rubik 0.1.0

data/lib/rubik/mcp/proxy_tool.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require_relative "../tools/base"
+require_relative "../tools/result"
+
+module Rubik
+  module MCP
+    class ProxyTool < Rubik::Tools::BaseTool
+      attr_reader :server_name, :original_name, :client
+
+      def initialize(server_name:, tool_def:, client:)
+        @server_name = server_name.to_s
+        @client = client
+        @original_name = (tool_def["name"] || tool_def[:name]).to_s
+
+        sanitized_server = @server_name.downcase.gsub(/[^a-z0-9_]/, "_")
+        sanitized_tool = @original_name.downcase.gsub(/[^a-z0-9_]/, "_")
+        tool_name = "mcp_#{sanitized_server}_#{sanitized_tool}"
+
+        raw_desc = (tool_def["description"] || tool_def[:description] || "").to_s.strip
+        desc = raw_desc.empty? ? "[MCP: #{@server_name}] #{@original_name}" : "[MCP: #{@server_name}] #{raw_desc}"
+        raw_schema = tool_def["inputSchema"] || tool_def[:inputSchema]
+        schema = raw_schema.is_a?(Hash) ? raw_schema.dup : {}
+        schema["type"] = "object" unless schema["type"].is_a?(String)
+        schema["properties"] = {} unless schema["properties"].is_a?(Hash)
+
+        super(
+          name: tool_name,
+          description: desc,
+          risk: risk_from_annotations(tool_def["annotations"] || tool_def[:annotations]),
+          params_schema: schema
+        )
+      end
+
+      # Maps MCP tool annotations onto Rubik's risk levels so approval
+      # guardrails can distinguish read-only MCP tools from destructive or
+      # open-world ones. Unannotated tools stay conservative (:execute).
+      def risk_from_annotations(annotations)
+        return :execute unless annotations.is_a?(Hash)
+
+        if annotations["readOnlyHint"] == true
+          :read
+        elsif annotations["destructiveHint"] == true
+          :write
+        else
+          :execute
+        end
+      end
+
+      def execute(args = {})
+        args_hash = args.is_a?(Hash) ? args : {}
+        res = @client.call_tool(@original_name, args_hash)
+
+        is_error = if res.respond_to?(:error?)
+                     res.error?
+                   elsif res.is_a?(Hash) || res.respond_to?(:[])
+                     res["isError"] == true || res[:isError] == true
+                   else
+                     false
+                   end
+
+        output_text = if res.is_a?(Hash)
+                        if res["text"]
+                          res["text"].to_s
+                        elsif res["content"].is_a?(Array)
+                          res["content"].select { |c| (c["type"] || c[:type]) == "text" }
+                                        .map { |c| (c["text"] || c[:text]).to_s }
+                                        .join("\n")
+                        else
+                          res.inspect
+                        end
+                      else
+                        res.to_s
+                      end
+
+        # Output size is bounded by the orchestrator's Truncator (single
+        # truncation point, head_tail strategy); no pre-truncation here so
+        # the strategy stays consistent for MCP and built-in tools alike.
+
+        if is_error
+          Rubik::Tools::Result.new(
+            tool_name: @name,
+            status: :error,
+            output: output_text,
+            error: output_text
+          )
+        else
+          Rubik::Tools::Result.new(
+            tool_name: @name,
+            status: :ok,
+            output: output_text
+          )
+        end
+      rescue StandardError => e
+        Rubik::Tools::Result.new(
+          tool_name: @name,
+          status: :error,
+          output: e.message,
+          error: e.message
+        )
+      end
+    end
+  end
+end

data/lib/rubik/mcp/transport/stdio.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+require "open3"
+require "json"
+require "shellwords"
+require_relative "../errors"
+require_relative "../../platform"
+require_relative "../../security/guard"
+
+module Rubik
+  module MCP
+    module Transport
+      class Stdio
+        attr_reader :command, :args, :env, :root_dir, :running, :wait_thr
+
+        def initialize(command, args: [], env: {}, root_dir: Dir.pwd, guard: nil)
+          @command = command
+          @args = Array(args).map(&:to_s)
+          @env = env || {}
+          @root_dir = File.expand_path(root_dir)
+          @guard = guard || Rubik::Security::Guard.new
+          @running = false
+          @req_id = 0
+          @stdin = nil
+          @stdout = nil
+          @stderr = nil
+          @wait_thr = nil
+          @reader_thr = nil
+          @mutex = Mutex.new
+          @cv = ConditionVariable.new
+          @responses = {}
+        end
+
+        def open
+          return if @running
+
+          cmd_parts = if @args.empty? && @command.is_a?(String)
+                        begin
+                          Shellwords.split(@command)
+                        rescue ArgumentError => e
+                          raise ConnectionError, "Invalid command syntax: #{e.message}"
+                        end
+                      else
+                        [@command.to_s] + @args
+                      end
+
+          bin = cmd_parts.first
+          raise ConnectionError, "MCP command cannot be empty" if bin.nil? || bin.empty?
+
+          # Red-Team Defense: Verify command safety against destructive operations.
+          # Route the MCP spawn command through the same Guard#verify_command_safety!
+          # call that RunCommandTool uses — the narrow DANGEROUS_COMMAND_PATTERNS
+          # subset below was a bypass: it misses many dangerous commands the
+          # classifier flags. Fails closed on any dangerous/unmanaged command.
+          full_cmd = Shellwords.shelljoin(cmd_parts)
+          begin
+            @guard.verify_command_safety!(full_cmd)
+          rescue Rubik::Security::BlockedWriteError => e
+            # No manual audit here: verify_command_safety! already logged
+            # "blocked_command" with the TRUE classifier reason before raising
+            # — a second hardcoded entry would double-log and mislabel it.
+            raise ConnectionError, "Security blocked MCP process: #{e.message}"
+          end
+
+          resolved_bin = Rubik::Platform.which(bin)
+          cmd_parts[0] = resolved_bin if resolved_bin
+
+          string_env = @env.transform_keys(&:to_s).transform_values(&:to_s)
+
+          begin
+            @stdin, @stdout, @stderr, @wait_thr = if string_env.empty?
+                                                    Open3.popen3(*cmd_parts, chdir: @root_dir)
+                                                  else
+                                                    Open3.popen3(string_env, *cmd_parts, chdir: @root_dir)
+                                                  end
+          rescue SystemCallError => e
+            raise ConnectionError, "Failed to spawn MCP process '#{bin}': #{e.message}"
+          end
+
+          @running = true
+          @req_id = 0
+          @responses.clear
+
+          start_reader_thread
+          self
+        end
+        alias start open
+
+        def send_request(method, params = {}, timeout: 10)
+          raise ConnectionError, "MCP transport is not running" unless @running && @stdin
+
+          req_id = @mutex.synchronize do
+            @req_id += 1
+            @req_id
+          end
+
+          msg = {
+            "jsonrpc" => "2.0",
+            "id" => req_id,
+            "method" => method.to_s,
+            "params" => params || {}
+          }
+
+          write_message(msg)
+          wait_for_response(req_id, timeout: timeout)
+        end
+
+        def send_notification(method, params = {})
+          raise ConnectionError, "MCP transport is not running" unless @running && @stdin
+
+          msg = {
+            "jsonrpc" => "2.0",
+            "method" => method.to_s,
+            "params" => params || {}
+          }
+
+          write_message(msg)
+        end
+
+        def close
+          return unless @running || @wait_thr&.alive?
+
+          @running = false
+
+          begin
+            @reader_thr&.kill
+          rescue StandardError
+            nil
+          end
+
+          [@stdin, @stdout, @stderr].each do |io|
+            io&.close unless io&.closed?
+          rescue StandardError
+            nil
+          end
+
+          begin
+            @reader_thr&.join(0.5)
+          rescue StandardError
+            nil
+          ensure
+            @reader_thr = nil
+          end
+
+          if @wait_thr&.alive?
+            Rubik::Platform.kill_tree(@wait_thr.pid)
+            begin
+              @wait_thr.join(0.5)
+            rescue StandardError
+              nil
+            end
+          end
+          @wait_thr = nil
+
+          @mutex.synchronize do
+            @responses.clear
+            @cv.broadcast
+          end
+        end
+        alias stop close
+        alias dispose close
+
+        def running?
+          @running && (@wait_thr.nil? || @wait_thr.alive?)
+        end
+
+        def pid
+          @wait_thr&.pid
+        end
+
+        private
+
+        def write_message(msg_hash)
+          json = JSON.dump(msg_hash)
+          @mutex.synchronize do
+            raise ConnectionError, "Process stdin is closed" if @stdin.nil? || @stdin.closed?
+
+            @stdin.puts(json)
+            @stdin.flush
+          end
+        rescue IOError, Errno::EPIPE => e
+          close
+          raise ConnectionError, "Failed to write to MCP server: #{e.message}"
+        end
+
+        def wait_for_response(req_id, timeout: 10)
+          start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          response = @mutex.synchronize do
+            loop do
+              match = @responses.delete(req_id) || @responses.delete(req_id.to_s) || @responses.delete(req_id.to_i)
+              break match if match
+              raise ConnectionError, "MCP transport stopped while waiting for response" unless @running
+
+              elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
+              remaining = timeout - elapsed
+              if remaining <= 0
+                @responses.delete(req_id)
+                raise TimeoutError, "Timed out waiting for MCP response to request #{req_id} after #{timeout}s"
+              end
+
+              @cv.wait(@mutex, remaining)
+            end
+          end
+
+          if response["error"]
+            err = response["error"]
+            code = err.is_a?(Hash) ? err["code"] : nil
+            msg = err.is_a?(Hash) ? (err["message"] || err.to_s) : err.to_s
+            code_str = code ? " (#{code})" : ""
+            raise ProtocolError, "MCP error#{code_str}: #{msg}"
+          end
+
+          response["result"]
+        end
+
+        def start_reader_thread
+          @reader_thr = Thread.new do
+            while @running && @stdout && !@stdout.closed?
+              line = begin
+                @stdout.gets
+              rescue IOError, Errno::EBADF
+                nil
+              end
+              break unless line
+
+              line = line.strip
+              next if line.empty?
+
+              begin
+                msg = JSON.parse(line)
+                handle_incoming_message(msg)
+              rescue JSON::ParserError
+                # Ignore non-JSON server logs, keep reader alive
+              end
+            end
+          ensure
+            @mutex.synchronize do
+              @running = false
+              @cv.broadcast
+            end
+          end
+        end
+
+        def handle_incoming_message(msg)
+          return unless msg.is_a?(Hash) && msg.key?("id")
+
+          @mutex.synchronize do
+            @responses[msg["id"]] = msg
+            @cv.broadcast
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubik/mcp.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require_relative "mcp/errors"
+require_relative "mcp/transport/stdio"
+require_relative "mcp/client"
+require_relative "mcp/proxy_tool"
+require_relative "mcp/manager"
+
+module Rubik
+  module MCP
+  end
+end

data/lib/rubik/orchestrator/activity_log.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Rubik
+  module Orchestrator
+    # Plan 61 D-15: low-cost per-run ledger of tool usage, touched file
+    # paths and tool errors, rendered into a compact turn summary. Failed
+    # or cancelled turns persist this summary next to their [Turn ...]
+    # marker so the model (and !resume) know what was already attempted.
+    # Loop owns an instance and resets it per run; StepExecutor records.
+    class ActivityLog
+      def initialize
+        @tools = Hash.new(0)
+        @files = []
+        @tool_errors = 0
+        @entries = [] # YENİ (Plan 85 D-2): sıralı per-call kronoloji [{ tool:, status: }, ...]
+      end
+
+      def record(tool_name, tool_args, status)
+        @tools[tool_name] += 1
+        @entries << { tool: tool_name, status: status } # YENİ: sıra korunur
+        path = tool_args["path"] || tool_args[:path]
+        @files << path.to_s if path && @files.size < 10 && !@files.include?(path.to_s)
+        @tool_errors += 1 if status == :error
+      rescue StandardError => e
+        Rubik::Platform.debug_warn("ActivityLog#record failed (#{e.class}: #{e.message}); telemetry entry dropped")
+        nil
+      end
+
+      def summary(buffer_manager = nil)
+        parts = []
+        unless @tools.empty?
+          used = @tools.map { |name, count| count > 1 ? "#{name}(x#{count})" : name }
+          parts << "Tools used: #{used.join(', ')}"
+        end
+        parts << "Files touched: #{@files.join(', ')}" unless @files.empty?
+        parts << "Tool errors encountered: #{@tool_errors}" if @tool_errors.positive?
+        if buffer_manager&.dirty?
+          dirty = buffer_manager.dirty_files
+          names = dirty.is_a?(Hash) ? dirty.keys : Array(dirty)
+          parts << "Unapplied buffer changes: #{names.join(', ')}" unless names.empty?
+        end
+        parts.join("\n")
+      end
+
+      # YENİ (Plan 85 D-2): Tüm tool çağrılarını gerçek kronolojik sırada döndürür.
+      # Model context'ine enjekte için tasarlandı. @entries boşsa "" döner.
+      def chronological_summary(max_entries: 20)
+        return "" if @entries.empty?
+
+        lines = @entries.first(max_entries).map.with_index(1) do |entry, i|
+          status_tag = entry[:status] == :error ? " [FAILED]" : ""
+          "  #{i}. #{entry[:tool]}#{status_tag}"
+        end
+        lines << "  ... (#{@entries.size - max_entries} more)" if @entries.size > max_entries
+        lines.join("\n")
+      end
+
+      # Kök-turn kronik satırı için kompakt araç dökümü (root-turn planı
+      # 2026-10-04): alfabetik ilk max_tools araç "ad(xN)" — sıralama
+      # sabit olduğundan replay'de aynı dize; @tools boşsa "".
+      def tool_tally(max_tools: 6)
+        return "" if @tools.empty?
+
+        @tools.keys.sort.first(max_tools).map { |name| "#{name}(x#{@tools[name]})" }.join(" ")
+      end
+
+      def reset!
+        @tools.clear
+        @files.clear
+        @tool_errors = 0
+        @entries.clear # YENİ
+      end
+    end
+  end
+end

data/lib/rubik/orchestrator/auto_apply.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+require_relative "subagent/notices"
+
+module Rubik
+  module Orchestrator
+    # Deep module (2026-09-22 review card 2): the ONE home for the buffer
+    # auto-apply policy. Eight call sites carried private spellings of the
+    # same decision (StepExecutor x3, subagent StepRunner x2, Supervisor
+    # completion, REPL !test/!sh) and drifted: the supervisor ignored
+    # buffer.auto_apply, subagent finish ignored on_finish, both subagent
+    # sites swallowed apply failures (tests could silently run on stale
+    # disk), the subagent steps skipped the AST sync, and the copy
+    # diverged ("file(s)" vs "modified file(s)").
+    #
+    #   owns   : the trigger vocabulary and decision table (mode x subagent
+    #            flag x tool class), the canonical apply+sync effect, the
+    #            failure-notice channel, config keys/defaults, and the REPL
+    #            copy vocabulary
+    #   leaves : the transport at each site (on_step event, event bus, IO),
+    #            which buffer instance is applied, the branch-workspace
+    #            fact, and branch merge semantics (Supervisor)
+    #
+    # Subagent state never enters this module (stateless-over-owner,
+    # ARCHITECTURE.md §2): config and trigger symbols in, booleans and
+    # strings out.
+    module AutoApply
+      MODE_KEY = "buffer.auto_apply"           # config/defaults.rb: "manual"
+      FLAG_KEY = "subagents.auto_apply_buffer" # config/defaults.rb: true
+
+      # Defensive defaults for config-less hosts (tests, embedded). The
+      # flag default deliberately diverges from defaults.rb's true: a nil
+      # config reads as OFF so a config-less Supervisor never writes disk
+      # (the merge-without-apply pin, test_subagent_orchestration.rb).
+      # Pinned by name in test_auto_apply_policy.rb — do not "unify".
+      DEFAULT_MODE = "manual"
+      DEFAULT_FLAG = false
+
+      TEST_CLASS_TOOLS = ["run_command", "run_tests", "test", "lint"].freeze
+
+      # Trigger -> modes that fire it. on_test fires at finish on purpose:
+      # the mode ladder ends every turn flushed (historical StepExecutor
+      # semantics, preserved by the 2026-09-22 reconciliation). completion
+      # mirrors finish for the supervisor's post-merge moment.
+      TRIGGER_MODES = {
+        pre_execution: ["on_test", "always"],
+        finish: ["on_finish", "on_test", "always"],
+        completion: ["on_finish", "on_test", "always"],
+        post_tool: ["always"]
+      }.freeze
+
+      module_function
+
+      # THE decision. subagent: true composes the subagents flag: flag on
+      # enables every trigger; otherwise the mode decides per trigger.
+      # tool classifies :pre_execution (nil = the caller already
+      # established the test-class context, e.g. REPL !test/!sh). mode:
+      # overrides config resolution entirely — the StepExecutor injection
+      # seam (its tests pass explicit modes positionally).
+      def apply?(config, trigger:, subagent: false, tool: nil, mode: nil)
+        return false if trigger == :pre_execution && !tool.nil? && !test_class_tool?(tool)
+
+        resolved = mode || (subagent && subagent_flag_on?(config) ? "always" : self.mode(config))
+        fires?(resolved, trigger)
+      end
+
+      # Pure predicate on a resolved mode string.
+      def fires?(mode, trigger)
+        TRIGGER_MODES.fetch(trigger).include?(mode.to_s.downcase)
+      end
+
+      # Raised when the disk apply succeeded but the context/AST index sync
+      # failed — the message says the changes ARE on disk so nobody
+      # "recovers" by re-applying a clean buffer.
+      class SyncFailedError < StandardError; end
+
+      # Canonical effect: apply the dirty buffer, then sync context/AST
+      # unless nothing was applied. Errors PROPAGATE (the main path
+      # contract); subagent callers rescue-and-report via report_failure.
+      def apply_and_sync(buffer_manager, shell)
+        return [] unless buffer_manager&.dirty?
+
+        applied = buffer_manager.apply!
+        begin
+          shell&.sync_context_and_ast(applied) unless applied.empty?
+        rescue StandardError => e
+          raise SyncFailedError, "index sync failed (changes ARE on disk): #{e.class}: #{e.message}"
+        end
+        applied
+      end
+
+      # Report-don't-swallow channel for the subagent paths. The trigger
+      # folds into reason; the cap keeps diagnostic color while preserving
+      # the TAIL — OS error messages carry the file path at the end, and a
+      # head-cut amputates exactly the actionable part. A failure channel
+      # must be the most defensive code on the path it protects: an emit
+      # that itself raises degrades to warn — raising here (from inside a
+      # caller's rescue) would mask the original apply error and, on the
+      # supervisor completion path, kill the COMPLETED_EVENT protocol.
+      REASON_CAP = 120
+
+      def report_failure(event_bus, id:, role:, state:, trigger:, reason:)
+        reason = capped_reason("#{trigger}: #{reason}")
+        begin
+          if event_bus.respond_to?(:emit)
+            Subagent::Notices.emit(event_bus, Subagent::Notices::AUTO_APPLY_FAILED_EVENT,
+                                   { id: id, role: role, state: state.to_s, reason: reason })
+          else
+            warn("[AutoApply] subagent '#{id}' auto-apply (#{trigger}) failed: #{reason}")
+          end
+        rescue StandardError => e
+          warn("[AutoApply] subagent '#{id}' auto-apply (#{trigger}) failed: #{reason} " \
+               "(notice emit also failed: #{e.class}: #{e.message})")
+        end
+      end
+
+      # apply! does not raise on an external-modification conflict — it
+      # skips the file and records it — but a skip means the next run_tests
+      # executes against disk that lacks the buffered edit: the same
+      # stale-disk failure report_failure exists for. Call immediately
+      # after apply_and_sync; the post-apply dirty? check distinguishes "a
+      # skip just happened" from "buffer was already clean" (apply! rewrites
+      # last_conflicts on every run).
+      def report_conflicts(event_bus, buffer_manager, id:, role:, state:, trigger:)
+        return unless buffer_manager&.dirty?
+
+        conflicts = buffer_manager.respond_to?(:last_conflicts) ? Array(buffer_manager.last_conflicts) : []
+        return if conflicts.empty?
+
+        report_failure(event_bus, id: id, role: role, state: state, trigger: trigger,
+                                  reason: "conflict skipped: #{conflicts.join(', ')}")
+      end
+
+      # -- copy vocabulary (the one home for auto-apply words) ------------
+
+      def applied_line(count, phase)
+        "[Rubik::Buffer] Auto-applied #{count} modified file(s) before #{phase}."
+      end
+
+      def unapplied_warning(subject)
+        "⚠️ [Rubik::Buffer] Notice: Unapplied buffer changes exist. #{subject} run against files on disk."
+      end
+
+      # -- one defensive spelling each (replaced eight) -------------------
+
+      def mode(config)
+        config.respond_to?(:fetch) ? config.fetch(MODE_KEY, DEFAULT_MODE).to_s.downcase : DEFAULT_MODE
+      end
+
+      def subagent_flag_on?(config)
+        config.respond_to?(:fetch) ? config.fetch(FLAG_KEY, DEFAULT_FLAG) == true : DEFAULT_FLAG
+      end
+
+      def test_class_tool?(canonical_name)
+        TEST_CLASS_TOOLS.include?(canonical_name.to_s)
+      end
+
+      def capped_reason(reason)
+        reason = reason.to_s
+        reason.length > REASON_CAP ? reason[-REASON_CAP..] : reason
+      end
+
+      private_class_method :capped_reason
+    end
+  end
+end