silas 0.1.1

data/lib/silas/registry.rb

@@ -0,0 +1,155 @@
+require "digest"
+
+module Silas
+  # Discovery by directory convention — no registration. Globs app/agent/,
+  # resolves tool classes through Zeitwerk, validates them at boot, and
+  # computes the definitions digest that guards against a deploy changing the
+  # agent mid-turn (NondeterminismError).
+  class Registry
+    def self.install!(root: Rails.root)
+      registry = new(root: root)
+      Silas.config.tool_resolver = registry.resolver
+      Silas.config.tool_definitions = -> { registry.definitions }
+      Silas.config.definitions_digest = -> { registry.digest }
+      Silas.config.skills = -> { registry.skills }
+      Silas.config.schedules = -> { registry.schedules }
+      Silas.config.channel_resolver = ->(name) { registry.channels[name] }
+      Silas.config.subagent_index = -> { registry.subagent_index }
+      Silas.config.subagent_scopes = -> { registry.subagent_scopes }
+      Silas.config.agent_override = nil
+      Silas.config.instructions_dir = nil
+      Silas.reset_agent_memo!
+      registry
+    end
+
+    def initialize(root: Rails.root)
+      @root = Pathname(root)
+    end
+
+    # tool_name => Class. Filename is identity; the class must match Zeitwerk's
+    # expectation for it (Agent::Tools::<Camelized>).
+    def tools
+      @tools ||= Dir[@root.join("app/agent/tools/*.rb")].sort.to_h do |file|
+        name = File.basename(file, ".rb")
+        klass = "Agent::Tools::#{name.camelize}".constantize
+        unless klass.ancestors.include?(Silas::Tool)
+          raise Error, "#{klass} (from #{file}) must inherit from Silas::Tool"
+        end
+
+        klass.validate_signature!
+        [ name, klass ]
+      end
+    end
+
+    def skills
+      @skills ||= Dir[@root.join("app/agent/skills/*.md")].sort.map { |f| Skill.parse(f) }
+    end
+
+    # Schedules by filesystem identity (subdirs included). Sorted so identity
+    # and compile order are deterministic. Deliberately NOT in #definitions or
+    # #digest — a schedule is a trigger, not a model-visible capability.
+    def schedules
+      @schedules ||= Dir[@root.join("app/agent/schedules/**/*.{md,rb}")].sort
+                         .map { |f| Schedule.parse(Pathname(f), root: @root) }
+    end
+
+    # name => Channel subclass. Filename identity, like tools. Also not in the
+    # digest — a channel is a trigger/transport, not a model-visible capability.
+    def channels
+      @channels ||= Dir[@root.join("app/agent/channels/*.rb")].sort.to_h do |file|
+        name = File.basename(file, ".rb")
+        klass = "Agent::Channels::#{name.camelize}".constantize
+        raise Error, "#{klass} (from #{file}) must inherit from Silas::Channel" unless klass < Silas::Channel
+
+        [ name, klass ]
+      end
+    end
+
+    # Built-in harness tools: load_skill when skills exist; delegate when
+    # subagents exist (root only — subagents never get delegate: depth-1).
+    def builtins
+      b = {}
+      b["load_skill"] = Silas::Tools::LoadSkill if skills.any?
+      b["delegate"] = Silas::Tools::Delegate if subagent_dirs.any?
+      b["run_code"] = Silas::Tools::RunCode if Silas.sandbox_enabled?
+      b
+    end
+
+    # Remote MCP tools from app/agent/connections/*.yml (warmed once at boot).
+    def connections
+      @connections ||= Silas::Connections.new(root: @root, client_factory: Silas.config.mcp_client_factory).warm!
+    end
+
+    def resolver
+      lambda do |name|
+        klass = tools[name] || builtins[name]
+        return klass.new if klass
+
+        connections.resolve(name) or raise Error, "unknown tool #{name.inspect}"
+      end
+    end
+
+    def definitions
+      (tools.values + builtins.values).map(&:schema) + connections.definitions
+    end
+
+    # Stable across boots for the same agent definition; changes when any tool
+    # schema (incl. the delegate roster + remote connection tools), or skill
+    # description, changes.
+    def digest
+      Digest::SHA256.hexdigest(JSON.generate({
+        tools: definitions,
+        skills: skills.map { |s| [ s.name, s.description ] }
+      }))
+    end
+
+    # --- subagents -----------------------------------------------------------
+
+    def subagent_dirs
+      @subagent_dirs ||= Dir[@root.join("app/agent/subagents/*")].select { |p| File.directory?(p) }.sort
+    end
+
+    def subagent_index
+      subagent_dirs.map do |dir|
+        name = File.basename(dir)
+        [ name, subagent_agent(dir, name).description ]
+      end
+    end
+
+    def subagent_scopes
+      @subagent_scopes ||= subagent_dirs.to_h do |dir|
+        name = File.basename(dir)
+        [ name, build_subagent_scope(Pathname(dir), name) ]
+      end
+    end
+
+    private
+
+    def subagent_agent(dir, name)
+      agent = Silas::Agent.load(dir: dir)
+      raise Error, "subagent #{name}: agent.yml must set `description`" if agent.description.blank?
+
+      agent
+    end
+
+    def build_subagent_scope(dir, name)
+      const_base = "Agent::Subagents::#{name.camelize}"
+      tools = Dir[dir.join("tools/*.rb")].sort.to_h do |file|
+        tname = File.basename(file, ".rb")
+        klass = "#{const_base}::Tools::#{tname.camelize}".constantize
+        raise Error, "#{klass} must inherit from Silas::Tool" unless klass.ancestors.include?(Silas::Tool)
+
+        klass.validate_signature!
+        [ tname, klass ]
+      end
+      skills = Dir[dir.join("skills/*.md")].sort.map { |f| Skill.parse(f) }
+      builtins = skills.any? ? { "load_skill" => Silas::Tools::LoadSkill } : {}
+      resolver = ->(n) { (tools[n] || builtins.fetch(n)).new }
+      definitions = (tools.values + builtins.values).map(&:schema)
+      digest = Digest::SHA256.hexdigest(JSON.generate(tools: definitions, skills: skills.map { |s| [ s.name, s.description ] }))
+
+      Silas::AgentScope.new(name: name, dir: dir, agent: subagent_agent(dir, name),
+                            resolver: resolver, definitions: definitions, digest: digest, skills: skills)
+    end
+  end
+end

data/lib/silas/sandbox/docker.rb

@@ -0,0 +1,67 @@
+require "securerandom"
+require "open3"
+
+module Silas
+  module Sandbox
+    # Interim adapter: shells to an ephemeral, locked-down `docker run` container
+    # (no network, read-only fs, dropped caps, no-new-privileges, memory/cpu/pid
+    # limits, host-side timeout). Weaker than a microVM — flag honestly. The argv
+    # is a pure function (unit-tested); the exec runner is injectable so the
+    # command building is testable without Docker present.
+    class Docker
+      TIMEOUT_EXIT = 124 # coreutils convention
+
+      def initialize(image:, network: "none", memory: "512m", cpus: "1", pids: 256,
+                     workdir: "/workspace", docker_bin: "docker", runner: nil)
+        raise SandboxError, "config.sandbox_image is required for :docker" if image.to_s.strip.empty?
+
+        @image = image
+        @network = network
+        @memory = memory
+        @cpus = cpus
+        @pids = pids
+        @workdir = workdir
+        @docker_bin = docker_bin
+        @runner = runner || method(:shell_capture)
+      end
+
+      def enabled? = true
+
+      def run(command, files: {}, timeout: 30)
+        if Silas::Ledger.in_transaction?
+          raise SandboxError, "sandbox exec inside a ledger transaction — sandbox-backed tools must be at_most_once!, never transactional!"
+        end
+        raise SandboxError, "files: is not supported in v1 (deferred)" unless files.empty?
+
+        name = "silas-sbx-#{SecureRandom.hex(6)}"
+        out, err, status = @runner.call(docker_argv(command, name: name), timeout: timeout, name: name)
+        Result.new(stdout: out, stderr: err, exit_status: status)
+      end
+
+      # Pure: command is a single argv element to `sh -c`, never interpolated into
+      # a shell string — no injection surface.
+      def docker_argv(command, name:)
+        [ @docker_bin, "run", "--rm", "--name", name,
+          "--network", @network,
+          "--memory", @memory, "--cpus", @cpus.to_s, "--pids-limit", @pids.to_s,
+          "--read-only", "--tmpfs", @workdir, "--workdir", @workdir,
+          "--cap-drop", "ALL", "--security-opt", "no-new-privileges",
+          @image, "/bin/sh", "-c", command ]
+      end
+
+      private
+
+      def shell_capture(argv, timeout:, name:)
+        reaper = Thread.new do
+          sleep(timeout)
+          system(@docker_bin, "kill", name, out: File::NULL, err: File::NULL)
+        end
+        out, err, status = Open3.capture3(*argv)
+        reaper.kill
+        status.termsig ? [ "", "sandbox timed out after #{timeout}s", TIMEOUT_EXIT ] : [ out, err, status.exitstatus ]
+      rescue Errno::ENOENT
+        raise SandboxError, "docker binary #{@docker_bin.inspect} not found on PATH"
+      end
+    end
+  end
+end

data/lib/silas/sandbox/null.rb

@@ -0,0 +1,17 @@
+module Silas
+  module Sandbox
+    # The default: code execution is off. run_code isn't even advertised to the
+    # model unless a real sandbox is configured, so this only fires on direct
+    # misconfiguration — and it fails loud (SandboxDisabledError is a Silas::Error,
+    # so the Ledger propagates it rather than silently failing the invocation).
+    class Null
+      def enabled? = false
+
+      def run(_command, files: {}, timeout: nil)
+        raise SandboxDisabledError,
+              "code execution is disabled (config.sandbox = :none). " \
+              "Set config.sandbox = :docker (and config.sandbox_image) to run untrusted commands."
+      end
+    end
+  end
+end

data/lib/silas/sandbox.rb

@@ -0,0 +1,15 @@
+module Silas
+  # A Sandbox runs a command in isolation and returns its captured output.
+  # Duck-typed like the engine seam: #run(command, files:, timeout:) -> Result,
+  # #enabled?. Default is Null (code execution off). :docker is the interim
+  # adapter — honestly weaker than eve's per-agent microVM (needs Docker present,
+  # container isolation not a VM), but real isolation for untrusted/model code.
+  module Sandbox
+    Result = Struct.new(:stdout, :stderr, :exit_status, keyword_init: true) do
+      def success? = exit_status.to_i.zero?
+    end
+  end
+end
+
+require "silas/sandbox/null"
+require "silas/sandbox/docker"

data/lib/silas/schedule/compiler.rb

@@ -0,0 +1,52 @@
+require "yaml"
+
+module Silas
+  class Schedule
+    # Discovery alone doesn't schedule anything: Solid Queue's scheduler reads
+    # config/recurring.yml at its own boot, and a running scheduler can't be
+    # appended to cleanly. So `bin/rails silas:schedules` compiles the discovered
+    # schedules into recurring.yml as a reviewable git diff — cron that fires
+    # real side effects stays explicit.
+    #
+    # Merge is key-scoped: only `silas_schedule_*` keys are managed. Hand-written
+    # entries (e.g. silas_dead_job_rescuer) are preserved.
+    module Compiler
+      module_function
+
+      MANAGED_PREFIX = "silas_schedule_".freeze
+
+      # { recurring_key => entry_hash } for the given schedules.
+      def render(schedules)
+        schedules.sort_by(&:name).to_h { |s| [ s.recurring_key, s.recurring_entry ] }
+      end
+
+      # Merge managed entries into recurring.yml under `env`, preserving
+      # everything else. Returns the written YAML string.
+      def write!(schedules, root:, env: "production")
+        path = root.join("config/recurring.yml")
+        doc = path.exist? ? (YAML.safe_load(path.read) || {}) : {}
+        doc[env] ||= {}
+        # Drop stale managed keys, then merge current ones.
+        doc[env].reject! { |k, _| k.to_s.start_with?(MANAGED_PREFIX) }
+        doc[env].merge!(render(schedules))
+        doc[env] = doc[env].sort.to_h
+        yaml = YAML.dump(doc)
+        path.write(yaml)
+        yaml
+      end
+
+      # Names present as files but not compiled into recurring.yml (and vice
+      # versa) — the doctor for `silas:schedules:list`.
+      def drift(schedules, root:, env: "production")
+        path = root.join("config/recurring.yml")
+        compiled = path.exist? ? ((YAML.safe_load(path.read) || {}).dig(env) || {}) : {}
+        compiled_keys = compiled.keys.select { |k| k.to_s.start_with?(MANAGED_PREFIX) }
+        discovered_keys = schedules.map(&:recurring_key)
+        {
+          uncompiled: schedules.reject { |s| compiled_keys.include?(s.recurring_key) }.map(&:name),
+          orphaned: compiled_keys - discovered_keys
+        }
+      end
+    end
+  end
+end

data/lib/silas/schedule.rb

@@ -0,0 +1,109 @@
+require "yaml"
+
+module Silas
+  # A schedule is a TRIGGER: it fires on a cron cadence and starts a normal,
+  # fully-durable turn. Two forms (eve's shapes):
+  #   .md with cron frontmatter — "task mode": the body becomes the turn input,
+  #     output discarded (fire-and-forget).
+  #   .rb subclassing Silas::Schedule::Handler — programmatic control (fan-out,
+  #     continue an existing session, conditional start).
+  #
+  # Identity is the filesystem path under app/agent/schedules (subdirs included):
+  # schedules/billing/sweep.rb -> "billing/sweep" -> Agent::Schedules::Billing::Sweep.
+  # Schedules are NOT model-visible capabilities, so they never enter the
+  # definitions digest — adding or removing one cannot diverge an in-flight turn.
+  class Schedule
+    KINDS = %i[task handler].freeze
+
+    attr_reader :name, :cron, :queue, :kind, :payload
+
+    def initialize(name:, cron:, queue:, kind:, payload:)
+      @name = name
+      @cron = cron
+      @queue = queue
+      @kind = kind
+      @payload = payload
+    end
+
+    def self.parse(path, root:)
+      rel = path.relative_path_from(root.join("app/agent/schedules"))
+      name = rel.sub_ext("").to_s
+      case path.extname
+      when ".md" then from_markdown(name, path)
+      when ".rb"
+        const = "Agent::Schedules::" + name.split("/").map(&:camelize).join("::")
+        from_handler(name, const.constantize)
+      end
+    end
+
+    def self.from_markdown(name, path)
+      content = File.read(path)
+      if content =~ /\A---\s*\n(.*?)\n---\s*\n(.*)\z/m
+        frontmatter = YAML.safe_load(Regexp.last_match(1)) || {}
+        body = Regexp.last_match(2)
+      else
+        frontmatter = {}
+        body = content
+      end
+      cron = frontmatter["cron"] || frontmatter["schedule"]
+      raise Error, "schedule #{name}: missing `cron:` frontmatter" if cron.nil?
+
+      new(name: name, cron: cron.to_s, queue: (frontmatter["queue"] || Silas.config.queue_name).to_s,
+          kind: :task, payload: body.strip)
+    end
+
+    def self.from_handler(name, klass)
+      unless klass.ancestors.include?(Schedule::Handler)
+        raise Error, "#{klass} (schedule #{name}) must inherit Silas::Schedule::Handler"
+      end
+      cron = klass.cron
+      raise Error, "schedule #{name}: handler must declare `cron` or `every`" if cron.nil?
+
+      new(name: name, cron: cron, queue: (klass.queue || Silas.config.queue_name).to_s,
+          kind: :handler, payload: klass)
+    end
+
+    # The only behavioural difference between the two forms.
+    def trigger!
+      case kind
+      when :task
+        Silas.agent.start(input: payload, metadata: { "trigger" => "schedule", "schedule" => name })
+      when :handler
+        payload.new(schedule: self).call
+      end
+    end
+
+    def recurring_key = "silas_schedule_#{name.tr('/', '_')}"
+
+    def recurring_entry
+      { "class" => "Silas::ScheduleJob", "args" => [ name ], "schedule" => cron, "queue" => queue }
+    end
+
+    # Base class for .rb handler schedules.
+    class Handler
+      class << self
+        def cron(expr = nil)
+          expr ? @schedule_expr = expr.to_s : @schedule_expr
+        end
+
+        def every(expr)
+          @schedule_expr = "every #{expr}"
+        end
+
+        def queue(name = nil)
+          name ? @queue = name.to_s : @queue
+        end
+      end
+
+      attr_reader :schedule
+
+      def initialize(schedule:)
+        @schedule = schedule
+      end
+
+      def call
+        raise NotImplementedError, "#{self.class}#call"
+      end
+    end
+  end
+end

data/lib/silas/skill.rb

@@ -0,0 +1,21 @@
+module Silas
+  # A flat markdown playbook with a description: frontmatter key — the
+  # description is advertised to the model; the body loads on demand via the
+  # load_skill tool (eve's progressive-disclosure mechanism).
+  Skill = Data.define(:name, :description, :path) do
+    def self.parse(path)
+      content = File.read(path)
+      description =
+        if content =~ /\A---\s*\n(.*?)\n---\s*\n/m
+          Regexp.last_match(1)[/^description:\s*(.+)$/, 1].to_s.strip
+        else
+          ""
+        end
+      new(name: File.basename(path, ".md"), description: description, path: path.to_s)
+    end
+
+    def body
+      File.read(path).sub(/\A---\s*\n.*?\n---\s*\n/m, "")
+    end
+  end
+end

data/lib/silas/slack.rb

@@ -0,0 +1,55 @@
+require "net/http"
+require "json"
+require "openssl"
+
+module Silas
+  # Thin Slack Web API helper — no gem dependency. Posting (chat.postMessage),
+  # approval Block Kit, and inbound request-signature verification.
+  module Slack
+    module_function
+
+    POST_MESSAGE = "https://slack.com/api/chat.postMessage".freeze
+    REPLAY_WINDOW = 300 # seconds
+
+    def post_message(channel:, text:, blocks: nil, thread_ts: nil, token: Silas.config.slack_bot_token)
+      raise Error, "no Slack bot token configured (credentials.silas.slack.bot_token)" if token.blank?
+
+      body = { channel: channel, text: text }
+      body[:blocks] = blocks if blocks
+      body[:thread_ts] = thread_ts if thread_ts
+
+      res = Net::HTTP.post(URI(POST_MESSAGE), body.to_json,
+                           "content-type" => "application/json; charset=utf-8",
+                           "authorization" => "Bearer #{token}")
+      JSON.parse(res.body)
+    end
+
+    # Approve/Decline buttons; the button value is the invocation id, so the
+    # actions webhook maps a click straight to invocation.approve!/decline!.
+    def approval_blocks(invocation)
+      [
+        { "type" => "section",
+          "text" => { "type" => "mrkdwn",
+                      "text" => "*Approval needed:* `#{invocation.tool_name}`\n```#{JSON.generate(invocation.arguments)}```" } },
+        { "type" => "actions", "block_id" => "silas_approval",
+          "elements" => [
+            { "type" => "button", "action_id" => "silas_approve", "style" => "primary",
+              "text" => { "type" => "plain_text", "text" => "Approve" }, "value" => invocation.id.to_s },
+            { "type" => "button", "action_id" => "silas_decline", "style" => "danger",
+              "text" => { "type" => "plain_text", "text" => "Decline" }, "value" => invocation.id.to_s }
+          ] }
+      ]
+    end
+
+    # Slack signs each request (v0 scheme) — HMAC-SHA256 over "v0:ts:body" plus a
+    # 5-minute replay window. Returns true only for a genuine, fresh request.
+    def verify_signature(signing_secret:, timestamp:, body:, signature:, now: Time.now.to_i)
+      return false if signing_secret.blank? || signature.blank? || timestamp.blank?
+      return false if (now - timestamp.to_i).abs > REPLAY_WINDOW
+
+      basestring = "v0:#{timestamp}:#{body}"
+      expected = "v0=" + OpenSSL::HMAC.hexdigest("SHA256", signing_secret, basestring)
+      ActiveSupport::SecurityUtils.secure_compare(expected, signature)
+    end
+  end
+end

data/lib/silas/step_runner.rb

@@ -0,0 +1,98 @@
+module Silas
+  # The idempotent body of one continuation step: at most one model call per
+  # (turn, index), replay feeds from rows, tool execution goes through the
+  # Ledger. Every path must be safe to run twice (crash replay) and safe to
+  # run in a fresh job (post-approval resume).
+  module StepRunner
+    module_function
+
+    # Returns :continue, :terminal, or :parked.
+    def call(turn, index)
+      step = Step.find_or_create_by!(turn: turn, index: index)
+
+      unless step.completed?
+        result = execute_model_call(turn, index)
+
+        # One transaction: the step's response, its terminal verdict, and the
+        # pending ledger rows commit together — or none of them do.
+        ApplicationRecord.transaction do
+          step.update!(
+            status: "completed",
+            response_blocks: result.blocks,
+            stop_reason: result.stop_reason,
+            terminal: result.terminal?,
+            model: turn_model(turn),
+            input_tokens: result.usage&.dig(:input_tokens),
+            output_tokens: result.usage&.dig(:output_tokens)
+          )
+          result.tool_calls.each do |tc|
+            ToolInvocation.create!(
+              step: step, turn: turn,
+              tool_call_id: tc.id, tool_name: tc.name, arguments: tc.arguments,
+              effect_mode: effect_mode_for(tc.name)
+            )
+          end
+        rescue ActiveRecord::RecordNotUnique
+          # A racing execution committed this step first; fall through to
+          # settle from the persisted rows.
+        end
+        step.reload
+      end
+
+      case Ledger.settle!(step, resolver: Silas.tool_resolver)
+      when :parked
+        park_turn!(turn, step)
+        :parked
+      else
+        step.terminal? ? :terminal : :continue
+      end
+    end
+
+    def execute_model_call(turn, index)
+      assert_definitions_unchanged!(turn)
+      engine = Silas.resolved_engine
+      context = {
+        turn: turn,
+        index: index,
+        system: turn.instructions_snapshot,
+        messages: MessageBuilder.call(turn, upto_index: index),
+        tools: Silas.tool_definitions,
+        model: turn_model(turn),
+        limits: { max_steps: Silas.agent.max_steps }
+      }
+      if (hook = Silas.config.around_model_call)
+        hook.call(context) { engine.execute_step(context) }
+      else
+        engine.execute_step(context)
+      end
+    end
+
+    # A deploy that changes tools/skills mid-turn must fail loudly, never
+    # resume into a different agent than the one that started the turn.
+    def assert_definitions_unchanged!(turn)
+      return if turn.definitions_digest.blank? || Silas.config.definitions_digest.nil?
+
+      live = Silas.config.definitions_digest.call.to_s
+      return if live == turn.definitions_digest
+
+      turn.finish!(:failed, reason: "definitions_changed")
+      raise NondeterminismError,
+            "Tool/skill definitions changed mid-turn (digest #{turn.definitions_digest[0, 12]}… → " \
+            "#{live[0, 12]}…). The turn was failed rather than resumed against a different agent."
+    end
+
+    def park_turn!(turn, step)
+      new_status = step.tool_invocations.reload.any?(&:in_doubt?) ? "in_doubt" : "waiting"
+      turn.update!(status: new_status)
+    end
+
+    def effect_mode_for(tool_name)
+      tool = Silas.tool_resolver.call(tool_name)
+      tool.respond_to?(:effect_mode) ? tool.effect_mode.to_s : "at_most_once"
+    end
+
+    def turn_model(_turn)
+      Silas.agent.model
+    end
+  end
+end

data/lib/silas/subprocess_runner.rb

@@ -0,0 +1,41 @@
+module Silas
+  # The engine-owned analog of StepRunner: it wraps one whole subprocess run in
+  # a single anchor Step and persists the durable result. Replay-aware and
+  # fail-closed — a resumed run whose subprocess got far enough to register a
+  # CLI session but did not finish is FAILED rather than re-spawned, because an
+  # engine-owned subprocess can't be replayed exactly-once (design risk #1).
+  module SubprocessRunner
+    module_function
+
+    # Returns :terminal or :failed.
+    def call(turn)
+      step = Step.find_or_create_by!(turn: turn, index: 0)
+      return :terminal if step.completed?
+
+      if turn.cli_session_id.present?
+        # A prior execution spawned a subprocess that never completed the step.
+        turn.finish!(:failed, reason: "agent_sdk_interrupted")
+        return :failed
+      end
+
+      result = Silas.resolved_engine.execute_step(engine_context(turn, step))
+      step.update!(
+        status: "completed", terminal: true,
+        response_blocks: result.blocks, stop_reason: result.stop_reason,
+        model: Silas.agent.model,
+        input_tokens: result.usage&.dig(:input_tokens),
+        output_tokens: result.usage&.dig(:output_tokens)
+      )
+      :terminal
+    end
+
+    def engine_context(turn, step)
+      { turn: turn, step: step, index: 0,
+        system: turn.instructions_snapshot,
+        messages: MessageBuilder.call(turn, upto_index: nil),
+        tools: Silas.tool_definitions,
+        model: Silas.agent.model,
+        limits: { max_steps: Silas.agent.max_steps } }
+    end
+  end
+end