legionio 1.8.6 → 1.8.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc945e4cbc2538a5a3c3566be37282dd8e532af7c3dfdbe74a43214e2422883c
-  data.tar.gz: 3d5a9e859cb710670e4cbdb480956871632c800426262a621d93c69686c10f39
+  metadata.gz: 47d2f43298e4d606c1a6817bddee1bc2e09fe63c78bcae858c45cdc29622ab85
+  data.tar.gz: 6043356cca31ed43034509f3c4e0f6de5b37dc8cc72011c4442cf50c072e392a
 SHA512:
-  metadata.gz: cd3531730af067dba6c85f9f19e066c601c6e5ce0678d4f3b1f640a15e18477b5f782294d1c328d0fbed7123f0401f85b45a251566f1bc9b1c765d4c301caff1
-  data.tar.gz: 4625e1bdcf1cc4f68c5a7df9621cfd22bfbcfa2a675cd5e34c3182a9bf273b4b92b9ca3e7b23b216d0468bb22d49bbca85739eb0b65dbec0ccfb5c4de6537f9a
+  metadata.gz: 29daf6503fc9a0fa6fd893d50b1dc05ac35040c6ed3b49024cb46df6863efe173a69b87c0bee65a5aaa65f6779b50f16784487cddde26c8ed92dfedc816a12c9
+  data.tar.gz: 90d6980b55176786950d8da78ace2f902c5974f1c2d5887a73eab97b7fb690a2cdb9fde657eeeddd44ee839d42d0fda4bbfe83dda2d9ee8f75cbef08e7b4941b

data/.gitignore

@@ -1,6 +1,6 @@
 /.bundle/
 /.yardoc
-/Gemfile.lock
+Gemfile.lock
 /_yardoc/
 /coverage/
 /doc/
@@ -28,3 +28,8 @@ legionio_wallpaper*.svg
 legionio_overview*
 # git worktrees
 .worktrees/
+# local-only directories
+docs/
+config/tls/
+# generated integration specs
+spec/integration/self_generate_spec.rb

data/AGENTS.md

@@ -0,0 +1,11 @@
+# AGENTS.md
+
+Instructions for AI agents working in this repository.
+
+## Pre-Commit Requirements
+
+Always run a full `bundle exec rspec` and `bundle exec rubocop -A` and fix all errors before committing.
+
+## Repository Context
+
+This is the primary gem (`legionio`) of the LegionIO framework. See `CLAUDE.md` for full architecture, file map, and conventions.

data/CHANGELOG.md

@@ -2,6 +2,63 @@
 
 ## [Unreleased]
 
+## [1.8.14] - 2026-04-18
+
+### Fixed
+- Optional subsystem `LoadError`s (RBAC, Data, LLM, Apollo, Gaia, Telemetry) now log at the caller-specified level instead of always ERROR with a full stack trace — `handle_exception` respects the `level:` kwarg. Fixes #155
+- `web_fetch` tool in `/api/llm/*` endpoints now delegates to `Legion::CLI::Chat::WebFetch.fetch` instead of bare `Net::HTTP.get`, gaining SSL, redirect-following, HTML-to-markdown conversion, and `maxLength` support. Fixes #153
+- `web_search` tool in `/api/llm/*` endpoints no longer falls through to the generic "not executable server-side" error — added dispatch branch delegating to `Legion::CLI::Chat::WebSearch.search`. Fixes #154
+
+## [1.8.13] - 2026-04-17
+
+### Added
+- `Absorbers::Base#query_knowledge` — scope-aware knowledge retrieval (`:local`, `:global`, `:all`) with deduplication, matching the pattern established by `Helpers::Knowledge`
+
+### Fixed
+- `Absorbers::Base` now routes ingestion by scope: `absorb_to_knowledge`, `absorb_raw`, and `ingest_chunks` resolve `Legion::Apollo::Local` for `:local` scope and `Legion::Apollo` for `:global`, instead of always hitting the global store
+- Added `apollo_local_available?` and `resolve_apollo_target` private helpers for scope-driven Apollo target selection
+
+## [1.8.12] - 2026-04-17
+
+### Fixed
+- `Actors::Subscription` now supports `pattern` class method as a DSL accessor for routing key hints, delegating to `routing_key_hint` — extensions calling `pattern 'some.routing.key'` no longer raise `NoMethodError`. Fixes #143
+- `Absorbers::Base` removed deprecated `alias handle absorb` — use `#absorb` directly
+- Generator template (`legion generate absorber`) now emits `def absorb(...)` instead of `def handle(...)`
+- `Matchers::File` is now required and registered alongside `Matchers::Url` in the absorber loader
+- Absorber base spec updated to use `#absorb` instead of removed `#handle` alias
+
+## [1.8.11] - 2026-04-17
+
+### Fixed
+- `Legion::CLI::Chat::WebFetch` — eliminated all remaining polynomial regex patterns (CodeQL `rb/polynomial-redos`): replaced `convert_blocks!`, `convert_headings!`, `convert_lists!`, `convert_formatting!`, and `strip_remaining_tags!` with index-based tag scanning helpers (`replace_tag_blocks!`, `replace_open_tags!`, `replace_close_tags!`, `replace_self_closing!`). No regex with `[^>]*` or `[^>]+` remains in the HTML-to-markdown pipeline.
+
+## [1.8.10] - 2026-04-17
+
+### Fixed
+- `Legion::CLI::Chat::WebFetch#convert_links!` polynomial regex on uncontrolled data (CodeQL `rb/polynomial-redos`) — replaced backtracking `<a[^>]*href=...>` regex with index-based scanner that walks tag boundaries without backtracking
+- Thor `[WARNING] Attempted to create command` noise during rspec — prepend `RSpec::Mocks::AnyInstance::Recorder` to wrap `observe!`, `mark_invoked!`, `restore_original_method!`, and `remove_dummy_method!` inside `Thor.no_commands_context` when the target class is a Thor subclass
+
+## [1.8.9] - 2026-04-17
+
+### Fixed
+- `Legion::DigitalWorker::Registry#emit_blocked` passed positional hash to `Legion::Events.emit` which expects kwargs — caused `ArgumentError` masking intended domain exceptions (`WorkerNotFound`, `WorkerNotActive`, `InsufficientConsent`). Fixes #114
+
+### Added
+- `Legion::Audit::HashChain` now includes `seq` in `CANONICAL_FIELDS` and `verify_chain` detects gaps in sequence numbers, preventing undetected record deletion from the tamper-evident audit chain. Backwards-compatible: gap check is skipped when `seq` is absent. Fixes #149
+
+## [1.8.8] - 2026-04-17
+
+### Fixed
+- `Legion::Ingress` code injection (CodeQL `rb/code-injection`) — replaced `Kernel.const_get` with allowlist lookup against registered extension modules; `resolve_runner_class` now only resolves classes present in `loaded_extension_modules` or `local_tasks`
+- `Legion::Graph::Exporter#to_dot` incomplete string escaping (CodeQL `rb/incomplete-sanitization`) — extracted `dot_escape` helper using char-by-char escaping of backslashes and quotes for DOT labels
+- `Legion::CLI::Chat::WebFetch#strip_invisible!` polynomial regex / incomplete sanitization / bad tag filter (CodeQL `rb/polynomial-redos`, `rb/incomplete-multi-character-sanitization`, `rb/bad-tag-filter`) — replaced regex `gsub!` with iterative `strip_tag_blocks!` that finds open/close tags by index, eliminating backtracking and handling malformed closing tags
+
+## [1.8.7] - 2026-04-17
+
+### Fixed
+- `Legion::CLI::Chat::WebSearch#extract_real_url` incomplete URL substring sanitization (CodeQL `rb/incomplete-url-substring-sanitization`) — replaced `include?('duckduckgo.com')` with `URI.parse` host check using `end_with?`
+- `Legion::Tools::EmbeddingCache.clear` now flushes L1/L2 cache tiers in addition to L0 memory, preventing stale lookups after clear
+
 ## [1.8.6] - 2026-04-15
 
 ### Added

data/CLAUDE.md

@@ -1,7 +1,7 @@
 # LegionIO: Async Job Engine and Task Framework
 
 **Repository Level 3 Documentation**
-- **Parent**: `/Users/miverso2/rubymine/legion/CLAUDE.md`
+- **Parent**: `../CLAUDE.md`
 
 ## Purpose
 
@@ -9,7 +9,7 @@ The primary gem for the LegionIO framework. An extensible async job engine for s
 
 **GitHub**: https://github.com/LegionIO/LegionIO
 **Gem**: `legionio`
-**Version**: 1.7.34
+**Version**: 1.8.12
 **License**: Apache-2.0
 **Docker**: `legionio/legion`
 **Ruby**: >= 3.4
@@ -796,6 +796,8 @@ bundle exec rspec       # ~3500+ examples, 0 failures
 bundle exec rubocop     # 0 offenses
 ```
 
+**Always run a full `bundle exec rspec` and `bundle exec rubocop -A` and fix all errors before committing.**
+
 Specs use `rack-test` for API testing. `Legion::JSON.load` returns symbol keys — use `body[:data]` not `body['data']` in specs.
 
 ---

data/CODEOWNERS

@@ -1,5 +1,5 @@
 # Default owner — all files
-* @Esity
+* @Esity @LegionIO/core
 
 # Core library code
 # lib/ @Esity @future-core-team

data/README.md

@@ -14,7 +14,11 @@ Schedule tasks, chain services into dependency graphs, run them concurrently via
          ╰──────────────────────────────────────╯
 ```
 
-**Ruby >= 3.4** | **v1.7.21** | **Apache-2.0** | [@Esity](https://github.com/Esity)
+[![Gem Version](https://img.shields.io/gem/v/legionio.svg)](https://rubygems.org/gems/legionio)
+[![Ruby](https://img.shields.io/badge/ruby-%3E%3D%203.4-red.svg)](https://www.ruby-lang.org/)
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
+
+**Ruby >= 3.4** | **v1.8.12** | **Apache-2.0** | [@Esity](https://github.com/Esity)
 
 ---
 
@@ -547,10 +551,34 @@ Each phase registers with `Legion::Readiness`. All phases are individually toggl
 git clone https://github.com/LegionIO/LegionIO.git
 cd LegionIO
 bundle install
-bundle exec rspec       # 0 failures
+bundle exec rspec       # ~3500+ examples, 0 failures
 bundle exec rubocop     # 0 offenses
 ```
 
+Always run `bundle exec rspec` and `bundle exec rubocop -A` and fix all errors before committing.
+
+### Project Structure
+
+| Path | Purpose |
+|------|---------|
+| `lib/legion.rb` | Entry point: `Legion.start`, `.shutdown`, `.reload` |
+| `lib/legion/service.rb` | 15-phase startup orchestrator |
+| `lib/legion/cli.rb` | Thor CLI: 40+ subcommands across two binaries |
+| `lib/legion/api.rb` | Sinatra REST API with middleware stack |
+| `lib/legion/extensions/` | LEX discovery, loading, actors, builders |
+| `lib/legion/tools/` | Canonical tool layer (Registry, Discovery, EmbeddingCache) |
+| `lib/legion/digital_worker/` | AI-as-labor governance platform |
+| `lib/legion/cli/chat/` | Interactive AI REPL with 40 tools |
+| `spec/` | RSpec suite (~3500+ examples) |
+
+### Contributing
+
+1. Fork the repo and create a feature branch
+2. Write specs for new functionality
+3. Ensure `bundle exec rspec` passes with 0 failures
+4. Ensure `bundle exec rubocop` passes with 0 offenses
+5. Open a PR targeting `main`
+
 ## License
 
 Apache-2.0

data/lib/legion/api/llm.rb

@@ -2,6 +2,9 @@
 
 require 'securerandom'
 require 'open3'
+require 'resolv'
+require 'ipaddr'
+require 'uri'
 
 module Legion
   class API < Sinatra::Base
@@ -69,9 +72,36 @@ module Legion
                     Dir.glob(pattern).first(100).join("\n")
                   when 'web_fetch'
                     url = kwargs[:url] || kwargs.values.first.to_s
-                    require 'net/http'
-                    uri = URI(url)
-                    Net::HTTP.get(uri)
+                    raw_length = (kwargs[:maxLength] || kwargs[:max_length])&.to_i
+                    max_length = raw_length&.positive? ? raw_length : nil
+                    parsed = begin
+                      URI.parse(url)
+                    rescue StandardError
+                      nil
+                    end
+                    raise 'Invalid or non-HTTP URL' unless parsed.is_a?(URI::HTTP)
+
+                    addr = begin
+                      ::Resolv.getaddress(parsed.host)
+                    rescue StandardError
+                      nil
+                    end
+                    if addr
+                      ip = ::IPAddr.new(addr)
+                      raise 'SSRF: private/loopback targets are not permitted' if
+                        ip.loopback? || ip.private? || ip.link_local?
+                    end
+                    require 'legion/cli/chat/web_fetch'
+                    content = Legion::CLI::Chat::WebFetch.fetch(url)
+                    max_length ? content[0, max_length] : content
+                  when 'web_search'
+                    query = kwargs[:query] || kwargs.values.first.to_s
+                    raw_results = (kwargs[:max_results] || kwargs[:maxResults]).to_i
+                    max_results = raw_results.positive? ? [raw_results, 50].min : 5
+                    require 'legion/cli/chat/web_search'
+                    results = Legion::CLI::Chat::WebSearch.search(query, max_results: max_results,
+                                                                         auto_fetch:  false)
+                    results[:results].map { |r| "### #{r[:title]}\n#{r[:url]}\n#{r[:snippet]}" }.join("\n\n")
                   else
                     "Tool #{tool_ref} is not executable server-side. Use a legion_ prefixed tool instead."
                   end

data/lib/legion/audit/hash_chain.rb

@@ -7,7 +7,7 @@ module Legion
     module HashChain
       ALGORITHM = 'SHA256'
       GENESIS_HASH = ('0' * 64).freeze
-      CANONICAL_FIELDS = %i[principal_id action resource source status detail created_at previous_hash].freeze
+      CANONICAL_FIELDS = %i[seq principal_id action resource source status detail created_at previous_hash].freeze
 
       module_function
 
@@ -23,7 +23,10 @@ module Legion
       def verify_chain(records)
         broken = []
         records.each_cons(2) do |prev, curr|
-          broken << { id: curr[:id], expected: prev[:record_hash], got: curr[:previous_hash] } unless curr[:previous_hash] == prev[:record_hash]
+          unless curr[:previous_hash] == prev[:record_hash]
+            broken << { id: curr[:id], type: :broken_link, expected: prev[:record_hash], got: curr[:previous_hash] }
+          end
+          broken << { id: curr[:id], type: :gap, expected_seq: prev[:seq] + 1, got_seq: curr[:seq] } if prev[:seq] && curr[:seq] && curr[:seq] != prev[:seq] + 1
         end
         { valid: broken.empty?, broken_links: broken, records_checked: records.size }
       end

data/lib/legion/cli/chat/web_fetch.rb

@@ -93,46 +93,175 @@ module Legion
         end
 
         def strip_invisible!(text)
-          text.gsub!(%r{<script[^>]*>.*?</script>}mi, '')
-          text.gsub!(%r{<style[^>]*>.*?</style>}mi, '')
-          text.gsub!(%r{<nav[^>]*>.*?</nav>}mi, '')
-          text.gsub!(%r{<footer[^>]*>.*?</footer>}mi, '')
-          text.gsub!(/<!--.*?-->/m, '')
+          %w[script style nav footer].each { |tag| strip_tag_blocks!(text, tag) }
+          strip_html_comments!(text)
+        end
+
+        def strip_html_comments!(text)
+          loop do
+            open_idx = text.index('<!--')
+            break unless open_idx
+
+            close_idx = text.index('-->', open_idx + 4)
+            if close_idx
+              text[open_idx..(close_idx + 2)] = ''
+            else
+              text[open_idx..] = ''
+            end
+          end
+        end
+
+        def strip_tag_blocks!(text, tag)
+          loop do
+            open_idx = text.index(/<#{tag}[\s>]/mi)
+            break unless open_idx
+
+            close_pat = %r{</#{tag}\s*>}mi
+            close_match = close_pat.match(text, open_idx)
+            if close_match
+              text[open_idx..(close_match.end(0) - 1)] = ''
+            else
+              text[open_idx..] = ''
+            end
+          end
+        end
+
+        def replace_tag_blocks!(text, tag)
+          loop do
+            open_idx = text.index(/<#{tag}[\s>]/mi)
+            break unless open_idx
+
+            tag_end = text.index('>', open_idx)
+            break unless tag_end
+
+            close_pat = %r{</#{tag}\s*>}mi
+            close_match = close_pat.match(text, tag_end)
+            if close_match
+              inner = text[(tag_end + 1)...close_match.begin(0)]
+              replacement = yield(inner)
+              text[open_idx..(close_match.end(0) - 1)] = replacement
+            else
+              text[open_idx..] = ''
+            end
+          end
+        end
+
+        def replace_open_tags!(text, tag, replacement)
+          loop do
+            idx = text.index(/<#{tag}[\s>]/mi)
+            break unless idx
+
+            close = text.index('>', idx)
+            break unless close
+
+            text[idx..close] = replacement
+          end
+        end
+
+        def replace_close_tags!(text, tag, replacement)
+          pat = %r{</#{tag}\s*>}mi
+          loop do
+            match = pat.match(text)
+            break unless match
+
+            text[match.begin(0)..(match.end(0) - 1)] = replacement
+          end
+        end
+
+        def replace_self_closing!(text, tag, replacement)
+          loop do
+            idx = text.index(%r{<#{tag}[\s>/]}mi)
+            break unless idx
+
+            close = text.index('>', idx)
+            break unless close
+
+            text[idx..close] = replacement
+          end
         end
 
         def convert_headings!(text)
           (1..6).each do |n|
             prefix = '#' * n
-            text.gsub!(%r{<h#{n}[^>]*>(.*?)</h#{n}>}mi, "\n#{prefix} \\1\n")
+            replace_tag_blocks!(text, "h#{n}") { |inner| "\n#{prefix} #{inner}\n" }
           end
         end
 
         def convert_links!(text)
-          text.gsub!(%r{<a[^>]*href=["']([^"']*)["'][^>]*>(.*?)</a>}mi, '[\\2](\\1)')
+          result = String.new
+          pos = 0
+          while pos < text.length
+            open_idx = text.index(/<a[\s>]/mi, pos)
+            break unless open_idx
+
+            close_idx = text.index(%r{</a\s*>}mi, open_idx)
+            unless close_idx
+              result << text[pos..]
+              pos = text.length
+              break
+            end
+
+            result << text[pos...open_idx]
+
+            tag_end = text.index('>', open_idx)
+            if tag_end && tag_end < close_idx
+              tag = text[open_idx..tag_end]
+              href = tag[/href=["']([^"']*)["']/i, 1]
+              inner = text[(tag_end + 1)...close_idx]
+              result << if href
+                          "[#{inner}](#{href})"
+                        else
+                          inner
+                        end
+            else
+              # Malformed opening tag — preserve the inner text up to the closing tag
+              result << text[open_idx...close_idx]
+            end
+
+            close_end = text.index('>', close_idx)
+            pos = close_end ? close_end + 1 : close_idx + 4
+          end
+          result << text[pos..] if pos < text.length
+          text.replace(result)
         end
 
         def convert_lists!(text)
-          text.gsub!(%r{<li[^>]*>(.*?)</li>}mi, "\n- \\1")
-          text.gsub!(%r{</?[ou]l[^>]*>}mi, "\n")
+          replace_tag_blocks!(text, 'li') { |inner| "\n- #{inner}" }
+          replace_open_tags!(text, 'ul', "\n")
+          replace_close_tags!(text, 'ul', "\n")
+          replace_open_tags!(text, 'ol', "\n")
+          replace_close_tags!(text, 'ol', "\n")
         end
 
         def convert_formatting!(text)
-          text.gsub!(%r{<(b|strong)[^>]*>(.*?)</\1>}mi, '**\\2**')
-          text.gsub!(%r{<(i|em)[^>]*>(.*?)</\1>}mi, '*\\2*')
-          text.gsub!(%r{<code[^>]*>(.*?)</code>}mi, '`\\1`')
+          %w[b strong].each { |t| replace_tag_blocks!(text, t) { |inner| "**#{inner}**" } }
+          %w[i em].each { |t| replace_tag_blocks!(text, t) { |inner| "*#{inner}*" } }
+          replace_tag_blocks!(text, 'code') { |inner| "`#{inner}`" }
         end
 
         def convert_blocks!(text)
-          text.gsub!(%r{<pre[^>]*>(.*?)</pre>}mi, "\n```\n\\1\n```\n")
-          text.gsub!(%r{<blockquote[^>]*>(.*?)</blockquote>}mi, "\n> \\1\n")
-          text.gsub!(/<p[^>]*>/mi, "\n\n")
-          text.gsub!(%r{</p>}mi, "\n")
-          text.gsub!(%r{<br\s*/?>}, "\n")
-          text.gsub!(%r{<hr\s*/?>}, "\n---\n")
+          replace_tag_blocks!(text, 'pre') { |inner| "\n```\n#{inner}\n```\n" }
+          replace_tag_blocks!(text, 'blockquote') { |inner| "\n> #{inner}\n" }
+          replace_open_tags!(text, 'p', "\n\n")
+          replace_close_tags!(text, 'p', "\n")
+          replace_self_closing!(text, 'br', "\n")
+          replace_self_closing!(text, 'hr', "\n---\n")
         end
 
         def strip_remaining_tags!(text)
-          text.gsub!(/<[^>]+>/, '')
+          result = String.new(capacity: text.length)
+          pos = 0
+          while pos < text.length
+            open_idx = text.index('<', pos)
+            unless open_idx
+              result << text[pos..]
+              break
+            end
+            result << text[pos...open_idx]
+            close_idx = text.index('>', open_idx)
+            pos = close_idx ? close_idx + 1 : text.length
+          end
+          text.replace(result)
         end
 
         def clean_whitespace(text)

data/lib/legion/cli/chat/web_search.rb

@@ -78,7 +78,8 @@ module Legion
         end
 
         def extract_real_url(ddg_url)
-          return ddg_url unless ddg_url.include?('duckduckgo.com')
+          uri = URI.parse(ddg_url)
+          return ddg_url unless uri.host&.end_with?('.duckduckgo.com') || uri.host == 'duckduckgo.com'
 
           match = ddg_url.match(/uddg=([^&]+)/)
           return nil unless match

data/lib/legion/cli/generate_command.rb

@@ -398,11 +398,11 @@ module Legion
                       pattern :url, #{escaped_pat}
                       description 'TODO: describe what this absorber handles'
 
-                      def handle(url: nil, content: nil, metadata: {}, context: {})
+                      def absorb(url: nil, content: nil, metadata: {}, context: {})
                         report_progress(message: 'starting absorption')
 
                         # TODO: implement content acquisition and processing
-                        # absorb_to_knowledge(content: text, tags: ['tag'])
+                        # absorb_to_knowledge(content: content, tags: ['tag'])
 
                         report_progress(message: 'done', percent: 100)
                         { success: true }

data/lib/legion/digital_worker/registry.rb

@@ -57,11 +57,10 @@ module Legion
       def self.emit_blocked(worker_id:, reason:)
         return unless defined?(Legion::Events)
 
-        Legion::Events.emit('worker.blocked', {
-                              worker_id: worker_id,
-                              reason:    reason,
-                              at:        Time.now.utc
-                            })
+        Legion::Events.emit('worker.blocked',
+                            worker_id: worker_id,
+                            reason:    reason,
+                            at:        Time.now.utc)
       end
 
       private_class_method :emit_blocked

data/lib/legion/extensions/absorbers/base.rb

@@ -37,12 +37,17 @@ module Legion
           raise NotImplementedError, "#{self.class.name} must implement #absorb"
         end
 
-        # @deprecated Use #absorb instead
-        alias handle absorb
+        # @deprecated Use {#absorb} instead. Will be removed in a future major release.
+        def handle(url: nil, content: nil, metadata: {}, context: {})
+          Legion::Logging.warn("#{self.class.name}#handle is deprecated — use #absorb instead") if defined?(Legion::Logging)
+          absorb(url: url, content: content, metadata: metadata, context: context)
+        end
 
         def absorb_to_knowledge(content:, tags: [], scope: :global, **opts)
           return fallback_absorb(:chunker, content, tags, scope, opts) unless chunker_available?
-          return fallback_absorb(:apollo, content, tags, scope, opts) unless apollo_available?
+
+          target = resolve_apollo_target(scope)
+          return fallback_absorb(:apollo, content, tags, scope, opts) unless target
 
           sections = [{ heading:      opts.delete(:heading) || 'absorbed',
                         content:      content,
@@ -54,11 +59,27 @@ module Legion
         end
 
         def absorb_raw(content:, tags: [], scope: :global, **)
-          if apollo_available?
-            Legion::Apollo.ingest(content: content, tags: Array(tags), scope: scope, **)
+          target = resolve_apollo_target(scope)
+          unless target
+            Legion::Logging.warn("absorb_raw: Apollo not available for scope=#{scope}") if defined?(Legion::Logging)
+            return { success: false, error: :apollo_not_available }
+          end
+
+          target.ingest(content: content, tags: Array(tags), scope: scope, **)
+        end
+
+        def query_knowledge(text:, limit: 5, scope: :all, **)
+          case scope.to_sym
+          when :local
+            return { success: false, error: :apollo_not_available } unless apollo_local_available?
+
+            Legion::Apollo::Local.query(text: text, limit: limit, **)
+          when :global
+            return { success: false, error: :apollo_not_available } unless apollo_available?
+
+            Legion::Apollo.query(text: text, limit: limit, **)
           else
-            Legion::Logging.warn('absorb_raw: Apollo not available') if defined?(Legion::Logging)
-            { success: false, error: :apollo_not_available }
+            query_all_scopes(text: text, limit: limit, **)
           end
         end
 
@@ -107,6 +128,46 @@ module Legion
             (!Legion::Apollo.respond_to?(:started?) || Legion::Apollo.started?)
         end
 
+        def apollo_local_available?
+          defined?(Legion::Apollo::Local) &&
+            Legion::Apollo::Local.respond_to?(:ingest) &&
+            (!Legion::Apollo::Local.respond_to?(:started?) || Legion::Apollo::Local.started?)
+        rescue NameError
+          false
+        end
+
+        def resolve_apollo_target(scope)
+          case scope.to_sym
+          when :local
+            apollo_local_available? ? Legion::Apollo::Local : nil
+          else
+            apollo_available? ? Legion::Apollo : nil
+          end
+        end
+
+        def query_all_scopes(text:, limit:, **)
+          local_results  = apollo_local_available? ? Array((Legion::Apollo::Local.query(text: text, limit: limit, **) || {})[:results]) : []
+          global_results = apollo_available? ? Array((Legion::Apollo.query(text: text, limit: limit, **) || {})[:results]) : []
+
+          if local_results.empty? && global_results.empty? && !apollo_local_available? && !apollo_available?
+            return { success: false, error: :apollo_not_available }
+          end
+
+          seen = {}
+          merged = []
+          local_results.each do |r|
+            key = r[:content_hash] || r[:content]
+            seen[key] = true
+            merged << r
+          end
+          global_results.each do |r|
+            key = r[:content_hash] || r[:content]
+            merged << r unless seen[key]
+          end
+
+          { success: true, results: merged.first(limit), count: [merged.size, limit].min, scope: :all }
+        end
+
         def fallback_absorb(reason, content, tags, scope, opts)
           if defined?(Legion::Logging)
             label = reason == :chunker ? 'lex-knowledge not available' : 'Apollo not available'
@@ -124,12 +185,15 @@ module Legion
         end
 
         def ingest_chunks(chunks, embeddings, tags, scope, opts)
+          target = resolve_apollo_target(scope)
+          return unless target
+
           chunks.each_with_index do |chunk, idx|
             vector  = embeddings.is_a?(Array) ? embeddings.dig(idx, :vector) : nil
             payload = build_chunk_payload(chunk, tags, opts)
             payload[:embedding] = vector if vector
-            Legion::Apollo.ingest(content: payload[:content], tags: payload[:tags],
-                                  scope: scope, **payload.except(:content, :tags))
+            target.ingest(content: payload[:content], tags: payload[:tags],
+                          scope: scope, **payload.except(:content, :tags))
           end
         end
 

data/lib/legion/extensions/absorbers.rb

@@ -2,6 +2,7 @@
 
 require_relative 'absorbers/matchers/base'
 require_relative 'absorbers/matchers/url'
+require_relative 'absorbers/matchers/file'
 require_relative 'absorbers/base'
 require_relative 'absorbers/pattern_matcher'
 

data/lib/legion/extensions/actors/subscription.rb

@@ -20,6 +20,13 @@ module Legion
         define_dsl_accessor :delay_start, default: 0
         define_dsl_accessor :block, default: false
         define_dsl_accessor :prefetch, default: 2
+        define_dsl_accessor :routing_key_hint, default: nil
+
+        def self.pattern(routing_key = nil)
+          return routing_key_hint unless routing_key
+
+          routing_key_hint(routing_key)
+        end
 
         def initialize(**_options)
           super()

data/lib/legion/graph/exporter.rb

@@ -37,19 +37,37 @@ module Legion
           lines = ['digraph legion_tasks {', '  rankdir=LR;']
 
           graph[:nodes].each do |key, node|
-            label = node[:label].gsub('"', '\\"')
+            label = dot_escape(node[:label])
             shape = node[:type] == 'trigger' ? 'box' : 'ellipse'
             lines << "  \"#{key}\" [label=\"#{label}\" shape=#{shape}];"
           end
 
           graph[:edges].each do |edge|
-            label = edge[:label] && !edge[:label].empty? ? " [label=\"#{edge[:label]}\"]" : ''
+            escaped = dot_escape(edge[:label])
+            label = escaped && !escaped.empty? ? " [label=\"#{escaped}\"]" : ''
             lines << "  \"#{edge[:from]}\" -> \"#{edge[:to]}\"#{label};"
           end
 
           lines << '}'
           lines.join("\n")
         end
+
+        private
+
+        def dot_escape(str)
+          return str unless str.is_a?(String)
+
+          result = String.new(capacity: str.length)
+          str.each_char do |ch|
+            escaped = case ch
+                      when '\\' then '\\\\'
+                      when '"'  then '\\"'
+                      else ch
+                      end
+            result << escaped
+          end
+          result
+        end
       end
     end
   end

data/lib/legion/ingress.rb

@@ -79,18 +79,23 @@ module Legion
 
         Legion::Events.emit('ingress.received', runner_class: rc.to_s, function: fn, source: source)
 
+        resolved_rc = begin
+          resolve_runner_class(rc)
+        rescue InvalidRunnerClass
+          rc
+        end
+
         if local_runner?(rc)
           Legion::Logging.debug "[Ingress] local short-circuit: #{rc}.#{fn}" if defined?(Legion::Logging)
-          klass = rc.is_a?(String) ? Kernel.const_get(rc) : rc
           ctx = message.merge(runner_class: rc.to_s, function: fn.to_s)
-          return Legion::Context.with_task_context(ctx) { klass.send(fn.to_sym, **message) }
+          return Legion::Context.with_task_context(ctx) { resolved_rc.send(fn.to_sym, **message) }
         end
 
         runner_block = lambda {
           ctx = message.merge(runner_class: rc.to_s, function: fn.to_s)
           Legion::Context.with_task_context(ctx) do
             Legion::Runner.run(
-              runner_class:  rc,
+              runner_class:  resolved_rc,
               function:      fn,
               check_subtask: check_subtask,
               generate_task: generate_task,
@@ -127,14 +132,47 @@ module Legion
       def local_runner?(runner_class)
         return false unless defined?(Legion::Extensions) && Legion::Extensions.local_tasks.is_a?(Array)
 
-        klass = runner_class.is_a?(String) ? Kernel.const_get(runner_class) : runner_class
+        klass = resolve_runner_class(runner_class)
         Legion::Extensions.local_tasks.any? { |t| t[:runner_module] == klass }
-      rescue NameError
+      rescue NameError, InvalidRunnerClass
         false
       end
 
       private
 
+      def resolve_runner_class(runner_class)
+        return runner_class unless runner_class.is_a?(String)
+
+        raise InvalidRunnerClass, "invalid runner_class format: #{runner_class}" unless runner_class.match?(RUNNER_CLASS_PATTERN)
+
+        resolved = registered_runner_modules[runner_class]
+        raise InvalidRunnerClass, "unregistered runner_class: #{runner_class}" unless resolved
+
+        resolved
+      end
+
+      def registered_runner_modules
+        return @registered_runner_modules if defined?(@registered_runner_modules) && @registered_runner_modules
+
+        modules = {}
+        if defined?(Legion::Extensions) && Legion::Extensions.respond_to?(:loaded_extension_modules)
+          Legion::Extensions.loaded_extension_modules.each do |mod|
+            modules[mod.to_s] = mod
+          end
+        end
+        if defined?(Legion::Extensions) && Legion::Extensions.local_tasks.is_a?(Array)
+          Legion::Extensions.local_tasks.each do |t|
+            mod = t[:runner_module]
+            modules[mod.to_s] = mod if mod
+          end
+        end
+        @registered_runner_modules = modules
+      end
+
+      def reset_runner_cache!
+        @registered_runner_modules = nil
+      end
+
       def parse_payload(payload)
         case payload
         when Hash

data/lib/legion/tools/embedding_cache.rb

@@ -172,6 +172,7 @@ module Legion
 
         def clear
           clear_memory
+          clear_cache_tiers
         rescue StandardError => e
           handle_exception(e, level: :warn, handled: true, operation: :embedding_cache_clear)
         end
@@ -244,6 +245,13 @@ module Legion
           false
         end
 
+        def clear_cache_tiers
+          Legion::Cache.local.flush if cache_local_available? && Legion::Cache.local.respond_to?(:flush)
+          Legion::Cache.flush if cache_global_available? && Legion::Cache.respond_to?(:flush)
+        rescue StandardError => e
+          handle_exception(e, level: :debug, handled: true, operation: :clear_cache_tiers)
+        end
+
         # --- Cache tier helpers ---
         def cache_local_get(key)
           return nil unless cache_local_available?

data/lib/legion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Legion
-  VERSION = '1.8.6'
+  VERSION = '1.8.14'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legionio
 version: !ruby/object:Gem::Version
-  version: 1.8.6
+  version: 1.8.14
 platform: ruby
 authors:
 - Esity
@@ -406,6 +406,7 @@ files:
 - ".github/workflows/publish-homebrew.yml"
 - ".gitignore"
 - ".rubocop.yml"
+- AGENTS.md
 - CHANGELOG.md
 - CLAUDE.md
 - CODEOWNERS
@@ -417,9 +418,6 @@ files:
 - completions/_legionio
 - completions/legion.bash
 - completions/legionio.bash
-- config/tls/README.md
-- config/tls/generate-certs.sh
-- config/tls/settings-tls.json
 - deploy/helm/legion/Chart.yaml
 - deploy/helm/legion/templates/_helpers.tpl
 - deploy/helm/legion/templates/deployment-api.yaml
@@ -430,7 +428,6 @@ files:
 - deploy/helm/legion/templates/serviceaccount.yaml
 - deploy/helm/legion/values.yaml
 - docker_deploy.rb
-- docs/README.md
 - exe/legion
 - exe/legionio
 - extensions-agentic/lex-consent/db/migrations/001_create_consent_maps.rb

data/config/tls/README.md

@@ -1,31 +0,0 @@
-# LegionIO TLS Configuration
-
-Quick-start guide for enabling TLS on all LegionIO components.
-
-## Generating Dev Certificates
-
-```bash
-sudo ./generate-certs.sh /etc/legionio/tls
-```
-
-Requires `openssl` in PATH. Creates:
-- `ca.pem` / `ca.key` — self-signed CA
-- `server.crt` / `server.key` — server certificate (localhost + 127.0.0.1 SAN)
-- `client.crt` / `client.key` — client certificate
-
-## Applying the Settings
-
-Copy `settings-tls.json` to your LegionIO settings directory
-(`~/legionio/settings/` or `/etc/legionio/settings/`) and adjust paths.
-
-Feature flags (default false — plain connections preserved unless enabled):
-- `data.tls.enabled` — enables TLS for PostgreSQL/MySQL
-- `api.tls.enabled` — enables TLS for the Puma HTTP API
-
-## Validating
-
-```bash
-legion doctor
-```
-
-The TLS doctor check verifies: TLS enabled/verify mode, cert file existence, sslmode correctness.

data/config/tls/generate-certs.sh

@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Generates a self-signed CA and service certificates for local TLS development.
-# Usage: ./generate-certs.sh [output-dir]
-# Default output-dir: /etc/legionio/tls
-
-OUTPUT_DIR="${1:-/etc/legionio/tls}"
-DAYS=365
-CA_CN="LegionIO Dev CA"
-SERVER_CN="legionio-server"
-CLIENT_CN="legionio-client"
-
-mkdir -p "${OUTPUT_DIR}"
-
-echo "Generating CA key and certificate..."
-openssl genrsa -out "${OUTPUT_DIR}/ca.key" 4096
-openssl req -new -x509 \
-  -key "${OUTPUT_DIR}/ca.key" \
-  -out "${OUTPUT_DIR}/ca.pem" \
-  -days "${DAYS}" \
-  -subj "/CN=${CA_CN}/O=LegionIO/OU=Dev"
-
-echo "Generating server key and CSR..."
-openssl genrsa -out "${OUTPUT_DIR}/server.key" 2048
-openssl req -new \
-  -key "${OUTPUT_DIR}/server.key" \
-  -out "${OUTPUT_DIR}/server.csr" \
-  -subj "/CN=${SERVER_CN}/O=LegionIO/OU=Dev"
-
-echo "Signing server certificate with CA..."
-openssl x509 -req \
-  -in "${OUTPUT_DIR}/server.csr" \
-  -CA "${OUTPUT_DIR}/ca.pem" \
-  -CAkey "${OUTPUT_DIR}/ca.key" \
-  -CAcreateserial \
-  -out "${OUTPUT_DIR}/server.crt" \
-  -days "${DAYS}" \
-  -extfile <(printf "subjectAltName=DNS:localhost,IP:127.0.0.1")
-
-echo "Generating client key and CSR..."
-openssl genrsa -out "${OUTPUT_DIR}/client.key" 2048
-openssl req -new \
-  -key "${OUTPUT_DIR}/client.key" \
-  -out "${OUTPUT_DIR}/client.csr" \
-  -subj "/CN=${CLIENT_CN}/O=LegionIO/OU=Dev"
-
-echo "Signing client certificate with CA..."
-openssl x509 -req \
-  -in "${OUTPUT_DIR}/client.csr" \
-  -CA "${OUTPUT_DIR}/ca.pem" \
-  -CAkey "${OUTPUT_DIR}/ca.key" \
-  -CAcreateserial \
-  -out "${OUTPUT_DIR}/client.crt" \
-  -days "${DAYS}"
-
-chmod 600 "${OUTPUT_DIR}"/*.key
-rm -f "${OUTPUT_DIR}"/*.csr "${OUTPUT_DIR}"/*.srl
-
-echo ""
-echo "Certificates written to ${OUTPUT_DIR}:"
-ls -lh "${OUTPUT_DIR}"
-echo ""
-echo "Reference these paths in settings-tls.json or your legionio settings JSON."

data/config/tls/settings-tls.json

@@ -1,43 +0,0 @@
-{
-  "transport": {
-    "connection": {
-      "port": 5671
-    },
-    "tls": {
-      "enabled": true,
-      "verify": "peer",
-      "ca": "/etc/legionio/tls/ca.pem",
-      "cert": "/etc/legionio/tls/client.crt",
-      "key": "/etc/legionio/tls/client.key"
-    }
-  },
-  "data": {
-    "adapter": "postgres",
-    "tls": {
-      "enabled": true,
-      "sslmode": "verify-full",
-      "ca": "/etc/legionio/tls/ca.pem",
-      "cert": "/etc/legionio/tls/client.crt",
-      "key": "/etc/legionio/tls/client.key"
-    }
-  },
-  "cache": {
-    "adapter": "redis",
-    "tls": {
-      "enabled": true,
-      "verify": "peer",
-      "ca": "/etc/legionio/tls/ca.pem"
-    }
-  },
-  "api": {
-    "port": 4567,
-    "bind": "0.0.0.0",
-    "tls": {
-      "enabled": true,
-      "cert": "/etc/legionio/tls/server.crt",
-      "key": "/etc/legionio/tls/server.key",
-      "ca": "/etc/legionio/tls/ca.pem",
-      "verify": "peer"
-    }
-  }
-}

data/docs/README.md

@@ -1,6 +0,0 @@
-# Moved
-
-All documentation has been consolidated into the workspace-level docs repo:
-`/Users/miverso2/rubymine/legion/docs/`
-
-That repo is local-only (no remote) to prevent accidental leakage of private content.