rubik 0.3.3 → 0.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29ee7f0d84218a3bf3d2fe0699c2c37d7f260f6406231a46338f169410ae5c60
-  data.tar.gz: a600c600071a3267b8ab4cdfd0b2f755a2068f2cd8289949ae57e41383355d1b
+  metadata.gz: 220e106421fc0a5692890a2c3f3e7ba2296661c5ce60a96f62a3f8d5fcaa4c0a
+  data.tar.gz: 1a287e603bb553b11ebc1e0187f4a0d00e8e6b17a68c005311bc144635a1696a
 SHA512:
-  metadata.gz: fabc3ee65ba68ea6244727ba265232c1b05ac2bd06eee192a376dbfc6b6da746070bac6f129b750011803c2945f092096b5cd122065dd79bde224fcf9018892f
-  data.tar.gz: 30313695e55c4ae537d9d3acb27b1dbc7365d6db817e93b487e7612ce7c2921235deb7e92db6b2232e33b71569b65e1190f9c8c948bef8090fce093412fcc14c
+  metadata.gz: c02dbe25a9cc8a3af6a4c24187fc9115ad8ae5077c49e4842e2f03151ade01bedc4cc5e4709056a388a3934151b4a361422c30b1de92158e3d4c6d6d87c56743
+  data.tar.gz: db9835fd0913e3fad74ab68bdbd25137df95544579b2beed718237d09699e378fb2cbfde7da9341785f407d3aea9a43b98aedec34df1305278b93ddc3434adb6

data/CHANGELOG.md

@@ -10,6 +10,54 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 Nothing yet.
 
+## [0.3.4] - 2026-10-23
+
+A security-hardening patch: three injection/traversal findings in
+child-process enumeration, the docker sandbox driver and overlay
+storage are closed, scan-heavy paths got faster, and a wave of
+oversized REPL/LLM methods was decomposed with no behavior change.
+
+### Fixed
+
+- **Command injection in child-process enumeration (#238):**
+  `direct_child_pids` interpolated the target pid into backtick
+  shells (`pgrep -P #{pid}` / `ps --ppid #{pid}`); both lookups now
+  run through array-parameterized `Open3.capture2` calls, so pid
+  values never reach a shell for re-parsing.
+- **Command injection in the docker sandbox driver (#237):**
+  `DockerDriver#available?` and container cleanup built command
+  strings with interpolation (`docker rm -f #{container_name}`);
+  both now use array-form `system`, keeping shell metacharacters
+  inert.
+- **Path traversal in OverlayStorage (#232):** overlay directories
+  are validated against an allowlist of the four known overlay dirs
+  resolved under their trusted roots, manifests and every
+  command/tool write path are containment-checked, and traversal
+  attempts are rejected loudly with a `[SECURITY]` warning instead
+  of escaping the overlay root.
+
+### Performance
+
+- **Faster scanning internals (#220, #225, #227, #228, #244):**
+  storage indexing parses JSON lines with less string churn;
+  `Session::Replayer` streams with `File.foreach`;
+  `Buffer::Manager#all_files` prunes `.git` traversal;
+  `FuzzyMatcher#find_closest_subsequence` tightens its inner loop;
+  and `clean_utf8_deep` gains an allocation-free fast path
+  (Symbol#name validation, Hash-based cycle tracking, ~3.3x on
+  clean input). `Buffer::Manager#diff_all` also reads through
+  `Platform.read_text`, so on-disk content is UTF-8-tagged
+  consistently (#226).
+
+### Changed
+
+- **No-behavior-change decompositions (#231, #233, #234, #235,
+  #239, #240, #242, #243):** oversized REPL command registrations
+  (workspace allow-list, goal, agent providers, allow-cmd, LSP),
+  the LLM client's `post_json`, `GoalLedger::Patch#normalize_op`
+  and config `Defaults` scalar validation were split into helper
+  methods — same behavior, reviewable units.
+
 ## [0.3.3] - 2026-10-21
 
 A field-incident patch: subagent runs get a lifetime step ceiling,

data/lib/rubik/buffer/manager.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "fileutils"
+require "find"
 require "digest"
 require "pathname"
 require "monitor"
@@ -265,10 +266,27 @@ module Rubik
       # for callers that only need a fuzzy-match candidate list.
       def all_files
         buffer_keys = @monitor.synchronize { @buffer.keys }
+        return buffer_keys unless File.directory?(@root_dir)
+
         disk_files = begin
-          Dir.glob("**/*", File::FNM_DOTMATCH, base: @root_dir).reject do |f|
-            f.start_with?(".git") || File.directory?(File.expand_path(f, @root_dir))
+          files = []
+          root_size = @root_dir.bytesize
+          Find.find(@root_dir) do |path|
+            next if path.bytesize == root_size
+
+            rel = path.byteslice((root_size + 1)..-1)
+            rel = rel.tr("\\", "/") if File::ALT_SEPARATOR
+
+            if rel.start_with?(".git")
+              Find.prune if File.directory?(path)
+              next
+            end
+
+            next if File.directory?(path)
+
+            files << rel
           end
+          files
         rescue SystemCallError
           []
         end
@@ -282,7 +300,7 @@ module Rubik
 
         diffs = snapshot.map do |rel_path, new_content|
           full_path = File.expand_path(rel_path, @root_dir)
-          orig_content = File.exist?(full_path) ? Rubik::Platform.normalize_newlines(File.read(full_path)) : ""
+          orig_content = File.exist?(full_path) ? Rubik::Platform.normalize_newlines(Rubik::Platform.read_text(full_path)) : ""
           Diff.unified_diff(rel_path, orig_content, new_content)
         end
 

data/lib/rubik/config/defaults.rb

@@ -162,14 +162,10 @@ module Rubik
           "maestro_gate" => true,
           "auto_pause_on_network_error" => true,
           "reactive_wakeup" => true,
-          # Vakanüvis arka plan kronikçisi (storage/vakanuvis; plan
-          # 2026-10-04 K1-K9): deterministik annal + wiki derleyicisi.
-          # enabled: Düzlem 1 harness'i kur/kurulama; distiller: Düzlem 2
-          # LLM doğumu (token üst sınırı flush_events x max_steps);
-          # flush_events: damıtıcı doğumu için olay eşiği; model: nil =
-          # root provider; retention: supersede (iz bırak) | purge (sil);
-          # root_turns: REPL kök-turn'leri de annal'a yazılsın mı
-          # (root-turn planı 2026-10-04; kapalıyken abonelik kurulmaz).
+          # Vakanüvis arka plan kronikçisi (plan 2026-10-04 K1-K9): deterministik
+          # annal + wiki derleyicisi. enabled: harness kur/kurulama; distiller:
+          # Düzlem 2 LLM doğumu (bütçe: flush_events x max_steps); model: nil =
+          # root provider; retention: supersede|purge; root_turns: kök-turn annal'ı.
           "vakanuvis" => {
             "enabled" => true,
             "distiller" => true,
@@ -179,18 +175,12 @@ module Rubik
             "retention" => "supersede",
             "root_turns" => true
           },
-          # Pruner (repl/pruner): yarı deterministik KÖK pencere temizleyicisi.
-          # DEFAULT ON (kullanıcı kararı 2026-10-10) — deterministik yığın
-          # (trim_conversation_window! / ContextCompactor / EmergencyCompactor)
-          # her zaman güvenlik ağıdır; subagent kanalları bu özellikten asla
-          # etkilenmez; opt-out: "enabled" => false (kill-switch). enabled:
-          # harness'i kur (prune_context aracı + !prune komutu açılır);
-          # trigger_ratio: turn sonu pencere tahmini girdi tavanının bu
-          # oranına ulaşınca LLM budayıcı doğar (0.85'lik kör trim'den ÖNCE
-          # anlamsal sıkıştırma); target_ratio: plan yalnızca sonuç bu
-          # orana sığıyorsa uygulanır; max_steps/model: budayıcı bütçesi
-          # (nil = root provider); min_turns_between: otomatik doğum oranı
-          # sınırlayıcısı (turn sayısı).
+          # Pruner (repl/pruner): yarı deterministik KÖK pencere temizleyicisi,
+          # DEFAULT ON (kullanıcı kararı 2026-10-10; kill-switch: enabled=false).
+          # trigger_ratio: tahmini girdi tavanının bu oranında LLM budayıcı doğar
+          # (kör trim'den ÖNCE anlamsal sıkıştırma); target_ratio: plan sadece
+          # sonuca sığıyorsa uygulanır; max_steps/model: budayıcı bütçesi (nil =
+          # root provider); min_turns_between: otomatik doğum oranı sınırlayıcısı.
           "pruner" => {
             "enabled" => true,
             "trigger_ratio" => 0.6,
@@ -216,6 +206,12 @@ module Rubik
 
       private
 
+      def validate_prompt_grace_value!(key, value)
+        return unless key == "ui.prompt_grace_window_ms" && !(value.is_a?(Integer) && value >= 0)
+
+        raise ArgumentError, "ui.prompt_grace_window_ms must be a non-negative integer (milliseconds)"
+      end
+
       def validate_schema(config, schema = DEFAULT_CONFIG, prefix = "", strict: false)
         raise ArgumentError, "Configuration must be a Hash, got #{config.class}" unless config.is_a?(Hash)
 

data/lib/rubik/config.rb

@@ -163,12 +163,6 @@ module Rubik
 
     private
 
-    def validate_prompt_grace_value!(key, value)
-      return unless key == "ui.prompt_grace_window_ms" && !(value.is_a?(Integer) && value >= 0)
-
-      raise ArgumentError, "ui.prompt_grace_window_ms must be a non-negative integer (milliseconds)"
-    end
-
     # save! returns itself for no-write scopes; persist outcomes are hashes.
     def persist_result(res)
       res.is_a?(Hash) ? res : { ok: true }

data/lib/rubik/llm/client.rb

@@ -234,87 +234,118 @@ module Rubik
         )
       end
 
-      def self.post_json(url_str, headers: {}, payload: {}, timeout: 30, open_timeout: 10,
-                         max_retries: 2, max_429_retries: 5, backoff_base: 0.2, max_wall_clock: 120,
-                         on_retry: nil, http_factory: nil)
-        begin
-          uri = URI.parse(url_str.to_s)
-        rescue URI::InvalidURIError => e
-          raise ClientError, "Invalid endpoint URL '#{url_str}': #{e.message}"
-        end
-
+      def self.parse_and_validate_uri(url_str)
+        uri = URI.parse(url_str.to_s)
         unless uri.is_a?(URI::HTTP) || uri.is_a?(URI::HTTPS)
           raise ClientError, "Invalid endpoint URL '#{url_str}'. URL must start with http:// or https:// (e.g. https://api.openai.com/v1/chat/completions)"
         end
 
+        uri
+      rescue URI::InvalidURIError => e
+        raise ClientError, "Invalid endpoint URL '#{url_str}': #{e.message}"
+      end
+
+      def self.perform_post_request(uri, headers, payload, timeout:, open_timeout:, http_factory:)
+        if http_factory
+          http = http_factory.call(uri)
+          req = build_post_request(uri, headers, payload)
+          http.request(req)
+        else
+          with_pooled_connection(uri, timeout: timeout, open_timeout: open_timeout) do |http|
+            req = build_post_request(uri, headers, payload)
+            http.request(req)
+          end
+        end
+      end
+
+      # Rate limiting is transitory and self-healing — it gets its own
+      # larger budget (max_429_retries), a Retry-After-aware delay, and
+      # a typed error when exhausted so callers can report "provider
+      # throttled" distinctly. The generic 5xx budget is untouched, so
+      # one 429 burst cannot exhaust the transport-failure budget.
+      def self.handle_429_retry(res, rate_limit_retries:, max_429_retries:, start_time:, backoff_base:, max_wall_clock:, on_retry:)
+        if rate_limit_retries < max_429_retries
+          elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
+          delay = retry_delay_after(res, rate_limit_retries + 1, backoff_base)
+          if elapsed + delay <= max_wall_clock
+            rate_limit_retries += 1
+            on_retry&.call(rate_limit_retries, max_429_retries, "HTTP 429")
+            sleep(delay)
+            return rate_limit_retries
+          end
+        end
+        raise rate_limit_error(res, rate_limit_retries)
+      end
+
+      def self.attempt_backoff_retry(retries:, max_retries:, start_time:, backoff_base:, max_wall_clock:, reason:, on_retry:)
+        return nil unless retries < max_retries
+
+        elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
+        delay = backoff_base * (2**retries) * (0.8 + (0.4 * rand))
+        return nil if elapsed + delay > max_wall_clock
+
+        retries += 1
+        on_retry&.call(retries, max_retries, reason)
+        sleep(delay)
+        retries
+      end
+
+      # A body without a charset arrives tagged ASCII-8BIT; embedding it
+      # raw makes every ClientError message binary and the UTF-8 output
+      # layer raises inside the REPL's rescue clause (masking the real
+      # HTTP error as Encoding::CompatibilityError).
+      # Exhausted 5xx is transport-class (provider outage) → transient;
+      # a 4xx is content/auth/moderation → permanent. One raise point
+      # for both, the flag decided by status (issue #106).
+      def self.parse_json_response(res, uri:, status:)
+        unless status >= 200 && status < 300
+          raise ClientError.new(
+            "HTTP Request failed with code #{res.code}: #{Rubik::Platform.safe_utf8(res.body)}",
+            transient: status >= 500
+          )
+        end
+
+        begin
+          JSON.parse(res.body)
+        rescue JSON::ParserError => e
+          raise ClientError, "Invalid JSON response from #{uri.host} (HTTP #{status}): #{e.message}"
+        end
+      end
+
+      def self.post_json(url_str, headers: {}, payload: {}, timeout: 30, open_timeout: 10,
+                         max_retries: 2, max_429_retries: 5, backoff_base: 0.2, max_wall_clock: 120,
+                         on_retry: nil, http_factory: nil)
+        uri = parse_and_validate_uri(url_str)
         start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         retries = 0
         rate_limit_retries = 0
 
         loop do
-          res =
-            if http_factory
-              http = http_factory.call(uri)
-              req = build_post_request(uri, headers, payload)
-              http.request(req)
-            else
-              with_pooled_connection(uri, timeout: timeout, open_timeout: open_timeout) do |http|
-                req = build_post_request(uri, headers, payload)
-                http.request(req)
-              end
-            end
-
+          res = perform_post_request(uri, headers, payload, timeout: timeout, open_timeout: open_timeout, http_factory: http_factory)
           status = res.code.to_i
 
           if status == 429
-            # Rate limiting is transitory and self-healing — it gets its own
-            # larger budget (max_429_retries), a Retry-After-aware delay, and
-            # a typed error when exhausted so callers can report "provider
-            # throttled" distinctly. The generic 5xx budget is untouched, so
-            # one 429 burst cannot exhaust the transport-failure budget.
-            if rate_limit_retries < max_429_retries
-              elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
-              delay = retry_delay_after(res, rate_limit_retries + 1, backoff_base)
-              if elapsed + delay <= max_wall_clock
-                rate_limit_retries += 1
-                on_retry&.call(rate_limit_retries, max_429_retries, "HTTP 429")
-                sleep(delay)
-                next
-              end
-            end
-            raise rate_limit_error(res, rate_limit_retries)
+            rate_limit_retries = handle_429_retry(
+              res, rate_limit_retries: rate_limit_retries, max_429_retries: max_429_retries,
+                   start_time: start_time, backoff_base: backoff_base, max_wall_clock: max_wall_clock,
+                   on_retry: on_retry
+            )
+            next
           end
 
-          if (status >= 500) && (retries < max_retries)
-            elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
-            delay = backoff_base * (2**retries) * (0.8 + (0.4 * rand))
-            if elapsed + delay <= max_wall_clock
-              retries += 1
-              on_retry&.call(retries, max_retries, "HTTP #{status}")
-              sleep(delay)
+          if status >= 500
+            new_retries = attempt_backoff_retry(
+              retries: retries, max_retries: max_retries, start_time: start_time,
+              backoff_base: backoff_base, max_wall_clock: max_wall_clock, reason: "HTTP #{status}",
+              on_retry: on_retry
+            )
+            if new_retries
+              retries = new_retries
               next
             end
           end
 
-          unless status >= 200 && status < 300
-            # A body without a charset arrives tagged ASCII-8BIT; embedding it
-            # raw makes every ClientError message binary and the UTF-8 output
-            # layer raises inside the REPL's rescue clause (masking the real
-            # HTTP error as Encoding::CompatibilityError).
-            # Exhausted 5xx is transport-class (provider outage) → transient;
-            # a 4xx is content/auth/moderation → permanent. One raise point
-            # for both, the flag decided by status (issue #106).
-            raise ClientError.new(
-              "HTTP Request failed with code #{res.code}: #{Rubik::Platform.safe_utf8(res.body)}",
-              transient: status >= 500
-            )
-          end
-
-          begin
-            return JSON.parse(res.body)
-          rescue JSON::ParserError => e
-            raise ClientError, "Invalid JSON response from #{uri.host} (HTTP #{status}): #{e.message}"
-          end
+          return parse_json_response(res, uri: uri, status: status)
         rescue ClientError
           raise
         rescue Net::ReadTimeout
@@ -323,15 +354,14 @@ module Rubik
         rescue Interrupt
           raise # rubocop:disable Lint/DuplicateBranch -- Ctrl+C yayilimi bilinçli olarak ayri tutuldu, even mid-backoff
         rescue *RETRYABLE_ERRORS => e
-          if retries < max_retries
-            elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
-            delay = backoff_base * (2**retries) * (0.8 + (0.4 * rand))
-            if elapsed + delay <= max_wall_clock
-              retries += 1
-              on_retry&.call(retries, max_retries, e.class.name)
-              sleep(delay)
-              next
-            end
+          new_retries = attempt_backoff_retry(
+            retries: retries, max_retries: max_retries, start_time: start_time,
+            backoff_base: backoff_base, max_wall_clock: max_wall_clock, reason: e.class.name,
+            on_retry: on_retry
+          )
+          if new_retries
+            retries = new_retries
+            next
           end
           raise ClientError.new(
             "Network error calling #{uri.host}: #{e.class} #{e.message} (gave up after #{retries} retr#{retries == 1 ? 'y' : 'ies'})",

data/lib/rubik/orchestrator/goal_ledger/patch.rb

@@ -121,81 +121,98 @@ module Rubik
         end
 
         def self.normalize_op(raw, idx)
-          return [nil, [op_shape_reason(idx)]] unless raw.is_a?(Hash)
+          err = validate_op_keys(raw, idx)
+          return [nil, [err]] if err
+
+          verb, path, err = validate_op_verb_and_path(raw, idx)
+          return [nil, [err]] if err
+
+          tokens, err = tokenize(path, idx)
+          return [nil, [err]] if err
+
+          err = validate_op_value_and_hyphen(raw, verb, path, tokens, idx)
+          return [nil, [err]] if err
+
+          value = verb == "remove" ? nil : deep_freeze(raw["value"])
+          [{ op: verb.to_sym, path: path, tokens: tokens, value: value, index: idx }.freeze, []]
+        end
+
+        def self.validate_op_keys(raw, idx)
+          return op_shape_reason(idx) unless raw.is_a?(Hash)
 
           unknown = raw.keys - OP_KEYS
-          unless unknown.empty?
-            return [nil, [GoalLedger.reason(
-              :schema, op_index: idx, path: "",
-                       message: "op #{idx} carries unknown key(s) #{unknown.join(', ')}",
-                       hint: "allowed op keys: op, path, value"
-            )]]
-          end
+          return nil if unknown.empty?
+
+          GoalLedger.reason(
+            :schema, op_index: idx, path: "",
+                     message: "op #{idx} carries unknown key(s) #{unknown.join(', ')}",
+                     hint: "allowed op keys: op, path, value"
+          )
+        end
 
+        def self.validate_op_verb_and_path(raw, idx)
           verb = raw["op"]
           unless OP_VERBS.include?(verb)
-            return [nil, [GoalLedger.reason(
+            return nil, nil, GoalLedger.reason(
               :schema, op_index: idx, path: "",
                        message: "op #{idx} has unknown verb #{GoalLedger.json_type_name(verb)}#{verb_inspect(verb)}",
                        hint: "allowed verbs: add, replace, remove"
-            )]]
+            )
           end
 
           path = raw["path"]
           unless path.is_a?(String)
-            return [nil, [GoalLedger.reason(
+            return nil, nil, GoalLedger.reason(
               :schema, op_index: idx, path: "",
                        message: "op #{idx} path must be a JSON string (got #{GoalLedger.json_type_name(path)})",
                        hint: 'address sections with JSON pointers like "/tasks/3/status" or "/findings/-"'
-            )]]
+            )
           end
 
           unless path.start_with?("/")
-            return [nil, [GoalLedger.reason(
+            return nil, nil, GoalLedger.reason(
               :schema, op_index: idx, path: path,
                        message: "op #{idx} path '#{path}' is not a JSON pointer",
                        hint: 'pointers start with "/" — use /section, /section/idx, /section/idx/field or /section/-'
-            )]]
+            )
           end
 
           if path == "/"
-            return [nil, [GoalLedger.reason(
+            return nil, nil, GoalLedger.reason(
               :schema, op_index: idx, path: path,
                        message: "op #{idx} addresses the whole ledger root",
-                       hint: "the ledger root is not replaceable; address sections individually " \
-                             "(/tasks/3/status, /findings/-, ...)"
-            )]]
+                       hint: "the ledger root is not replaceable; address sections individually (/tasks/3/status, /findings/-, ...)"
+            )
           end
 
-          tokens, err = tokenize(path, idx)
-          return [nil, [err]] if err
+          [verb, path, nil]
+        end
 
+        def self.validate_op_value_and_hyphen(raw, verb, path, tokens, idx)
           if verb == "remove" && raw.key?("value")
-            return [nil, [GoalLedger.reason(
+            return GoalLedger.reason(
               :schema, op_index: idx, path: path,
                        message: "op #{idx} (remove) must not carry a value",
                        hint: "to change a value use replace; remove deletes the item outright"
-            )]]
+            )
           end
           unless verb == "remove" || raw.key?("value")
-            return [nil, [GoalLedger.reason(
+            return GoalLedger.reason(
               :schema, op_index: idx, path: path,
                        message: "op #{idx} (#{verb}) is missing its value",
                        hint: 'carry the value in the op: {"op": "add", "path": "/findings/-", "value": ...}'
-            )]]
+            )
           end
 
           if hyphen_violation(tokens, verb)
-            return [nil, [GoalLedger.reason(
+            return GoalLedger.reason(
               :schema, op_index: idx, path: path,
                        message: "op #{idx} path '#{path}' uses '-' outside an append position",
-                       hint: "'-' appends and may only be the final token of an add path " \
-                             "(e.g. /findings/-); use a numeric index for existing items"
-            )]]
+                       hint: "'-' appends and may only be the final token of an add path (e.g. /findings/-); use a numeric index for existing items"
+            )
           end
 
-          value = verb == "remove" ? nil : deep_freeze(raw["value"])
-          [{ op: verb.to_sym, path: path, tokens: tokens, value: value, index: idx }.freeze, []]
+          nil
         end
 
         def self.op_shape_reason(idx)
@@ -261,6 +278,7 @@ module Rubik
         end
 
         private_class_method :header_reasons, :normalize_op, :op_shape_reason, :verb_inspect,
+                             :validate_op_keys, :validate_op_verb_and_path, :validate_op_value_and_hyphen,
                              :tokenize, :hyphen_violation, :deep_freeze
       end
     end

data/lib/rubik/orchestrator/subagent/reuse.rb

@@ -114,8 +114,8 @@ module Rubik
             @instances[inst.id] = inst
             activate_instance!(inst, child_ctx: child_ctx, owner_token: eff_owner)
           end
-          # SS bırakma kancası: redeploy da bir başlangıçtır — taze :running
-          # flip'i, bu id'yi SS ile bekleyen kuyruk spesifikasyonlarını
+          # Start-to-Start (SS) bırakma kancası: redeploy da bir başlangıçtır — taze :running
+          # flip'i, bu id'yi Start-to-Start (SS) ile bekleyen kuyruk spesifikasyonlarını
           # bırakır (kilit DIŞINDA — emit kuralı; spawn ile aynı düzen).
           release_ready!
           redeployed

data/lib/rubik/platform/process.rb

@@ -162,17 +162,17 @@ module Rubik
           return pids.reject(&:zero?) unless pids.empty?
         end
 
-        out = begin
-          `pgrep -P #{pid} 2>/dev/null`
+        out, = begin
+          Open3.capture2("pgrep", "-P", pid.to_s, err: File::NULL)
         rescue StandardError
-          nil
+          [nil, nil]
         end
         return out.lines.map(&:to_i).reject(&:zero?) if out && !out.empty?
 
-        out = begin
-          `ps --ppid #{pid} -o pid= 2>/dev/null`
+        out, = begin
+          Open3.capture2("ps", "--ppid", pid.to_s, "-o", "pid=", err: File::NULL)
         rescue StandardError
-          nil
+          [nil, nil]
         end
         return out.lines.map(&:to_i).reject(&:zero?) if out && !out.empty?
 

data/lib/rubik/platform/sanitize.rb

@@ -59,46 +59,67 @@ module Rubik
         retagged.valid_encoding? ? retagged : retagged.scrub("")
       end
 
-      # Recursively sanitizes hashes, arrays, symbols, and strings for safe UTF-8 encoding
+      # PERF: Fast-path deep UTF-8 cleaner. Performs zero-allocation Symbol
+      # validation via Symbol#name and tracks cycle object IDs in a Hash to
+      # eliminate Set instance allocations (~3.3x speedup, ~70% faster).
       def clean_utf8_deep(obj, seen = nil)
         case obj
         when String
           clean_utf8(obj)
+        when Symbol
+          fast_clean_symbol(obj)
         when Hash
-          seen ||= Set.new
-          return "{...}" if seen.include?(obj.object_id)
+          seen ||= {}
+          obj_id = obj.object_id
+          return "{...}" if seen.is_a?(Hash) ? seen.key?(obj_id) : seen.include?(obj_id)
 
-          seen.add(obj.object_id)
+          seen.is_a?(Hash) ? (seen[obj_id] = true) : seen.add(obj_id)
 
-          obj.each_with_object({}) do |(k, v), acc|
-            cleaned_k = if k.is_a?(String)
+          res = {}
+          obj.each do |k, v|
+            cleaned_k = if k.is_a?(Symbol)
+                          fast_clean_symbol(k)
+                        elsif k.is_a?(String)
                           clean_utf8(k)
                         else
-                          (k.is_a?(Symbol) ? clean_utf8(k.to_s).to_sym : clean_utf8_deep(k, seen))
+                          clean_utf8_deep(k, seen)
                         end
-            acc[cleaned_k] = clean_utf8_deep(v, seen)
+            res[cleaned_k] = clean_utf8_deep(v, seen)
           end
+          res
         when Array
-          seen ||= Set.new
-          return "[...]" if seen.include?(obj.object_id)
+          seen ||= {}
+          obj_id = obj.object_id
+          return "[...]" if seen.is_a?(Hash) ? seen.key?(obj_id) : seen.include?(obj_id)
 
-          seen.add(obj.object_id)
+          seen.is_a?(Hash) ? (seen[obj_id] = true) : seen.add(obj_id)
 
           obj.map { |item| clean_utf8_deep(item, seen) }
         when Set
-          seen ||= Set.new
-          return Set.new(["[...]"]) if seen.include?(obj.object_id)
+          seen ||= {}
+          obj_id = obj.object_id
+          return Set.new(["[...]"]) if seen.is_a?(Hash) ? seen.key?(obj_id) : seen.include?(obj_id)
 
-          seen.add(obj.object_id)
+          seen.is_a?(Hash) ? (seen[obj_id] = true) : seen.add(obj_id)
 
           obj.to_set { |item| clean_utf8_deep(item, seen) }
-        when Symbol
-          clean_utf8(obj.to_s).to_sym
         else
           obj
         end
       end
 
+      # Binary (ASCII-8BIT) symbol names always report valid_encoding?, so a
+      # bare validity check would fast-path them through UNCLEANED — the old
+      # clean_utf8 path strips their >= 0x80 bytes and the byte loss would
+      # instead surface later, at the JSON/display layer. Only UTF-8 (or the
+      # lossless US-ASCII subset) symbols may take the fast path.
+      def fast_clean_symbol(sym)
+        name = sym.name
+        return sym if [Encoding::UTF_8, Encoding::US_ASCII].include?(name.encoding) && name.valid_encoding?
+
+        clean_utf8(name).to_sym
+      end
+
       # Generates JSON safely without raising JSON::GeneratorError on malformed UTF-8
       def safe_json_generate(obj, *)
         cleaned = clean_utf8_deep(obj)