rubino-agent 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db2afff4be97c340cbe86b9fb1b7509f1457abdfe812ac8c376e03421229ada1
-  data.tar.gz: efc19c01b592b21c70304f82fe9dbc4b76fea60b9dbdd63ed15fe5b5d0548f57
+  metadata.gz: a20b85c30f537ff5bdaf5abec6300eedfcda791d76b899ac3fcd972b71854ac1
+  data.tar.gz: d5692a31f13e338690a3be90bc4d96d27251ddad165b706afee7e0fcdee3fea7
 SHA512:
-  metadata.gz: fb700fb3a191d046737ad40b53d69c66a1e2c0cba573e04c6d3cfa803fa94cc2f1c74c09390ebda03424e6b30d19b9d4a948ee1ecfaba44926576b31c92d089a
-  data.tar.gz: 2eef17e973b05eb0eb5e6c0f7ee79ac8c8c440ea32f2c6ef589c06512319d0b03fac46879a480ee92923bf18167ede7fbd9ae14178ede83e32571058791890f6
+  metadata.gz: 865a203c91311f039d90a98b4e88ff8f792d0049e7370f10c847e2aeb77458f2f39d80485f133a79d8c2e8d9c1eeb5dec369f53320d210ff79928965a8c0a3f2
+  data.tar.gz: a9435d6746bc743e65db73574e13d4cd65445bf97ec5c9e2387737c176e7ab8726991062cc852a6c295910e3876d8b4a1d8c96420f5a8dd6a83dabf68a280546

data/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-06-13
+
+### Added — skills from git (#4)
+
+- **`rubino skills install <owner/repo | git-URL>`** — install skills from any
+  git repo shipping the `<name>/SKILL.md` layout (`--skill NAME` / `--all` /
+  `--list`; `--documents` is shorthand for the four `anthropics/skills`
+  document skills). Provenance lands in `~/.rubino/skills/.sources.json`, so
+  **`rubino skills update`** re-fetches from the recorded source (up-to-date vs
+  updated by commit) and **`rubino skills remove NAME`** only deletes what this
+  mechanism installed. `rubino skills list` gains a Source column.
+- The skill registry now also discovers the agent-neutral `.agents/skills/`
+  and `~/.agents/skills/` dirs (the `npx skills` / Gemini CLI convention) —
+  additive, lowest precedence, trust-gated like `.rubino/skills`.
+
+### Added
+
+- **`/agents <id>` watch — live tool-output tail (#5).** The drill-in watch grows an `output:` block showing the tail of the running subagent's current tool output, clearing when the tool finishes.
+- **`soffice` and `qpdf` in the `[Environment]` probe (#4/#6)** so the agent honestly reports whether LibreOffice/qpdf are available for the document skills.
+
+### Fixed
+
+- **`read_attachment` extension-spoof gate now covers document MIMEs (#239).** A text file named `report.docx` reads inline as text instead of bouncing off the document converter; a real `.docx` (ZIP magic) still classifies as a document.
+- **No more CLI crash under a C/POSIX locale (#250).** Skill and context files are read as UTF-8 rather than the ambient (US-ASCII) encoding, so `rubino skills list` and prompt assembly no longer raise `invalid byte sequence` on minimal Linux/Docker images.
+- **Installer no longer always exits 1 on a fresh Linux box (#240).** Fixed an unbound `rv_bin` under `set -u` and an invalid `gem environment gembindir` call; `curl … | bash` now installs cleanly and is idempotent.
+
+### Internal
+
+- **Test stability (#236):** PTY capture specs read to the child's EOF instead of treating a 0.5s quiet window as end-of-output, removing a rare 2-failure flake under concurrent suite load.
+- **Approval-handoff guard (#10):** the #80 unit guard now genuinely fails on a full revert; the PTY handoff spec is relabeled as a happy-path check.
+
+## [0.3.0] - 2026-06-06
+
+Major capability release: the core conversation loop was ported 1:1 from the reference implementation (formalized LLM boundary, retry/backoff/fallback, degenerate-response recovery), background subagents became the default delegation path, the memory subsystem grew a pluggable backend contract with a tiny-Zep SQLite backend that is now the default, CLI gained image/file input and a scroll-native redesign, and a reference-aligned approval model (hardline floor, dangerous-pattern deny, prefix-derived rules) landed. Consolidated from `feature/subagent-view` (#48) plus #49-#58.
+
 ### Added — CLI redesign & in-chat surfaces
 
 A scroll-native `rubino chat` refresh plus several new slash commands and input affordances. All are documented under [docs/commands.md](docs/commands.md) and [docs/configuration.md](docs/configuration.md).
@@ -107,10 +142,6 @@ The GitHub repository is `github.com/Jhonnyr97/rubino-agent`. Publishing the ren
 
 - `docs/api/v1.md` aligned to the real API surface (#165, #166, #167): SSE catalogue documents the non-streaming contract (no `message.delta`/`reasoning.delta`), the approval decision enum lists all seven accepted values with semantics, and `GET /v1/sessions`, `/v1/memory*`, `/v1/tasks*` are documented. A doc-drift spec locks the documented route list to the registered routes.
 
-## [0.3.0] - 2026-06-06
-
-Major capability release: the core conversation loop was ported 1:1 from the reference implementation (formalized LLM boundary, retry/backoff/fallback, degenerate-response recovery), background subagents became the default delegation path, the memory subsystem grew a pluggable backend contract with a tiny-Zep SQLite backend that is now the default, CLI gained image/file input and a scroll-native redesign, and a reference-aligned approval model (hardline floor, dangerous-pattern deny, prefix-derived rules) landed. Consolidated from `feature/subagent-view` (#48) plus #49-#58.
-
 ### Breaking / upgrade notes
 
 - **Default memory backend is now SQLite (tiny-Zep).** `memory.backend` now defaults to `"sqlite"` (previously `"default"`). The new backend reads/writes the `:memory_facts` table; the old `"default"` backend used the `:memories` table. On upgrade, users who were on the previous `"default"` backend and do **not** pin `memory.backend: "default"` in their config will stop reading their prior memory store — the new backend looks only at `:memory_facts`. Your old data in `:memories` is **not deleted**, just no longer read. **No automatic backfill is shipped.** To keep old recall, pin `memory.backend: "default"` in config. (Acceptable for alpha; documented here.)

data/docs/commands.md

@@ -13,7 +13,7 @@ Two surfaces: **CLI subcommands** (run from your shell) and **slash commands** (
 | `rubino memory SUBCOMMAND` | Manage persistent memories (`list` / `show` / `delete` / `backend`) |
 | `rubino sessions SUBCOMMAND` | Manage chat sessions |
 | `rubino jobs SUBCOMMAND` | Manage background jobs |
-| `rubino skills SUBCOMMAND` | Manage skills (`list` / `show` / `enable` / `disable`) |
+| `rubino skills SUBCOMMAND` | Manage skills (`list` / `show` / `enable` / `disable` / `install` / `update` / `remove`) |
 | `rubino tools` | List available tools and their enabled/disabled state |
 | `rubino server` | Start the JSON API + SSE server |
 | `rubino tls-cert` | Print the agent's self-signed TLS certificate PEM (generating it if absent) |
@@ -129,10 +129,15 @@ rubino jobs list
 rubino jobs process          # run pending jobs now (manual mode)
 rubino jobs worker           # start a background worker
 
-rubino skills list           # list skills with enabled/disabled markers
+rubino skills list           # list skills with enabled/disabled markers + provenance
 rubino skills show NAME      # print a skill's SKILL.md body (review before enabling)
 rubino skills enable NAME    # put a skill back in the index (every session)
 rubino skills disable NAME   # drop a skill from the index (every session)
+
+rubino skills install owner/repo --skill NAME   # install skills from a git repo (#4)
+rubino skills install --documents               # anthropics/skills: pdf docx pptx xlsx
+rubino skills update [NAME ...]                 # re-fetch from the recorded sources
+rubino skills remove NAME                       # delete an installed skill + provenance
 ```
 
 `config get`/`config show` mask secret-named keys (`api_key`, tokens, …) on display — the file keeps the real value. See [memory.md](memory.md) for the memory backends, [jobs.md](jobs.md) for the queue/cron system and [skills.md](skills.md) for the skill model.

data/docs/skills.md

@@ -31,6 +31,12 @@ skills:
 Override the search paths via the `skills.paths` config key. On a name collision
 the **directory** layout wins over the flat-file layout (it is the richer unit).
 
+The registry additionally scans the **agent-neutral** skill dirs — project
+`.agents/skills/` and `~/.agents/skills/` (the emerging cross-agent convention
+used by `npx skills`, Gemini CLI, goose) — at the lowest precedence: a
+rubino-path skill of the same name wins, and nothing changes when those dirs
+are absent. The project-local one is trust-gated exactly like `.rubino/skills`.
+
 ### Two layouts
 
 | Layout | Path | Skill name | Bundled files |
@@ -59,6 +65,31 @@ skills:
   include_builtin: false   # default true
 ```
 
+### Installing skills from git (`rubino skills install`)
+
+Any git repo shipping the `<name>/SKILL.md` layout is a skill source — there is
+no marketplace and nothing else is vendored in the gem. Skills are
+shallow-cloned and copied into `~/.rubino/skills`, where the registry discovers
+them like any hand-written skill:
+
+```bash
+rubino skills install anthropics/skills --list        # see what a source ships
+rubino skills install anthropics/skills --skill pdf   # pick by name (repeatable)
+rubino skills install owner/repo --all                # take everything
+rubino skills install https://gitlab.com/o/r.git      # any git URL works
+rubino skills install --documents                     # anthropics/skills: pdf docx pptx xlsx
+rubino skills update                                  # re-fetch installed skills
+rubino skills remove NAME                             # delete dir + provenance
+```
+
+With no `--skill`/`--all` and multiple skills in the source, the CLI prints the
+catalogue and asks you to pick (off a TTY it just prints the hint). Provenance
+is recorded per installed skill in `~/.rubino/skills/.sources.json`
+(`name → {source, path, commit}`): `rubino skills list` shows it in the Source
+column, and `update` re-fetches from the recorded source, reporting
+*up to date* vs *updated* by comparing commits. `remove` only deletes skills
+this mechanism installed — hand-written skills are never touched.
+
 ### Authoring a `SKILL.md`
 
 A `SKILL.md` is YAML frontmatter followed by the instruction body:

data/install.sh

@@ -144,7 +144,7 @@ setup_ruby_rv() {
     return 1
   }
 
-  local rv_bin
+  # NOTE: rv_bin is intentionally NOT local: rubyx() reads it after we return.
   if rv_bin="$(locate_rv)"; then
     ok "rv already installed: ${rv_bin}"
   else
@@ -198,10 +198,11 @@ case "$METHOD" in
   *)    die "internal: unknown method '${METHOD}'." ;;
 esac
 
-# Where gem-installed executables land for the chosen Ruby. `gem environment
-# gembindir` is correct for both rv and Homebrew; fall back to the ruby bin dir.
-GEM_BIN_DIR="$(rubyx gem environment gembindir 2>/dev/null | tail -n1)" || GEM_BIN_DIR=""
-[ -n "${GEM_BIN_DIR:-}" ] && [ -d "$GEM_BIN_DIR" ] || GEM_BIN_DIR="$RUBY_BIN_DIR"
+# Where gem-installed executables land for the chosen Ruby. Ask RubyGems
+# directly (Gem.bindir); fall back to the ruby bin dir. The dir may not exist
+# yet on a fresh machine — `gem install` creates it — so don't require it.
+GEM_BIN_DIR="$(rubyx ruby -e 'print Gem.bindir' 2>/dev/null)" || GEM_BIN_DIR=""
+[ -n "${GEM_BIN_DIR:-}" ] || GEM_BIN_DIR="$RUBY_BIN_DIR"
 
 # --- install the rubino gem -------------------------------------------------
 

data/lib/rubino/attachments/classify.rb

@@ -35,19 +35,35 @@ module Rubino
       ].freeze
       IMAGE_EXTS = %w[.png .jpg .jpeg .gif .webp .bmp .tiff .tif].freeze
 
-      # Leading magic bytes per recognised image MIME (WebP is special-cased:
-      # RIFF container + WEBP tag). Marcel lets the file NAME break the tie
-      # when the content sniff only yields a generic type (text/plain,
-      # octet-stream), so a text file renamed fake.png came back image/png and
-      # was shipped to the provider (#158). An image verdict must therefore be
-      # backed by the actual signature.
-      IMAGE_SIGNATURES = {
+      # Leading magic bytes per recognised image/document MIME (WebP is
+      # special-cased: RIFF container + WEBP tag). Marcel lets the file NAME
+      # break the tie when the content sniff only yields a generic type
+      # (text/plain, octet-stream), so a text file renamed fake.png came back
+      # image/png and was shipped to the provider (#158) — and a text file
+      # renamed report.docx came back as :document and got a shell-hint
+      # instead of reading inline (#239). An image or document verdict must
+      # therefore be backed by the actual signature.
+      OLE2 = "\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1".b
+      SIGNATURES = {
         "image/png" => ["\x89PNG\r\n\x1a\n".b],
         "image/jpeg" => ["\xFF\xD8\xFF".b],
         "image/gif" => ["GIF87a".b, "GIF89a".b],
         "image/bmp" => ["BM".b],
         "image/x-ms-bmp" => ["BM".b],
-        "image/tiff" => ["II*\x00".b, "MM\x00*".b]
+        "image/tiff" => ["II*\x00".b, "MM\x00*".b],
+        "application/pdf" => ["%PDF".b],
+        # OOXML and ODF are ZIP containers.
+        "application/vnd.openxmlformats-officedocument.wordprocessingml.document" => ["PK".b],
+        "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" => ["PK".b],
+        "application/vnd.openxmlformats-officedocument.presentationml.presentation" => ["PK".b],
+        "application/vnd.oasis.opendocument.text" => ["PK".b],
+        "application/vnd.oasis.opendocument.spreadsheet" => ["PK".b],
+        # Legacy Office is an OLE2 compound file.
+        "application/msword" => [OLE2],
+        "application/vnd.ms-excel" => [OLE2],
+        "application/vnd.ms-powerpoint" => [OLE2],
+        "application/rtf" => ["{\\rtf".b],
+        "text/rtf" => ["{\\rtf".b]
       }.freeze
 
       module_function
@@ -97,12 +113,14 @@ module Rubino
         basename = File.basename(real)
         mime = Marcel::MimeType.for(Pathname(real), name: basename).to_s
 
-        # Extension-spoof gate (#158): an image verdict that the magic bytes
-        # don't back up came from the extension, not the content. Re-resolve
-        # from content alone (no name:); when that is generic too, the text/
-        # binary sniff names the honest type — so fake.png full of text is
-        # rejected at the staging gate as text/plain, before any network call.
-        if IMAGE_MIMES.include?(mime) && !image_signature?(real, mime)
+        # Extension-spoof gate (#158, #239): an image or document verdict that
+        # the magic bytes don't back up came from the extension, not the
+        # content. Re-resolve from content alone (no name:); when that is
+        # generic too, the text/binary sniff names the honest type — so
+        # fake.png full of text is rejected at the staging gate as text/plain
+        # before any network call, and report.docx full of text reads inline
+        # as text instead of bouncing off the document converter.
+        if (IMAGE_MIMES.include?(mime) || DOCUMENT_MIMES.include?(mime)) && !signature?(real, mime)
           mime = Marcel::MimeType.for(Pathname(real)).to_s
           if mime.empty? || mime == "application/octet-stream"
             return base_helper.send(:binary?, real) ? [:binary, "application/octet-stream"] : [:text, "text/plain"]
@@ -136,12 +154,12 @@ module Rubino
       end
 
       # True when the file's leading bytes carry the signature +mime+ claims.
-      # Unknown image MIMEs fail closed (no signature -> not verified).
-      def image_signature?(real, mime)
+      # MIMEs without a known signature fail closed (not verified).
+      def signature?(real, mime)
         head = File.binread(real, 16).to_s.b
         return head.start_with?("RIFF") && head[8, 4] == "WEBP" if mime == "image/webp"
 
-        Array(IMAGE_SIGNATURES[mime]).any? { |sig| head.start_with?(sig) }
+        Array(SIGNATURES[mime]).any? { |sig| head.start_with?(sig) }
       end
 
       # JSON/XML/YAML/JS and friends arrive as application/* but are text.

data/lib/rubino/cli/commands.rb

@@ -183,7 +183,7 @@ module Rubino
       desc "jobs SUBCOMMAND", "Manage background jobs"
       subcommand "jobs", JobsCommand
 
-      desc "skills SUBCOMMAND", "Manage skills (list, show, enable, disable)"
+      desc "skills SUBCOMMAND", "Manage skills (list, enable, install, update)"
       subcommand "skills", SkillsCommand
 
       desc "tools", "List available tools"

data/lib/rubino/cli/skills_command.rb

@@ -10,10 +10,18 @@ module Rubino
     # run the SAME registry-validated StateRepository write the HTTP API
     # toggle and the in-chat `/skills enable|disable` use (Skills::Toggle) —
     # no new logic, just the missing terminal surface.
+    #
+    # `install`/`update`/`remove` (#4) manage skills fetched from git repos
+    # (Skills::Installer): any repo shipping the registry's `<name>/SKILL.md`
+    # layout is a source — no marketplace, nothing vendored in the gem.
     class SkillsCommand < Thor
       # Clean `tree`/help label instead of the underscored class-name default (F12).
       namespace "rubino skills"
 
+      # The `--documents` shorthand (#4): Anthropic's four document skills.
+      DOCUMENTS_SOURCE = "anthropics/skills"
+      DOCUMENT_SKILLS  = %w[pdf docx pptx xlsx].freeze
+
       def self.exit_on_failure?
         true
       end
@@ -29,10 +37,12 @@ module Rubino
           return
         end
 
+        sources = Skills::Installer.new.sources
         rows = skills.map do |skill|
-          [skill.name, skill_status(skill.name, registry), skill.description.to_s]
+          [skill.name, skill_status(skill.name, registry), provenance(skill.name, sources),
+           skill.description.to_s]
         end
-        Rubino.ui.table(headers: %w[Name Status Description], rows: rows)
+        Rubino.ui.table(headers: %w[Name Status Source Description], rows: rows)
       end
 
       desc "show NAME", "Print a skill's SKILL.md body (review it before enabling)"
@@ -56,6 +66,70 @@ module Rubino
         toggle(name, enabled: false)
       end
 
+      desc "install [SOURCE]", "Install skills from a git repo (owner/repo shorthand or git URL)"
+      option :skill, type: :string, repeatable: true,
+                     desc: "Skill name to install from the source (repeatable)"
+      option :all,   type: :boolean, desc: "Install every skill found in the source"
+      option :list,  type: :boolean, desc: "Only list the skills discoverable in the source"
+      option :documents, type: :boolean,
+                         desc: "Shorthand for #{DOCUMENTS_SOURCE} with #{DOCUMENT_SKILLS.join("/")}"
+      def install(source = nil)
+        wanted = Array(options[:skill])
+        if options[:documents]
+          source ||= DOCUMENTS_SOURCE
+          wanted = DOCUMENT_SKILLS.dup if wanted.empty?
+        end
+        if source.nil?
+          Rubino.ui.error("missing source — pass owner/repo, a git URL, or --documents")
+          return
+        end
+
+        installer = Skills::Installer.new
+        fetched = installer.fetch(source) do |checkout, sha|
+          found = installer.discover(checkout)
+          if found.empty?
+            Rubino.ui.warning("no skills found in #{source} (expected <name>/SKILL.md directories)")
+          elsif options[:list]
+            discovered_table(found)
+          else
+            install_selected(installer, found, wanted, checkout: checkout, source: source, commit: sha)
+          end
+          true
+        end
+        Rubino.ui.error("could not fetch #{source} — check the source name/URL and your network") if fetched.nil?
+      end
+
+      desc "update [NAME ...]", "Re-fetch installed skills from their recorded sources"
+      def update(*names)
+        installer = Skills::Installer.new
+        if installer.sources.empty?
+          Rubino.ui.info("No skills installed via `rubino skills install` yet.")
+          return
+        end
+
+        installer.update(names).each do |name, status|
+          case status
+          when :updated     then Rubino.ui.success("Updated skill: #{name}")
+          when :up_to_date  then Rubino.ui.info("#{name} is up to date.")
+          when :unknown     then Rubino.ui.error("unknown skill: #{name} (not installed via `rubino skills install`)")
+          else                   Rubino.ui.error("could not update #{name} — fetch failed or the skill left its source")
+          end
+        end
+      end
+
+      desc "remove NAME", "Remove a skill installed via `rubino skills install`"
+      def remove(name)
+        installer = Skills::Installer.new
+        if installer.remove(name)
+          Rubino.ui.success("Removed skill: #{name}")
+          return
+        end
+
+        Rubino.ui.error("#{name} wasn't installed via `rubino skills install` (no provenance entry)")
+        dir = File.join(installer.skills_dir, name)
+        Rubino.ui.info("It exists at #{dir} — delete the directory manually.") if File.directory?(dir)
+      end
+
       private
 
       # The Status cell: enabled/disabled from the StateRepository (the same
@@ -68,6 +142,13 @@ module Rubino
         status
       end
 
+      # The Source cell: where an installed skill came from (provenance ledger),
+      # blank for built-in / hand-written skills.
+      def provenance(name, sources)
+        entry = sources[name]
+        entry ? "#{entry["source"]} @ #{entry["commit"].to_s[0, 7]}" : ""
+      end
+
       def toggle(name, enabled:)
         Rubino.ensure_database_ready!
         registry = Skills::Registry.trusted
@@ -80,6 +161,52 @@ module Rubino
 
         Rubino.ui.success("#{enabled ? "Enabled" : "Disabled"} skill: #{name}")
       end
+
+      # Resolves which of the discovered skills to install: explicit --skill
+      # names (all-or-nothing — a typo aborts rather than half-installing),
+      # --all, the only skill found, or an interactive pick. Off a TTY the
+      # picker returns nil and the multi-skill case degrades to the catalogue
+      # plus a --skill/--all hint.
+      def install_selected(installer, found, wanted, checkout:, source:, commit:)
+        chosen =
+          if wanted.any?
+            missing = wanted - found.map { |e| e[:name] }
+            unless missing.empty?
+              Rubino.ui.error("not found in #{source}: #{missing.join(", ")}")
+              Rubino.ui.info("Available: #{found.map { |e| e[:name] }.join(", ")}")
+              return
+            end
+            found.select { |e| wanted.include?(e[:name]) }
+          elsif options[:all] || found.size == 1
+            found
+          else
+            pick_one(found)
+          end
+        return if chosen.nil?
+
+        installer.install(chosen, checkout: checkout, source: source, commit: commit)
+        chosen.each { |e| Rubino.ui.success("Installed skill: #{e[:name]} (#{source} @ #{commit[0, 7]})") }
+        Rubino.ui.status("Installed into #{installer.skills_dir}")
+      end
+
+      # Multiple skills, none selected: print the catalogue and ask to pick
+      # (the same arrow-key picker /sessions resume uses). nil when there is
+      # no real terminal or the pick is cancelled.
+      def pick_one(found)
+        discovered_table(found)
+        picked = Rubino.ui.select("Install which skill?", found.map { |e| [e[:name], e] })
+        if picked.nil?
+          Rubino.ui.info("Multiple skills found — pass --skill NAME (repeatable) or --all.")
+          return nil
+        end
+
+        [picked]
+      end
+
+      def discovered_table(found)
+        rows = found.map { |e| [e[:name], e[:path], e[:description]] }
+        Rubino.ui.table(headers: %w[Name Path Description], rows: rows)
+      end
     end
   end
 end

data/lib/rubino/commands/handlers/agents.rb

@@ -299,9 +299,10 @@ module Rubino
           watch_loop(entry.id)
         end
 
-        # Renders ONE watch frame: header + task + the recent: ring. Public-ish
-        # snapshot shape reused per refresh tick. The recent ring is the registry's
-        # bounded activity_log, plus the live last_activity as the trailing ● line.
+        # Renders ONE watch frame: header + task + the recent: ring + the live
+        # output: tail. Public-ish snapshot shape reused per refresh tick. The
+        # recent ring is the registry's bounded activity_log, plus the live
+        # last_activity as the trailing ● line.
         def render_agent_watch(entry)
           @ui.info("#{entry.id}  #{agent_status_icon(entry.status)}  ·  #{entry.subagent}  ·  #{agent_elapsed(entry)}")
           @ui.info("task: #{truncate(entry.prompt, 120)}")
@@ -309,6 +310,25 @@ module Rubino
           Array(entry.activity_log).last(5).each { |line| @ui.info("  #{line}") }
           last = entry.last_activity.to_s
           @ui.info("  #{pastel.yellow("●")} #{last}") unless last.empty?
+          render_agent_output_tail(entry)
+        end
+
+        # #5 — the live output: block under the ring: the tail of the CURRENTLY
+        # RUNNING tool's streamed output (the registry's bounded output_tail,
+        # fed by the child's UI::SubagentView#tool_chunk and wiped at
+        # tool_finished), so a long shell call shows its lines as they print
+        # instead of a frozen frame. Renders nothing when no tool is mid-run or
+        # it hasn't produced output yet; the buffer's empty last slot just means
+        # the latest line is complete, so it is dropped, not rendered.
+        def render_agent_output_tail(entry)
+          lines = Array(entry.output_tail)
+          lines = lines[0..-2] if lines.last.to_s.empty?
+          return if lines.empty?
+
+          @ui.info("output:")
+          lines.last(Tools::BackgroundTasks::OUTPUT_TAIL_MAX).each do |line|
+            @ui.info("  #{pastel.dim("│")} #{truncate(line, 120)}")
+          end
         end
 
         # The live refresh loop for #watch_agent. Polls the registry and re-renders

data/lib/rubino/context/environment_inspector.rb

@@ -26,7 +26,7 @@ module Rubino
         git gh rg jq curl wget
         ruby python3 node npm bundle
         docker psql sqlite3 redis-cli
-        ffmpeg pandoc markitdown pdftotext tesseract
+        ffmpeg pandoc markitdown pdftotext tesseract soffice qpdf
       ].freeze
 
       class << self
@@ -114,7 +114,7 @@ module Rubino
       def linux_distro
         return nil unless File.readable?("/etc/os-release")
 
-        pretty = File.read("/etc/os-release").lines.find { |l| l.start_with?("PRETTY_NAME=") }
+        pretty = File.read("/etc/os-release", encoding: "UTF-8").lines.find { |l| l.start_with?("PRETTY_NAME=") }
         pretty&.split("=", 2)&.last&.strip&.delete('"')
       rescue StandardError
         nil

data/lib/rubino/context/file_discovery.rb

@@ -22,7 +22,7 @@ module Rubino
         files = discover_files
         return nil if files.empty?
 
-        files.map { |f| File.read(f) }.join("\n\n---\n\n")
+        files.map { |f| File.read(f, encoding: "UTF-8") }.join("\n\n---\n\n")
       end
 
       # Returns list of discovered context file paths
@@ -37,7 +37,7 @@ module Rubino
       def local_context(subdir)
         CONTEXT_FILES.filter_map do |filename|
           path = File.join(@base_path, subdir, filename)
-          File.read(path) if File.exist?(path)
+          File.read(path, encoding: "UTF-8") if File.exist?(path)
         end.join("\n")
       end
     end

data/lib/rubino/context/prompt_assembler.rb

@@ -339,7 +339,7 @@ module Rubino
 
       def load_builtin_prompt(name)
         path = File.expand_path("../agent/prompts/#{name}.txt", __dir__)
-        File.exist?(path) ? File.read(path).strip : nil
+        File.exist?(path) ? File.read(path, encoding: "UTF-8").strip : nil
       rescue StandardError
         nil
       end

data/lib/rubino/skills/installer.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require "json"
+require "tmpdir"
+
+module Rubino
+  module Skills
+    # Installs skills from git repositories into the user skills dir (#4) —
+    # the `rubino skills install/update/remove` backend. There is no
+    # marketplace and nothing is vendored in the gem: a source is just a repo
+    # (GitHub `owner/repo` shorthand or any git URL), shallow-cloned to a
+    # tmpdir, scanned for the registry's own `<name>/SKILL.md` layout, and the
+    # selected skill dirs are copied into `~/.rubino/skills` where the
+    # existing Registry discovers them like any hand-written skill.
+    #
+    # Provenance is recorded per installed skill in `<skills-dir>/.sources.json`
+    # (`name → {source, path, commit}`) so `update` can re-fetch from the
+    # recorded source and `remove` knows which dirs this mechanism owns. The
+    # dotfile name keeps it out of the registry's `*.md` / `*/SKILL.md` globs.
+    class Installer
+      SOURCES_FILE = ".sources.json"
+
+      # GitHub shorthand: bare `owner/repo` (one slash, no scheme/host).
+      GITHUB_SHORTHAND = %r{\A[\w.-]+/[\w.-]+\z}
+
+      attr_reader :skills_dir
+
+      def initialize(skills_dir: nil)
+        # The same resolved home the registry's "~/.rubino/skills" entry
+        # expands to (RUBINO_HOME → else ~/.rubino), so an install is
+        # discovered without any config change.
+        @skills_dir = skills_dir || File.join(Config::Loader.default_home_path, "skills")
+      end
+
+      # `owner/repo` → the GitHub URL; anything else is passed to git verbatim.
+      def self.url_for(source)
+        GITHUB_SHORTHAND.match?(source.to_s) ? "https://github.com/#{source}" : source.to_s
+      end
+
+      # Shallow-clones +source+ and yields (checkout_dir, head_sha); the tmp
+      # checkout is deleted when the block returns. Returns the block's value,
+      # or nil when the clone fails (unknown repo, no network — git's own
+      # stderr is left visible as the diagnostic). The ONE network touchpoint,
+      # so specs stub this method and never shell out.
+      def fetch(source)
+        Dir.mktmpdir("rubino-skills") do |dir|
+          return nil unless system("git", "clone", "--depth", "1", "--quiet",
+                                   self.class.url_for(source), dir, out: File::NULL)
+
+          sha = IO.popen(["git", "-C", dir, "rev-parse", "HEAD"], &:read).strip
+          yield dir, sha
+        end
+      end
+
+      # Skills discoverable in a checkout, as `{name:, path:, description:}`
+      # hashes (path = skill dir relative to the repo root). Recursive
+      # (`**/` + the registry's DIR_GLOB) so catalog repos that nest skills
+      # under a grouping dir are found too.
+      def discover(checkout)
+        Dir.glob(File.join("**", Registry::DIR_GLOB), base: checkout).sort.map do |rel|
+          dir = File.dirname(rel)
+          skill = Skill.new(path: File.join(checkout, rel))
+          { name: skill.name, path: dir, description: skill.description.to_s }
+        end
+      end
+
+      # Copies the discover-entries into the skills dir (replacing any prior
+      # copy of the same name) and records their provenance.
+      def install(entries, checkout:, source:, commit:)
+        FileUtils.mkdir_p(@skills_dir)
+        data = sources
+        entries.each do |entry|
+          dest = File.join(@skills_dir, entry[:name])
+          FileUtils.rm_rf(dest)
+          FileUtils.cp_r(File.join(checkout, entry[:path]), dest)
+          data[entry[:name]] = { "source" => source, "path" => entry[:path], "commit" => commit }
+        end
+        write_sources(data)
+      end
+
+      # Re-fetches +names+ (default: every recorded skill) from their recorded
+      # sources, one clone per distinct source. Returns name → :updated /
+      # :up_to_date / :failed (clone failed, or the skill's recorded path no
+      # longer holds a SKILL.md) / :unknown (no provenance entry).
+      def update(names = [])
+        data = sources
+        names = data.keys if names.empty?
+        results = {}
+        names.group_by { |name| data.dig(name, "source") }.each do |source, group|
+          next group.each { |name| results[name] = :unknown } if source.nil?
+
+          fetched = fetch(source) do |checkout, sha|
+            group.each { |name| results[name] = update_one(name, data[name], checkout, sha) }
+            write_sources(data)
+            true
+          end
+          group.each { |name| results[name] = :failed } unless fetched
+        end
+        results
+      end
+
+      # Deletes the skill dir + provenance entry. Returns false (nothing
+      # touched) for a skill without a provenance entry — this mechanism only
+      # removes what it installed.
+      def remove(name) # rubocop:disable Naming/PredicateMethod -- "did I remove anything", a mutator reporting what it did
+        data = sources
+        return false unless data.key?(name)
+
+        FileUtils.rm_rf(File.join(@skills_dir, name))
+        data.delete(name)
+        write_sources(data)
+        true
+      end
+
+      # The provenance ledger (empty hash when absent or unparseable).
+      def sources
+        path = File.join(@skills_dir, SOURCES_FILE)
+        File.file?(path) ? JSON.parse(File.read(path)) : {}
+      rescue JSON::ParserError
+        {}
+      end
+
+      private
+
+      # Re-copies one skill from a fresh checkout, mutating its ledger entry's
+      # commit in place (the caller persists the ledger once per source).
+      def update_one(name, entry, checkout, sha)
+        return :up_to_date if entry["commit"] == sha
+
+        src = File.join(checkout, entry["path"])
+        return :failed unless File.file?(File.join(src, "SKILL.md"))
+
+        dest = File.join(@skills_dir, name)
+        FileUtils.rm_rf(dest)
+        FileUtils.cp_r(src, dest)
+        entry["commit"] = sha
+        :updated
+      end
+
+      def write_sources(data)
+        FileUtils.mkdir_p(@skills_dir)
+        File.write(File.join(@skills_dir, SOURCES_FILE), JSON.pretty_generate(data))
+      end
+    end
+  end
+end

data/lib/rubino/skills/registry.rb

@@ -11,6 +11,12 @@ module Rubino
       # Directory skills: <dir>/<name>/SKILL.md (Claude skill layout).
       DIR_GLOB = File.join("*", "SKILL.md")
 
+      # Agent-neutral skill dirs (the emerging `npx skills` / Gemini CLI /
+      # goose convention): discovered in ADDITION to the configured rubino
+      # paths, scanned before them so a rubino-path skill of the same name
+      # wins (lowest precedence). No behavior change when the dirs are absent.
+      AGENT_NEUTRAL_PATHS = [".agents/skills", "~/.agents/skills"].freeze
+
       # Skills shipped *inside the gem* (skills/<name>/SKILL.md at the gem
       # root, packaged via the gemspec's git-ls-files list). These are
       # ALWAYS discovered — they don't depend on the user's skills.paths
@@ -176,6 +182,10 @@ module Rubino
           ".rubino/skills",
           "~/.rubino/skills"
         ]
+        # Prepended (not appended) so the rubino paths override them on a name
+        # collision, and BEFORE the trust filter so the project-local
+        # `.agents/skills` is gated exactly like `.rubino/skills`.
+        paths = AGENT_NEUTRAL_PATHS + paths
         unless @include_project_local
           # Untrusted primary root: drop the project-local (cwd-relative) skill
           # dirs, keeping only absolute / home (~) paths the user controls.

data/lib/rubino/skills/skill.rb

@@ -61,7 +61,7 @@ module Rubino
         resolved = resolve_within_dir(relative_path)
         return nil unless resolved && File.file?(resolved)
 
-        File.read(resolved)
+        File.read(resolved, encoding: "UTF-8")
       rescue Errno::ENOENT, Errno::EACCES
         nil
       end
@@ -128,7 +128,7 @@ module Rubino
       end
 
       def parse_frontmatter!
-        raw = File.read(@path)
+        raw = File.read(@path, encoding: "UTF-8")
 
         if raw.start_with?("---")
           parts = raw.split("---", 3)
@@ -160,7 +160,7 @@ module Rubino
       end
 
       def load_content
-        raw = File.read(@path)
+        raw = File.read(@path, encoding: "UTF-8")
 
         if raw.start_with?("---")
           parts = raw.split("---", 3)

data/lib/rubino/tools/background_tasks.rb

@@ -38,8 +38,11 @@ module Rubino
       # #record_tool_started / #record_tool_finished) under the registry mutex
       # and read by the parent renderer (UI::SubagentCards) and
       # the /agents drill-in. activity_log is a bounded ring of the last few
-      # `✓ verb · hint` lines for the live drill-in; nothing is persisted (it
-      # dies with the process, like the rest of the registry).
+      # `✓ verb · hint` lines for the live drill-in; output_tail is the bounded
+      # line buffer of the CURRENTLY RUNNING tool's streamed output (fed by
+      # #record_tool_output, wiped at #record_tool_finished) that the drill-in's
+      # output: block tails (#5). Nothing is persisted (it dies with the
+      # process, like the rest of the registry).
       #
       # approval_gate / approval_question / approval_command are the
       # Option-2 approval-surfacing state: when a background child's tool needs
@@ -49,7 +52,7 @@ module Rubino
       Entry = Struct.new(
         :id, :subagent, :prompt, :status, :result, :error,
         :thread, :runner, :started_at, :finished_at,
-        :last_activity, :tool_count, :activity_log,
+        :last_activity, :tool_count, :activity_log, :output_tail,
         :approval_gate, :approval_id, :approval_question, :approval_command,
         # Parent->child steer (the `/agents <id> steer "..."` note). Wired into
         # the child Loop as its Interaction::InputQueue (the SAME turn-boundary
@@ -94,6 +97,13 @@ module Rubino
       # How many recent activity lines the drill-in shows (the live `recent:` ring).
       ACTIVITY_LOG_MAX = 6
 
+      # Bounds for the live output tail (#5): how many COMPLETE lines the
+      # drill-in's output: block shows (the buffer keeps one extra slot for the
+      # in-flight partial line), and the byte cap per buffered line so a
+      # newline-free stream can't grow a line unbounded.
+      OUTPUT_TAIL_MAX      = 6
+      OUTPUT_TAIL_LINE_MAX = 200
+
       class << self
         def instance
           @instance ||= new
@@ -219,7 +229,8 @@ module Rubino
       # Records a child tool FINISHING: appends a terse line to the bounded
       # activity ring the live drill-in (#71) tails. Keeps the last
       # ACTIVITY_LOG_MAX entries so the ring never grows unbounded for a
-      # read-heavy child.
+      # read-heavy child. Also wipes the live output tail — it belongs to the
+      # tool that just finished, so the drill-in's output: block clears (#5).
       def record_tool_finished(id, line)
         @mutex.synchronize do
           entry = @entries[id]
@@ -228,6 +239,26 @@ module Rubino
           log = (entry.activity_log ||= [])
           log << line.to_s
           log.shift while log.size > ACTIVITY_LOG_MAX
+          entry.output_tail = nil
+        end
+      end
+
+      # Records a streamed chunk of the CURRENTLY RUNNING tool's output (#5):
+      # splits on newlines into a bounded line buffer whose LAST slot carries
+      # the in-flight partial line, so the /agents drill-in can tail it live.
+      # Called from UI::SubagentView#tool_chunk on the CHILD thread, so it MUST
+      # take the mutex like the other record_* writers. No-op for an unknown id.
+      def record_tool_output(id, chunk)
+        @mutex.synchronize do
+          entry = @entries[id]
+          return unless entry
+
+          tail = (entry.output_tail ||= [""])
+          chunk.to_s.each_line do |line|
+            tail[-1] = "#{tail[-1]}#{line.chomp}"[0, OUTPUT_TAIL_LINE_MAX]
+            tail << "" if line.end_with?("\n")
+          end
+          tail.shift while tail.size > OUTPUT_TAIL_MAX + 1
         end
       end
 

data/lib/rubino/ui/subagent_view.rb

@@ -28,7 +28,8 @@ module Rubino
     # single in-place line per subagent (`▸ sa_… · explore · running · N tools ·
     # Ns · <last_activity>`) that updates without scrolling — see UI::CLI
     # #set_subagent_cards / UI::SubagentCards. The /agents <id> drill-in tails the
-    # same registry ring for the live recent: list (#71).
+    # same registry ring for the live recent: list (#71) and the entry's
+    # output_tail — fed by #tool_chunk — for the live output: block (#5).
     #
     # The view is wired with the entry id at construction (TaskTool builds it per
     # background run). With no id (legacy/foreground synchronous path, tests) it
@@ -124,10 +125,20 @@ module Rubino
         end
       end
 
-      # tool_body / tool_chunk: the child's tool previews/streamed chunks. Kept
-      # quiet to stay low-noise — the start/finish rows already say what ran.
+      # Card mode: append the streamed chunk to the entry's bounded output tail —
+      # the live output: block the /agents <id> watch tails while THIS tool runs
+      # (#5). Registry-only, NO card repaint: a chatty shell streams a chunk per
+      # line and repainting the cards per chunk would flood the parent terminal
+      # (the watch drill-in re-reads the tail on its own tick). Legacy mode
+      # stays quiet (the start/finish rows already say what ran).
+      def tool_chunk(_name, chunk)
+        Tools::BackgroundTasks.instance.record_tool_output(@entry_id, chunk) if card_mode?
+      end
+
+      # tool_body: the END-OF-CALL preview of a NON-streaming tool (the executor
+      # skips it when the tool streamed via #tool_chunk). Useless for the live
+      # tail — tool_finished wipes the buffer right after — so it stays quiet.
       def tool_body(_text, kind: :plain); end
-      def tool_chunk(_name, _chunk); end
 
       # --- Suppressed: the child's prose / token stream ---------------------
 

data/lib/rubino/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rubino
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubino-agent
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Jhon Rojas
@@ -733,6 +733,7 @@ files:
 - lib/rubino/session/repository.rb
 - lib/rubino/session/store.rb
 - lib/rubino/session/summary_store.rb
+- lib/rubino/skills/installer.rb
 - lib/rubino/skills/prompt_index.rb
 - lib/rubino/skills/registry.rb
 - lib/rubino/skills/skill.rb