samagotchi 0.56.0 → 0.58.0

data/lib/samagotchi/bundles/slow-commands/plugin.rb

@@ -0,0 +1,320 @@
+# frozen_string_literal: true
+
+# The slow-commands bundle (docs/plugins.md, The slow-commands bundle): an
+# `execute` that ran past its limit (or close to it) is remembered for the
+# project, and the next identical `execute` is denied with advice: start it
+# with task_create, then task_wait with a timeout that fits.
+#
+# A command is keyed by its project (the session's git checkout, else its
+# working directory) and its text: the ShellLex words and operators joined
+# by one space, the call's cwd: folded in as a leading `cd <dir> &&`
+# (relative to the project), and a trailing output filter dropped (a final
+# 2>&1, `| tail …`, `| head …`, `| grep …`: they don't change how long it
+# runs). Arguments stay: `bundle exec rspec` (the suite) is not
+# `bundle exec rspec spec/x_spec.rb`. Input that ends inside a quote, $(…)
+# or heredoc is never recorded, nor one with a $(…), backticks or a heredoc
+# cat/tee read as data: ShellLex makes those one placeholder, so different
+# commands would share a key.
+#
+# after_tool_call records: timed out, or ran at least warn_ratio of the
+# limit -> slow; ran under half of it with exit 0 -> the entry is dropped
+# (a fast failure says nothing about the suite's length), unless a trailing
+# filter was stripped: `rspec | tail` exits with tail's 0 when rspec failed,
+# and a `| head` can end it early. A stopped or
+# denied call records nothing. A key is denied once per turn: the model
+# running it again in the same turn is let through (maybe it got faster),
+# and that run records the new truth. before_turn resets it.
+#
+# Store: <data_dir>/commands.json, a list of {project, command, slow_at,
+# limit_s, elapsed_s, timed_out}, re-read on each lookup (another session's
+# record counts at once), written whole (AtomicFile), entries older than
+# ttl_days dropped on write.
+#
+# The advice names how long a finished task of the same command took: the
+# project's tmp/tasks/*/task.json read as files (never TaskRuntime's
+# list_records, which mkdirs, runs ps and writes), the exit_code file's
+# mtime minus started_at (finished_at is when chi noticed).
+#
+# Settings (config.yml, bundles: slow-commands:):
+#   mode: deny        deny | notify (warn the user, never deny)
+#   warn_ratio: 0.8   a run this share of the limit or longer is slow
+#   ttl_days: 14      entries older than this are forgotten
+#
+# /slow-commands lists this project's entries; /slow-commands forget <n|all>
+# drops them.
+require "json"
+require "pathname"
+require "time"
+require "samagotchi/atomic_file"
+require "samagotchi/guardrails/shell_lex"
+require "samagotchi/tools/execute"
+require "samagotchi/tools/task_runtime"
+
+class Plugin
+  SOURCE = "bundle slow-commands"
+  FILE = "commands.json"
+  FILTERS = %w[tail head grep].freeze
+  TIMED_OUT = /\A#{Regexp.escape(Samagotchi::Tools::Execute::TIMEOUT_PREFIX)} (\d+)s/
+  STOPPED = [Samagotchi::Tools::Execute::STOPPED_BY_USER, Samagotchi::Tools::Execute::NOT_RUN_ON_STOP].freeze
+  LEX = Samagotchi::Guardrails::ShellLex
+  SHORT_CHARS = 60
+  WAIT_DEFAULT = 600
+
+  def initialize(settings = {})
+    @mode = settings["mode"].to_s == "notify" ? :notify : :deny
+    ratio = Float(settings["warn_ratio"].to_s, exception: false)
+    @warn_ratio = ratio && ratio.positive? && ratio <= 1 ? ratio : 0.8
+    @ttl_days = positive(settings["ttl_days"]) || 14
+    reset
+  end
+
+  def register(chi)
+    chi.on(:before_turn) { |_event| reset }
+    chi.on(:before_tool_call) { |event, ctx| before(event, ctx) }
+    chi.on(:after_tool_call) { |event, ctx| after(event, ctx) }
+    chi.command "/slow-commands", "commands that ran past the execute limit here; forget <n|all> drops them",
+                anytime: true do |args, ctx|
+      command(args.to_s.strip, ctx)
+    end
+  end
+
+  # The command text as the store keys it, or nil when it can't be keyed
+  # (empty, unterminated). +cwd+: where it runs (nil: the session's).
+  def self.normalize(text, cwd:, project:, base:)
+    text = text.to_s.strip
+    return nil if text.empty? || LEX.unterminated?(text)
+
+    tokens = LEX.lex(text)
+    return nil if tokens.any? { |kind, value| kind == :word && value.include?("\0") }
+
+    tokens = strip_filters(tokens)
+    return nil if tokens.empty?
+
+    words = tokens.map { |kind, value| kind == :op ? value.tr("\n", ";") : quote(value) }
+    dir = folded_dir(cwd, project: project, base: base)
+    words = ["cd", quote(dir), "&&", *words] if dir
+    words.join(" ")
+  end
+
+  # Whether the key dropped a trailing output filter (2>&1, | tail …):
+  # the exit code is then the filter's, and the run may have been cut short.
+  def self.filtered?(text)
+    tokens = LEX.lex(text.to_s.strip)
+    tokens.pop while tokens.last && tokens.last[0] == :op && [";", "\n"].include?(tokens.last[1])
+    strip_filters(tokens).size != tokens.size
+  end
+
+  # Drops a trailing 2>&1 word and `| tail/head/grep …` filters, and a
+  # trailing ; or newline, until none is left.
+  def self.strip_filters(tokens)
+    tokens = tokens.dup
+    loop do
+      before = tokens.size
+      tokens.pop while tokens.last && tokens.last[0] == :op && [";", "\n"].include?(tokens.last[1])
+      tokens.pop if tokens.last && tokens.last[0] == :word && tokens.last[1] == "2>&1"
+      pipe = tokens.rindex { |kind, value| kind == :op && value == "|" }
+      if pipe && tokens[(pipe + 1)..].all? { |kind, _| kind == :word } && FILTERS.include?(tokens[pipe + 1]&.at(1))
+        tokens = tokens[0...pipe]
+      end
+      return tokens if tokens.size == before
+    end
+  end
+
+  def self.quote(word)
+    word.empty? || word.match?(/[\s'"]/) ? "'#{word.gsub("'", "'\\\\''")}'" : word
+  end
+
+  # The run dir relative to +project+, or nil for the project itself.
+  def self.folded_dir(cwd, project:, base:)
+    dir = File.expand_path(cwd.to_s.strip.empty? ? base : cwd.to_s.strip, base)
+    rel = Pathname.new(dir).relative_path_from(Pathname.new(File.expand_path(project))).to_s
+    rel == "." ? nil : rel
+  rescue ArgumentError
+    dir
+  end
+
+  private
+
+  def reset
+    @denied = {}
+  end
+
+  def before(event, ctx)
+    call = event[:call]
+    verdict = event[:guardrail]
+    return unless call.is_a?(Hash) && call[:name].to_s == Samagotchi::Tools::Execute::NAME && verdict
+    return if verdict.deny?
+
+    key = key_for(call, ctx)
+    return unless key
+    return if @denied[key]
+
+    entry = live_entries(ctx).find { |e| e["project"] == key[0] && e["command"] == key[1] }
+    return unless entry
+
+    @denied[key] = true
+    if @mode == :notify
+      ctx.notify("execute #{short(key[1])}: #{what(entry)} before", level: :warn)
+      return
+    end
+
+    verdict.deny!("slow command", source: SOURCE, advice: advice(entry, ctx, key))
+    ctx.notify("execute #{short(key[1])}: #{what(entry)} before, denied", level: :warn)
+  end
+
+  def after(event, ctx)
+    call = event[:call]
+    return unless event[:tool].to_s == Samagotchi::Tools::Execute::NAME && call.is_a?(Hash)
+
+    elapsed_ms = event[:elapsed_ms]
+    result = event[:result].to_s
+    return if elapsed_ms.nil? || STOPPED.any? { |text| result.start_with?(text) }
+
+    key = key_for(call, ctx)
+    return unless key
+
+    limit = Samagotchi::Tools::Execute.timeout_seconds
+    if (timed_out = result[TIMED_OUT, 1])
+      remember(ctx, key, limit_s: timed_out.to_i, elapsed_s: timed_out.to_i, timed_out: true)
+    elsif elapsed_ms >= @warn_ratio * limit * 1000
+      remember(ctx, key, limit_s: limit, elapsed_s: (elapsed_ms / 1000.0).round, timed_out: false)
+    elsif elapsed_ms < 0.5 * limit * 1000 && exit_zero?(result) && !self.class.filtered?(call[:content])
+      forget_key(ctx, key)
+    end
+  end
+
+  def key_for(call, ctx)
+    project = project_of(ctx)
+    command = self.class.normalize(call[:content], cwd: call[:cwd], project: project, base: ctx.cwd)
+    command ? [project, command] : nil
+  end
+
+  def project_of(ctx) = ctx.repo_root || ctx.cwd
+
+  def exit_zero?(result)
+    result.scan(/^exit: (-?\d+)/).last == ["0"]
+  end
+
+  # --- the store ---
+
+  def store_path(ctx) = File.join(ctx.data_dir, FILE)
+
+  def entries(ctx)
+    list = JSON.parse(File.read(store_path(ctx)))
+    list.is_a?(Array) ? list.select { |e| e.is_a?(Hash) && e["project"] && e["command"] } : []
+  rescue Errno::ENOENT, JSON::ParserError
+    []
+  end
+
+  def live_entries(ctx) = entries(ctx).select { |e| live?(e) }
+
+  def live?(entry)
+    Time.iso8601(entry["slow_at"].to_s) > Time.now - (@ttl_days * 86_400)
+  rescue ArgumentError
+    false
+  end
+
+  def save(ctx, list)
+    Samagotchi::AtomicFile.write(store_path(ctx), "#{JSON.pretty_generate(list.select { |e| live?(e) })}\n")
+  end
+
+  def remember(ctx, key, limit_s:, elapsed_s:, timed_out:)
+    list = entries(ctx).reject { |e| e["project"] == key[0] && e["command"] == key[1] }
+    list << { "project" => key[0], "command" => key[1], "slow_at" => Time.now.utc.iso8601,
+              "limit_s" => limit_s, "elapsed_s" => elapsed_s, "timed_out" => timed_out }
+    save(ctx, list)
+  end
+
+  def forget_key(ctx, key)
+    list = entries(ctx)
+    kept = list.reject { |e| e["project"] == key[0] && e["command"] == key[1] }
+    save(ctx, kept) if kept.size != list.size
+  end
+
+  # --- the deny's advice ---
+
+  def advice(entry, ctx, key)
+    took = task_duration(ctx, key)
+    wait = took ? [WAIT_DEFAULT, ((took * 1.5) / 60.0).ceil * 60].max : WAIT_DEFAULT
+    date = entry["slow_at"].to_s[0, 10]
+    seen = if entry["timed_out"]
+             "This command ran past the execute limit (#{entry["limit_s"]} s) here on #{date}."
+           else
+             "This command took #{duration(entry["elapsed_s"])} of the execute limit (#{entry["limit_s"]} s) here on #{date}."
+           end
+    text = "#{seen} Start it with task_create, then task_wait (timeout #{wait})."
+    took ? "#{text} A finished task of this command took #{duration(took)}." : text
+  end
+
+  # Seconds the newest finished (exit 0) task of this key took, or nil.
+  def task_duration(ctx, key)
+    roots = [ctx.cwd, project_of(ctx)].uniq
+    records = roots.flat_map do |root|
+      Dir.glob(File.join(root, Samagotchi::Tools::TaskRuntime::TASKS_DIR, "*", "task.json"))
+    end.uniq
+    found = records.filter_map { |path| finished_task(path, ctx, key) }
+    found.max_by(&:first)&.last
+  end
+
+  # [started_at, seconds] for a task record of +key+ that ended with exit 0.
+  def finished_task(path, ctx, key)
+    record = JSON.parse(File.read(path))
+    exit_code = File.join(File.dirname(path), Samagotchi::Tools::TaskRuntime::EXIT_CODE_FILENAME)
+    return nil unless File.file?(exit_code) && File.read(exit_code).strip == "0"
+
+    command = self.class.normalize(record["command"], cwd: record["cwd"], project: key[0], base: ctx.cwd)
+    return nil unless command == key[1]
+
+    started = Time.iso8601(record["started_at"].to_s)
+    seconds = (File.mtime(exit_code) - started).round
+    seconds.negative? ? nil : [started, seconds]
+  rescue StandardError
+    nil
+  end
+
+  # --- /slow-commands ---
+
+  def command(args, ctx)
+    project = project_of(ctx)
+    mine = live_entries(ctx).select { |e| e["project"] == project }.sort_by { |e| e["slow_at"].to_s }
+    case args
+    when ""
+      return "slow-commands: none recorded for #{project}" if mine.empty?
+
+      lines = mine.each_with_index.map do |e, i|
+        "#{i + 1}. #{e["command"]}: #{what(e)} (#{e["slow_at"].to_s[0, 10]})"
+      end
+      "slow-commands in #{project}:\n#{lines.join("\n")}\n/slow-commands forget <n|all> drops an entry"
+    when /\Aforget\s+(all|\d+)\z/
+      which = Regexp.last_match(1)
+      drop = which == "all" ? mine : [mine[which.to_i - 1]].compact
+      return "slow-commands: no entry #{which} (/slow-commands lists them)" if drop.empty?
+
+      save(ctx, entries(ctx).reject { |e| drop.any? { |d| d["project"] == e["project"] && d["command"] == e["command"] } })
+      "slow-commands: forgot #{drop.size == 1 ? drop.first["command"] : "#{drop.size} commands"}"
+    else
+      "usage: /slow-commands (list this project's slow commands), /slow-commands forget <n|all>"
+    end
+  end
+
+  # --- text ---
+
+  def what(entry)
+    entry["timed_out"] ? "ran past #{entry["limit_s"]} s" : "took #{duration(entry["elapsed_s"])} of #{entry["limit_s"]} s"
+  end
+
+  def duration(seconds)
+    seconds = seconds.to_i
+    seconds < 60 ? "#{seconds}s" : "#{seconds / 60}m#{format("%02d", seconds % 60)}s"
+  end
+
+  def short(command)
+    text = command.to_s
+    text.length > SHORT_CHARS ? "#{text[0, SHORT_CHARS - 1]}…" : text
+  end
+
+  def positive(value)
+    number = Integer(value.to_s, exception: false)
+    number&.positive? ? number : nil
+  end
+end

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.56.0
+version: 0.58.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:29c2f7df9f6c5acbc5ec17000a4490741e55e426af15ca0d81c8706edd9bd027
   self_map.md: sha256:dfc19266259a9af1e0d769b7e0f67996b740b0c9921fdf3dadad973f6e5c144a
   config_modification_protocol.md: sha256:d908921b5988244fb2a03fe04e693d0e7a1dfadf8cd77704e9232826db7eb2d7
-  memory_guide.md: sha256:15cd3b24eda853cc458371c6c75809a2d4b5352311d075aaa4384926b5221c27
+  memory_guide.md: sha256:d16919387c42d229498f470fc4078245a15faee872480ffbeffe2e27897624e4
   delegated.md: sha256:aedaa1e756a244904c5560fff0424e06fb468bbdcb0358bccefe321d67cd2614

data/lib/samagotchi/bundles/system/memory_guide.md

@@ -94,7 +94,7 @@ Bundles are versioned directories/zips/tar.gz/git URLs with a `manifest.yml` and
 - Integrity: each file's sha256 is recorded at install; a hook/plugin/rule file changed afterwards is not loaded (rules: every call denied) until reinstalled. It is an integrity check, not proof of authorship.
 - Installing = trusting its Ruby code (hooks, plugin), like a gem. Install only copies; the code runs at the next session start (`Engine.new`), so a running worker needs a restart to pick it up.
 - A bundle without `*.md` (btw, mcp, loop-guard) adds no line to the prompt's memory index.
-- Profiles are shipped bundles with only `includes:` (bundle names): `core` (loop-guard, check-in, guardrails; `chi bootstrap` installs it) and `dev` (known-names, mcp, btw, skills, source-links). `chi bundle install core` installs the ones not installed and records them; a bundle the user uninstalled stays out on a later install, upgrade or `chi update`, which install only bundles new to the profile. `chi bundle uninstall core` removes its recorded bundles, then core (`docs/memory.md` "Bundle profiles").
+- Profiles are shipped bundles with only `includes:` (bundle names): `core` (loop-guard, check-in, guardrails, slow-commands; `chi bootstrap` installs it) and `dev` (known-names, mcp, btw, skills, source-links, github-pr, coordinator). `chi bundle install core` installs the ones not installed and records them; a bundle the user uninstalled stays out on a later install, upgrade or `chi update`, which install only bundles new to the profile. `chi bundle uninstall core` removes its recorded bundles, then core (`docs/memory.md` "Bundle profiles").
 
 ### CLI — `chi bundle`
 

data/lib/samagotchi/context_command.rb

@@ -10,6 +10,7 @@ require_relative "session"
 require_relative "cli/command"
 require_relative "cli/exit"
 require_relative "cli/flags"
+require_relative "redacted_inspect"
 
 module Samagotchi
   # `chi context`: attach live external text to sessions (ContextSources).
@@ -18,6 +19,7 @@ module Samagotchi
   # reads the text with context_read.
   class ContextCommand
     include CLI::Command
+    include RedactedInspect
 
     USAGE = <<~TEXT
       Usage: chi context <add|push|ls|show|refresh|rm|mute|unmute> [options] [TARGET]

data/lib/samagotchi/desktop/macos.rb

@@ -11,6 +11,7 @@ require_relative "../version"
 require_relative "../self_report"
 require_relative "../installed_gem"
 require_relative "../config"
+require_relative "../redacted_inspect"
 
 module Samagotchi
   module Desktop
@@ -22,6 +23,8 @@ module Samagotchi
     # command goes through the runner, and the dirs are injectable, so specs
     # (and smokes with register: false) never touch the real system.
     class MacOS
+      include RedactedInspect
+
       class Error < StandardError
       end
 

data/lib/samagotchi/engine.rb

@@ -266,8 +266,8 @@ module Samagotchi
     def wire_kernel(kernel, muted_memories)
       # A given kernel (specs) gets the Engine's store, hooks and tools, as
       # the one built here does.
-      @kernel = kernel || KernelLoop.new(client: @client, profile: @given_profile, hooks: @hooks, reminder_store: @reminder_store,
-                                         tools: @tools)
+      @kernel = kernel || KernelLoop.new(client: @client, profile: @given_profile, model_name: @effective_model_name,
+                                         hooks: @hooks, reminder_store: @reminder_store, tools: @tools)
       @kernel.reminder_store = @reminder_store
       @kernel.hooks = @hooks
       @kernel.tools = @tools

data/lib/samagotchi/gem_update.rb

@@ -6,6 +6,7 @@ require "open3"
 require "rbconfig"
 require "rubygems/package"
 require_relative "version"
+require_relative "redacted_inspect"
 
 module Samagotchi
   # The gem part of `chi update`: the newest samagotchi on rubygems, and a
@@ -15,6 +16,8 @@ module Samagotchi
   # SAMAGOTCHI_UPDATE_GEM_FILE=<path to a .gem> (hidden, for smokes) makes that
   # file the newest version and installs it instead.
   class GemUpdate
+    include RedactedInspect
+
     class Error < StandardError
     end
 

data/lib/samagotchi/guardrails/shell_lex.rb

@@ -33,6 +33,14 @@ module Samagotchi
         Lexer.new(text).tokens
       end
 
+      # Whether +text+ ends inside a quote, a $(…) or a heredoc: its tokens
+      # are a best guess.
+      def self.unterminated?(text)
+        lexer = Lexer.new(text)
+        lexer.tokens
+        lexer.unterminated?
+      end
+
       # The token stream split at operators into word lists; ( and ) become
       # :open / :close markers.
       def self.simple_commands(tokens)

data/lib/samagotchi/guardrails/shell_paths.rb

@@ -2,6 +2,7 @@
 
 require_relative "shell_lex"
 require_relative "protected_paths"
+require_relative "../redacted_inspect"
 
 module Samagotchi
   module Guardrails
@@ -62,6 +63,8 @@ module Samagotchi
       # Follows the current dir and gives, per simple command, each word
       # with its path (nil when it can't be resolved).
       class Walk
+        include RedactedInspect
+
         def initialize(cwd, home, env)
           @dir = cwd
           @home = home

data/lib/samagotchi/host_registry.rb

@@ -384,6 +384,21 @@ module Samagotchi
       @mutex.synchronize { @cache }
     end
 
+    # Hosts, their addresses, key variable names and declared models, never
+    # the environment: it holds every host's API key (a failing spec prints
+    # the registry).
+    def inspect
+      hosts = @entries.values.map do |entry|
+        parts = [entry.openai_base_url]
+        parts << "key=#{entry.api_key_env}" if entry.api_key_env
+        parts << "models=#{entry.models.values.map(&:id).join(",")}" unless entry.models.empty?
+        "#{entry.name}(#{parts.join(" ")})"
+      end
+      "#<#{self.class.name} #{hosts.join(", ")}>"
+    end
+
+    def pretty_print(printer) = printer.text(inspect)
+
     private
 
     # A listing error as text without the host's name (a provider error's

data/lib/samagotchi/installed_versions.rb

@@ -2,6 +2,7 @@
 
 require_relative "installed_gem"
 require_relative "version"
+require_relative "redacted_inspect"
 
 module Samagotchi
   # The newest chi on this machine, which a long-lived process (chi web, an
@@ -18,6 +19,8 @@ module Samagotchi
   # SAMAGOTCHI_INSTALLED_VERSION=<v> (hidden, for smokes and e2e) answers
   # <v> instead.
   class InstalledVersions
+    include RedactedInspect
+
     ENV_KEY = "SAMAGOTCHI_INSTALLED_VERSION"
     GEMSPEC = /\Asamagotchi-(#{Gem::Version::VERSION_PATTERN})\.gemspec\z/
     VERSION_LINE = /^\s*VERSION\s*=\s*["']([^"']+)["']/

data/lib/samagotchi/model_profile.rb

@@ -142,13 +142,24 @@ module Samagotchi
       end
     end
 
+    # The model the config names as the default, or nil when it names none.
+    # It never raises.
+    # @return [String, nil]
+    def self.default_model_name
+      require_relative "config"
+      value = Samagotchi::Config.get("default.model")
+      return nil unless value
+
+      stripped = value.to_s.strip
+      stripped.empty? ? nil : stripped
+    end
+
     def self.required_model_name(model_name = nil)
       value = model_name.to_s.strip
       if value.empty?
-        require_relative "config"
-        value = Samagotchi::Config.get("default.model").to_s.strip
+        value = default_model_name
       end
-      raise MissingModel, missing_model_message if value.empty?
+      raise MissingModel, missing_model_message if value.to_s.strip.empty?
 
       value
     end

data/lib/samagotchi/plugin/context.rb

@@ -90,6 +90,11 @@ module Samagotchi
         @data_dir = nil
       end
 
+      # The bundle, never the environment it holds (every API key in it).
+      def inspect = "#<#{self.class.name} bundle=#{@bundle}>"
+
+      def pretty_print(printer) = printer.text(inspect)
+
       # @return [String, nil] the session's id (nil before the first one)
       def session_id = @host.session_id.call
 

data/lib/samagotchi/redacted_inspect.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  # A single redacted #inspect for the classes that hold the process
+  # environment (@env, every API key) or the web token (@token, or a :token
+  # key inside a Hash ivar, as Web::App's @lan): instead of dumping every
+  # instance variable (which would print the keys), it shows the rest with
+  # each value's own inspect and prints the others as [redacted]. A failing
+  # spec, a debugger or an error message that inspects one of them used to
+  # leak every key.
+  module RedactedInspect
+    # The instance variables never printed.
+    REDACTED = %i[@env @token].freeze
+    # The keys of a Hash ivar whose values are never printed; the rest of the
+    # Hash is, so Web::App's @lan still shows its :ip.
+    REDACTED_KEYS = %i[token].freeze
+
+    # Stands in for a redacted Hash value: inspects as [redacted], unquoted.
+    HIDDEN = Object.new.tap { |hidden| hidden.define_singleton_method(:inspect) { "[redacted]" } }.freeze
+
+    def inspect
+      body = instance_variables.map do |ivar|
+        if REDACTED.include?(ivar)
+          "#{ivar}=[redacted]"
+        else
+          "#{ivar}=#{redacted_value(instance_variable_get(ivar)).inspect}"
+        end
+      end.join(", ")
+      "#<#{self.class.name} #{body}>"
+    end
+
+    # pp otherwise ignores inspect.
+    def pretty_print(printer) = printer.text(inspect)
+
+    private
+
+    def redacted_value(value)
+      return value unless value.is_a?(Hash) && REDACTED_KEYS.any? { |key| value.key?(key) }
+
+      value.to_h { |key, item| [key, REDACTED_KEYS.include?(key) ? HIDDEN : item] }
+    end
+  end
+end

data/lib/samagotchi/session_commands.rb

@@ -188,12 +188,12 @@ module Samagotchi
     # @return [String, nil]
     def self.builtin_name(line) = builtin_registry.lookup(line)&.name
 
-    # @return [String] the model /model clear goes back to
+    # @return [String, nil] the model /model clear goes back to; nil when none
     attr_reader :default_model
 
-    # @param default_model [String] the config default, which /model clear
+    # @param default_model [String, nil] the config default, which /model clear
     #   restores and /model names (the Engine may have started elsewhere, e.g.
-    #   on a resumed session's model)
+    #   on a resumed session's model); nil when the config names no default
     # @param save [#call] saves a session (a worker passes its state dir)
     # @param registry [Commands::Registry] the commands #run looks lines up in
     def initialize(engine:, turn_flow:, default_model:, save: ->(session) { session.save },
@@ -484,7 +484,7 @@ module Samagotchi
     def model_command(input)
       suffix = input.delete_prefix(MODEL_COMMAND).strip
       if suffix.empty?
-        return ["runtime model: #{model_name}#{model_note}#{served_note}#{sampling_note}#{thinking_note}#{reasoning_history_note}#{notes_note}", false] if model_name == @engine.model_ref_for(@default_model)
+        return ["runtime model: #{model_name}#{model_note}#{served_note}#{sampling_note}#{thinking_note}#{reasoning_history_note}#{notes_note}", false] if @default_model.nil? || model_name == @engine.model_ref_for(@default_model)
 
         return ["runtime model: #{model_name}#{model_note("default: #{@default_model}")}#{served_note}#{sampling_note}#{thinking_note}#{reasoning_history_note}#{notes_note}", false]
       end
@@ -554,6 +554,7 @@ module Samagotchi
 
         if ConfigFile::RESERVED_MODEL_ALIASES.include?(arg.downcase)
           return ["--default cannot be combined with clear/default/none/off", false] if persist_default
+          raise ModelProfile::MissingModel, "no default model is configured (set default.model in config.yml, or /model <name> --default)" if @default_model.nil?
 
           switch_model(@default_model)
           return ["runtime model reset to #{model_name}#{model_note}#{thinking_note}#{reasoning_history_note}#{notes_note}", true]

data/lib/samagotchi/terminal_ui/attached_loop.rb

@@ -85,7 +85,8 @@ module Samagotchi
       # @param first_prompt [String, nil] sent once joined (`chi -p`)
       # @param first_command [String, Array<String>, nil] run before the
       #   first prompt, in order (`--model` on a resumed session: "/model X";
-      #   --llm-context: "/llm-context strategy …"); if one doesn't go
+      #   --llm-context: "/llm-context strategy …"; --thinking: "/thinking X
+      #   --yes"); if one doesn't go
       #   through, the launch stops
       # @param no_interrupt [Boolean] post every turn with no_interrupt
       # @param default_input [Boolean] type SAMAGOTCHI_DEFAULT_INPUT into
@@ -614,8 +615,7 @@ module Samagotchi
       end
 
       def first_command_queued
-        flag = @first_command_line.to_s.start_with?("/model") ? "--model" : "--llm-context"
-        "(#{flag} queued: applies after the running turn)"
+        "(#{first_command_flag} queued: applies after the running turn)"
       end
 
       def command_ran(event)
@@ -1113,7 +1113,7 @@ module Samagotchi
         nil
       end
 
-      # --model (or --llm-context) on a resumed session: run it in its
+      # --model (or --llm-context, --thinking) on a resumed session: run it in its
       # worker before the first prompt goes; its :command_ran decides
       # (#first_command_ran), and sends the next one.
       # @return [Symbol, nil] :failed when the worker didn't take it
@@ -1154,7 +1154,14 @@ module Samagotchi
       end
 
       def first_command_failed
-        @first_command_line.to_s.start_with?("/model") ? "could not switch to the --model" : "could not set the --llm-context"
+        flag = first_command_flag
+        flag == "--model" ? "could not switch to the --model" : "could not set the #{flag}"
+      end
+
+      # The launch flag the first command came from: "/model X" is --model,
+      # "/llm-context …" --llm-context, "/thinking X --yes" --thinking.
+      def first_command_flag
+        "--#{@first_command_line.to_s[%r{\A/([\w-]+)}, 1]}"
       end
 
       # After the join, so it lands below what the session already had. Our
@@ -1449,9 +1456,7 @@ module Samagotchi
 
       # The config's default model, as the worker's /model names it.
       def default_model_name
-        @default_model_name ||= ModelProfile.required_model_name(nil)
-      rescue StandardError
-        nil
+        @default_model_name ||= ModelProfile.default_model_name
       end
 
       def reminder_origin?(origin) = origin[:client_id].to_s.start_with?(ClientId::SYSTEM_PREFIX)