rubik 0.4.1 → 0.5.0

data/lib/rubik/mcp/manager.rb

@@ -51,6 +51,7 @@ module Rubik
         # boot epoch that owns them (@boot_marks).
         @stopped = false
         @boot_thread = nil
+        @boot_slot = nil
         @boot_marks = {}
         @monitor = Monitor.new
       end
@@ -68,18 +69,13 @@ module Rubik
         name_str = name.to_s
         parsed_defn = defn.is_a?(Hash) ? defn.transform_keys(&:to_s) : {}
         persist_res = { ok: true }
-        tools_count = 0
 
         @monitor.synchronize do
           @servers[name_str] = parsed_defn
           @statuses[name_str] ||= :disabled
 
           if @config && persist && @config.persisting?(persist)
-            server_hash = {
-              "command" => parsed_defn["command"],
-              "args" => Array(parsed_defn["args"]),
-              "env" => parsed_defn["env"] || {}
-            }
+            server_hash = { "command" => parsed_defn["command"], "args" => Array(parsed_defn["args"]), "env" => parsed_defn["env"] || {} }
             # Per-server handshake override round-trips only when present,
             # so `!mcp add` output stays minimal (the knob is hand-written
             # config, not a CLI flag).
@@ -87,14 +83,12 @@ module Rubik
             persist_res = @config.set("mcp.servers.#{name_str}", server_hash, persist: persist)
           end
 
-          if auto_start && enabled?
-            enable_server(name_str)
-          else
-            transition_server!(name_str, :disabled)
-          end
-          tools_count = (@tools[name_str] || []).size
+          transition_server!(name_str, :disabled) unless auto_start && enabled?
         end
 
+        enable_server(name_str) if auto_start && enabled?
+
+        tools_count = @monitor.synchronize { (@tools[name_str] || []).size }
         persist_res.merge(tools: tools_count)
       end
 
@@ -219,30 +213,42 @@ module Rubik
           # Post-wiring failures stopped the client via the ctx drain above;
           # pre-wiring failures (stale-context dispose, ctx.extend) reach
           # only this line — idempotent Client#stop makes it exactly-once.
-          begin
-            client.stop
-          rescue StandardError
-            nil
-          end
+          safely_stop_rolled_back_client(client, name_str)
           raise e
         end
       end
 
       def enable_server(name)
         name_str = name.to_s
+        server_defn = nil
+        epoch = nil
         @monitor.synchronize do
           server_defn = @servers[name_str]
           raise Rubik::MCP::Error, "MCP server '#{name_str}' not found" unless server_defn
 
           return @clients[name_str] if @statuses[name_str] == :active && @clients[name_str]&.running?
 
-          connected = begin
-            connect_server(name_str, server_defn)
-          rescue StandardError
-            transition_server!(name_str, :failed)
-            raise
+          epoch = Object.new
+          transition_server!(name_str, :connecting)
+          @boot_marks[name_str] = epoch
+        end
+
+        connected = begin
+          connect_server(name_str, server_defn)
+        rescue StandardError => e
+          @monitor.synchronize { transition_server!(name_str, :failed, epoch: epoch) }
+          raise e
+        end
+
+        @monitor.synchronize do
+          if @stopped || @statuses[name_str] != :connecting || !@boot_marks[name_str].equal?(epoch)
+            safely_stop_rolled_back_client(connected[:client], name_str)
+            return @clients[name_str]
           end
+
           apply_connected_server(name_str, server_defn, **connected)
+          transition_server!(name_str, :active, epoch: epoch)
+          @clients[name_str]
         end
       end
 
@@ -301,18 +307,29 @@ module Rubik
         end
 
         join_boot_safely(2.0)
+        epoch = Object.new
         @monitor.synchronize { @stopped = false }
         thread = Thread.new do
           perform_load_from_config(cfg)
         rescue StandardError, Interrupt => e
           Rubik::Log.warn(:mcp, "background MCP boot failed (#{e.class}: #{e.message})")
         ensure
-          # Only clear OUR reference: a wedged boot A expiring past the drain
-          # bound must not clobber the handle to a newer boot B's thread.
-          @monitor.synchronize { @boot_thread = nil if @boot_thread.equal?(Thread.current) }
+          # Epoch-tagged clear: only clear OUR reference so a wedged boot A
+          # expiring past the drain bound cannot clobber a newer boot B's slot.
+          @monitor.synchronize do
+            @boot_slot = @boot_thread = nil if @boot_slot && @boot_slot[:epoch].equal?(epoch)
+          end
         end
         thread.name = "rubik-mcp-boot" if thread.respond_to?(:name=)
-        @boot_thread = thread
+        @monitor.synchronize do
+          if thread.alive?
+            @boot_slot = { thread: thread, epoch: epoch }
+            @boot_thread = thread
+          elsif @boot_slot && @boot_slot[:epoch].equal?(epoch)
+            @boot_slot = @boot_thread = nil
+          end
+        end
+        thread
       end
 
       private
@@ -509,7 +526,6 @@ module Rubik
             disable_server(name)
           rescue StandardError => e
             Rubik::Log.warn(:mcp, "failed to stop MCP server '#{name}' during teardown (#{e.class}: #{e.message})")
-            nil
           end
         end
       end
@@ -517,11 +533,7 @@ module Rubik
       alias dispose stop_all
 
       def status_summary
-        @monitor.synchronize do
-          @servers.map do |name, _defn|
-            server_status(name)
-          end.compact
-        end
+        @monitor.synchronize { @servers.keys.map { |name| server_status(name) }.compact }
       end
 
       def server_status(name)
@@ -602,9 +614,7 @@ module Rubik
       # falls through to the next source — a miswritten knob must never fail
       # the boot at the config boundary.
       def resolve_connect_timeout(server_defn, explicit)
-        sources = [explicit, server_defn["timeout"] || server_defn[:timeout]]
-        cfg_timeout = @config&.fetch("mcp.timeout", nil)
-        sources << cfg_timeout unless cfg_timeout.nil?
+        sources = [explicit, server_defn["timeout"] || server_defn[:timeout], @config&.fetch("mcp.timeout", nil)]
 
         sources.each do |candidate|
           return candidate if candidate.is_a?(Numeric) && candidate.positive?
@@ -614,6 +624,12 @@ module Rubik
         end
         Client::DEFAULT_TIMEOUT
       end
+
+      def safely_stop_rolled_back_client(client, name)
+        client&.stop
+      rescue StandardError => e
+        Rubik::Log.warn(:mcp, "failed to stop rolled-back MCP client '#{name}' (#{e.class}: #{e.message})")
+      end
     end
   end
 end

data/lib/rubik/mcp/proxy_tool.rb

@@ -91,6 +91,23 @@ module Rubik
             output: output_text
           )
         end
+      rescue ConnectionError, TimeoutError => e
+        tail = if @client.respond_to?(:stderr_tail)
+                 @client.stderr_tail
+               elsif @client.respond_to?(:transport) && @client.transport.respond_to?(:stderr_tail)
+                 @client.transport.stderr_tail
+               else
+                 []
+               end
+        tail_lines = Array(tail).last(3)
+        stderr_detail = tail_lines.empty? ? "" : "; server stderr: #{tail_lines.join(' | ')}"
+        err_msg = "MCP server '#{@server_name}' is unreachable (#{e.class}: #{e.message}); its proxy tools are unavailable until reconnect or `!mcp` re-add#{stderr_detail}"
+        Rubik::Tools::Result.new(
+          tool_name: @name,
+          status: :error,
+          output: err_msg,
+          error: err_msg
+        )
       rescue StandardError => e
         Rubik::Tools::Result.new(
           tool_name: @name,

data/lib/rubik/mcp/transport/stdio.rb

@@ -11,6 +11,11 @@ module Rubik
   module MCP
     module Transport
       class Stdio
+        # The child's stderr pipe is drained continuously (see
+        # #start_stderr_thread); this many recent lines stay queryable via
+        # #stderr_tail for diagnostics.
+        STDERR_TAIL_LINES = 20
+
         attr_reader :command, :args, :env, :root_dir, :running, :wait_thr
 
         def initialize(command, args: [], env: {}, root_dir: Dir.pwd, guard: nil)
@@ -26,14 +31,25 @@ module Rubik
           @stderr = nil
           @wait_thr = nil
           @reader_thr = nil
+          @stderr_thr = nil
+          @stderr_mutex = Mutex.new
+          @stderr_tail = []
           @mutex = Mutex.new
           @cv = ConditionVariable.new
           @responses = {}
           @closed = false
+          @generation = 0
+          @pending_requests = Set.new
         end
 
         def open
-          return if @running
+          return if running?
+
+          # A previous incarnation whose child died on its own (the reader's
+          # ensure cleared @running) still holds pipe FDs and an unreaped
+          # wait thread; re-spawning over them leaks both. close is
+          # idempotent and a no-op when nothing lingers.
+          close if @wait_thr || @reader_thr || @stderr_thr
 
           cmd_parts = if @args.empty? && @command.is_a?(String)
                         begin
@@ -78,21 +94,29 @@ module Rubik
             raise ConnectionError, "Failed to spawn MCP process '#{bin}': #{e.message}"
           end
 
-          @running = true
-          @closed = false
-          @req_id = 0
-          @responses.clear
+          @mutex.synchronize do
+            @running = true
+            @closed = false
+            @generation += 1
+            @req_id = 0
+            @responses.clear
+            @pending_requests.clear
+          end
+          @stderr_mutex.synchronize { @stderr_tail.clear }
 
+          start_stderr_thread
           start_reader_thread
           self
         end
         alias start open
 
         def send_request(method, params = {}, timeout: 10)
-          raise ConnectionError, "MCP transport is not running" unless @running && @stdin
+          raise ConnectionError, "MCP transport is not running" unless running? && @stdin
 
           req_id = @mutex.synchronize do
             @req_id += 1
+            @pending_requests.add(@req_id)
+            @pending_requests.add(@req_id.to_s)
             @req_id
           end
 
@@ -103,8 +127,17 @@ module Rubik
             "params" => params || {}
           }
 
-          write_message(msg)
-          wait_for_response(req_id, timeout: timeout)
+          begin
+            write_message(msg)
+            wait_for_response(req_id, timeout: timeout)
+          ensure
+            @mutex.synchronize do
+              @pending_requests.delete(req_id)
+              @pending_requests.delete(req_id.to_s)
+              @responses.delete(req_id)
+              @responses.delete(req_id.to_s)
+            end
+          end
         end
 
         def send_notification(method, params = {})
@@ -120,10 +153,14 @@ module Rubik
         end
 
         def close
-          return if @closed
+          child_died = false
+          @mutex.synchronize do
+            return if @closed
 
-          @closed = true
-          @running = false
+            child_died = !@running
+            @closed = true
+            @running = false
+          end
 
           begin
             @reader_thr&.kill
@@ -131,13 +168,32 @@ module Rubik
             nil
           end
 
+          begin
+            @stderr_thr&.kill
+          rescue StandardError
+            nil
+          end
+
           if @wait_thr&.alive?
-            Rubik::Platform.kill_tree(@wait_thr.pid)
+            pid_to_kill = @wait_thr.pid
+            Rubik::Platform.kill_tree(pid_to_kill)
             begin
               @wait_thr.join(0.5)
             rescue StandardError
               nil
             end
+
+            if @wait_thr.alive?
+              abandoned_waiter = @wait_thr
+              Thread.new do
+                begin
+                  abandoned_waiter.join(2.5)
+                rescue StandardError
+                  nil
+                end
+                Rubik::Log.warn(:mcp, "abandoned child process pid #{pid_to_kill} did not exit within reaper window") if abandoned_waiter.alive?
+              end
+            end
           end
           @wait_thr = nil
 
@@ -155,8 +211,22 @@ module Rubik
             @reader_thr = nil
           end
 
+          begin
+            @stderr_thr&.join(0.5)
+          rescue StandardError
+            nil
+          ensure
+            @stderr_thr = nil
+          end
+
+          if child_died
+            hint = stderr_tail.last(5).join(" | ")[0, 512]
+            Rubik::Log.warn(:mcp, "MCP child process (pid #{pid}) had already exited; recent stderr: #{hint}") unless hint.empty?
+          end
+
           @mutex.synchronize do
             @responses.clear
+            @pending_requests.clear
             @cv.broadcast
           end
         end
@@ -164,7 +234,17 @@ module Rubik
         alias dispose close
 
         def running?
-          @running && (@wait_thr.nil? || @wait_thr.alive?)
+          @mutex.synchronize do
+            @running && (@wait_thr.nil? || @wait_thr.alive?)
+          end
+        end
+
+        # Recent stderr output from the child (last STDERR_TAIL_LINES lines).
+        # The drain keeps the OS pipe buffer empty so a chatty server can
+        # never block on stderr write; the tail is what makes that output
+        # diagnosable instead of silently discarded.
+        def stderr_tail
+          @stderr_mutex.synchronize { @stderr_tail.dup }
         end
 
         def pid
@@ -198,7 +278,12 @@ module Rubik
               remaining = timeout - elapsed
               if remaining <= 0
                 @responses.delete(req_id)
-                raise TimeoutError, "Timed out waiting for MCP response to request #{req_id} after #{timeout}s"
+                # The stderr tail is the one place a wedged server explains
+                # itself (crash traces, logging storms); attach it so the
+                # timeout is diagnosable instead of opaque.
+                hint = stderr_tail.last(3).join(" | ")[0, 512]
+                suffix = hint.empty? ? "" : "; server stderr: #{hint}"
+                raise TimeoutError, "Timed out waiting for MCP response to request #{req_id} after #{timeout}s#{suffix}"
               end
 
               @cv.wait(@mutex, remaining)
@@ -217,8 +302,9 @@ module Rubik
         end
 
         def start_reader_thread
+          gen = @mutex.synchronize { @generation }
           @reader_thr = Thread.new do
-            while @running && @stdout && !@stdout.closed?
+            while @mutex.synchronize { @running } && @stdout && !@stdout.closed?
               line = begin
                 @stdout.gets
               rescue IOError, Errno::EBADF
@@ -238,9 +324,46 @@ module Rubik
             end
           ensure
             @mutex.synchronize do
-              @running = false
-              @cv.broadcast
+              if @generation == gen
+                @running = false
+                @cv.broadcast
+              end
+            end
+          end
+        end
+
+        # Drain the child's stderr on its own thread. Without a reader, a
+        # server that logs more than the OS pipe buffer holds (~64KB on
+        # Linux, far less on Windows) blocks inside its write() and stops
+        # answering requests — every call then times out with no hint that
+        # the child is wedged on its own logging. EOF on stderr must NOT
+        # stop the transport: a child may close stderr and keep serving.
+        def start_stderr_thread
+          @stderr_thr = Thread.new do
+            while @running && @stderr && !@stderr.closed?
+              line = begin
+                @stderr.gets
+              rescue IOError, Errno::EBADF
+                nil
+              end
+              break unless line
+
+              line = line.chomp
+              # Cap retained size per line: a newline-less flood must not
+              # turn the diagnostic tail into a memory hog.
+              line = line[0, 4096] if line.length > 4096
+
+              @stderr_mutex.synchronize do
+                @stderr_tail << line
+                @stderr_tail.shift while @stderr_tail.length > STDERR_TAIL_LINES
+              end
             end
+          rescue IOError, Errno::EBADF
+            nil
+          rescue StandardError => e
+            # A silently dead drainer would recreate the exact wedge this
+            # thread exists to prevent — make its death greppable.
+            Rubik::Log.warn(:mcp, "stderr drain thread exited unexpectedly (#{e.class}: #{e.message}); the MCP child may block on a full stderr pipe")
           end
         end
 
@@ -248,6 +371,8 @@ module Rubik
           return unless msg.is_a?(Hash) && msg.key?("id")
 
           @mutex.synchronize do
+            return unless @pending_requests.include?(msg["id"])
+
             @responses[msg["id"]] = msg
             @cv.broadcast
           end

data/lib/rubik/orchestrator/budget_manager.rb

@@ -57,6 +57,8 @@ module Rubik
                                                 max_output_tokens: @deps.max_output_tokens, config: context_cfg,
                                                 absorb: GoalLedger::ObservationProjection.directive_for(deps: @deps)
                                ))
+        manager = @deps.runtime_manager if @deps.respond_to?(:runtime_manager)
+        Rubik::Storage::Vakanuvis::Orientation.inject_after_compaction!(@deps.history, manager, config: @deps.config)
       end
 
       def track_token_usage!(res)

data/lib/rubik/orchestrator/loop.rb

@@ -177,6 +177,7 @@ module Rubik
             end
           end
 
+          Rubik::Storage::Vakanuvis::Orientation.inject_session_start!(@history, @runtime_manager, config: @config)
           @history << { role: "user", content: formatted_task }
 
           execute_steps(opts: opts, plan_only: plan_only)

data/lib/rubik/orchestrator/shell_deps.rb

@@ -71,6 +71,10 @@ module Rubik
         @loop.emergency_compact_and_notify!(reason)
       end
 
+      def runtime_manager
+        @loop.runtime_manager if @loop.respond_to?(:runtime_manager)
+      end
+
       def respond_to_missing?(name, include_private = false)
         (SURFACE.include?(name) && @loop.respond_to?(name, include_private)) || super
       end

data/lib/rubik/orchestrator/turn_executor/user_channel.rb

@@ -103,6 +103,8 @@ module Rubik
 
         # ── announce ──
         def announce_compaction(reason, layer)
+          manager = @deps.runtime_manager if @deps.respond_to?(:runtime_manager)
+          Rubik::Storage::Vakanuvis::Orientation.inject_after_compaction!(@deps.history, manager, config: @deps.config)
           @deps.on_step&.call(type: :emergency_compact, reason: reason, step: @deps.step_count,
                               max_steps: @deps.max_steps, layer: layer)
         end

data/lib/rubik/plugin/manager.rb

@@ -100,30 +100,44 @@ module Rubik
       def load_dropin_plugins(runtime_manager:, storage:)
         plugins = storage.discover_plugins
         plugins.each do |plugin_meta|
-          integrity = storage.verify_integrity(plugin_meta[:path], scope: plugin_meta[:scope])
+          content = File.exist?(plugin_meta[:path]) ? File.binread(plugin_meta[:path]) : nil
+          integrity = storage.verify_integrity(plugin_meta[:path], scope: plugin_meta[:scope], content: content)
           if integrity == :rejected
             @logger.warn("Skipping drop-in plugin '#{plugin_meta[:name]}' due to integrity check failure.")
             next
           end
 
-          load_plugin_file(plugin_meta, runtime_manager: runtime_manager)
+          load_plugin_file(plugin_meta, runtime_manager: runtime_manager, content: content)
         end
       end
 
-      def load_plugin_file(plugin_meta, runtime_manager:)
+      def load_plugin_file(plugin_meta, runtime_manager:, content: nil)
         name = plugin_meta[:name]
         component_name = "plugin_#{name}"
 
-        unload_plugin(name, runtime_manager: runtime_manager) if runtime_manager.fibers.key?(component_name)
+        # If plugin is already running, prepare the replacement first (issue #309).
+        # Unloading before prepare would destroy the live plugin if the replacement has a syntax/prepare error.
+        already_running = runtime_manager.fibers.key?(component_name)
+        previous_def = Rubik::Plugin::Registry.get(name) if already_running
+        previous_fiber = runtime_manager.fibers[component_name] if already_running
+        was_active = previous_fiber&.state == :active
 
-        definition = prepare_plugin_definition(plugin_meta)
+        definition = prepare_plugin_definition(plugin_meta, content: content)
         return false unless definition
 
+        unload_plugin(name, runtime_manager: runtime_manager) if already_running
+        Rubik::Plugin::Registry.register(definition)
+
         fiber = register_plugin_component(name, definition, plugin_meta, runtime_manager: runtime_manager)
-        return false unless fiber
+        if fiber.nil? || fiber.state == :failed || (was_active && fiber.state == :pending)
+          if already_running && previous_def
+            @logger.error("Failed to activate replacement for plugin '#{name}' (state: #{fiber&.state}); rolling back to previous version")
+            runtime_manager.unregister_component(component_name)
+            restore_previous_plugin(name, previous_def, plugin_meta, runtime_manager: runtime_manager)
+          end
+          return false
+        end
 
-        # Honest load result (issue #144): a failed activation (factory raised)
-        # is reported as failure, not as a successful load.
         fiber.state != :failed
       end
 
@@ -159,14 +173,19 @@ module Rubik
           return false
         end
 
-        integrity = storage.verify_integrity(target[:path], scope: target[:scope])
+        content = File.exist?(target[:path]) ? File.binread(target[:path]) : nil
+        integrity = storage.verify_integrity(target[:path], scope: target[:scope], content: content)
         if integrity == :rejected
           @logger.error("Reload of drop-in plugin '#{name}' refused: integrity check failed; previous version kept")
           return false
         end
 
+        component_name = "plugin_#{name}"
         previous = Rubik::Plugin::Registry.get(name)
-        definition = prepare_plugin_definition(target)
+        previous_fiber = runtime_manager.fibers[component_name]
+        was_active = previous_fiber&.state == :active
+
+        definition = prepare_plugin_definition(target, content: content)
         unless definition
           @logger.error("Reload of drop-in plugin '#{name}' failed during preparation; previous version kept")
           return false
@@ -175,10 +194,11 @@ module Rubik
         unload_plugin(name, runtime_manager: runtime_manager)
         Rubik::Plugin::Registry.register(definition)
         fiber = register_plugin_component(name, definition, target, runtime_manager: runtime_manager)
-        return true if fiber && fiber.state != :failed
+        return true if fiber && fiber.state != :failed && (!was_active || fiber.state == :active)
 
-        @logger.error("Reload of drop-in plugin '#{name}' failed during activation; rolling back")
-        runtime_manager.unregister_component("plugin_#{name}")
+        state_reason = fiber ? fiber.state.to_s : "nil fiber"
+        @logger.error("Reload of drop-in plugin '#{name}' failed during activation (ended #{state_reason}); rolling back")
+        runtime_manager.unregister_component(component_name)
         restore_previous_plugin(name, previous, target, runtime_manager: runtime_manager)
         false
       end
@@ -190,7 +210,7 @@ module Rubik
       # replacement can never cost the old version. Returns the new
       # Definition on success; nil on failure, with the previous registry
       # entry restored and the load-path claim released.
-      def prepare_plugin_definition(plugin_meta)
+      def prepare_plugin_definition(plugin_meta, content: nil)
         name = plugin_meta[:name]
         path = plugin_meta[:path]
         load_path = plugin_meta[:load_path]
@@ -199,7 +219,11 @@ module Rubik
         claim_load_path(load_path)
 
         begin
-          load path
+          if content
+            TOPLEVEL_BINDING.eval(content, path)
+          else
+            load path
+          end
         rescue StandardError, ScriptError => e
           @logger.error("Failed to parse drop-in plugin '#{name}': #{e.message}")
           rollback_prepared_definition(name, previous)

data/lib/rubik/plugin/package_inventory.rb

@@ -33,12 +33,22 @@ module Rubik
         e.message
       end
 
+      def secure_compare(first, second)
+        return false unless first.is_a?(String) && second.is_a?(String)
+        return false unless first.bytesize == second.bytesize
+
+        bytes = first.unpack("C*")
+        res = 0
+        second.each_byte { |byte| res |= byte ^ bytes.shift }
+        res.zero?
+      end
+
       # Audits additions, deletions, and modifications: any drift means the
       # package no longer matches the consented inventory.
       def drift(expected, current)
         added = current.keys - expected.keys
         removed = expected.keys - current.keys
-        modified = (current.keys & expected.keys).reject { |f| current[f] == expected[f] }
+        modified = (current.keys & expected.keys).reject { |f| secure_compare(current[f], expected[f]) }
 
         parts = []
         parts << "added: #{added.sort.join(', ')}" unless added.empty?