rubik 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4d73f60e02ac1d3902de40f910cb600612f5685c7e7a7ef2b7736b91567c14d8
-  data.tar.gz: ecf9501583c3e5c480efe0ad5093ba4dc8a5d91be08b33292503ee0b6f414e2f
+  metadata.gz: 13f2d00bb2c72a92d48741df2cb3c3e84fc970a9ce3e4e844722afa58ef59599
+  data.tar.gz: f3314db467118bbd56aa79625f954f5c9e76611c56b5eb5e467d442fa440aa63
 SHA512:
-  metadata.gz: ccdb0699c44357cfe03c15ff0755293b38fca1e8b25daa1a7c47458f770242ce91c87ec723df61463931306a096a1d811dee35dd7404bb1033701276e2a81b8b
-  data.tar.gz: 21ec55890b5ba261f9cbb97b78fe7a87b07a9bc998e01ff4af52e7353935407a12003efcfae499af7c44004103b792aa42c85ee46fd5f647dc09b97842585015
+  metadata.gz: a5c29f5af7119d6b9189e37d39390c6dd2463caa1fd870e49022b92a0ed72481b227616000a84a2e201f26c7a65009f7fcb05ac6591db6ca1b9ecae3f81bc6d4
+  data.tar.gz: 3ab1188c4607f7dbcbe4011111723f530555052497154eaea6c8d47b09dc927bfcfa43b50b88869f2dc8bc1e402c7589a569d59ad584d29b991bfff765292d08

data/CHANGELOG.md

@@ -8,6 +8,44 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## Unreleased
 
+Nothing yet.
+
+## [0.1.1] - 2026-10-11
+
+The Linux surface release: CI now proves Linux on Ruby 3.4 and 4.0
+(`linux-test` is a required check), and the host seams that surface
+exposed are fixed. Ships the structured goal ledger, the default-on
+context pruner, and the vakanüvis recall/write hardening below.
+
+### Fixed
+
+- **Fiber Scheduler: Net timeouts no longer fire watchdogs into
+  unrelated frames** (#102): Net::HTTP implemented its open/read
+  deadlines with the Timeout module — an async `Thread#raise` into the
+  originating thread. Under the scheduler that thread hops between
+  parked fibers, so an expired deadline landed in whichever frame was
+  running (observed on Linux killing the test reporter's stdout write
+  and `safe_select`'s `IO.select` itself). Deadlines are now
+  fiber-native: EventLoop timers drive them, and the timeout never
+  leaves the owning fiber.
+- **LSP diagnostics keys normalize by path shape, not host OS** (#103):
+  a windows-drive root plus `file:///C:/...` uris and backslash lookups
+  resolved differently on a linux host; drive semantics now follow the
+  path's own shape.
+- **Allowlist `.exe` alias matches lexically** (#103): the windows
+  executable-extension rule engaged through a second host seam the
+  platform stub did not cover; the alias is decided inside the matcher.
+- **Task manager fixtures are shell-safe and poll for readiness**
+  (#103): fixed sleeps raced linux process startup, so a kill arrived
+  after the task had already FAILED.
+- **REPL wake-loop**: subagent notices stranded at turn end re-armed the
+  reactive wake (synthetic Enter), so a steady subagent stream chained
+  autonomous maestro turns forever — the prompt never returned and the cycle
+  survived Ctrl+C, because the interrupted turn's own ensure block re-armed
+  the wake. Settlement invariant: an autonomous notice turn never spawns
+  another one, and an interrupted turn settles the wake debt; the
+  model-channel no-loss delivery is unchanged.
+
 ### Added
 
 - **Vakanüvis recall + write hardening** (issues #99/#100): `storage put`
@@ -91,16 +129,6 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   subagent reported red?"); failed instances still get a body (task + state
   line) and the upsert/dedupe/canonical-link contract is unchanged.
 
-### Fixed
-
-- **REPL wake-loop**: subagent notices stranded at turn end re-armed the
-  reactive wake (synthetic Enter), so a steady subagent stream chained
-  autonomous maestro turns forever — the prompt never returned and the cycle
-  survived Ctrl+C, because the interrupted turn's own ensure block re-armed
-  the wake. Settlement invariant: an autonomous notice turn never spawns
-  another one, and an interrupted turn settles the wake debt; the
-  model-channel no-loss delivery is unchanged.
-
 ## [0.1.0] - 2026-10-09
 
 First rubygems.org release of the `rubik` gem. Linux and macOS install out of

data/lib/rubik/concurrency/event_loop.rb

@@ -28,8 +28,21 @@ module Rubik
     # Thread#join/block), io-waiting, or timer-pending. Finished fibers leave
     # no registration, so "is anything waiting?" answers "are we done?".
     class EventLoop
-      READABLE = 1
-      WRITABLE = 2
+      # The VM's io_wait hook passes and expects the scheduler-protocol wait
+      # mask — the same domain as ::IO::READABLE / ::IO::WRITABLE (1 and 4;
+      # 2 is IO::PRIORITY). A local 1/2 pair silently drops WRITABLE
+      # interests (5.anybits?(2) is false): connects park forever until a
+      # deadline fires — the mis-aimed-watchdog crash of #102 never even
+      # needed the watchdog. Aliased to the real constants so a protocol
+      # drift surfaces as a NameError, not a hang.
+      READABLE = ::IO::READABLE
+      WRITABLE = ::IO::WRITABLE
+
+      # Timer generation slot for deadline registrations that must survive
+      # re-parks (Timeout.timeout spans many io waits within ONE timed
+      # operation). Sticky entries never go stale — they are cancelled
+      # explicitly by the owning fiber's ensure.
+      STICKY = :sticky
 
       attr_reader :spawn_errors
 
@@ -41,7 +54,11 @@ module Rubik
         # Stale timers (fiber re-parked or resumed since registration) must
         # not gate draining — @gen is bumped on every resume, so any of this
         # fiber's outstanding registrations becomes inert at that moment.
-        @timers = Timers.new { |fiber, gen| @gen[fiber] != gen }
+        @timers = Timers.new do |fiber, gen|
+          next false if gen == STICKY
+
+          @gen[fiber] != gen
+        end
         @io_waiters = {}     # io => { read: {fiber=>gen}, write: {fiber=>gen} }
         @gen = ::Hash.new(0) # fiber => park generation (loop thread only)
         @live = {}           # fiber => true while a spawned fiber runs
@@ -212,6 +229,34 @@ module Rubik
         ::Addrinfo.getaddrinfo(hostname, nil).map(&:ip_address).uniq
       end
 
+      # True while this thread is inside run/run_until_drained (a boundary
+      # is draining). Timeout deadlines are fiber-native only in this
+      # window — outside it no loop consumes the timers, so the patch falls
+      # back to the stock Timeout watchdog.
+      def draining?
+        !@closed && !@loop_thread.nil?
+      end
+
+      # Fiber-native Timeout.timeout body (see concurrency/fiber_timeout.rb):
+      # runs the block inline and delivers the deadline exception through
+      # the interrupt path at the fiber's current park. The :sticky
+      # generation means re-parks during the timed operation never stale
+      # the deadline (a Net open spans many io waits); the ensure cancels
+      # the timer and retracts an already-fired, still-queued delivery, so
+      # a deadline that loses the race against block completion can never
+      # leak into a later operation.
+      def fiber_timeout(sec, exception_class, message)
+        fiber = ::Fiber.current
+        error = (exception_class || ::Timeout::Error).new(message || "execution expired")
+        timer = @timers.add(monotonic + sec, fiber, error, STICKY)
+        begin
+          yield
+        ensure
+          @timers.cancel(timer)
+          discard_queued(fiber, error)
+        end
+      end
+
       # ---- Reactor -------------------------------------------------------------
 
       # Runs the boundary body as a fiber and drains everything it spawned.
@@ -359,7 +404,7 @@ module Rubik
 
       def fire_due_timers
         @timers.fire_due!(monotonic) do |fiber, value, gen|
-          next if @gen[fiber] != gen # stale: fiber moved on after registering
+          next if gen != STICKY && @gen[fiber] != gen # stale: fiber moved on after registering
 
           drop_io_interest(fiber)
           push(fiber, value: value)
@@ -427,6 +472,20 @@ module Rubik
         nil
       end
 
+      # Retract a queued resume: a deadline that fired while its fiber was
+      # running (mid-operation) sits in @runnable until the next pop —
+      # without retraction, the block's completion would leave the
+      # exception aimed at the fiber's NEXT park (the watchdog-leak shape,
+      # in miniature). Same-thread ordering makes this airtight: the entry
+      # can only be consumed by a resume that delivers it into the timed
+      # block, and then the ensure's cancel finds nothing to retract.
+      def discard_queued(fiber, value)
+        @mutex.synchronize do
+          @runnable.reject! { |(queued_fiber, queued_value)| queued_fiber.equal?(fiber) && queued_value.equal?(value) }
+        end
+        nil
+      end
+
       def kick
         @wake_write.write_nonblock(".", exception: false)
       rescue StandardError

data/lib/rubik/concurrency/fiber_timeout.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "timeout"
+
+module Rubik
+  module Concurrency
+    # #102: Net::HTTP (and any stdlib code) enforces deadlines with the
+    # Timeout module — a watchdog Thread that Thread#raises the calling
+    # thread when the deadline expires. Under the scheduler that thread is
+    # the loop thread, shared by every parked fiber: the raise lands in
+    # whichever frame is executing (another fiber's IO.select, the minitest
+    # reporter), and after an abandoned drain it fires into unrelated
+    # runner code.
+    #
+    # While a boundary is draining on this thread, Timeout.timeout is
+    # fiber-native instead: the block runs inline (no watchdog thread is
+    # ever created) and the deadline exception is delivered through the
+    # loop's interrupt path at the calling fiber's current park. Outside a
+    # drain there is no loop to consume timers, so the stock watchdog
+    # applies — a thread-raise into the thread that is genuinely blocked is
+    # correctly targeted there.
+    module TimeoutPatch
+      def timeout(sec = nil, exception_class = nil, message = nil, &)
+        scheduler = ::Fiber.scheduler
+        if sec.is_a?(::Numeric) && sec.positive? &&
+           scheduler.is_a?(::Rubik::Concurrency::Scheduler) && scheduler.native_deadlines?
+          return scheduler.fiber_timeout(sec, exception_class, message, &)
+        end
+
+        super
+      end
+    end
+
+    ::Timeout.singleton_class.prepend(TimeoutPatch)
+  end
+end

data/lib/rubik/concurrency/scheduler.rb

@@ -75,6 +75,21 @@ module Rubik
         @loop.resolve_address(hostname)
       end
 
+      # True while the loop is actively draining on this thread — the only
+      # window in which Timeout deadlines can be driven by loop timers
+      # (outside it the stock Timeout watchdog applies).
+      def native_deadlines?
+        @loop.draining?
+      end
+
+      # Runs block with a fiber-native deadline: the exception arrives at
+      # the fiber's current park instead of a watchdog Thread#raise into
+      # the loop thread (#102). Loop-thread only — the Timeout patch routes
+      # here exclusively from scheduled fibers.
+      def fiber_timeout(sec, exception_class, message, &)
+        @loop.fiber_timeout(sec, exception_class, message, &)
+      end
+
       def scheduler_close
         @loop.shutdown
         nil

data/lib/rubik/concurrency/timers.rb

@@ -68,6 +68,24 @@ module Rubik
         fired
       end
 
+      # Removes a pending entry (identity comparison — entries are arrays
+      # that may compare structurally equal) and re-heapifies around the
+      # hole. Returns true when the entry was still pending. Only the loop
+      # thread mutates the heap and cancellation runs on the loop thread
+      # too, so a cancelled entry can never fire afterwards.
+      def cancel(entry)
+        index = @heap.index { |candidate| candidate.equal?(entry) }
+        return false unless index
+
+        last = @heap.pop
+        return true if index >= @heap.size
+
+        @heap[index] = last
+        sift_down(index)
+        sift_up(index)
+        true
+      end
+
       private
 
       def prune!

data/lib/rubik/concurrency.rb

@@ -6,6 +6,7 @@ require_relative "concurrency/event_loop"
 require_relative "concurrency/scheduler"
 require_relative "concurrency/boundary"
 require_relative "concurrency/join"
+require_relative "concurrency/fiber_timeout"
 
 module Rubik
   # Silent concurrency over Ruby's Fiber Scheduler: plain blocking I/O —
@@ -17,10 +18,12 @@ module Rubik
   # Envelope (documented limits, plan §9): this is I/O concurrency, not CPU
   # parallelism (the GVL still serializes computation); regular-file reads
   # never park (read_nonblock on files returns immediately — they simply run
-  # serially, which is harmless); Timeout.timeout-backed code paths are not
-  # adopted inside boundaries in v1 (Thread.raise cannot be aimed at a
-  # specific fiber). Escape hatch: RUBIK_FIBER_SCHEDULER=off degrades every
-  # boundary to plain sequential execution.
+  # serially, which is harmless). Timeout.timeout-backed deadlines (Net::HTTP
+  # open/read) are fiber-native inside boundaries: the watchdog Thread#raise
+  # is replaced by a loop-timer delivery into the calling fiber, so it can
+  # never land in another fiber's frame or in post-shutdown runner code
+  # (concurrency/fiber_timeout.rb). Escape hatch: RUBIK_FIBER_SCHEDULER=off
+  # degrades every boundary to plain sequential execution.
   module Concurrency
     module_function
 

data/lib/rubik/lsp/client.rb

@@ -28,7 +28,7 @@ module Rubik
 
       def initialize(language, root_dir: Dir.pwd, server_cmd: nil)
         @language = language.to_s.downcase
-        @root_dir = File.expand_path(root_dir)
+        @root_dir = Rubik::Platform.expand_path(root_dir)
         cmd = server_cmd || SERVERS[@language]
         if (cmd.to_s.start_with?("typeprof") || cmd.to_s.start_with?("typescript-language-server")) && !cmd.to_s.include?("--stdio")
           cmd = "#{cmd} --stdio"
@@ -232,7 +232,7 @@ module Rubik
       def did_open(file_path, content, language_id = @language)
         return false unless alive?
 
-        abs_path = Rubik::Platform.normalize_path_raw(File.expand_path(file_path, @root_dir))
+        abs_path = Rubik::Platform.normalize_path_raw(Rubik::Platform.expand_path(file_path, @root_dir))
         @mutex.synchronize do
           @version_counter += 1
           @open_documents[abs_path] = @version_counter
@@ -254,7 +254,7 @@ module Rubik
       def did_change(file_path, content)
         return false unless alive?
 
-        abs_path = Rubik::Platform.normalize_path_raw(File.expand_path(file_path, @root_dir))
+        abs_path = Rubik::Platform.normalize_path_raw(Rubik::Platform.expand_path(file_path, @root_dir))
         version = @mutex.synchronize do
           @version_counter += 1
           @open_documents[abs_path] = @version_counter
@@ -281,7 +281,7 @@ module Rubik
       def did_close(file_path)
         return false unless @running
 
-        abs_path = Rubik::Platform.normalize_path_raw(File.expand_path(file_path, @root_dir))
+        abs_path = Rubik::Platform.normalize_path_raw(Rubik::Platform.expand_path(file_path, @root_dir))
         @mutex.synchronize { @open_documents.delete(abs_path) }
 
         send_notification("textDocument/didClose", {
@@ -295,14 +295,14 @@ module Rubik
       def document_open?(file_path)
         return false if file_path.nil? || file_path.to_s.strip.empty?
 
-        abs_path = Rubik::Platform.normalize_path_raw(File.expand_path(file_path, @root_dir))
+        abs_path = Rubik::Platform.normalize_path_raw(Rubik::Platform.expand_path(file_path, @root_dir))
         @mutex.synchronize { @open_documents.key?(abs_path) }
       rescue ArgumentError
         false
       end
 
       def diagnostics_for(file_path)
-        abs_path = Rubik::Platform.normalize_path_raw(File.expand_path(file_path, @root_dir))
+        abs_path = Rubik::Platform.normalize_path_raw(Rubik::Platform.expand_path(file_path, @root_dir))
         root_norm = Rubik::Platform.normalize_path_raw(@root_dir)
         rel_path = abs_path.start_with?("#{root_norm}/") ? abs_path.delete_prefix("#{root_norm}/") : file_path.to_s.tr("\\", "/")
         @mutex.synchronize do
@@ -381,7 +381,7 @@ module Rubik
           params = msg["params"] || {}
           uri = params["uri"].to_s
           raw_path = Rubik::Platform.from_file_uri(uri)
-          abs_path = Rubik::Platform.normalize_path_raw(File.expand_path(raw_path, @root_dir))
+          abs_path = Rubik::Platform.normalize_path_raw(Rubik::Platform.expand_path(raw_path, @root_dir))
           root_norm = Rubik::Platform.normalize_path_raw(@root_dir)
           rel_path = abs_path.start_with?("#{root_norm}/") ? abs_path.delete_prefix("#{root_norm}/") : abs_path
           diags = params["diagnostics"] || []

data/lib/rubik/platform/path.rb

@@ -65,7 +65,7 @@ module Rubik
       # RFC 8089 Compliant File URI (e.g. file:///C:/path/file vs file:///path/file)
       def to_file_uri(path)
         normalized = normalize_path_raw(path)
-        if windows? && normalized =~ %r{^([a-zA-Z]):/(.*)$}
+        if (windows? || windows_shaped?(normalized)) && normalized =~ %r{^([a-zA-Z]):/(.*)$}
           "file:///#{::Regexp.last_match(1)}:/#{::Regexp.last_match(2)}"
         else
           normalized.start_with?("/") ? "file://#{normalized}" : "file:///#{normalized}"
@@ -73,23 +73,49 @@ module Rubik
       end
 
       def from_file_uri(uri)
-        str = uri.to_s.sub(%r{^file://}, "")
+        str = uri.to_s.sub(%r{\Afile://}, "")
         str = CGI.unescape(str)
-        if windows?
-          # Handles file:///C:/... and file://C:/...
-          if str =~ %r{^/?([a-zA-Z]:/.*)$}
+        if windows? || str.match?(%r{\A/?[a-zA-Z]:/})
+          # Handles file:///C:/... and file://C:/... — keyed by SHAPE, so
+          # the same drive URIs resolve identically on a posix host (#103).
+          if str =~ %r{\A/?([a-zA-Z]:/.*)\z}
             ::Regexp.last_match(1)
           else
             str
           end
+        elsif str.start_with?("/")
+          str
         else
-          str.start_with?("/") ? str : "/#{str}"
+          "/#{str}"
         end
       end
 
+      # Windows path SHAPE: a drive-letter root (C:/ or C:\). Host OS and
+      # path shape are independent — a windows-shaped path can reach a
+      # posix host (LSP payloads, fixtures, mounted drives) and its drive
+      # semantics must not depend on where the process happens to run
+      # (#103). Only drive-rooted paths count: a backslash is a legal
+      # character in a posix filename, so it never triggers windows
+      # semantics on its own.
+      def windows_shaped?(path)
+        path.to_s.match?(%r{\A[a-zA-Z]:[/\\]})
+      end
+
+      # File.expand_path is host-OS-driven: on a posix host a drive-rooted
+      # windows path is treated as a RELATIVE name and mangled under cwd.
+      # A windows-shaped path carries its own root, so expansion is a no-op
+      # and only the separators normalize. Posix-shaped inputs and windows
+      # hosts take the stock path, byte-for-byte — including its TYPE
+      # strictness: callers' error paths depend on File.expand_path raising
+      # on non-strings, so never coerce here.
+      def expand_path(path, base = nil)
+        return path.tr("\\", "/") if !windows? && windows_shaped?(path)
+
+        ::File.expand_path(path, base)
+      end
+
       def normalize_path_raw(path)
-        expanded = File.expand_path(path.to_s)
-        expanded.gsub("\\", "/")
+        expand_path(path.to_s).gsub("\\", "/")
       end
 
       # Normalizes separators and casing for comparison

data/lib/rubik/security/guard.rb

@@ -257,6 +257,14 @@ module Rubik
 
       def binary_allowlist_match?(arg, token)
         return true if arg == token
+        # Windows exe-alias fast path (#103): on a windows host "node.exe"
+        # IS the allowlisted "node" — a lexical alias, no filesystem probe.
+        # The canonical-path probe below resolves through Platform.which +
+        # File.file?, a second host seam the windows? stub cannot cover (a
+        # linux host has no node.exe on disk, so the probe fails and the
+        # allowlist would dead-close). On a posix host the alias is FALSE:
+        # node.exe is a different binary than node there.
+        return true if windows_executable_alias?(arg, token)
 
         c_arg = canonical_binary_path(arg)
         c_token = canonical_binary_path(token)
@@ -266,6 +274,19 @@ module Rubik
         false
       end
 
+      # True when arg carries an executable extension from PATHEXT and its
+      # stem equals the token (case-insensitive — windows path semantics).
+      # Bare stems only: a path-form arg ("C:/x/node.exe") keeps going
+      # through the canonical-path probe, which resolves both sides.
+      def windows_executable_alias?(arg, token)
+        return false unless Rubik::Platform.windows?
+
+        ext = ::File.extname(arg)
+        return false if ext.empty? || !Rubik::Platform.pathext.include?(ext.downcase)
+
+        arg.delete_suffix(ext).casecmp?(token)
+      end
+
       def command_matches_allowlist?(result)
         # Missing argv (e.g. empty invocation) can never be allowlisted.
         argv = result.respond_to?(:argv) ? result.argv : nil

data/lib/rubik/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rubik
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubik
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Özgür Ulukır
@@ -276,6 +276,7 @@ files:
 - lib/rubik/concurrency/dns_pool.rb
 - lib/rubik/concurrency/errors.rb
 - lib/rubik/concurrency/event_loop.rb
+- lib/rubik/concurrency/fiber_timeout.rb
 - lib/rubik/concurrency/join.rb
 - lib/rubik/concurrency/process_waiter.rb
 - lib/rubik/concurrency/scheduler.rb