rubino-agent 0.3.0

data/lib/rubino/util/output.rb

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+
+module Rubino
+  module Util
+    # Smart truncation of long tool output for the scrollback preview.
+    #
+    # Rule shape (5 head + 10 tail + marker, threshold 30) follows the
+    # pattern that emerged from surveying Codex, Gemini CLI, Roo, and
+    # Aider: tail bias because errors, exit codes, and command summaries
+    # live at the end. A head-heavy split (which would be intuitive for
+    # "show me the start") consistently hides the part the user actually
+    # needs when something failed.
+    #
+    # The FULL output still goes to the model and the session DB — this
+    # is only what the user sees in the live scroll. The marker tells
+    # them so they don't think they're missing something irrecoverable.
+    module Output
+      DEFAULT_MAX  = 30
+      DEFAULT_HEAD = 5
+      DEFAULT_TAIL = 10
+
+      # Returns either the full text (when total lines <= max) or a
+      # head + marker + tail preview. Pure function — no side effects,
+      # no IO. Caller decides where to render the result.
+      #
+      # @param text [String] the raw output
+      # @param max  [Integer] line count above which we trim
+      # @param head [Integer] lines to keep from the top
+      # @param tail [Integer] lines to keep from the bottom
+      # @return [String] the preview (always a String, never nil)
+      def self.preview(text, max: DEFAULT_MAX, head: DEFAULT_HEAD, tail: DEFAULT_TAIL)
+        return "" if text.nil? || text.to_s.empty?
+
+        lines = text.to_s.lines.map(&:chomp)
+        return lines.join("\n") if lines.size <= max
+
+        omitted  = lines.size - head - tail
+        head_pt  = lines.first(head)
+        tail_pt  = lines.last(tail)
+        marker   = "… [#{omitted} more lines · full in DB] …"
+
+        (head_pt + [marker] + tail_pt).join("\n")
+      end
+
+      # Single-line elision to +max+ characters with a trailing ellipsis.
+      # Shared by the parent-note tools (AnswerChild/Task/Steer) that all
+      # carried a byte-identical private `truncate`. Pure function.
+      #
+      # @param text [#to_s] the raw text (nil becomes "")
+      # @param max  [Integer] character budget before eliding
+      # @return [String] the text, or its first +max+ chars + "…"
+      def self.elide(text, max)
+        s = text.to_s
+        s.length > max ? "#{s[0, max]}…" : s
+      end
+
+      # First NON-BLANK line of +text+, stripped (or "" when all-blank). A
+      # multi-line ruby/shell command often starts with a blank line, so a
+      # naive `.lines.first` rendered an empty approval/activity hint (#141).
+      # Pure function shared by the subagent card / view rows and the task
+      # tool's approval preview, which each carried this extraction inline.
+      def self.first_nonblank_line(text)
+        text.to_s.each_line.map(&:strip).find { |l| !l.empty? }.to_s
+      end
+
+      # First NON-BLANK line, elided to +max+ chars (max-1 + "…"). The single
+      # source for the subagent card and view rows, which carried a
+      # byte-identical private copy. Distinct from #elide (which keeps +max+
+      # chars before the ellipsis) — this row shape budgets the ellipsis IN.
+      def self.first_line(text, max)
+        first = first_nonblank_line(text)
+        first.length > max ? "#{first[0, max - 1]}…" : first
+      end
+
+      # Truncates long tool output to stay within byte/line limits, with
+      # tail-bias because the part the agent (and a human reading the log)
+      # actually need is at the end: exit-code suffix, error message,
+      # backtrace, "X failures" line. Head-only truncation drops exactly
+      # the bytes that matter when something blows up at byte 49,999.
+      #
+      # Shape: keep ~10% head + bulk of the budget in the tail + a marker
+      # in the middle saying how many bytes/lines were elided. Mirrors the
+      # pattern #preview already uses for the scrollback body.
+      #
+      # When +spill+ is supplied it is called with the full pre-truncation
+      # text and must return a path (or nil); the marker then points the
+      # model at it, so the elided middle isn't lost — the model can `read`
+      # the file with offset/limit to recover any part. (Claude-Code-style
+      # spill.) Pure aside from that injected callback.
+      def self.truncate(text, max_bytes:, max_lines:, spill: nil)
+        text = text.to_s
+        over_bytes = text.bytesize > max_bytes
+        over_lines = text.lines.size > max_lines
+        return text unless over_bytes || over_lines
+
+        spill_path = spill&.call(text)
+        text = tail_bias_bytes(text, max_bytes, spill_path) if over_bytes
+        text = tail_bias_lines(text, max_lines, spill_path) if text.lines.size > max_lines
+        text
+      end
+
+      def self.tail_bias_bytes(text, max_bytes, spill_path = nil)
+        encoding        = text.encoding
+        recover         = spill_path ? " · full output saved to #{spill_path} — read it with offset/limit" : ""
+        marker_template = "\n... [%d bytes elided#{recover} · use grep/head to narrow] ...\n"
+        marker_max      = (marker_template % 999_999_999).bytesize
+        head_budget     = (max_bytes * 0.1).to_i
+        tail_budget     = max_bytes - head_budget - marker_max
+
+        # Below ~200 bytes the marker eats the entire budget, so fall back
+        # to a simple head truncation (old behavior). Realistic caps go
+        # through the head+tail path.
+        if tail_budget <= 0
+          truncated = text.byteslice(0, max_bytes).to_s.force_encoding(encoding).scrub("")
+          tail_note = spill_path ? " · full output: #{spill_path}" : ""
+          return "#{truncated}\n... [truncated at #{max_bytes} bytes#{tail_note}]"
+        end
+
+        head   = text.byteslice(0, head_budget).to_s.force_encoding(encoding).scrub("")
+        tail   = text.byteslice(-tail_budget, tail_budget).to_s.force_encoding(encoding).scrub("")
+        elided = text.bytesize - head.bytesize - tail.bytesize
+        "#{head}#{format(marker_template, elided)}#{tail}"
+      end
+
+      def self.tail_bias_lines(text, max_lines, spill_path = nil)
+        lines = text.lines
+        return text if lines.size <= max_lines
+
+        recover    = spill_path ? " · full output saved to #{spill_path} — read it with offset/limit" : ""
+        head_count = [max_lines / 10, 5].max
+        tail_count = max_lines - head_count - 1
+        # Vanishing budget falls back to head-only truncation.
+        if tail_count <= 0
+          tail_note = spill_path ? " · full output: #{spill_path}" : ""
+          return "#{lines.first(max_lines).join}\n... [truncated at #{max_lines} lines#{tail_note}]"
+        end
+
+        elided = lines.size - head_count - tail_count
+        head   = lines.first(head_count).join
+        tail   = lines.last(tail_count).join
+        "#{head}... [#{elided} lines elided#{recover} · use grep/head to narrow] ...\n#{tail}"
+      end
+    end
+  end
+end

data/lib/rubino/util/secrets_mask.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Rubino
+  module Util
+    # Heuristic masking for credentials in tool arguments. The model often
+    # passes secrets through cleanly (env vars, config files), but a stray
+    # `command: "curl -H 'Authorization: Bearer sk_live_…'"` showing up in
+    # an approval prompt — or, worse, in the persistent scrollback — is a
+    # leak waiting to happen. Mask aggressively on display; the underlying
+    # tool still receives the real value.
+    module SecretsMask
+      SECRET_KEY_TOKENS = %w[
+        password passwd
+        secret
+        token bearer
+        api_key apikey api-key
+        access_key accesskey access-key
+        private_key privatekey private-key
+        auth authorization
+      ].freeze
+
+      # Pattern that matches `key=value`, `key: value`, `key value` for the
+      # secret-named keys, inside a free-text string (shell command, URL
+      # query). The trailing value is grabbed up to whitespace or a known
+      # delimiter; quoted values are grabbed whole. `Bearer <token>` is
+      # treated as a single value so `Authorization: Bearer XYZ` masks
+      # the whole token instead of leaving XYZ exposed.
+      INLINE_RE = /
+        (?<key>password|passwd|secret|token|
+              api[_-]?key|access[_-]?key|private[_-]?key|
+              authorization|auth|bearer)
+        (?<sep>\s*[:=]\s*|\s+)
+        (?<val>"[^"]+"|'[^']+'|(?:Bearer\s+)?[^"'\s]+)
+      /xi
+
+      MASK = "***"
+
+      # True if the given key looks sensitive on its own (used when the
+      # caller already has key/value pairs, e.g. a Hash of arguments).
+      def self.sensitive_key?(key)
+        k = key.to_s.downcase.tr("-", "_")
+        SECRET_KEY_TOKENS.any? { |t| k == t.tr("-", "_") || k.include?(t.tr("-", "_")) }
+      end
+
+      # Mask a single value, given the key it belongs to. Returns MASK if
+      # the key is sensitive; otherwise scans the value for inline secrets.
+      def self.mask_value(value, key: nil)
+        return value if value.nil?
+        return MASK if key && sensitive_key?(key)
+
+        mask_inline(value.to_s)
+      end
+
+      # Mask inline patterns like `Authorization: Bearer XYZ` in any string,
+      # whether or not the caller knows the surrounding context. Quoted
+      # values keep their quotes around the mask so the surrounding
+      # structure (`-H "Authorization: ***"`) stays balanced — otherwise
+      # the mask would eat a quote and the rest of the string would look
+      # like one long open string.
+      def self.mask_inline(text)
+        text.to_s.gsub(INLINE_RE) do
+          m   = Regexp.last_match
+          val = m[:val]
+          masked = case val[0]
+                   when '"' then %("#{MASK}")
+                   when "'" then "'#{MASK}'"
+                   else MASK
+                   end
+          "#{m[:key]}#{m[:sep]}#{masked}"
+        end
+      end
+
+      # Convenience for Hash arguments: returns a new Hash with sensitive
+      # values masked, leaving the original untouched (the real value still
+      # has to reach the tool).
+      def self.mask_hash(hash)
+        return hash unless hash.is_a?(Hash)
+
+        hash.each_with_object({}) { |(k, v), out| out[k] = mask_value(v, key: k) }
+      end
+    end
+  end
+end

data/lib/rubino/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Rubino
+  VERSION = "0.3.0"
+end

data/lib/rubino/workspace.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Rubino
+  # The set of directory roots the agent is allowed to work in.
+  #
+  # Historically rubino had exactly ONE root, resolved at launch from
+  # terminal.cwd or Dir.pwd, and every tool re-derived it. This module turns
+  # that single root into an ordered SET of roots: the primary (launch) root
+  # plus any directories added via `--add-dir` / `/add-dir`. The default — no
+  # extra dirs — is byte-identical to the old single-root behaviour.
+  #
+  # Modelled on Claude Code's `--add-dir`: extra roots widen the write/edit
+  # sandbox (see Tools::Base#within_workspace?) so the agent can touch files
+  # under any allowed root, e.g. a service and its client library at once.
+  module Workspace
+    @added = []
+    @mutex = Mutex.new
+
+    class << self
+      # The primary root: terminal.cwd when set, else the process cwd. This is
+      # the same rule Tools::Base#workspace_root has always used, kept as the
+      # single source of truth so the @-picker, shell/test cwd, file API and
+      # attachment downloader all agree on "the" root.
+      def primary_root
+        Rubino.configuration&.dig("terminal", "cwd") || Dir.pwd
+      end
+
+      # Every allowed root: the primary first, then each added dir, de-duped on
+      # canonical path so re-adding the launch dir (or the same dir twice) is a
+      # no-op. Returns plain strings.
+      def roots
+        @mutex.synchronize do
+          ordered = [primary_root, *@added]
+          seen = Set.new
+          ordered.filter_map do |dir|
+            real = canonical(dir)
+            next unless real
+            next if seen.include?(real)
+
+            seen << real
+            dir
+          end
+        end
+      end
+
+      # Canonical (realpath, symlinks resolved) form of every root — what the
+      # sandbox compares against.
+      def canonical_roots
+        roots.filter_map { |dir| canonical(dir) }
+      end
+
+      # Adds an extra allowed root. Returns the canonical path on success, or
+      # raises ArgumentError with a human-readable reason when the dir doesn't
+      # exist / isn't a readable directory. realpath-resolves so a symlinked
+      # add-dir lands on its true destination (and matches the sandbox check).
+      def add(dir)
+        expanded = File.expand_path(dir.to_s)
+        raise ArgumentError, "no such directory: #{dir}" unless File.directory?(expanded)
+        raise ArgumentError, "not readable: #{dir}" unless File.readable?(expanded)
+
+        real = File.realpath(expanded)
+        @mutex.synchronize do
+          @added << real unless @added.include?(real) || canonical(primary_root) == real
+        end
+        real
+      end
+
+      # Test/teardown hook: drop all added roots (the primary is always derived
+      # live from config/cwd, so it can't be reset here).
+      def reset!
+        @mutex.synchronize { @added = [] }
+      end
+
+      private
+
+      def canonical(path)
+        return nil if path.nil? || path.to_s.empty?
+
+        File.realpath(File.expand_path(path.to_s))
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/rubino-agent.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+# Shim so `require "rubino-agent"` (matching the gem name on RubyGems)
+# resolves to the canonical entry point in lib/rubino.rb.
+require "rubino"

data/lib/rubino.rb

@@ -0,0 +1,318 @@
+# frozen_string_literal: true
+
+require "zeitwerk"
+require "dry-configurable"
+require "fileutils"
+
+# Main module for the Rubino gem.
+# Provides an agentic framework with persistent memory, sessions,
+# context compaction, and extensible tool system built on ruby_llm.
+module Rubino
+  class Error < StandardError; end
+  class ConfigurationError < Error; end
+  class DatabaseError < Error; end
+  class SessionError < Error; end
+
+  # Raised when --resume <query> matches more than one session by id-prefix
+  # or title-substring. Carries the matches so the CLI can list them and
+  # ask the user to disambiguate, instead of silently picking the first.
+  class AmbiguousSessionError < SessionError
+    attr_reader :query, :matches
+
+    def initialize(query, matches)
+      @query   = query
+      @matches = matches
+      super(build_message)
+    end
+
+    private
+
+    def build_message
+      lines = ["Ambiguous --resume '#{@query}': #{@matches.size} sessions match."]
+      @matches.first(10).each do |s|
+        lines << "  #{s[:id][0, 8]}  #{s[:title] || "(no title)"}  [#{s[:status]}]"
+      end
+      lines << "Use --resume <full-id> (8+ chars) to pick one."
+      lines.join("\n")
+    end
+  end
+
+  class ToolError < Error; end
+  class CompactionError < Error; end
+  class JobError < Error; end
+end
+
+require_relative "rubino/errors"
+
+module Rubino
+  class << self
+    # Returns the Zeitwerk loader for autoloading
+    def loader
+      @loader ||= begin
+        loader = Zeitwerk::Loader.for_gem
+        loader.inflector.inflect(
+          # Acronym modules
+          "cli" => "CLI",
+          "llm" => "LLM",
+          "ui" => "UI",
+          "api" => "API",
+          "tls" => "TLS",
+          "mcp" => "MCP",
+          "oauth" => "OAuth",
+          # Files with compound names that need exact mapping
+          "ruby_llm_adapter" => "RubyLLMAdapter",
+          "mcp_tool_wrapper" => "MCPToolWrapper",
+          "bedrock_bearer_client" => "BedrockBearerClient",
+          "adapter_response" => "AdapterResponse",
+          "indented_io" => "IndentedIO",
+          "webfetch_tool" => "WebFetchTool",
+          "websearch_tool" => "WebSearchTool",
+          "github_tool" => "GitHubTool",
+          "skill_tool" => "SkillTool",
+          "custom_tool_loader" => "CustomToolLoader",
+          "custom_tool_builder" => "CustomToolBuilder",
+          "tool_pair_sanitizer" => "ToolPairSanitizer",
+          "degenerate_recovery" => "DegenerateResponseRecovery"
+        )
+        # Migrations are plain SQL files, not Ruby constants
+        loader.ignore(
+          File.expand_path("rubino/database/migrations", __dir__)
+        )
+        # errors.rb defines multiple constants in Rubino (NotFoundError, ...),
+        # not a single Rubino::Errors module — loaded manually via require_relative.
+        loader.ignore(File.expand_path("rubino/errors.rb", __dir__))
+        # rubino-agent.rb is a require shim matching the gem name; it maps to no
+        # Rubino constant (and "Rubino-agent" isn't a valid cname). Zeitwerk must
+        # not try to manage it.
+        loader.ignore(File.expand_path("rubino-agent.rb", __dir__))
+        loader
+      end
+    end
+
+    # Returns the current configuration instance
+    def configuration
+      @configuration ||= Config::Configuration.new
+    end
+
+    # Yields the configuration for block-style setup
+    def configure
+      yield(configuration) if block_given?
+      configuration
+    end
+
+    # Drops the memoized configuration so the next #configuration reload reads
+    # config.yml / .env fresh. Used after the first-run onboarding wizard writes
+    # them mid-process so the just-saved key is visible without a restart.
+    def reload_configuration!
+      @configuration = nil
+      configuration
+    end
+
+    # Returns the current UI adapter instance.
+    #
+    # A thread-local override (set via #with_ui) wins over the process-global
+    # adapter. This is what lets the API server run many runs concurrently:
+    # each run executes in its own thread (Run::Executor#start) with its own
+    # gated UI::API, and tools that reach for the global adapter
+    # (QuestionTool#ask, TaskTool) resolve to THAT run's UI — not a shared,
+    # gate-less global that would silently drop interactive prompts (the
+    # clarify/`question` flow) and could cross-talk between runs.
+    def ui
+      Thread.current[:rubino_ui] || (@ui ||= UI.build(configuration.ui_adapter))
+    end
+
+    # Sets the process-global UI adapter (CLI boot, tests).
+    attr_writer :ui
+
+    # Runs the block with +adapter+ as the thread-scoped UI, restoring the
+    # previous value afterwards (nested-safe). Used by Run::Executor to bind
+    # the run's gated UI::API for the duration of the worker thread so global
+    # `Rubino.ui` lookups inside tools hit the right, gated instance.
+    def with_ui(adapter)
+      prev = Thread.current[:rubino_ui]
+      Thread.current[:rubino_ui] = adapter
+      yield
+    ensure
+      Thread.current[:rubino_ui] = prev
+    end
+
+    # The EventBus of the CURRENTLY-RUNNING parent turn. The API/server path
+    # injects a fresh per-run bus (Run::Executor) that its Recorder is attached
+    # to; the CLI path uses the process-global bus. A backgrounded `task`
+    # subagent emits its SPAWNED/COMPLETED/FAILED lifecycle events here so they
+    # reach THAT run's recorder (and SSE stream) rather than a detached global
+    # bus. Falls back to the global bus when no turn-scoped bus is bound.
+    def active_event_bus
+      Thread.current[:rubino_event_bus] || event_bus
+    end
+
+    # Binds +bus+ as the turn-scoped event bus for the duration of the block
+    # (set by Interaction::Lifecycle around the loop run, like #with_ui binds
+    # the UI). Thread-local so a tool reaches it with no signature churn.
+    def with_event_bus(bus)
+      prev = Thread.current[:rubino_event_bus]
+      Thread.current[:rubino_event_bus] = bus
+      yield
+    ensure
+      Thread.current[:rubino_event_bus] = prev
+    end
+
+    # The InputQueue of the CURRENTLY-RUNNING parent turn, if any. A background
+    # subagent (TaskTool) reads this to deliver its completion notification back
+    # into the parent's live loop — the parent picks it up at its next iteration
+    # boundary via Loop#inject_steered_input, so the notice lands as a user
+    # message between turns, NEVER between an assistant tool_use and its results.
+    # Nil on the API/server path (no steering queue) — there the result is still
+    # reachable via the BackgroundTasks registry / `task_result`.
+    def background_sink
+      Thread.current[:rubino_background_sink]
+    end
+
+    # Binds +queue+ as the background-subagent notification sink for the
+    # duration of the block (set by Interaction::Lifecycle around the turn,
+    # exactly like #with_ui binds the run's UI). Thread-local so a tool can
+    # reach it with zero signature churn through the loop/executor.
+    def with_background_sink(queue)
+      prev = Thread.current[:rubino_background_sink]
+      Thread.current[:rubino_background_sink] = queue
+      yield
+    ensure
+      Thread.current[:rubino_background_sink] = prev
+    end
+
+    # The BackgroundTasks entry id of the subagent run executing on THIS thread,
+    # if any. Set by TaskTool#run_child_thread around the child Runner#run! so a
+    # tool the child invokes (today: ask_parent) can find its own registry entry
+    # — the card it surfaces on, the steer queue it receives answers through —
+    # without threading the id through the loop/executor/tool signatures. Nil on
+    # the parent thread and on any non-delegated (top-level) run, which is the
+    # signal ask_parent uses to refuse (a top-level agent has no parent to ask).
+    def current_subagent_id
+      Thread.current[:rubino_current_subagent_id]
+    end
+
+    # Binds +id+ as the current subagent id for the duration of the block
+    # (set by TaskTool around the child run, exactly like #with_ui / the
+    # background sink). Thread-local so the child's tools reach it with zero
+    # signature churn.
+    def with_current_subagent_id(id)
+      prev = Thread.current[:rubino_current_subagent_id]
+      Thread.current[:rubino_current_subagent_id] = id
+      yield
+    ensure
+      Thread.current[:rubino_current_subagent_id] = prev
+    end
+
+    # Returns the current structured logger.
+    def logger
+      @logger ||= Logger.new
+    end
+
+    # Sets the logger (useful for testing).
+    attr_writer :logger
+
+    # Returns the database connection
+    def database
+      @database ||= Database::Connection.new(configuration.database_path)
+    end
+
+    # First-run guard for any DB-touching entry point. A brand-new RUBINO_HOME
+    # has no schema yet (setup/chat hasn't migrated it), so a read path like
+    # `rubino sessions list` would otherwise hit a raw
+    # `SQLite3::SQLException: no such table` backtrace (#35). `healthy?` only
+    # runs `SELECT 1`, which passes the moment SQLite lazily creates the empty
+    # file — the tables are still missing — so we also check migrator.pending?.
+    # Migrations are idempotent, so this is safe to call on every command. This
+    # is the same logic the interactive `chat` command already used; promoted
+    # here so the read CLIs (sessions/memory/jobs) share one implementation.
+    # Returns true when the schema is ready, false when initialization failed
+    # (callers decide whether that's fatal or degrades to an empty state).
+    def ensure_database_ready!
+      connection = database
+      migrator   = Database::Migrator.new(connection)
+      return true unless connection.healthy? == false || migrator.pending?
+
+      ensure_directories!
+      migrator.migrate!
+      true
+    rescue StandardError => e
+      logger.debug(event: "ensure_database_ready_failed", error: "#{e.class}: #{e.message}")
+      false
+    end
+
+    # Returns the event bus instance
+    def event_bus
+      @event_bus ||= Interaction::EventBus.new
+    end
+
+    # Returns the shared agent registry (primary/subagent/utility definitions).
+    # Memoized process-wide so the `task` tool can resolve a subagent by name
+    # at call time without each boot path having to thread an instance through
+    # the tool executor. Both entry points (CLI ChatCommand, API ServerCommand)
+    # touch this at boot so delegation works identically over /v1 and in chat;
+    # the tool also reads it lazily here, so a stripped boot still resolves.
+    def agent_registry
+      @agent_registry ||= Agent::AgentRegistry.new
+    end
+
+    # Sets the agent registry (useful for testing / custom boots).
+    attr_writer :agent_registry
+
+    # Returns the plugin registry
+    def plugin_registry
+      Plugins.registry
+    end
+
+    # DSL for defining plugins
+    def plugin(&)
+      Plugins.registry.instance_eval(&)
+    end
+
+    # Resets all memoized state (useful for testing)
+    def reset!
+      @configuration = nil
+      @ui = nil
+      @database = nil
+      @event_bus = nil
+      @agent_registry = nil
+      Plugins.reset!
+    end
+
+    # Returns the home directory path. Delegates to the SAME resolver the
+    # config Loader uses (RUBINO_HOME → else ~/.rubino) so the server
+    # (which loads config.yml through the Loader) and the CLI (config/setup/
+    # doctor + ensure_directories!) never disagree about where state lives.
+    # Previously this read the YAML `paths.home` default (~/.rubino) and
+    # ignored $RUBINO_HOME, splitting the brain at first boot / for .env.
+    def home_path
+      Rubino::Config::Loader.default_home_path
+    end
+
+    # Ensures the home directory and subdirectories exist. The home holds
+    # secrets (.env) and the database, so it is forced to 0700 here — the
+    # single code path every entry point (setup/chat/prompt/doctor) goes
+    # through to materialize the home — not just when `setup` ran first
+    # (#65): an auto-created home used to be left at the umask's 0755.
+    def ensure_directories!
+      home = home_path
+      FileUtils.mkdir_p(home)
+      File.chmod(0o700, home)
+      %w[memories sessions logs skills commands tools plugins].each do |subdir|
+        dir = File.join(home, subdir)
+        FileUtils.mkdir_p(dir) unless File.directory?(dir)
+      end
+    end
+  end
+end
+
+# Setup autoloading
+Rubino.loader.setup
+
+# Register the built-in memory backends. The default backend wraps the
+# existing Store/Retriever/Extractor, so an unset `memory.backend` is
+# byte-identical to the pre-pluggable behavior.
+Rubino::Memory::Backends.register(Rubino::Memory::Backends::Default)
+# The "tiny-Zep" SQLite backend: LLM-extracted atomic facts, bi-temporal
+# supersession, and hybrid FTS5 + recency recall. Switch with
+# `rubino memory backend sqlite`.
+Rubino::Memory::Backends.register(Rubino::Memory::Backends::Sqlite)

data/mise.toml

@@ -0,0 +1,2 @@
+[tools]
+ruby = "3.3.3"