samagotchi 0.70.0 → 0.72.0

data/docs/plugins.md

@@ -568,19 +568,25 @@ end
 - Each task runs once per session start. A `-p … --non-interactive` run
   starts them with its turn and shows nothing but the answer.
 
-### `chi.toolkit(name, base:, add: [], remove: [])`
+### `chi.toolkit(name, base:, add: [], remove: [], prompt: nil)`
 
 A toolkit sessions can be put on: `base`'s tools (`full`, `lean`, `child`, a
-config or bundle toolkit) with `add` declared and `remove` left out. Users pick
+config or bundle toolkit) with `add` declared and `remove` left out, and
+`prompt`: text the sessions on it get in their system prompt, verbatim (nil
+inherits the base's, `""` clears it; at most 2000 characters, and one that
+isn't a String or is longer is a load error). Users pick
 it like chi's own (`chi --toolkit NAME`, `toolkit.default`, `/toolkit NAME`),
 and the plugin with `ctx.use_toolkit` (below). Names are `a-z`, `0-9`, `_` and
 `-`; one chi has (`full`, `lean`, `child`) or another bundle declared is a
 load error. A session saved on a toolkit whose bundle is gone declares every
 tool (full) until it comes back, with a warning at its first turn. See
-[Toolkits](configuration.md#toolkits).
+[Toolkits](configuration.md#toolkits). `prompt:` needs chi 0.72.0 (an older
+chi refuses the keyword, a load error: a bundle that passes it sets
+`requires_chi: ">= 0.72.0"`).
 
 ```ruby
 chi.toolkit "review", base: "lean", add: %w[delegate delegate_result]
+chi.toolkit "coding", base: "child", prompt: "- Be concise in your responses"
 ```
 
 ### `chi.tool_source(call:, acts_as:, label:, wait:, prefix:)`
@@ -645,9 +651,10 @@ index = Samagotchi::Tools::ToolIndex
   ([acts_as:](#guardrails)), even when another bundle has a tool of that
   name (only the core-tool drop applies). A call made before its tool is published is
   named by `acts_as` from the names alone; a bare name with `prefix` is
-  taken as an `acts_as` as given. The `acts_as:` hook must give exactly the
+  taken as an `acts_as` as given (without `prefix`, a bare name is refused:
+  call it as `<group>/<tool>`). The `acts_as:` hook must give exactly the
   `acts_as` the source publishes for that tool: a call whose tool isn't the
-  one guardrails were given is refused ("the MCP tools changed while the call
+  one guardrails were given is refused ("the tool list changed while the call
   waited"), so a hook that disagrees refuses every call.
 - **The row** shows `label` (default: the bundle's name) and
   `<group>/<tool> args…`. `@source.declared_names` and `declared_tokens` say
@@ -1672,6 +1679,11 @@ by themselves there.
   or a turn already there) and the session's toolkit has no `delegate`, the
   reply says to run `/toolkit coordinator`. A continue of a coordinator link
   keeps the toolkit.
+- **The coding toolkit.** The bundle (0.5.0) also declares `coding`: `child`
+  with the prompt text `- Be concise in your responses` / `- Show file paths
+  clearly when working with files`. The skill starts build and fix children
+  on it (`delegate` with `toolkit: "coding"`); reviews, research and plans
+  stay on `toolkit.child`, as they need the length.
 - **`/children [all]`** shows the session's children as a card, newest first,
   one line each: `` `ab12cd34` · running · fix/flaky · "fix the flaky spec" ``,
   `` `9a8b7c6d` · done · feat/x · reported · "All 12 specs pass" `` (`not
@@ -1761,8 +1773,7 @@ Claude pairs; without one the bundle costs one tool declaration.
   - In the web, selecting text offers **Confirm with Claude**
     ([`chi.annotation`](#chiannotationlabel-command-template-quote-send-false)):
     it fills the composer with `/claude validate` and the quote, for you to
-    add what needs confirming. On a chi without `chi.annotation` (0.62–0.65)
-    the bundle loads without the pill.
+    add what needs confirming.
   - `/claude last` sends the model's last completed answer as context. Mid-turn
     it is the answer before the running turn, never the turn's partial text;
     a cancelled or failed turn has no answer, so the one before it goes.

data/docs/sessions.md

@@ -45,7 +45,7 @@ chi sessions archive ID...                            # hide from every list, ke
 chi sessions list --archived                          # archived sessions too, marked [archived]
 chi sessions delete [--force] ID...                    # for good; --force stops a live worker first
 chi sessions prune [--dry-run] [--days N] [--keep N] [--keep-status running,...] [--test-only]
-chi sessions clean [--dry-run] [--days N]             # test sessions: all, or older than N days
+chi sessions clean [--dry-run] [--days N] [--all]     # test sessions: all, or older than N days; --all: every kind, as prune
 chi sessions stats ID [--format text|json]            # cost, tokens and progress, without a model turn
 ```
 
@@ -226,7 +226,9 @@ A session file's `toolkit` (`{"name", "add", "remove"}`) is the toolkit it was c
 `toolkit.default`, `toolkit.child` for a delegate child, or `chi --toolkit` / `chi send --new --toolkit` (with
 `--tool` / `--no-tool`). It is never resolved again from config: a respawned or woken worker declares the same
 tools. `null` (a session from before toolkits) is `full`. A continue (`continue →`, `chi send --new --continues`)
-and a fork (`ctx.sessions.fork`) keep it, as they keep the thinking level; a delegate child gets `toolkit.child`.
+and a fork (`ctx.sessions.fork`) keep it, as they keep the thinking level; a delegate child gets the kit its
+`delegate` call names (`toolkit:`, any kit the parent knows) or `toolkit.child`; one its worker can't resolve
+declares every tool (full). The file stores only the name: a kit's tools and prompt text come from its definition.
 `/toolkit` changes it, saved at once, from the next turn's start. See
 [Toolkits](configuration.md#toolkits).
 

data/docs/testing.md

@@ -36,7 +36,10 @@ A select bound with `.value` instead reads right in both, but lit sets it before
 `npm test` runs every file in one process (`--test-isolation=none`; CI and local runs use Node 24): the files share
 `globalThis`, the shim's one happy-dom window and every module's state: a global a spec sets (stage_view's
 `ResizeObserver` stand-in) is there for the files after it, so set only harmless stand-ins and put anything else
-back (`t.mock` restores itself). One file: `node --test spec/web/public/NAME.test.js`.
+back (`t.mock` restores itself). A test that sets off a module's timer (a flash, a highlight's end) fakes it
+(`t.mock.timers.enable({ apis: ["setTimeout"] })`, then `tick`): a real one still pending after the last test keeps
+node running until it fires (a 4 s one made the run 6 s for 2 s of work). One file:
+`node --test spec/web/public/NAME.test.js`.
 
 Where a composer line goes is decided twice, in Ruby (`ComposerRoute`, both terminals) and in the web
 (`composer.js#routeComposerLine`). `spec/fixtures/composer_routes.json` holds the cases both answer: rspec
@@ -44,6 +47,12 @@ Where a composer line goes is decided twice, in Ruby (`ComposerRoute`, both term
 either router adds its row there; a row where a UI differs on purpose (or a found divergence) carries a `web` or
 `repl` override and a `note`.
 
+A spec that waits for something uses `wait_until(timeout:)`, or `wait_until!(what, timeout:)` where no check
+follows (stubs, helper threads: it raises "timed out after N s waiting for <what>") — never a loop with no deadline.
+Every example also runs under a 120 s limit (`spec_helper`'s `around`; `integration`, `macos_build`, `warmup` and
+`recap` examples are exempt), so a hang fails its example instead of the run. `SPEC_EXAMPLE_TIMEOUT=N` changes the
+limit, `0` turns it off (a debugger session).
+
 ## While you work: affected specs
 
 ```sh
@@ -56,8 +65,8 @@ script/affected-specs A..B            # another range (A...B: from their merge-b
 A builder runs these while working, not the full suite: the specs the change touched, the specs named after the
 files it changed (`lib/samagotchi/foo/bar.rb` → `spec/foo/bar_spec.rb`, `bar_*_spec.rb`…), the specs that read
 docs or source as text (its `RULES`: add one when a full run catches what the names missed) and the golden of a changed
-file's layer (any `terminal_ui/*.rb` → `spec/terminal_ui_golden_spec.rb`), then the other name
-matches (a spec named after several changed files first, e.g. `engine_toolkit_spec.rb` for `engine.rb` and
+file's layer (any `terminal_ui/*.rb` → `spec/terminal_ui_golden_spec.rb`; `turn_flow.rb` and `turn_note.rb`, whose
+words the REPL prints, pick it by a rule), then the other name matches (a spec named after several changed files first, e.g. `engine_toolkit_spec.rb` for `engine.rb` and
 `toolkit.rb`; then one beside the file, so `plugin/context.rb` picks `spec/samagotchi/plugin/*context*` before
 `spec/guardrails/context_spec.rb`), then the specs that name a changed file's class. The default range is the merge-base with main (or origin/main) plus uncommitted and untracked files.
 The Ruby specs go to stdout; the node tests to run (`npm test` targets), "web changed: also run npm run e2e" and a

data/lib/samagotchi/bootstrap/config_writer.rb

@@ -60,12 +60,11 @@ module Samagotchi
       attr_reader :path
 
       # @param path [String] config.yml (a symlink is written through)
-      # @param env [Hash] the environment for the check (SAMAGOTCHI_HOSTS_JSON
-      #   is dropped: it would replace the file's hosts)
+      # @param env [Hash] the environment for the check
       # @param now [Proc] the time for the backup's name and the header
       def initialize(path:, env: ENV, now: -> { Time.now })
         @path = path
-        @env = env.to_h.except("SAMAGOTCHI_HOSTS_JSON")
+        @env = env.to_h
         @now = now
       end
 

data/lib/samagotchi/bridge/turn_accumulator.rb

@@ -18,8 +18,11 @@ module Samagotchi
     # its terminal event, the same event that brings its messages into the
     # session, so a snapshot shows a turn in exactly one of the two.
     class TurnAccumulator
+      # @param max_output_chars [Integer] a tool part's output past this keeps
+      #   its head and tail: a reload's cap, so a joined row is the row a
+      #   reload draws
       # @param clock [#call] monotonic seconds: a tool call's duration
-      def initialize(max_output_chars: KernelLoop::DEFAULT_MAX_TOOL_OUTPUT_CHARS,
+      def initialize(max_output_chars: ToolOutputCut::WEB_PREVIEW_CHARS,
                      clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
         @max_output_chars = max_output_chars
         @clock = clock

data/lib/samagotchi/bridge.rb

@@ -289,13 +289,16 @@ module Samagotchi
     # session state, the last answer (Engine#last_answer_message: one
     # message, not the conversation) and the cards, as one step of the event
     # log (one event_seq). Light whatever the session's length: GET tail.
-    # @return [Hash] {session_id:, session_state_snapshot:, answer:, cards:, event_seq:, event_id:}
+    # The session's folder (working_directory) rides along: what the web
+    # checks the answer's file refs against without reading the session file.
+    # @return [Hash] {session_id:, working_directory:, session_state_snapshot:, answer:, cards:, event_seq:, event_id:}
     # +turn_id+: that turn's answer, not the newest (Engine#last_answer_message).
     def tail_frame(turn_id: nil)
       @engine.synchronize_events do
         seq = @engine.event_count
         state = @engine.session_state_snapshot.merge(event_seq: seq, event_id: event_id(seq))
-        { session_id: @session_id, session_state_snapshot: state, answer: @engine.last_answer_message(turn_id: turn_id),
+        { session_id: @session_id, working_directory: @engine.session&.working_directory,
+          session_state_snapshot: state, answer: @engine.last_answer_message(turn_id: turn_id),
           cards: @cards.list, event_seq: seq, event_id: event_id(seq) }
       end
     end

data/lib/samagotchi/broadcast/scope_card.rb

@@ -2,7 +2,7 @@
 
 require "pathname"
 require_relative "../session"
-require_relative "../context_note"
+require_relative "../paths"
 require_relative "../context_sources"
 require_relative "../git_head"
 require_relative "../recap_store"
@@ -78,7 +78,7 @@ module Samagotchi
       # back resolved (/private/tmp/… on macOS) while the session's folder
       # may go through a symlink (/tmp/…).
       def folder(cwd, project)
-        return ContextNote.home_relative(cwd) if project.nil?
+        return Paths.tilde(cwd) if project.nil?
 
         cwd = real(cwd)
         project = real(project)

data/lib/samagotchi/bundles/claude-peer/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: claude-peer
-version: 0.4.0
+version: 0.4.1
 scope: system
 description: "Pair this session with a Claude Code session you work with: the claude_send tool and /claude send it a part of the work (a plan step, a diff, a finding) to validate or as context, and Claude's answer comes back as the claude-outbox context; /claude install-skill installs Claude's chi-peer skill, which pairs"
 trust_level: reviewed
@@ -10,15 +10,10 @@ files:
     description: "Send a part of the work to the paired Claude Code session (claude_send): only when the user asks, or to reply to its answer in a peer turn; validate, context or question; Claude's answer comes as the claude-outbox context"
 plugin:
   file: plugin.rb
-  sha256: sha256:08000c9ccd8672ecae38fb4f53694ad3220caa8ed06de70cc4661ce7e882eecb
+  sha256: sha256:50f427d3862ae9d0d15693b4d887c528162b96c0320cc663df89d59d830d4660
 scripts:
   pair: sha256:35f3be2b466a5ba07591d64040bc5780fdd843b9b08737f8ea8a2fccb2102832
   chi-peer-SKILL.md: sha256:e991a91139a127a60f9a216043eb5864945fb211952a1e3c8db2068c6cc254f1
-# Two things need chi 0.63.0, and the bundle works without them on 0.62:
-# ctx.context.list's summary: (the /claude card's last answer; without it
-# the card shows no summary), and a pushed source's first wake: true push
-# waking the session (on 0.62 Claude's first answer arrives as a note
-# without waking; later ones wake).
 # The plugin needs Samagotchi::Plugin::Peer and chi.peer_source (chi 0.67.0).
 # An agreeing answer's closing wake (the skills say an OK wakes chi once)
 # and the plugin's OUTBOX (Plugin::Peer's rename of REVIEW) need chi 0.70.0.

data/lib/samagotchi/bundles/claude-peer/plugin.rb

@@ -40,8 +40,8 @@ require "samagotchi/plugin/peer"
 # sees it. The skill is scripts/chi-peer-SKILL.md beside this file, with the
 # installed scripts/pair path and the payload folder written in.
 #
-# In the web, selecting text offers "Confirm with Claude" (chi.annotation;
-# skipped on a chi without it, 0.62–0.65): it fills the composer with
+# In the web, selecting text offers "Confirm with Claude" (chi.annotation):
+# it fills the composer with
 # `/claude validate` and the quote, for the user to add what to confirm.
 # Such a text is titled by its first quoted line, not the quote's
 # `From your thinking:` label.

data/lib/samagotchi/bundles/codex-peer/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: codex-peer
-version: 0.3.0
+version: 0.3.1
 scope: system
 description: "Pair this session with an OpenAI Codex CLI session you work with: the codex_send tool and /codex send it a part of the work (a plan step, a diff, a finding) to validate or as context, with codex queue, and Codex's answer comes back as the codex-outbox context; /codex install-skill installs Codex's chi-peer skill, which pairs"
 trust_level: reviewed
@@ -10,14 +10,10 @@ files:
     description: "Send a part of the work to the paired Codex CLI session (codex_send): only when the user asks, or to reply to its answer in a peer turn; validate, context or question; Codex's answer comes as the codex-outbox context"
 plugin:
   file: plugin.rb
-  sha256: sha256:c36cba9ab4c87c1a5ec9fbb8f907286bb04410b2a85b56269e29392173160689
+  sha256: sha256:eb6888e3611b8ed42498cfecab5b430e0ef7a4c2dc7b3c090d015336aa039b11
 scripts:
   pair: sha256:251448a31959b5c916400eff7909e85c696855d5c16b6b10973ada40915c8051
   chi-peer-SKILL.md: sha256:7c392ac04c115ea1e762ad562b5c4c44c3eca71558ba5d9dfeaeabdd533b6a82
-# Codex's answer is a pushed source's first wake: true push, which wakes the
-# session from chi 0.63.0 (before, the first answer arrives as a note
-# without waking); ctx.context.list's summary: (the /codex card's last
-# answer) is 0.63.0 too.
 # The plugin needs Samagotchi::Plugin::Peer and chi.peer_source (chi 0.67.0).
 # An agreeing answer's closing wake (the skills say an OK wakes chi once)
 # and the plugin's OUTBOX (Plugin::Peer's rename of REVIEW) need chi 0.70.0.

data/lib/samagotchi/bundles/codex-peer/plugin.rb

@@ -42,8 +42,8 @@ require "samagotchi/plugin/peer"
 # pairing and replies (its default sandbox can't write chi's state); chi
 # never edits Codex's config.
 #
-# In the web, selecting text offers "Confirm with Codex" (chi.annotation;
-# skipped on a chi without it, 0.63–0.65): it fills the composer with
+# In the web, selecting text offers "Confirm with Codex" (chi.annotation):
+# it fills the composer with
 # `/codex validate` and the quote, for the user to add what to confirm.
 # Such a text is titled by its first quoted line, not the quote's
 # `From your thinking:` label.

data/lib/samagotchi/bundles/coordinator/manifest.yml

@@ -1,15 +1,17 @@
 ---
 name: coordinator
-version: 0.4.0
+version: 0.5.0
 scope: system
-description: "Coordinate parallel work: the coordinator skill (split the work, one worktree and child session per task, check each report, ask before each merge, a handoff memory to resume from), /coordinate <goal>, /coordinate resume, /coordinate end and /children; the coordinator toolkit (lean + delegate, delegate_result, list_sessions)"
+description: "Coordinate parallel work: the coordinator skill (split the work, one worktree and child session per task, check each report, ask before each merge, a handoff memory to resume from), /coordinate <goal>, /coordinate resume, /coordinate end and /children; the coordinator toolkit (lean + delegate, delegate_result, list_sessions) and the coding toolkit for build children (child + be concise)"
 trust_level: reviewed
 files:
   skill_coordinator.md:
-    sha256: sha256:2ef3faefa89cbb23ce89c76bd5d913e29dde9817edf08cd29a063aeafa698643
+    sha256: sha256:718cb76da10f9610a7582eddf1441590566836ebc6a9cb127b7f7847b17ceb92
     description: "Coordinate parallel work: split it, delegate each task wait:false in its own worktree (cwd:), check each report, ask the user before each merge; resume from a handoff_* memory"
 plugin:
   file: plugin.rb
-  sha256: sha256:caaddd24fbec2c66fa0e88937478b7ec7799bac7c98d5dc7f71ffc3fc227953a
-# the coordinator toolkit needs chi.toolkit and ctx.use_toolkit (0.66.0)
-requires_chi: ">= 0.66.0"
+  sha256: sha256:3b5f766ad198862243c494e4c5aec7c4a0972e7644a6388bed843c5651f5ca0d
+# the coordinator toolkit needs chi.toolkit and ctx.use_toolkit (0.66.0); the
+# coding toolkit (chi.toolkit prompt:) and the skill's delegate toolkit: need
+# the next chi.
+requires_chi: ">= 0.72.0"

data/lib/samagotchi/bundles/coordinator/plugin.rb

@@ -38,6 +38,13 @@
 # before the session's first model reply and outside a turn: otherwise it
 # says to run /toolkit coordinator, unless the session declares delegate
 # anyway.
+#
+# The coding toolkit is for build and fix children (the skill's delegate
+# toolkit: "coding"): child's tools plus a prompt text, pi's two plain
+# lines. In the harness evals (r5, r7: Qwen3.6-35B-A3B, lean, N=3) they cut
+# the median time by a third at the same quality. Plain wording only: a
+# scoped wording ("in this task, …") backfired (+50% thinking). Reviews,
+# research and plans stay on child (no toolkit:): they need the length.
 class Plugin
   CARD_ID = "children"
   # A card takes 6 actions: Refresh and up to 5 Stops.
@@ -56,9 +63,12 @@ class Plugin
 
   TOOLKIT = "coordinator"
   TOOLKIT_TOOLS = %w[delegate delegate_result list_sessions].freeze
+  CODING_TOOLKIT = "coding"
+  CODING_PROMPT = "- Be concise in your responses\n- Show file paths clearly when working with files"
 
   def register(chi)
     chi.toolkit TOOLKIT, base: "lean", add: TOOLKIT_TOOLS
+    chi.toolkit CODING_TOOLKIT, base: "child", prompt: CODING_PROMPT
     chi.command "/children", "this session's child sessions: state, branch, last reply; all, stop <id>",
                 anytime: true do |args, ctx|
       children_command(args.to_s.strip, ctx)

data/lib/samagotchi/bundles/coordinator/skill_coordinator.md

@@ -46,7 +46,8 @@ If the request is a new goal, say which handoffs are open (one line each) and go
    user if unsure. Split the work into independent tasks (at most session.max_children at once,
    default 4). Tell the user the split in a few lines and go on unless they object.
 2. For each task: from your own folder, `git worktree add ../<repo>-<task> -b <type>/<task>` with
-   execute; then `delegate` with `wait: false`, `cwd:` that worktree's absolute path, and a
+   execute; then `delegate` with `wait: false`, `cwd:` that worktree's absolute path, `toolkit:
+   "coding"` for a build or fix task (none for a review, research or a plan), and a
    self-contained task. The task starts with "Work only in <absolute worktree path>: every cd, read,
    write, test and commit goes there, never the project root" and says what to report (the result,
    evidence: commands and what they printed, what isn't done) and "commit on the branch, don't merge,

data/lib/samagotchi/bundles/system/config_modification_protocol.md

@@ -57,7 +57,7 @@ Only the nested form is read. An env name used as a top-level key (`SAMAGOTCHI_D
 **Excluded maps** (YAML-only, not part of the flat registry; skipped by scalar loader):
 
 - `model_aliases:` map of alias → model id (`ModelRef.parse`, through `HostRegistry#resolve`). Keys lowercased on write (`ConfigFile.write_model_alias!`). Values may be bare `model` or qualified `host:model` (hybrid; only `:` names a host, `org/model` is an id). Aliases apply once: never point an alias at another alias.
-- `hosts:` map of `name → {host, port | url, transport, api, api_key_env, auth, dialect, profile, first_token_timeout, vision, sampling, thinking, enabled, models}` (`ConfigFile.hosts_config`, `host_registry.rb` `HostEntry`). Names lowercased; `url:` (http/https, optional path) replaces host/port, never both; `api_key_env:` names the env var holding the API key (never write a key into config.yml); `auth:` (`bearer|x-api-key`) is the header the key goes in (default `x-api-key` on `api: anthropic`, Bearer elsewhere); `dialect:` (`fireworks`, or `standard` for the default; `api: anthropic` only) adjusts the Messages wire for that provider (Bearer by default, no thinking `display`, no `cache_control`, `x-session-affinity`; `LLM::Dialect`, docs/configuration.md "Anthropic Messages hosts"); `transport` overrides `server.transport`; `first_token_timeout` (seconds, `0` = off; a negative or non-number warns and is ignored) overrides `server.first_token_timeout` for that host; `models:` (a map of model ids, or a plain list) declares ids the host serves whatever its `/v1/models` lists: no "doesn't list" warning, and a bare id routes there as if listed (`HostModel`); an entry may hold `price: {input, output, cache_read?, cache_write?}` in USD per 1M tokens (`ModelPrice`; an unset cache rate is the input rate), which estimates a cost the provider doesn't report or reports as 0 (`cost_estimate`, shown as `~$`), and `served: [ids] | any`, the models a gateway may answer that id with (no served-model warning for them); model settings stay in the root `models:`; a worker reads `hosts:` from the file as it starts (`SAMAGOTCHI_HOSTS_JSON` replaces it for a process it is set on; `SessionManager.spawn_options` unsets it for workers).
+- `hosts:` map of `name → {host, port | url, transport, api, api_key_env, auth, dialect, profile, first_token_timeout, vision, sampling, thinking, enabled, models}` (`ConfigFile.hosts_config`, `host_registry.rb` `HostEntry`). Names lowercased; `url:` (http/https, optional path) replaces host/port, never both; `api_key_env:` names the env var holding the API key (never write a key into config.yml); `auth:` (`bearer|x-api-key`) is the header the key goes in (default `x-api-key` on `api: anthropic`, Bearer elsewhere); `dialect:` (`fireworks`, or `standard` for the default; `api: anthropic` only) adjusts the Messages wire for that provider (Bearer by default, no thinking `display`, no `cache_control`, `x-session-affinity`; `LLM::Dialect`, docs/configuration.md "Anthropic Messages hosts"); `transport` overrides `server.transport`; `first_token_timeout` (seconds, `0` = off; a negative or non-number warns and is ignored) overrides `server.first_token_timeout` for that host; `models:` (a map of model ids, or a plain list) declares ids the host serves whatever its `/v1/models` lists: no "doesn't list" warning, and a bare id routes there as if listed (`HostModel`); an entry may hold `price: {input, output, cache_read?, cache_write?}` in USD per 1M tokens (`ModelPrice`; an unset cache rate is the input rate), which estimates a cost the provider doesn't report or reports as 0 (`cost_estimate`, shown as `~$`), and `served: [ids] | any`, the models a gateway may answer that id with (no served-model warning for them); model settings stay in the root `models:`; a worker reads `hosts:` from the file as it starts (no environment variable sets hosts).
 - `models:` map of model id or alias → `{profile, vision, sampling, thinking, reasoning_history}` (`ConfigFile.model_settings`). `thinking:` (here, on a host, or `thinking.level` for every model) is `off|low|medium|high|default` (`Thinking`; unquoted `off` works, `on` is not a level; `default` = send nothing). Precedence: the session's own level (`/thinking LEVEL`, saved in the session; `chi --thinking` on a session run, `chi send --new --thinking`) > `chi web --thinking`/`SAMAGOTCHI_THINKING_LEVEL` > `models:` > `hosts.<name>.thinking` > `thinking.level` in config.yml > `default`. A `sampling:` key wins over the fields a level sends (`null` drops one); `docs/configuration.md` "Thinking". `reasoning_history:` (here or on a host) is `drop|turn|all`, which of its reasoning a chat host's model gets back. Precedence: the session's own level (`/reasoning-history LEVEL`, saved in the session) > `SAMAGOTCHI_REASONING_HISTORY` > `models:` > `hosts.<name>.reasoning_history` > `turn`; `docs/configuration.md` "Reasoning history". `/thinking` and `/reasoning-history` ask before a change that restarts the prompt cache; `--yes` applies it (`chi send` commands apply directly). `sampling:` (here or on a host) is a map of request fields passed to the provider as written (`temperature`, `top_p`, `presence_penalty`, `repeat_penalty`, …; a model's fields win over its host's per field; `null` = don't send; chi's own fields like `max_tokens`/`stream` are refused with a warning; `docs/configuration.md` "Sampling"). Keys match case-insensitively. `profile` (here or on a host) is `qwen36|gemma4`: the raw prompt format for native hosts. Precedence: `--profile`/`SAMAGOTCHI_MODEL_PROFILE` > `models:` > `hosts.<name>.profile` > the llama.cpp server's chat template > the name (`qwen`/`gemma`) > `qwen36` (`ModelProfile.resolve`). Set one when a model's name hides its family (e.g. a Qwen fine-tune under another name on mlx, which has no template to read).
 - `hooks:` map of `hooks_dir` + per-event lists `{path, on_error}` (`Hooks::Loader.load`). `hooks_dir` may start with `~`.
 - `guardrails:` tool-call rules (`docs/guardrails.md`; read in `Engine#guardrail_rules`, parsed by `Guardrails::Rules.parse`): `enabled` (bool, default true; `false` drops rules and hooks' asks, a deny still applies; config.yml only, like every `guardrails` setting: no env variable), `parent_approvals` (`off`, the default: a parent agent's `chi answer` can only deny an approval; `once`: it may give "Allow once" too; a convention for an honest parent, not a security boundary, and the user's choice: set it only when the user asks), `rules:` (list), `disable:` (a rule id or a list of them, `id` or `bundle:id`, switching off a bundle's or config rule without editing it), `small_models` (`auto`, the default: small = 32B or less read from the name; a glob or list of globs; `[]` for none). A rule takes only `id`, `tool`, `command`, `path`, `git`, `models`, `verdict`, `reason`, `scopes`: `id` required; at least one of `tool` (a name, `shell` = execute + task_create, a `File.fnmatch` glob like `"mcp_*"`, or a list), `command` (a Ruby regex on the shell command), `path` (a glob, or `outside_repo`: outside the session's repo, tmp folders and memory files excepted), `git` (only `outside_repo`: a shell call runs commit/add/reset/… in another checkout); `models` (optional: `small`, a model-name glob, or a list; without it the rule is for every model); `verdict` `ask|deny`; `scopes` (for `ask`) a subset of `once, session, repo, rule`. **Any parse error (an unknown key, a bad regex, no verdict) makes chi deny every tool call** until fixed, so validate with `YAML.safe_load` and keep the list shape. Rules are read again on the next tool call after config.yml or a bundle's rules change: no restart needed. Installed bundles' rule files (`chi bundle install guardrails`) add to them; `/guardrails` lists what loaded.

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.70.0
+version: 0.72.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:29c2f7df9f6c5acbc5ec17000a4490741e55e426af15ca0d81c8706edd9bd027
   self_map.md: sha256:b5b3166c91f6f2af2563dd9db5f9959cda66747d907017acd0776fcd2fe29049
-  config_modification_protocol.md: sha256:c7decf27af999066195f83e71222a6ae294f13174ced9664a21cd1dabf8b854a
+  config_modification_protocol.md: sha256:66792f788cdbb8ee0252f2c387c96bd75266817bb75f721aaa181b602db97137
   memory_guide.md: sha256:c48eea744db69e4f3e9bb415e9a03a8c78bbcaa1205ad3b1fb157a079f92d22e
   delegated.md: sha256:a0d6ddcd4a8be06526d964898611775fd251cfd9d145a9d16afaccaa503597bd

data/lib/samagotchi/config.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "yaml"
-require "json"
 require "fileutils"
 require "uri"
 require_relative "atomic_file"
@@ -877,13 +876,13 @@ module Samagotchi
     HOST_NAME_RE = /\A[a-z0-9][a-z0-9._-]*\z/i
     ENV_NAME_RE = /\A[A-Za-z_][A-Za-z0-9_]*\z/
 
-    # config.yml's hosts: (or a SAMAGOTCHI_HOSTS_JSON override) by lowercased
-    # name; an entry that is disabled or invalid (warned) is left out. No
-    # entry left: "default", from server.host/port/transport.
+    # config.yml's hosts: by lowercased name; an entry that is disabled or
+    # invalid (warned) is left out. No entry left: "default", from
+    # server.host/port/transport.
     # @return [Hash{String => HostConfig}]
     def hosts_config(env: ENV, path: global_path(env: env))
       data = read_yaml(env: env, path: path)
-      raw_hosts = hosts_source(data, env)
+      raw_hosts = data[HOSTS_KEY] if data.is_a?(Hash)
 
       normalized = {}
       if raw_hosts.is_a?(Hash)
@@ -933,11 +932,11 @@ module Samagotchi
     private_class_method :warn_duplicate_host_models
 
     # The names (lowercased) of the hosts entries with enabled: false, which
-    # hosts_config leaves out. Read from the same source: config.yml's
-    # hosts:, or a SAMAGOTCHI_HOSTS_JSON override.
+    # hosts_config leaves out, from config.yml's hosts:.
     # @return [Array<String>]
     def disabled_host_names(env: ENV, path: global_path(env: env))
-      raw = hosts_source(read_yaml(env: env, path: path), env)
+      data = read_yaml(env: env, path: path)
+      raw = data[HOSTS_KEY] if data.is_a?(Hash)
       return [] unless raw.is_a?(Hash)
 
       raw.filter_map { |name, cfg| name.to_s.strip.downcase if cfg.is_a?(Hash) && HostConfig.disabled?(cfg) }
@@ -945,23 +944,6 @@ module Samagotchi
       []
     end
 
-    # config.yml's hosts: as written, or the SAMAGOTCHI_HOSTS_JSON override
-    # set on this process (specs; SessionManager.spawn_options unsets it for
-    # a worker, which reads the file).
-    def hosts_source(data, env)
-      raw = data[HOSTS_KEY] if data.is_a?(Hash)
-      env_json = env["SAMAGOTCHI_HOSTS_JSON"].to_s.strip
-      return raw if env_json.empty?
-
-      parsed = begin
-        JSON.parse(env_json)
-      rescue StandardError
-        nil
-      end
-      parsed.is_a?(Hash) ? parsed : raw
-    end
-    private_class_method :hosts_source
-
     # Resolve the `recap:` section through the Config registry so scalar
     # recap settings share the single precedence path (CLI > ENV > file >
     # default). Returns false when explicitly disabled (file `recap: false`

data/lib/samagotchi/context_note.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "time"
+require_relative "paths"
 
 module Samagotchi
   # A context note: background text pushed into a session from outside (the
@@ -39,7 +40,7 @@ module Samagotchi
     def label(source:, from_session: nil, from_cwd: nil)
       return source.to_s unless from_session
 
-      "session #{from_session.to_s[0, 6]}#{" (#{home_relative(from_cwd)})" if from_cwd}"
+      "session #{from_session.to_s[0, 6]}#{" (#{Paths.tilde(from_cwd)})" if from_cwd}"
     end
 
     def label_of(message)
@@ -78,10 +79,5 @@ module Samagotchi
     rescue ArgumentError
       nil
     end
-
-    def home_relative(path)
-      home = Dir.home
-      path.to_s.start_with?("#{home}/") || path.to_s == home ? path.to_s.sub(home, "~") : path.to_s
-    end
   end
 end

data/lib/samagotchi/effective_model.rb

@@ -30,7 +30,7 @@ module Samagotchi
   #
   # Each setting reader rescues its own failure and gives the fallback the
   # Engine has always given (Unresolved); building one raises as
-  # HostRegistry#resolve does (the Engine's #model_setting gives the
+  # HostRegistry#resolve does (SessionModelSettings#model_setting gives the
   # fallback then).
   EffectiveModel = Data.define(:registry, :name, :typed, :target, :names) do
     # @param registry [HostRegistry]