rubino-agent 0.5.1 → 0.5.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c1debe685b923c625e0dc4dcf95da3c9fc12fcd6c73bdff71e35164279e62b06
-  data.tar.gz: 5451e122fc13bfdd4ffeba0e680cad9fb6b976dfabe8f9dcfd894e5215ac9688
+  metadata.gz: 45e009503b875320e560be8ce46459d7c2a70b0c5744043b70f2121c5e747ab2
+  data.tar.gz: c26d1f586ae8578ed3d7298d1f7f8765d16ed5328b6d063d77e0df41d32a710a
 SHA512:
-  metadata.gz: bf657914d128053ffa39d7911a5c2c12e491ff45b1907e8bc78a694b8f8d7540a1e8d1182ee5831670af17e5e64b16148202d987ebc9e2c75604a88f78148d36
-  data.tar.gz: eefe6fbbcd977bff1cf8b7a189fdaf73daee9ca6b12ca55b82876a99c55ede529dc78ba3f5146f8b34a7e6e6b6b38dab454c9d6cdcf3baca8e754187f49c6829
+  metadata.gz: dc1cfd93fb51e6236daf8e839a8df248fdcd299aef3028c258fefc93c585bf15e322b5d41ebf4d1b504795a9d24d6e8668f5dece2089b9454f6432dabcace482
+  data.tar.gz: 5495d4862d7b082826205ca4ecb30701df4a103ce801233df6a3dc91c59ce423ea4cb6cab4e41b9b0327f72e911ad310bf9433aaf6d218d8803bb0ffd56bec65

data/CHANGELOG.md

@@ -1,5 +1,76 @@
 # Changelog
 
+## [0.5.2.1] - 2026-06-26
+
+### Fixed
+
+- **Symlinked workspace roots broke three path checks.** Several modules compared
+  a symlink-resolved path against a NON-resolved root, so a workspace reached
+  through a symlink (macOS `/etc` → `/private/etc`, `/var` → `/private/var`, or
+  any symlinked checkout) defeated the match:
+  - **SecretPath** — `secret?("/etc/sudoers")` returned `false` and the
+    `~/.ssh`/`~/.aws`/… credential read-gate classified nothing, silently
+    no-op'ing the write-approval gate and read-block for those paths.
+  - **IgnoreRules** — `git rev-parse --show-toplevel` returns the realpath, so
+    the allowed-set rebase dropped *every* file and the whole tree read as
+    git-ignored; `grep`/`glob` then returned nothing under a symlinked checkout.
+  - **Skills::Registry** — an untrusted repo's project-local `.rubino/skills` was
+    not recognised as project-local, so the trust gate failed to drop it (hostile
+    project skills could load in an untrusted directory).
+
+  All three now resolve both sides of the comparison through `realpath` /
+  `canonical_path`. Defense-in-depth — not security boundaries.
+- **`grep` Ruby fallback now matches dotfiles.** Without ripgrep on PATH, the
+  fallback globbed `**/<include>` without `FNM_DOTMATCH`, so an include like
+  `*.env` never matched `.env`/`.envrc` — exactly the secret-bearing files. The
+  include glob now matches dotfiles, mirroring `rg --glob`.
+
+## [0.5.2] - 2026-06-26
+
+### Added
+
+- **Live formatted-markdown streaming.** The in-flight model stream now renders
+  as formatted markdown while it arrives (Stage 1), painted as atomic frames via
+  DEC-2026 synchronized output so a fast stream never tears mid-update (Stage 2),
+  with committed code blocks syntax-highlighted through Rouge (Stage 3). (#592,
+  #593, #594)
+- **Leaked tool-call recovery.** Models that emit a tool call as plain text or
+  garbled XML/JSON markup instead of a structured call (MiniMax-M3 and other
+  tool-loop models) now have those calls re-parsed into real `tool_calls` at the
+  transport layer so they actually execute, including a garbled `<invoke">`
+  variant.
+- **`write` content preview.** The `write` tool box now shows a preview of the
+  content being written.
+
+### Changed
+
+- Raise the default `max_tool_iterations` from 25 to 90 (Hermes-aligned), so long
+  tool-driven turns no longer hit the ceiling mid-task.
+- Teach the agent (via the build prompt) to read the compressed tool-output
+  markers introduced in 0.5.1.
+
+### Fixed
+
+- Render any unterminated code fence as a code box, matching CommonMark's
+  end-of-file fence auto-close, instead of leaking the raw backticks. (#595)
+- Merge consecutive same-role messages on the Anthropic-family wire so the
+  request shape stays valid. (#597)
+- Give MiniMax its full output ceiling so a long thinking block no longer starves
+  the visible output (a root cause of heavy-turn "invalid params" death).
+- Keep a 5xx-wrapped "invalid params" response on the retryable path.
+- Multi-line `ask()` prompts no longer erase terminal scrollback.
+- Exclude synthetic `[harness control]` injections from the rewind picker.
+- Fix an installed-gem launch crash (`uninitialized constant Rubino::TAGLINE`).
+
+### Removed
+
+- Drop the dead `server.*` config section, the orphaned `ask_parent` takeover and
+  ask/reply substrate, and dead code surfaced by the post-removal audit.
+
+### Docs
+
+- Mark native OAuth as not wired end-to-end (WIP).
+
 ## [0.5.1] - 2026-06-25
 
 ### Added

data/docs/agents.md

@@ -4,7 +4,7 @@ rubino has two distinct multi-agent surfaces, and **both ship today**:
 
 1. **Background subagents** (✅ shipping) — the agent delegates bounded sub-tasks
    to isolated subagent runs via its `task` tool, and you supervise them with
-   `/agents` and `/reply`.
+   `/agents`.
 2. **Primary-agent switching** (✅ shipping) — pick the primary agent that
    handles your turns: `/agent <name>` (or a bare `/<name>` for a primary)
    pins it for the session, **Tab** cycles through the primaries, and a one-shot
@@ -68,9 +68,7 @@ message instead of fanning out unbounded work:
 | Glyph | Status | Meaning | You act via |
 |---|---|---|---|
 | `●` | `running` | Working (last activity shown) | — |
-| `●` | `needs_approval` | A child tool needs your approval (or a budget request) | `/agents <id>` or `/reply <id>` |
-| `⛔` | `blocked_on_human` | Vocabulary glyph for a child parked on the human (not raised in normal operation now that subagents are non-blocking) | `/reply <id> <answer>` |
-| `◷` | `blocked_on_parent` | Vocabulary glyph for a child parked on its agent-parent (likewise not raised now that subagents are non-blocking) | (optional) `/reply <id>` |
+| `●` | `needs_approval` | A child tool needs your approval (or a budget request) | `/agents <id>` |
 | `◌` | `stopping` | Stop requested; unwinding at its next checkpoint | — |
 | `✓` | `done` | Finished; result available | `/agents <id>` |
 | `✗` | `failed` | Errored; error available | `/agents <id>` |
@@ -79,25 +77,20 @@ message instead of fanning out unbounded work:
 Subagents are **non-blocking** background workers: they never pause to ask you a
 mid-task question. The one way a child waits on you is an **approval** — its next
 tool needs your go-ahead, so it parks as `needs_approval` and a marker persists
-until you resolve it (via `/agents <id>` or `/reply <id>`). The `⛔
-blocked_on_human` / `◷ blocked_on_parent` glyphs remain in the status vocabulary
-the `/agents` surface can render, but with the child→parent ask channel removed
-they are no longer raised in normal operation.
+until you resolve it (via `/agents <id>`).
 
-### Supervising from the CLI: `/agents` and `/reply`
+### Supervising from the CLI: `/agents`
 
 ```
 /agents                       # list background subagents (status, tools run, activity)
 /agents <id>                  # drill in: live watch while running, result/error when done
-/agents <id> --stop           # cancel a running subagent (blocked descendants unwind too)
+/agents <id> --stop           # cancel a running subagent
 /agents <id> steer "note"     # park a note folded into the child's context at its next turn
 /agents <id> probe "question" # ephemeral read-only peek — nothing is saved to the child
-/reply <id> <answer>          # answer a child blocked on you (e.g. an approval)
-/reply                        # bare: list the subagents currently blocked on you
 ```
 
-`/tasks` is an alias for `/agents`. Stopping a node cancels its descendants'
-approval gates too, so anything parked anywhere in the subtree unwinds at once.
+`/tasks` is an alias for `/agents`. Stopping a node cancels its approval gate so
+a parked child unwinds at once.
 
 #### Attach to a subagent (agent-view)
 
@@ -109,12 +102,11 @@ subagent picker, arrow to one, and `Enter`:
   what it said, replayed from its session (not the bounded activity snapshot the
   picker used to show);
 - the prompt becomes **scoped** to it: `sa_xxxx ❯`;
-- while attached, just **type** to steer the running child (or answer it if it's
-  blocked on you) — no id needed; `←` on the empty prompt (or `/detach`) returns
-  to the main timeline.
+- while attached, just **type** to steer the running child — no id needed; `←` on
+  the empty prompt (or `/detach`) returns to the main timeline.
 
-So attaching makes `/agents <id> steer/probe` and `/reply <id>` redundant for the
-focused child — they're the same operations, just addressed by id. Attach is a
+So attaching makes `/agents <id> steer/probe` redundant for the focused child —
+they're the same operations, just addressed by id. Attach is a
 between-turns action (it owns the screen): while a parent turn is still streaming
 the picker's `Enter` toasts "attach when the turn ends" — attach once it's idle.
 

data/docs/api/v1.md

@@ -350,6 +350,8 @@ Cooperative cancel of a running task (descendant ask-gates are cancelled too). R
 
 ## OAuth
 
+> **WIP — not wired end-to-end.** These endpoints work and store encrypted tokens, but **no tool consumes a connection's token yet** and there is no CLI surface. See the status banner in [`docs/oauth-providers.md`](../oauth-providers.md) (and issue #590: native vs MCP-delegated).
+
 See [`docs/oauth-providers.md`](../oauth-providers.md) for the full PKCE flow, encryption key requirements, and per-provider setup. The HTTP surface:
 
 ### `GET /v1/oauth/providers` → 200

data/docs/commands.md

@@ -179,7 +179,6 @@ Type these inside `rubino chat`. Generated from `BuiltIns::DESCRIPTIONS` (drift-
 | `/agent` | Switch the primary agent (/agent <name>; a bare /<name> or Tab cycles) |
 | `/agents` | List background subagents; ↓+Enter to attach & steer one live, or steer/probe/view by id |
 | `/tasks` | Alias for /agents |
-| `/reply` | Answer a subagent that is blocked waiting on you (e.g. an approval) |
 | `/stop` | Stop a running subagent (/stop <id>; alias for /agents <id> --stop) |
 | `/jobs` | List the background job queue (status counts); /jobs <id> for detail |
 | `/skills` | List skills; activate one ('none' clears), or enable/disable NAME |
@@ -317,7 +316,7 @@ Read (and set) configuration without leaving the REPL, over the same **effective
 
 Gets resolve default-valued keys (not just what's in the file), and secret-named keys (`api_key`, tokens, …) render masked — exactly like `rubino config show`. A set writes through `Config::Writer` (the same persist path `/reasoning` and `/think` use) **and** updates the live configuration, so it survives the session and applies from the next turn; consumers that memoize their config (e.g. the memory backend) still need a restart. Typing `/config ` opens a dropdown with the verbs plus the known config keys flattened from the defaults tree; after `get`/`set` the keys complete again.
 
-### Background subagents: `/agents` and `/reply`
+### Background subagents: `/agents`
 
 The agent spawns background subagents with its `task` tool; these commands are the human surface over them (full model in [agents.md](agents.md)):
 
@@ -327,8 +326,6 @@ The agent spawns background subagents with its `task` tool; these commands are t
 /agents <id> --stop           # cancel a running subagent (blocked descendants unwind too)
 /agents <id> steer "note"     # park a note folded into the child's context at its next turn
 /agents <id> probe "question" # ephemeral read-only peek — nothing is saved to the child
-/reply <id> <answer>          # answer a subagent blocked on you (e.g. an approval)
-/reply                        # bare: list the subagents currently blocked on you
 ```
 
 `/tasks` is an alias for `/agents`.
@@ -337,9 +334,9 @@ The agent spawns background subagents with its `task` tool; these commands are t
 idle prompt to open the subagent picker, arrow to one, and `Enter` to **attach**:
 the screen switches to that agent's own full timeline (its tool calls and what it
 said, replayed) and the prompt becomes scoped — `sa_xxxx ❯`. While attached, just
-type to steer the running child (or answer it if it's blocked on you); `←` on the
+type to steer the running child; `←` on the
 empty prompt (or `/detach`) returns to the main timeline. The scoped prompt makes
-the global `/agents <id> steer/probe` and `/reply <id>` forms redundant — they're
+the global `/agents <id> steer/probe` forms redundant — they're
 the same operations, by id, from anywhere.
 
 ### Workspace roots: `/add-dir` and `/dirs`

data/docs/configuration.md

@@ -227,6 +227,9 @@ display:
   statusbar: true        # the model + context bar under the chat input
   tool_output_preview_lines: 3  # head lines of tool output shown in the transcript (0 = full dump)
   input_max_rows: 8      # chat input grows up to this many rows, then scrolls
+  live_markdown: true    # format the in-flight streamed block live (false = raw live tail)
+  synchronized_output: true  # atomic frames via DEC-2026 BSU/ESU (false = legacy per-write frames)
+  code_highlight: true       # syntax-highlight committed code blocks (Rouge); false = plain
 
 paste:
   collapse_lines: 5            # pastes longer than this collapse to a placeholder
@@ -246,6 +249,10 @@ context:
 - `display.statusbar` (default `true`) pins a dim one-line bar UNDER the chat input — the session mode first (plus the branch/skill tokens when set), then the resolved model id and context saturation, e.g. `default · MiniMax-M3 · ctx ~8.4k/64k (13%)` (the percentage is omitted below 1%). The mode token is the live mode indicator (the prompt itself is a constant `▍❯ `): dim `default`, yellow `plan`, red `yolo`. Saturation uses the REAL usage the provider reported for the last response when available (the full assembled prompt, recorded by the agent loop), else the same chars/4 estimate compaction runs on (`Context::TokenBudget`); the window comes from `model.context_length` / `context.max_tokens`. It refreshes at turn boundaries (after each turn footer, and on session resume), never per stream delta. The percentage turns yellow at 70% and red at 90%; with no usable window only the token count shows. The bar is omitted off a TTY or on terminals narrower than 40 columns.
 - `display.tool_output_preview_lines` (default `3`) caps how many head lines of each tool's output the transcript shows before a dim `… +N lines (full output → context)` marker. DISPLAY-ONLY: the model always receives the full output (subject to the `tool_output` truncation caps) — only the scrollback rendering collapses. Set `0` to restore the old full dump.
 - `display.input_max_rows` (default `8`) caps how many visual rows the chat input grows to as a long or multi-line prompt wraps; past the cap the input scrolls vertically, keeping the caret row in view.
+- `display.live_markdown` (default `true`) renders the still-streaming (in-flight) block as FORMATTED markdown in the live region — bold, headings, lists and code style as the tokens arrive, with syntax left open by the partial stream repaired (an open code fence shows as a code block, a dangling `**`/`` ` `` span is closed) so no raw marker leaks. Set `false` for the legacy raw rolling-tail that only snaps to styled when the block commits. Display-only; the committed scrollback render is identical either way.
+- `display.synchronized_output` (default `true`) wraps each live-region frame in DEC private mode 2026 (BSU/ESU synchronized output) so a supporting terminal (kitty, WezTerm, tmux ≥3.4, recent xterm.js) buffers the whole clear→commit→redraw sequence and swaps it in one atomic update — no flicker or tearing on multi-step repaints. Terminals without support silently ignore the mode (it degrades cleanly); the escapes are emitted only to a real TTY. Set `false` for the legacy per-write frames.
+- `display.code_highlight` (default `true`) syntax-highlights fenced code blocks by language (via Rouge) in the COMMITTED render — the live tail stays unstyled, so highlighting never blocks the stream (code shows instantly, colours arrive a beat later when the block commits, like Claude Code). Unknown languages, language-less fences, and any failure fall back to the plain code body. Set `false` for plain (uncoloured) code blocks.
+- An **unterminated** code fence at end-of-stream — a fence the model never closed, or closed with a too-short bare run of backticks (e.g. MiniMax-M3 emitting `` against a ``` opener) — is rendered as a code box, matching CommonMark's end-of-document auto-close (§4.5) that every other renderer relies on. The CLI synthesises the close at the opener length (never relaxing the "close ≥ opener" rule), because kramdown does not auto-close an open fence.
 - `paste.collapse_lines` (default `5`) — the file-backed paste pipeline's first tier. Pasting MORE than this many lines into the chat input inserts a single cyan `[Pasted text #N +M lines]` placeholder instead of flooding the composer; the placeholder is one editable token (backspace deletes it whole, you can type around it, it survives ↑ draft recall and Alt+Enter queueing) and expands to the full pasted body when the message is sent — the model sees everything, while the transcript echo keeps the compact placeholder. Pastes at or under the threshold inline as real rows, exactly as before.
 - `paste.file_threshold_tokens` (default `8000`) — the second tier. A paste estimated above this many tokens (chars/4, the same rule compaction uses) is written to `<RUBINO_HOME>/sessions/<session-id>/paste_N.txt` instead of being held inline, and the sent message carries `[Pasted text #N saved to <path> — too large to inline; read it with the read tool]` so the model reads just the parts it needs. The files persist for the session; `/clear-images` does not touch them (it only drops staged image attachments).
 
@@ -303,7 +310,6 @@ tasks:
   max_children_per_node: 3       # max LIVE direct children per node
   max_concurrent_total: 8        # hard ceiling on total LIVE subagents across the tree
   max_live_probes_per_child: 5   # per-child budget for billed live probes (probe(live: true))
-  ask_parent_timeout: 900        # vestigial: governed the removed child→parent ask channel; no effect now
 ```
 
 ### tools
@@ -657,13 +663,14 @@ agents:
     mcp_servers: []
 ```
 
-### server / api
+### api
 
-```yaml
-server:
-  port: 4820
-  auth: false
+The API server's listen port and bind host come from the CLI, not config:
+`rubino server --port <n>` (or `RUBINO_API_PORT`, default `4820`) and `--host`
+(or `RUBINO_API_HOST`). The bearer token is `RUBINO_API_KEY`. The `api` block
+configures payload caps, rate limiting, and the public-bind gate:
 
+```yaml
 api:
   max_body_bytes: 5242880        # 5 MB cap on JSON request bodies (413 past this)
   max_upload_bytes: 52428800     # 50 MB cap on multipart uploads

data/docs/oauth-providers.md

@@ -1,5 +1,26 @@
 # OAuth provider connectors
 
+> **Status: NOT WIRED END-TO-END (WIP).** The pieces below exist and the HTTP
+> surface works — the `/v1/oauth/...` API endpoints perform the PKCE flow and
+> store **encrypted** tokens in the `oauth_connections` table. But the subsystem
+> is **API-only and not yet consumed**:
+> - **No tool uses the stored tokens.** Nothing reads `ConnectionRepository`
+>   outside the API operations — there is no `GithubTool`/`GoogleTool` etc. that
+>   pulls a connection's token to call a provider, so a connected account is not
+>   actually actionable by the agent yet.
+> - **No CLI surface.** There is no `rubino oauth` command; the connect/callback
+>   flow needs a browser redirect, so it lives only on the API. The CLI treats
+>   `RUBINO_ENCRYPTION_KEY` as optional (`doctor`: "only needed for the
+>   API/OAuth server").
+> - **Token sharing, when consumption lands:** tokens are not "passed" between
+>   CLI and API — both read the **same SQLite DB** (same `RUBINO_HOME`) and
+>   decrypt with the **same `RUBINO_ENCRYPTION_KEY`**. So wiring CLI consumption
+>   = read `ConnectionRepository` + require the key on the CLI too.
+>
+> Open design question (issue #590): finish the native subsystem, or deprecate
+> it and delegate third-party connections to an MCP server (which does its own
+> OAuth and holds its own tokens). Don't depend on native OAuth in production yet.
+
 Built-in OAuth integration lets users connect third-party accounts (Github, Google, etc.) so tools running inside rubino can act on their behalf.
 
 ## Design

data/lib/rubino/agent/prompts/build.txt

@@ -38,6 +38,13 @@ assume or default to one.
   map-reduces the file in a separate context and returns only the summary,
   so the raw text never fills this conversation. Reach for `read` (with
   offset/limit) or `grep` only when you need exact lines, not an overview.
+- Tool output may be COMPRESSED to save context — it is lossless to YOU: a
+  `# … N lines elided — read <path> offset=.. limit=..` pointer in a file read
+  means that exact body is one targeted `read` away, verbatim (so issue that
+  read before editing it). `[… N lines hidden by log compression …]` in command
+  output means only passing/info noise was dropped — every error/failure and the
+  final summary are kept. `{"_elided": N}` / `"<elided N chars>"` mark trimmed
+  JSON. These markers are NOT part of the file; never match or edit against them.
 - The `ruby` tool runs sandboxed Ruby for quick computation/scripting —
   reach for it when Ruby fits the project. Otherwise use `shell` for the
   host's binaries and the project's own toolchain (its interpreter, package

data/lib/rubino/api/operations/tasks/stop_operation.rb

@@ -31,9 +31,6 @@ module Rubino
             raise ConflictError, "task #{id} already #{entry.status} — nothing to stop" unless entry.status == :running
 
             entry.runner&.cancel!
-            # Stop-cascade (S5a): wake any descendant parked on a blocking
-            # ask_parent so the whole subtree unwinds at once.
-            @registry.cancel_descendant_ask_gates(id)
             [202, Serializer.detail(entry)]
           end
         end

data/lib/rubino/attachments/classify.rb

@@ -33,7 +33,6 @@ module Rubino
         application/x-7z-compressed application/x-rar-compressed application/vnd.rar
         application/x-bzip2 application/x-xz
       ].freeze
-      IMAGE_EXTS = %w[.png .jpg .jpeg .gif .webp .bmp .tiff .tif].freeze
 
       # Leading magic bytes per recognised image/document MIME (WebP is
       # special-cased: RIFF container + WEBP tag). Marcel lets the file NAME

data/lib/rubino/cli/chat/completion_builder.rb

@@ -62,7 +62,6 @@ module Rubino
           #   * /agents (alias /tasks) — the live subagent ids, then the
           #     steer/probe/--stop subcommand grammar, so the comm surface is
           #     discoverable from the composer (#39).
-          #   * /reply — the ids of children blocked waiting on the human.
           #   * /mcp — the configured server names (+ reload), then on/off for a
           #     named server (#182), same grammar shape as /agents.
           #   * /mode, /reasoning, /think — the closed enums (#185), via the
@@ -95,7 +94,6 @@ module Rubino
             "agents" => ->(args) { agents_arg_candidates(args) },
             "tasks" => ->(args) { agents_arg_candidates(args) },
             "agent" => ->(args) { args.empty? ? primary_agent_names : [] },
-            "reply" => ->(args) { args.empty? ? blocked_subagent_ids : [] },
             "mcp" => ->(args) { mcp_arg_candidates(args) },
             "mode" => ->(args) { args.empty? ? Rubino::Modes::ALL.map(&:to_s) : [] },
             "model" => ->(args) { args.empty? ? model_arg_candidates : [] },
@@ -148,12 +146,6 @@ module Rubino
           end
         end
 
-        # Children parked on an ask_parent waiting for the human — the ids /reply
-        # answers.
-        def blocked_subagent_ids
-          Tools::BackgroundTasks.instance.awaiting_human.map(&:id)
-        end
-
         # The /model candidates: the registry's model ids for the provider the
         # next turn would route through. Resolved lazily on each dropdown open so
         # a /model or /config provider switch is reflected immediately.