rubik 0.1.6 → 0.3.0

data/lib/rubik/ast/graph.rb

@@ -36,9 +36,17 @@ module Rubik
         @symbols = {}
         @qualified_symbols = {}
         @file_symbols = Hash.new { |h, k| h[k] = [] }
+        @extraction_status = {}
         @mutex = Mutex.new
       end
 
+      # Last extraction status recorded for a file (issue #147): :ok,
+      # :partial, :failed, or :unavailable. Lets callers tell "no symbols"
+      # apart from "extraction failed" without re-running the extractor.
+      def extraction_status(file_path)
+        @mutex.synchronize { @extraction_status[file_path] }
+      end
+
       def symbols
         @mutex.synchronize do
           SymbolMap.new(@symbols.dup, @qualified_symbols.dup)
@@ -54,6 +62,7 @@ module Rubik
           @symbols.clear
           @qualified_symbols.clear
           @file_symbols.clear
+          @extraction_status.clear
         end
       end
 
@@ -66,6 +75,7 @@ module Rubik
       def remove_file(file_path)
         @mutex.synchronize do
           _remove_file_unlocked(file_path)
+          @extraction_status.delete(file_path)
         end
       end
 
@@ -218,12 +228,28 @@ module Rubik
       end
 
       def _index_file_unlocked(file_path, content = nil)
+        result = Extractor.extract_result(file_path, content)
+        @extraction_status[file_path] = result.status
+
+        # A failed extraction must not silently DELETE the file's previously
+        # indexed symbols (issue #147): stale-but-known beats unknown, and
+        # the log line makes the downgrade visible. The best-effort symbols
+        # are only indexed when there is nothing to protect.
+        if result.status == :failed
+          existing = _get_file_symbols_unlocked(file_path)
+          unless existing.empty?
+            Rubik::Log.warn(:ast, "extraction failed for #{file_path} (#{result.detail}); keeping previously indexed symbols")
+            return existing
+          end
+          Rubik::Log.warn(:ast, "extraction failed for #{file_path} (#{result.detail}); no symbols indexed")
+        end
+
         _remove_file_unlocked(file_path)
 
-        extracted = Extractor.extract(file_path, content)
         ext = File.extname(file_path).downcase
         lang = CacheStore::LANGUAGE_MAP[ext] || "code"
 
+        extracted = result.symbols
         extracted.each do |sym|
           @symbols[sym.name] = sym
           q_key = "#{lang}:#{file_path}##{sym.name}"

data/lib/rubik/ast/treesitter/c_walker.rb

@@ -5,31 +5,71 @@ require_relative "base_walker"
 module Rubik
   module AST
     module TreeSitter
+      # Shared C/C++ walker (issue #147). Supported scope, pinned by
+      # test_ast_cpp_extraction.rb:
+      #   • includes, typedefs, and struct/union/class specifiers (nested
+      #     classes qualify as Outer::Inner);
+      #   • free functions and in-class member definitions/declarations,
+      #     including constructors, destructors, and operator overloads;
+      #   • namespaces: symbol names carry the namespace path (app::run);
+      #   • templates: a template_declaration is unwrapped and its inner
+      #     class/function is walked (specialization nuances are out of scope).
+      # Qualification follows the project convention: namespace/enclosing
+      # segments join with "::", an in-class member joins its class with "#"
+      # (app::Widget#run — the same Class#method shape the TypeScript and
+      # Python walkers use). Out-of-line definitions keep their written
+      # spelling (`void Widget::run` stays "Widget::run").
+      # Out of scope (documented boundary): macro bodies, free-function
+      # prototypes outside a class, local classes inside function bodies, and
+      # declarators hidden behind attributes/`decltype` syntax.
       class CWalker < BaseWalker
+        RECORD_KINDS = {
+          "class_specifier" => :class,
+          "struct_specifier" => :struct,
+          "union_specifier" => :union
+        }.freeze
+
+        DECLARATOR_WRAPPERS = [
+          "function_declarator", "pointer_declarator", "reference_declarator", "parenthesized_declarator"
+        ].freeze
+        NAME_NODE_KINDS = [
+          "identifier", "field_identifier", "type_identifier", "destructor_name", "operator_name"
+        ].freeze
+
         def walk(root_node)
           symbols = []
           return symbols unless root_node
 
-          walk_children(root_node, symbols)
+          walk_children(root_node, symbols, [], member: false)
           symbols
         end
 
         private
 
-        def walk_children(node, symbols)
+        # `scope` is the enclosing declaration path (namespaces, then the
+        # innermost class, outermost first); `member` marks a class body so
+        # declarations are read as member declarations.
+        def walk_children(node, symbols, scope, member:)
           (0...node.named_child_count).each do |i|
             child = node.named_child(i)
             case child.kind
             when "preproc_include"
               walk_include(child, symbols)
             when "type_definition"
-              walk_typedef(child, symbols)
-            when "struct_specifier"
-              walk_struct(child, symbols)
+              walk_typedef(child, symbols, scope)
+            when *RECORD_KINDS.keys
+              walk_record(child, symbols, scope)
+            when "namespace_definition"
+              walk_namespace(child, symbols, scope)
             when "function_definition"
-              walk_function(child, symbols)
+              walk_function(child, symbols, scope, member: member)
+            when "field_declaration", "declaration"
+              walk_member_declaration(child, symbols, scope) if member
             else
-              walk_children(child, symbols)
+              # Plain recursion also unwraps template_declaration nodes (their
+              # inner class/function is walked in place) and linkage
+              # specifications.
+              walk_children(child, symbols, scope, member: member)
             end
           end
         end
@@ -44,7 +84,7 @@ module Rubik
           )
         end
 
-        def walk_typedef(node, symbols)
+        def walk_typedef(node, symbols, scope)
           declarator = node.child_by_field_name("declarator")
           name = if declarator
                    text_for(declarator).strip
@@ -54,32 +94,47 @@ module Rubik
                  end
           return if name.empty?
 
+          qualified = qualify(scope, name)
           sig = clean_signature(node)
           symbols << build_symbol(
-            name: name,
+            name: qualified,
             kind: :struct,
             node: node,
-            signature: sig.empty? ? "typedef struct #{name}" : sig
+            signature: sig.empty? ? "typedef struct #{qualified}" : sig
           )
         end
 
-        def walk_struct(node, symbols)
+        def walk_record(node, symbols, scope)
           name_node = node.child_by_field_name("name")
           return unless name_node
 
           name = text_for(name_node).strip
           return if name.empty?
 
-          sig = "struct #{name}"
+          kind = RECORD_KINDS.fetch(node.kind, :struct)
+          qualified = qualify(scope, name)
+          sig = clean_signature(node)
           symbols << build_symbol(
-            name: name,
-            kind: :struct,
+            name: qualified,
+            kind: kind,
             node: node,
-            signature: sig
+            signature: sig.empty? ? "#{kind} #{qualified}" : sig
           )
+
+          body = node.child_by_field_name("body")
+          walk_children(body, symbols, scope + [name], member: true) if body
+        end
+
+        # Namespace names extend the qualification path; everything inside is
+        # walked with the namespace prefix (app::run, app::Widget#run).
+        def walk_namespace(node, symbols, scope)
+          name_node = node.child_by_field_name("name")
+          ns_scope = name_node ? scope + [text_for(name_node).strip] : scope
+          body = node.child_by_field_name("body")
+          walk_children(body, symbols, ns_scope, member: false) if body
         end
 
-        def walk_function(node, symbols)
+        def walk_function(node, symbols, scope, member:)
           decl = node.child_by_field_name("declarator")
           return unless decl
 
@@ -88,10 +143,11 @@ module Rubik
 
           body = node.child_by_field_name("body")
           calls = extract_calls(body, ["call_expression"])
+          qualified = member ? member_name(scope, fn_name) : qualify(scope, fn_name)
 
           sig = clean_signature(node)
           symbols << build_symbol(
-            name: fn_name,
+            name: qualified,
             kind: :function,
             node: node,
             signature: sig.empty? ? "#{fn_name}()" : sig,
@@ -99,22 +155,74 @@ module Rubik
           )
         end
 
+        # In-class member DECLARATIONS without a body: `void run();`, `C();`,
+        # `~C();`, `void operator+(int);`, `operator bool() const;`. Plain
+        # field declarations (`int x;`) are not symbols.
+        def walk_member_declaration(node, symbols, scope)
+          return if scope.empty?
+
+          decl = node.child_by_field_name("declarator")
+          return unless decl
+
+          name = if decl.kind == "operator_cast"
+                   type_node = decl.child_by_field_name("type")
+                   type_node ? "operator #{text_for(type_node).strip}" : nil
+                 elsif callable_declarator?(decl)
+                   extract_function_name(decl)
+                 end
+          return if name.nil? || name.empty?
+
+          sig = clean_signature(node)
+          symbols << build_symbol(
+            name: member_name(scope, name),
+            kind: :function,
+            node: node,
+            signature: sig.empty? ? "#{name}()" : sig
+          )
+        end
+
+        def callable_declarator?(decl)
+          current = decl
+          while current
+            return true if current.kind == "function_declarator"
+
+            break unless DECLARATOR_WRAPPERS.include?(current.kind)
+
+            current = current.child_by_field_name("declarator")
+          end
+          false
+        end
+
+        # Resolves a callable's name from its declarator chain: identifiers
+        # (C and free functions), field_identifier (in-class methods),
+        # destructor_name (~C), operator_name (operator+), and
+        # qualified_identifier (out-of-line Widget::run). Only known
+        # declarator wrappers are descended; anything else ends the walk with
+        # nil — a wrong name is worse than a missing symbol.
         def extract_function_name(declarator_node)
           current = declarator_node
           while current
-            case current.kind
-            when "function_declarator", "pointer_declarator"
-              current = current.child_by_field_name("declarator")
-            when "identifier"
-              return text_for(current).strip
-            else
-              # Try first identifier child
-              ident = current.children.find { |c| c.kind == "identifier" }
-              return text_for(ident).strip if ident
+            kind = current.kind
+            return text_for(current).strip if NAME_NODE_KINDS.include?(kind) || kind == "qualified_identifier"
 
-              return text_for(current).strip
-            end
+            return nil unless DECLARATOR_WRAPPERS.include?(kind)
+
+            current = current.child_by_field_name("declarator")
           end
+          nil
+        end
+
+        # Namespace/enclosing-class segments join with "::"; an in-class
+        # member joins its class with "#" (see the class comment).
+        def qualify(scope, name)
+          scope.empty? ? name : "#{scope.join('::')}::#{name}"
+        end
+
+        def member_name(scope, name)
+          return name if scope.empty?
+
+          *outer, klass = scope
+          (outer + ["#{klass}##{name}"]).join("::")
         end
       end
     end

data/lib/rubik/ast/treesitter_extractor.rb

@@ -7,6 +7,7 @@ rescue LoadError
   TREE_SITTER_AVAILABLE = false
 end
 
+require_relative "extraction_result"
 require_relative "treesitter/base_walker"
 require_relative "treesitter/python_walker"
 require_relative "treesitter/go_walker"
@@ -55,37 +56,64 @@ module Rubik
           Thread.current[:rubik_ts_parsers]&.clear
         end
 
+        # Array-or-nil seam (unchanged contract for every existing caller):
+        # nil means "fall back to the regex extractor".
         def extract(file_path, content = nil)
-          return nil unless available?
+          result = extract_result(file_path, content)
+          result.trustworthy? ? result.symbols : nil
+        end
+
+        # Structured outcome (issue #147): status :ok / :partial / :failed /
+        # :unavailable plus best-effort symbols, so an empty result is never
+        # confused with a broken parse. See AST::ExtractionResult.
+        def extract_result(file_path, content = nil)
+          return unavailable_result unless available?
 
           ext = File.extname(file_path).downcase
           mapping = LANGUAGE_MAP[ext]
-          return nil unless mapping
+          return unavailable_result unless mapping
 
           code = content || (File.exist?(file_path) ? File.read(file_path) : "")
-          return [] if code.empty?
+          return ExtractionResult.new(symbols: [], status: :ok, source: :tree_sitter) if code.empty?
 
           code = code.encode("UTF-8", invalid: :replace, undef: :replace) unless code.valid_encoding?
 
           parser = parser_for(mapping[:parser])
-          return nil unless parser
+          return failed_result("no parser for #{mapping[:parser]}") unless parser
 
           tree = parser.parse(code)
-          return nil unless tree&.root_node
-
-          walker = mapping[:walker].new(file_path, code)
-          symbols = walker.walk(tree.root_node)
-          has_err = if tree.root_node.respond_to?(:has_error?)
-                      tree.root_node.has_error?
-                    elsif tree.root_node.respond_to?(:has_error)
-                      tree.root_node.has_error
-                    end
-          return nil if has_err && (symbols.nil? || symbols.empty?)
-
-          symbols
+          return failed_result("parser returned no tree") unless tree&.root_node
+
+          symbols = mapping[:walker].new(file_path, code).walk(tree.root_node) || []
+          if root_has_error?(tree.root_node)
+            return failed_result("tree-sitter reported syntax errors with no symbols") if symbols.empty?
+
+            return ExtractionResult.new(symbols: symbols, status: :partial, source: :tree_sitter,
+                                        detail: "tree-sitter reported syntax errors")
+          end
+
+          ExtractionResult.new(symbols: symbols, status: :ok, source: :tree_sitter)
         rescue StandardError, SystemStackError, ScriptError => e
           warn "[WARN] TreeSitter extraction failed for #{file_path}: #{e.message}" if ENV["RUBIK_DEBUG"]
-          nil
+          failed_result("#{e.class}: #{e.message}")
+        end
+
+        private
+
+        def root_has_error?(node)
+          if node.respond_to?(:has_error?)
+            node.has_error?
+          elsif node.respond_to?(:has_error)
+            node.has_error
+          end
+        end
+
+        def failed_result(detail)
+          ExtractionResult.new(symbols: [], status: :failed, source: :none, detail: detail)
+        end
+
+        def unavailable_result
+          ExtractionResult.new(symbols: [], status: :unavailable, source: :none)
         end
       end
     end

data/lib/rubik/buffer/apply_contract.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module Rubik
+  module Buffer
+    # The one home for the apply CONTRACT vocabulary (issue #146):
+    #  - who may apply the buffer: the model's apply_buffer tool is gated by
+    #    buffer.model_can_apply (the operator !apply flow never is);
+    #  - what a mid-run failure reports: the buffer is per-file atomic, NOT
+    #    a multi-file transaction, so the report names what DID reach disk,
+    #    what failed, what stays dirty for a retry, and skipped conflicts.
+    # Both planes (ApplyBufferTool, the !apply REPL command) render through
+    # here so the truth cannot drift between model and operator output.
+    module ApplyContract
+      module_function
+
+      # Authority resolution: the shell's live config wins when present; a
+      # tool rebuilt without a shell (ScopedRegistry branch workspaces) falls
+      # back to the buffer manager's own config. Missing config keeps the
+      # documented default (true).
+      def model_can_apply?(shell_config:, manager_config:)
+        cfg = shell_config || manager_config
+        return true if cfg.nil? || !cfg.respond_to?(:fetch)
+
+        cfg.fetch("buffer.model_can_apply", true) != false
+      end
+
+      # Partial-apply report lines. `sync` (when given) receives the applied
+      # paths and performs the context/AST sync; a raising sync is annotated,
+      # never allowed to swallow the report.
+      def failure_lines(failure, sync: nil)
+        lines = ["Apply stopped before completing; the buffer is not a multi-file transaction:"]
+        lines << if failure.applied.empty?
+                   "  • Nothing was written to disk."
+                 else
+                   "  • Already written to disk (do not re-apply): #{failure.applied.join(', ')}"
+                 end
+        cause = failure.cause
+        lines << "  • Failed: #{failure.failed}#{cause ? " (#{cause.class}: #{cause.message})" : " (#{failure.kind})"}"
+        lines << "  • Still dirty — a retry writes only these: #{failure.pending.join(', ')}" unless failure.pending.empty?
+        lines << "  • Skipped conflicts (disk changed externally): #{failure.conflicts.join(', ')}" unless failure.conflicts.empty?
+        if sync
+          annotation = sync_annotation(failure, sync)
+          lines << annotation if annotation
+        end
+        lines
+      end
+
+      # "Buffer is clean" alone reads as "nothing happened" when an earlier
+      # apply (the tool or the auto-apply policy) already flushed the edits
+      # to disk. Surface the last successful apply so the model can verify
+      # against reality instead of re-editing or force-applying (issue #97
+      # finding 6). When the mode cannot be read, the origin stays
+      # deliberately two-sided rather than inventing a specific cause.
+      def clean_buffer_message(last_applied, mode)
+        paths = last_applied.is_a?(Hash) ? Array(last_applied[:paths]) : []
+        return "No unapplied buffer changes to write (buffer is clean)." if paths.empty?
+
+        origin = if !mode.nil? && !mode.to_s.strip.empty? && mode.to_s.downcase != "manual"
+                   "the auto-apply policy (buffer.auto_apply: #{mode})"
+                 else
+                   "an earlier apply_buffer call or the auto-apply policy"
+                 end
+        "No unapplied buffer changes to write (buffer is clean): #{paths.size} file(s) were already written to disk " \
+          "at #{last_applied[:at].utc.iso8601} by #{origin}: #{paths.join(', ')}."
+      end
+
+      def sync_annotation(failure, sync)
+        return nil if failure.applied.empty?
+
+        sync.call(failure.applied)
+        nil
+      rescue StandardError => e
+        "  • context/AST sync failed for the already-written files: #{e.class}: #{e.message}"
+      end
+      private_class_method :sync_annotation
+    end
+  end
+end

data/lib/rubik/buffer/manager.rb

@@ -13,6 +13,25 @@ module Rubik
   module Buffer
     class InvalidPathError < StandardError; end
 
+    # Mid-run apply failure with the partial-progress report (issue #146):
+    # the buffer is NOT a multi-file transaction — entries already written
+    # stay on disk, and this error says exactly which. `kind` names the
+    # failure class (:write_failed or :containment_blocked); `cause` carries
+    # the underlying error. `pending` lists this run's entries that are
+    # still dirty (a retry writes only those).
+    class ApplyFailedError < StandardError
+      attr_reader :kind, :applied, :failed, :pending, :conflicts
+
+      def initialize(message, kind:, applied: [], failed: nil, pending: [], conflicts: [])
+        super(message)
+        @kind = kind
+        @applied = applied
+        @failed = failed
+        @pending = pending
+        @conflicts = conflicts
+      end
+    end
+
     class Manager
       attr_reader :root_dir, :dirty_files, :additional_roots, :rw_roots, :allowed_external_dirs, :rw_allowed_dirs, :guard, :last_conflicts
       attr_accessor :allow_external_writes, :config
@@ -270,6 +289,12 @@ module Rubik
         diffs.join("\n")
       end
 
+      # Applies dirty buffer entries to disk (per-file atomic writes — NOT a
+      # multi-file transaction). On a mid-run failure the partial progress is
+      # carried by ApplyFailedError: applied entries ARE on disk, the failed
+      # entry stays dirty, and pending entries keep their buffer content, so
+      # a retry writes only the remainder. External-modification conflicts
+      # are skipped (recorded in last_conflicts) unless policy is "overwrite".
       def apply!(target_paths = nil, policy: nil)
         @monitor.synchronize do
           applied_paths = []
@@ -282,7 +307,7 @@ module Rubik
 
           effective_policy = (policy || external_modification_policy).to_s.downcase
 
-          keys_to_apply.each do |rel_path|
+          keys_to_apply.each_with_index do |rel_path, index|
             next unless @dirty_files.key?(rel_path)
 
             unless PathValidator.valid?(rel_path)
@@ -323,14 +348,28 @@ module Rubik
               # last_conflicts on every run" holds for readers (AutoApply's
               # report_conflicts) even on the failure path.
               @last_conflicts = conflicts
-              raise InvalidPathError,
-                    "Write blocked: '#{rel_path}' resolves outside all allowed roots at apply time " \
-                    "(possible symlink swap since buffering). Re-verify the workspace and retry."
+              raise apply_failure(
+                "Write blocked: '#{rel_path}' resolves outside all allowed roots at apply time " \
+                "(possible symlink swap since buffering). Re-verify the workspace and retry.",
+                kind: :containment_blocked, applied: applied_paths, failed: rel_path,
+                pending: pending_after(keys_to_apply, index), conflicts: conflicts
+              )
             end
 
             content = @buffer[rel_path]
 
-            Rubik::Platform.atomic_write(full_path, content)
+            begin
+              Rubik::Platform.atomic_write(full_path, content)
+            rescue StandardError => e
+              @last_conflicts = conflicts
+              raise apply_failure(
+                "Apply failed for '#{rel_path}': #{e.class}: #{e.message}; " \
+                "#{applied_paths.empty? ? 'no file was written' : "already written: #{applied_paths.join(', ')}"}; " \
+                "#{pending_after(keys_to_apply, index).size} file(s) still dirty",
+                kind: :write_failed, applied: applied_paths, failed: rel_path,
+                pending: pending_after(keys_to_apply, index), conflicts: conflicts
+              ), cause: e
+            end
 
             @original_hashes[rel_path] = Digest::SHA256.hexdigest(content)
             @dirty_files.delete(rel_path)
@@ -422,6 +461,23 @@ module Rubik
       rescue Errno::ENOENT, Errno::EACCES
         nil
       end
+
+      # Build the structured partial-apply error with frozen report copies —
+      # a reader must see the state at raise time, not later mutations.
+      def apply_failure(message, kind:, applied:, failed:, pending:, conflicts:)
+        ApplyFailedError.new(
+          message, kind: kind,
+                   applied: applied.dup.freeze, failed: failed,
+                   pending: pending.dup.freeze, conflicts: conflicts.dup.freeze
+        )
+      end
+
+      # This run's remaining dirty entries after the failed index — exactly
+      # what a retry will still have to write (garbage-skipped entries are
+      # already out of dirty_files when this runs).
+      def pending_after(keys, index)
+        keys[(index + 1)..].to_a.select { |k| @dirty_files.key?(k) }
+      end
     end
   end
 end

data/lib/rubik/cli/workspace_trust.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "tty-prompt"
+require "yaml/store"
+
+module Rubik
+  module CLI
+    class WorkspaceTrust
+      TRUSTED_WORKSPACES_KEY = "trusted_workspaces"
+      TRUST_OPTION = "Trust and continue"
+      EXIT_OPTION = "Exit"
+
+      class << self
+        def authorize!(workspace:, input: $stdin, output: $stdout, store_path: default_store_path)
+          return true unless UI::Capability.interactive?(input: input, output: output)
+
+          workspace_path = File.realpath(workspace)
+          return true if trusted?(workspace_path, store_path: store_path)
+
+          output.puts <<~NOTICE
+            Workspace trust is required before Rubik loads this workspace:
+            #{workspace_path}
+
+            Rubik can read and modify workspace files and run foreground and background commands.
+            Some commands may run without a separate approval. OS sandboxing is disabled by default.
+
+            `buffer.model_can_apply: false` only restricts applying staged buffer changes; it does
+            not restrict shell commands.
+          NOTICE
+
+          choice = TTY::Prompt.new(input: input, output: output).select(
+            "Choose an option:",
+            [TRUST_OPTION, EXIT_OPTION],
+            default: EXIT_OPTION,
+            filter: false,
+            per_page: 2
+          )
+          return false unless choice == TRUST_OPTION
+
+          trust!(workspace_path, store_path: store_path)
+          true
+        rescue StandardError => e
+          output.puts "[Rubik] Workspace trust could not be established: #{e.message}. Exiting."
+          false
+        end
+
+        def trusted?(workspace, store_path: default_store_path)
+          return false unless File.file?(store_path)
+
+          store = YAML::Store.new(store_path, true)
+          store.transaction(true) do
+            Array(store[TRUSTED_WORKSPACES_KEY]).include?(File.realpath(workspace))
+          end
+        rescue Psych::Exception, SystemCallError
+          false
+        end
+
+        def trust!(workspace, store_path: default_store_path)
+          FileUtils.mkdir_p(File.dirname(store_path), mode: 0o700)
+          workspace_path = File.realpath(workspace)
+          store = YAML::Store.new(store_path, true)
+          store.transaction do
+            paths = Array(store[TRUSTED_WORKSPACES_KEY])
+            store[TRUSTED_WORKSPACES_KEY] = (paths + [workspace_path]).uniq
+          end
+          File.chmod(0o600, store_path)
+        end
+
+        private
+
+        def default_store_path
+          File.join(Platform.home_dir, ".rubik", "trusted_workspaces.yml")
+        end
+      end
+    end
+  end
+end