rubino-agent 0.4.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a20b85c30f537ff5bdaf5abec6300eedfcda791d76b899ac3fcd972b71854ac1
-  data.tar.gz: d5692a31f13e338690a3be90bc4d96d27251ddad165b706afee7e0fcdee3fea7
+  metadata.gz: c1debe685b923c625e0dc4dcf95da3c9fc12fcd6c73bdff71e35164279e62b06
+  data.tar.gz: 5451e122fc13bfdd4ffeba0e680cad9fb6b976dfabe8f9dcfd894e5215ac9688
 SHA512:
-  metadata.gz: 865a203c91311f039d90a98b4e88ff8f792d0049e7370f10c847e2aeb77458f2f39d80485f133a79d8c2e8d9c1eeb5dec369f53320d210ff79928965a8c0a3f2
-  data.tar.gz: a9435d6746bc743e65db73574e13d4cd65445bf97ec5c9e2387737c176e7ab8726991062cc852a6c295910e3876d8b4a1d8c96420f5a8dd6a83dabf68a280546
+  metadata.gz: bf657914d128053ffa39d7911a5c2c12e491ff45b1907e8bc78a694b8f8d7540a1e8d1182ee5831670af17e5e64b16148202d987ebc9e2c75604a88f78148d36
+  data.tar.gz: eefe6fbbcd977bff1cf8b7a189fdaf73daee9ca6b12ca55b82876a99c55ede529dc78ba3f5146f8b34a7e6e6b6b38dab454c9d6cdcf3baca8e754187f49c6829

data/.rubocop.yml

@@ -27,6 +27,12 @@ AllCops:
     # Test fixtures are sample input documents (e.g. a .rb code sample for the
     # plain-text converter), not project source -- they must not be linted.
     - "spec/fixtures/**/*"
+    # Eval-harness fixtures are deliberately tiny/imperfect sample projects the
+    # agent edits at eval time (INPUT, not source); results/ is generated output.
+    # The eval/.rubocop.yml excludes these for an in-eval run; mirror it here so
+    # the whole-repo lint from the root is clean too.
+    - "eval/fixtures/**/*"
+    - "eval/results/**/*"
 
 # --- House style: strings ----------------------------------------------------
 

data/.rubocop_todo.yml

@@ -256,6 +256,8 @@ Metrics/BlockLength:
 Metrics/ClassLength:
   Exclude:
     - 'lib/rubino/cli/chat_command.rb'
+    - 'lib/rubino/commands/executor.rb'
+    - 'lib/rubino/llm/ruby_llm_adapter.rb'
     - 'lib/rubino/ui/bottom_composer.rb'
     - 'lib/rubino/ui/cli.rb'
 
@@ -406,7 +408,6 @@ Naming/PredicateMethod:
   Exclude:
     - 'lib/rubino/agent/model_call_runner.rb'
     - 'lib/rubino/agent/response_validator.rb'
-    - 'lib/rubino/agent/router.rb'
     - 'lib/rubino/cli/onboarding_wizard.rb'
     - 'lib/rubino/cli/trust_gate.rb'
     - 'lib/rubino/memory/backends/sqlite.rb'
@@ -451,6 +452,7 @@ RSpec/AnyInstance:
     - 'spec/rubino/commands/commands_spec.rb'
     - 'spec/rubino/context/compressor_spec.rb'
     - 'spec/rubino/context/prompt_assembler_active_skill_spec.rb'
+    - 'spec/rubino/context/prompt_assembler_cache_breakpoints_spec.rb'
     - 'spec/rubino/context/prompt_assembler_ignore_rules_spec.rb'
     - 'spec/rubino/context/prompt_assembler_layering_spec.rb'
     - 'spec/rubino/context/prompt_assembler_memory_snapshot_spec.rb'
@@ -462,8 +464,10 @@ RSpec/BeforeAfterAll:
     - '**/spec/spec_helper.rb'
     - '**/spec/rails_helper.rb'
     - '**/spec/support/**/*.rb'
+    - 'spec/rubino/llm/tool_bridge_cache_breakpoint_spec.rb'
     - 'spec/rubino/security/approval_policy_mode_spec.rb'
     - 'spec/rubino/tools/registry_mode_spec.rb'
+    - 'spec/rubino/tools/registry_situational_gating_spec.rb'
     - 'spec/rubino/tools/registry_spec.rb'
 
 # Offense count: 31
@@ -534,6 +538,7 @@ RSpec/DescribeClass:
     - 'spec/rubino/skills/skills_spec.rb'
     - 'spec/rubino/tools/edit_read_gate_spec.rb'
     - 'spec/rubino/tools/shell_background_spec.rb'
+    - 'spec/rubino/tools/shell_background_completion_spec.rb'
     - 'spec/rubino/tools/shell_input_spec.rb'
     - 'spec/rubino/tools/tool_fixes_spec.rb'
     - 'spec/rubino/ui/bottom_composer_approval_handoff_pty_spec.rb'
@@ -550,7 +555,11 @@ RSpec/DescribeMethod:
     - 'spec/rubino/api/middleware/json_body_size_spec.rb'
     - 'spec/rubino/cli/chat_command_continue_spec.rb'
     - 'spec/rubino/cli/commands_version_spec.rb'
+    - 'spec/rubino/llm/ruby_llm_adapter_cache_spec.rb'
+    - 'spec/rubino/llm/tool_bridge_cache_breakpoint_spec.rb'
+    - 'spec/rubino/tools/registry_situational_gating_spec.rb'
     - 'spec/rubino/context/prompt_assembler_active_skill_spec.rb'
+    - 'spec/rubino/context/prompt_assembler_cache_breakpoints_spec.rb'
     - 'spec/rubino/context/prompt_assembler_ignore_rules_spec.rb'
     - 'spec/rubino/context/prompt_assembler_layering_spec.rb'
     - 'spec/rubino/context/prompt_assembler_memory_snapshot_spec.rb'
@@ -654,12 +663,13 @@ RSpec/LeakyLocalVariable:
   Exclude:
     - 'spec/rubino/no_direct_output_spec.rb'
 
-# Offense count: 7
+# Offense count: 8
 RSpec/MultipleDescribes:
   Exclude:
     - 'spec/rubino/commands/commands_spec.rb'
     - 'spec/rubino/context/prompt_assembler_layering_spec.rb'
     - 'spec/rubino/memory/backends_spec.rb'
+    - 'spec/rubino/tools/encoding_robustness_spec.rb'
     - 'spec/rubino/tools/error_code_spec.rb'
     - 'spec/rubino/tools/tool_fixes_spec.rb'
     - 'spec/rubino/trust_spec.rb'

data/AGENTS.md

@@ -77,7 +77,7 @@ lib/rubino/
 ## Surfaces this project exposes
 
 - **HTTP API** (`/v1/*`) — the canonical interface. See `docs/api/v1.md`.
-- **CLI** — `rubino {setup,chat,prompt,server,config,memory,sessions,jobs,tools,doctor,version}`.
+- **CLI** — `rubino {setup,chat,prompt,server,config,memory,sessions,jobs,skills,tools,tls_cert,doctor,version,update}`.
 - **Library** — `require "rubino"; Rubino.run(...)`.
 
 The interactive CLI ships as part of `rubino chat`. Multi-agent routing, MCP, and plugin hooks are designed in but not fully wired yet.

data/CHANGELOG.md

@@ -1,6 +1,459 @@
 # Changelog
 
-## [Unreleased]
+## [0.5.1] - 2026-06-25
+
+### Added
+
+- **Tool-output compression (deterministic, off by default).** A no-LLM content
+  router at the single `Agent::ToolExecutor` seam compresses high-volume tool
+  output before it reaches the model: test/build/lint logs are reduced to their
+  failures + summary (≈97% fewer tokens on a failing suite, every failure kept),
+  and a whole-file source read can be returned as a skeleton (signatures kept,
+  large bodies elided behind a `read offset:/limit:` pointer). Diffs, grep/search
+  results, JSON, and short output pass through **byte-identical**. Reversibility
+  reuses the existing spill: the full original is written to
+  `tool-results/<call_id>.txt` and the compressed output points the model there —
+  no separate store/tool. When enabled, `read` and `shell` expose a `compress`
+  parameter (default true) so the model can opt a single call out and get the
+  verbatim output. Master switch `tool_output_compression.enabled` (default
+  `false`); `rubino setup` offers to turn it on. See
+  [configuration.md](docs/configuration.md#tool_output_compression).
+- **Multi-language code compression.** The whole-file source-skeleton compressor
+  now covers more than Ruby. `tool_output_compression.code.languages` (default
+  `["ruby"]`) selects which languages get skeletonised: Ruby (built-in Prism
+  parser), Python (stdlib `ast` via your `python3` — a no-op if `python3` isn't
+  on PATH), and JavaScript / TypeScript / TSX (via the optional
+  `tree_sitter_language_pack` gem — a no-op until it's installed). A read in an
+  unlisted language passes through verbatim. `rubino setup` adds a language
+  picker and, if you choose JS/TS, offers to install the parser gem.
+- **Agent-attach view.** At the idle prompt, `↓` opens the subagent picker and
+  `Enter` now **attaches** to the highlighted background subagent: the screen
+  switches to that agent's OWN full timeline (its tool calls and what it said,
+  replayed from its session) and the input prompt becomes scoped — `sa_xxxx ❯`.
+  While attached, typed text steers the running child (or answers it when it's
+  blocked on you); `←` on the empty prompt (or the picker's `◂ main` row) returns
+  to the main timeline, and the picker doubles as a switcher between agents. This
+  replaces the bounded registry snapshot the picker's Enter used to show with the
+  agent's real conversation, and makes the global `/agents <id> steer/probe` and
+  `/reply <id>` forms redundant while attached. The attached view **live-tails**
+  the child's stream (tool rows and streaming prose) exactly like the main agent
+  instead of freezing on a snapshot, and `/back` / `/detach` return to the main
+  agent regardless of composer-draft state (#82, #85, #87).
+- **`api.allow_public_bind` gate.** Because the API server can execute shell
+  tools, binding it to a non-loopback address (`--host 0.0.0.0`,
+  `RUBINO_API_HOST`) now **refuses to boot** unless `api.allow_public_bind: true`
+  is set in `config.yml`; when opted in, the server prints a one-time exposure
+  warning. Loopback binds are unaffected (#577).
+- **MCP tool transparency + parallel startup.** An MCP tool's display label now
+  carries its source — the live tool card and the approval card both show
+  `<bare> (mcp:<server>)`, so you can tell at a glance that an out-of-process
+  server is running (the model-facing tool name is unchanged) (#582). MCP
+  servers also now connect **in parallel** at boot, so one hanging server no
+  longer serializes startup (#576).
+- **Read-only meta-commands run immediately while a turn is active.** A small
+  set of non-mutating slash commands (`/agents`, `/tasks`, `/stop`, `/status`,
+  `/jobs`, `/help`, `/commands`, `/dirs`) now execute **immediately** mid-turn
+  instead of queuing — so you can drill into a sub-agent, stop the run, or check
+  status without interrupting. State-mutating commands (`/model`, `/clear`,
+  `/new`, `/config`, `/mode`, …) show a transient `⚠ <cmd> is not available
+  during an active turn — press Esc to interrupt first` notice; plain text still
+  queues, and `Esc` interrupts.
+- **Interactive CLI session picker.** A bare `rubino sessions` on a TTY opens an
+  interactive picker (id, title, message count, dir, age; arrow-key highlight,
+  type-to-filter, `Esc` cancels) and `Enter` resumes the chosen session. On a
+  pipe / non-TTY it prints a script-safe list; `sessions list` stays list-only.
+  The picker is cwd-scoped by default; `--all` unscopes it.
+- **`/sessions rename <id|title> <new title>`.** Rename a session from the REPL
+  (#45).
+- **Aux-LLM session titles.** When `auxiliary.title` names a concrete backend,
+  new sessions get an LLM-generated, length-capped summary title; the
+  deterministic derivation stays the default and the fallback (#45).
+- **Streaming GFM table rendering (#89).** A markdown table now renders as a
+  live, correctly-fitted table as it streams — a sliding window of recent rows
+  grows in place — instead of leaking raw `| col | col |` pipes that only snap
+  into a table once the message completes.
+
+### Changed
+
+- **Provider auto-routing.** With `model.provider: "auto"` (the default), the
+  concrete provider is derived from the model id (`openai/*` → OpenAI); the
+  setup wizard / auto-detect write an explicit provider when a non-OpenAI
+  backend is chosen.
+- **Credential check uses provider-specific env vars.** The credential check
+  and key resolution now read the env var for the configured provider
+  (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GEMINI_API_KEY`, `BEDROCK_API_KEY`,
+  `MINIMAX_API_KEY`, and `<PROVIDER>_API_KEY` for anything else, e.g.
+  `DEEPSEEK_API_KEY`). A non-OpenAI provider no longer silently falls back to
+  `OPENAI_API_KEY` (only providers explicitly marked `openai_compatible` /
+  `anthropic_compatible` fall back to `OPENAI_API_KEY` / `ANTHROPIC_API_KEY`).
+- **`security.confirm_policy` default is `dangerous_only`.** Safe shell commands
+  run unprompted; only commands matching a dangerous pattern prompt. Set
+  `confirm_policy: confirm_all` to restore prompt-on-everything. The
+  non-bypassable hardline floor and `permissions: deny` always run first
+  regardless of policy.
+- **Removed the built-in `run_tests` and `github` tools.** Running tests and
+  GitHub/git operations now go through the generic `shell` tool (with its
+  hardened git arg parsing), matching the field norm and shrinking the tool
+  surface.
+- **Blocked-tool results are now typed errors.** When a tool call is blocked
+  (denied by approval, sandbox, or policy), its result is returned to the model
+  as a typed error with explicit anti-confabulation wording, so the model is told
+  the action did NOT happen instead of being free to assume success (#583).
+- **Single status bar during a turn.** The animated facet activity row is folded
+  into the model/ctx footer (one bar, not two); the "esc to interrupt" hint shows
+  exactly once, and a mid-stream **waiting indicator** resurfaces beneath the
+  in-flight tail after a short window of model/transport silence and drops away
+  the instant tokens resume (#21, #56b — `/status` now also shows the workspace
+  cwd line).
+- **FIFO approval queue for concurrent subagents.** When multiple subagents need
+  approval at once, one modal shows at a time with an "(N more queued)"
+  indicator that dequeues on resolve, and async-completion notices no longer
+  print over an active modal. Subagent approvals also **escalate to the parent's
+  approval card at any nesting depth**, so a nested child no longer fail-closes
+  with a noninteractive block (#86).
+- **Slash commands dispatch while attached to a subagent** (`/stop <id>`,
+  `/agents`, `/status`, …) instead of being steered into the child as text;
+  `/skills list` / `/skills ls` show the skills list rather than trying to
+  activate a skill named `list`; `/think off` hides the reasoning aside for
+  always-thinking models unless an explicit `/reasoning` is set; `/config <key>`
+  resolves the short labels `/status` advertises (`reasoning`, `effort`,
+  `think`) (#62, #66, #87).
+- **`/new` returns instantly.** The end-of-session memory flush is enqueued as a
+  background job instead of running a synchronous aux-LLM extract, so starting a
+  new session no longer freezes the prompt for 2–3s.
+- **Headless one-shot drains only its own jobs.** `rubino -q` now emits and
+  flushes the JSON result envelope before draining, and scopes the post-turn job
+  drain to the run's own session, so a one-shot returns immediately even with a
+  background job backlog.
+- **Subagent cards are distinguishable + carry the task id.** Concurrent
+  subagent cards label by a dimension drawn from the task prompt (rather than the
+  bare agent type), background "done" markers carry the task id, and the live
+  elapsed counter shows seconds (`1m05s`) so it visibly advances (#44, #570).
+- **Pastes coalesce into a single placeholder**, input history is recalled and
+  persisted, `Enter` accepts the highlighted dropdown candidate, and
+  `task_result` running-polls no longer flood the transcript (#524, #525).
+- **System-prompt grounding for control + tools.** The cap / continuation /
+  summary control is framed as trusted `[harness control]` so MiniMax-M3 stops
+  treating it as prompt-injection (#75); the background-shell lifecycle is primed
+  so the model uses `shell_output` / `shell_kill` correctly; the verification
+  step is scoped to never modify the environment and to stop honestly.
+- **Memory-flush best-effort boundary** made airtight (#471), so a failure
+  flushing memory at shutdown can't take down the run.
+
+### Removed
+
+- **Child→parent `ask_parent` / `answer_child` tools.** Subagents are
+  non-blocking background workers and can no longer pause mid-task to ask their
+  parent (or the human) a question; instead they make sensible default calls and
+  surface open decisions in their result. The two model-facing tools that
+  implemented that channel — `ask_parent` (the child→parent escalation) and
+  `answer_child` (the parent's reply) — are gone. The parent→child `steer` /
+  `probe` tools and the human approval gate (`/reply` for a child parked on an
+  approval) are unchanged. `tasks.ask_parent_timeout` is now vestigial.
+- **`streaming.cursor` config key.** It was dead config (assigned, never read)
+  and is no longer accepted — remove it from any `config.yml`.
+- **`security.require_confirmation_for_shell` config key.** Replaced by
+  `security.confirm_policy` (`dangerous_only` | `confirm_all`); the old key is no
+  longer honored.
+
+### Security
+
+- **Hermes-style secret handling (#506).** Adopts the Hermes secret model across
+  the agent: the structured `read` tool blocks `.env` and credential files
+  outright, and secret **values** are redacted in the output of `read`, `grep`,
+  `shell` (including the live stream seam, not just the final buffer, #507),
+  `summarize`, and `read_attachment` (#511/#512). A `security.redact_secrets`
+  toggle (default **on**) controls redaction. The earlier per-read secret-file
+  approval gate was removed in favour of this block-list + redaction model
+  (#480). Over-broad redaction was then narrowed: the `ENV_ASSIGN` pattern is
+  anchored so `AUTHORS` / `SECRETARY` pass through while `API_KEY` / `AUTH_TOKEN`
+  still redact, the Telegram-token pattern is pinned to its canonical shape, and
+  fully-masked secrets carry an explicit marker rather than a bare `***`
+  (#67, #516).
+- **Secrets are no longer persisted to memory (#99).** A `Security::SecretDetector`
+  is wired into the memory write path (it refuses an explicit save and the
+  auto-extract persist path) and into the redactor, catching prefixed key
+  shapes, prefix-less AWS secret keys, and a high-entropy heuristic — previously
+  an `sk-proj-…` key could be saved verbatim and re-injected into every future
+  system prompt.
+- **Removed the dedicated `git` tool (RCE bypass).** Git now runs through the
+  hardened `shell` with strict arg parsing that rejects exec vectors
+  (`--ext-diff`, `-c`, textconv, …) plus a `GIT_HARDENED_ENV`, instead of a tool
+  that could be steered into arbitrary command execution (#536/#553).
+- **Dangerous write/exec flag-forms prompt under the default gate (#61).**
+  `git -c` / `--output`, `sed -i`, `sort -o`, `find -delete` / `-exec`,
+  `tar --to-command`, `tee`, interpreter `-c` / `-e` / `--eval`, etc. no longer
+  auto-run under `dangerous_only`, while bare interpreters and read-only forms
+  still auto-run. A shared `Security::CommandNormalizer` also closes
+  line-continuation evasion (e.g. `rm -r\<newline>f` no longer slips past the
+  danger/approval layer).
+- **Extended HOME credential read-block.** Reading credential stores under HOME
+  is blocked and a base64-decode-pipe-to-shell (`echo … | base64 -d | sh`) is
+  flagged dangerous (#519); the denylist now covers `.ssh`, `.aws`, `.netrc`,
+  `.git-credentials`, `.kube`, `.docker`, `.gnupg`, `.azure`, and `.config/gh`
+  (#537). A write through a **dangling in-workspace symlink** can no longer
+  escape the sandbox — the link target is resolved before the create-new-file
+  fallback (#62).
+- **Tighten the `ruby_llm` floor to `>= 1.16` (#508).** The adapter wires native
+  providers through ruby_llm's generic `<provider>_api_base=` setters
+  (deepseek/mistral/etc., #482), which only exist from ruby_llm 1.16.0. The
+  gemspec previously allowed `~> 1.0`, so a fresh `gem install` could resolve
+  ruby_llm 1.15 and crash at runtime with `NoMethodError`. The dependency is now
+  `>= 1.16, < 2.0`.
+- **Secret masking on `config set`.** `rubino config set` now masks the echoed
+  value when the key looks secret (`api_key`, `token`, `password`, `secret`,
+  `authorization`, …) and when the value itself contains inline credentials
+  (`key=value`, `Bearer …`, URL userinfo, `curl -u`, `mysql -p…`), so keys are
+  not printed in the clear to the terminal/scrollback.
+- **Sanitized untrusted text rendered to the terminal (CWE-150).** Text that
+  originates from the model, tools, or filenames (subagent cards, `/`-palette and
+  `@`-picker menu labels, and the remaining CLI aside sinks — probe, reasoning,
+  open-fence, branch title) is now defanged of ANSI/OSC escape sequences before
+  it is written, closing an escape-injection class (#563/#564/#565–#568).
+- **Vision egress hardening.** The `vision` tool now honours
+  `attachments.policy.aux_vision_egress` (default `true`): set it to `false` and
+  the tool refuses to send an image to an external auxiliary model, returning a
+  clean error instead of egressing the bytes (#578). Before any egress it also
+  **content-sniffs** the file (magic bytes win over the extension, fail-closed),
+  so a mislabelled or non-image file can't be smuggled to the external host
+  (#579).
+- **OS sandbox covers more executors.** The OS write-jail (Landlock / Seatbelt)
+  now also confines background shells, `ruby`, and `run_tests`, with relaxation
+  gated on verified enforcement; a write-jail `EACCES` outside the workspace
+  produces an attributable "blocked by write-jail" hint (#74).
+
+### Fixed
+
+- **MiniMax-M3 pre-tool-call "freeze".** Thinking/reasoning now defaults ON for
+  every provider (it was deliberately off for MiniMax-family ids). On the
+  anthropic-compatible path rubino now sends `thinking: {type: enabled,
+  budget_tokens: …}` and streams the model's reasoning deltas — so the multi-
+  second window where M3 reasons toward a tool-call is filled with visible
+  streamed reasoning instead of dead air (the symptom that read as the agent
+  "freezing" when it spawned subagents). Matches the reference agent's default
+  `reasoning_effort: medium`. A backend that rejects the budget is caught and
+  retried once without it (#75), so default-on is safe; set
+  `providers.<name>.supports_thinking: false` to opt out.
+- **MCP `degraded` server state.** `/mcp` and `rubino doctor` now distinguish a
+  reachable server (`●`) from a **degraded** one (`⚠` — the process is alive but
+  a protocol call such as `tools/list` failed), instead of reporting it as plain
+  reachable (#575).
+- **Session-title length cap.** A renamed session title is now length-capped at
+  rename and truncated on render, so an over-long title can't disrupt status /
+  session-list layout (#581).
+- **Streaming fidelity.** A streaming turn no longer re-executes or re-surfaces
+  tool calls it already ran (no double "started" line or duplicate final tool)
+  (#53), and a split think/fence sentinel is held across the message-boundary
+  flush so reasoning no longer leaks into the body and prose isn't torn apart
+  (#43/#54). A committed markdown table glued to trailing prose no longer leaks
+  raw pipes, and a too-wide table fits the pane instead of tearing the border.
+- **Subagent / multiplexer UI.** A running `blocked_on_parent` sub stays visible
+  in the footer while listed; cap-rejected delegation renders a neutral
+  "at capacity" row instead of a phantom failed card; the close-row / replay use
+  the per-call subagent name instead of a shared stale one (#35); the agent
+  picker opens reliably on `↓` and `←`/`↑` backs out; picking `◂ main` returns to
+  main immediately mid-turn; a nested child's menu no longer crashes it; and the
+  parent autonomously resumes at idle when background subagents finish while
+  detached (#37, #44, #51, #561).
+- **Interrupt handling.** `Esc` at the tool-dispatch boundary raises a clean
+  interrupt instead of a malformed continuation that the backend rejects as
+  "invalid params"; a stray `Ctrl-C` exits cleanly (130) with no raw `net/http`
+  backtrace; and a background thread never dumps a backtrace on death.
+- **Input papercuts.** Backspace (`DEL 0x7f`) deletes instead of inserting a
+  space (#522); a single `Ctrl-D` at an idle empty composer no longer hangs, and
+  fast input bursts coalesce their redraws (#520). Several composer
+  render/input races and resize-while-typing reflows that duplicated the
+  in-progress input into the scrollback are fixed, including chained resizes and
+  the resize REPAINT path (#481/#485/#486/#499/#500/#501/#503).
+- **`edit` no longer crashes on non-UTF-8 / binary buffers.** Fuzzy-match
+  normalization passes invalid-encoding bytes through verbatim (#47), atomic
+  writes are binmode'd so binary buffers never transcode (the intermittent
+  in-session edit crash on accented files) (#65), and `clean_slice` reinterprets
+  binary as UTF-8 rather than calling `.encode` (#58). A failed edit / read /
+  write now shows `✗` instead of a green `✓`.
+- **Background jobs and shells.** The job queue drains reliably — stale `running`
+  rows are reclaimed after the lease expires (#76) and `ExtractMemoryJob` is
+  prioritized over `SummarizeSessionJob` so save→recall doesn't lag (#79);
+  finished background shells are retired with their buffer and exit status
+  retained, so `shell_output` / `shell_tail` / `shell_kill` stay reachable next
+  turn (#78); shell cancel no longer orphans the child process group, and a
+  finished background shell auto-wakes the model.
+- **Turn-ledger honesty.** Blocked / errored tools no longer count toward the
+  "N tools ran / M edits" ledger, so a turn whose only tool was refused stops
+  telling you to review nonexistent changes; the force-summary and closing-summary
+  nudges are grounded in the truthful turn ledger so the model can't confabulate
+  having done nothing (#36/#84). MiniMax HTTP 429 / quota errors are categorized
+  as retryable rate-limit (honouring `Retry-After`) instead of "Invalid request",
+  and the anti-confabulation note no longer over-fires on accurate local caveats.
+- **Sessions / resume / doctor.** A per-session `flock` guard stops a concurrent
+  `--continue` from forking a moving transcript (#543), replay renders only the
+  new tail of a restated final message (#542), `--resume <id>` is validated
+  before the boot banner (#521), and `doctor` warns instead of false-green when
+  no usable credential exists and no longer implies an unverified key is
+  validated (#541/#546).
+- **Non-native provider wiring (#482).** Fixed the preflight that falsely
+  reported non-native providers (deepseek/mistral/…) as ready; they are now
+  wired through the generic `<provider>_api_base=` setters and the run stops
+  on an unreachable endpoint instead of failing later. Transient name-resolution
+  failures (`EAI_AGAIN`) are retried rather than fatal, and a stream that ends
+  without a finish signal is recovered instead of failing the turn.
+- **Parent-death reaps child shells (#478).** When the agent process dies, the
+  long-running child shells it spawned are reaped instead of being orphaned,
+  using a trap-safe SIGTERM/SIGHUP handler (no `Mutex` inside the signal trap).
+- **Compaction no-op loop (#484).** Stopped a busy-loop on an over-budget
+  session that has too few messages to compact. The `doom_loop.threshold`
+  default is also no longer rejected by its own validator (#60).
+- **Memory polish indicator no longer flashes every turn (#59).** The polish
+  worker starts only when a row was actually enqueued, the indicator composes
+  alongside the ctx bar instead of replacing it, and a verbatim repeat
+  short-circuits to the existing row at the write seam.
+- **`/exit` and exit codes.** `/exit` routes through the quit-guard, and an
+  interactive session exits non-zero on an auth/credential error (#154).
+- **CLI DX papercuts.** Fixed the bare-`rubino "prompt"` one-shot path, help-
+  session clutter, a bare-prompt did-you-mean edge case, and a `read_attachment`
+  hint that suggested markitdown for raster images instead of OCR.
+- **Input hardening.** Fixed a raw SQLite3 exception on session input with
+  hostile/NUL bytes (#498) and cleaned up `Errno` error messages on the failure
+  paths; tightened mcp args validation and assorted low-severity
+  config/sessions/resume/CLI papercuts.
+
+## [0.5.0] - 2026-06-15
+
+### Added
+
+- **One-shot tool-activity trace.** The non-interactive text path (`rubino
+  prompt` / `-q` / piped `chat`) now prints a concise per-tool activity trace
+  by default — one line per tool completion (`· edit foo.rb`, `· bash npm
+  test`) — routed to STDERR so the final answer on STDOUT stays clean
+  (`x=$(rubino prompt …)` captures only the answer). `--quiet`/`-Q` silences
+  the trace (machine-silent path); `--verbose`/`-v` widens each line's args.
+  `--output-format json`/`stream-json` (structured events on stdout) and the
+  interactive TUI tool-cards are unchanged. Mirrors the Codex/gemini-cli/Hermes
+  stderr-trace norm (Hermes `-q` default / `-Q` quiet).
+
+- **Prompt-cache breakpoints (`cache_control`).** The conversation now inserts
+  cache breakpoints so the stable prefix (system + tool schemas + prior turns)
+  is reused across round-trips, cutting input-token cost/latency.
+- **Situational tool-schema gating.** Tool definitions sent to the model are
+  scoped to the situation instead of always shipping the full set, reducing
+  prompt size and accidental tool selection.
+- **Primary-agent switching.** Switch the active primary agent inline with
+  `/<name>`, the `/agent` command, or `Tab`; `@` remains reserved for file
+  references.
+- **Detached post-turn polishing.** A post-turn polishing pass runs detached and
+  is cancellable with `Esc`, so it never blocks the next prompt.
+- **Stdin pipe for one-shot.** Piped stdin is consumed as the prompt for
+  one-shot runs (`echo … | rubino prompt`), enabling unix-style composition.
+- **Per-round-trip loop accounting.** Round-trips are counted, usage is summed
+  across them, and `tool_calls` are persisted on the streaming path.
+- **Machine-readable headless output (`--output-format json | stream-json`, #312).**
+  `rubino prompt` / `chat -q` can now emit Claude-Code-aligned JSON for
+  CI/automation instead of prose. `--output-format json` (or the `--json` alias)
+  prints a single `{type:"result", subtype, is_error, result, session_id,
+  exit_reason, num_turns, duration_ms, usage:{input/output/cache_* tokens},
+  total_cost_usd, model}` object on stdout at completion; `--output-format
+  stream-json` emits JSONL (a `system`/`init` line, then Messages-API-shaped
+  `assistant`/`user` step objects, then the same final `result`). In both modes
+  ALL JSON goes to stdout and ALL logs/diagnostics/errors to stderr, and markdown
+  rendering is suppressed. The fail-closed / exit-code contract is preserved: a
+  blocked tool still emits the result with `is_error:true` and a non-zero exit.
+  The schema lives in a single shared serializer (`Rubino::Output::ResultSerializer`)
+  so it never drifts. `text` (default) is unchanged.
+- **Higher tool-loop budget with an interactive extension prompt (#399).** The
+  `max_tool_iterations` default is raised from 8 to 25 so longer agent runs no
+  longer hit the cap mid-task. When the cap is reached interactively, the run
+  pauses with a budget-extension prompt — **Continue +N** (grant another batch),
+  **Summarize** (wrap up with what's done), or **Abort** — instead of failing
+  silently; headless runs keep the force-summarize behavior.
+- **TUI: Ctrl-L clear-screen and a resize-while-typing fix (#395 / #401).**
+  `Ctrl-L` now clears the screen from the composer. Fixed a bug where resizing
+  the terminal while typing reflowed and duplicated the in-progress input into
+  the scrollback.
+
+### Security
+
+- **Hardened/narrowed the command-allowlist convenience layer (SEC-R2-1/2/3).**
+  Closes three default-config / bare-`git` paths that could run arbitrary code
+  or write arbitrary files past the headless gate **without `--yolo`**:
+  - removed code-loading test/build runners (`bundle exec rspec`, …) from the
+    **shipped default** `command_allowlist` — they load and execute arbitrary
+    project code by design (`rspec -r FILE`), so they are not safely
+    auto-approvable (SEC-R2-3);
+  - an allowlisted **git** head is now vetted for GLOBAL flags before the
+    subcommand (`git -c alias.x='!cmd' x`, `-c core.sshCommand=…`, `-C dir`,
+    `--exec-path`) and for code-loading/mutating subcommands (`apply`, `am`,
+    `push`, hooks, …); the "approve git always" path now persists only a
+    narrowed `git <read-only verb>`, never bare `git` (SEC-R2-1);
+  - any allowlisted head whose argument is itself a program
+    (`awk`/`sed`/`perl`/`python`/`ruby`/`node`/`tar`/`tee`/`xargs`/shells) is
+    default-denied auto-approval, and write flags on read heads (`sort -o`, …)
+    are rejected (SEC-R2-2).
+
+  An allowlist is a convenience layer, **not** a security boundary (per industry
+  practice the OS sandbox is the real floor, tracked separately); this narrows
+  it to close the above default-config and bare-`git` RCEs.
+
+### Hardening
+
+Four adversarial QA rounds fixed ~45 issues across the agent. Highlights:
+
+- **Security.** Hardline-floor canonicalization; OOXML zip-bomb total-archive
+  cap; CWE-150 argument sanitization; threat-scanner; tightened
+  command-allowlist (see above).
+- **Correctness.** UTF-8-safe edits; atomic compaction with auto-switch-to-child;
+  resume keeps the full tool history; cwd-scoped sessions; corrupt-DB recovery
+  (incl. `NotADatabaseException`); job-queue compare-and-swap; headless job drain
+  so memory works in automation.
+- **Interrupt.** True cancel — stream cancellation with the partial persisted;
+  clean one-shot `SIGINT`/`SIGTERM` labels.
+- **Performance.** Bounded huge-output memory; spill/paste eviction; streaming
+  grep with consistent ignore rules.
+- **UX.** Config validation; `doctor` checks; resilient timeouts and error
+  classification.
+
+Every fix was container-verified (non-root QA image, real MiniMax for live
+behavior, true 0 failures); a full pre-release functionality sweep confirmed all
+subsystems release-ready.
+
+## [0.4.1] - 2026-06-13
+
+### Security
+
+- **Headless approvals now fail closed (#260).** A one-shot / scripted run
+  (`rubino prompt`, `chat -q`, no TTY) no longer auto-runs a tool that would
+  otherwise prompt: a write/edit, or a shell command not covered by your
+  `permissions` / command allowlist / read-only auto-allow, is **blocked, not
+  run**. A `blocked: <tool> needs approval …` line goes to stderr and the run
+  exits **2**, so CI/automation fails loudly instead of silently skipping (or
+  auto-executing). Full auto-exec now requires an explicit **`--yolo`** —
+  honored ONLY as a CLI flag, never grantable by a project-local/persisted
+  config — and **`--no-yolo`** forces fail-closed even over a yolo boot default.
+
+### Fixed — installer
+
+- **`mise` method (#256)** alongside Homebrew and `rv`, with `global`/`local`
+  scope (`RUBINO_INSTALL_SCOPE`); `RUBINO_INSTALL_METHOD` now accepts `mise`.
+- **Activation/PATH is persisted to your shell rc (#268)** (`.zshrc` /
+  `.bashrc` / `.profile`) and a **post-install fresh-shell gate** fails loudly
+  if `rubino` isn't on PATH in a new shell. `RUBINO_NO_MODIFY_RC=1` opts out.
+- **`mise` installs pin the latest published gem version (#258/#268)** instead
+  of drifting to a pre-release / age-gated build.
+- **Method-aware prereq preflight (#272)** (xz/git/toolchain) with real gem
+  error surfacing, and a **Debian-12 / glibc-too-old steer from rv → mise
+  (#241/#242/#272)** so users don't land on a broken musl Ruby.
+
+### Fixed
+
+- **Config corruption + `doctor` crash on a scalar written over a section (#259).**
+- **Streaming persistence (#266):** pre-tool narration is persisted and the
+  `tool_calls` audit is populated.
+- **TUI render (#269):** table columns sized to content, nested/markdown fences
+  consumed, interrupt "ghost" line cleared.
+- **Memory extraction bounded by a per-session cursor (#249)** — no more
+  re-scanning the whole transcript every turn.
+- **Boots under a bare C/POSIX locale (#273)** without
+  `Encoding::CompatibilityError`.
+- **Session summary folded into the single system message (#253/#254).**
 
 ## [0.4.0] - 2026-06-13
 

data/CONTRIBUTING.md

@@ -21,11 +21,20 @@ Run the CLI from the checkout with `bundle exec rubino <command>`.
 ## Tests
 
 ```bash
-bundle exec rspec                 # full suite
+bundle exec rspec                 # full suite (sequential; generates the coverage report)
 bundle exec rspec path/to/file_spec.rb
 bundle exec rake                  # default task == spec
+bundle exec rake parallel:spec    # full suite across all CPU cores (no coverage report)
+bundle exec rake parallel:spec[4] # ...forced to 4 workers
 ```
 
+`parallel:spec` shards the suite across one process per core via the
+`parallel_tests` gem; each worker is isolated by `TEST_ENV_NUMBER`
+(per-worker `RUBINO_HOME`, document fixtures, and example-status file).
+SimpleCov is skipped under parallel runs (the workers would race the
+coverage resultset) — use the sequential `bundle exec rspec` when you need
+the coverage report.
+
 The HTTP boundary is locked by an end-to-end contract suite under `spec/rubino/api/contract/`. When the docs and the contract suite disagree, **the contract suite is canonical** — update the docs to match.
 
 ## Lint