samagotchi 0.29.0 → 0.31.0

data/lib/samagotchi/client.rb

@@ -250,11 +250,13 @@ module Samagotchi
     #   this request runs on. PromptWarmup's pin, and only while a warm-up
     #   still runs there: a request pinned to a slot the server has since
     #   cleared skips its prompt cache and prefills everything again
+    # @param cache_prompt [Boolean] llama.cpp only: false prefills the whole
+    #   prompt, reusing nothing cached (a malformed generation's retry)
     # @return [String] the generated text
     def complete(prompt, stop: [], n_predict: nil, model: nil, on_chunk: nil, cancel_controller: nil, on_retry: nil,
-                 images: [], sampling: {}, slot: nil)
+                 images: [], sampling: {}, slot: nil, cache_prompt: true)
       images = Array(images)
-      request = { stop: stop, n_predict: n_predict, model: model, sampling: sampling, slot: slot }
+      request = { stop: stop, n_predict: n_predict, model: model, sampling: sampling, slot: slot, cache_prompt: cache_prompt }
       return stream_completion(LLM::Utf8Scrub.call(prompt), request, on_chunk, cancel_controller, on_retry) if images.empty?
 
       # The media marker is random per server process: a restart between the
@@ -311,6 +313,33 @@ module Samagotchi
                  prompt_ms: timings["prompt_ms"]&.round)
     end
 
+    # Whether llama.cpp's slot +slot+ is processing a request now (GET
+    # /slots, its is_processing): :busy or :idle. nil when unknown: no slot,
+    # another transport, the endpoint off (--no-slots), a slot it doesn't
+    # list, a bad body or a network error. One quick attempt (PromptWarmup:
+    # a warm-up pinned to a busy slot waits behind that request, and the
+    # next turn behind the warm-up).
+    # @return [Symbol, nil]
+    def slot_status(slot, model: nil)
+      return nil unless @transport.native? && slot.is_a?(Integer)
+
+      model = model.to_s.strip
+      query = model.empty? ? "" : "?#{URI.encode_www_form(model: model)}"
+      uri = URI("#{@scheme}://#{@host}:#{@port}/slots#{query}")
+      response = @http.fetch(uri, Net::HTTP::Get.new(uri), retries: false, check_status: false,
+                                  log_fields: { purpose: "slots" },
+                                  open_timeout: CONTEXT_WINDOW_PROBE_OPEN_TIMEOUT,
+                                  read_timeout: CONTEXT_WINDOW_PROBE_READ_TIMEOUT)
+      return nil unless response.code.to_s == "200"
+
+      entry = Array(JSON.parse(response.body.to_s)).find { |s| s.is_a?(Hash) && s["id"] == slot }
+      return nil unless entry&.key?("is_processing")
+
+      entry["is_processing"] == true ? :busy : :idle
+    rescue StandardError
+      nil
+    end
+
     private def stream_completion(prompt, fields, on_chunk, cancel_controller, on_retry)
       uri = completion_uri
       request = Net::HTTP::Post.new(uri)
@@ -498,7 +527,7 @@ module Samagotchi
       URI("#{@scheme}://#{@host}:#{@port}#{@transport.completion_path}")
     end
 
-    def completion_payload(prompt, stop:, n_predict:, model:, sampling: {}, slot: nil)
+    def completion_payload(prompt, stop:, n_predict:, model:, sampling: {}, slot: nil, cache_prompt: true)
       payload = { prompt: prompt, stop: stop, stream: true }
       # A non-positive cap is dropped, which leaves the length to the server
       # (unbounded): 0 here never means "only process the prompt". The
@@ -508,7 +537,9 @@ module Samagotchi
       payload[:model] = model_name if model_name
       if @transport.native?
         # llama.cpp's default today, sent anyway: chi's next turn relies on it.
-        payload[:cache_prompt] = true
+        # false only for the retry of a malformed generation (KernelLoop),
+        # which a poisoned cache must not produce again.
+        payload[:cache_prompt] = cache_prompt != false
         payload[:id_slot] = slot if slot.is_a?(Integer)
       end
       sendable_sampling(sampling).merge(payload)

data/lib/samagotchi/command_steps.rb

@@ -9,7 +9,9 @@ module Samagotchi
   # command as the model wrote it. Rules, in order:
   #
   # - a heredoc's body leaves its step's text and becomes its +heredoc+
-  #   ({tag:, lines:}), also one inside a "$(cat <<'EOF' … EOF)" argument;
+  #   ({tag:, lines:}), also one inside a "$(cat <<'EOF' … EOF)" argument; a
+  #   step with more than one is cut of them all, and lists them as
+  #   +heredocs+ (+heredoc+ stays the first; the web's chip names it, +N);
   # - steps are split at && || ; | |& & and newlines; a ( … ) subshell stays
   #   one step; +op+ is the operator before a step (nil for the first);
   # - a leading "cd X &&" / "cd X;" becomes +cd+ (only the first);
@@ -23,8 +25,8 @@ module Samagotchi
   #   parentheses) gives nil: the UI then shows the title and the raw
   #   command.
   module CommandSteps
-    Step = Data.define(:text, :op, :label, :limit, :heredoc) do
-      def initialize(text:, op: nil, label: nil, limit: nil, heredoc: nil) = super
+    Step = Data.define(:text, :op, :label, :limit, :heredoc, :heredocs) do
+      def initialize(text:, op: nil, label: nil, limit: nil, heredoc: nil, heredocs: nil) = super
 
       def to_h = super.compact
     end
@@ -122,29 +124,47 @@ module Samagotchi
 
       slice = text[from...to]
       heredoc = body && { tag: bodies[body.last], lines: body_lines(text[body.last]) }
-      slice, heredoc = inner_heredoc(slice) unless heredoc
-      Step.new(text: slice.strip, op: op, heredoc: heredoc)
+      slice, heredocs = inner_heredocs(slice) if heredoc.nil?
+      Step.new(text: slice.strip, op: op, heredoc: heredoc || heredocs&.first,
+               heredocs: heredocs && heredocs.size > 1 ? heredocs : nil)
     end
 
-    # A heredoc inside a $(…) in +slice+ (git commit -m "$(cat <<'EOF' …)"):
-    # the slice with the body cut out, and the heredoc; or the slice as is.
-    def inner_heredoc(slice)
-      return [slice, nil] unless slice.include?("<<")
+    # Every heredoc inside a $(…) in +slice+ (git commit -m "$(cat <<'EOF'
+    # …)"): the slice with all their bodies cut out, and the heredocs ([] for
+    # none). One step can hold several ("-f body=$(cat <<EOF …)" and
+    # "-f title=$(cat <<EOF …)"), and the rest of the step is text the reader
+    # would otherwise see.
+    def inner_heredocs(slice)
+      heredocs = []
+      return [slice, heredocs] unless slice.include?("<<")
 
       at = 0
       while (open = slice.index("$(", at))
         lexer = Lex::Lexer.new(slice[(open + 2)..])
         lexer.tokens
         doc = lexer.heredoc_spans.first
-        if doc
-          from = open + 2 + doc[:span].begin - 1 # the newline before the body
-          to = open + 2 + doc[:span].end
-          to += 1 if slice[to] == "\n"
-          return [slice[0...from] + slice[to..], { tag: doc[:tag], lines: body_lines(slice[(from + 1)...to]) }]
+        unless doc
+          at = open + 2
+          next
         end
+
+        from = open + 2 + doc[:span].begin - 1 # the newline before the body
+        to = open + 2 + doc[:span].end
+        to += 1 if slice[to] == "\n"
+        heredocs << { tag: doc[:tag], lines: body_lines(slice[(from + 1)...to]) }
+        cut = slice[0...from] + slice[to..]
+        # A span that cut nothing (it can't) would loop here: move past it.
+        if cut.length >= slice.length
+          at = open + 2
+          next
+        end
+
+        slice = cut
+        # The cut moved everything after it left; keep looking from the same
+        # spot, past this "$(".
         at = open + 2
       end
-      [slice, nil]
+      [slice, heredocs]
     end
 
     # The body's line count, its terminator line not counted.

data/lib/samagotchi/config.rb

@@ -95,6 +95,11 @@ module Samagotchi
       Entry.new(key: "session.keep_empty",            yaml_path: %w[session keep_empty],            type: :bool,    default: false, expose: %i[env config]),
       # The most sessions one session may have delegated and still running (the delegate tool); a guard against a runaway model.
       Entry.new(key: "session.max_children",          yaml_path: %w[session max_children],          type: :integer, default: 4,     expose: %i[env config]),
+      # A delegate child's turn end reaches its parent (ChildReports): wake runs an idle parent's turn for it, queue waits
+      # for the parent's next turn, off is the old behaviour (only delegate_result asks).
+      Entry.new(key: "session.delegate_reports",      yaml_path: %w[session delegate_reports],      type: :enum,    default: "wake", expose: %i[env config], enum_values: %w[wake queue off]),
+      # Turns a parent runs for delegate reports in a row with no human input; past it reports wait for the next turn.
+      Entry.new(key: "session.max_wakes",             yaml_path: %w[session max_wakes],             type: :integer, default: 10,    expose: %i[env config]),
 
       # Images sent to a model (ImageStore): the long side they are downscaled
       # to, the most bytes one may take (bigger → re-encoded as jpeg), and how

data/lib/samagotchi/engine.rb

@@ -61,6 +61,7 @@ require_relative "thinking"
 require_relative "answer_display"
 require_relative "edit_preview"
 require_relative "question_desk"
+require_relative "child_reports"
 require_relative "relay_desk"
 require_relative "guardrail_wiring"
 require_relative "plugin_tasks"
@@ -1190,6 +1191,7 @@ module Samagotchi
     def record_last_turn(session, outcome, seconds, origin, event, limit: nil)
       client_id = origin.is_a?(Hash) ? origin[:client_id].to_s : ""
       source = if client_id.start_with?("#{Tools::Delegate::CLIENT_PREFIX}:") then "delegate"
+               elsif client_id.start_with?(ChildReports::CLIENT_PREFIX) then "delegate_report"
                elsif client_id == SessionManager::REMINDER_CLIENT_ID then "reminder"
                else "client"
                end

data/lib/samagotchi/host_registry.rb

@@ -5,6 +5,7 @@ require_relative "config"
 require_relative "log"
 require_relative "model_ref"
 require_relative "client"
+require_relative "model_list_store"
 require_relative "llm/openai_chat"
 
 module Samagotchi
@@ -287,6 +288,9 @@ module Samagotchi
             models = list_models_for(entry)
             data = { host: entry.host, port: entry.port, transport: entry.transport, models: models, error: nil }
             @mutex.synchronize { @host_lists[name] = { data: data, at: @clock.call } }
+            # On disk too: a process that spawns a worker without listing
+            # (`chi send --new --model`, delegate) checks an id against it.
+            ModelListStore.save(name, models.map(&:id))
           rescue StandardError => e
             Log.warn(:model, "list_failed", host: name, error: e.class.name, msg: e.message.to_s[0, 500])
             data = { host: entry.host, port: entry.port, transport: entry.transport, models: [], error: e.message }

data/lib/samagotchi/idle_recap.rb

@@ -54,6 +54,7 @@ module Samagotchi
       TOOL_OUTPUT_HEADER_RE = /\A\[([\w.:-]+)\]/
       # The text the web sends for a turn of images alone (images.js turnText).
       IMAGE_ONLY_RE = /\A\s*(?:\[image: [^\]\n]*\]\s*)+\z/
+      DELEGATE_REPORT_LINE = "(a delegate session's report, delivered by chi; not the user's words)"
 
       module_function
 
@@ -71,6 +72,9 @@ module Samagotchi
             # An image is a line naming it (refs only, never its bytes), unless
             # the text is only the web's placeholder naming it already.
             content = message["content"].to_s
+            # A delegate child's report (ChildReports) is chi's news, not
+            # what the user said.
+            content = "#{DELEGATE_REPORT_LINE}\n#{content}" if message["source"].to_s == Steer::DELEGATE_REPORT
             images = IMAGE_ONLY_RE.match?(content) ? [] : image_lines(message["images"])
             [content, *images].reject(&:empty?).join("\n")
           when "model", "assistant"

data/lib/samagotchi/kernel_loop.rb

@@ -97,6 +97,8 @@ module Samagotchi
 
     DEFAULT_MAX_TOOL_OUTPUT_CHARS = 10_000
     QWEN_INCOMPLETE_TOOL_CALL_RECOVERY_LIMIT = 2
+    # How much of a malformed generation's end the warning keeps.
+    MALFORMED_TAIL_CHARS = 400
     QWEN_INCOMPLETE_TOOL_CALL_RECOVERY_PROMPT = "Continue the previous assistant message by finishing the open <tool_call> XML block. Output only the remaining XML needed to complete the tool call."
 
     # @param tools [Tools::Registry, nil] the tools calls dispatch to (the
@@ -197,7 +199,8 @@ module Samagotchi
         emit(turn, type: :generation_cancelled, iteration: turn.iteration, reason: e.reason,
                    stopped_by: turn.cancel_controller&.stopped_by)
         return cancelled_result(turn.conversation, tool_activity: turn.tool_activity, reason: e.reason,
-                                                   partial_assistant_text: turn.buffer)
+                                                   partial_assistant_text: turn.buffer,
+                                                   streamed_thinking: turn.streamed_thinking)
       end
       finish(turn)
     rescue StandardError => e
@@ -239,9 +242,10 @@ module Samagotchi
     # context tracker and the retry budget, the tool activity, the visible
     # text streamed so far (salvaged on a cancel), the Qwen recovery state,
     # the prefill, and what the caller gave.
-    Turn = Struct.new(:conversation, :context, :empty_retry, :tool_activity, :buffer, :qwen_attempts, :qwen_partial,
-                      :prefill, :pending_tool_calls, :model_name, :pending_input, :on_stream_event,
-                      :cancel_controller, :cap, :emit, :iteration, :empty_steps, :ended_empty, keyword_init: true)
+    Turn = Struct.new(:conversation, :context, :empty_retry, :tool_activity, :buffer, :streamed_thinking, :qwen_attempts,
+                      :qwen_partial, :prefill, :pending_tool_calls, :model_name, :pending_input, :on_stream_event,
+                      :cancel_controller, :cap, :emit, :iteration, :empty_steps, :ended_empty, :malformed_retried,
+                      :uncached_next, keyword_init: true)
     # One request: the prompt and its images as sent, the images' token
     # estimate, and the window it was measured against.
     Request = Struct.new(:prompt, :images, :image_tokens, :window, :prefill, keyword_init: true)
@@ -249,16 +253,18 @@ module Samagotchi
     # generation's own server counts, the model the server named, the
     # thinking it streamed, and why it stopped (the transport's finish
     # reason, Client::Transport#finish_reason_from; nil when not named),
-    # and its prompt-cache counts (the largest seen: they come cumulative).
+    # and its prompt-cache counts (the largest seen: they come cumulative),
+    # and where its visible text starts in the turn's buffer.
     Generation = Struct.new(:response, :cut, :usage, :served_model, :streamed_thinking, :finish_reason, :cache,
-                            keyword_init: true)
+                            :buffer_mark, keyword_init: true)
     private_constant :Turn, :Request, :Generation
 
     def start_turn(messages, on_stream_event:, cancel_controller:, pending_input:, cap:)
       conversation = prepare_conversation(messages)
       Turn.new(
         conversation: conversation, context: ContextStatus.new(conversation: conversation),
-        empty_retry: EmptyAnswerRetry.new, empty_steps: [], tool_activity: [], buffer: +"", qwen_attempts: 0, qwen_partial: nil,
+        empty_retry: EmptyAnswerRetry.new, empty_steps: [], tool_activity: [], buffer: +"", streamed_thinking: +"",
+        qwen_attempts: 0, qwen_partial: nil,
         # Qwen with thinking off: an empty thought after the cue, so the model
         # answers at once. Kept in the turn's model messages, so each tool-loop
         # prompt starts with what the server already has cached.
@@ -276,6 +282,9 @@ module Samagotchi
       request = prepare_request(turn)
       generation = generate(turn, request)
       return after_cut(turn, generation) if generation.cut
+      if (reason = parser.malformed(generation.response))
+        return after_malformed(turn, generation, reason)
+      end
 
       turn.conversation << { role: "model", content: request.prefill + generation.response.to_s }
       # Profile-specific parse (incl. Qwen unterminated-block recovery); the
@@ -328,7 +337,13 @@ module Samagotchi
       # thinking_chars=N content_length=…).
       generation = Generation.new(usage: nil, served_model: nil, streamed_thinking: 0)
       fire_hook(:before_generation, { type: :before_generation, iteration: turn.iteration }) if @hooks
-      buffer_mark = turn.buffer.length
+      buffer_mark = generation.buffer_mark = turn.buffer.length
+      # A cancel salvages only this generation's thinking: the earlier
+      # steps' is on their own messages already.
+      turn.streamed_thinking = +""
+      # Only the retry of a malformed generation skips the prompt cache.
+      uncached = turn.uncached_next
+      turn.uncached_next = false
       generation.response = with_generation(turn.cancel_controller) do |generation_controller|
         request_generation(
           request.prompt,
@@ -336,12 +351,14 @@ module Samagotchi
           cancel_controller: turn.cancel_controller,
           model_name: turn.model_name,
           sampling: turn.empty_retry.request_sampling(@turn_settings.sampling),
+          cache_prompt: !uncached,
           on_chunk: ->(chunk) { stream_chunk(turn, generation, stream_splitter, chunk) },
           on_retry: lambda { |retry_event|
             # The retry streams from the start: its counts replace these.
             generation.usage = nil
             generation.cache = nil
             generation.streamed_thinking = 0
+            turn.streamed_thinking = +""
             generation.finish_reason = nil
             turn.emit.call({ type: :generation_retrying, iteration: turn.iteration }.merge(retry_event)) if turn.on_stream_event
           },
@@ -368,6 +385,7 @@ module Samagotchi
       generation.finish_reason = chunk[:finish_reason] if chunk[:finish_reason]
       split = stream_splitter.feed(chunk[:content])
       turn.buffer << split[:text]
+      turn.streamed_thinking << split[:thinking].to_s
       generation.streamed_thinking += split[:thinking].to_s.length
       return unless turn.on_stream_event
 
@@ -455,6 +473,31 @@ module Samagotchi
       cancelled_result(turn.conversation, tool_activity: turn.tool_activity, reason: :hook, partial_assistant_text: "")
     end
 
+    # A corrupt generation (ToolCallParser#malformed) is no answer and runs
+    # no tool: it is logged and dropped, with its streamed text, and the
+    # same prompt goes once more without the server's prompt cache (a
+    # poisoned cache made it, ggml-org/llama.cpp#27148), shown as the loop
+    # asking again. A second one fails the turn. Returns :next.
+    def after_malformed(turn, generation, reason)
+      response = generation.response.to_s
+      Log.warn(:model, "generation_malformed", iteration: turn.iteration, reason: reason, id_slot: @last_slot,
+                                               cache_n: generation.cache&.dig(:cached), finish_reason: generation.finish_reason,
+                                               retried: turn.malformed_retried ? true : false,
+                                               payload: response[-MALFORMED_TAIL_CHARS..] || response)
+      turn.buffer.slice!(generation.buffer_mark..)
+      if turn.malformed_retried
+        label = @client.respond_to?(:host_name) && @client.host_name ? @client.host_name : "llama.cpp"
+        raise LLM::MalformedGeneration.new("#{label}: #{reason}, again without the prompt cache; nothing was saved",
+                                           host: label)
+      end
+
+      turn.malformed_retried = true
+      turn.uncached_next = true
+      emit(turn, type: :empty_answer_retry, iteration: turn.iteration, attempt: 1, of: 1,
+                 finish_reason: generation.finish_reason, malformed: true)
+      :next
+    end
+
     # A generation with no tool calls: a Qwen call left open is asked to be
     # finished; an empty answer is asked again (EmptyAnswerRetry: not when
     # a length stop came with the context full); queued input keeps the
@@ -605,8 +648,11 @@ module Samagotchi
     end
 
     # +sampling+: this request's (EmptyAnswerRetry#request_sampling).
-    def complete_kwargs(cancel_controller:, model_name: nil, on_chunk: nil, on_retry: nil, images: [], sampling: nil)
+    # +cache_prompt+: false for a malformed generation's retry (only then sent).
+    def complete_kwargs(cancel_controller:, model_name: nil, on_chunk: nil, on_retry: nil, images: [], sampling: nil,
+                        cache_prompt: true)
       kwargs = {}
+      kwargs[:cache_prompt] = false unless cache_prompt
       # Only a request with images names them: a text-only call is unchanged.
       kwargs[:images] = images unless images.empty?
       kwargs[:on_chunk] = on_chunk if on_chunk
@@ -625,7 +671,7 @@ module Samagotchi
       ModelProfile.required_model_name(override)
     end
 
-    def cancelled_result(conversation, tool_activity:, reason:, partial_assistant_text: "")
+    def cancelled_result(conversation, tool_activity:, reason:, partial_assistant_text: "", streamed_thinking: "")
       partial = partial_assistant_text.to_s.strip
       conversation = duplicate_conversation(conversation)
       # Salvage the already-streamed visible reply (thought/tool_call lanes
@@ -633,7 +679,13 @@ module Samagotchi
       # cannot leak) so a follow-up steering message continues with the model's
       # half-finished work in context instead of losing it.
       unless partial.empty?
-        conversation << { role: "model", content: "#{partial}\n[interrupted]", interrupted: true }
+        message = { role: "model", content: "#{partial}\n[interrupted]", interrupted: true }
+        # The thinking this generation streamed goes with it (the chat loop's
+        # with_thinking key, which MessageParts reads and the prompt doesn't):
+        # without it, reloading the cut step shows the empty answer it isn't.
+        thinking = streamed_thinking.to_s
+        message[:thinking] = thinking unless thinking.strip.empty?
+        conversation << message
       end
       LLM::ModelResult.new(
         text: "",

data/lib/samagotchi/llm/chat_loop.rb

@@ -213,7 +213,7 @@ module Samagotchi
       # Array), plus a model turn's tool_calls and thinking (the host's
       # reasoning, never sent back), a result's tool_call_id, the image
       # refs of a user message or a tool result, a prompt's turn_id (Engine,
-      # never sent), and a plugin tool result's tool_params and tool_labels
+      # never sent) and a wake turn's report's turn_start (Steer, never sent), and a plugin tool result's tool_params and tool_labels
       # (the live row's params line and label, never sent back), an
       # edit/write result's tool_diffs (never sent), and an empty-answer
       # note's marker (TurnNote.empty, never sent).
@@ -225,6 +225,7 @@ module Samagotchi
           message[:tool_call_id] = entry[:tool_call_id] if entry[:tool_call_id]
           message[:images] = entry[:images] if entry[:images].is_a?(Array) && !entry[:images].empty?
           message[:turn_id] = entry[:turn_id] if entry[:turn_id]
+          message[:turn_start] = true if entry[:turn_start] == true
           message[:thinking] = entry[:thinking] if entry[:thinking].is_a?(String) && !entry[:thinking].empty?
           ToolResponse::SAVED_KEYS.each { |key| message[key] = entry[key] if entry[key] }
           message[TurnNote::RETRY_NUDGE] = true if TurnNote.retry_nudge?(entry)
@@ -338,8 +339,8 @@ module Samagotchi
             return canceled(iteration, @cancel_controller.reason) if @cancel_controller&.cancelled?
 
             inject_pending_input(iteration)
-            response, partial = generate(iteration)
-            return canceled(iteration, response, partial) if partial
+            response, partial, thought = generate(iteration)
+            return canceled(iteration, response, partial, thought) if partial
 
             if response.cut
               outcome = after_cut(iteration, response)
@@ -468,7 +469,7 @@ module Samagotchi
                                                messages: AnswerDisplay.strip_all(@conversation).map(&:dup).freeze })
           [response, nil]
         rescue RequestCancelled => e
-          [e.reason, streamed]
+          [e.reason, streamed, thought]
         end
 
         # The request runs under the generation's own controller (the turn
@@ -593,11 +594,17 @@ module Samagotchi
         end
 
         # The text streamed before the cancel stays, marked [interrupted],
-        # as the native loop's salvage does.
-        def canceled(iteration, reason, partial = "")
+        # as the native loop's salvage does; the reasoning this generation
+        # streamed rides along on the message (with_thinking's key).
+        def canceled(iteration, reason, partial = "", thinking = "")
           emit(type: :generation_cancelled, iteration: iteration, reason: reason, stopped_by: @cancel_controller&.stopped_by)
           visible = @loop.strip_model_thought(partial.to_s).strip
-          @conversation << { role: "model", content: "#{visible}\n[interrupted]", interrupted: true } unless visible.empty?
+          unless visible.empty?
+            message = { role: "model", content: "#{visible}\n[interrupted]", interrupted: true }
+            thought = thinking.to_s
+            message[:thinking] = thought unless thought.strip.empty?
+            @conversation << message
+          end
           conversation = @loop.plain(@conversation)
           conversation.last[:interrupted] = true unless visible.empty?
           ModelResult.new(text: "", conversation: conversation, canceled: true,

data/lib/samagotchi/llm/errors.rb

@@ -207,6 +207,15 @@ module Samagotchi
       def summary = "unexpected response from host #{host}: #{detail}"
     end
 
+    # A native generation that came out corrupt twice (KernelLoop: a tool
+    # call never closed, or a fresh thought header after the answer), the
+    # second time without the server's prompt cache. A poisoned llama.cpp
+    # prompt cache does this (ggml-org/llama.cpp#27148); the text is not
+    # an answer.
+    class MalformedGeneration < ProtocolError
+      def summary = "malformed generation from host #{host}: #{detail}"
+    end
+
     # A request that kept failing on network errors until the retry budget
     # ran out (or failed mid-stream, where a retry would repeat output).
     class RetryExhausted < ConnectionError

data/lib/samagotchi/log_subscriber.rb

@@ -29,7 +29,7 @@ module Samagotchi
       question_cancelled: %i[id reason],
       question_relay: %i[id reason],
       generation_cancelled: %i[iteration],
-      empty_answer_retry: %i[iteration attempt of finish_reason thinking_chars stopped_by]
+      empty_answer_retry: %i[iteration attempt of finish_reason thinking_chars stopped_by malformed]
     }.freeze
 
     # @param session_id [#call] the session the events are about (the

data/lib/samagotchi/model_list_store.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "json"
+require "fileutils"
+
+require_relative "atomic_file"
+require_relative "log"
+require_relative "paths"
+
+module Samagotchi
+  # The model ids each host last listed, saved in
+  # <state dir>/model_lists.json for the processes that spawn a worker but
+  # never list a host themselves: `chi send --new --model` and the
+  # `delegate` tool warn about an unknown model id up front from it
+  # (ModelProfile.model_warning) instead of only the worker's first turn
+  # failing. It is a cache of the hosts' own lists, so it never raises: no
+  # file, an unreadable one or bad JSON reads as no list at all. Only a
+  # successful listing writes (a host that is down keeps the ids we know),
+  # and a list older than TTL_SECONDS is no evidence about the host any
+  # more.
+  #
+  #   { "<host name>" => { "ids" => ["…"], "at" => <epoch seconds> } }
+  module ModelListStore
+    FILE = "model_lists.json"
+    # When a saved list is too old to say what a host serves: a model may
+    # have been added or removed since.
+    TTL_SECONDS = 7 * 24 * 60 * 60
+
+    # One host's saved list: the ids it listed and when (+at+, epoch
+    # seconds).
+    Saved = Data.define(:host, :ids, :at) do
+      def age(now: Time.now.to_i) = now.to_i - at.to_i
+
+      # Too old to check an id against (ModelProfile.model_warning): a model
+      # may have been added or removed since.
+      def stale?(now: Time.now.to_i) = age(now: now) > ModelListStore::TTL_SECONDS
+
+      # A host's own list spells its ids, and resolution matches them by
+      # case (the registry's model index is downcased): so does this.
+      def known?(id) = ids.any? { |known| known.casecmp?(id.to_s.strip) }
+    end
+
+    module_function
+
+    # @return [String] <state home>/samagotchi/model_lists.json
+    def path(env: ENV)
+      File.join(Paths.state_dir(env: env), FILE)
+    end
+
+    # Every saved list by host name, the lists as [Saved] (empty without a
+    # file, with bad JSON, or with nothing readable in it).
+    # @return [Hash{String => Saved}]
+    def read(env: ENV)
+      all(env: env).each_with_object({}) do |(name, entry), acc|
+        list = saved_from(name, entry)
+        acc[name] = list if list
+      end
+    end
+
+    # One host's saved list.
+    # @return [Saved, nil] nil without a file, with bad JSON, or with no
+    #   entry for the host
+    def find(host, env: ENV)
+      read(env: env)[host.to_s.strip.downcase]
+    end
+
+    # Save the ids +host+ just listed, keeping every other host's entry.
+    # Best effort: a store that can't be written never fails the listing
+    # that found the ids. An empty list is not saved (it is no evidence the
+    # host serves nothing: keep the ids we know).
+    # @return [Saved, nil] what was saved, nil when nothing was
+    def save(host, ids, at: Time.now.to_i, env: ENV)
+      name = host.to_s.strip.downcase
+      list = Array(ids).map { |id| id.to_s.strip }.reject(&:empty?).uniq
+      return nil if name.empty? || list.empty?
+
+      file = path(env: env)
+      FileUtils.mkdir_p(File.dirname(file))
+      # Under the lock, so two workers listing a host at once (or two
+      # threads of one registry) never drop each other's entries.
+      File.open("#{file}.lock", File::RDWR | File::CREAT, 0o600) do |lock|
+        lock.flock(File::LOCK_EX)
+        entries = all(env: env)
+        entries[name] = { "ids" => list, "at" => at.to_i }
+        AtomicFile.write(file, JSON.pretty_generate(entries) + "\n")
+      end
+      Saved.new(host: name, ids: list, at: at.to_i)
+    rescue StandardError => e
+      Log.warn(:model, "model_list_save_failed", host: host.to_s, error: e.class.name, msg: e.message.to_s[0, 200])
+      nil
+    end
+
+    # The whole file, host names downcased: {name => entry}.
+    # @return [Hash]
+    def all(env: ENV)
+      data = JSON.parse(File.read(path(env: env)))
+      return {} unless data.is_a?(Hash)
+
+      data.each_with_object({}) do |(name, entry), acc|
+        acc[name.to_s.strip.downcase] = entry if entry.is_a?(Hash)
+      end
+    rescue StandardError
+      {}
+    end
+
+    # One +entry+ of the file as a Saved, or nil when it holds no ids or no
+    # time.
+    def saved_from(name, entry)
+      ids = Array(entry["ids"]).map { |id| id.to_s.strip }.reject(&:empty?)
+      at = entry["at"].to_i
+      return nil if ids.empty? || at <= 0
+
+      Saved.new(host: name, ids: ids, at: at)
+    end
+    private_class_method :saved_from
+  end
+end

data/lib/samagotchi/model_profile.rb

@@ -179,6 +179,49 @@ module Samagotchi
       raise UnknownHost, "unknown host '#{host}' in model '#{ref}'#{hint}; the configured hosts are #{names.join(", ")}"
     end
 
+    # A warning when +model_name+ resolves to a model id a host's saved
+    # list doesn't have (ModelListStore: what a `chi models`, a /models or
+    # the web's GET /api/models last listed for that host), else nil.
+    # Called where a session is spawned without listing the hosts itself
+    # (`chi send --new --model`, the delegate tool), so a typo is
+    # named before the worker's first turn fails on it. Only a warning: some
+    # hosts serve ids they don't list (a one-model llama.cpp server takes any
+    # name, OpenRouter's :nitro variants), so the session starts anyway.
+    # Never asks a host.
+    #
+    # Only a ref that names a host is checked (its alias resolved first, as
+    # ModelRef.parse does), and only against that host's own list: a bare id
+    # goes to whichever host lists it (HostRegistry#host_for_model), so no
+    # single list can judge it. Nothing is checked either without a saved
+    # list for the host or with one older than ModelListStore::TTL_SECONDS
+    # (a week: the host may serve different models by now).
+    # @param hosts [Hash, nil] the hosts a prefix may name (a HostRegistry's
+    #   entries); config.yml's by default
+    # @param lists [#read] ModelListStore by default
+    # @return [String, nil]
+    def self.model_warning(model_name, env: ENV, hosts: nil, lists: nil)
+      require_relative "config"
+      require_relative "model_list_store"
+      hosts ||= Samagotchi::ConfigFile.hosts_config(env: env)
+      lists ||= Samagotchi::ModelListStore
+      parsed = Samagotchi::ConfigFile.model_ref(model_name, env: env, hosts: hosts)
+      host = parsed.host_name
+      return nil unless host
+
+      list = lists.read(env: env)[host.to_s.strip.downcase]
+      return nil if list.nil? || list.stale? || list.known?(parsed.id)
+
+      unknown_model_message(parsed.id, host, list.ids)
+    end
+
+    # The warning for an id the host doesn't list, with up to three close
+    # ids (Config.near_names) when there are any.
+    def self.unknown_model_message(id, host, ids)
+      near = Samagotchi::Config.near_names(id, ids).first(3)
+      hint = near.empty? ? "" : " (did you mean: #{near.join(", ")}?)"
+      "host '#{host}' doesn't list model '#{id}'#{hint}; started it anyway; `chi models` lists what the hosts serve"
+    end
+
     # The prefix of "box:x" when box is a host config.yml has with
     # enabled: false (left out of +hosts+), else nil.
     def self.disabled_host_prefix(ref, hosts, env)