rubyn-code 0.2.2 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17b949375b6599cc1899caffd006f644a7292244982103608bfe31ad9146f549
-  data.tar.gz: 9c97ea6f5a1d73a91b220221b20f028833b86e7f6caa3904860e5000004f3fa9
+  metadata.gz: 1a3ef81b040a1c9a75050f2545f229ba69aa88808ced47ad5cc8634ea52f115c
+  data.tar.gz: 9020382400cdf70d332858a9b85c89e5aa4a90e07965709e8520a803273d43b2
 SHA512:
-  metadata.gz: 33bd180490d02c55def1d138ee8c71607c639ddb7f66f5fc05392e31bd41feead7bbf42d6224e67e36651410aeac6b67e55afc9522f965affc2787d91cc54967
-  data.tar.gz: a55628e9fb27d9de1c9822c6fc215820fa6b639d9f9fd6f4750b79f26ab31a09c59da8def39d391ba54f3bcbe92516973904b40260c81afe0b60017746eefa3b
+  metadata.gz: d7c2b95f2eec7e20e589c377784a2236f5ca7fa62402012358137a895f18e899e521ab2a3280854dda2376d515d906a40ad56dcc9c21d65062da6c9549a18912
+  data.tar.gz: cbb80d2749475054829c46aadd8ed5b7244d99f9d6ee05f73a0cd85618866e4e43881ae77e6718dbdcc6cced9e57222752b2a5c403185ae92a039a13da5105e1

data/README.md

@@ -80,7 +80,7 @@ bundle exec ruby -Ilib exe/rubyn-code
 
 </details>
 
-**Authentication:** Rubyn Code reads your Claude Code OAuth token from the macOS Keychain automatically. Just make sure you've logged into Claude Code once (`claude` in your terminal). Also supports `ANTHROPIC_API_KEY` env var.
+**Authentication:** Rubyn Code reads your Claude Code OAuth token from the macOS Keychain automatically. Just make sure you've logged into Claude Code once (`claude` in your terminal). Also supports `ANTHROPIC_API_KEY` env var. See [Authentication](#authentication) for OpenAI and other providers.
 
 ## Quick Start
 
@@ -142,7 +142,7 @@ Agent finished (23 tool calls).
 This is a Rails 7.1 e-commerce app with...
 ```
 
-## 28 Built-in Tools
+## 29 Built-in Tools
 
 | Category | Tools |
 |----------|-------|
@@ -157,6 +157,7 @@ This is a Rails 7.1 e-commerce app with...
 | **Context** | `compact`, `load_skill`, `task` |
 | **Memory** | `memory_search`, `memory_write` |
 | **Teams** | `send_message`, `read_inbox` |
+| **Interactive** | `ask_user` (ask clarifying questions mid-task) |
 
 ## 112 Best Practice Skills
 
@@ -323,6 +324,7 @@ rubyn-code --help             # Show help
 |---------|---------|
 | `/help` | Show help |
 | `/quit` | Exit (saves session + extracts learnings) |
+| `/new` | Save session and start a fresh conversation |
 | `/review [base]` | PR review against best practices |
 | `/spawn name role` | Spawn a persistent teammate |
 | `/compact` | Compress conversation context |
@@ -331,9 +333,13 @@ rubyn-code --help             # Show help
 | `/budget [amt]` | Show or set session budget |
 | `/skill [name]` | Load or list available skills |
 | `/resume [id]` | Resume or list sessions |
+| `/provider` | Add or list providers |
+| `/model` | Show/switch model and provider |
 
 ## Authentication
 
+### Anthropic (default)
+
 | Priority | Source | Setup |
 |----------|--------|-------|
 | 1 | macOS Keychain | Log into Claude Code once: `claude` |
@@ -342,6 +348,60 @@ rubyn-code --help             # Show help
 
 Works with Claude Pro, Max, Team, and Enterprise. Default model: **Claude Opus 4.6**.
 
+### OpenAI
+
+```bash
+export OPENAI_API_KEY=sk-...
+```
+
+Available models: `gpt-5.4`, `gpt-5.4-mini`, `gpt-5.4-nano`, `gpt-4o`, `gpt-4o-mini`, `o3`, `o4-mini`
+
+### Other Providers (Groq, Together, Ollama, etc.)
+
+Add a provider and its API key in one command:
+
+```bash
+/provider add groq https://api.groq.com/openai/v1 --key gsk-xxx --models llama-3.3-70b
+
+# For Anthropic-format proxies (e.g., Bedrock, custom gateways)
+/provider add my-proxy https://proxy.example.com/v1 --format anthropic --key sk-xxx --models claude-sonnet-4-6
+
+# Update a key later
+/provider set-key groq gsk-new-key
+
+# List configured providers
+/provider list
+```
+
+API keys are **encrypted at rest** using AES-256-GCM. The encryption key is derived from
+your machine identity (username, hostname, home directory) via PBKDF2, so keys are only
+decryptable on the same machine by the same user. Rubyn decrypts them automatically at
+runtime and re-encrypts on save — no manual steps required.
+
+Keys stored via environment variables (`GROQ_API_KEY`, `TOGETHER_API_KEY`, etc.) also work
+as a fallback if you prefer that approach.
+
+Or add directly to `~/.rubyn-code/config.yml`:
+
+```yaml
+providers:
+  groq:
+    base_url: https://api.groq.com/openai/v1
+    env_key: GROQ_API_KEY
+    models:
+      top: llama-3.3-70b
+  my-proxy:
+    api_format: anthropic        # 'openai' (default) or 'anthropic'
+    base_url: https://proxy.example.com/v1
+    env_key: PROXY_API_KEY
+    models:
+      top: claude-sonnet-4-6
+```
+
+Then switch with `/model groq:llama-3.3-70b`.
+
+Local providers (Ollama, LM Studio) running on `localhost`/`127.0.0.1` don't require an API key.
+
 ## Architecture
 
 16-layer agentic architecture:
@@ -362,25 +422,111 @@ Works with Claude Pro, Max, Team, and Enterprise. Default model: **Claude Opus 4
 │  Layer 5:  Skills (112 best practice docs, on-demand loading) │
 │  Layer 4:  Context Management (3-layer compression pipeline)  │
 │  Layer 3:  Permissions (tiered access + deny lists + hooks)   │
-│  Layer 2:  Tool System (28 tools, dispatch map registry)      │
+│  Layer 2:  Tool System (29 tools, dispatch map registry)      │
 │  Layer 1:  THE AGENT LOOP (while tool_use → execute → repeat) │
 └──────────────────────────────────────────────────────────────┘
 ```
 
 ## Configuration
 
+The `provider` and `model` keys at the top set the **default provider and model** used at startup.
+These must match a provider defined in the `providers` section (or a built-in like `anthropic`/`openai`).
+
 ```yaml
 # ~/.rubyn-code/config.yml (global)
-model: claude-opus-4-6
+provider: anthropic              # default provider on startup
+model: claude-opus-4-6           # default model on startup
 permission_mode: allow_read
 session_budget: 5.00
 daily_budget: 10.00
 
 # .rubyn-code/config.yml (project — overrides global)
-model: claude-sonnet-4-6
+provider: minimax                # this project uses MiniMax by default
+model: MiniMax-M2.7-highspeed
 permission_mode: autonomous
 ```
 
+### Multi-Provider Model Routing
+
+Rubyn can automatically route tasks to different AI models based on complexity. Simple tasks (file search, git ops) use cheap, fast models. Complex tasks (architecture, security review) use the most capable model. Configure per-provider model tiers in `config.yml`:
+
+```yaml
+# ~/.rubyn-code/config.yml
+provider: anthropic
+model: claude-opus-4-6
+
+providers:
+  anthropic:
+    env_key: ANTHROPIC_API_KEY
+    models:
+      cheap: claude-haiku-4-5      # file search, git ops, formatting
+      mid: claude-sonnet-4-6       # code gen, specs, refactors, reviews
+      top: claude-opus-4-6         # architecture, security, complex work
+
+  openai:
+    env_key: OPENAI_API_KEY
+    models:
+      cheap: gpt-5.4-nano          # lightweight tasks
+      mid: gpt-5.4-mini            # regular coding
+      top: gpt-5.4                 # complex reasoning
+
+  groq:
+    base_url: https://api.groq.com/openai/v1
+    env_key: GROQ_API_KEY
+    models:
+      cheap: llama-3-8b
+      mid: llama-3-70b
+    pricing:
+      llama-3-8b: [0.05, 0.08]    # [input_rate, output_rate] per million tokens
+      llama-3-70b: [0.59, 0.79]
+
+  ollama:
+    base_url: http://localhost:11434/v1
+    models:
+      cheap: llama3
+      mid: llama3
+      top: llama3
+```
+
+**How it works:** When you ask Rubyn to do something, the Model Router detects the task type and picks the right tier. If you've configured model tiers for a provider, those are used first. Otherwise it falls back to the built-in defaults (Anthropic for all tiers).
+
+| Tier | Task types | Default model |
+|------|-----------|---------------|
+| **cheap** | File search, git ops, formatting, summaries | `claude-haiku-4-5` |
+| **mid** | Code generation, specs, refactors, code review, bug fixes | `claude-sonnet-4-6` |
+| **top** | Architecture, security review, complex refactors, planning | `claude-opus-4-6` |
+
+You can also set custom pricing per model so `/cost` reports accurate spending for third-party providers.
+
+## Security
+
+### Credential Storage
+
+All provider API keys are encrypted at rest using **AES-256-GCM** (authenticated encryption).
+Keys are never stored as plaintext on disk.
+
+| Layer | Detail |
+|-------|--------|
+| **Cipher** | AES-256-GCM (authenticated — detects tampering) |
+| **Key derivation** | PBKDF2-HMAC-SHA256, 100,000 iterations |
+| **Machine binding** | Key derived from username + hostname + home directory |
+| **Salt** | Random 32-byte salt, generated once, stored in `~/.rubyn-code/.encryption_salt` |
+| **File permissions** | `tokens.yml` and `.encryption_salt` are `0600` (owner read/write only) |
+
+This means:
+- Keys copied to another machine or user account cannot be decrypted
+- The encryption key is never stored — it is derived at runtime
+- Plaintext keys from older versions are automatically encrypted on first read
+
+### File Permissions
+
+| File | Permissions | Contents |
+|------|------------|----------|
+| `~/.rubyn-code/` | `0700` | Home directory |
+| `~/.rubyn-code/tokens.yml` | `0600` | Encrypted API keys, OAuth tokens |
+| `~/.rubyn-code/.encryption_salt` | `0600` | PBKDF2 salt (not secret alone, but protected) |
+| `~/.rubyn-code/config.yml` | `0600` | Provider config (no secrets) |
+
 ## Development
 
 Requires Ruby 4.0+.

data/db/migrations/013_add_failed_status_to_tasks.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+# Expands the tasks CHECK constraint on status to include 'failed',
+# used by the GOLEM daemon to mark tasks that have exceeded max retries.
+#
+# SQLite does not support ALTER CONSTRAINT, so we rebuild the table.
+# The Migrator already wraps .up in a transaction — no manual BEGIN/COMMIT here.
+module Migration013AddFailedStatusToTasks
+  module_function
+
+  def up(db)
+    create_new_tasks_table(db)
+    migrate_data(db)
+    swap_tables(db)
+  end
+
+  def create_new_tasks_table(db)
+    db.execute(<<~SQL)
+      CREATE TABLE tasks_new (
+        id TEXT PRIMARY KEY,
+        session_id TEXT REFERENCES sessions(id) ON DELETE SET NULL,
+        title TEXT NOT NULL,
+        description TEXT,
+        status TEXT NOT NULL DEFAULT 'pending'
+          CHECK(status IN ('pending','in_progress','blocked','completed','cancelled','failed')),
+        priority INTEGER NOT NULL DEFAULT 0,
+        owner TEXT,
+        result TEXT,
+        metadata TEXT DEFAULT '{}',
+        created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ','now')),
+        updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ','now'))
+      )
+    SQL
+  end
+
+  def migrate_data(db)
+    db.execute(<<~SQL)
+      INSERT INTO tasks_new (id, session_id, title, description, status, priority, owner, result, metadata, created_at, updated_at)
+      SELECT id, session_id, title, description, status, priority, owner, result, metadata, created_at, updated_at
+      FROM tasks
+    SQL
+  end
+
+  def swap_tables(db)
+    db.execute('DROP TABLE tasks')
+    db.execute('ALTER TABLE tasks_new RENAME TO tasks')
+    db.execute('CREATE INDEX IF NOT EXISTS idx_tasks_session ON tasks(session_id)')
+    db.execute('CREATE INDEX IF NOT EXISTS idx_tasks_status ON tasks(status)')
+    db.execute('CREATE INDEX IF NOT EXISTS idx_tasks_owner ON tasks(owner)')
+  end
+end

data/lib/rubyn_code/agent/background_job_handler.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module RubynCode
+  module Agent
+    # Manages background job polling, waiting, and notification draining
+    # for the agent loop.
+    module BackgroundJobHandler
+      private
+
+      def wait_for_background_jobs
+        max_wait = 300 # 5 minutes max
+        poll_interval = 3
+
+        RubynCode::Debug.agent(
+          'Waiting for background jobs to finish ' \
+          "(polling every #{poll_interval}s, max #{max_wait}s)"
+        )
+
+        elapsed = poll_until_done(max_wait, poll_interval)
+        drain_background_notifications
+        RubynCode::Debug.agent("Background wait done (#{elapsed}s)")
+      end
+
+      def poll_until_done(max_wait, poll_interval)
+        elapsed = 0
+        while elapsed < max_wait && pending_background_jobs?
+          sleep poll_interval
+          elapsed += poll_interval
+          drain_background_notifications
+        end
+        elapsed
+      end
+
+      def drain_background_notifications
+        return unless @background_manager
+
+        notifications = @background_manager.drain_notifications
+        return if notifications.nil? || notifications.empty?
+
+        summary = notifications.map { |n| format_background_notification(n) }.join("\n\n")
+        @conversation.add_user_message("[Background job results]\n#{summary}")
+      rescue NoMethodError
+        # background_manager does not support drain_notifications yet
+      end
+
+      def pending_background_jobs?
+        return false unless @background_manager
+
+        @background_manager.active_count.positive?
+      rescue NoMethodError
+        false
+      end
+
+      def format_background_notification(notification)
+        return notification.to_s unless notification.is_a?(Hash)
+
+        status   = notification[:status] || 'unknown'
+        job_id   = notification[:job_id]&.[](0..7) || 'unknown'
+        duration = format_duration(notification[:duration])
+        result   = notification[:result] || '(no output)'
+        "Job #{job_id} [#{status}] (#{duration}):\n#{result}"
+      end
+
+      def format_duration(dur)
+        return 'unknown' unless dur
+
+        format('%.1fs', dur)
+      end
+    end
+  end
+end

data/lib/rubyn_code/agent/conversation.rb

@@ -126,66 +126,89 @@ module RubynCode
 
       # Ensure every tool_use block has a matching tool_result.
       # If a tool_use is orphaned (e.g. from Ctrl-C interruption),
-      # inject a synthetic tool_result so the API doesn't reject the request.
+      # inject a synthetic tool_result immediately after the assistant
+      # message that contains the orphaned tool_use.
       def repair_orphaned_tool_uses(formatted)
-        # Collect all tool_use IDs from assistant messages
-        tool_use_ids = Set.new
-        formatted.each do |msg|
+        orphaned = collect_tool_use_ids(formatted) - collect_tool_result_ids(formatted)
+        return formatted if orphaned.empty?
+
+        insert_orphan_results(formatted, orphaned)
+      end
+
+      # Walk backwards to find the assistant message containing each orphaned
+      # tool_use and insert a user/tool_result message right after it.
+      # -- walks messages to find insertion point
+      def insert_orphan_results(formatted, orphaned)
+        orphan_set = orphaned.to_a.to_set
+        insert_idx = find_orphan_insert_index(formatted, orphan_set)
+
+        results = orphaned.map do |id|
+          { type: 'tool_result', tool_use_id: id, content: '[interrupted]', is_error: true }
+        end
+
+        formatted.insert(insert_idx, { role: 'user', content: results })
+        formatted
+      end
+
+      # Find the index right after the last assistant message that contains
+      # any of the orphaned tool_use IDs.
+      def find_orphan_insert_index(formatted, orphan_set)
+        formatted.each_with_index.reverse_each do |msg, idx|
           next unless msg[:role] == 'assistant' && msg[:content].is_a?(Array)
+          return idx + 1 if assistant_has_orphan?(msg, orphan_set)
+        end
 
-          msg[:content].each do |block|
-            if block.is_a?(Hash) && (block[:type] == 'tool_use' || block['type'] == 'tool_use')
-              tool_use_ids << (block[:id] || block['id'])
-            end
-          end
+        formatted.length # fallback: append at end
+      end
+
+      def assistant_has_orphan?(msg, orphan_set)
+        msg[:content].any? do |block|
+          block.is_a?(Hash) && block_matches_type?(block, 'tool_use') &&
+            orphan_set.include?(block[:id] || block['id'])
         end
+      end
+
+      def collect_tool_use_ids(formatted)
+        collect_block_ids(formatted, role: 'assistant', type: 'tool_use', id_key: :id, id_str_key: 'id')
+      end
+
+      def collect_tool_result_ids(formatted)
+        collect_block_ids(formatted, role: 'user', type: 'tool_result', id_key: :tool_use_id,
+                                     id_str_key: 'tool_use_id')
+      end
 
-        # Collect all tool_result IDs from user messages
-        tool_result_ids = Set.new
+      def collect_block_ids(formatted, role:, type:, id_key:, id_str_key:) # rubocop:disable Metrics/CyclomaticComplexity -- iterates blocks with type+role guards
+        ids = Set.new
         formatted.each do |msg|
-          next unless msg[:role] == 'user' && msg[:content].is_a?(Array)
+          next unless msg[:role] == role && msg[:content].is_a?(Array)
 
           msg[:content].each do |block|
-            if block.is_a?(Hash) && (block[:type] == 'tool_result' || block['type'] == 'tool_result')
-              tool_result_ids << (block[:tool_use_id] || block['tool_use_id'])
-            end
-          end
-        end
-
-        # Find orphans
-        orphaned = tool_use_ids - tool_result_ids
-        return formatted if orphaned.empty?
+            next unless block.is_a?(Hash) && block_matches_type?(block, type)
 
-        # Inject synthetic tool_results for orphans
-        orphan_results = orphaned.map do |id|
-          { type: 'tool_result', tool_use_id: id, content: '[interrupted]', is_error: true }
+            ids << (block[id_key] || block[id_str_key])
+          end
         end
+        ids
+      end
 
-        # Append as a user message after the last assistant message
-        formatted << { role: 'user', content: orphan_results }
-        formatted
+      def block_matches_type?(block, type)
+        block[:type] == type || block['type'] == type
       end
 
       # Normalize content and tool_calls into a single array of content blocks.
       def normalize_content(content, tool_calls)
-        blocks = []
+        blocks = content_to_blocks(content)
+        tool_calls.each { |tc| blocks << block_to_hash(tc) }
+        blocks
+      end
 
+      def content_to_blocks(content)
         case content
-        when Array
-          content.each { |b| blocks << block_to_hash(b) }
-        when String
-          blocks << { type: 'text', text: content } unless content.empty?
-        when Hash
-          blocks << content
-        else
-          blocks << block_to_hash(content) if content.respond_to?(:type)
-        end
-
-        tool_calls.each do |tc|
-          blocks << block_to_hash(tc)
+        when Array  then content.map { |b| block_to_hash(b) }
+        when String then content.empty? ? [] : [{ type: 'text', text: content }]
+        when Hash   then [content]
+        else content.respond_to?(:type) ? [block_to_hash(content)] : []
         end
-
-        blocks
       end
 
       # Format message content for the API. Converts Data objects to hashes.
@@ -200,25 +223,30 @@ module RubynCode
 
       def block_to_hash(block)
         return block if block.is_a?(Hash)
+        return block unless block.respond_to?(:type)
 
-        if block.respond_to?(:type)
-          case block.type.to_s
-          when 'text'
-            { type: 'text', text: block.text }
-          when 'tool_use'
-            { type: 'tool_use', id: block.id, name: block.name, input: block.input }
-          when 'tool_result'
-            h = { type: 'tool_result', tool_use_id: block.tool_use_id, content: block.content.to_s }
-            h[:is_error] = true if block.respond_to?(:is_error) && block.is_error
-            h
-          else
-            block.respond_to?(:to_h) ? block.to_h : block
-          end
+        typed_block_to_hash(block)
+      end
+
+      def typed_block_to_hash(block)
+        case block.type.to_s
+        when 'text'
+          { type: 'text', text: block.text }
+        when 'tool_use'
+          { type: 'tool_use', id: block.id, name: block.name, input: block.input }
+        when 'tool_result'
+          tool_result_block_to_hash(block)
         else
-          block
+          block.respond_to?(:to_h) ? block.to_h : block
         end
       end
 
+      def tool_result_block_to_hash(block)
+        h = { type: 'tool_result', tool_use_id: block.tool_use_id, content: block.content.to_s }
+        h[:is_error] = true if block.respond_to?(:is_error) && block.is_error
+        h
+      end
+
       # Extract text from content blocks.
       def extract_text(content)
         case content