rubino-agent 0.3.0 → 0.5.0

data/lib/rubino/tools/task_tool.rb

@@ -127,7 +127,14 @@ module Rubino
                  "Valid subagents: #{available_subagent_names.join(", ")}."
         end
 
-        if background
+        # Force FOREGROUND in headless one-shot (#380): a `rubino prompt`/-q run
+        # has no IdleCardHost to fold a background child's result back in, and the
+        # process exits the instant the parent's answer is ready — so a background
+        # subagent's result would be silently dropped (its notice sink is nil and
+        # its thread is killed on exit). Running synchronously returns the child's
+        # final text as THIS tool's result, so it lands in the parent transcript
+        # and is factored into the one-shot answer, making `task` reliable headless.
+        if background && !Rubino.headless?
           run_background(definition, prompt)
         else
           run_subagent(definition, prompt)
@@ -261,12 +268,28 @@ module Rubino
       # Records the terminal :completed state and notifies the parent.
       # Deliver-or-report for /agents steer (#140): a parked note the child
       # never got another turn to fold in would otherwise vanish silently —
-      # the user believes the child was steered when it wasn't. Drain what's
-      # left NOW (the child is done; nothing can consume it anymore) and say
-      # so, on the parent UI and in the completion notice.
+      # the user believes the child was steered when it wasn't. Say so, on the
+      # parent UI and in the completion notice.
+      #
+      # H5 — the final drain now happens INSIDE #complete, under the SAME
+      # registry mutex that flips the status to terminal (and that #steer checks
+      # before pushing). The previous shape drained the queue HERE (InputQueue
+      # lock) and THEN called #complete (registry lock): a steer/answer arriving
+      # in that gap landed on an already-drained queue — dropped, missing from
+      # `undelivered`, yet reported delivered. Taking the drained notes from
+      # #complete's return closes that gap: a note is either drained here (and
+      # reported undelivered) or rejected by #steer (and reported not-delivered
+      # to its caller) — never silently lost.
       def record_completion(entry, text, sink, parent_ui)
-        undelivered = entry.steer_queue&.drain || []
-        BackgroundTasks.instance.complete(entry, status: :completed, result: text)
+        drained = BackgroundTasks.instance.complete(entry, status: :completed, result: text)
+        # Drop the gate-delivered answer COPIES (#457 regression): a /reply
+        # answer is delivered to the child via its ask gate AND mirrored onto the
+        # steer queue; when the child resumes via the gate and finishes without
+        # another turn, that mirror is drained here. It was NOT undelivered — the
+        # gate delivered it — so reporting it would surface a false "steer note
+        # not delivered" alarm on the happy path. GENUINE steer notes (no
+        # ANSWER_NOTE_PREFIX) still report undelivered, preserving #457's invariant.
+        undelivered = drained.reject { |n| n.to_s.start_with?(BackgroundTasks::ANSWER_NOTE_PREFIX) }
         notify(sink, completion_notice(entry, text, undelivered: undelivered))
         unless undelivered.empty?
           surface_completion(parent_ui,
@@ -428,7 +451,10 @@ module Rubino
             max_turns: definition.max_turns,
             ui: child_ui,
             agent_definition: definition,
-            event_bus: Interaction::EventBus.new
+            event_bus: Interaction::EventBus.new,
+            # Tag the child's fresh session as subagent machinery so it's hidden
+            # from the user-facing /sessions picker + `sessions list` (item 2).
+            session_source: "subagent"
           )
         end
       end
@@ -572,7 +598,9 @@ module Rubino
             model_override: definition.resolved_model,
             max_turns: definition.max_turns,
             ui: nested_ui(definition),
-            agent_definition: definition
+            agent_definition: definition,
+            # Hidden from the user-facing /sessions list/picker (item 2).
+            session_source: "subagent"
           )
         end
       end

data/lib/rubino/tools/vision_tool.rb

@@ -55,6 +55,11 @@ module Rubino
         return "Error: file_path is required" if path.empty?
 
         expanded = File.expand_path(path)
+        # Like summarize_file, vision sends the raw bytes off to the auxiliary
+        # LLM, so an out-of-workspace image must be DENIED rather than read and
+        # exfiltrated. Checked before existence so a file outside the sandbox
+        # isn't even probed for presence (r5 MF-1 / r5c NEW-2).
+        return outside_workspace_message(path) if outside_workspace?(expanded)
         return "Error: file not found: #{path}" unless File.exist?(expanded)
         return "Error: not a regular file: #{path}" unless File.file?(expanded)
 

data/lib/rubino/tools/webfetch_tool.rb

@@ -58,15 +58,16 @@ module Rubino
       def fetch_url(url, format:, redirects: 5)
         return "Error: Too many redirects" if redirects <= 0
 
-        uri = URI.parse(url)
-        uri = URI.parse("https://#{url}") unless uri.scheme
+        # Default a bare host to https:// (previous behaviour) before
+        # validating, so the SSRF guard sees a complete URL with a scheme.
+        url = "https://#{url}" unless URI.parse(url).scheme
+        safe = Rubino::Security::UrlSafety.validate!(url)
+        uri = safe[:uri]
 
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = (uri.scheme == "https")
-        http.open_timeout = TIMEOUT
-        http.read_timeout = TIMEOUT
+        http = build_http(uri, safe[:addresses].first)
 
         request = Net::HTTP::Get.new(uri.request_uri)
+        request["Host"] = uri.host
         request["User-Agent"] = "Rubino/#{Rubino::VERSION}"
         request["Accept"] = "text/html,text/plain,application/json"
 
@@ -74,7 +75,10 @@ module Rubino
 
         case response
         when Net::HTTPRedirection
-          fetch_url(response["location"], format: format, redirects: redirects - 1)
+          # Re-validate the redirect target from scratch (resolve + IP check);
+          # never trust the Location header to point somewhere safe (SSRF).
+          next_url = absolute_redirect(uri, response["location"])
+          fetch_url(next_url, format: format, redirects: redirects - 1)
         when Net::HTTPSuccess
           content_type = response["content-type"].to_s
           return binary_refusal(url, content_type) if binary_content_type?(content_type)
@@ -97,10 +101,38 @@ module Rubino
         else
           "Error: HTTP #{response.code} - #{response.message}"
         end
+      rescue Rubino::Security::UrlSafety::BlockedURLError => e
+        "Refused for safety: #{e.message}"
       rescue StandardError => e
         "Error fetching URL: #{e.message}"
       end
 
+      # Build a Net::HTTP pinned to a validated IP so a DNS-rebinding server
+      # can't swap in a private address between our check and connect(). The
+      # Host header (set by the caller) and TLS SNI/verification still use the
+      # original hostname.
+      def build_http(uri, connect_ip)
+        http = Net::HTTP.new(connect_ip, uri.port)
+        http.use_ssl = (uri.scheme == "https")
+        if http.use_ssl?
+          http.ipaddr = connect_ip
+          # Net::HTTP derives SNI and certificate verification from #address;
+          # restore it to the hostname so TLS validates against the cert.
+          http.instance_variable_set(:@address, uri.host)
+        end
+        http.open_timeout = TIMEOUT
+        http.read_timeout = TIMEOUT
+        http
+      end
+
+      # Resolve a (possibly relative) Location header against the current URL,
+      # so the per-hop SSRF re-validation always runs on an absolute URL.
+      def absolute_redirect(current_uri, location)
+        URI.join(current_uri.to_s, location.to_s).to_s
+      rescue StandardError
+        location.to_s
+      end
+
       BINARY_TYPE_PATTERNS = [
         %r{\Aapplication/(pdf|zip|x-tar|x-gzip|x-bzip2|x-7z-compressed|x-rar|octet-stream|x-msdownload|vnd\.openxmlformats|vnd\.ms-)},
         %r{\Aimage/}, %r{\Aaudio/}, %r{\Avideo/},

data/lib/rubino/tools/websearch_tool.rb

@@ -7,7 +7,22 @@ require "json"
 module Rubino
   module Tools
     # Tool for performing web searches via external search APIs.
-    # Supports Tavily, SearXNG, and a fallback DuckDuckGo scraper.
+    #
+    # Backends, in priority order:
+    #   1. Tavily        (TAVILY_API_KEY)   — high-quality, preferred
+    #   2. SearXNG       (SEARXNG_URL)      — self-hosted, full web index
+    #   3. DuckDuckGo Instant Answer JSON   — keyless DEFAULT (no key needed)
+    #
+    # Why not scrape html/lite.duckduckgo.com keyless? DuckDuckGo now serves
+    # an anomaly/bot-challenge page (zero results) to datacenter egress IPs,
+    # so the old single-regex HTML scrape returned "No results" 100% of the
+    # time — a silent failure that looked like success. The Instant Answer
+    # JSON API (api.duckduckgo.com) is keyless, returns structured JSON, and
+    # is NOT bot-walled, so it is the robust keyless default. Its coverage is
+    # narrower (topic/entity answers, not a full web index): when it yields
+    # nothing we degrade to an EXPLICIT "search unavailable" message that
+    # points the user at TAVILY_API_KEY / SEARXNG_URL — never a silent
+    # zero-results-that-looks-like-a-real-answer.
     class WebSearchTool < Base
       def name
         "websearch"
@@ -106,51 +121,96 @@ module Rubino
         results.empty? ? "No results found for: #{query}" : results.join("\n\n")
       end
 
-      # DuckDuckGo HTML scraper (fallback, no API key needed)
+      # Keyless default: DuckDuckGo Instant Answer JSON API.
+      # No API key, no bot-challenge for datacenter IPs. Defensive parse over
+      # Abstract / Results / RelatedTopics; explicit "unavailable" on no data.
       def search_ddg(query, max_results)
-        uri = URI("https://html.duckduckgo.com/html/")
-        body = URI.encode_www_form(q: query)
+        uri = URI("https://api.duckduckgo.com/")
+        uri.query = URI.encode_www_form(
+          q: query,
+          format: "json",
+          no_html: 1,
+          no_redirect: 1,
+          skip_disambig: 0,
+          t: "rubino"
+        )
 
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = true
-        request = Net::HTTP::Post.new(uri.path)
-        request["User-Agent"] = "Rubino/#{Rubino::VERSION}"
-        request.body = body
+        body = get_json(uri)
+        data = parse_json(body)
+        return ddg_unavailable(query, "could not parse search response") if data.nil?
 
-        response = http.request(request)
-        parse_ddg_html(response.body, max_results)
+        results = ddg_results(data, max_results)
+        return results.join("\n\n") unless results.empty?
+
+        ddg_unavailable(query, "no instant-answer results")
       end
 
-      def parse_ddg_html(html, max_results)
+      # Build a result list from the Instant Answer payload, most-specific
+      # signal first: the Abstract (a direct answer), then Results (official
+      # site links), then RelatedTopics (related entities). Topic groups
+      # (which nest a "Topics" array) are flattened.
+      def ddg_results(data, max_results)
         results = []
 
-        # Extract result blocks
-        html.scan(%r{<a rel="nofollow" class="result__a" href="([^"]+)"[^>]*>(.+?)</a>.*?<a class="result__snippet"[^>]*>(.+?)</a>}m) do |url, title, snippet|
-          clean_title = title.gsub(/<[^>]+>/, "").strip
-          clean_snippet = snippet.gsub(/<[^>]+>/, "").strip
-          clean_url = url.strip
-
-          # DuckDuckGo wraps URLs in redirects
-          if clean_url.include?("uddg=")
-            clean_url = begin
-              URI.decode_www_form_component(clean_url.match(/uddg=([^&]+)/)[1])
-            rescue StandardError
-              clean_url
-            end
-          end
-
-          results << format_result(clean_title, clean_url, clean_snippet)
-          break if results.size >= max_results
+        abstract = data["AbstractText"].to_s.strip
+        abstract = data["Abstract"].to_s.strip if abstract.empty?
+        if !abstract.empty? && data["AbstractURL"].to_s.strip != ""
+          results << format_result(
+            data["Heading"].to_s.strip.empty? ? "Answer" : data["Heading"].to_s.strip,
+            data["AbstractURL"], abstract
+          )
         end
 
-        results.empty? ? "No results found (DDG fallback)" : results.join("\n\n")
+        ddg_topics(data["Results"]).each { |t| results << ddg_topic_result(t) }
+        ddg_topics(data["RelatedTopics"]).each { |t| results << ddg_topic_result(t) }
+
+        results.compact.first(max_results)
+      end
+
+      # Flatten DDG's RelatedTopics: some entries are leaf topics (have
+      # FirstURL), others are category groups carrying a nested "Topics" array.
+      def ddg_topics(raw)
+        Array(raw).flat_map do |entry|
+          next [] unless entry.is_a?(Hash)
+
+          entry.key?("Topics") ? Array(entry["Topics"]) : [entry]
+        end
+      end
+
+      def ddg_topic_result(topic)
+        return nil unless topic.is_a?(Hash)
+
+        url = topic["FirstURL"].to_s.strip
+        text = topic["Text"].to_s.strip
+        return nil if url.empty? || text.empty?
+
+        # The leading sentence of Text doubles as the title; keep the whole
+        # thing as the snippet so no information is lost.
+        title = text.split(" - ", 2).first.to_s.strip
+        title = text if title.empty?
+        format_result(title, url, text)
+      end
+
+      def ddg_unavailable(query, reason)
+        "Web search unavailable for \"#{query}\" (#{reason}).\n\n" \
+          "The keyless DuckDuckGo Instant Answer backend only covers topic/" \
+          "entity queries and returned nothing for this one. For full web " \
+          "search, set TAVILY_API_KEY (https://tavily.com) or SEARXNG_URL to " \
+          "a SearXNG instance, then retry."
       end
 
       def format_result(title, url, snippet)
         "**#{title}**\n#{url}\n#{snippet}"
       end
 
+      def parse_json(body)
+        JSON.parse(body)
+      rescue JSON::ParserError
+        nil
+      end
+
       def post_json(uri, body)
+        Rubino::Security::UrlSafety.validate!(uri.to_s)
         http = Net::HTTP.new(uri.host, uri.port)
         http.use_ssl      = (uri.scheme == "https")
         http.open_timeout = 10
@@ -164,6 +224,7 @@ module Rubino
       end
 
       def get_json(uri)
+        Rubino::Security::UrlSafety.validate!(uri.to_s)
         http = Net::HTTP.new(uri.host, uri.port)
         http.use_ssl      = (uri.scheme == "https")
         http.open_timeout = 10
@@ -171,6 +232,7 @@ module Rubino
 
         request = Net::HTTP::Get.new(uri.request_uri)
         request["Accept"] = "application/json"
+        request["User-Agent"] = "Rubino/#{Rubino::VERSION}"
 
         http.request(request).body
       end

data/lib/rubino/tools/write_tool.rb

@@ -40,13 +40,32 @@ module Rubino
 
         return "Error: file_path is required" if file_path.nil? || file_path.to_s.empty?
 
-        expanded = File.expand_path(file_path)
+        expanded = expand_workspace_path(file_path)
+        # SECRET/credential writes (#446) are no longer HARD-refused here — they
+        # are gated UPSTREAM by Security::ApprovalPolicy#decide (→ :ask): an
+        # APPROVED write to your .env actually writes, a denied/headless one
+        # never reaches #call. The workspace sandbox below is unchanged.
         return workspace_violation_message(file_path) unless within_workspace?(expanded)
 
-        FileUtils.mkdir_p(File.dirname(expanded))
-
         existed = File.exist?(expanded)
-        File.write(expanded, content)
+        # Read-before-overwrite guard (r5 MF-2, Claude Code's rule): writing
+        # over an EXISTING file requires that the model read it this session, so
+        # a blind `write` can't silently clobber content the model never saw
+        # (the near-data-loss path). NEW files skip the guard. No tracker
+        # injected → no guard (single-tool unit tests / one-shot MCP).
+        if existed && (guard = overwrite_guard_error(expanded, file_path))
+          return guard
+        end
+
+        FileUtils.mkdir_p(File.dirname(expanded))
+        # Crash-safe write: temp-in-same-dir + fsync + atomic rename, so a
+        # SIGINT/SIGTERM/OOM-kill mid-write leaves the ORIGINAL file intact
+        # rather than a torn/truncated one (HIGH-1). The bare File.write here
+        # could be cut mid-flush, destroying the user's existing content.
+        Util::AtomicFile.write_atomic(expanded, content)
+        # Refresh-on-own-write so a later edit of this just-written file passes
+        # the read-gate (r5 B2) and a re-read sees it as authoritative.
+        @read_tracker&.note_write(expanded, content)
 
         verb  = existed ? "overwrote" : "created"
         bytes = content.to_s.bytesize

data/lib/rubino/ui/api.rb

@@ -52,6 +52,15 @@ module Rubino
         !@gate.nil? && !@recorder.nil?
       end
 
+      # ToolExecutor reads this to decide whether a tool needing approval can be
+      # put in front of a human (#260). The API adapter CAN — via the HTTP
+      # ApprovalGate — but only when a gate + recorder are wired; a gate-less
+      # embed/test run has no one to answer, so it fails closed too instead of
+      # silently auto-approving a write/shell command.
+      def interactive?
+        blocking_human_input?
+      end
+
       def info(message) = emit_event(:info, message: message)
 
       def success(message) = emit_event(:success, message: message)
@@ -81,7 +90,7 @@ module Rubino
       end
 
       def tool_body(text, kind: :plain) = emit_event(:tool_body, text: text, kind: kind)
-      def tool_chunk(name, chunk) = emit_event(:tool_chunk, name: name, chunk: chunk)
+      def tool_chunk(name, chunk, kind: :plain) = emit_event(:tool_chunk, name: name, chunk: chunk, kind: kind)
       def tool_finished(name, result: nil) = emit_event(:tool_finished, name: name)
       def compression_started(at: nil) = emit_event(:compression_started, at: at)
 

data/lib/rubino/ui/base.rb

@@ -139,6 +139,17 @@ module Rubino
         raise NotImplementedError, "#{self.class}#confirm not implemented"
       end
 
+      # True when this adapter can actually put an approval prompt in front of a
+      # human and block for an answer — a real interactive terminal (UI::CLI) or
+      # the HTTP approval gate (UI::API). The headless one-shot adapter
+      # (UI::Null) returns false, which is the signal ToolExecutor uses to FAIL
+      # CLOSED: a tool that needs approval is DENIED rather than auto-run, since
+      # there is no one to ask (the security floor behind #260). Default true so
+      # any custom adapter that hosts a human keeps the prompt path.
+      def interactive?
+        true
+      end
+
       # A destructive yes/No confirm, default No — distinct from the tool-approval
       # #confirm above (#218). Used for the in-chat/CLI destructive verbs (session
       # delete, memory forget), so only the CLI and Null adapters implement it;