samagotchi 0.57.0 → 0.59.0

data/lib/samagotchi/bundles/slow-commands/plugin.rb

@@ -11,13 +11,22 @@
 # (relative to the project), and a trailing output filter dropped (a final
 # 2>&1, `| tail …`, `| head …`, `| grep …`: they don't change how long it
 # runs). Arguments stay: `bundle exec rspec` (the suite) is not
-# `bundle exec rspec spec/x_spec.rb`. Input that ends inside a quote, $(…)
+# `bundle exec rspec spec/x_spec.rb`. Wrappers a model adds by habit are
+# dropped at the start of each simple command (after &&, ||, ;, a newline,
+# so after a leading `cd X &&` too): `time [-p]` and `timeout`/`gtimeout`
+# with its options and duration. `X=…` assignments stay, sorted (they can
+# pick the target or the mode: SPEC=…, RAILS_ENV=…, CI=… (jest/vitest
+# watch without it)), except NO_COLOR, FORCE_COLOR and TERM, which never
+# change what runs; a plain
+# `env X=… cmd` is `X=… cmd`, an `env` with -C/-i/-u (or any other option)
+# stays as typed. The entry's `shown` is the last run as typed. Input that ends inside a quote, $(…)
 # or heredoc is never recorded, nor one with a $(…), backticks or a heredoc
 # cat/tee read as data: ShellLex makes those one placeholder, so different
 # commands would share a key.
 #
-# after_tool_call records: timed out, or ran at least warn_ratio of the
-# limit -> slow; ran under half of it with exit 0 -> the entry is dropped
+# after_tool_call records: timed out (killed at the limit), handed over as
+# a task at the limit (Execute::HANDED_OVER), or ran at least warn_ratio of
+# the limit -> slow; ran under half of it with exit 0 -> the entry is dropped
 # (a fast failure says nothing about the suite's length), unless a trailing
 # filter was stripped: `rspec | tail` exits with tail's 0 when rspec failed,
 # and a `| head` can end it early. A stopped or
@@ -25,15 +34,23 @@
 # running it again in the same turn is let through (maybe it got faster),
 # and that run records the new truth. before_turn resets it.
 #
-# Store: <data_dir>/commands.json, a list of {project, command, slow_at,
-# limit_s, elapsed_s, timed_out}, re-read on each lookup (another session's
+# Store: <data_dir>/commands.json, a list of {project, command (the key),
+# shown, slow_at, limit_s, elapsed_s, timed_out}, re-read on each lookup (another session's
 # record counts at once), written whole (AtomicFile), entries older than
 # ttl_days dropped on write.
 #
 # The advice names how long a finished task of the same command took: the
 # project's tmp/tasks/*/task.json read as files (never TaskRuntime's
 # list_records, which mkdirs, runs ps and writes), the exit_code file's
-# mtime minus started_at (finished_at is when chi noticed).
+# mtime minus started_at (finished_at is when chi noticed). The exit_code
+# file is the record's exit_code_path (a handed-over execute keeps it in
+# the state dir), else the one next to task.json.
+#
+# A `timeout N` over the execute limit is denied up front (no history
+# needed) when execute.on_timeout is kill: execute stops it first. Under
+# task (the default) it runs on as a task until timeout fires: nothing to
+# say. Exit codes mean what they always do here: 124/137 (timeout's) are
+# no sign of a slow command by themselves.
 #
 # Settings (config.yml, bundles: slow-commands:):
 #   mode: deny        deny | notify (warn the user, never deny)
@@ -46,6 +63,7 @@ require "json"
 require "pathname"
 require "time"
 require "samagotchi/atomic_file"
+require "samagotchi/config"
 require "samagotchi/guardrails/shell_lex"
 require "samagotchi/tools/execute"
 require "samagotchi/tools/task_runtime"
@@ -55,10 +73,23 @@ class Plugin
   FILE = "commands.json"
   FILTERS = %w[tail head grep].freeze
   TIMED_OUT = /\A#{Regexp.escape(Samagotchi::Tools::Execute::TIMEOUT_PREFIX)} (\d+)s/
+  # Still running at the limit, handed over as a task (chi >= 0.59.0).
+  HANDED_OVER = /\A#{Regexp.escape(Samagotchi::Tools::Execute::HANDED_OVER)} (\d+)s limit/
   STOPPED = [Samagotchi::Tools::Execute::STOPPED_BY_USER, Samagotchi::Tools::Execute::NOT_RUN_ON_STOP].freeze
   LEX = Samagotchi::Guardrails::ShellLex
   SHORT_CHARS = 60
   WAIT_DEFAULT = 600
+  # Where a simple command starts: a wrapper there is dropped from the key.
+  STARTS = ["&&", "||", ";", "\n"].freeze
+  ASSIGNMENT = /\A[A-Za-z_][A-Za-z0-9_]*=/
+  # Assignments that never change what runs: not part of the key.
+  NEUTRAL_VARS = %w[NO_COLOR FORCE_COLOR TERM].freeze
+  TIMEOUTS = %w[timeout gtimeout].freeze
+  # timeout's options: those that take a value, and the flags.
+  TIMEOUT_VALUE_OPTIONS = %w[-s -k --signal --kill-after].freeze
+  TIMEOUT_FLAGS = %w[--foreground --preserve-status -v --verbose].freeze
+  DURATION = /\A(\d+(?:\.\d+)?|\.\d+)([smhd]?)\z/
+  UNIT_SECONDS = { "" => 1, "s" => 1, "m" => 60, "h" => 3600, "d" => 86_400 }.freeze
 
   def initialize(settings = {})
     @mode = settings["mode"].to_s == "notify" ? :notify : :deny
@@ -87,6 +118,7 @@ class Plugin
     tokens = LEX.lex(text)
     return nil if tokens.any? { |kind, value| kind == :word && value.include?("\0") }
 
+    tokens = unwrap(tokens).first
     tokens = strip_filters(tokens)
     return nil if tokens.empty?
 
@@ -96,6 +128,95 @@ class Plugin
     words.join(" ")
   end
 
+  # The tokens without the wrappers at the start of each simple command
+  # (time, timeout), assignments sorted and the neutral ones dropped, and
+  # the seconds of every timeout dropped. A simple command left with no
+  # words (`NO_COLOR=1 && rspec`) goes with the operator after it, and a
+  # last one with the operator before it.
+  # @return [Array(Array, Array<Float>)]
+  def self.unwrap(tokens)
+    durations = []
+    out = []
+    segment = []
+    flush = lambda do
+      words, seconds = unwrap_command(segment)
+      durations.concat(seconds)
+      out.concat(words)
+      segment = []
+      !words.empty?
+    end
+    tokens.each do |token|
+      if token[0] == :op && STARTS.include?(token[1])
+        out << token if flush.call
+      else
+        segment << token
+      end
+    end
+    out.pop if !flush.call && out.last&.first == :op && STARTS.include?(out.last[1])
+    [out, durations]
+  end
+
+  # One simple command's tokens (it may hold a | or & further on: only its
+  # start is looked at).
+  def self.unwrap_command(tokens)
+    rest = tokens.dup
+    assignments = []
+    durations = []
+    loop do
+      assignments << rest.shift[1] while word?(rest.first) && rest.first[1].match?(ASSIGNMENT)
+      head = word?(rest.first) ? rest.first[1] : nil
+      # time -p only: another option (GNU time -v) is a different program.
+      if head == "time" && !(word?(rest[1]) && rest[1][1].start_with?("-") && rest[1][1] != "-p")
+        rest.shift
+        rest.shift if word?(rest.first) && rest.first[1] == "-p"
+      elsif head == "env" && word?(rest[1]) && !rest[1][1].start_with?("-")
+        rest.shift
+      elsif TIMEOUTS.include?(head) && (skipped = timeout_length(rest))
+        count, seconds = skipped
+        rest.shift(count)
+        durations << seconds
+      else
+        break
+      end
+    end
+    kept = assignments.reject { |a| NEUTRAL_VARS.include?(a.split("=", 2).first) }.sort
+    [kept.map { |a| [:word, a, ""] } + rest, durations]
+  end
+
+  # [words to drop, seconds] for a `timeout [opts] DUR` at the start of
+  # +tokens+, or nil when it can't be read (then it stays in the key).
+  def self.timeout_length(tokens)
+    i = 1
+    while word?(tokens[i]) && tokens[i][1].start_with?("-")
+      option = tokens[i][1]
+      if TIMEOUT_FLAGS.include?(option) || option.start_with?("--signal=", "--kill-after=")
+        i += 1
+      elsif TIMEOUT_VALUE_OPTIONS.include?(option)
+        i += 2
+      else
+        return nil
+      end
+    end
+    seconds = word?(tokens[i]) ? duration_seconds(tokens[i][1]) : nil
+    seconds && word?(tokens[i + 1]) ? [i + 1, seconds] : nil
+  end
+
+  def self.duration_seconds(text)
+    match = DURATION.match(text)
+    match ? Float(match[1]) * UNIT_SECONDS.fetch(match[2]) : nil
+  end
+
+  def self.word?(token) = token && token[0] == :word
+
+  # The longest `timeout N` (seconds) at the start of a simple command in
+  # +text+, or nil for none (or text that can't be keyed).
+  def self.timeout_seconds(text)
+    text = text.to_s.strip
+    return nil if text.empty? || LEX.unterminated?(text)
+
+    unwrap(LEX.lex(text)).last.max
+  end
+
   # Whether the key dropped a trailing output filter (2>&1, | tail …):
   # the exit code is then the filter's, and the run may have been cut short.
   def self.filtered?(text)
@@ -148,18 +269,44 @@ class Plugin
     key = key_for(call, ctx)
     return unless key
     return if @denied[key]
+    return if over_limit_timeout(call, verdict, ctx, key)
 
     entry = live_entries(ctx).find { |e| e["project"] == key[0] && e["command"] == key[1] }
     return unless entry
 
     @denied[key] = true
     if @mode == :notify
-      ctx.notify("execute #{short(key[1])}: #{what(entry)} before", level: :warn)
+      ctx.notify("execute #{short(call[:content])}: #{what(entry)} before", level: :warn)
       return
     end
 
     verdict.deny!("slow command", source: SOURCE, advice: advice(entry, ctx, key))
-    ctx.notify("execute #{short(key[1])}: #{what(entry)} before, denied", level: :warn)
+    ctx.notify("execute #{short(call[:content])}: #{what(entry)} before, denied", level: :warn)
+  end
+
+  # A `timeout N` over the limit while execute kills at it (on_timeout:
+  # kill): N never takes effect. Denied once a turn, like a slow entry.
+  # @return [Boolean] whether it was handled
+  def over_limit_timeout(call, verdict, ctx, key)
+    return false unless Samagotchi::Config.get("execute.on_timeout").to_s == "kill"
+
+    seconds = self.class.timeout_seconds(call[:content])
+    limit = Samagotchi::Tools::Execute.timeout_seconds
+    return false unless seconds && seconds > limit
+
+    @denied[key] = true
+    wait = [WAIT_DEFAULT, seconds.ceil].max
+    line = "execute #{short(call[:content])}: timeout #{duration(seconds.ceil)} is past the #{limit} s limit"
+    if @mode == :notify
+      ctx.notify(line, level: :warn)
+    else
+      verdict.deny!("timeout past the execute limit", source: SOURCE,
+                                                      advice: "execute stops a command at #{limit} s, so its timeout " \
+                                                              "(#{duration(seconds.ceil)}) never takes effect. Start it " \
+                                                              "with task_create, then task_wait (timeout #{wait}).")
+      ctx.notify("#{line}, denied", level: :warn)
+    end
+    true
   end
 
   def after(event, ctx)
@@ -174,10 +321,11 @@ class Plugin
     return unless key
 
     limit = Samagotchi::Tools::Execute.timeout_seconds
-    if (timed_out = result[TIMED_OUT, 1])
-      remember(ctx, key, limit_s: timed_out.to_i, elapsed_s: timed_out.to_i, timed_out: true)
+    shown = call[:content].to_s.strip
+    if (timed_out = result[TIMED_OUT, 1] || result[HANDED_OVER, 1])
+      remember(ctx, key, shown, limit_s: timed_out.to_i, elapsed_s: timed_out.to_i, timed_out: true)
     elsif elapsed_ms >= @warn_ratio * limit * 1000
-      remember(ctx, key, limit_s: limit, elapsed_s: (elapsed_ms / 1000.0).round, timed_out: false)
+      remember(ctx, key, shown, limit_s: limit, elapsed_s: (elapsed_ms / 1000.0).round, timed_out: false)
     elsif elapsed_ms < 0.5 * limit * 1000 && exit_zero?(result) && !self.class.filtered?(call[:content])
       forget_key(ctx, key)
     end
@@ -218,9 +366,10 @@ class Plugin
     Samagotchi::AtomicFile.write(store_path(ctx), "#{JSON.pretty_generate(list.select { |e| live?(e) })}\n")
   end
 
-  def remember(ctx, key, limit_s:, elapsed_s:, timed_out:)
+  # +shown+: the command as this run typed it (the list shows it).
+  def remember(ctx, key, shown, limit_s:, elapsed_s:, timed_out:)
     list = entries(ctx).reject { |e| e["project"] == key[0] && e["command"] == key[1] }
-    list << { "project" => key[0], "command" => key[1], "slow_at" => Time.now.utc.iso8601,
+    list << { "project" => key[0], "command" => key[1], "shown" => shown, "slow_at" => Time.now.utc.iso8601,
               "limit_s" => limit_s, "elapsed_s" => elapsed_s, "timed_out" => timed_out }
     save(ctx, list)
   end
@@ -259,7 +408,8 @@ class Plugin
   # [started_at, seconds] for a task record of +key+ that ended with exit 0.
   def finished_task(path, ctx, key)
     record = JSON.parse(File.read(path))
-    exit_code = File.join(File.dirname(path), Samagotchi::Tools::TaskRuntime::EXIT_CODE_FILENAME)
+    exit_code = record["exit_code_path"].to_s
+    exit_code = File.join(File.dirname(path), Samagotchi::Tools::TaskRuntime::EXIT_CODE_FILENAME) unless File.absolute_path?(exit_code)
     return nil unless File.file?(exit_code) && File.read(exit_code).strip == "0"
 
     command = self.class.normalize(record["command"], cwd: record["cwd"], project: key[0], base: ctx.cwd)
@@ -282,7 +432,7 @@ class Plugin
       return "slow-commands: none recorded for #{project}" if mine.empty?
 
       lines = mine.each_with_index.map do |e, i|
-        "#{i + 1}. #{e["command"]}: #{what(e)} (#{e["slow_at"].to_s[0, 10]})"
+        "#{i + 1}. #{shown(e)}: #{what(e)} (#{e["slow_at"].to_s[0, 10]})"
       end
       "slow-commands in #{project}:\n#{lines.join("\n")}\n/slow-commands forget <n|all> drops an entry"
     when /\Aforget\s+(all|\d+)\z/
@@ -291,7 +441,7 @@ class Plugin
       return "slow-commands: no entry #{which} (/slow-commands lists them)" if drop.empty?
 
       save(ctx, entries(ctx).reject { |e| drop.any? { |d| d["project"] == e["project"] && d["command"] == e["command"] } })
-      "slow-commands: forgot #{drop.size == 1 ? drop.first["command"] : "#{drop.size} commands"}"
+      "slow-commands: forgot #{drop.size == 1 ? shown(drop.first) : "#{drop.size} commands"}"
     else
       "usage: /slow-commands (list this project's slow commands), /slow-commands forget <n|all>"
     end
@@ -299,6 +449,9 @@ class Plugin
 
   # --- text ---
 
+  # The command as last typed; an entry from 0.1.0 has only its key.
+  def shown(entry) = entry["shown"].to_s.empty? ? entry["command"] : entry["shown"]
+
   def what(entry)
     entry["timed_out"] ? "ran past #{entry["limit_s"]} s" : "took #{duration(entry["elapsed_s"])} of #{entry["limit_s"]} s"
   end

data/lib/samagotchi/bundles/system/config_modification_protocol.md

@@ -121,7 +121,7 @@ A guardrail rule's `tool:` may be a glob (`tool: "mcp_*"`, verdict `ask`) to cov
 1. **Read** the current file via `read` tool (or `ConfigFile.global_path`). If `File.file?` false, start from `{}`.
 2. `YAML.safe_load` (permitted_classes: [], aliases: false). If data nil or not Hash, treat as `{}` or raise with path.
 3. Mutate the intended **nested** key in the raw hash. Preserve all other keys byte-for-byte where possible. Example for default model: `raw_data["default"] ||= {}; raw_data["default"]["model"] = "new-model"`.
-4. **Validate** (see below) before writing. Also run `Samagotchi::Config.validate_yaml_sections` — it returns one `config: unknown key '…' (did you mean '…'?)` per key chi doesn't read (every config-exposed `Config::ENTRIES` key is known as written, including the section-less `max_tool_output_chars` and `skip_agent_md`; names under `hosts:`/`models:`/`model_aliases:`/`hooks:`/`bundles:`/`memories:` are free-form, host and model entries are checked against `Config::MAP_ENTRY_KEYS`). An empty list means no warning at start.
+4. **Validate** (see below) before writing. Also run `Samagotchi::Config.validate_yaml_sections` — it returns one `config: unknown key '…' (did you mean '…'?)` per key chi doesn't read (every config-exposed `Config::ENTRIES` key is known as written, including the section-less `max_tool_output_chars` and `skip_agents_md`; names under `hosts:`/`models:`/`model_aliases:`/`hooks:`/`bundles:`/`memories:` are free-form, host and model entries are checked against `Config::MAP_ENTRY_KEYS`). An empty list means no warning at start.
 5. **Write**: change only the lines you mean to, with the edit tool, so the user's comments and layout stay; `YAML.dump` of the whole hash drops every comment, so rewrite the file only when it has none worth keeping. From Ruby, write atomically with `Samagotchi::AtomicFile.write(path, text)` (a unique temp file renamed over it), never through a fixed `"#{path}.tmp"` that another chi may be writing at the same time.
 6. Nothing else to update: config.yml values are never copied into `ENV`, and every `Config.get` reads the file again when it changed, so the next read (and every worker started after the write) sees the new value with origin `:file`. What a running worker set up at its start (`hosts:`, bundle settings) waits for its restart; guardrail rules and `model_aliases:` are read again live. CLI overrides (`--model`, `--recap-model`, …) win over the file until the process exits; a worker gets its spawner's CLI settings through its env (`Config.cli_env`).
 

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.57.0
+version: 0.59.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:29c2f7df9f6c5acbc5ec17000a4490741e55e426af15ca0d81c8706edd9bd027
   self_map.md: sha256:dfc19266259a9af1e0d769b7e0f67996b740b0c9921fdf3dadad973f6e5c144a
-  config_modification_protocol.md: sha256:d908921b5988244fb2a03fe04e693d0e7a1dfadf8cd77704e9232826db7eb2d7
+  config_modification_protocol.md: sha256:44a35f59baf44202972c9250989daa50eb978ab2a1967159e622c74ddd9c736c
   memory_guide.md: sha256:d16919387c42d229498f470fc4078245a15faee872480ffbeffe2e27897624e4
   delegated.md: sha256:aedaa1e756a244904c5560fff0424e06fb468bbdcb0358bccefe321d67cd2614

data/lib/samagotchi/config.rb

@@ -20,6 +20,8 @@ module Samagotchi
   # One models: entry, and one field found in them; they need ConfigFile's readers.
   autoload :ModelSettings, File.expand_path("model_settings", __dir__)
   autoload :ModelSetting, File.expand_path("model_settings", __dir__)
+  # The per-model/host seconds a cut waits (like Thinking for the level).
+  autoload :SteerCutAfter, File.expand_path("steer_cut_after", __dir__)
 
   # Unified configuration registry implementing the implicit convention:
   #   ENV    SAMAGOTCHI_ATTR            (UPPER + prefix + _ = nesting)
@@ -216,7 +218,8 @@ module Samagotchi
       Entry.new(key: "retry.empty_answer",       yaml_path: %w[retry empty_answer],       type: :integer, default: 1,               expose: %i[env config]),
       # Seconds a generation must have streamed only thinking before a message
       # for the running turn (the user's, chi send's, a parent agent's) cuts
-      # it (Engine#cut_for_steer); 0 = never. No CLI flag: workers get no CLI args.
+      # it (Engine#cut_for_steer); 0 = never. hosts.<name>.steer_cut_after and
+      # models.<key>.steer_cut_after win. No CLI flag: workers get no CLI args.
       Entry.new(key: "steer.cut_after",          yaml_path: %w[steer cut_after],          type: :integer, default: 20,              expose: %i[env config]),
       # A turn's step limit: model ↔ tool rounds before it stops and offers to continue (IterationLimit); integer ≥ 1.
       # --no-interrupt turns get max(1000, this). No CLI flag: --no-interrupt is the flag.
@@ -242,8 +245,11 @@ module Samagotchi
       Entry.new(key: "execute.truncate_at_bytes",       yaml_path: %w[execute truncate_at_bytes],       type: :integer, default: 65_536, expose: %i[env config cli]),
       Entry.new(key: "execute.preview_bytes",           yaml_path: %w[execute preview_bytes],           type: :integer, default: 12_288, expose: %i[env config cli]),
       Entry.new(key: "execute.telemetry_threshold_pct", yaml_path: %w[execute telemetry_threshold_pct], type: :integer, default: 80,     expose: %i[env config cli]),
-      # Seconds one execute command may run before it is stopped (Tools::Execute::TIMEOUT_SEC).
+      # Seconds one execute command may run before execute.on_timeout applies (Tools::Execute::TIMEOUT_SEC).
       Entry.new(key: "execute.timeout_sec",             yaml_path: %w[execute timeout_sec],             type: :integer, default: 120,    expose: %i[env config cli]),
+      # What happens to a command still running at that limit (Tools::Execute::ON_TIMEOUT): task hands it over as a
+      # background task (task_wait waits for it), kill stops it.
+      Entry.new(key: "execute.on_timeout",              yaml_path: %w[execute on_timeout],              type: :enum,    default: "task", expose: %i[env config cli], enum_values: %w[task kill]),
       # Whether execute declares its optional description parameter (a few model-written words, a tool row's title).
       Entry.new(key: "execute.description",             yaml_path: %w[execute description],             type: :bool,    default: true,   expose: %i[env config]),
 
@@ -263,7 +269,7 @@ module Samagotchi
       # env+config only
       Entry.new(key: "default.input",            yaml_path: %w[default input],            type: :string, default: nil,              expose: %i[env config]),
       Entry.new(key: "history.file",             yaml_path: %w[history file],             type: :string, default: nil,              expose: %i[env config]),
-      Entry.new(key: "skip_agent_md",            yaml_path: %w[skip_agent_md],            type: :bool,   default: false,            expose: %i[env config])
+      Entry.new(key: "skip_agents_md",           yaml_path: %w[skip_agents_md],           type: :bool,   default: false,            expose: %i[env config])
     ].freeze
 
     # Top-level maps read by their own code, whose entry names and contents
@@ -274,8 +280,8 @@ module Samagotchi
     # (ConfigFile.hosts_config, ConfigFile.model_settings).
     MAP_ENTRY_KEYS = {
       "hosts" => %w[host port url transport api api_key_env profile first_token_timeout vision sampling thinking
-                    reasoning_history enabled remote window_tokens llm_context_strategy llm_context_apply llm_context_budget_tokens models].freeze,
-      "models" => %w[profile vision sampling thinking reasoning_history window_tokens llm_context_strategy llm_context_apply
+                    reasoning_history enabled remote window_tokens steer_cut_after llm_context_strategy llm_context_apply llm_context_budget_tokens models].freeze,
+      "models" => %w[profile vision sampling thinking reasoning_history window_tokens steer_cut_after llm_context_strategy llm_context_apply
                      llm_context_budget_tokens].freeze
     }.freeze
     # The keys a hosts.<name>.models entry may hold (HostModel.parse_map).

data/lib/samagotchi/engine.rb

@@ -115,7 +115,8 @@ module Samagotchi
       # may steer or ask whether a turn runs while it loads.
       @turn_state = TurnState.new(clock: -> { monotonic_now })
       # A message for the running turn cutting its generation.
-      @steer_cut = SteerCut.new(clock: -> { monotonic_now }, controller: -> { active_cancel_controller })
+      @steer_cut = SteerCut.new(clock: -> { monotonic_now }, controller: -> { active_cancel_controller },
+                                cut_after: -> { steer_cut_after })
       @scratch = scratch
       @no_interrupt = no_interrupt
       @chat_backend = nil
@@ -266,8 +267,8 @@ module Samagotchi
     def wire_kernel(kernel, muted_memories)
       # A given kernel (specs) gets the Engine's store, hooks and tools, as
       # the one built here does.
-      @kernel = kernel || KernelLoop.new(client: @client, profile: @given_profile, hooks: @hooks, reminder_store: @reminder_store,
-                                         tools: @tools)
+      @kernel = kernel || KernelLoop.new(client: @client, profile: @given_profile, model_name: @effective_model_name,
+                                         hooks: @hooks, reminder_store: @reminder_store, tools: @tools)
       @kernel.reminder_store = @reminder_store
       @kernel.hooks = @hooks
       @kernel.tools = @tools
@@ -1094,6 +1095,29 @@ module Samagotchi
       explained&.source ? explained.label : nil
     end
 
+    # The seconds a cut waits for the effective model to stream only
+    # thinking (SteerCutAfter.resolve), resolved on every call, as
+    # turn_sampling; on any error, the global and its name.
+    # @return [Array(Integer, String|nil)]
+    def steer_cut_after_explained
+      target = @host_registry.resolve(@effective_model_name)
+      SteerCutAfter.resolve(target, names: model_lookup_names(target))
+    rescue StandardError
+      [SteerCut.cut_after, "steer.cut_after"]
+    end
+
+    # #steer_cut_after_explained's seconds: what SteerCut#cut_for_steer
+    # reads, per host and model.
+    def steer_cut_after = steer_cut_after_explained.first
+
+    # "after 60 s (models: qwen)", "never (hosts.splash)" for /model: the
+    # effective model's cut wait and where it came from, nil for the
+    # default.
+    def steer_cut_summary
+      seconds, source = steer_cut_after_explained
+      source ? SteerCutAfter.label(seconds, source) : nil
+    end
+
     # The effective model's thinking level with where it came from and the
     # session's own (SettingExplained), as the next turn resolves it;
     # nil when it can't be resolved.
@@ -1916,6 +1940,7 @@ module Samagotchi
       turn_started = { type: :turn_started, session_id: session.id, prompt: turn.prompt, turn_id: turn.id }
       turn_started[:continue] = true if turn.continue
       turn_started[:images] = image_refs unless image_refs.empty?
+      turn_started[:cut_after] = steer_cut_after
       emit_event(turn.on_event, turn.tag(turn_started))
       raise image_error if image_error
 

data/lib/samagotchi/host_config.rb

@@ -19,7 +19,7 @@ module Samagotchi
   # describes them, nil when unset; models: {downcased id => HostModel}.
   HostConfig = Data.define(:name, :host, :port, :scheme, :url, :transport, :api, :api_key_env, :profile,
                            :first_token_timeout, :vision, :sampling, :thinking, :reasoning_history, :remote,
-                           :window_tokens, :llm_context_strategy, :llm_context_apply, :llm_context_budget_tokens,
+                           :window_tokens, :steer_cut_after, :llm_context_strategy, :llm_context_apply, :llm_context_budget_tokens,
                            :models) do
     # Every field but name may be left out: nil, models {}.
     def initialize(**fields)
@@ -50,6 +50,7 @@ module Samagotchi
         vision: ConfigFile.vision_flag(value.call(:vision), where),
         remote: ConfigFile.bool_flag(value.call(:remote), where, "remote"),
         window_tokens: ConfigFile.window_tokens(value.call(:window_tokens), where),
+        steer_cut_after: SteerCutAfter.seconds(value.call(:steer_cut_after), where),
         sampling: ConfigFile.sampling_map(value.call(:sampling), where),
         thinking: Thinking.level(value.call(:thinking), where),
         reasoning_history: ReasoningHistory.level(value.call(:reasoning_history), where),
@@ -170,6 +171,7 @@ module Samagotchi
                      "profile" => profile, "first_token_timeout" => first_token_timeout,
                      "vision" => vision, "sampling" => sampling, "thinking" => thinking&.to_s,
                      "reasoning_history" => reasoning_history&.to_s, "remote" => remote, "window_tokens" => window_tokens,
+                     "steer_cut_after" => steer_cut_after,
                      "llm_context_strategy" => llm_context_strategy&.map(&:to_s),
                      "llm_context_apply" => llm_context_apply&.to_s,
                      "llm_context_budget_tokens" => llm_context_budget_tokens,

data/lib/samagotchi/host_registry.rb

@@ -38,13 +38,14 @@ module Samagotchi
     # reasoning_history: the configured level (ReasoningHistory), nil when unset;
     # remote: the configured true/false (#remote?), nil when unset;
     # window_tokens: the configured context window (ContextWindow.setting), nil when unset;
+    # steer_cut_after: the seconds a cut waits for its thinking (SteerCutAfter), nil when unset;
     # llm_context_strategy: the configured layers (LLMContextStrategy), nil when unset;
     # llm_context_apply: the configured apply rule (LLMContextStrategy), nil when unset;
     # llm_context_budget_tokens: the configured context budget (LLMContextStrategy), nil when unset;
     # models: the ids the host serves whatever it lists, {downcased id => HostModel} ({} when none).
     HostEntry = Struct.new(:name, :host, :port, :transport, :client, :api, :scheme, :url, :api_key_env, :profile,
                            :first_token_timeout, :vision, :sampling, :thinking, :reasoning_history, :remote,
-                           :window_tokens, :llm_context_strategy, :llm_context_apply, :llm_context_budget_tokens,
+                           :window_tokens, :steer_cut_after, :llm_context_strategy, :llm_context_apply, :llm_context_budget_tokens,
                            :models, keyword_init: true) do
       # Talks the OpenAI chat API (the chat loop); nil and raw apis use the
       # raw-prompt loop.

data/lib/samagotchi/model_profile.rb

@@ -142,13 +142,24 @@ module Samagotchi
       end
     end
 
+    # The model the config names as the default, or nil when it names none.
+    # It never raises.
+    # @return [String, nil]
+    def self.default_model_name
+      require_relative "config"
+      value = Samagotchi::Config.get("default.model")
+      return nil unless value
+
+      stripped = value.to_s.strip
+      stripped.empty? ? nil : stripped
+    end
+
     def self.required_model_name(model_name = nil)
       value = model_name.to_s.strip
       if value.empty?
-        require_relative "config"
-        value = Samagotchi::Config.get("default.model").to_s.strip
+        value = default_model_name
       end
-      raise MissingModel, missing_model_message if value.empty?
+      raise MissingModel, missing_model_message if value.to_s.strip.empty?
 
       value
     end

data/lib/samagotchi/model_settings.rb

@@ -10,10 +10,11 @@ module Samagotchi
   # downcased key. Each field is nil when unset: profile kept as written
   # (downcased; ModelProfile.resolve validates it), vision true/false,
   # sampling a request-field map, thinking a level, reasoning_history a
-  # ReasoningHistory level, window_tokens, and the
+  # ReasoningHistory level, window_tokens, steer_cut_after whole seconds
+  # (0 = never, SteerCutAfter), and the
   # LLM context strategy, apply rule and budget (LLMContextStrategy). The
   # same per-model fields a hosts: entry carries (HostConfig).
-  ModelSettings = Data.define(:profile, :vision, :sampling, :thinking, :reasoning_history, :window_tokens,
+  ModelSettings = Data.define(:profile, :vision, :sampling, :thinking, :reasoning_history, :window_tokens, :steer_cut_after,
                               :llm_context_strategy, :llm_context_apply, :llm_context_budget_tokens) do
     # Every field may be left out (nil).
     def initialize(**fields)
@@ -37,6 +38,7 @@ module Samagotchi
           thinking: Thinking.level(value.call(:thinking), where),
           reasoning_history: ReasoningHistory.level(value.call(:reasoning_history), where),
           window_tokens: ConfigFile.window_tokens(value.call(:window_tokens), where),
+          steer_cut_after: SteerCutAfter.seconds(value.call(:steer_cut_after), where),
           llm_context_strategy: LLMContextStrategy.parse(value.call(LLMContextStrategy::KEY), where),
           llm_context_apply: LLMContextStrategy.parse_apply(value.call(LLMContextStrategy::APPLY_KEY), where),
           llm_context_budget_tokens: LLMContextStrategy.parse_budget(value.call(LLMContextStrategy::BUDGET_KEY), where))

data/lib/samagotchi/process_group.rb

@@ -109,23 +109,96 @@ module Samagotchi
     # TERMs the group, waits up to +grace+ for +stopped+, then KILLs it and
     # waits up to +kill_wait+ for +stopped+ again (a KILL is delivered, not
     # done, when kill returns).
+    #
+    # The groups the group's processes started are stopped with it: a
+    # descendant that moved to a group of its own (GNU `timeout N cmd`
+    # without --foreground calls setpgid) is out of reach of a signal to
+    # +pgid+. They are found (#descendant_groups) before the TERM, while the
+    # group's processes still run, and again before the KILL; each is
+    # signalled too and must be gone as well. One that already lost its
+    # parent (reparented to init: a setsid'd `cmd &` whose shell exited) is
+    # not found, and so left running.
     # @param stopped [#call] true once it has stopped (default: the leader
     #   is gone)
     # @param wait [#call] (seconds) between two checks (default: a sleep)
+    # @param walk [Boolean] also stop the descendants' groups (one ps each
+    #   time, ~40 ms on macOS with ~850 processes)
     # @param signal_options [Hash] for #signal (leader:, quiet:)
     # @return [Boolean] true when it stopped within the grace (no KILL sent)
     # @raise [ArgumentError] unless #signalable?
     def stop(pgid, grace:, poll:, stopped: -> { !alive?(pgid) }, wait: ->(seconds) { sleep(seconds) },
-             kill_wait: KILL_WAIT_SEC, **signal_options)
+             kill_wait: KILL_WAIT_SEC, walk: true, **signal_options)
       check!(pgid)
+      # The group's members only: a leader reaped by now may be another process.
+      extra = walk ? descendant_groups(pgid) : []
       signal(pgid, "TERM", **signal_options)
-      return true if wait_for(stopped, grace, poll, wait)
+      extra.each { |group| signal(group, "TERM") }
+      # +stopped+ is asked until it says true once (it may reap: a second
+      # wait on a reaped pid raises ECHILD), then only the extra groups.
+      done = false
+      all_stopped = -> { (done ||= stopped.call ? true : false) && extra.none? { |group| group_alive?(group) } }
+      return true if wait_for(all_stopped, grace, poll, wait)
 
+      extra |= descendant_groups(pgid) if walk
       signal(pgid, "KILL", **signal_options)
-      wait_for(stopped, kill_wait, poll, wait)
+      extra.each { |group| signal(group, "KILL") }
+      wait_for(all_stopped, kill_wait, poll, wait)
       false
     end
 
+    # Whether any process is still in the group +pgid+.
+    def group_alive?(pgid)
+      check!(pgid)
+      Process.kill(0, -pgid)
+      true
+    rescue Errno::ESRCH
+      false
+    rescue Errno::EPERM
+      true
+    end
+
+    # The process groups, other than +pgid+ and chi's own, of the
+    # descendants of the processes in the group +pgid+ (and of the process
+    # +pgid+ itself with +leader+: a leader chi started that left its
+    # group). Read from one `ps -A -o pid=,ppid=,pgid=`; [] when ps fails.
+    # Only members of the group are roots, never the bare pid +pgid+ without
+    # +leader+: a reaped leader's pid may name some other process by now.
+    # @return [Array<Integer>]
+    def descendant_groups(pgid, leader: false)
+      rows = process_table
+      children = rows.group_by { |_pid, ppid, _group| ppid }
+      queue = rows.select { |_pid, _ppid, group| group == pgid }.map(&:first)
+      queue << pgid if leader
+      seen = {}
+      groups = []
+      until queue.empty?
+        pid = queue.shift
+        next if seen[pid]
+
+        seen[pid] = true
+        Array(children[pid]).each do |child, _ppid, group|
+          groups << group unless group == pgid
+          queue << child
+        end
+      end
+      own = Process.getpgrp
+      groups.uniq.select { |group| signalable?(group) && group != own }
+    end
+
+    # Every process as [pid, ppid, pgid].
+    # @return [Array<Array(Integer, Integer, Integer)>]
+    def process_table
+      out, status = Open3.capture2("ps", "-A", "-o", "pid=,ppid=,pgid=", err: File::NULL)
+      return [] unless status.success?
+
+      out.lines.filter_map do |line|
+        fields = line.split.map { |field| Integer(field, exception: false) }
+        fields if fields.size == 3 && fields.all?
+      end
+    rescue SystemCallError, IOError
+      []
+    end
+
     # Checks +stopped+ every +poll+ until it is true or +seconds+ are over.
     # @return [Boolean] whether it stopped
     def wait_for(stopped, seconds, poll, wait)