rails_console_ai 0.35.0 → 0.38.0

data/app/views/rails_console_ai/artifacts/show.html.erb

@@ -0,0 +1,119 @@
+<div class="btn-bar">
+  <%= link_to '← All artifacts', artifacts_path, class: 'btn btn-secondary' %>
+  <%= link_to 'Download', download_artifact_path(@artifact.slug), class: 'btn' %>
+  <%= link_to 'Open raw', raw_artifact_path(@artifact.slug), class: 'btn btn-secondary', target: '_blank', rel: 'noopener noreferrer' %>
+  <%# Copies the artifact's source, exactly as stored. Fetches the raw URL on
+      click rather than embedding a second copy of the content in this page. %>
+  <button type="button" class="btn btn-secondary" id="copy-artifact"
+          data-url="<%= raw_artifact_path(@artifact.slug) %>"
+          title="Copy the artifact's content to the clipboard">Copy</button>
+  <%# button_to, not link_to: the engine layout loads no JavaScript, so a
+      data-method link would quietly do nothing. Matches skills/agents. %>
+  <span style="margin-left:auto;">
+    <%= button_to 'Delete', artifact_path(@artifact.slug), method: :delete,
+          class: 'btn btn-danger', form: { style: 'display:inline' },
+          data: { confirm: 'Delete this artifact? This cannot be undone.' } %>
+  </span>
+</div>
+
+<div class="meta-card">
+  <h2 style="font-size:18px; margin-bottom:4px;"><%= @artifact.name %></h2>
+  <% if @artifact.description.present? %>
+    <p class="text-muted" style="margin-bottom:16px;"><%= @artifact.description %></p>
+  <% end %>
+  <div class="meta-grid">
+    <div class="meta-item">
+      <label title="How the assistant addresses this artifact">Handle</label>
+      <span class="mono"><%= @artifact.slug %></span>
+    </div>
+    <div class="meta-item"><label>Revision</label><span><%= @artifact.revision %></span></div>
+    <div class="meta-item"><label>Type</label><span class="mono"><%= @artifact.content_type %></span></div>
+    <div class="meta-item"><label>Size</label><span><%= @artifact.human_size %></span></div>
+    <div class="meta-item"><label>Created by</label><span><%= @artifact.created_by || '—' %></span></div>
+    <div class="meta-item">
+      <label>Session</label>
+      <span>
+        <% if @artifact.session_id %>
+          <%= link_to "##{@artifact.session_id}", session_path(@artifact.session_id) %>
+        <% else %>
+          —
+        <% end %>
+      </span>
+    </div>
+    <div class="meta-item"><label>Created</label><span><%= @artifact.created_at.strftime('%Y-%m-%d %H:%M') %></span></div>
+    <div class="meta-item"><label>Updated</label><span><%= @artifact.updated_at.strftime('%Y-%m-%d %H:%M') %></span></div>
+  </div>
+</div>
+
+<% if @artifact.renderable? %>
+  <div class="meta-card" style="padding:0; overflow:hidden;">
+    <%#
+      Sandboxed with no allow-same-origin and no allow-scripts: the frame gets an
+      opaque origin, so even if the content carried a script it could not run, and
+      could not reach this page's session if it did. The same restrictions are set
+      as a CSP header on the raw response, which is what protects the "Open raw"
+      link where no iframe attribute applies.
+    %>
+    <iframe src="<%= raw_artifact_path(@artifact.slug) %>"
+            sandbox
+            referrerpolicy="no-referrer"
+            title="<%= @artifact.name %>"
+            style="width:100%; height:70vh; border:0; background:#fff; display:block;"></iframe>
+  </div>
+  <p class="text-muted" style="font-size:12px; margin-top:8px;">
+    Rendered in a sandboxed frame — scripts and network requests are blocked, so inline CSS shows but JavaScript will not run.
+  </p>
+<% else %>
+  <div class="terminal">
+    <pre><%= @artifact.content %></pre>
+  </div>
+<% end %>
+
+<%# The only JavaScript in the admin UI. nonce: true picks up the host app's CSP
+    nonce when it has one, and is a no-op otherwise. %>
+<%= javascript_tag nonce: true do %>
+  (function () {
+    var button = document.getElementById('copy-artifact');
+    if (!button) return;
+    var label = button.textContent;
+
+    function flash(text) {
+      button.textContent = text;
+      setTimeout(function () { button.textContent = label; }, 2000);
+    }
+
+    // navigator.clipboard needs a secure context (https or localhost). Over
+    // plain http elsewhere, fall back to the old textarea + execCommand route.
+    function writeClipboard(text) {
+      if (navigator.clipboard && window.isSecureContext) {
+        return navigator.clipboard.writeText(text);
+      }
+      return new Promise(function (resolve, reject) {
+        var area = document.createElement('textarea');
+        area.value = text;
+        area.setAttribute('readonly', '');
+        area.style.position = 'fixed';
+        area.style.top = '-1000px';
+        document.body.appendChild(area);
+        area.select();
+        var ok = false;
+        try { ok = document.execCommand('copy'); } catch (e) { ok = false; }
+        document.body.removeChild(area);
+        ok ? resolve() : reject(new Error('execCommand copy failed'));
+      });
+    }
+
+    button.addEventListener('click', function () {
+      button.disabled = true;
+      fetch(button.getAttribute('data-url'), { credentials: 'same-origin' })
+        .then(function (response) {
+          if (!response.ok) throw new Error('HTTP ' + response.status);
+          return response.text();
+        })
+        .then(writeClipboard)
+        .then(function () { flash('Copied'); })
+        .catch(function () { flash('Copy failed'); })
+        .then(function () { button.disabled = false; });
+    });
+  })();
+<% end %>

data/app/views/rails_console_ai/sessions/show.html.erb

@@ -36,6 +36,12 @@
         <span><%= @session.slack_channel_name %></span>
       </div>
     <% end %>
+    <% if @session.try(:slack_thread_ts).present? %>
+      <div class="meta-item">
+        <label>Slack Thread</label>
+        <span class="mono"><%= @session.slack_thread_ts %></span>
+      </div>
+    <% end %>
     <div class="meta-item">
       <label>Provider / Model</label>
       <span><%= @session.provider %> / <%= @session.model %></span>

data/config/routes.rb

@@ -2,6 +2,14 @@ RailsConsoleAi::Engine.routes.draw do
   root to: 'sessions#index'
   resources :sessions, only: [:index, :show]
 
+  # Addressed by token, not id — see ArtifactsController#load_artifact.
+  resources :artifacts, only: [:index, :show, :destroy] do
+    member do
+      get :raw
+      get :download
+    end
+  end
+
   resources :skills do
     member do
       post :approve

data/lib/generators/rails_console_ai/templates/initializer.rb

@@ -1,5 +1,5 @@
 RailsConsoleAi.configure do |config|
-  # LLM provider: :anthropic, :openai, or :local
+  # LLM provider: :anthropic, :openai, :openrouter, :bedrock, or :local
   config.provider = :anthropic
 
   # API key (or set ANTHROPIC_API_KEY / OPENAI_API_KEY env var)
@@ -32,6 +32,12 @@ RailsConsoleAi.configure do |config|
   # config.local_model = 'qwen2.5:7b'
   # config.local_api_key = nil
 
+  # OpenRouter provider (400+ models via unified API):
+  # config.provider = :openrouter
+  # config.model = 'anthropic/claude-sonnet-5'
+  # config.openrouter_site_url = 'https://yoursite.com'  # optional, for attribution
+  # config.openrouter_app_name = 'MyApp'                # optional, shown on openrouter.ai
+
   # Slack: which users the bot responds to (legacy — prefer channels config below)
   # config.slack_allowed_usernames = ['alice', 'bob']
 
@@ -47,6 +53,11 @@ RailsConsoleAi.configure do |config|
   # Run RailsConsoleAi.setup! in the Rails console to create the table
   config.session_logging = true
 
+  # Public base URL of this app, so links the assistant hands out (artifact URLs)
+  # are absolute — a bare path is useless once pasted into Slack or opened on a
+  # phone. Falls back to the app's default_url_options, then to a relative path.
+  # config.base_url = 'https://secure.example.com'
+
   # Database connection for RailsConsoleAi tables (default: ActiveRecord::Base)
   # Set to a class that responds to .connection if tables live on a different DB
   # config.connection_class = Sharding::CentralizedModel

data/lib/rails_console_ai/channel/console.rb

@@ -1,5 +1,6 @@
-require 'readline'
 require 'rails_console_ai/channel/base'
+require 'rails_console_ai/line_editor'
+require 'rails_console_ai/slash_commands'
 
 module RailsConsoleAi
   module Channel
@@ -186,6 +187,16 @@ module RailsConsoleAi
         @interactive_console_capture = StringIO.new
         @real_stdout = $stdout
         $stdout = TeeIO.new(@real_stdout, @interactive_console_capture)
+        init_slash_commands
+      end
+
+      def init_slash_commands
+        @slash_commands = SlashCommands.new
+        # Point the editor at the real stdout: Reline draws its completion menu
+        # through a Ruby IO, and $stdout is a TeeIO right now — without this the
+        # menu's escape codes get written into the saved session log.
+        @editor = LineEditor.resolve(RailsConsoleAi.configuration.line_editor, output: @real_stdout)
+        @editor.complete_with { @slash_commands.completion_entries }
       end
 
       def run_interactive_loop
@@ -196,14 +207,13 @@ module RailsConsoleAi
         config = RailsConsoleAi.configuration
         @real_stdout.puts "\e[2m  Provider: #{config.provider} | Model: #{config.resolved_model}\e[0m"
         safe_info = guards.empty? ? '' : " | Safe mode: #{guards.enabled? ? 'ON' : 'OFF'} (/danger to toggle)"
-        @real_stdout.puts "\e[2m  Auto-execute: #{auto ? 'ON' : 'OFF'} (Shift-Tab or /auto to toggle)#{safe_info} | > code | /usage | /cost | /compact | /think | /name <label>\e[0m"
+        @real_stdout.puts "\e[2m  Auto-execute: #{auto ? 'ON' : 'OFF'} (Shift-Tab or /auto to toggle)#{safe_info} | > code\e[0m"
+        @real_stdout.puts "\e[2m  Type / for commands, skills and agents#{@editor.is_a?(LineEditor::Reline_) ? ' (menu appears as you type)' : ' (Tab to complete)'}\e[0m"
 
-        if Readline.respond_to?(:parse_and_bind)
-          Readline.parse_and_bind('"\e[Z": "\C-a\C-k/auto\C-m"')
-        end
+        @editor.bind_auto_toggle
 
         loop do
-          input = Readline.readline("\001\e[33m\002ai> \001\e[0m\002", false)
+          input = @editor.readline(@editor.prompt('ai> ', "\e[33m"))
           break if input.nil?
 
           input = input.strip
@@ -211,8 +221,13 @@ module RailsConsoleAi
           break if input.downcase == 'exit' || input.downcase == 'quit'
           next if input.empty?
 
-          handled = handle_slash_command(input)
-          next if handled
+          # What the user typed, kept for history/logging even when a skill
+          # command expands into a much longer prompt.
+          typed = input
+
+          outcome = handle_slash_command(input)
+          next if outcome == :handled
+          input = outcome if outcome.is_a?(String)
 
           # Direct code execution with ">" prefix
           if input.start_with?('>') && !input.start_with?('>=')
@@ -220,14 +235,13 @@ module RailsConsoleAi
             next
           end
 
-          # Add to Readline history
-          Readline::HISTORY.push(input) unless input == Readline::HISTORY.to_a.last
+          @editor.push_history(typed)
 
           @engine.maybe_auto_upgrade_thinking(input)
 
-          @engine.set_interactive_query(input)
+          @engine.set_interactive_query(typed)
           @engine.add_user_message(input)
-          @interactive_console_capture.write("ai> #{input}\n")
+          @interactive_console_capture.write("ai> #{typed}\n")
           @engine.log_interactive_turn
 
           expected_stdout = $stdout
@@ -254,6 +268,9 @@ module RailsConsoleAi
 
           @engine.log_interactive_turn
           @engine.warn_if_history_large
+          # A turn may have created a skill or agent via save_skill/save_agent —
+          # drop the memo so the next "/" reflects it.
+          @slash_commands.refresh!
         end
 
         $stdout = @real_stdout
@@ -269,6 +286,9 @@ module RailsConsoleAi
         $stderr.puts "\e[31mRailsConsoleAi Error: #{e.class}: #{e.message}\e[0m"
       end
 
+      # Returns :handled when the command did its own thing, a String when it
+      # should be sent to the model as this turn's message, or nil when the input
+      # isn't a slash command at all.
       def handle_slash_command(input)
         case input
         when '?', '/'
@@ -301,6 +321,8 @@ module RailsConsoleAi
           @engine.upgrade_to_thinking_model
         when '/unthink'
           @engine.downgrade_from_thinking_model
+        when '/cheap'
+          @engine.switch_to_cheap_model
         when /\A\/expand/
           expand_id = input.sub('/expand', '').strip.to_i
           full_output = expand_output(expand_id)
@@ -314,9 +336,47 @@ module RailsConsoleAi
         when /\A\/name/
           handle_name_command(input)
         else
-          return false
+          return dispatch_registry_command(input)
+        end
+        :handled
+      end
+
+      # Skills and agents are addressed by a slug derived from their name:
+      # "Restart user trial" -> /restart-user-trial.
+      def dispatch_registry_command(input)
+        return nil unless input.start_with?('/')
+
+        slug, _, args = input[1..].partition(/\s+/)
+        command = @slash_commands.find(slug)
+
+        unless command
+          # Only claim the input if it actually looks like a command. A message
+          # that merely opens with a path ("/tmp/foo.log has the error") must
+          # still reach the model untouched.
+          return nil unless slug =~ /\A[a-z0-9][a-z0-9_-]*\z/
+          warn_unknown_command(slug)
+          return :handled
+        end
+
+        case command.kind
+        when :skill
+          @engine.skill_command_prompt(command.record, args)
+        when :agent
+          @engine.run_agent_command(command.record, args)
+          :handled
+        else
+          nil # a built-in, already handled by the case above
+        end
+      end
+
+      def warn_unknown_command(slug)
+        @real_stdout.puts "\e[33m  Unknown command: /#{slug}\e[0m"
+        near = @slash_commands.candidates.select { |c| c.start_with?("/#{slug[0, 3]}") }
+        if near.empty?
+          @real_stdout.puts "\e[2m  Type / to see everything available.\e[0m"
+        else
+          @real_stdout.puts "\e[2m  Did you mean: #{near.first(5).join(', ')}?\e[0m"
         end
-        true
       end
 
       def retry_last_code
@@ -325,7 +385,7 @@ module RailsConsoleAi
 
       def handle_direct_execution(input)
         raw_code = input.sub(/\A>\s?/, '')
-        Readline::HISTORY.push(input) unless input == Readline::HISTORY.to_a.last
+        @editor.push_history(input)
         @interactive_console_capture.write("ai> #{input}\n")
         @engine.execute_direct(raw_code)
         @engine.log_interactive_turn
@@ -367,13 +427,14 @@ module RailsConsoleAi
       def display_model_info
         config = RailsConsoleAi.configuration
         model = @engine.effective_model
-        thinking = config.resolved_thinking_model
         pricing = Configuration.pricing_for(model)
 
         @real_stdout.puts "\e[36m  Model info:\e[0m"
         @real_stdout.puts "\e[2m    Provider:        #{config.provider}\e[0m"
-        @real_stdout.puts "\e[2m    Model:           #{model}\e[0m"
-        @real_stdout.puts "\e[2m    Thinking model:  #{thinking}\e[0m"
+        @real_stdout.puts "\e[2m    Model:           #{@engine.effective_model_label} [#{@engine.model_tier}]\e[0m"
+        @real_stdout.puts "\e[2m    Default model:   #{model_with_effort(config.resolved_model, config.effort)}\e[0m"
+        @real_stdout.puts "\e[2m    Thinking model:  #{model_with_effort(config.resolved_thinking_model, config.thinking_effort)}\e[0m"
+        @real_stdout.puts "\e[2m    Cheap model:     #{config.resolved_cheap_model}\e[0m"
         @real_stdout.puts "\e[2m    Max tokens:      #{config.resolved_max_tokens}\e[0m"
         if pricing
           @real_stdout.puts "\e[2m    Pricing:         $#{pricing[:input] * 1_000_000}/M in, $#{pricing[:output] * 1_000_000}/M out\e[0m"
@@ -383,6 +444,12 @@ module RailsConsoleAi
         end
         @real_stdout.puts "\e[2m    Bedrock region:  #{config.bedrock_region}\e[0m" if config.provider == :bedrock
         @real_stdout.puts "\e[2m    Local URL:       #{config.local_url}\e[0m" if config.provider == :local
+        @real_stdout.puts "\e[2m    OpenRouter URL:  #{config.openrouter_url}\e[0m" if config.openrouter_url
+      end
+
+      def model_with_effort(model, effort)
+        effort = Configuration.effort_for(model, effort)
+        effort ? "#{model} (#{effort} effort)" : model
       end
 
       def handle_name_command(input)
@@ -412,6 +479,7 @@ module RailsConsoleAi
         @real_stdout.puts "\e[2m    /model       Show provider, model, and pricing info\e[0m"
         @real_stdout.puts "\e[2m    /think       Switch to thinking model\e[0m"
         @real_stdout.puts "\e[2m    /unthink     Switch back to default model\e[0m"
+        @real_stdout.puts "\e[2m    /cheap       Switch to the cheaper, faster model\e[0m"
         @real_stdout.puts "\e[2m    /compact     Summarize conversation to reduce context\e[0m"
         @real_stdout.puts "\e[2m    /usage       Show session token totals\e[0m"
         @real_stdout.puts "\e[2m    /cost        Show cost estimate by model\e[0m"
@@ -424,6 +492,52 @@ module RailsConsoleAi
         @real_stdout.puts "\e[2m    > code       Execute Ruby directly (skip LLM)\e[0m"
         @real_stdout.puts "\e[2m    Ctrl-C       Cancel the current operation\e[0m"
         @real_stdout.puts "\e[2m    exit/quit    Leave interactive mode\e[0m"
+        display_registry_help
+      end
+
+      # Skills and agents, listed the same way as the built-ins so "/" answers
+      # "what can I run?" in one place.
+      def display_registry_help
+        @slash_commands.refresh!
+
+        skills = @slash_commands.skills
+        agents = @slash_commands.agents
+        # Size the column to what's actually listed, and don't let one very long
+        # name push every description off the right edge.
+        width = [(skills + agents).map { |c| c.slug.length }.max.to_i + 2, 34].min
+
+        unless skills.empty?
+          @real_stdout.puts
+          @real_stdout.puts "\e[36m  Skills:\e[0m \e[2m(runs here, following the recipe)\e[0m"
+          skills.each { |c| @real_stdout.puts registry_help_row(c, width) }
+        end
+
+        unless agents.empty?
+          @real_stdout.puts
+          @real_stdout.puts "\e[36m  Agents:\e[0m \e[2m(runs in a separate context, reports back)\e[0m"
+          agents.each { |c| @real_stdout.puts registry_help_row(c, width) }
+        end
+
+        return if skills.empty? && agents.empty?
+        @real_stdout.puts
+        @real_stdout.puts "\e[2m  Pass a request after the name: /#{(skills.first || agents.first).slug} <what you want>\e[0m"
+      end
+
+      # One "/slug   description" line, clipped so a long description wraps into
+      # the next row instead of making the list unreadable.
+      def registry_help_row(command, width)
+        room = terminal_width - width - 6
+        desc = command.description.to_s
+        desc = "#{desc[0, room - 1]}\u2026" if room > 10 && desc.length > room
+        "\e[2m    /#{command.slug.ljust(width)} #{desc}\e[0m"
+      end
+
+      def terminal_width
+        require 'io/console'
+        cols = IO.console && IO.console.winsize.last.to_i
+        cols && cols > 40 ? cols : 100
+      rescue StandardError
+        100
       end
 
       def display_exit_info

data/lib/rails_console_ai/channel/slack.rb

@@ -71,7 +71,7 @@ module RailsConsoleAi
         stripped = strip_ansi(text).strip
         return if stripped.empty?
 
-        if stripped =~ /\AThinking\.\.\.|\AAttempting to fix|\ACancelled|\A_session:/
+        if stripped =~ /\AThinking\.\.\.|\AAttempting to fix|\ACancelled|\A_Session\b/
           post(stripped)
         else
           @output_log.write("#{stripped}\n")