rubino-agent 0.5.0 → 0.5.1

data/docs/commands.md

@@ -85,6 +85,7 @@ Pasting **text** into the chat input goes through the file-backed paste pipeline
 - `--new` forces a fresh session; `--continue`/`-c` resumes the latest; `--resume`/`-r <id|title>` resumes a specific one.
 - `--resume` matches an ID prefix first, then a case-insensitive substring of the session title **or its full first prompt** — so a memorable phrase from the tail of a long first message works even though the stored title is truncated. More than one match is an error listing the candidates; no match exits non-zero with a pointer to `rubino sessions list`.
 - One-shot mode (`-q` / `prompt`) does **not** auto-resume — automation isn't silently hijacked onto a past session; pass `--resume`/`--continue` explicitly if you want it.
+- A bare **`rubino sessions`** on a real terminal opens an arrow-key resume picker over this directory's sessions (`--all` for every dir); ↑↓ select, Enter loads the chosen session into the chat REPL (the same as `rubino chat --session <id>`), Esc cancels. Off a TTY (piped/redirected) it prints the static `list` table so scripts stay deterministic; `rubino sessions list` is always the table.
 - One-shot output: when stdout is a **terminal** the answer renders through the same markdown pipeline as interactive chat (styled text, fitted tables, wrapping); when stdout is **piped/redirected** the answer stays plain raw text and diagnostics go to stderr, so `$(rubino prompt …)` stays clean.
 - Sessions are marked ended on clean exit, terminal close (SIGHUP), or kill (SIGTERM), so a closed window doesn't leave a session looking active.
 
@@ -134,6 +135,7 @@ rubino memory show ID
 rubino memory delete ID
 rubino memory backend [NAME] # show the active memory backend, or switch to NAME
 
+rubino sessions             # on a TTY: arrow-key resume picker (Enter loads, Esc cancels); piped: lists
 rubino sessions list
 rubino sessions show ID
 rubino sessions compact ID
@@ -175,9 +177,9 @@ Type these inside `rubino chat`. Generated from `BuiltIns::DESCRIPTIONS` (drift-
 | `/export` | Write the session transcript as markdown (/export [path]) |
 | `/memory` | Inspect/search/forget what the agent remembers (show ID, backend, --all) |
 | `/agent` | Switch the primary agent (/agent <name>; a bare /<name> or Tab cycles) |
-| `/agents` | List background subagents; steer/probe a running one, or view output |
+| `/agents` | List background subagents; ↓+Enter to attach & steer one live, or steer/probe/view by id |
 | `/tasks` | Alias for /agents |
-| `/reply` | Answer a subagent that is blocked waiting on you (ask_parent) |
+| `/reply` | Answer a subagent that is blocked waiting on you (e.g. an approval) |
 | `/stop` | Stop a running subagent (/stop <id>; alias for /agents <id> --stop) |
 | `/jobs` | List the background job queue (status counts); /jobs <id> for detail |
 | `/skills` | List skills; activate one ('none' clears), or enable/disable NAME |
@@ -202,9 +204,10 @@ Type these inside `rubino chat`. Generated from `BuiltIns::DESCRIPTIONS` (drift-
 
 You can keep typing while a turn is running — the pinned input stays live:
 
-- **Enter** interrupts the current turn and runs your line as the **next** turn (the partial answer is kept and marked `⎿ interrupted`).
-- **Alt+Enter** queues the line **without** interrupting: it runs after the current turn finishes, with a live `⏳ queued:` indicator above the input until it does. At idle (no turn running) there is nothing to queue behind, so Alt+Enter submits the line immediately, same as Enter.
-- **`/queued <message>`** is the terminal-independent fallback for Alt+Enter (some terminals don't deliver the chord) — it queues the message the same way.
+- **Enter** queues the line **without** interrupting (the queue-by-default / type-ahead model, #421): the current turn keeps running, the line waits behind any earlier-queued items (FIFO) with a live `⏳ queued:` indicator above the input, and it is committed as a normal message when its turn runs. At idle (no turn running) Enter submits immediately.
+- **Esc** interrupts the current turn (the partial answer is kept and marked `⎿ interrupted`); any queued lines then run as the next turns.
+- **`/queued <message>`** queues a message explicitly — the terminal-independent way to enqueue without typing it into the live input.
+- **Read-only meta-commands run immediately, mid-turn.** A small set of non-mutating slash commands — `/agents` (and `/tasks`), `/stop`, `/status`, `/jobs`, `/help`, `/commands`, `/dirs` — execute **right away** while a turn is running, so you can drill into a sub-agent, stop the run, or check status without interrupting. State-mutating commands (`/model`, `/clear`, `/new`, `/config`, `/mode`, `/reasoning`, `/think`, …) are not available mid-turn: they show a transient `⚠ <cmd> is not available during an active turn — press Esc to interrupt first` notice instead of running.
 
 ### Keys: `Esc Esc` — rewind to an earlier message
 
@@ -324,12 +327,21 @@ The agent spawns background subagents with its `task` tool; these commands are t
 /agents <id> --stop           # cancel a running subagent (blocked descendants unwind too)
 /agents <id> steer "note"     # park a note folded into the child's context at its next turn
 /agents <id> probe "question" # ephemeral read-only peek — nothing is saved to the child
-/reply <id> <answer>          # answer a subagent blocked on an ask_parent question
+/reply <id> <answer>          # answer a subagent blocked on you (e.g. an approval)
 /reply                        # bare: list the subagents currently blocked on you
 ```
 
 `/tasks` is an alias for `/agents`.
 
+**Attach to a subagent (agent-view).** Instead of typing ids, press `↓` at the
+idle prompt to open the subagent picker, arrow to one, and `Enter` to **attach**:
+the screen switches to that agent's own full timeline (its tool calls and what it
+said, replayed) and the prompt becomes scoped — `sa_xxxx ❯`. While attached, just
+type to steer the running child (or answer it if it's blocked on you); `←` on the
+empty prompt (or `/detach`) returns to the main timeline. The scoped prompt makes
+the global `/agents <id> steer/probe` and `/reply <id>` forms redundant — they're
+the same operations, by id, from anywhere.
+
 ### Workspace roots: `/add-dir` and `/dirs`
 
 The workspace sandbox confines write/edit/delete tools to the workspace roots. `/add-dir <path>` adds an extra allowed root mid-session (and runs the one-time folder-trust gate, so the new root's `AGENTS.md`/skills are only honored once vouched for); `/dirs` lists the current roots and their trust state. Typing `/add-dir ` opens a directory-path dropdown (relative, absolute, and `~` paths complete as you type).

data/docs/configuration.md

@@ -65,10 +65,27 @@ providers:
     assume_model_exists: true
     base_url: null
     request_timeout_seconds: 600
+    extra_body: {}                 # free-form body merged into /v1/chat/completions
 ```
 
 Per-provider you may also set `api_key`, and for custom gateways `anthropic_compatible: true` (MiniMax) or `openai_compatible: true`. See [models-and-keys.md](models-and-keys.md).
 
+#### `extra_body` — OpenAI-compatible request passthrough
+
+`providers.<name>.extra_body` is a free-form hash deep-merged verbatim into the OpenAI-style `/v1/chat/completions` request body. It is honored **only on the OpenAI-compatible request path** (`openai_compatible: true`, or the native `openai` provider) and is never applied on the anthropic-family path, nor does it touch the thinking-budget logic. Adapter-routed keys (`max_tokens`, `thinking`) win on conflict. Left unset (the default `{}`) the request is byte-identical to before.
+
+Use it to pass provider-specific knobs the adapter does not model natively. The canonical case is suppressing chain-of-thought leakage on oMLX / Qwen-style backends that emit `<think>` text instead of native `tool_calls` unless the request carries `chat_template_kwargs: { enable_thinking: false }`:
+
+```yaml
+providers:
+  gateway:
+    openai_compatible: true
+    base_url: "http://localhost:8000/v1"
+    extra_body:
+      chat_template_kwargs:
+        enable_thinking: false
+```
+
 Per-provider `supports_thinking: true | false` declares whether the backend handles an Anthropic-style thinking budget correctly; `false` means no budget is ever sent to it, regardless of `thinking.effort`. Unset, MiniMax-family model ids default to `false`, everything else to `true` — see [reasoning & thinking](#reasoning--thinking).
 
 ### auxiliary
@@ -97,6 +114,14 @@ auxiliary:
     timeout: 300
 ```
 
+Each block routes through `LLM::AuxiliaryClient`, so `provider`/`model`/`base_url`
+are all honored: `provider: "main"` (or empty) reuses the primary provider, an empty
+`model` falls back to `model.default`, and a `base_url` points that task at a
+different endpoint. `auxiliary.compression` is the **context-compaction summary**
+model — at the defaults it is the primary model (e.g. MiniMax-M3), unchanged; set
+`provider`/`model`/`base_url` to run compaction summaries on a different
+(OpenAI-compatible) endpoint.
+
 ### agent
 
 ```yaml
@@ -154,7 +179,7 @@ ui:
 
 ### notifications
 
-Attention signals for the moments the agent needs human eyes: a long turn finishing, an approval prompt parking the run on a decision, or a background subagent escalating an `ask_parent` to you (the ⛔ banner).
+Attention signals for the moments the agent needs human eyes: a long turn finishing, or an approval prompt parking the run on a decision (the main agent's card or a background subagent flipping to `needs_approval`).
 
 ```yaml
 notifications:
@@ -164,7 +189,7 @@ notifications:
   min_turn_seconds: 10   # a turn must run at least this long before its completion notifies; quick turns stay silent
 ```
 
-- **Events**: `turn_finished` (only when the turn ran ≥ `min_turn_seconds`), `needs_approval` (the main agent's approval card or a background child flipping to `needs approval`), `blocked` (a background child escalated `ask_parent` to the human).
+- **Events**: `turn_finished` (only when the turn ran ≥ `min_turn_seconds`), `needs_approval` (the main agent's approval card or a background child flipping to `needs approval`). A third event, `blocked`, exists in the enum for a child parked on the human; with subagents now non-blocking it is not raised in normal operation.
 - **Bell hygiene**: the BEL byte is only ever written to a real terminal — never into a pipe — and is routed to the real terminal IO even while the bottom composer owns the screen (BEL doesn't move the cursor).
 - **`command` hook**: runs detached and best-effort (stdio nulled, errors swallowed to the log) with `RUBINO_EVENT` (`turn_finished` | `needs_approval` | `blocked`) and `RUBINO_MESSAGE` in its environment — the seam for `osascript` (macOS), `notify-send` (Linux), or any custom notifier.
 - **Spam control**: events within ~1s of the last emitted one coalesce into a single signal.
@@ -212,7 +237,6 @@ streaming:
   transport: "off"
   edit_interval: 0.3
   buffer_threshold: 40
-  cursor: " ▉"
 
 context:
   engine: "compressor"
@@ -244,7 +268,7 @@ compression:
 ```yaml
 memory:
   enabled: true
-  backend: "sqlite"          # tiny-Zep FTS5/BM25 + graph-lite recall (default). "default" = legacy non-ranked store
+  backend: "sqlite"          # SQLite FTS5/BM25 + graph-lite recall (default). "default" = legacy non-ranked store
   auto_extract: true
   auto_save: true
   user_profile_enabled: true
@@ -279,7 +303,7 @@ tasks:
   max_children_per_node: 3       # max LIVE direct children per node
   max_concurrent_total: 8        # hard ceiling on total LIVE subagents across the tree
   max_live_probes_per_child: 5   # per-child budget for billed live probes (probe(live: true))
-  ask_parent_timeout: 900        # seconds a blocking ask_parent waits before the child self-heals
+  ask_parent_timeout: 900        # vestigial: governed the removed child→parent ask channel; no effect now
 ```
 
 ### tools
@@ -291,7 +315,7 @@ tools:
   shell: true             # ON by default (the agent ships to run inside an isolated VM);
                           # dangerous commands are still gated by security.confirm_policy
   ruby: true
-  web: false              # Gates BOTH the webfetch and websearch tools
+  web: true               # ON by default (keyless DuckDuckGo backend); gates BOTH the webfetch and websearch tools
   memory: true
 ```
 
@@ -315,6 +339,107 @@ file_read:
   max_chars: 100000
 ```
 
+### tool_output_compression
+
+Deterministic (no-LLM) compression of a tool's output **before it reaches the
+model**, to spend fewer context tokens on high-volume, low-signal output. This is
+distinct from [`compression`](#compression) (which summarises the *conversation
+history* when the window fills) and from `display.tool_output_preview_lines`
+(scrollback-only). It runs at a single seam — every tool's output passes through
+`Agent::ToolExecutor` — so a content **router** picks the strategy by what the
+output *is*, not by which tool produced it:
+
+| Output detected as | Strategy | Effect |
+| --- | --- | --- |
+| test / build / lint / shell logs (rspec, pytest, jest, cargo, npm, make, generic) | `LogCompressor` | keep every error/failure + the summary tally + context, drop passing/info noise (≈97% fewer tokens on a failing suite) |
+| a **whole-file** source read (Ruby) | code `skeleton` | keep signatures, elide large method bodies behind a `read offset:/limit:` pointer |
+| a unified diff (`git diff`, `diff`) | `DiffCompressor` | keep every `+`/`-` line and every file/hunk header; trim far unchanged context to ±N lines; collapse a generated/lock file to a one-line summary. A small/tight diff (the "show me the diff" case) passes through **byte-identical** via the saving guard. The human view is the tool's separate scrollback diff (`body`), which is **never** compressed |
+| a **whole-output** JSON dump (`curl \| jq`, `kubectl get -o json`, `gh api`, `docker inspect`, `aws --output json`, MCP/custom-tool JSON) | `JsonCompressor` | an array of **uniform** objects folds **losslessly** to a schema header + one compact row per item (repeated key names emitted once); a large array whose fold is too thin falls back to lossy row selection where **error-bearing rows and statistical outliers always survive** and dropped rows collapse to an `{"_elided": N}` sentinel; a single large object elides only **big string values** (never drops a key). Detected **before** the log channel, so a JSON shell dump folds as a table and is never log-compressed. Small JSON passes through **byte-identical** via the saving guard |
+| grep / search results (`path:line:`) | passthrough | **byte-identical** |
+| short output | passthrough | unchanged |
+
+```yaml
+tool_output_compression:
+  enabled: false              # MASTER switch — off ships by default; the whole
+                              # router is bypassed when false. `rubino setup`
+                              # offers to turn this (and logs.enabled) on.
+  code:                       # whole-file source reads → skeleton
+    strategy: skeleton        # only "skeleton" is implemented; any other value = passthrough
+    min_lines: 150            # files shorter than this are never skeletonised
+    keep_method_body_max_lines: 8  # bodies up to N lines are kept inline; larger ones are elided
+    languages: [ruby]         # source languages to skeletonise (see note below); `rubino setup` lets you pick
+  logs:
+    enabled: false            # sub-gate: log compression only runs when BOTH this and the master are on
+    min_lines: 40             # outputs shorter than this pass through unchanged
+    max_total_lines: 100      # cap on kept lines
+    max_errors: 10            # keep up to N errors/failures (first and last always kept)
+    max_warnings: 5
+    max_stack_traces: 3
+    context_lines: 4          # lines of surrounding context kept around each failure
+  diff:                       # unified diffs (git diff / diff) — model copy only
+    context_lines: 3          # unchanged context kept on each side of a change; far context → `… N unchanged lines`
+    min_lines: 40             # diffs shorter than this pass through unchanged ("show me the diff")
+    min_saving: 0.25          # only apply when ≥25% smaller; else byte-identical passthrough
+    generated_patterns:       # changed files matching these collapse to a one-line summary
+      - "*.lock"
+      - Gemfile.lock
+      - package-lock.json
+      - yarn.lock
+      - pnpm-lock.yaml
+      - composer.lock
+      - "*.min.js"
+      - "*.min.css"
+      - dist/
+      - build/
+      - "*.snap"
+      - vendor/
+  json:                       # whole-output JSON dumps (kubectl/gh/docker/aws/jq)
+    min_items: 8              # arrays with fewer items (and < min_lines) pass through unchanged
+    min_lines: 40             # objects / text shorter than this pass through unchanged
+    min_saving: 0.25          # only apply when ≥25% smaller; else byte-identical passthrough
+    outlier_sigma: 3.0        # a numeric field > N σ from its column mean = a kept outlier row (lossy)
+    max_string_chars: 400     # in a single object, string values longer than this collapse to `<elided N chars>` (key kept)
+```
+
+> **`code.languages`** (default `["ruby"]`) selects which source languages get
+> whole-file skeletonisation; a read whose language isn't listed passes through
+> verbatim, so removing a language disables compression for it. Values: `ruby`
+> (built-in Prism parser, always available), `python` (stdlib `ast` via your
+> `python3` — a no-op if `python3` isn't on PATH), and `javascript` /
+> `typescript` / `tsx` (need the optional `tree_sitter_language_pack` gem — a
+> no-op until it's installed). `rubino setup` offers a language picker and, if you
+> choose JS/TS, asks before installing the parser gem.
+
+> `diff` and `json` have **no** own `enabled` sub-gate (like `code`): they are
+> active whenever the master flag is on, and the saving guard (`min_lines`/
+> `min_items` + `min_saving`) is the real gate — small/tight diffs and small JSON
+> the user wants to see stay verbatim automatically.
+
+**Reversibility.** When the router compresses, the executor spills the *full
+original* to `<home>/tool-results/<call_id>.txt` and the compressed output ends
+with a passive pointer carrying the call's **id** (`… N line(s) hidden …
+retrieve_output id=<id> only if a hidden line is specifically needed`). The model
+recovers the original by calling the **`retrieve_output`** tool with that id —
+registered **only** while compression is enabled (so the default registry/tool
+count is unchanged). The pointer deliberately prints **no cat-able filesystem
+path**: recovery is an id behind a dedicated tool (headroom-style), so a small
+model can't `sed`/`grep`/`cat` a printed spill path and re-inflate the output the
+compressor just shrank. If the spill failed the pointer says *full output
+unavailable (spill failed)* with no id. **Fidelity:** a failure or summary line
+is never dropped; only passing/info noise is.
+
+**Per-call opt-out.** When the feature is on, `read` and `shell` advertise a
+`compress` boolean parameter (default `true`); the model can pass `compress:false`
+to receive the verbatim output for that one call (returned byte-identical).
+
+**Telemetry.** Compression events are logged as `compression.applied` /
+`compression.drill_in` / `compression.failed`. `compression.drill_in` is emitted
+on every `retrieve_output` call (a deliberate recovery, carrying the `id`) and on
+a `read`'s targeted offset-read into an elided `:code` skeleton body — so the
+counter measures real recoveries and is **not** bypassable by a shell `sed`/
+`grep`/`cat` (there is no path to cat). A strategy error always falls back to the
+uncompressed text, so compression can never break a tool call.
+
 ### terminal
 
 ```yaml
@@ -366,10 +491,18 @@ attachments:
     inline_text_budget_bytes: 100000
     allow_kinds: [image, text, document, archive, binary]
     auto_extract_documents: false
-    aux_vision_egress: true
+    aux_vision_egress: true          # allow the `vision` tool to send an image to an EXTERNAL aux model (data egress; see below)
     archive: { max_entries: 2000, max_uncompressed_bytes: 268435456, max_entry_ratio: 100, max_total_ratio: 50, max_nesting_depth: 1 }
 ```
 
+`aux_vision_egress` (default `true`) gates the **`vision` tool**: routing an
+image to an external auxiliary vision model is data egress, so set it to `false`
+to refuse — the tool then returns a clean error instead of sending the bytes
+(#578). Independently, before any egress the tool **content-sniffs** the file
+(magic bytes win over the extension, fail-closed): a path that isn't actually an
+image is rejected, so a mislabelled or non-image file can't be smuggled to the
+external host (#579).
+
 ### security
 
 ```yaml
@@ -537,8 +670,22 @@ api:
   rate_limit_enabled: true
   rate_limit_unauth_per_minute: 60
   rate_limit_auth_per_minute: 600
+  allow_public_bind: false       # gate for a non-loopback bind (see below)
 ```
 
+`allow_public_bind` is **false by default (safe)**. The API can execute shell
+tools, so binding it to a non-loopback address (`--host 0.0.0.0`,
+`RUBINO_API_HOST` set to anything other than `127.0.0.1` / `::1` / `localhost`)
+publishes a remote-code-execution surface to the network — and with TLS off the
+bearer token and all traffic travel in cleartext. While this is `false`, the
+server **refuses to boot** on a non-loopback host with an actionable error.
+Loopback binds (the default) are unaffected and need no opt-in.
+
+To deliberately expose the listener, set `allow_public_bind: true`. The server
+then boots on the routable host but prints a one-time exposure **WARNING** at
+startup. When you opt in, enable TLS (`RUBINO_TLS=1`) and a strong
+`RUBINO_API_KEY`, and prefer a reverse proxy over a direct bind.
+
 ---
 
 ## Environment Variables

data/docs/mcp.md

@@ -44,10 +44,10 @@ mcp:
 
 ## How It Works
 
-1. At chat boot (and in `rubino tools`), `MCP::Manager` connects to all configured servers — best-effort: a server that fails to start prints a warning and is skipped, it never blocks the session
+1. At chat boot (and in `rubino tools`), `MCP::Manager` connects to all configured servers **in parallel** (#576), so one hanging server no longer serializes startup — best-effort: a server that fails to start prints a warning and is skipped, it never blocks the session
 2. Each server's tools are wrapped in `MCPToolWrapper` (adapts to `Tools::Base` interface), forwarding the server-declared input schema so the model calls them with the right argument names
 3. Wrapped tools are registered in `Tools::Registry` with a prefix (`servername_toolname`)
-4. The agent can use MCP tools like any built-in tool; a failed MCP call (including a server-side argument rejection) surfaces as an `Error: …` tool result and renders ✗ like any failed built-in tool
+4. The agent can use MCP tools like any built-in tool; a failed MCP call (including a server-side argument rejection) surfaces as an `Error: …` tool result and renders ✗ like any failed built-in tool. To keep external code visible, an MCP tool's **display label** is suffixed with its source — the live tool card and the approval card both show `<bare> (mcp:<server>)` (e.g. `echo (mcp:chaos)`), so you can tell at a glance that an out-of-process server is running (#582). The model-facing tool name is unchanged.
 5. `ruby_llm-mcp`'s own log lines (including everything a stdio server prints on its stderr) go to `<home>/logs/mcp.log`, never to stdout — one-shot `rubino prompt` output stays machine-readable
 
 MCP tools are dynamic — they come from whatever servers you configure — so they are not part of the drift-checked built-in tool list in [tools.md](tools.md) and have no `tools.<key>` config gate; disable a server (`/mcp <server> off` for the session, or set `mcp.enabled: false`) to remove its tools.
@@ -95,7 +95,7 @@ An `oauth` hash on a `streamable` server is forwarded verbatim to `ruby_llm-mcp`
 /mcp reload          # re-read config.yml and reconnect every server (no chat restart needed)
 ```
 
-`off`/`on` are session-scoped — config is untouched. `/mcp reload` is how a server added to `config.yml` mid-session becomes usable. When servers are configured, `/status` includes an `mcp` line (`2 servers · 1 reachable · 14 tools`).
+`/mcp`'s server list glyphs each server by health: green `●` **reachable**, yellow `⚠` **degraded** (#575 — the process is alive but a protocol call such as `tools/list` failed, so it's up but not fully serving), and a stopped/failed server shows its last start error in the drill-in. `off`/`on` are session-scoped — config is untouched. `/mcp reload` is how a server added to `config.yml` mid-session becomes usable. When servers are configured, `/status` includes an `mcp` line (`2 servers · 1 reachable · 14 tools`).
 
 ## Manual Management
 

data/docs/memory.md

@@ -1,6 +1,6 @@
 # Memory
 
-rubino remembers facts about you and the project across sessions. The default backend is a small SQLite "tiny-Zep" store — Zep/Graphiti-inspired, minus the graph database, the server, and the multi-call pipeline.
+rubino remembers facts about you and the project across sessions. The default backend is a small SQLite fact store — an LLM-extracted, bi-temporal fact store with hybrid recall, minus the graph database, the server, and the multi-call pipeline.
 
 ## Backends
 
@@ -8,7 +8,7 @@ Memory backends are pluggable (registered like tools). Two ship:
 
 | `memory.backend` | What it is |
 |---|---|
-| `sqlite` (**default**) | tiny-Zep: LLM-extracted atomic facts, bi-temporal supersession, hybrid FTS5/BM25 (+ optional vector) ranked recall, graph-lite 1-hop blend |
+| `sqlite` (**default**) | LLM-extracted atomic facts, bi-temporal supersession, hybrid FTS5/BM25 (+ optional vector) ranked recall, graph-lite 1-hop blend |
 | `default` | the legacy non-ranked store (kept for back-compat) |
 
 Switch backends:
@@ -20,7 +20,7 @@ rubino memory backend sqlite   # switch (writes memory.backend to config.yml)
 
 The agent loop, the in-chat `/memory` view, the `/status` panel, the `rubino memory` CLI, and the HTTP `/v1/memory` operations all use the **active** backend (fixed in #94/#106/#83 — these surfaces previously read a hardwired legacy table and never saw the facts the agent actually persists).
 
-## The sqlite tiny-Zep backend
+## The sqlite memory backend
 
 ### What's stored
 

data/docs/security.md

@@ -145,7 +145,7 @@ The fake LLM provider can short-circuit tool decisions, so `chat` and `server` r
 
 ## TLS for the HTTP API
 
-The API binds `127.0.0.1` by default; only expose it (`--host 0.0.0.0` / `RUBINO_API_HOST`) behind TLS or a trusted segment. For a remote HTTP client, set `RUBINO_TLS=1` (or leave a cert in place) and the API serves over a self-signed cert that the client **pins** (no DNS / Let's Encrypt needed). On first boot it generates `cert.pem` + `key.pem` under `$RUBINO_HOME/tls` (CN/SAN = host/IP, ~10y) and reuses them. Hand the public cert to a pinning client with:
+The API binds `127.0.0.1` by default; only expose it (`--host 0.0.0.0` / `RUBINO_API_HOST`) behind TLS or a trusted segment. Because the API can execute shell tools, a non-loopback bind is **config-gated and refused by default** (#577): the server will not boot on a routable host unless `api.allow_public_bind: true` is set in `config.yml`, and when it is, it prints a one-time exposure warning at startup. Loopback binds (`127.0.0.1` / `::1` / `localhost`) are unaffected. For a remote HTTP client, set `RUBINO_TLS=1` (or leave a cert in place) and the API serves over a self-signed cert that the client **pins** (no DNS / Let's Encrypt needed). On first boot it generates `cert.pem` + `key.pem` under `$RUBINO_HOME/tls` (CN/SAN = host/IP, ~10y) and reuses them. Hand the public cert to a pinning client with:
 
 ```bash
 rubino tls-cert   # prints $RUBINO_HOME/tls/cert.pem (generating it if absent)

data/docs/tools.md

@@ -1,10 +1,10 @@
 # Tools Reference
 
-rubino ships **34 built-in tools** plus dynamic MCP tools (started at boot when `mcp.servers` is configured — see [mcp.md](mcp.md); being server-dependent they are excluded from the drift-checked list below) and custom user-defined tools. Each tool is gated by a `tools.<key>` config flag (opt-out: absent key = enabled, only an explicit `false` disables) and the approval model. The count and list below are drift-checked against the live registry by `spec/docs/tools_doc_drift_spec.rb`.
+rubino ships **29 built-in tools** plus dynamic MCP tools (started at boot when `mcp.servers` is configured — see [mcp.md](mcp.md); being server-dependent they are excluded from the drift-checked list below) and custom user-defined tools. Each tool is gated by a `tools.<key>` config flag (opt-out: absent key = enabled, only an explicit `false` disables) and the approval model. The count and list below are drift-checked against the live registry by `spec/docs/tools_doc_drift_spec.rb`.
 
-The full list (registration order): `read`, `summarize_file`, `write`, `edit`, `multi_edit`, `grep`, `glob`, `git`, `github`, `shell`, `shell_output`, `shell_tail`, `shell_input`, `shell_kill`, `ruby`, `run_tests`, `apply_patch`, `webfetch`, `websearch`, `question`, `todowrite`, `memory`, `session_search`, `attach_file`, `read_attachment`, `vision`, `skill`, `task`, `task_result`, `task_stop`, `ask_parent`, `steer`, `probe`, `answer_child`.
+The full list (registration order): `read`, `summarize_file`, `write`, `edit`, `multi_edit`, `grep`, `glob`, `shell`, `shell_output`, `shell_tail`, `shell_input`, `shell_kill`, `ruby`, `apply_patch`, `webfetch`, `websearch`, `question`, `todowrite`, `memory`, `session_search`, `attach_file`, `read_attachment`, `vision`, `skill`, `task`, `task_result`, `task_stop`, `steer`, `probe`.
 
-Several tools share one config gate, so `rubino tools` shows **27 rows** (config groups), not 34: `webfetch` + `websearch` share `tools.web`, and the whole delegation family (`task`, `task_result`, `task_stop`, `ask_parent`, `steer`, `probe`, `answer_child`) rides on `tools.task` — disabling delegation disables them all.
+Several tools share one config gate, so `rubino tools` shows **24 rows** (config groups), not 29: `webfetch` + `websearch` share `tools.web`, and the whole delegation family (`task`, `task_result`, `task_stop`, `steer`, `probe`) rides on `tools.task` — disabling delegation disables them all.
 
 ## How tools are gated
 
@@ -13,6 +13,27 @@ Several tools share one config gate, so `rubino tools` shows **27 rows** (config
 - **Approval** — see [security.md](security.md). Shell commands are confirmation-gated by default; a non-bypassable hardline floor blocks catastrophic commands regardless of mode.
 - **Workspace sandbox** — with `tools.workspace_strict: true` (default), write/edit/delete tools are confined to the workspace root (`terminal.cwd` or `Dir.pwd`).
 
+## Output compression
+
+When `tool_output_compression.enabled` is on (off by default; `rubino setup`
+offers it), every tool's output passes through a deterministic content router
+before it reaches the model: test/build/lint **logs** are reduced to their
+failures + summary, a **whole-file source read** can come back as a skeleton, and
+**diffs / grep results / JSON / short output pass through byte-identical**. The
+full original is always recoverable: the compressed view ends with a passive
+pointer carrying an `id` (`retrieve_output id=…`), and the model recovers the
+verbatim original by calling the `retrieve_output` tool with that id — there is
+**no cat-able filesystem path** in the pointer, so a small model can't `sed`/
+`grep`/`cat` a spill path and re-inflate the very output compression just shrank.
+While enabled, `read` and `shell` advertise an extra `compress` boolean parameter
+(default `true`) so the model can pass `compress:false` to get one call's output
+verbatim, and the registry adds the `retrieve_output` recovery tool (present
+**only** while compression is enabled — it is absent from the default registry,
+so the count below is unchanged). See
+[configuration.md](configuration.md#tool_output_compression) for the full key
+reference. Compression is OFF in the default registry, so the parameter lists
+below describe the shipped (uncompressed) behaviour.
+
 ## Built-in Tools
 
 ### read
@@ -78,25 +99,6 @@ Risk: low
 Parameters: pattern, path, max_results
 ```
 
-### git
-
-Git operations: status, diff, log, branch, show.
-
-```
-Risk: low (read-only operations)
-Parameters: command, args
-```
-
-### github
-
-GitHub integration: PRs, issues, reviews. Uses gh CLI or REST API.
-
-```
-Risk: medium
-Parameters: action, title, body, number, repo, base, labels
-Actions: pr_create, pr_list, pr_view, pr_checks, pr_diff, issue_create, issue_list, issue_view, repo_view, release_list
-```
-
 ### shell
 
 Execute a shell command. Foreground blocks until exit or `timeout`; pass `run_in_background: true` to fire-and-forget and get a `run_id`.
@@ -155,15 +157,6 @@ Risk: medium
 Parameters: code
 ```
 
-### run_tests
-
-Run the workspace project's test suite and return a **structured** result instead of the raw toolchain firehose. Auto-detects RSpec / Minitest / a Rakefile default task, prefers `bundle exec` when a Gemfile is present (falls back to the bare runner if the bundle is broken), and returns pass/fail counts plus the failing examples (name + file:line + short message) and a short raw tail. Distinguishes "the suite couldn't start" (toolchain error) from "the suite ran and N failed". Use this instead of driving `shell` by hand to run tests. (issue #101)
-
-```
-Risk: low
-Parameters: path (optional file/pattern), framework (optional: rspec|minitest|rake)
-```
-
 ### apply_patch
 
 Apply unified diff patches to files.
@@ -182,6 +175,27 @@ Risk: low
 Parameters: url, format (text|html)
 ```
 
+`format: "text"` (default) runs a readability-style **main-content extraction**
+(nokogiri): page chrome — `script`, `style`, `noscript`, `nav`, `header`,
+`footer`, `aside`, `form`, `svg`, `iframe`, `button`, plus ARIA landmark roles
+(`navigation`, `banner`, `contentinfo`, `search`, `complementary`) — is dropped,
+the main container is preferred (`<main>` → `[role=main]` → `<article>` →
+`<body>`), and the kept subtree is serialized to markdown-ish text (`## `
+headings, `- ` list items, blank-line-separated paragraphs, entities decoded).
+This strips nav menus/footers/cookie banners and typically cuts tokens
+substantially on article and docs pages.
+
+Two guarantees so capability is never lost:
+
+- **Safety fallback** — if the extracted text is under ~30% of the full page
+  text (or below a small char floor), the tool returns the full-page strip
+  instead, so a page whose content isn't in a clean `<main>`/`<article>` is never
+  over-trimmed. Malformed HTML that nokogiri can't parse also falls back (a fetch
+  never crashes). When extraction trims a lot, a one-line note points back at the
+  raw escape hatch.
+- **Raw escape hatch** — `format: "html"` returns the full raw HTML **verbatim**,
+  completely unprocessed, for when the model wants the original page.
+
 ### websearch
 
 Search the web. Supports Tavily (best), SearXNG, or DuckDuckGo fallback.
@@ -302,15 +316,6 @@ Risk: medium
 Parameters: task_id
 ```
 
-### ask_parent
-
-Child→parent escalation: a subagent asks its parent a question it cannot resolve from its sealed prompt. `blocking: true` pauses the child until the answer arrives; `blocking: false` (default) lets it keep working and folds the answer in later as a note. The parent (agent or human) answers via `answer_child` / `/reply`. Only available to subagents — a top-level agent has no parent to ask. Gated by `tools.task`.
-
-```
-Risk: low
-Parameters: question, blocking
-```
-
 ### steer
 
 Parent→child steering note: park a short note on one of YOUR OWN running subagents; it is folded into the child's context at its next turn boundary and persists (it changes the child's trajectory). Ownership-scoped at call time — only your direct children. The model counterpart of the human `/agents <id> steer "…"`. Gated by `tools.task`.
@@ -329,15 +334,6 @@ Risk: low
 Parameters: task_id, question, live
 ```
 
-### answer_child
-
-Parent→child answer to an `ask_parent` question: delivers the answer into the asking child's context (unblocks a blocking ask; folds in for a non-blocking one). Ownership-scoped — only a direct child that is actually waiting. The model counterpart of the human `/reply <id> <answer>`. Gated by `tools.task`.
-
-```
-Risk: low
-Parameters: task_id, answer
-```
-
 ---
 
 ## MCP Tools

data/ext/landlock/extconf.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+# Build step for the standalone `rubino-landlock` helper.
+#
+# This is NOT a Ruby C extension in the usual sense — the gem has no native
+# Ruby bindings. We (ab)use the extension mechanism purely so RubyGems compiles
+# a tiny standalone executable at install time: a Landlock-applying exec-wrapper
+# the Linux sandbox path (Security::Sandbox) launches in front of `bash`.
+#
+# CRITICAL: this must DEGRADE GRACEFULLY. The gem must install on macOS, on
+# Windows, and on a Linux kernel/toolchain without Landlock headers. So we never
+# fail the build: on any non-Linux host, a missing compiler, or missing Landlock
+# headers we write a no-op Makefile and exit 0. The sandbox then reports the
+# Linux mechanism as unavailable and fails OPEN with a loud banner (by design).
+require "mkmf"
+
+# A Makefile that satisfies `make` / `make install` with no work, so
+# `gem install` always succeeds even when we can't build the helper.
+def write_noop_makefile(reason)
+  warn "rubino-landlock: skipping native helper build (#{reason}); " \
+       "the Linux OS write-sandbox will be unavailable (fail-open)."
+  File.write("Makefile", <<~MAKE)
+    all:
+    \t@true
+    install:
+    \t@true
+    clean:
+    \t@true
+  MAKE
+end
+
+# Only Linux has Landlock. Everywhere else the helper is irrelevant.
+unless RUBY_PLATFORM.include?("linux")
+  write_noop_makefile("not Linux")
+  exit 0
+end
+
+# The helper needs the Landlock UAPI header to know the struct/flag layout.
+# (The syscall itself is invoked by number, so no libc wrapper is required.)
+unless have_header("linux/landlock.h")
+  write_noop_makefile("linux/landlock.h not found")
+  exit 0
+end
+
+# The compiled helper lands in the gem's exe/ dir as `rubino-landlock`, on PATH
+# of the installed gem. extconf builds into the extension dir; we install it to
+# the gem's bin via a custom rule appended after create_makefile.
+target = "rubino-landlock"
+
+# create_makefile expects a Ruby-loadable .so; we instead emit our own Makefile
+# that compiles a freestanding executable. Bypass the .so machinery entirely.
+cc = RbConfig::CONFIG["CC"] || "cc"
+srcdir = __dir__
+
+File.write("Makefile", <<~MAKE)
+  CC = #{cc}
+  TARGET = #{target}
+  SRC = #{File.join(srcdir, "landlock.c")}
+
+  all: $(TARGET)
+
+  $(TARGET): $(SRC)
+  \t$(CC) -O2 -Wall -o $(TARGET) $(SRC)
+
+  # `gem install` runs `make` then `make install`; RubyGems copies any built
+  # artifact reported in the extension dir. We additionally drop the binary into
+  # the gem's exe/ so Security::Sandbox can resolve it next to the `rubino` exe.
+  install: all
+  \t@true
+
+  clean:
+  \t-rm -f $(TARGET)
+MAKE
+
+# If the compile would fail (no working cc), we still don't want to break the
+# install — but mkmf already verified a compiler via have_header above. Leave
+# the real compile to `make`; a failure there is rare and caught by Sandbox's
+# runtime probe (binary absent ⇒ fail-open).