :model_warning
+
     def initialize(id:, mode:, model_name:, working_directory:, messages:, created_at:, updated_at:,
                    metadata_version: METADATA_VERSION, status: STATUS_IDLE, last_prompt: "",
                    first_preview: "", test_run: false, pending_question: nil,

data/lib/samagotchi/session_commands.rb

@@ -5,6 +5,7 @@ require_relative "model_profile"
 require_relative "served_model"
 require_relative "turn_flow"
 require_relative "tools/execute"
+require_relative "tools/builtins"
 require_relative "commands/registry"
 
 module Samagotchi
@@ -207,12 +208,15 @@ module Samagotchi
     end
 
     # The output goes into the conversation for the next turn. Not saved
-    # here (as in the REPL, the next turn saves it).
+    # here (as in the REPL, the next turn saves it). No parent-session
+    # marker: the user runs this, not the model. A worker's `chi --model X`
+    # default is unset, though: it was that run's, not the default of a chi
+    # run here (Tools::Builtins.cli_model_unset).
     def shell(text)
       command = text.delete_prefix(SHELL_BANG_PREFIX).strip
       return reply("!: please provide a shell command after '!'", status: :error) if command.empty?
 
-      output = Samagotchi::Tools::Execute.call(command)
+      output = Samagotchi::Tools::Execute.call(command, env: Samagotchi::Tools::Builtins.cli_model_unset)
       @engine.append_messages([{ role: "user", content: "!(#{command})\n#{output}" }])
       # Rolling back past this would silently drop the command output.
       @turn_flow.note_conversation_changed

data/lib/samagotchi/session_manager.rb

@@ -130,14 +130,20 @@ module Samagotchi
     # @param images_from [String, nil] the session dir the seed's images are in
     # @param title [String, nil] what the lists show before the first turn
     #   (the prompt's preview by default, else the seed's first user message)
-    # @return [Session] with #seed_images_dropped: refs whose file was gone
+    # @return [Session] with #seed_images_dropped: refs whose file was gone,
+    #   and #model_warning: an id its host's saved list doesn't have
     def self.spawn_session(prompt:, mode: "assist", working_directory: nil, model_name: nil, state_dir: nil,
                            memories: [], muted_memories: [], parent_id: nil, messages: [], images_from: nil,
                            title: nil)
       sd = state_dir || Session.default_state_dir
       # The resolved ref is stored (a resumed session keeps its model when an
-      # alias is retargeted), with the name as typed beside it.
+      # alias is retargeted), with the name as typed beside it. A wrong host
+      # refuses here, before anything is saved or spawned; a model id the
+      # host's saved list doesn't have (ModelListStore) only warns
+      # (#model_warning on the session), as some hosts serve ids they don't
+      # list.
       typed = Samagotchi::ModelProfile.check_host!(Samagotchi::ModelProfile.required_model_name(model_name))
+      model_warning = Samagotchi::ModelProfile.model_warning(typed)
       ref = ConfigFile.model_ref(typed).ref
       session = Session.new_session(
         mode: mode,
@@ -149,6 +155,7 @@ module Samagotchi
         parent_id: parent_id,
         messages: messages
       )
+      session.model_warning = model_warning
       # With no prompt there is no first turn to run (an attaching UI sends
       # the prompts), so the session starts idle.
       session.status = prompt.to_s.strip.empty? ? Session::STATUS_IDLE : Session::STATUS_RUNNING

data/lib/samagotchi/session_metrics.rb

@@ -481,9 +481,12 @@ module Samagotchi
           # A turn that failed mid-stream never saw its generation end:
           # what it got to still counts.
           close_generation if @turn.gen_open
-          # A call still running when the turn ends (a cancel, a failure)
-          # never completes: its record says so, as the count already has it.
-          @turn.tool_calls_by_id.each_value { |active| finish_tool_record(active, "canceled") }
+          # A call still running when the turn ends never completes: its
+          # record says so, as the count already has it. A cancel stopped it
+          # ("stopped", as ToolActivity names a call the Stop cut); a
+          # failure left it "canceled".
+          cut = status == "canceled" ? "stopped" : "canceled"
+          @turn.tool_calls_by_id.each_value { |active| finish_tool_record(active, cut) }
           @turn.tool_calls_by_id.clear
           finished_at = now
           record = {

data/lib/samagotchi/terminal_ui/formatting.rb

@@ -226,19 +226,22 @@ module Samagotchi
       # A cancel's reason as the UIs name it (anything else as it is);
       # spec/shared/labels_matrix.json pins it for both.
       CANCEL_REASONS = { "ctrl_c" => "Ctrl-C", "user" => "stopped", "hook" => "by a hook" }.freeze
+      # A canceled turn's mark: a stop someone chose (Ctrl-C, Stop, a hook),
+      # not an error's ✕ (timing.js STOP_MARK; the labels matrix pins it).
+      STOP_MARK = "■"
       # Under a canceled prompt turn (a canceled continue is back where it
       # started): its partial progress stays in the conversation.
       ROLLBACK_HINT = "partial progress kept; !rollback restores the pre-turn state"
 
-      # "✕ turn canceled (Ctrl-C) · 3.1s"; a hook's stop that names who
-      # (+by+, turn_canceled's cancelled_by): "✕ turn stopped by loop-guard"
+      # "■ turn canceled (Ctrl-C) · 3.1s"; a hook's stop that names who
+      # (+by+, turn_canceled's cancelled_by): "■ turn stopped by loop-guard"
       def turn_canceled_line(reason, duration_ms, by: nil)
         if reason.to_s == "hook" && !by.to_s.empty?
-          return "#{paint("✕", 33)} turn stopped by #{by}#{turn_duration_suffix(duration_ms)}"
+          return "#{paint(STOP_MARK, 33)} turn stopped by #{by}#{turn_duration_suffix(duration_ms)}"
         end
 
         label = reason.to_s.empty? ? nil : CANCEL_REASONS.fetch(reason.to_s, reason.to_s)
-        "#{paint("✕", 33)} turn canceled#{" (#{label})" if label}#{turn_duration_suffix(duration_ms)}"
+        "#{paint(STOP_MARK, 33)} turn canceled#{" (#{label})" if label}#{turn_duration_suffix(duration_ms)}"
       end
 
       # "✕ turn failed: <summary> · 2.0s"

data/lib/samagotchi/terminal_ui.rb

@@ -16,6 +16,7 @@ require_relative "host_registry"
 require_relative "session"
 require_relative "owner_lock"
 require_relative "bridge/card_store"
+require_relative "bridge/pending_card"
 require_relative "engine"
 require_relative "guardrails/parent_approvals"
 require_relative "tools/memory"
@@ -298,7 +299,10 @@ module Samagotchi
     ensure
       # However it ends (the early returns too; the Engine was built in
       # #initialize): the anytime commands finish, the plugins' services
-      # stop (a server process).
+      # stop (a server process). Nothing resolves an open card any more, so
+      # its pending_card.json goes (a scratch session's folder is deleted
+      # below anyway; the others stay).
+      clear_pending_card
       @engine&.shutdown
       # A scratch session goes on every way out: /exit, Ctrl-D, an error,
       # SIGTERM or SIGHUP (Ruby raises those here). Only kill -9 leaves it
@@ -308,6 +312,17 @@ module Samagotchi
 
     EMPTY_ANSWER_ERROR = "chi: the model gave an empty answer"
 
+    # The session is over for this process (its exits and the ensure below):
+    # nothing will resolve the open card any more, so its pending_card.json
+    # goes (the Engine's TURN_END would clear it, but the REPL may end
+    # mid-turn).
+    def clear_pending_card
+      return unless @pending_card_handle
+
+      @pending_card_handle.observer.clear
+      @pending_card_handle = nil
+    end
+
     # A -p --non-interactive turn that failed (bin/chi exits 1): the error,
     # then how to go on. The Engine saved the failed turn with its prompt,
     # so the session is kept and `chi --resume` takes it up again.
@@ -415,13 +430,28 @@ module Samagotchi
       @surface.commit("Session #{session.id} was not archived (#{e.message}): chi sessions archive #{session.id}")
     end
 
-    # The session's cards.json, kept as a worker's Bridge keeps it (it owns
-    # the session as a worker would): this REPL's kept turns count on from
-    # the saved count, so a card an earlier worker showed stays that many
-    # turns back, and its own cards and notices are saved for the next.
+    # The session's cards.json and pending_card.json, kept as a worker's
+    # Bridge keeps them (it owns the session as a worker would): this REPL's
+    # kept turns count on from the saved count, so a card an earlier worker
+    # showed stays that many turns back, and its own cards and notices are
+    # saved for the next; an open card with actions is on disk, where
+    # `chi web`'s session hub reads it to mark the session as waiting.
     def keep_cards(session)
       path = File.join(Session.session_dir(session.id), Bridge::CardStore::FILE)
       @cards_handle ||= @engine.subscribe(observer: Bridge::CardStore.new(path: path))
+      keep_pending_card(session)
+    end
+
+    # A card a worker that died left isn't open: the file goes before the
+    # observer takes over, as Bridge#start does. Subscribed once: the REPL
+    # keeps one session, and a second observer would fold every card twice
+    # and clear the file at the first turn's end.
+    def keep_pending_card(session)
+      return if @pending_card_handle
+
+      pending = Bridge::PendingCard.new(Session.session_dir(session.id))
+      pending.clear
+      @pending_card_handle = @engine.subscribe(observer: pending)
     end
 
     # Take the session's OwnerLock for this process's lifetime: the TUI runs

data/lib/samagotchi/tool_activity.rb

@@ -12,6 +12,7 @@ require_relative "tools/edit"
 require_relative "tools/task_create"
 require_relative "tools/task_get"
 require_relative "tools/task_list"
+require_relative "tools/task_runtime"
 require_relative "tools/task_stop"
 require_relative "tools/task_wait"
 require_relative "tools/web_fetch"
@@ -62,11 +63,13 @@ module Samagotchi
     # command without its "cd … &&"): a file tool's path relative to +cwd+
     # when it is under it, a command's description (the model's few words),
     # else its first step and how many more (CommandSteps; its first line
-    # when it has no steps), a memory's name;
-    # nil for the other tools (a plugin's row keeps its preview, the
+    # when it has no steps), a memory's name, a task tool's task command
+    # (task_title); nil for the other tools (a plugin's row keeps its preview, the
     # params). +params+ stays the full key=value line (the TUI, the
     # guardrails).
     def tool_title(tool_name, call, cwd: nil)
+      return task_title(tool_name, call, cwd) if TASK_TOOLS.include?(tool_name)
+
       if [Tools::Execute::NAME, Tools::TaskCreate::NAME].include?(tool_name)
         title = command_description(tool_name, call) || steps_title(call[:content])
         return title if title
@@ -90,19 +93,42 @@ module Samagotchi
       end
     end
 
+    TASK_TOOLS = [Tools::TaskWait::NAME, Tools::TaskGet::NAME, Tools::TaskStop::NAME].freeze
+
+    # A task_wait / task_get / task_stop row's title: the task's command
+    # (its record under +cwd+, the process's directory when nil) as a
+    # command's title, and for a wait how long it waits ("npm test · up to
+    # 600s"). nil when there is no record: the row keeps its id.
+    def task_title(tool_name, call, cwd)
+      command = Tools::TaskRuntime.command_of(call[:content], root: cwd)
+      return nil unless command
+
+      suffix = ""
+      if tool_name == Tools::TaskWait::NAME
+        timeout = call[:timeout].to_s.strip
+        suffix = " · up to #{timeout.empty? ? Tools::TaskWait::TIMEOUT_DEFAULT : timeout.to_i}s"
+      end
+      room = TOOL_ACTIVITY_PREVIEW_LIMIT - suffix.length
+      text = steps_title(command, room) || command_title(command).gsub(/\s+/, " ")
+      return nil if text.empty?
+
+      text = "#{text[0, room - 1]}…" if text.length > room
+      "#{text}#{suffix}"
+    end
+
     # A leading "cd <dir> &&" / "cd <dir>;" goes: the model's habit, and it
     # eats the line.
     LEADING_CD = /\Acd\s+(?:"[^"]*"|'[^']*'|\S+)\s*(?:&&|;)\s*/
 
-    # "<first step> +N" (N the steps after it), cut to fit
-    # TOOL_ACTIVITY_PREVIEW_LIMIT; nil when the command has no steps.
-    def steps_title(command)
+    # "<first step> +N" (N the steps after it), cut to fit +limit+
+    # (TOOL_ACTIVITY_PREVIEW_LIMIT); nil when the command has no steps.
+    def steps_title(command, limit = TOOL_ACTIVITY_PREVIEW_LIMIT)
       steps = CommandSteps.parse(command)&.steps
       return nil unless steps
 
       first = steps.first.text.gsub(/\s+/, " ")
       more = steps.size > 1 ? " +#{steps.size - 1}" : ""
-      room = TOOL_ACTIVITY_PREVIEW_LIMIT - more.length
+      room = limit - more.length
       first = "#{first[0, room - 1]}…" if first.length > room
       "#{first}#{more}"
     end
@@ -150,10 +176,14 @@ module Samagotchi
     # "error" for an "Error:" result, and for an execute whose command
     # exited non-zero (its last "exit: N" line; no number: killed by a
     # signal), so the turn tally's "(N failed)" counts it. "stopped" for a
-    # task_wait the user's Stop ended (the task itself runs on), and for one
-    # whose task was stopped (the stop-task button, or the model's task_stop).
+    # task_wait the user's Stop ended (the task itself runs on), for one
+    # whose task was stopped (the stop-task button, or the model's task_stop),
+    # and for a command the user's Stop killed or kept from starting: a
+    # cancel, not a failure (its text still starts "Error:" for the model).
     def tool_activity_status(result, tool_name = nil)
       text = result.to_s
+      return "stopped" if text == Tools::Execute::NOT_RUN_ON_STOP
+      return "stopped" if tool_name == Tools::Execute::NAME && text.start_with?(Tools::Execute::STOPPED_BY_USER)
       return "error" if text.start_with?("Error:")
       return "error" if tool_name == Tools::Execute::NAME && execute_failed?(text)
       return "stopped" if tool_name == Tools::TaskWait::NAME && text.match?(/^(wait_result: canceled|status: stopped)$/)