rubino-agent 0.3.0 → 0.5.0

data/lib/rubino/ui/streaming_markdown.rb

@@ -34,6 +34,21 @@ module Rubino
     #                                 can emit it as plain text — never lost)
     class StreamingMarkdown
       FENCE_RE = /\A\s*```/
+      # An OPENING fence captures its run of backticks (≥3) and any info string
+      # (the language tag) that follows. The CommonMark rule we lean on: a fenced
+      # block is closed only by a bare fence — no info string — of AT LEAST as
+      # many backticks. That keeps a nested ```ruby inside an outer ```markdown
+      # from being mistaken for the close (it carries an info string), so the
+      # whole wrapped block stays one unit instead of mis-toggling (#264).
+      FENCE_OPEN_RE  = /\A\s*(`{3,})\s*(\S.*)?\z/
+      FENCE_CLOSE_RE = /\A\s*(`{3,})\s*\z/
+      # Info strings that mean "this fence WRAPS markdown" — the model boxed a
+      # whole answer (which itself contains nested ```lang fences) in an outer
+      # ```markdown / ```md. For those, and ONLY those, we track fence-nesting
+      # DEPTH: a nested fence's bare close must not be mistaken for the wrapper's
+      # close (T1), so the whole wrapped answer stays ONE block. The renderer
+      # re-renders such a body AS markdown (MarkdownRenderer::MARKDOWN_FENCE_LANGS).
+      MARKDOWN_FENCE_LANGS = %w[markdown md].freeze
       # An ordered ("1. ", "2) ") or unordered ("- ", "* ", "+ ") list item.
       # Used so a loose list (blank lines BETWEEN items) is kept as ONE block
       # instead of being split per-item: each split item was re-rendered on its
@@ -45,6 +60,13 @@ module Rubino
         @pending = +""   # un-newlined remainder (the live tail-in-progress line)
         @block   = []    # completed lines accumulated for the current block
         @in_fence = false
+        @fence_len = 0 # backtick count of the OPEN fence (close needs ≥ this many)
+        # When the OPEN fence is a ```markdown / ```md wrapper, we track nesting
+        # DEPTH (starts at 1 on open): nested opening fences ++ it, bare closes of
+        # ≥ @fence_len -- it, and the block completes only when it returns to 0.
+        # nil = the open fence is a PLAIN code fence (no nesting; closes on the
+        # first bare fence of ≥ @fence_len), the CommonMark default (T1).
+        @fence_depth = nil
         @in_list  = false # current block is a markdown list (keep loose items together)
         @blanks   = 0     # blank lines buffered inside a list, re-emitted iff it continues
       end
@@ -109,6 +131,8 @@ module Rubino
         text = @block.join("\n")
         @block = []
         @in_fence = false
+        @fence_len = 0
+        @fence_depth = nil
         @in_list = false
         @blanks = 0
         text
@@ -121,15 +145,22 @@ module Rubino
       def consume_line(line)
         if @in_fence
           @block << line
-          if line.match?(FENCE_RE) # closing fence ends the code block
-            @in_fence = false
-            return take_block
-          end
-          return nil
+          return nil unless fence_line_closes?(line)
+
+          @in_fence = false
+          @fence_len = 0
+          @fence_depth = nil
+          return take_block
         end
 
-        if line.match?(FENCE_RE) # opening fence starts a code block
+        if (m = line.match(FENCE_OPEN_RE)) # opening fence starts a code block
           @in_fence = true
+          @fence_len = m[1].length
+          # A ```markdown / ```md wrapper arms nesting-DEPTH tracking (starts at
+          # 1); its body's nested ```lang fences must not close it early (T1).
+          # Any other language (or none) is a plain code fence: depth stays nil,
+          # so it closes on the first bare fence of ≥ @fence_len (CommonMark).
+          @fence_depth = MARKDOWN_FENCE_LANGS.include?(m[2].to_s.strip.downcase) ? 1 : nil
           flush_blanks
           @block << line
           return nil
@@ -167,6 +198,28 @@ module Rubino
         nil
       end
 
+      # Does this line (already appended to the open fence's block) CLOSE that
+      # fence? For a PLAIN code fence (@fence_depth nil) the first bare fence of
+      # ≥ the opening run closes it — the CommonMark default. For a ```markdown /
+      # ```md WRAPPER we track nesting depth: a nested OPENING fence (carries an
+      # info string, e.g. ```ruby) deepens it, a bare close of ≥ @fence_len
+      # un-nests one level, and only the close that returns depth to 0 ends the
+      # block — so the wrapper's nested fences never close it early (T1).
+      def fence_line_closes?(line)
+        if @fence_depth.nil?
+          m = line.match(FENCE_CLOSE_RE)
+          return !!(m && m[1].length >= @fence_len)
+        end
+
+        if (m = line.match(FENCE_CLOSE_RE)) && m[1].length >= @fence_len
+          @fence_depth -= 1
+          return @fence_depth <= 0
+        end
+        # A nested opening fence (```lang, with an info string) deepens the wrapper.
+        @fence_depth += 1 if line.match?(FENCE_OPEN_RE)
+        false
+      end
+
       # Re-emit blank lines buffered inside a continuing list so loose-list
       # spacing is preserved in the committed block text.
       def flush_blanks

data/lib/rubino/ui/subagent_view.rb

@@ -28,7 +28,8 @@ module Rubino
     # single in-place line per subagent (`▸ sa_… · explore · running · N tools ·
     # Ns · <last_activity>`) that updates without scrolling — see UI::CLI
     # #set_subagent_cards / UI::SubagentCards. The /agents <id> drill-in tails the
-    # same registry ring for the live recent: list (#71).
+    # same registry ring for the live recent: list (#71) and the entry's
+    # output_tail — fed by #tool_chunk — for the live output: block (#5).
     #
     # The view is wired with the entry id at construction (TaskTool builds it per
     # background run). With no id (legacy/foreground synchronous path, tests) it
@@ -124,10 +125,20 @@ module Rubino
         end
       end
 
-      # tool_body / tool_chunk: the child's tool previews/streamed chunks. Kept
-      # quiet to stay low-noise — the start/finish rows already say what ran.
+      # Card mode: append the streamed chunk to the entry's bounded output tail —
+      # the live output: block the /agents <id> watch tails while THIS tool runs
+      # (#5). Registry-only, NO card repaint: a chatty shell streams a chunk per
+      # line and repainting the cards per chunk would flood the parent terminal
+      # (the watch drill-in re-reads the tail on its own tick). Legacy mode
+      # stays quiet (the start/finish rows already say what ran).
+      def tool_chunk(_name, chunk, kind: :plain)
+        Tools::BackgroundTasks.instance.record_tool_output(@entry_id, chunk) if card_mode?
+      end
+
+      # tool_body: the END-OF-CALL preview of a NON-streaming tool (the executor
+      # skips it when the tool streamed via #tool_chunk). Useless for the live
+      # tail — tool_finished wipes the buffer right after — so it stays quiet.
       def tool_body(_text, kind: :plain); end
-      def tool_chunk(_name, _chunk); end
 
       # --- Suppressed: the child's prose / token stream ---------------------
 
@@ -185,6 +196,20 @@ module Rubino
         false
       end
 
+      # Whether this nested view can actually put an approval in front of a
+      # human and block for an answer. ONLY the card-mode background path with a
+      # wired @approve handler can (it parks the child on a per-entry gate and a
+      # /agents <id> decision resolves it). The foreground/legacy path (no
+      # @approve) cannot — there is no one to ask. Returning false there makes
+      # the child's ToolExecutor FAIL CLOSED with the honest "needs approval but
+      # no interactive session — use --yolo / allowlist it" block (#260) instead
+      # of routing through #confirm's auto-deny, which the model otherwise reads
+      # as "the user denied it" though no human ever decided (#419). With a
+      # handler we stay interactive so the gate path is reached as before.
+      def interactive?
+        !@approve.nil?
+      end
+
       # No interactive clarification mid-delegation either.
       def ask(_prompt)
         nil

data/lib/rubino/ui/tool_label.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Rubino
+  module UI
+    # Shared vocabulary for the concise `name hint` tool label used across
+    # adapters — the interactive `● edit foo.rb` card open-row (UI::CLI) AND the
+    # non-interactive one-shot stderr trace (UI::HeadlessTrace) draw their hint
+    # from here so the two never drift. The hint is the single most-identifying
+    # argument (pattern / file_path / path / command), secrets-masked and
+    # terminal-sanitized so an untrusted filename/command can never drive the
+    # terminal from a label row (R3C-1, CWE-150).
+    module ToolLabel
+      module_function
+
+      # Picks the most-identifying [key, value] pair from a tool's arguments,
+      # in priority order. Returns nil when none of the known keys carry a value.
+      def pick_hint(arguments)
+        return nil unless arguments.is_a?(Hash)
+
+        %i[pattern file_path path command].each do |k|
+          v = arguments[k] || arguments[k.to_s]
+          return [k, v] if v && !v.to_s.empty?
+        end
+        nil
+      end
+
+      # The concise, sanitized hint string for a tool's arguments — the first
+      # line, secrets-masked, escape-stripped, truncated to `max` chars. Returns
+      # nil when there's no identifying argument. `verbose:` raises the cap so a
+      # `--verbose` one-shot trace can show fuller args.
+      def hint(arguments, max: 60, verbose: false)
+        picked = pick_hint(arguments)
+        return nil unless picked
+
+        raw_key, raw_value = picked
+        masked = Util::SecretsMask.mask_value(raw_value, key: raw_key).to_s
+        clean  = Util::Output.sanitize_terminal(masked)
+        first  = clean.lines.first.to_s.strip
+        cap    = verbose ? max * 4 : max
+        first.length > cap ? "#{first[0, cap - 3]}..." : first
+      end
+
+      # The full `name hint` label (e.g. `edit foo.rb`, `bash npm test`,
+      # `read README.md`). Falls back to the bare tool name when the tool has no
+      # identifying argument.
+      def label(name, arguments, max: 60, verbose: false)
+        h = hint(arguments, max: max, verbose: verbose)
+        h && !h.empty? ? "#{name} #{h}" : name.to_s
+      end
+    end
+  end
+end

data/lib/rubino/update_check.rb

@@ -42,6 +42,12 @@ module Rubino
     # notice must not leak through either (#66).
     def notice_from_cache
       return nil if opted_out?
+      # Never render off a poisoned cache: a future-dated checked_at (the
+      # "v99.0.0" phantom came from {"checked_at":"2099-…","latest":"99.0.0"})
+      # is suppressed here, and stale? treats it as stale so a refresh
+      # repopulates it for next boot. A legitimately >24h-old cache is still
+      # trusted for the notice — only forward-dated / corrupt entries are poison.
+      return nil if poisoned_cache?
 
       latest = cached_latest
       return nil unless newer?(latest)
@@ -59,6 +65,7 @@ module Rubino
       return nil unless stale?
 
       Thread.new do
+        Thread.current[:rubino_update_refresh] = true
         latest = fetch_latest
         write_cache(latest) if latest
       rescue StandardError
@@ -138,14 +145,42 @@ module Rubino
         ENV["CI"].to_s.strip.empty?
     end
 
-    # True when the cache is missing or its checked_at is older than 24h.
+    # True when the cache is missing, unreadable, its checked_at is older than
+    # 24h — AND, crucially, also true when checked_at is in the FUTURE.
+    #
+    # A future checked_at (clock skew, a hand-edited or corrupt cache, a bogus
+    # fixture) yields a NEGATIVE age, which `>= 24h` is never true for — so the
+    # old code latched the poisoned cache forever and re-rendered its bogus
+    # `latest` on every boot (the live "rubino v99.0.0 available" phantom, from
+    # a cache pinned at {"checked_at":"2099-…","latest":"99.0.0"}). Treating a
+    # negative age as stale forces a re-check, letting the notifier self-heal.
     def stale?
-      return true unless File.exist?(cache_path)
+      age = cache_age
+      return true if age.nil?
+
+      age.negative? || age >= CHECK_INTERVAL
+    end
+
+    # A cache whose checked_at is in the future is poison: it cannot reflect a
+    # real check and must never drive the boot notice. Missing/unreadable caches
+    # are NOT "poisoned" (they simply yield no notice); only a forward-dated or
+    # unparseable timestamp is.
+    def poisoned_cache?
+      return false unless File.exist?(cache_path)
+
+      age = cache_age
+      age.nil? || age.negative?
+    end
+
+    # Seconds since the cached checked_at (negative if it is in the future), or
+    # nil when the cache is missing, unreadable, or has an unparseable timestamp.
+    def cache_age
+      return nil unless File.exist?(cache_path)
 
       checked_at = JSON.parse(File.read(cache_path))["checked_at"]
-      Time.now.utc - Time.parse(checked_at) >= CHECK_INTERVAL
+      Time.now.utc - Time.parse(checked_at)
     rescue StandardError
-      true
+      nil
     end
 
     # ---- update mechanics -------------------------------------------------

data/lib/rubino/util/atomic_file.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "fileutils"
+
+module Rubino
+  module Util
+    # Crash- and concurrency-safe writes to a shared state file.
+    #
+    # Several files in rubino are read-modify-written by commands the user can
+    # legitimately run in parallel: the skills provenance ledger
+    # (`.sources.json`), the YAML config (`config.yml`). A plain
+    # read → mutate → `File.write` has two defects under concurrency:
+    #
+    #   * lost update — two writers read the same base, each writes its own
+    #     mutation, the second clobbers the first (e.g. 4 parallel
+    #     `skills install` → only the last 2 ledger entries survive); and
+    #   * torn file — a writer interrupted mid-`write` (or interleaved with a
+    #     reader) leaves a half-written, unparseable file that bricks every
+    #     later command (e.g. corrupt `config.yml`).
+    #
+    # `update` fixes both with the standard POSIX recipe:
+    #
+    #   1. `flock(LOCK_EX)` on a dedicated `<target>.lock` sibling — a separate
+    #      file so the lock outlives any rename/replace of the data file and a
+    #      reader's `LOCK_SH` never races the writer's rename of the data file
+    #      itself. The whole read-modify-write runs under the lock, so writers
+    #      serialize and none reads a base another is about to overwrite.
+    #   2. write the new contents to a temp file IN THE SAME DIRECTORY (so the
+    #      final rename is same-filesystem, hence atomic), then `fsync` it.
+    #   3. `File.rename(tmp, target)` — atomic on POSIX: a concurrent reader sees
+    #      either the whole old file or the whole new one, never a torn mix.
+    #   4. `fsync` the directory so the rename survives a crash.
+    #
+    # Readers that want a consistent snapshot can take `LOCK_SH` over the same
+    # lock via `.read_shared`; a plain `File.read` is also safe against tearing
+    # because the rename is atomic (it just may observe a slightly stale file).
+    module AtomicFile
+      module_function
+
+      # Serialized read-modify-write of +path+. Yields the current file contents
+      # (a String, or nil when the file doesn't exist yet) while holding an
+      # exclusive lock, and atomically writes back whatever the block returns.
+      # If the block returns nil the file is left untouched (no-op write).
+      # Returns the block's value.
+      def update(path)
+        FileUtils.mkdir_p(File.dirname(path))
+        with_lock(path, File::LOCK_EX) do
+          current = File.file?(path) ? File.read(path) : nil
+          new_contents = yield(current)
+          write_atomic(path, new_contents) unless new_contents.nil?
+          new_contents
+        end
+      end
+
+      # Reads +path+ under a shared lock (so it can't observe a concurrent
+      # writer's intermediate state). Returns the contents, or nil when absent.
+      def read_shared(path)
+        return nil unless File.file?(path)
+
+        with_lock(path, File::LOCK_SH) do
+          File.file?(path) ? File.read(path) : nil
+        end
+      end
+
+      # Write +contents+ to +path+ via temp-file + atomic rename, fsyncing the
+      # temp file and the directory. Standalone (no lock) for callers that
+      # already hold one, or that only need crash-safety, not serialization.
+      def write_atomic(path, contents)
+        dir = File.dirname(path)
+        FileUtils.mkdir_p(dir)
+        # Preserve plain-write semantics on an EXISTING read-only file: a temp +
+        # rename would otherwise sidestep the file's own 0444 (the writable dir
+        # lets us swap it in), silently clobbering a file the user marked
+        # read-only. Refuse with the same EACCES a File.write would have raised.
+        existing_mode = File.exist?(path) ? File.stat(path).mode : nil
+        raise Errno::EACCES, path if existing_mode && !File.writable?(path)
+
+        tmp = File.join(dir, ".#{File.basename(path)}.#{Process.pid}.#{rand(1 << 32)}.tmp")
+        begin
+          File.open(tmp, File::WRONLY | File::CREAT | File::TRUNC, 0o600) do |f|
+            f.write(contents)
+            f.flush
+            f.fsync
+          end
+          # Carry the original file's permission bits across the replace so an
+          # in-place edit doesn't silently re-chmod the user's file to 0600.
+          File.chmod(existing_mode & 0o777, tmp) if existing_mode
+          File.rename(tmp, path)
+          fsync_dir(dir)
+        ensure
+          FileUtils.rm_f(tmp)
+        end
+      end
+
+      def with_lock(path, mode)
+        lock_path = "#{path}.lock"
+        FileUtils.mkdir_p(File.dirname(lock_path))
+        File.open(lock_path, File::RDWR | File::CREAT, 0o600) do |lock|
+          lock.flock(mode)
+          yield
+        ensure
+          lock.flock(File::LOCK_UN)
+        end
+      end
+
+      # fsync the directory so the rename is durable. Best-effort: some
+      # platforms/filesystems refuse to open a dir for fsync (e.g. Windows),
+      # in which case durability of the rename degrades but correctness of the
+      # atomic swap is unaffected.
+      def fsync_dir(dir)
+        File.open(dir, &:fsync)
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/rubino/util/ignore_rules.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require "open3"
+
+module Rubino
+  module Util
+    # Consistent .gitignore-aware file filtering shared by the grep Ruby
+    # fallback and the glob tool (#375b/#375c).
+    #
+    # The PROBLEM: grep's ripgrep path honors .gitignore, but the Ruby fallback
+    # (`Dir.glob("**/*")`) did not — so `grep` returned a DIFFERENT, larger set
+    # (including build artifacts, node_modules, secrets in ignored files)
+    # depending on whether rg happened to be installed. Non-deterministic, and a
+    # leak of ignored content. The glob tool ignored .gitignore entirely too.
+    #
+    # The FIX: a single ignore oracle both non-rg paths consult, matching rg's
+    # default semantics as closely as a non-rg implementation can:
+    #
+    #   * In a git repo, the canonical answer is `git ls-files --cached --others
+    #     --exclude-standard` (tracked + untracked-but-not-ignored) — EXACTLY
+    #     the set rg searches by default. We build the allowed-path set from it.
+    #   * Outside a repo (or if git fails), fall back to a small built-in
+    #     denylist of always-noise dirs (.git, node_modules, …) so behaviour is
+    #     still deterministic and never leaks the VCS internals.
+    #
+    # Per-root results are cached for the life of the instance, so a single
+    # grep/glob call pays the git cost once.
+    class IgnoreRules
+      # Always-skipped dirs for the non-git fallback. Mirrors the set
+      # UI::CompletionSource uses so discovery is consistent across the tool.
+      FALLBACK_IGNORE_DIRS = %w[.git node_modules vendor tmp log .bundle .svn .hg __pycache__].freeze
+
+      def initialize
+        @allowed_cache = {}
+        @git_root_cache = {}
+      end
+
+      # True when +abs_path+ (an absolute file path) should be EXCLUDED from
+      # results given +root+ (the search base). Consistent across grep-fallback
+      # and glob: a path git ignores (or the fallback denylist matches) is
+      # ignored regardless of whether rg is installed.
+      def ignored?(abs_path, root)
+        allowed = allowed_set(root)
+        return fallback_ignored?(abs_path, root) if allowed.nil?
+
+        rel = relative(abs_path, root)
+        return true if rel.nil?
+
+        !allowed.include?(rel)
+      end
+
+      private
+
+      # The set of NON-ignored relative paths under +root+ per git, or nil when
+      # this isn't a git repo / git failed (caller falls back to the denylist).
+      # git ls-files is run from the repo root and paths are re-based onto +root+
+      # so a search rooted in a subdir still matches.
+      def allowed_set(root)
+        @allowed_cache.fetch(root) do
+          @allowed_cache[root] = build_allowed_set(root)
+        end
+      end
+
+      def build_allowed_set(root)
+        repo_root = git_root(root)
+        return nil if repo_root.nil?
+
+        out, status = Open3.capture2(
+          "git", "ls-files", "--cached", "--others", "--exclude-standard", "-z",
+          chdir: repo_root, err: File::NULL
+        )
+        return nil unless status.success?
+
+        set = Set.new
+        out.split("\0").each do |rel_to_repo|
+          next if rel_to_repo.empty?
+
+          abs = File.expand_path(rel_to_repo, repo_root)
+          rel = relative(abs, root)
+          set << rel if rel
+        end
+        set
+      rescue StandardError
+        nil
+      end
+
+      # The git toplevel for +root+, or nil if not a repo. Cached per root.
+      def git_root(root)
+        @git_root_cache.fetch(root) do
+          out, status = Open3.capture2(
+            "git", "rev-parse", "--show-toplevel",
+            chdir: root, err: File::NULL
+          )
+          @git_root_cache[root] = status.success? ? out.strip : nil
+        end
+      rescue StandardError
+        @git_root_cache[root] = nil
+      end
+
+      # Non-git fallback: ignore by built-in noise-dir denylist on any path
+      # component, so behaviour stays deterministic without a repo.
+      def fallback_ignored?(abs_path, root)
+        rel = relative(abs_path, root) || File.basename(abs_path)
+        rel.split(File::SEPARATOR).any? { |part| FALLBACK_IGNORE_DIRS.include?(part) }
+      end
+
+      # Path of +abs_path+ relative to +root+, or nil when it's outside +root+.
+      def relative(abs_path, root)
+        abs  = File.expand_path(abs_path)
+        base = File.expand_path(root)
+        return File.basename(abs) if abs == base
+
+        prefix = "#{base}#{File::SEPARATOR}"
+        return nil unless abs.start_with?(prefix)
+
+        abs[prefix.length..]
+      end
+    end
+  end
+end