samagotchi 0.29.0 → 0.30.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 581b7b0fa7184fb49a83588921656f2f91f05ae04538592e69874ba1207b686c
-  data.tar.gz: 4c381eb155ab69b933cda29461a02b111910adfb53309bb38ffc5819dfc764d6
+  metadata.gz: 7af50a3a7e90170a9d6b4f3f5ab5914a0ab536ea121b498779109dabfb7c0b51
+  data.tar.gz: 4ddba29c753f1a6900956cc5abbbef70c3d912286e252c4c9adf08534a773368
 SHA512:
-  metadata.gz: 84b0ba1d65c4c5d41fcbee9e925934f6fd6ee1eb4b46bb35af98b46cde28f9ad334ab56ff44e1ee503f0f7f9dab107d03429c145c7097fa35f90aa8ab86f1f4f
-  data.tar.gz: 7725dc03f4d5c9d42e7a5c4cae0ba5729740a6d95d37fb04c7bdcc611489907b039ad2ec9b0770c7f47ff04fc681d750309988825896c0e90c1e5b7c0dda3605
+  metadata.gz: 497f4731e7a4ca9c1bd5073bea8e897506d37a5fcdfd15ea394f5837edfc85d76fbaade739ec4f6de998f7da5a982c3a8a9c1d4674b1e218a50ab14fe673291b
+  data.tar.gz: 0c6428021607e8540dcb21801510eca0295be3fba2de0e09eb4c2fd3c2c362326301065b52c5bc7745e006768522312d1934659da4cacc93254560402c767e76

data/CHANGELOG.md

@@ -8,6 +8,58 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.30.0] - 2026-10-05
+
+### Added
+
+- chi saves the model ids each host last listed (`~/.local/state/samagotchi/model_lists.json`), so a command that
+  starts a session without listing the hosts itself knows what they serve.
+- `chi send --new --model` and the `delegate` tool's `model:` warn about a model id the named host's saved list
+  doesn't have: `host 'box' doesn't list model 'gemma-smal' (did you mean: gemma-small?); started it anyway`, on
+  stderr / in the tool's result. The session still starts: some hosts serve ids they don't list (a one-model
+  llama.cpp server takes any name, OpenRouter's `:nitro`). A name that names no host, a host with no saved list, and
+  a list over a week old are not checked.
+
+### Changed
+
+- Web: an open step whose label is its narration's first line or its first call's title shows only its call count,
+  so it doesn't repeat the words its body starts with; closed, the label is unchanged.
+- Web stage: an answered turn says its step count once (in the cloud's chip) and its time once (in the status row).
+- Web stage: `execute` and the task tools are blue in the running-tool row and the ticks, as in the tool rows under
+  them; purple is thinking's colour only (other tools' ticks are a quieter blue-grey).
+- Web stage: `edit` and `write` are blue in the running-tool row and the ticks too, as in the tool rows; green is a
+  finished call's `✓` and an answered turn's only.
+
+### Fixed
+
+- A command the user's Stop killed (or kept from starting) is saved as `stopped`, not `error`: the web shows it with
+  ■ and `stopped`, and the turn's `(N failed)` and the session's tool errors no longer count it.
+- Web: the stop-task confirm names a task from an earlier turn by its command (the wait row's title), not its id.
+- Web: a canceled turn's end line (the Stop, Ctrl-C, a hook, the session's stop) reads `■ canceled (stopped)` in the
+  stopped calls' amber, live and after a reload, not as a red error; a worker that exited mid-turn stays red `✕`.
+- Web stage: a call the Stop cut has an amber tick and an amber `■` in the trail, as its `■ STOPPED` row, instead of
+  its tool kind's colour.
+- A call still running when its turn is canceled is saved in the session's tool records as `stopped` (was
+  `canceled`), the word its row uses; one cut by a failed turn stays `canceled`.
+- A canceled turn's last step keeps the thinking it streamed, so reloading it shows the thought instead of an empty
+  step (both loops).
+- A plain REPL (`--no-shared`) keeps its session's `pending_card.json` as a worker does, so `chi web` marks a session
+  waiting on an open card it showed.
+- source-links: a ref that names its own repo (`other/repo#12`) takes `{host}` from the git remote only when the
+  source's `remote_host:` lists that host, so it can't link to the local checkout's host.
+- Web stage: the running-tool row no longer reads `thinking…` once the turn has ended (answered, canceled or
+  failed): it is idle, with no word.
+- The REPL and attached mode end a canceled turn with an amber `■` (`■ turn canceled (Ctrl-C)`, `■ turn stopped by
+  loop-guard`), as the web does, instead of `✕`: a stop someone chose, not an error; a failed turn keeps `✕`.
+- Web stage: a call a guardrail blocked has a red tick and a red `✕` in the trail, as its `✕ BLOCKED` row, instead
+  of its tool kind's colour.
+- A command step with more than one heredoc (`-f body="$(cat <<EOF …)" -f title="$(cat <<EOF …)"`) cuts every body
+  out of its text, and its chip says so: `EOF · 3 lines +1`, with all of them on hover.
+- A session worker survives a failed save between turns too (its first prompt, a command, taken notes, a dropped
+  question): it logs it and keeps going; notes whose save failed are kept and saved on the next pass.
+
+Update with `chi update` (source-links 0.3.4, mcp 0.4.4) and restart `chi web`.
+
 ## [0.29.0] - 2026-10-05
 
 ### Added
@@ -1500,7 +1552,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.29.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.30.0...HEAD
+[0.30.0]: https://github.com/dm1try/samagotchi/compare/v0.29.0...v0.30.0
 [0.29.0]: https://github.com/dm1try/samagotchi/compare/v0.28.0...v0.29.0
 [0.28.0]: https://github.com/dm1try/samagotchi/compare/v0.27.0...v0.28.0
 [0.27.0]: https://github.com/dm1try/samagotchi/compare/v0.26.0...v0.27.0

data/docs/cli.md

@@ -849,12 +849,12 @@ While a turn runs, you can cancel it without exiting the process:
 Behavior notes:
 
 - Cancellation returns control to the prompt immediately; what you typed there stays.
-- The turn ends with one line, `✕ turn canceled (Ctrl-C) · 3.1s`, and for a prompt turn a dim
+- The turn ends with one line, `■ turn canceled (Ctrl-C) · 3.1s` (`■`, a stop someone chose, in amber), and for a prompt turn a dim
   `partial progress kept; !rollback restores the pre-turn state` under it (a canceled continue is back where it
   started). A failed turn ends with `✕ turn failed: <summary> · 2.0s` and a dim `prompt restored for retry`. The
-  REPL and attached mode say the same; the web says `✕ canceled (Ctrl-C)` (`stopped` for its Stop button,
-  `by a hook` for a hook's). A turn a bundle's plugin stopped names it: `✕ turn stopped by loop-guard` (the web:
-  `✕ stopped by loop-guard`).
+  REPL and attached mode say the same; the web says `■ canceled (Ctrl-C)` (`stopped` for its Stop button,
+  `by a hook` for a hook's). A turn a bundle's plugin stopped names it: `■ turn stopped by loop-guard` (the web:
+  `■ stopped by loop-guard`).
 - Visible text the canceled request had streamed stays in the conversation, marked `[interrupted]`, so the next
   message (or a continue) picks up from the half-finished reply; the canceled request's thinking and any unfinished
   tool call are dropped.

data/docs/hooks.md

@@ -179,7 +179,7 @@ What a cut is, in detail:
 - It is an empty answer made early: it uses the `retry.empty_answer` budget
   ([configuration.md](configuration.md#llama-network-retry-behavior)). With
   no retry left (`retry.empty_answer: 0`, or already used) and nothing
-  queued, the turn ends cancelled (hook): "✕ turn canceled (hook)".
+  queued, the turn ends cancelled (hook): "■ turn canceled (by a hook)".
 - It shows nothing by itself: post your own notice (`event[:notify]`) to say
   why. The bundle and the reason go into the note the model reads and the
   log (`generation_stopped`).

data/docs/plugins.md

@@ -863,7 +863,7 @@ What happens (`action: retry`, the default):
    `loop-guard> thinking repeats itself ("Wait, the count of the letter r…", 3 sentences ×3, 4k chars, 8 s): cut`
    (a short run or a window says how many different sentences it held:
    "12 different sentences in 48"), and `↻ cut by loop-guard, asking again (1/1)`.
-2. If the retry loops too, the turn is stopped ("stopped the turn: …", "✕
+2. If the retry loops too, the turn is stopped ("stopped the turn: …", "■
    turn stopped by loop-guard") with a card that quotes the repeated
    sentences.
 3. A loop is forgotten after `forget_after` good steps in a row (generations

data/docs/sessions.md

@@ -168,7 +168,7 @@ chi send --wait -m "and the tests?" 3fa2               # a follow-up in the same
 chi send --wait 3fa2                                   # sends nothing: waits for its next reply
 ```
 
-- `--new` takes no ids (one new session per call). `--dir DIR` is its folder, and so its project (default the current one); `--model M` its model (default the configured one; the name isn't checked up front, a wrong one fails the worker's first turn).
+- `--new` takes no ids (one new session per call). `--dir DIR` is its folder, and so its project (default the current one); `--model M` its model (default the configured one). A host config.yml doesn't have is refused before anything is spawned (exit 1). A `host:id` whose id that host's last saved list doesn't have (`~/.local/state/samagotchi/model_lists.json`, what `chi models` / `/models` / the web last listed for that host, at most a week old) gets one warning line on stderr, with up to three close ids as a hint (`did you mean: gemma-small?`), and the session starts anyway: some hosts serve ids they don't list (a one-model llama.cpp server takes any name). A bare id (no `host:`) isn't checked that way — routing sends it to whichever host lists it — and with no saved list for the host nothing is said; a wrong id then fails the worker's first turn.
 - `--new` prints `<full id>  started` on stdout. With `--wait` that line (and the `sent` line for an existing session) goes to stderr, so stdout is exactly the answer: the reply of the turn the message started, in full. It is the worker's `output/` file, the same one `delegate` reads; a turn that ends with only tool calls and no text has none.
 - `--wait` takes one session: `--new` or one id. A session with a running turn is refused (`busy: a turn is running; wait or attach`, exit 1): the message would run after it, and its reply would come back as the answer.
 - Exit codes with `--wait`: 0 answered; 3 the turn waits for an answer from you (a question, a hook's question, a guardrail approval, or the step-limit question: see [chi as a sub-agent](sub-agent.md#the-step-limit)), and the session keeps waiting: stderr gets the whole question (`waiting for an answer (approval): …`, its text, the numbered options, whether free text is allowed) and how to answer it (`chi answer ID --question QID --option N`, or `chi --attach ID`, the web); 4 `--timeout S` passed with the turn still running (it goes on; wait again); 1 the turn ended without a reply (canceled, failed or empty), the worker failed or vanished, or the session was stopped; 130 on Ctrl-C, which leaves the turn running (`still running: chi --attach ID`). There is no default timeout.
@@ -179,7 +179,7 @@ chi send --wait 3fa2                                   # sends nothing: waits fo
 
 ## Delegating
 
-The `delegate` tool hands a task to a **child session**: an ordinary chi session in a worker of its own, started in the parent's `working_directory` with the task, verbatim, as its first user message, on the parent's model unless the call names one (`model:` takes a name or an alias, resolved as `--model` is; nothing checks the host serves it, so an unknown one fails the child's first turn). Children run in parallel and only their **final reply** comes back to the parent: the child's newest `output/<timestamp>.txt` file, which the worker writes at the end of each turn that produced visible text, cut head-and-tail like an `execute` result. Nothing of the child's trace enters the parent's context. Nothing is hidden: a child shows in `chi sessions list` (`↳ <parent>`), the web (a `↳` chip on its card, `delegated by` in its info bar, listed right after its parent in the all-sessions view) and the `list_sessions` tool (`child`; the parent shows as `parent` in the child's own list); the user can `chi --attach <child id>` and steer it mid-run, and `chi send` and `send_note` reach it like any session.
+The `delegate` tool hands a task to a **child session**: an ordinary chi session in a worker of its own, started in the parent's `working_directory` with the task, verbatim, as its first user message, on the parent's model unless the call names one (`model:` takes a name or an alias, resolved as `--model` is; an unknown host comes back as the tool's `Error:` line; an id the host's saved model list doesn't have starts the child with a `Warning: host 'h' doesn't list model 'x' (did you mean: …?)` line in the result). Children run in parallel and only their **final reply** comes back to the parent: the child's newest `output/<timestamp>.txt` file, which the worker writes at the end of each turn that produced visible text, cut head-and-tail like an `execute` result. Nothing of the child's trace enters the parent's context. Nothing is hidden: a child shows in `chi sessions list` (`↳ <parent>`), the web (a `↳` chip on its card, `delegated by` in its info bar, listed right after its parent in the all-sessions view) and the `list_sessions` tool (`child`; the parent shows as `parent` in the child's own list); the user can `chi --attach <child id>` and steer it mid-run, and `chi send` and `send_note` reach it like any session.
 
 - `delegate(task, model:, session:, wait:, timeout:)`: starts a child and, by default, waits for its reply (`wait: false` returns at once, so several children can run side by side; `timeout`, default 600 s, leaves a slow child running; 0 checks once without waiting). With `session:` (a child's id or prefix) the task goes to that child as a follow-up instead, delivered like `chi send` (client id `delegate:<parent short id>`, shown as `delegate>` in the child's UIs); only this session's children take one.
 - `delegate_result(session:, timeout:)`: waits for a child's next reply: the one named, or the newest running child (`timeout` as for `delegate`: 0 checks once and returns at once). The reply comes back once; a later call waits for the next one.

data/lib/samagotchi/bundles/mcp/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: mcp
-version: 0.4.3
+version: 0.4.4
 scope: system
 description: "Tools from MCP servers (stdio): each server in config.yml bundles: mcp: servers: runs for the session, its tools are mcp_<server>_<tool>; /mcp lists them"
 trust_level: reviewed
 files: {}
 plugin:
   file: plugin.rb
-  sha256: sha256:079a42892f10822115235e1ced7ccd481f80c9ef54abb094f9a1c599bb03e8e2
+  sha256: sha256:05543038e2950a5391655184f57a1028133eda8ca05f9e46e5cd2eddc3e9e608
 requires_chi: ">= 0.8.0"

data/lib/samagotchi/bundles/mcp/plugin.rb

@@ -18,11 +18,12 @@
 #           attach_image_paths: true  # default: an image path in the text, in the
 #                                     # temp dir or cwd, attaches it
 #
-# Image blocks in a result go to the model as images (text: "[image 1:
-# image/png, attached]"); so does an image file named in a text block,
+# Image blocks in a result go to the model as images (the text keeps
+# "[image 1: image/png]"); so does an image file named in a text block,
 # under the system temp dir or the server's cwd: the block is only its
 # absolute path (chrome-devtools-mcp --slim answers a screenshot that way),
-# or it says one ending in an image extension ("Saved it to /tmp/a.png.").
+# or it says one ending in an image extension ("Saved it to /tmp/a.png."),
+# noted as "[image 1: a.png]".
 # A server that doesn't start, answer or list its tools is skipped with a
 # notice; the rest of chi works. One that exits mid-session starts again on
 # its next call, at most MAX_RESTARTS times a session. /mcp lists the

data/lib/samagotchi/bundles/source-links/hooks/source_links.rb

@@ -40,8 +40,12 @@ require "open3"
 # A `url:` template takes {match} (group 1, else the whole ref), {1}…{9}
 # (numbered groups), {name} (named groups), and {repo}/{host}: the named
 # group when it took part, else the project's (Dir.pwd's) git remote, asked
-# of git once per worker. A ref with a placeholder that can't be filled is
-# not linked; a `{word}` that is none of these stays text (warned at load).
+# of git once per worker. A {repo} the ref itself names ("other/repo#12")
+# is that ref's own, so its {host} comes from the remote only when the
+# source's `remote_host:` list has the remote's host: else the ref would
+# link to this checkout's host with someone else's repo. A ref with a
+# placeholder that can't be filled is not linked; a `{word}` that is none
+# of these stays text (warned at load).
 #
 # The note is not stored in the conversation: it is an event, replayed by a
 # UI only while the session's worker lives (a reload keeps it; a stopped
@@ -457,7 +461,7 @@ class SourceLinks
     when /\A\d+\z/ then match[word.to_i]&.then { |value| escape_url(value) }
     when "repo", "host"
       value = match.names.include?(word) ? match[word] : nil
-      value ||= remote_value(word, source)
+      value ||= remote_value(word, source, repo_from_match: match.names.include?("repo") ? match["repo"] : nil)
       word == "repo" ? escape_repo(value) : value&.then { |host| escape_url(host) }
     else match[word]&.then { |value| escape_url(value) }
     end
@@ -466,7 +470,16 @@ class SourceLinks
   # {repo} / {host} from the project's git remote (the source's `remote:`,
   # default origin); nil when there is none, or when its host is not one of
   # the source's `remote_host:` list.
-  def remote_value(word, source)
+  #
+  # +repo_from_match+: the match's own {repo}, when it has one. Such a ref
+  # names its own repo (`other/repo#12`), not the local checkout's, so its
+  # {host} may only come from the remote when the source lists that remote's
+  # host (remote_host:): else the ref would link to the local remote's host
+  # with someone else's repo.
+  def remote_value(word, source, repo_from_match: nil)
+    derived_host = word == "host" && !repo_from_match.to_s.empty?
+    return nil if derived_host && source[:remote_hosts].empty?
+
     remote = project_remote(source[:remote])
     return nil unless remote
 

data/lib/samagotchi/bundles/source-links/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: source-links
-version: 0.3.3
+version: 0.3.4
 scope: system
 description: Links source refs (JIRA tickets, GitHub issues, …) in the model's answer — inline links in the web, and a one-line note after the turn (note false turns it off); sources are configured patterns
 trust_level: reviewed
@@ -8,7 +8,7 @@ files:
   source_links.md: sha256:aebd37f1e25491780994ecc4afc20ed6e8db32b724dc038302bb050177efada8
 hooks:
   source_links.rb:
-    sha256: sha256:454d3512a4aa078b288ff6d0ed25867222a56ead1a57ef1eaa14918e631fec23
+    sha256: sha256:c93269964ebc824b5f15ab60db81a458facd50de61446c550f254ea4c68964e2
     event: after_turn
     on_error: log
     priority: 90

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.29.0
+version: 0.30.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/command_steps.rb

@@ -9,7 +9,9 @@ module Samagotchi
   # command as the model wrote it. Rules, in order:
   #
   # - a heredoc's body leaves its step's text and becomes its +heredoc+
-  #   ({tag:, lines:}), also one inside a "$(cat <<'EOF' … EOF)" argument;
+  #   ({tag:, lines:}), also one inside a "$(cat <<'EOF' … EOF)" argument; a
+  #   step with more than one is cut of them all, and lists them as
+  #   +heredocs+ (+heredoc+ stays the first; the web's chip names it, +N);
   # - steps are split at && || ; | |& & and newlines; a ( … ) subshell stays
   #   one step; +op+ is the operator before a step (nil for the first);
   # - a leading "cd X &&" / "cd X;" becomes +cd+ (only the first);
@@ -23,8 +25,8 @@ module Samagotchi
   #   parentheses) gives nil: the UI then shows the title and the raw
   #   command.
   module CommandSteps
-    Step = Data.define(:text, :op, :label, :limit, :heredoc) do
-      def initialize(text:, op: nil, label: nil, limit: nil, heredoc: nil) = super
+    Step = Data.define(:text, :op, :label, :limit, :heredoc, :heredocs) do
+      def initialize(text:, op: nil, label: nil, limit: nil, heredoc: nil, heredocs: nil) = super
 
       def to_h = super.compact
     end
@@ -122,29 +124,47 @@ module Samagotchi
 
       slice = text[from...to]
       heredoc = body && { tag: bodies[body.last], lines: body_lines(text[body.last]) }
-      slice, heredoc = inner_heredoc(slice) unless heredoc
-      Step.new(text: slice.strip, op: op, heredoc: heredoc)
+      slice, heredocs = inner_heredocs(slice) if heredoc.nil?
+      Step.new(text: slice.strip, op: op, heredoc: heredoc || heredocs&.first,
+               heredocs: heredocs && heredocs.size > 1 ? heredocs : nil)
     end
 
-    # A heredoc inside a $(…) in +slice+ (git commit -m "$(cat <<'EOF' …)"):
-    # the slice with the body cut out, and the heredoc; or the slice as is.
-    def inner_heredoc(slice)
-      return [slice, nil] unless slice.include?("<<")
+    # Every heredoc inside a $(…) in +slice+ (git commit -m "$(cat <<'EOF'
+    # …)"): the slice with all their bodies cut out, and the heredocs ([] for
+    # none). One step can hold several ("-f body=$(cat <<EOF …)" and
+    # "-f title=$(cat <<EOF …)"), and the rest of the step is text the reader
+    # would otherwise see.
+    def inner_heredocs(slice)
+      heredocs = []
+      return [slice, heredocs] unless slice.include?("<<")
 
       at = 0
       while (open = slice.index("$(", at))
         lexer = Lex::Lexer.new(slice[(open + 2)..])
         lexer.tokens
         doc = lexer.heredoc_spans.first
-        if doc
-          from = open + 2 + doc[:span].begin - 1 # the newline before the body
-          to = open + 2 + doc[:span].end
-          to += 1 if slice[to] == "\n"
-          return [slice[0...from] + slice[to..], { tag: doc[:tag], lines: body_lines(slice[(from + 1)...to]) }]
+        unless doc
+          at = open + 2
+          next
         end
+
+        from = open + 2 + doc[:span].begin - 1 # the newline before the body
+        to = open + 2 + doc[:span].end
+        to += 1 if slice[to] == "\n"
+        heredocs << { tag: doc[:tag], lines: body_lines(slice[(from + 1)...to]) }
+        cut = slice[0...from] + slice[to..]
+        # A span that cut nothing (it can't) would loop here: move past it.
+        if cut.length >= slice.length
+          at = open + 2
+          next
+        end
+
+        slice = cut
+        # The cut moved everything after it left; keep looking from the same
+        # spot, past this "$(".
         at = open + 2
       end
-      [slice, nil]
+      [slice, heredocs]
     end
 
     # The body's line count, its terminator line not counted.

data/lib/samagotchi/host_registry.rb

@@ -5,6 +5,7 @@ require_relative "config"
 require_relative "log"
 require_relative "model_ref"
 require_relative "client"
+require_relative "model_list_store"
 require_relative "llm/openai_chat"
 
 module Samagotchi
@@ -287,6 +288,9 @@ module Samagotchi
             models = list_models_for(entry)
             data = { host: entry.host, port: entry.port, transport: entry.transport, models: models, error: nil }
             @mutex.synchronize { @host_lists[name] = { data: data, at: @clock.call } }
+            # On disk too: a process that spawns a worker without listing
+            # (`chi send --new --model`, delegate) checks an id against it.
+            ModelListStore.save(name, models.map(&:id))
           rescue StandardError => e
             Log.warn(:model, "list_failed", host: name, error: e.class.name, msg: e.message.to_s[0, 500])
             data = { host: entry.host, port: entry.port, transport: entry.transport, models: [], error: e.message }

data/lib/samagotchi/kernel_loop.rb

@@ -197,7 +197,8 @@ module Samagotchi
         emit(turn, type: :generation_cancelled, iteration: turn.iteration, reason: e.reason,
                    stopped_by: turn.cancel_controller&.stopped_by)
         return cancelled_result(turn.conversation, tool_activity: turn.tool_activity, reason: e.reason,
-                                                   partial_assistant_text: turn.buffer)
+                                                   partial_assistant_text: turn.buffer,
+                                                   streamed_thinking: turn.streamed_thinking)
       end
       finish(turn)
     rescue StandardError => e
@@ -239,8 +240,8 @@ module Samagotchi
     # context tracker and the retry budget, the tool activity, the visible
     # text streamed so far (salvaged on a cancel), the Qwen recovery state,
     # the prefill, and what the caller gave.
-    Turn = Struct.new(:conversation, :context, :empty_retry, :tool_activity, :buffer, :qwen_attempts, :qwen_partial,
-                      :prefill, :pending_tool_calls, :model_name, :pending_input, :on_stream_event,
+    Turn = Struct.new(:conversation, :context, :empty_retry, :tool_activity, :buffer, :streamed_thinking, :qwen_attempts,
+                      :qwen_partial, :prefill, :pending_tool_calls, :model_name, :pending_input, :on_stream_event,
                       :cancel_controller, :cap, :emit, :iteration, :empty_steps, :ended_empty, keyword_init: true)
     # One request: the prompt and its images as sent, the images' token
     # estimate, and the window it was measured against.
@@ -258,7 +259,8 @@ module Samagotchi
       conversation = prepare_conversation(messages)
       Turn.new(
         conversation: conversation, context: ContextStatus.new(conversation: conversation),
-        empty_retry: EmptyAnswerRetry.new, empty_steps: [], tool_activity: [], buffer: +"", qwen_attempts: 0, qwen_partial: nil,
+        empty_retry: EmptyAnswerRetry.new, empty_steps: [], tool_activity: [], buffer: +"", streamed_thinking: +"",
+        qwen_attempts: 0, qwen_partial: nil,
         # Qwen with thinking off: an empty thought after the cue, so the model
         # answers at once. Kept in the turn's model messages, so each tool-loop
         # prompt starts with what the server already has cached.
@@ -329,6 +331,9 @@ module Samagotchi
       generation = Generation.new(usage: nil, served_model: nil, streamed_thinking: 0)
       fire_hook(:before_generation, { type: :before_generation, iteration: turn.iteration }) if @hooks
       buffer_mark = turn.buffer.length
+      # A cancel salvages only this generation's thinking: the earlier
+      # steps' is on their own messages already.
+      turn.streamed_thinking = +""
       generation.response = with_generation(turn.cancel_controller) do |generation_controller|
         request_generation(
           request.prompt,
@@ -342,6 +347,7 @@ module Samagotchi
             generation.usage = nil
             generation.cache = nil
             generation.streamed_thinking = 0
+            turn.streamed_thinking = +""
             generation.finish_reason = nil
             turn.emit.call({ type: :generation_retrying, iteration: turn.iteration }.merge(retry_event)) if turn.on_stream_event
           },
@@ -368,6 +374,7 @@ module Samagotchi
       generation.finish_reason = chunk[:finish_reason] if chunk[:finish_reason]
       split = stream_splitter.feed(chunk[:content])
       turn.buffer << split[:text]
+      turn.streamed_thinking << split[:thinking].to_s
       generation.streamed_thinking += split[:thinking].to_s.length
       return unless turn.on_stream_event
 
@@ -625,7 +632,7 @@ module Samagotchi
       ModelProfile.required_model_name(override)
     end
 
-    def cancelled_result(conversation, tool_activity:, reason:, partial_assistant_text: "")
+    def cancelled_result(conversation, tool_activity:, reason:, partial_assistant_text: "", streamed_thinking: "")
       partial = partial_assistant_text.to_s.strip
       conversation = duplicate_conversation(conversation)
       # Salvage the already-streamed visible reply (thought/tool_call lanes
@@ -633,7 +640,13 @@ module Samagotchi
       # cannot leak) so a follow-up steering message continues with the model's
       # half-finished work in context instead of losing it.
       unless partial.empty?
-        conversation << { role: "model", content: "#{partial}\n[interrupted]", interrupted: true }
+        message = { role: "model", content: "#{partial}\n[interrupted]", interrupted: true }
+        # The thinking this generation streamed goes with it (the chat loop's
+        # with_thinking key, which MessageParts reads and the prompt doesn't):
+        # without it, reloading the cut step shows the empty answer it isn't.
+        thinking = streamed_thinking.to_s
+        message[:thinking] = thinking unless thinking.strip.empty?
+        conversation << message
       end
       LLM::ModelResult.new(
         text: "",

data/lib/samagotchi/llm/chat_loop.rb

@@ -338,8 +338,8 @@ module Samagotchi
             return canceled(iteration, @cancel_controller.reason) if @cancel_controller&.cancelled?
 
             inject_pending_input(iteration)
-            response, partial = generate(iteration)
-            return canceled(iteration, response, partial) if partial
+            response, partial, thought = generate(iteration)
+            return canceled(iteration, response, partial, thought) if partial
 
             if response.cut
               outcome = after_cut(iteration, response)
@@ -468,7 +468,7 @@ module Samagotchi
                                                messages: AnswerDisplay.strip_all(@conversation).map(&:dup).freeze })
           [response, nil]
         rescue RequestCancelled => e
-          [e.reason, streamed]
+          [e.reason, streamed, thought]
         end
 
         # The request runs under the generation's own controller (the turn
@@ -593,11 +593,17 @@ module Samagotchi
         end
 
         # The text streamed before the cancel stays, marked [interrupted],
-        # as the native loop's salvage does.
-        def canceled(iteration, reason, partial = "")
+        # as the native loop's salvage does; the reasoning this generation
+        # streamed rides along on the message (with_thinking's key).
+        def canceled(iteration, reason, partial = "", thinking = "")
           emit(type: :generation_cancelled, iteration: iteration, reason: reason, stopped_by: @cancel_controller&.stopped_by)
           visible = @loop.strip_model_thought(partial.to_s).strip
-          @conversation << { role: "model", content: "#{visible}\n[interrupted]", interrupted: true } unless visible.empty?
+          unless visible.empty?
+            message = { role: "model", content: "#{visible}\n[interrupted]", interrupted: true }
+            thought = thinking.to_s
+            message[:thinking] = thought unless thought.strip.empty?
+            @conversation << message
+          end
           conversation = @loop.plain(@conversation)
           conversation.last[:interrupted] = true unless visible.empty?
           ModelResult.new(text: "", conversation: conversation, canceled: true,

data/lib/samagotchi/model_list_store.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "json"
+require "fileutils"
+
+require_relative "atomic_file"
+require_relative "log"
+require_relative "paths"
+
+module Samagotchi
+  # The model ids each host last listed, saved in
+  # <state dir>/model_lists.json for the processes that spawn a worker but
+  # never list a host themselves: `chi send --new --model` and the
+  # `delegate` tool warn about an unknown model id up front from it
+  # (ModelProfile.model_warning) instead of only the worker's first turn
+  # failing. It is a cache of the hosts' own lists, so it never raises: no
+  # file, an unreadable one or bad JSON reads as no list at all. Only a
+  # successful listing writes (a host that is down keeps the ids we know),
+  # and a list older than TTL_SECONDS is no evidence about the host any
+  # more.
+  #
+  #   { "<host name>" => { "ids" => ["…"], "at" => <epoch seconds> } }
+  module ModelListStore
+    FILE = "model_lists.json"
+    # When a saved list is too old to say what a host serves: a model may
+    # have been added or removed since.
+    TTL_SECONDS = 7 * 24 * 60 * 60
+
+    # One host's saved list: the ids it listed and when (+at+, epoch
+    # seconds).
+    Saved = Data.define(:host, :ids, :at) do
+      def age(now: Time.now.to_i) = now.to_i - at.to_i
+
+      # Too old to check an id against (ModelProfile.model_warning): a model
+      # may have been added or removed since.
+      def stale?(now: Time.now.to_i) = age(now: now) > ModelListStore::TTL_SECONDS
+
+      # A host's own list spells its ids, and resolution matches them by
+      # case (the registry's model index is downcased): so does this.
+      def known?(id) = ids.any? { |known| known.casecmp?(id.to_s.strip) }
+    end
+
+    module_function
+
+    # @return [String] <state home>/samagotchi/model_lists.json
+    def path(env: ENV)
+      File.join(Paths.state_dir(env: env), FILE)
+    end
+
+    # Every saved list by host name, the lists as [Saved] (empty without a
+    # file, with bad JSON, or with nothing readable in it).
+    # @return [Hash{String => Saved}]
+    def read(env: ENV)
+      all(env: env).each_with_object({}) do |(name, entry), acc|
+        list = saved_from(name, entry)
+        acc[name] = list if list
+      end
+    end
+
+    # One host's saved list.
+    # @return [Saved, nil] nil without a file, with bad JSON, or with no
+    #   entry for the host
+    def find(host, env: ENV)
+      read(env: env)[host.to_s.strip.downcase]
+    end
+
+    # Save the ids +host+ just listed, keeping every other host's entry.
+    # Best effort: a store that can't be written never fails the listing
+    # that found the ids. An empty list is not saved (it is no evidence the
+    # host serves nothing: keep the ids we know).
+    # @return [Saved, nil] what was saved, nil when nothing was
+    def save(host, ids, at: Time.now.to_i, env: ENV)
+      name = host.to_s.strip.downcase
+      list = Array(ids).map { |id| id.to_s.strip }.reject(&:empty?).uniq
+      return nil if name.empty? || list.empty?
+
+      file = path(env: env)
+      FileUtils.mkdir_p(File.dirname(file))
+      # Under the lock, so two workers listing a host at once (or two
+      # threads of one registry) never drop each other's entries.
+      File.open("#{file}.lock", File::RDWR | File::CREAT, 0o600) do |lock|
+        lock.flock(File::LOCK_EX)
+        entries = all(env: env)
+        entries[name] = { "ids" => list, "at" => at.to_i }
+        AtomicFile.write(file, JSON.pretty_generate(entries) + "\n")
+      end
+      Saved.new(host: name, ids: list, at: at.to_i)
+    rescue StandardError => e
+      Log.warn(:model, "model_list_save_failed", host: host.to_s, error: e.class.name, msg: e.message.to_s[0, 200])
+      nil
+    end
+
+    # The whole file, host names downcased: {name => entry}.
+    # @return [Hash]
+    def all(env: ENV)
+      data = JSON.parse(File.read(path(env: env)))
+      return {} unless data.is_a?(Hash)
+
+      data.each_with_object({}) do |(name, entry), acc|
+        acc[name.to_s.strip.downcase] = entry if entry.is_a?(Hash)
+      end
+    rescue StandardError
+      {}
+    end
+
+    # One +entry+ of the file as a Saved, or nil when it holds no ids or no
+    # time.
+    def saved_from(name, entry)
+      ids = Array(entry["ids"]).map { |id| id.to_s.strip }.reject(&:empty?)
+      at = entry["at"].to_i
+      return nil if ids.empty? || at <= 0
+
+      Saved.new(host: name, ids: ids, at: at)
+    end
+    private_class_method :saved_from
+  end
+end

data/lib/samagotchi/model_profile.rb

@@ -179,6 +179,49 @@ module Samagotchi
       raise UnknownHost, "unknown host '#{host}' in model '#{ref}'#{hint}; the configured hosts are #{names.join(", ")}"
     end
 
+    # A warning when +model_name+ resolves to a model id a host's saved
+    # list doesn't have (ModelListStore: what a `chi models`, a /models or
+    # the web's GET /api/models last listed for that host), else nil.
+    # Called where a session is spawned without listing the hosts itself
+    # (`chi send --new --model`, the delegate tool), so a typo is
+    # named before the worker's first turn fails on it. Only a warning: some
+    # hosts serve ids they don't list (a one-model llama.cpp server takes any
+    # name, OpenRouter's :nitro variants), so the session starts anyway.
+    # Never asks a host.
+    #
+    # Only a ref that names a host is checked (its alias resolved first, as
+    # ModelRef.parse does), and only against that host's own list: a bare id
+    # goes to whichever host lists it (HostRegistry#host_for_model), so no
+    # single list can judge it. Nothing is checked either without a saved
+    # list for the host or with one older than ModelListStore::TTL_SECONDS
+    # (a week: the host may serve different models by now).
+    # @param hosts [Hash, nil] the hosts a prefix may name (a HostRegistry's
+    #   entries); config.yml's by default
+    # @param lists [#read] ModelListStore by default
+    # @return [String, nil]
+    def self.model_warning(model_name, env: ENV, hosts: nil, lists: nil)
+      require_relative "config"
+      require_relative "model_list_store"
+      hosts ||= Samagotchi::ConfigFile.hosts_config(env: env)
+      lists ||= Samagotchi::ModelListStore
+      parsed = Samagotchi::ConfigFile.model_ref(model_name, env: env, hosts: hosts)
+      host = parsed.host_name
+      return nil unless host
+
+      list = lists.read(env: env)[host.to_s.strip.downcase]
+      return nil if list.nil? || list.stale? || list.known?(parsed.id)
+
+      unknown_model_message(parsed.id, host, list.ids)
+    end
+
+    # The warning for an id the host doesn't list, with up to three close
+    # ids (Config.near_names) when there are any.
+    def self.unknown_model_message(id, host, ids)
+      near = Samagotchi::Config.near_names(id, ids).first(3)
+      hint = near.empty? ? "" : " (did you mean: #{near.join(", ")}?)"
+      "host '#{host}' doesn't list model '#{id}'#{hint}; started it anyway; `chi models` lists what the hosts serve"
+    end
+
     # The prefix of "box:x" when box is a host config.yml has with
     # enabled: false (left out of +hosts+), else nil.
     def self.disabled_host_prefix(ref, hosts, env)